MEMORY

Memory

One fact per file, indexed here. See the `self-maintenance` skill.

• [lead-drive-to-completion](lead-drive-to-completion.md) — take charge; drive work to done; decide coordination yourself, escalate only genuine product/authority forks.
• [run-aw-only-from-instance-home](run-aw-only-from-instance-home.md) — run aw ONLY from the instance home (repo root = grace, a different identity); never batch git+aw in one shell; "agent not found" is usually wrong-cwd, not a registry outage.
• [dont-reopen-converged-decisions](dont-reopen-converged-decisions.md) — once the team converges + commits on a functionally-fine choice, freeze it; don't re-open for a marginal detail; a coordinator flip-flop costs more thrash than the gain.
• [correctness-over-momentum](correctness-over-momentum.md) — optimize for getting it right, not activity; don't manufacture busywork to avoid idle; drive to done-RIGHT, slow the cadence, write+pressure-test high-risk plans before executing.
• [aweb-deploy-topology](aweb-deploy-topology.md) — app.aweb.ai IS ac's deployment; the aweb server is bundled into ac's release image from source; aweb changes ship via an ac v* release, not a separate aweb pipeline (deploy owner = ac-coordinator).
• [dont-assert-business-facts-messy-isnt-unneeded](dont-assert-business-facts-messy-isnt-unneeded.md) — don't assert pricing/roadmap/what's-needed facts (verify or ask Juan); and messy/unproven/sprawl ≠ unneeded — clean+consolidate needed machinery, don't cut it.
• [app-emit-path-binding-canonical](app-emit-path-binding-canonical.md) — app-emit signed path is mount-dependent + LOCKED: /api/v1/events/app hosted (ac mounts under /api; raw_request_target uses full-external raw_path), /v1 = standalone vector fixture; don't "fix" folio to /v1; the live emit is the empirical arbiter over coordinator theory.
• [awid-cert-controller-only-revoke](awid-cert-controller-only-revoke.md) — awid certs are deliberately controller-only for add AND revoke; the issuer_did_key column + revoke-broadening was investigated and SCRAPPED as YAGNI (2026-06-21); don't reopen unless member-mediated invites become scope; AC orphan bugs aabq.10/aabq.9 survive independently.
• [security-review-detector-narrowing-check-wrapped-forms](security-review-detector-narrowing-check-wrapped-forms.md) — when security-reviewing a scanner NARROWING (substring → structured regex), test serialization-wrapped forms (JSON/YAML quoted keys, quoted headers), not just bare assignment + edges; a name-then-delimiter regex misses quoted-name forms the old substring scanner caught. I missed exactly this on aabq.24; the dual gate caught it.
• [review-completeness-every-site-every-dimension](review-completeness-every-site-every-dimension.md) — before any review ACK, sweep 2 axes: (1) the fix's OWN stated purpose at every site, (2) the standard dimensions (deny? status? message? LOGS exc_info? tests?) as a checklist; enumerate sites mechanically. I anchored on one dimension and missed adjacent gaps twice in the aabq.23/.24 arc (federation.py logging; quoted-key).
• [regression-attribution-reproduce-read-actual-error](regression-attribution-reproduce-read-actual-error.md) — to attribute a regression, REPRODUCE + read the LITERAL first error before fixing; a bisect bounds the DELTA, not the COMMIT (suspect-by-name is a guess); raise the bar when the suspect is your own code. 2026-06-30 fed-e2e RC was 4c97715b (CLI accept-invite --global guard), NOT my aabq.23 503-coupling; reproducing caught it before I shipped a wrong fix.