---
name: blind-consumer-read-beats-author-checklist
description: "Gate consumer-facing docs by having the real consumer read them BLIND — never hand over the author's checklist; measured payoff 2026-07-20"
metadata: 
  node_type: memory
  type: feedback
  originSessionId: 650aa13f-e98d-4c25-995f-c75873b0b298
  modified: 2026-07-20T08:07:50.286Z
---

BINDING for any doc a blind integrator must build from (adapter surfaces, JSON contracts, CLI reference). **Acceptance = the consuming agent reads the page cold and reports what they still had to INFER. Do not hand them the author's requirement list.**

**Why (measured, TEARDOWN-AUTHORITY W4/W4b 2026-07-20):** doyle deliberately withheld the remaining doc requirements from perri. Results no author-side checklist could produce: the entry-kind provenance table pre-solved perri's live v0.25.2 miscount bug; their four inference gaps drove W4b, after which perri REARCHITECTED a shipped consumer (`--follow` deltas replaced a 15s poll; a hand-rolled `--last 12` scan dropped); the page corrected a wrong mental model they had built (open-turn re-delivery as livelock); and an OPTIONAL nit — "only the follow stream is line-delimited" — was independently reported as preventing a real bug ("I would have written ONE reader for both paths"). The author cannot un-know the answers, so only the blind reader can find the requirement the author never thought to impose.

**Re-read after EVERY change to the page, not once per wave** (adopted 2026-07-20 after three consecutive rounds each found a defect INSIDE the previous correction). A converging page is not a finished one; the clean read is the evidence of convergence and is worth having before publish.

**Corollary earned in round 3:** a rule stated as a LIST OF EXCEPTIONS is keyed on the cases someone happened to think of; state the PREDICATE instead and the unraised case is covered too. (doyle's "the pair is blind while a turn is partial" → todlando/perri's "the pair detects only changes that move a committed agent-produced seq", which covers injected-only changes on closed turns as well.)

**Strongest acceptance form when the consumer already has running code (adopted 2026-07-20): ask them to AUDIT THEIR IMPLEMENTATION against the page, not to review the page.** Prose review checks sentences; a code audit checks COMPOSITIONS. The dominant defect here was never a wrong sentence — it was *two TRUE facts left uncomposed* (perri's phrasing), which passes every review that examines sentences individually. That audit produced the round-4 retraction: perri found their shipped healer was safe BY LUCK (a guard written for transient digest misses happened to cover permanently-empty), and retracted a design our own page had invited by placing "poll unconditionally" and "run your own liveness timer" near each other without saying the poll cannot BE the timer.

**A blind read certifies a SHA, not a page.** If text landed after the read started, ask about that text explicitly — treating a clean read as coverage of bytes the reader never saw is the same silence-as-proof error as [[absence-needs-sibling-probe]].

**Review question that catches the dominant defect** (earned over instances 9-11, all the same shape): **for every rule the page states, ask what question it provokes — and whether the page answers that question in the same place.** Both late instances were rules whose obvious follow-up ("then how do I get what I need?") was answerable from facts already on the page, left uncomposed. A capability statement also needs its ELIGIBILITY boundary attached, or the ineligible reader hunts for a flag that does not exist.

**A certification is only as good as its premises: when a premise falls, RE-RUN the certification rather than keeping the verdict.** Three parties did this on one page in one day (doyle withdrew a blocks-release ruling, todlando withdrew a "safe" recommendation, perri withdrew their own clean certification of their healer). Nobody should have to ask — whoever learns the new fact owns the re-check.

**Reciprocity makes it an audit, not an approval queue.** 2026-07-20 the first correction traveled CONSUMER → BUILDER about our own CLI (perri corrected a false premise in doyle's ruling: `spt api --adapter` exists and is optional). Their stated reason — letting it slide would be poor form after seven rounds of us grounding their claims — is the relationship working. Standard adopted: **a true conclusion resting on a false premise does not get a pass because the conclusion happened to be right.**

**Named location for the "re-read statements keyed on the changed path" rule:** GROUP/module-level doc-strings above the item you edited. Nobody reads a struct's group comment while editing its field, so that is where a true statement goes to die quietly — `api/mod.rs` claimed `--adapter` was "required on every invocation" for three weeks after the field became `Option`, and it misled a reader (todlando) into a false claim.

**How to apply:** ask one question ("would you still have to infer anything?") plus an invitation to say if they now reach for something different; name the delta sections, attach nothing else. Put every requirement on the DOC, never into the tester's head. Weight nits by how the consumer will actually build, not by author-side severity. Related: [[perri-question-triage-protocol]], [[adapter-tips-published-docs]], [[teardown-authority-progress]].