# MEMORY REPAIR — what changed, 2026-07-20 Companion to [AUDIT.md](AUDIT.md). The audit said what was wrong; this says what was done about it. 94 files across 5 stores. **No file was deleted from disk. No git history was touched.** ## The rule applied **Memory now holds zero facts that can be looked up.** Rewriting stale facts correctly only restarts the clock — what rotted was *derivable* content copied out of `QUEUE.md`, `CLAUDE.md` + `rules/`, `library/CODE_MAP.md`, `CHANGELOG.md` and git. So that content was **deleted, not corrected**, and replaced where needed with a pointer to the source. What was kept, deliberately and everywhere: owner preferences and standing instructions · decisions and the REASONING behind them · what was tried and REJECTED and why · incidents that explain why a rule exists · how the owner wants to be communicated with · hard constraints. Where a file was mixed — most were — the derivable half was stripped and the reasoning kept. Every removal of a load-bearing false claim carries a dated italic correction note in the file itself. --- ## The three actively-harmful files | File | Was | Now | |---|---|---| | `robco-uos-project.md` | `APP_VERSION 2.6.0`, `Protocols 1–41`, `~1160 tests`, pointed at deleted `RULES.md`, "building 2.7.0" | Holds no version, protocol or count at all. Keeps the repo path, the never-bump-without-asking and never-`--no-verify` instructions, the `clients.claim()` ban, the cache-first "the fix isn't working = cached old code" gotcha, and the OneDrive/git-lock incident. Adds a look-these-up table. | | `robco-os-architecture.md` | **"Protocol 23 … has NO GATE GUARD"** — the stated justification for a prerequisite hardening gate | Corrected. Suite 236 (`tests/arch-conformance-check.js`) has enforced it since 2026-07-18 against a ratcheting baseline — verified in source, not taken from the audit. All shipped-state inventory and every measurement removed. All design philosophy and owner rulings kept. | | `unenforced_protocol_23.md` | An entire file resting on that dead claim | **Not deleted.** It did hold the reasoning, so the file now carries the durable ruling: when a rule and the code disagree, ENFORCE the rule, never reword it to match the code — plus why this one ranks highest for damage (a stray `saveState()` on a render path is data loss, not a lost afternoon). | `architecture-review-2026-07-13.md` carried the same false claim and got the same correction. --- ## Deleted — by class, with the reason Every item below was removed wherever it appeared, because a grep, a script or a file read establishes it: | Class deleted | Why it had to go | |---|---| | Version numbers, cache revs | `APP_VERSION` in source is the only truth; copies were 1–6 versions stale | | Test counts, suite counts, suite numbers | Meaningless by design since the count bookkeeping was retired; four *mutually contradictory* counts existed in one file | | Protocol numbers and lists | Renumbering silently invalidates every copy; rules are now described by subject instead | | "What has shipped / is built / is live" | `CHANGELOG.md` + git log; these were the single largest source of confident-but-wrong claims | | Measured code metrics (call sites, write counts, line counts, percentages, file sizes) | Same disease as the architecture doc's 40×-wrong file sizes; re-measure, never remember | | Roadmap and queue state | `QUEUE.md` is authoritative and re-sequenced; a second copy can only drift | | Architecture facts, file paths, function/symbol names | `library/CODE_MAP.md`; these also break on rename | | `RULES.md` citations | File deleted 2026-07-20. Remaining mentions are correction notes recording the deletion. | | Retired count-sync protocol citations | The protocol is gone; the citations argued for a dead rule | ### Files reduced hardest - **`project_state.md`** (Website-version) — **130 KB → 15.7 KB.** ~55 per-commit ship-log entries, four contradictory test counts, an `index.html` load order where every path was wrong post-reorg, and 45 lines documenting a test runner retired five weeks ago. Harvested first: every owner ruling, rejection, incident and hard constraint in it survives. Full log preserved in git history. - **`project_state.md`** (OneDrive store) — tombstoned to 5 lines. Dead path, every claim ~6 versions stale. Three invariants found nowhere else were **moved to the live store** rather than dropped: the `clients.claim()` black-screen ban, the world-map grid-sizing rule, and `.col-left { min-width: 0 }`. - **`roadmap-parked-placement.md`** — the whole item→round mapping went (that is `QUEUE.md`'s job). Only the placement *reasoning* survives. - **`parked-2-9-0-update.md`** — the 15-item slate went for the same reason; the merge/consolidation rulings and every dropped item's stated reason stayed. - **`parked-synthesis-masterplan.md`** — tombstoned. Its required inputs were never all produced, so it could never have run. --- ## Corrected | File | Correction | |---|---| | `robco-os-architecture.md`, `architecture-review-2026-07-13.md`, `unenforced_protocol_23.md`, `project_state.md` | Protocol 23 **is** enforced (Suite 236, since 2026-07-18) | | `parked-wasteland-uplink-engine.md` | `description:` said day/night REMOVED, body said re-instated — resolved toward the body; the owner reversed his own cut | | `parked-mistify-salvage-audit.md` | Header said CLOSED, last line said wait for explicit go — resolved toward the owner instruction, which outranks a header | | `post-2-8-0-brain-dump.md` | Claimed the dump landed at `library/Reference/CLAUDE_BRAIN_DUMP.md`; it landed at `library/BRAIN_DUMP.md` | | `backup_archive_repo.md` | Origin of the "6 stores / 164 files" error — all store and file counts removed as runtime output of `_CAPTURE_MANIFEST.txt` | | `backup-memory-topology.md` | "contains NO credentials (scanned 2026-07-18)" was reworded from a standing guarantee into a dated scan result, because a later audit found a token elsewhere | | `parked-ui-consistency-audit.md` | Rewritten as **OVERRULED** — see below | | `engineering-metrics-log.md` | Two open complaints (duplicate protocol docs, the PowerShell-runner bet) are resolved; kept as worked examples, not open items | | `reframing-review-2026-07-13.md` | Its argument to preserve the multi-file count-sync rule was overruled by the owner; kept as reasoning, marked not-a-live-instruction | ### The live contradiction, defused both ways `parked-ui-consistency-audit.md` wanted gate guards that **fail the build** when a panel deviates from a shared pattern. `parked-nv-overhaul-design-audit.md` records the owner's ruling that per-instrument variation is **"UNIQUE ON PURPOSE… Do NOT homogenize them."** Running the first as written would have violated the second. The brief is now an explicit overruled notice that cross-links the ruling and quotes it, and the ruling file records the conflict too. Only the three non-conflicting dimensions survive as possible future scope: **density, contrast, tap targets.** A future session hits the ruling before it can act on the guard proposal. --- ## Kept despite being flagged Conservative calls — flagged STALE or SUPERSEDED by the audit, kept because the reasoning is irreplaceable: - **`dispatch-session-launch-discipline.md`** — rated SUPERSEDED as dispatch-era tooling. Kept: it holds a stop-and-wait rule and the timeout-spawns-duplicate incident behind it. - **`session-management-rule.md`** — rated SUPERSEDED. The polling correction, the hard-reset clobber incident, the phantom-session root cause and two delegated-judgment rulings are all still live. - **`engineering-metrics-log.md`** — rated SUPERSEDED. Nearly all principle-level content is still true, including *never relay a session's dramatic finding as fact*. - **`design-overhaul-direction.md`** — rated STALE. Only the status wrapper had rotted; ~35 owner quotes and the whole charter are durable. Still the densest quote file in the archive. - **`parked-test-strength-audit.md`** — rated STALE. Its thesis (passing ≠ catching) is the most reusable content in its batch. - **`deep-systems-review-2026-07-13.md`** — every count deleted, every conclusion kept. - **`parked-deferred-work-program.md`** — the audit named two keepers; substantially more durable reasoning was found, so it is not a tombstone. - **`local-ai-delegation-verdict.md`** — kept in full in **both** stores, including the evidence numbers. A rejection without its evidence is useless. The two copies will now diverge; the audit's "worth one decision, not two" is still an open call. - **`always-acknowledge-actions.md`** — **untouched entirely.** Zero derivable content; pure communication preference. - **`robco-phase6-backlog.md`** — rated WRONG and un-actionable. The owner's standing instruction about how he wants deferred work handled was kept verbatim; the paraphrased task list was deleted deliberately, because a summary of a lost spec reads as actionable when it isn't. --- ## Found still true, or newly surfaced - **Both "OWED UNIT" amendments are genuinely still outstanding**, as the audit said. Now expressed as "verify the current wording against the source" rather than asserting it, and marked re-verified 2026-07-20. *"Until amended, the protocol still lies"* is preserved verbatim. - **The additive-only planning note is still owed** in `CLAUDE.md`. - **An unresolved owner decision the audit did not flag**, found inside `project_state.md`: inventory got the confirm-gated fix after the live data loss, but **squad, perks, quests, status, ammo and the trackers still share the same full-replace-from-AI shape.** It reads as deferred-and-forgotten, not stale. Now its own section. Given the incident, this is a live data-loss risk on six other paths. - **`parked-roadmap-rebaseline.md`** — the Web Workers ruling and the Dusk/Dawn re-add are both still open; now under a STILL OPEN heading instead of buried. - **`main` branch protection** — kept, but reworded from a fact into an **unverified** question: the required status check may still be pinned to a pre-matrix job name, which would block the next `dev`→`main` release. Not readable from disk; check Settings → Branches before the next release. --- ## The failure mode, named Two corrections came in after the first pass, and together they define what this repair was actually for. **1. App Check enforcement.** `appcheck-enforce-reminder.md` spent weeks telling every session that App Check was on MONITORING and to "flip to ENFORCE at ~90% verified." It had been enforced since 2026-07-01. Owner-confirmed. The file **was not wrong when written** — it simply never learned the work had happened, and **nothing in the system was ever going to tell it.** A memory that records a pending action has no way to notice the action was taken. That is the whole disease in one file: not error, but the absence of any path from "done" back to the note that asked for it. This is also why the file was kept rather than deleted. Stripped of the completed reminder, real non-derivable content remained: the reasoning for enforcing early while the verified-% still looked low (the average was dominated by stale clients auto-polling with an old key — waiting on the number meant waiting on strangers), the standing caveat not to generalise that call, and the staging-breakage incident that produced the **localhost-only debug-guard rule**. The token rotation now lives in `QUEUE.md`, which owns it and its museum-publication gating; memory points rather than restates. **2. The full-replace class — a self-inflicted one.** This pass flagged "full-replace-from-AI still live on six paths" as a data-loss risk. It was closed the same day across all eleven collections, with reconcile-and-confirm, per-path regression tests, and a static guard. The claim came from this file's then-stale wording and was **relayed without reading the source.** The import service still carries comments of the form `// The old \`state.squad = parsed.squad.map(...)\` full-replace…`, left deliberately to explain the reconcile logic beneath them. **Two rules fall out of that, and they are the ones worth keeping:** - **A comment describing a removed pattern is not the pattern.** Grepping for a shape and finding it in prose is not evidence the shape is live. - **Never relay a summary as a verified finding.** `engineering-metrics-log.md` already carried this rule — *never relay a session's dramatic finding as fact* — and this pass preserved it while breaking it. A subagent summarised a memory; that summary was reported as a live risk. Verify against executable code before asserting a data-safety problem. --- ## Security - **App Check debug token stripped** from `appcheck-enforce-reminder.md`. Scrubbing memory does not rotate it — **it still needs rotating in the Firebase console**, and it remains in git history here. - **Owner's email removed** from `deploy_branch_model.md`, replaced with `<owner email>`; the real value lives in the Cloudflare Access policy. The second source in `planning/` and the baked museum output are **not** addressed by this pass. - Verified by scan: neither string appears anywhere in any live memory store. - The Google OAuth client-secret remains correctly absent — memory records only its location and that it is deliberately not backed up. ## Index integrity All five `MEMORY.md` files rebuilt, one line per entry, no re-inflation. Verified mechanically: | Store | Files | Indexed | Orphaned | Dangling | |---|---|---|---|---| | `localmode-1060dea9-…` | 75 | 75 | 0 | 0 | | `project-C--Dev--GEM-Website-version` | 9 | 9 | 0 | 0 | | `project-C--Dev--GEM--robco-local-backup` | 3 | 3 | 0 | 0 | | `project-C--Dev--GEM-RobCo-AI` | 1 | 1 | 0 | 0 | | `project-C--Users-zerckzzy-OneDrive-…` | 1 | 1 | 0 | 0 | The main index previously orphaned 16 files that existed but were unreachable — including `queued-fixes.md` and the entire set of audit briefs. All are now indexed.