oficina / memoria Public

🤖 merge: main into the suite branch, and what the two lines disagreed about

Eighteen commits of main — the Notion connector, multi-file drop, draft 5
of the spec — against the suite strand. Seven files conflicted and the
prose ones were not mechanical: both lines rewrote §1's review history,
§4.1's S2 contract, §4.3's admission and §10's gate list.

WHERE MAIN WAS RIGHT AND THIS BRANCH WAS WRONG. Three places, all mine:

§2 said memoria holds "its own roster copy" four lines above main's
paragraph explaining that the owners list is not a roster and why calling
it one is the mistake. Main's distinction stands; ruling 4's pulled copy
is a third thing and now says so.

§4.2 said "memoria's own grants are authoritative". Main had already found
that memoria has neither members nor grants — the test is admission plus
presence, two facts, nothing else. Taken wholesale.

§6.5 said memoria "pulls the roster and fires a warm-up S2 on wake". Main
had corrected exactly that: S2 takes a person ref and there is nobody there
on a wake. The roster pull is fine (call 8 carries no asker); the S2 was
the same error draft 3 made and draft 4 fixed, reintroduced by me.

THE ONE REAL DISAGREEMENT, LEFT OPEN RATHER THAN DECIDED. Draft 4 cut a
fifth S2 value, AHEAD, for a sibling that is BEHIND memoria — its log stops
short of our revision, or it has no row at all. STALE means we are behind,
NOT_VISIBLE is silent and would delete history the sibling holds, and
UNKNOWN reports that nobody answered when the sibling did. Three wrong
homes, so a fourth value.

suite.Authorization has four constants, and revision 7 rules the case
UNKNOWN — on my word, given to the suite session from a branch that had not
read draft 4. So the wire shape is the contract's four, the loss is
recorded at the point of use and in §13, and it is raised with the suite as
a contract change rather than settled here. §1.10's lesson, one repository
over, with me on the wrong side of it.

GATE NUMBERING. Both lines added gates 22 to 27. Main's six are cited some
thirty times in its prose, so they keep their numbers and mine move to
28-33; §10 now runs 1-33 with no duplicates, and the Go tests follow. Gate
17 caught main's five connector routes on the way in, which is the gate
working: they could not reach the app until somebody declared them.

The egress gate keeps main's allowedNetworkDirs design rather than my
hardcoded path — a list with "exactly N" asserted, each exemption paid for
by a runtime guard the grep cannot perform. The sibling package is the
second entry and pays the same way.

One predicate, not two: main's owners/isOwner and my admits closure were
the same question answered twice inside one struct. Signin collapses back
to plain auth.

make ci green: vet, fmt-check, test, migration-check.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01H3VKtXnq6fSmM2F11Bjcsy