oficina / memoria Public

Final review: four surfaces outside the path, all found by review

Reviewed by Codex GPT-6-Astra (dispatched: codex/gpt-6-astra; self-
reported "GPT-6 (Codex)"). REQUEST CHANGES, three blocking. Every one is
a place content could leave, or a claim could be false, OUTSIDE the code
path §8.9 describes — which is why the reviews aimed at that path missed
them, and why a whole-branch review was worth running.

**Go's own logger quoted provider bytes.** With keep-alives on, net/http
reads idle pooled connections and reports unsolicited bytes with the
standard library's log.Printf — "Unsolicited response received on idle
HTTP channel starting with %q" — straight past every sanitised error in
the provider and the store. Reproduced by the reviewer over real TLS.
Keep-alives are off; the test captures the STANDARD logger, since that
is the channel, and goes red with them back on. A fresh handshake per
call is the cost.

**The footer said no document leaves, on every page, while one had.**
I updated the README and never opened the footer, and an existing gate
required the now-false wording. It now states the switch: with AI on it
names TensorX, the trigger and live search; with AI off the strong claim
stands and is true. My first draft of the AI-on sentence ended "Nothing
else leaves this instance" — the exact overclaim the footer's gate
documents (sign-in dials the address's domain), dodging its substring
check only by wording. Caught before commit; it says "No other document"
now. The test walks every declared GET route, the routes gate's own
list lifted to package scope, so a page cannot skip the claim — and it
found one I would have listed wrongly: /help/open-source renders an
empty footer on purpose, which makes no claim and is fine. Mutations
that drop ModelOn from one page each fail naming that page.

**Processing a response was unbounded.** The deadline covered the call
and not the work on its answer: 1,000 identical proposals in a response
under the cap took 6.8 s, after the deadline and uncancellable. One
deadline now covers both, checked per proposal; identical proposals are
validated once; the recognisers run once per passage. My first fixture
for this was split small by the chunker and passed against the OLD code;
it is now one 60 KB chunk, and the old behaviour fails it at 823 ms,
deadline-bounded. An early return past the cap was removed rather than
kept: with caching, its absence could not be made slow enough to see.

**Native search called the model for nothing.** Its response has no
field for facts, so it paid the latency and caused the egress without
receiving the address. SearchWithoutFacts: same ruling, no box, no call;
tested through the real native route with the web search as the
presence half.

Also closed: TLS is verified, with both halves — an untrusted
certificate reaches nothing, a trusted one works, through a roots seam
tests alone can reach; the provider deadline must be DeadlineExceeded,
which the store logs, not Canceled, which it silences; every passage
sent is checked at the stub, not only the second; and after thinning, a
pointer's index is into the thinned list — the mutation that looked it
up in the unthinned one cited a deleted document.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>