oficina / memoria Public

Slice 1's unblocked scope is built: the sibling contract, §4.1's ruling on every search, the S1 poll loop, §6.5's warm-up, and §8.1's refusal breaker with an owner-facing sources page. Thirteen commits on worktree-tensorx-provider, three independent reviews absorbed, every gate mutation-tested with the survivors chased down rather than argued away.

What is built

| Piece | Gate | |---|---| | S1 / S2 / S3 clients against the contract module | — | | §4.1's policy layer and §6.5's concurrent fan-out | 6, 23 | | Search routed through the ruling, structurally | — | | Sibling coordinates on documents (migration 0005) | — | | Roster config, every misconfiguration refused at boot | — | | S1 poll loop: a failed poll advances nothing (0006) | 7 | | Wake warm-up, asserted as presence not a race | 24 | | Refusal breaker + sources page (0007) | 8 |

Still blocked

Post-restore reconciliation, S1a's re-announce and the third breaker (gate 27) all need AHEAD in the contract module. §13 carries the dependency; TestAheadIsStillAShippingLag goes red on the day it lands and names what is then owed.

Two spec amendments, both because §8.1 disagreed with itself

The window is a UTC day. §8.1 mandates counters keyed per (sibling, asker, UTC day) and a "rolling 24-hour window". Two integers a day cannot answer a question about an interval starting mid-day, and there is nothing in the row to split on — that is the whole economy of storing an aggregate rather than the per-refusal log the section declines to build. The storage rule wins. The cost is a delay in firing at the day boundary, never a false positive.

The NOT_VISIBLE clause binds each counted asker, not the window. Read globally it is satisfied by one routine refusal of one Docs-only member, so a 24-hour outage plus that single query fires the refusal breaker — the exact case the prose says is excluded. §13 already carried this fix and §8.1 was amended without it being opened, which is this project's characteristic failure, committed in the act of repairing another one. Recorded in both sections.

Three things found that predate this work

1. rst-callout="danger" styles nothing. tokens.css carries the tone in a paired attribute — [rst-callout][rst-tone~="negative"] — so every flash message in this product has rendered as the right box in the wrong colour. Three tests pinned it there. Fixed, with a gate that reads selectors rather than grepping strings.

1. rst-btn="quiet compact" styles nothing either. The variants are primary, ghost, danger. Every button spelled that way renders as the default — the header nav, sign-out, the connector actions. Not fixed: which variant a "quiet compact" button should be is a visual decision, not a defect with one correct repair. Listed by name in the gate and left for Paul.

1. rst-cell-mut written as an attribute selects nothing. It is a utility, and tokens.css says utilities keep the class spelling. Every template does this. Same treatment: listed, dated, not silently swept.

What the reviews cost and bought

Three passes, all REQUEST CHANGES, 53 mutations between them of which 31 survived first contact. The ones that mattered were not style notes:

• Content fired S3 at ?item_id= where the module declares /suite/s3/{item_id} — every fetch would have 404'd against a conforming sibling and read as "not team-visible, or gone";
• the roster accepted <app>.<team> addresses the transport refuses on every call, and the documented example was one;
• a single empty item wedged a sibling's feed permanently;
• a revision bump on an identical body left the passage withheld forever;
• the breaker could be unwired from production with the suite green.

In each case a test agreed with the bug, because it was written from the same model as the code.