From the consolidation critique (self-review + an independent adversarial read of all notes), extended by the scenario walkthroughs (scenario-walkthroughs.md — entries #19+ promoted from its findings register). Status is one of: fixed (correction applied), decide (needs a product/values call), design (needs its own design task). Severity is as-found — how much the design's own promises depended on the defect (for #1–18, banded from the original severity ranking). This is the honest defect list — several of these were real errors in the design.
Re-derivability oversold. Replay re-applies frozen deltas — it reproduces the old extraction, it can't improve Layer 2. Evolving the schema needs a separate batched LLM re-extraction over Layer-1 narrative (undesigned, uncosted) — and that can't live in the "LLM-free projector."
Files projection-store.md, user-model.md
Severity high
Status fixed (split the two claims; re-extraction named as its own job)
OnboardingCompleted vs UserProfileCreated unreconciled + import gap. The event vocab conflicts; the import chunk carries "no history," so imported users land with zero Layer 2/3 and no rating — yet projection-store calls replay "the user-copy path."
Files event-sourcing.md, onboarding-interview.md, projection-store.md
Severity high
Status fixed — D42: UserProfileCreated basics-only; OnboardingCompleted sole interview carrier; import emits a ProfileImported snapshot (L1 + as-of-export L2) the projector seeds from; L3/rating env-local; interview required-by-default but decoupled from activation
Crypto-shred breaks "replay reproduces state exactly." A shredded user's PII is unreadable, so replay can't rebuild their state; projector-on-shred is unspecified; key-management ("TBD") actually blocks onboarding (first heavy-PII event).
Files event-sourcing.md, projection-store.md
Severity high
Status fixed (guarantee restated; projector tombstones; key-mgmt flagged as onboarding blocker)
Decay clock never pinned. Time-relative decay/recency makes replay non-deterministic and conflicts with workshop time-travel.
Files projection-store.md, workshop-mode.md
Severity high
Status fixed (anchored to event simulatedTime, never wall-clock)
No LLM seam in workshop/test. AI flows can't be stubbed → tests can't be fast and robots can't run. A Group-0 foundation gap.
Files workshop-mode.md, AI-flow notes
Severity high
Status fixed (LLM seam added; D37)
"Contributor rating informs, never dominates" is an unbacked promise. No bounded-influence mechanism exists, yet organiser trust, facilitator gating, and enforcement already depend on it.
Files contributor-rating.md, organizer-engagement.md, matching.md
Severity high
Status design→matching.md — bounded soft nudges capped below fit + exploration floor make "never dominates" structural; nudge caps need real-data tuning
Mutual-affinity co-suggestion is physically observable. If tapping "see again: Priya" makes Priya keep appearing at my events, I can infer she tapped back — the "who liked you" signal D21 forbids, and gameable.
Files debrief.md, user-model.md, matching.md
Severity medium
Status design→matching.md — reframed: remove our problematic influences, don't chase unobservability (real-world effects are inherently observable and that's fine); soft/noisy nudges for UX; popularity ≠ routing power
Cold-start inclusion is asserted, not solved. Matching leans on observed signal newcomers lack; crews concentrate co-suggestion among established users, crowding newcomers out. Benefit-of-the-doubt ≠ inclusion.
Files user-model.md, contributor-rating.md, debrief.md, matching.md
Severity medium
Status design→matching.md — fit-first ranking works cold; exploration + newcomer-injection floor into well-fitting rooms
"Positive ≠ popularity" defended only by "weakly." Affinity-received is popularity; any weight penalises the shy the facet exists to protect (the liking-gap).
Files contributor-rating.md, hypotheses.md
Severity medium
Status fixed — replaced raw affinity-received with the welcomer signal (generosity-normalized, newcomer-weighted; composition-only); raw capture retained (capture ≠ use); tracked as hypotheses H1–H3 with kill criteria (D40)
Dwelling-detection vs the zero-LLM fast path. Proactively offering reflection requires a model call the fast path forbids.
Files debrief.md, reflection-and-coaching.md
Severity medium
Status fixed — D44: a standing static "say more" door on every debrief close (no model call, always visible, spans self- and process-reflection) + explicit pull; proactive model-judged offers deferred pending evidence
Safety "quarantine" hand-waved. What preference signal is discarded on a conduct flag, and how, was undefined.
Files debrief.md
Severity medium
Status fixed (command suppresses that event's preference deltas; projector treats a flagged debrief as non-model-bearing)
event-sourcing.md stale. Lists async Streams projections as out-of-scope; omits OnboardingCompleted/DebriefRecorded/ReflectionRecorded/OrganizerDebriefRecorded.
Files event-sourcing.md
Severity medium
Status fixed (events added; async model-projection noted as the planned later phase)
Reflection copy breaks its own "no unprovable claims" rule — "honestly the most common thing we hear."
Files reflection-and-coaching.md
Severity low
Status fixed (copy made modest; voice guardrail added)
energy dimension has two incompatible shapes; novelty missing from one schema.
Files onboarding-interview.md, onboarding-prompt.md
Severity low
Status fixed (energy given {capacity, frequency}; novelty added)
Caching cost story self-contradicts — "~0.1×" vs. "no-op below 4096 tokens."
Files onboarding-interview.md, onboarding-prompt.md
Severity low
Status fixed (request-design row corrected)
Event policy is reactive-only; $20 cap has no unit. First attendees are always the canary; the covert-commercialisation watch is unspecifiable without a unit.
Files event-policy.md
Severity low
Status fixed — D34 updated: $20 per attendee, per event occurrence; no per-organiser dollar ceiling — pattern watch (frequency × amount × attendance → human review); proactive control = required cost disclosure at propose time (amount + what it covers)
do-not-interact differential leaks attendance. Avoiding co-placement is itself information → the stalking vector the principle forbids.
Files user-model.md, matching.md
Severity low
Status design→matching.md — avoidance = soft de-weight only, symmetric, never hard-remove
Structured-output wrong-branch has no fallback. A schema-valid {done:true} with no closing breaks the client.
Files onboarding-prompt.md
Severity low
Status fixed (server validates branch; retry/templated fallback)
Tap-spam manufactures mutual-affinity edges (walkthroughs F8). Generosity normalisation is specified only at the rating layer (welcomer signal); co-suggestion and crew seeding consume raw mutual edges — so tapping everyone converts every tap received into "the strongest signal the system gets" and seeds crews cheaply. Fix direction: apply tapper-generosity weighting wherever affinity edges are consumed, not only in rating (interpretation-layer; capture ≠ use already permits it).
Files matching.md, debrief.md, hypotheses.md
Severity high
Status fixed — D47: edges consumed strength-weighted (tapper-generosity, weaker-side combiner, co-attendance-confirmable); crew seeding accumulates weighted strength; capture stays raw; tracked as H4
Graduation is read per-group, masking the left-behind member (walkthroughs F9). "Crew went quiet = probable graduation" applied at group granularity reads all members as a success — including the one the crew graduated without, who is now exactly the least-served member the distributional stance exists for. The read must be per-member (individual affinity mutuality + individual trajectory + gentle self-report).
Files success-and-progress.md
Severity high
Status fixed — D48: per-member read (probable-graduation / left-behind / ambiguous) from own signal; left-behind joins the inclusion floor, never win-back, never surfaced; tracked as H5
Nudge-stack priority unspecified: guaranteed floors vs. soft de-weights (walkthroughs F6). When newcomer injection (a guarantee) collides with avoidance / didn't-click (soft de-weights) — e.g. the injected newcomer is someone another attendee named do-not-interact — nothing says which wins. Needs an explicit precedence rule in the ranking spec.
Files matching.md
Severity medium
Status fixed — D49: graduated precedence for the comfort tier (suggestion < injection < intimate composition; windowed floor; floor-debt to human review); protective blocks are hard constraints above the floor by construction (D50); tracked as H6
Protective-block mechanism undesigned; principles now fixed (D50). Safety-critical and carries legal exposure: presence-shielding across every surface (attendee lists, people steps, counts — an attentive blocked person comparing counts to heads), what the blocker may see of the blocked (safety need vs. reverse-surveillance by a false "victim"), mutual/contested blocks, interaction with enforcement and contributor rating, and the capture-time routing that gets a person in danger to the block tier without demanding disclosure.
Files matching.md, user-model.md, Group 4
Severity high
Status fixed — D52, designed in protective-blocks.md: rendered-world rule (counts adjusted, unconditional invisibility); ordinary-power blocker view with awareness/peace choice + itinerary alert; displacement handled (free yields, pattern watch); co-presence stated as the fiction's limit; block ≠ accusation; informed-choice roster for blocked organisers; env-local (D42 unqualified). Advocate validation planned before build
Injection floor unsatisfiable on a thin calendar; no fallback (walkthroughs F5). "Injection into well-fitting rooms" assumes such rooms exist; in a sparse week the floor silently fails. The corrective lever is event creation (surfacing unmet envelope demand to organisers / propose-your-own), which is outside the ranker and currently unlinked to it.
Files matching.md, organizer-engagement.md
Severity medium
Status fixed — D51: the supply loop is a standing function at every scale (continuous fit-gap read → aggregate demand surfacing → bar-free idea stage → bounded invitations → quality loop); the ranker never relaxes fit to fill the floor; tracked as H7
Coherent on one point worth stating: the debrief's frozen-deltas-in-the-event design (LLM extracts at command time, projector re-applies stored deltas) is replay-safe for the delta application itself. The determinism risk was the time-relative decay layered on top (#4), now fixed.