| 1 | # Adversarial review brief — memoria design spec, DRAFT 3 |
| 2 | |
| 3 | You reviewed **draft 2** in a previous session and returned REQUEST |
| 4 | CHANGES with one blocker and six findings, plus twelve verdicts on the |
| 5 | earlier round. Draft 3 claims to answer them. Check whether it did, and |
| 6 | find what is still wrong. |
| 7 | |
| 8 | **Under review:** `docs/superpowers/specs/2026-09-03-memoria-design.md` |
| 9 | **Measurements it now cites:** `docs/BENCHMARKS.md` |
| 10 | **Code that now exists:** `internal/memoria/` and `internal/memoriatest/` |
| 11 | — slice 0 is built, so some claims are checkable against an |
| 12 | implementation rather than only against prose. |
| 13 | |
| 14 | ## Your draft-2 findings |
| 15 | |
| 16 | - **B1 BLOCKER** — the ingestion contract contradicts the source apps' |
| 17 | instance-boundary rules. |
| 18 | - **B2** — S3 cannot perform the grants join it promises (no asker). |
| 19 | - **B3** — `NOT_VISIBLE` conflates denial with stale data. |
| 20 | - **B5** — the FTS measurement and the 150k ceiling cannot both describe |
| 21 | the stated corpus. |
| 22 | - **B6** — live authorization has no bounded availability design. |
| 23 | - **B7** — the gate suite does not enforce several claimed fixes. |
| 24 | - Plus PARTIALs on findings 1, 3, 5, 6, 9, 11, 12 of the previous round. |
| 25 | |
| 26 | For each, state **ANSWERED / PARTIALLY ANSWERED / REWORDED / |
| 27 | UNANSWERED**, with evidence. "Reworded" remains the verdict I most want |
| 28 | you to be willing to give. |
| 29 | |
| 30 | Note that draft 3 **concedes B1 rather than answering it** — it records |
| 31 | the blocker as not memoria's to close and says slice 1 is blocked on |
| 32 | agreement. Judge whether that concession is honest or whether it lets the |
| 33 | design proceed on an assumption it should not. |
| 34 | |
| 35 | ## Verify against, and do not trust the spec's characterisation of |
| 36 | |
| 37 | - `/home/paulca/amadan.net/oficina/sheets-core/AGENTS.md` |
| 38 | - `/home/paulca/amadan.net/oficina/sheets-core/PRODUCT.md` |
| 39 | - `/home/paulca/amadan.net/oficina/sheets-core/docs/superpowers/specs/2026-08-30-sheets-design.md` |
| 40 | - `/home/paulca/amadan.net/oficina/home/docs/superpowers/specs/2026-08-30-home-design.md` |
| 41 | - `/home/paulca/amadan.net/oficina/docs/docs/superpowers/specs/2026-08-30-docs-design.md` |
| 42 | |
| 43 | Quote binding rules; do not paraphrase them. |
| 44 | |
| 45 | ## New surface in draft 3 — attack these specifically |
| 46 | |
| 47 | 1. **Admission is now relayed from siblings** (decision 11, §4.3) via a |
| 48 | new S7 call, cached per session. Does that actually close the |
| 49 | membership hole, or move it? A session outlives a revocation by its |
| 50 | TTL — is that stated honestly and is the TTL bounded anywhere? |
| 51 | 2. **S2 is four-valued** with `STALE`, and the decoder is claimed total |
| 52 | (§4.1). Find a transport or protocol outcome with no defined mapping. |
| 53 | 3. **§8.7, numeric questions.** A new S6 call takes enumerated functions |
| 54 | over cell refs. Does anything let memoria become a formula author by |
| 55 | another route? Can the slot-resolution scheme produce a confidently |
| 56 | wrong number, or does it genuinely refuse? Does it introduce a leak |
| 57 | S1–S3 did not — S6 reveals which cells a person is comparing. |
| 58 | 4. **§6.5's availability contract.** 800 ms, concurrent, partial pages |
| 59 | normal. Is failing closed still guaranteed under every partial case? |
| 60 | 5. **§7's numbers are now measured** (`docs/BENCHMARKS.md` gives machine |
| 61 | and command). Check the arithmetic, and check what the benchmark does |
| 62 | NOT establish — the file admits a cycled corpus and unmeasured |
| 63 | bandwidth. Is the ~90–110k ceiling now supported, or merely |
| 64 | better-sourced? |
| 65 | 6. **§7.4's durable tombstone log** and the rule that a snapshot is not |
| 66 | retired while a restorable backup could reference it. Is there still |
| 67 | a restore ordering that serves deleted content, or that finds no |
| 68 | index at all? |
| 69 | 7. **The gates (§10), now 21.** For each claimed fix, is there a gate |
| 70 | that would fail if the fix were reverted? Gate 5 now demands two |
| 71 | people get different answers — is that enough? |
| 72 | 8. **The implementation.** `internal/memoria/` is real code. Does it |
| 73 | match what the spec says slice 0 does? Are the five gates in |
| 74 | `internal/memoriatest/gates_test.go` capable of failing? Note that |
| 75 | one earlier gate passed when the thing it guarded was deleted, and |
| 76 | was replaced for that reason — look for others of that shape. |
| 77 | |
| 78 | ## What I do not want |
| 79 | |
| 80 | Style feedback. Unverified findings. An over-broad kill. |
| 81 | |
| 82 | ## Output |
| 83 | |
| 84 | Part A: verdicts on the draft-2 findings, with evidence. |
| 85 | Part B: new findings — section, defect, evidence, BLOCKER/MAJOR/MINOR. |
| 86 | Part C: verdict, one paragraph. |
| 87 | Part D: re-review your own new findings; say which you would withdraw. |
| 88 | |
| 89 | State your exact model id at the top. |
| 90 | |
amadan