docs: address Q195 editor design review findings

BUILD-LOG.md

@@ -5181,3 +5181,5 @@ Before: managed project/thread verbs had no Console conversation area. After: fi
 2026-10-21T16:04:23Z | Q195/Q196 writing editor design, #1752 / Vikunja #448 | Before: row 154 edits Markdown in a separate Docs view, with no selected-word thesaurus or document pins. After: design draft on gyro/editor-design compares three editor approaches, records WordNet source/license/size, folds the pane/pin model and specifies guarded context/proposal APIs, DesignCraft handoff and seven proposed briefs. Q196 changes the basis to a Word-like interface. Verification so far: editor/provenance checks 10 pass, 1 explicit rebuild skip (pinned esbuild absent); brief fields, unique headings and 11-line checklist checked. Product, queue and live state unchanged. WordCraft scratch evaluation is being incorporated before publication. Review and Jason choices remain open.
 
 2026-10-21T16:22:36Z | Q195/Q196 design verification, #1752 / Vikunja #448 | Folded Fenton 7caf8008b and Louie 880ef19e0. Recommend bounded O3: Word-like DOM editor plus isolated headless DOCX export, with explicit feature cut and semantic loss checks. WordCraft web 44,179,239 bytes, identical twice; measured comment/footnote conversion limits recorded. Seven briefs and 12-line checklist validated. Fresh editor/provenance: 10 pass, 0 fail, 1 explicit rebuild skip (esbuild 0.28.2 absent). CI queue guard identity gyro/purpose push returned documented degraded-pass (exit 0), CANNOT_ASSERT credential-unresolvable, scratch audit gyro-q195-ci-queue-audit.jsonl; no fallback or CI-green claim. Documentation-only candidate for Mos/Fenton review, no source, queue or live changes.
+
+2026-10-22T16:06:34Z | Q195/Q196 design review fixes, #1752 / Vikunja #448, mos-1300 / fenton-0004 | Before: draft 105811400 had owner-only thread wording, stale source positions, two mismatched seat/model assignments, an assumed library save boundary and 12 owner questions. After: grant-aware pin validation and stale/revoked access redaction; references refreshed against aca16404c, including public/bus.js and README offsets; Sage assigns model-only seats; unimplemented library.file.save/C2-11b brief blocks book editing; tabs explicitly cover 62-76rem; J7 stricter context choice recorded; pronouns removed; six owner questions. Static docs/source-anchor checks only, no builds, product suites, MVP gate slot or live action. Fenton re-check pending; O3 and both companion folds retained.

docs/SESSIONS.md

@@ -1421,3 +1421,7 @@ are never rewritten or removed; corrections are new entries.
 2026-10-21T15:19:14Z | Sage (Opus 5.5, 1ef1e4f8) | MVP push 10-21 afternoon: rows 249, 197 proof 3/4, 222 singles, 66 r4d, queue-commit | 249 landed 9de5a57ab (+7b9737953 DEFERRED N1, #1751 closed, Vikunja 445 c442); 197 proof 3 rc=1 on a driver defect, Herb's fix a5b636750 to Webby, proof 4 set up in sage-r197p4; 222 singles 34/34 and 5 mutants killed (sage-2028); 66 round 4 in review (82c830779, c30083/30084); queue revs 2642-2904 committed 0636721e6
 
 2026-10-21T16:04:23Z | Gyro (T3 Codex gpt-6.1-sol) | Q195/Q196 design only, #1752 / Vikunja #448, gyro/editor-design | Code-measured writing-editor draft with three options, local thesaurus, pane/pins, guarded API/MCP, DesignCraft handoff and proposed briefs; queue next refused linked worktree, canonical next gyro returned nothing; no implementation or live actions.
+
+2026-10-22T16:02:06Z | Gyro (T3 Codex gpt-6.1-sol) | Q195/Q196 independent-review follow-up, mos-1300, Q220 | Recovered candidate 105811400 and current refactor aca16404c; canonical queue next gyro returned nothing; sent read-only reference drift map to Fenton, whose review is active. Design candidate left unchanged pending verdict. Docs-only fixes authorized on gyro/editor-design, no MVP gate slot.
+
+2026-10-22T16:06:34Z | Gyro (T3 Codex gpt-6.1-sol) | Q195/Q196 fenton-0004 F1-F8 docs fixes, mos-1300, #1752 / Vikunja #448 | Verified findings against aca16404c, retained O3, corrected grants/dependencies/model routing/folds/citations and reduced checklist to six; docs-only candidate for Fenton re-check, no product checks or MVP gate slot.

docs/plans/2026-10-21_q195-writing-editor.md

@@ -1,8 +1,10 @@
 # Q195 writing editor design
 
 Gitea #1752, Vikunja #448, DECISIONS Q168, Q177, Q194, Q195 and Q196. Design for review, not build
-authority. Measured against `origin/refactor` at `6c75887b0`. All repository line references below
+authority. Originally measured at `6c75887b0`, rechecked against `origin/refactor` at
-use that commit unless a different revision is named. Work is confined to `gyro/editor-design`.
+`aca16404c` for Fenton's fenton-0004 review. Repository line references use `aca16404c` unless
+a different revision is named. WordCraft and DesignCraft retain their separately pinned revisions.
+Work is confined to `gyro/editor-design`.
 
 ## Outcome and boundaries
 
@@ -10,7 +12,9 @@ D1. Give Melanie a familiar Word-like writing interface inside the Console. She
 selects a word for synonyms, and moves between documents without losing her draft or chat. Her
 corpus includes hundreds of .doc files, several .qxd books and recent Markdown. Obsidian is not the
 interface model. Ship a useful writing slice before legacy import. This add-on does not gate the
-October 27 Markdown-library MVP, which Q196 leaves unchanged.
+October 27 Markdown-library MVP, which Q196 leaves unchanged. Editor build gates are
+post-October 27 work and never take the gate slot ahead of MVP rows. Design and review
+continue now under Q220.
 
 D2. Q196 withdraws the earlier assumption that the current Markdown editor must be the solution.
 Compare all three options below. WordCraft's canvas/WebGPU browser UI
@@ -34,14 +38,14 @@ role changes, queue changes or access to `~/.mosaic-dev` is part of this assignm
 |---|---|
 | F1 | Row 154 landed as `9353675d1` (#1648). `packages/webui/editor/model.mjs:16-18` imports ProseMirror and markdown-it. `view.mjs:162` mounts the DOM editor with history, formatting, lists and a link bar. `model.mjs:1-14` and the serializer retain original blocks unless edited. Front matter and unsupported structures remain source blocks. This is the implementation to extend. |
 | F2 | The actual vendor path is `packages/webui/third_party/editor/`, relative to the WebUI package, not repository-root `third_party/editor/`. `PROVENANCE.json:1-13` records 170 files, 19 packages and no local changes. `NOTICE:1-10` names tagged source, hashes and license paths. `editor/build.mjs:16-24,34-56` aliases source and produces an unminified bundle with inline legal notices and hashes. `editor/BUILD.json:7-14` records 758,420 JS bytes and 4,462 CSS bytes. These are checked against bytes, not inferred from the README. |
-| F3 | `packages/webui/src/public/bus.js:868-887,925-927` keeps a shared Markdown draft and falls back to Source when exact round-trip fails. Redrawing destroys the editor. `editor/view.mjs:183-205` creates a new history on `setText`. The README's “Visual editor” section (`packages/webui/README.md:563`) records this limit. A writer needs a stable editor mount while chat polls. |
+| F3 | `packages/webui/src/public/bus.js:892-911,949-951` keeps a shared Markdown draft and falls back to Source when exact round-trip fails. Redrawing destroys the editor. `editor/view.mjs:183-205` creates a new history on `setText`. The README's “Visual editor” section (`packages/webui/README.md:572`) records this limit. A writer needs a stable editor mount while chat polls. |
-| F4 | Row 148's save is `POST /api/project-file`, with exactly `{project,path,base,content}` (`bus.js:975-986`, `serve.mjs:414-447`). Authentication, exact Origin, Fetch Metadata, strict keys and a 1 MiB request bound apply. `packages/project/src/index.mjs:244-260` restricts it to a human and refuses a changed file base. `paths.mjs:12-15` allows only `spec/north-star.md` and direct `docs/*.md`. This route cannot save book paths today. Do not widen its regexp to admit the vault. |
+| F4 | Row 148's save is `POST /api/project-file`, with exactly `{project,path,base,content}` (`bus.js:999-1010`, `serve.mjs:522-555`, keys :527 and handler :531). Authentication, exact Origin, Fetch Metadata, strict keys and a 1 MiB request bound apply. `packages/project/src/index.mjs:244-260` restricts it to a human and refuses a changed file base. `paths.mjs:12-15` allows only `spec/north-star.md` and direct `docs/*.md`. This route cannot save book paths today. Do not widen its regexp to admit the vault. |
-| F5 | The Console already has chat projects, named threads, message paging, send and explicit resume (`packages/webui/src/chat.mjs:19-27`, `public/chat.js:9-14,66-70`). Chat has its own route and render lifecycle (`public/bus.js:1100-1104`), so Docs and Chat currently replace each other. `chat.js:68` renders bodies as escaped text. There is no document pin in these structures. |
+| F5 | The Console already has chat projects, named threads, message paging, send and explicit resume (`packages/webui/src/chat.mjs:19-27`, `public/chat.js:9-14,66-70`). Chat has its own route and render lifecycle (`public/bus.js:1124-1128`), so Docs and Chat currently replace each other. `chat.js:68` renders bodies as escaped text. There is no document pin in these structures. |
-| F6 | Sessions are durable thread identity plus replaceable runs. Row 121 landed as `2c16d6b93` (#1615). `packages/bus/src/broker.mjs:479-525` tracks pending work, holder and idle release. `:3429-3451` creates an owned thread, and `:3468-3474` requests launch only on explicit open. Reuse thread IDs, never run IDs, for pins. Existing tester isolation is in rows 177/182 and `chat.mjs:1-4`. |
+| F6 | Sessions are durable thread identity plus replaceable runs. Row 121 landed as `2c16d6b93` (#1615). `packages/bus/src/broker.mjs:845-853` exposes thread state and idle release. Thread creation at `:5716-5728` checks FED R3 grants; open/send at `:5766-5780` also use `#grantedThread` (`:790-793`) after thread ownership checks. Open requests launch explicitly. Current chat uses the thread's default session; pins remain thread IDs, never individual runs. Existing tester isolation is in rows 177/182 and `chat.mjs:1-4`. |
-| F7 | C2-11a, row 214, owns `editor/model.mjs`, bundle output and editor tests (`docs/plans/2026-10-20_case2-rows.md:235`). It measures and preserves wikilink forms. All proposed changes under `editor/` wait behind it. C2-10b owns `public/bus.js`, its stylesheet, `serve.mjs` and WebUI tests (`:780`). It supplies cited items, scope badges and sync status. Our shared-file rows wait behind it and reuse its renderer. Neither brief proves that its feature has landed. |
+| F7 | C2-11a, row 214, owns `editor/model.mjs`, bundle output and editor tests (`docs/plans/2026-10-20_case2-rows.md:235`). It measures and preserves wikilink forms. All proposed changes under `editor/` wait behind it. C2-10b owns `public/bus.js`, its stylesheet, `serve.mjs` and WebUI tests (`:784`). It supplies cited items, scope badges and sync status. Our shared-file rows wait behind it and reuse its renderer. Neither brief proves that its feature has landed. |
-| F8 | Sage's input via mos-1179: row 220, C2-10a (#1721), makes the conversation reader hide creative sessions and refuse direct opens with `conversation-not-listed` (`case2-rows.md:517`). Row 198 (#1696) retires the 7331 board writer, currently referenced at `serve.mjs:12`. This design uses neither raw session files nor the board route. It does not depend on row 5 (waiting on Jason) or parked row 29. |
+| F8 | Sage's input via mos-1179: row 220, C2-10a (#1721), makes the conversation reader hide creative sessions and refuse direct opens with `conversation-not-listed` (`case2-rows.md:522`). Row 198 (#1696) retires the 7331 board writer, currently referenced at `serve.mjs:14`. This design uses neither raw session files nor the board route. It does not depend on row 5 (waiting on Jason) or parked row 29. |
 
-Verification: `node --test packages/webui/tests/editor-provenance.test.mjs
+Original draft verification at `6c75887b0`: `node --test packages/webui/tests/editor-provenance.test.mjs
 packages/webui/tests/editor.test.mjs` passed 10 tests with 1 explicit skip. The skip is the rebuild
 because pinned esbuild 0.28.2 is absent. The source tree, output hashes, licenses, route serving and
 exact round-trip tests passed. This is fixture evidence, not a live check.
@@ -86,9 +90,9 @@ assumption that the existing vault defines her needs.
 
 Louie's evaluation is pinned at `origin/louie/wordcraft-eval`, commit
 `880ef19e017dad0194ecc9921ae55a0cf2e8fef2`,
-`docs/plans/2026-10-21_q195-wordcraft-eval.md`. He built a scratch clone of WordCraft
+`docs/plans/2026-10-21_q195-wordcraft-eval.md`. Louie built a scratch clone of WordCraft
 `e05b7fe86f3b85454000dffc321de638d7009817` (0.9.0), with no source modifications.
-These are his measured results, not estimates or a claim that this combined design ran
+These are Louie's measured results, not estimates or a claim that this combined design ran
 the application in the Console.
 
 | Evidence | Measured result | Design implication |
@@ -110,7 +114,8 @@ on an embedded WordCraft response rather than the shell's existing `'none'`. A r
 integration could disable PDF preview, but must demonstrate the resulting narrower policy.
 The shell policy stays unchanged when only an editor response changes. Q167 D3 still
 requires Jason's ruling on that editor policy. No worker/GPU-specific CSP directive is
-needed for this build.
+needed for this build. The report's Console CSP reference was `serve.mjs:495` at
+`6c75887b0`; the identical policy is now `packages/webui/src/serve.mjs:605` at `aca16404c`.
 
 Pane fitting is a source-based inference: eframe 0.36.2 uses ResizeObserver on the canvas.
 Louie did not prove a functioning Console embedding, keyboard escape, browser startup
@@ -197,12 +202,14 @@ Markdown book folders, chapters, characters, summaries, locations, research and
 front matter keys `type`, `name`, `appears_in` and `relationships`. Only that structure is used
 here. `.base` and `.canvas` stay untouched and are not offered as editable documents.
 
-D5. Reuse C2-11b's library navigation and human `library.file` / `library.file.save` boundary, plus
+D5. Reuse C2-04's human-only `library.file` read (`packages/bus/src/broker.mjs:99,4610-4616`).
-C2-02's writer and C2-03b's push behavior. They are dependencies, not work hidden in a UI row. The
+The future `library.file.save` verb does not exist at `aca16404c`. C2-11b has no accepted
-Case 2 design, `origin/gosalyn/case2-design:agents/gosalyn/work/case2/DESIGN.md` section 7.3,
+brief yet (`docs/plans/2026-10-20_case2-rows.md:11-14`), and the Case 2 design
-already assigns these. A usable book-editing release waits for their reviewed write and sync
+(`origin/gosalyn/case2-design:agents/gosalyn/work/case2/DESIGN.md`, section 7.3) proposes
-semantics. Until then the new writing surface can be tested on `docs/` fixtures, but is not reported
+its navigation and save UI. C2-11b's brief, the future human save verb, C2-02's writer and
-as usable for Melanie's books.
+C2-03b's push behavior must be implemented and independently reviewed before W2 can ship
+book editing. They are explicit blockers, not an existing save boundary or work hidden in
+a UI row. Until then only `docs/` fixtures can exercise the new writing surface.
 
 D6. Keep one working editor with a collapsible file tree, heading outline, recent documents and a
 path/name filter. Opening a fixture such as `Lantern Book/Chapters/03 - Rain.md` uses the mapping's
@@ -367,10 +374,10 @@ remain outside this recommendation.
 ## Split pane, chat and pins
 
 D24. This section folds Fenton's pane, chat and pin design from `origin/fenton/editor-design` at
-`7caf8008b5887c15f74303a50db2e54a9778375f`, `docs/plans/2026-10-21_q195-pane-and-pin.md`. His
+`7caf8008b5887c15f74303a50db2e54a9778375f`, `docs/plans/2026-10-21_q195-pane-and-pin.md`. Fenton's
 separate work supplies the layout, durable thread pin and send-time context model. The following
 reconciles it with Q196, Case 2 paths and this brief's explicit sharing rules. It is design input,
-not his review approval of this combined document.
+not Fenton's review approval of this combined document.
 
 D25. On writing routes put the editor container, a divider and sibling `aside#chat-pane` under
 `main`. Navigation replaces the document container only. Embedded chat takes an explicit thread ID
@@ -386,9 +393,12 @@ clamp document/chat widths to 44rem/18rem and clamp again on resize. Below 76rem
 tabs, preserve both drafts and show reply counts without switching focus. Store width/collapse only
 in `mosaic-console-split`, with invalid values reset. No document text in browser storage. These are
 design sizes, not benchmark results. The compact O1 toolbar alternative uses 28rem/18rem and tabs
-below 60rem. Existing CSP stays unchanged for the recommended O3 headless-export mix.
+below 60rem. For the ribbon UI, tabs deliberately start at 76rem, including the entire
+62–76rem band where the two pane minimums alone would fit. That leaves room for navigation
+and avoids another intermediate layout. This deliberately replaces Fenton's E6 2.5rem chat
+rail in that band. Existing CSP stays unchanged for the recommended O3 headless-export mix.
 
-D27. Unpinned chat “Follows you” as documents change. A pin binds an owned bus thread UUID to a
+D27. Unpinned chat “Follows you” as documents change. A pin binds a bus thread UUID that passes current ownership and FED R3 grant checks to a
 document, never a harness run or session-file path. On A pinned to T1 and B pinned to T2, opening B
 shows T2, keeping each thread's draft/read cursor. A document without a pin restores the follow-you
 thread. Unpinning leaves the displayed thread following the user. Switching thread on a pinned
@@ -400,8 +410,11 @@ D28. Recommend durable pins on the bus, following Fenton's S6. Add
 `thread_pins(business,owner,project,path,thread,at)`, unique per business/owner/project/path, with
 `POST /api/chat/pins` → `thread.pin`, `DELETE /api/chat/pins` → `thread.unpin`, and `GET
 /api/chat/pins` → `thread.pins`, under the existing chat identity/write fences. Testers retain their
-own isolated pins, never the human's. Both document and thread must belong to the authenticated
+own isolated pins, never the human's. The pin belongs to its authenticated business/user.
-business and owner. For library documents validate the mapped path/scope through the library reader,
+`thread.pin` and `thread.pins` reuse `#grantedThread` after the existing thread ownership
+check, as open/send/messages do (`packages/bus/src/broker.mjs:790-793,5766-5780`). Ownership
+alone is insufficient. Pin operations never grant thread or document access. For library
+documents validate the mapped path/scope through the library reader,
 not row 148's narrow `documentPath`. Do not widen that existing function. Keep the thread's chat
 project separate from the writing repository identity and validate their declared association. Poll
 pin unread metadata separately from message bodies so background threads can get a badge without
@@ -409,7 +422,9 @@ rendering or waking them. Row 121's current API has no such metadata contract, s
 and test it rather than assume it exists.
 
 No automatic rename following. A missing path shows a stale pin and explicit Re-pin/Unpin controls.
-A missing/forbidden thread offers Unpin only and exposes no former content. Two tabs update pins
+A missing/forbidden thread or revoked/expired thread grant shows the stale-pin state,
+offers Unpin only and exposes no former content or unread metadata. The owner may remove
+that stale pin without regaining access to the thread. Two tabs update pins
 with a revision precondition, so an old tab cannot silently replace a new pin. The follow-you thread
 ID may live under an owner/business-scoped browser key and is cleared on sign-out. A pin confers no
 document permission or context sharing.
@@ -421,7 +436,8 @@ is mapped, caller/thread can read that scope, and both lines exist in that exact
 draft is dirty or mapping is uncertain, omit selection lines and label “Saved version only. Save to
 cite this selection.” Do not pretend draft offsets are saved line numbers. The agent uses existing
 approved library lookup tools and C2-06 citations, not session files or an expanded generic `read`
-root.
+root. `packages/project/src/paths.mjs:34-40` now refuses a library repository unless
+`allowLibrary` is explicit. Use the library reader and do not widen `documentPath`.
 
 Store structured context in `message_context` keyed to the message, kept apart from body and
 inserted atomically. `thread.send` accepts this optional strict field, and message reads return it
@@ -432,7 +448,7 @@ Jason's explicit schema/API approval. They grant no prose authority.
 D30. Fenton found C2-10b's file list names `bus.js`, while actual thread messages render in
 `public/chat.js:68`. Sage must amend that row's ownership/acceptance to include `chat.js` or a
 shared renderer before W3 starts. Otherwise cited JSON would reach the pane as plain text. C2-09a's
-brief also cites older broker positions. Re-measure against `broker.mjs:3429-3438` when building. No
+brief also cites older broker positions. Re-measure against `broker.mjs:5716` when building. No
 edits to those briefs or queue are made here. M7 and M8 remain intact, and neither row 5 nor row 29
 is a dependency.
 
@@ -465,7 +481,8 @@ delta.
 O2's DOCX selection cannot use Markdown line citations. A versioned document locator and C2
 guard/renderer support would need a separate reviewed format-policy brief. A DOCX path is not made
 legal by leaving `lines` out. Until that change is approved, rich-document agent context is
-disabled. Do not use paragraph indexes as if they were existing git lines.
+disabled. This deliberately replaces Fenton's J7 proposal to send DOCX context without
+lines. Do not use paragraph indexes as if they were existing git lines.
 
 ## Build order and review gates
 
@@ -495,9 +512,10 @@ dataset exists in the measured editor inputs.
 
 ### Owner and reviewer
 
-- Owner: Researcher in a T3 Codex gpt-6-luna seat (lower-level data import and converter).
+- Owner: a T3 Codex gpt-6-luna seat, assigned by Sage (lower-level data import and converter).
 - Reviewer: Fenton, Opus 5.5, independent of this implementation.
-- After: Jason's data-source confirmation. May start independently of C2 shared-file work.
+- After: Jason's first-slice approval. WordNet is the design's routine data-source choice.
+  May start independently of C2 shared-file work.
 
 ### Files owned
 
@@ -532,7 +550,8 @@ read/write path (F4, D5).
 
 - Owner: Gyro, Codex gpt-6.1-sol (editor lifecycle and selection handling).
 - Reviewer: Fenton, Opus 5.5, independent of the code.
-- After: W1, C2-11a row 214, C2-10b, and C2-11b with C2-02/C2-03b for usable book saves.
+- After: W1, C2-11a row 214, C2-10b, and C2-11b's future accepted brief and the unimplemented human `library.file.save` verb,
+  with C2-02/C2-03b for usable book saves. No acceptance claim until all are reviewed.
 
 ### Files owned
 
@@ -593,7 +612,10 @@ D28-D29, an idempotent versioned migration in the repository's existing migratio
 owned-pin revision checks, background unread metadata and atomic saved-message context. Tests refuse
 another user's/thread's/business's context, wrong scope, unreachable commit, missing file and
 out-of-bounds lines. Failed context insertion leaves no message. Pin tests cover tester separation,
-stale paths and concurrent repin refusal. No document text stored in the new context table.
+stale paths, grant revocation/expiry and concurrent repin refusal. `thread.pin` refuses an
+owned thread whose grant no longer covers it. `thread.pins` redacts thread content and
+unread metadata after revocation while permitting stale-pin removal. No document text
+is stored in the new context table.
 Migration/restore-count and bus tool allowlist tests remain green.
 
 ### Out of scope
@@ -614,7 +636,8 @@ supply the behavior to implement.
 
 ### Owner and reviewer
 
-- Owner: Dewey in a T3 Haiku 5.5 high seat (mid-level pane and state wiring).
+- Owner: a T3 Haiku 5.5 high seat, assigned by Sage (mid-level pane and state wiring),
+  separate from C2-10b's reviewer.
 - Reviewer: Fenton, Opus 5.5, independent of the implementation.
 - After: W2, W3a, C2-10b, C2-09a and row 220 C2-10a. Shared files wait behind those owners.
 
@@ -628,9 +651,9 @@ here.
 
 ### What ships
 
-D24-D31: a resizable accessible split pane that reuses the existing owned chat thread and C2-10b
+D24-D31: a resizable accessible split pane that reuses the existing grant-accessible chat thread and C2-10b
 cited-item rendering, retains editor selection/history during polling and follows the pin rules in
-D27-D29. Tests cover pin/unpin, two files, two tabs, removed/inaccessible thread, keyboard divider,
+D27-D29. Tests cover pin/unpin, two files, two tabs, removed/inaccessible thread, revoked/expired grant, keyboard divider,
 narrow viewport, reconnect/sign-out and navigation during delayed replies. No implicit `thread.open`
 on read or navigation. Existing chat tests remain green. The saved context chip uses W2's exact
 source mapping, and dirty drafts omit selection lines.
@@ -775,7 +798,7 @@ Sage accepts. No deploy or activation authority follows.
 
 Checked 2026-10-21T16:22:36Z (from `date -u`). Both companion branches were fetched and their
 report commits pinned above. Seven briefs have every BRIEF-TEMPLATE field, unique anchors
-and an independent implementation reviewer. The checklist has 12 lines. Only this design
+and an independent implementation reviewer. The initial checklist had 12 lines before fenton-0004. Only this design
 and append-only BUILD-LOG/SESSIONS records change. No product or queue files change.
 
 Fresh editor/provenance checks: 10 passed, zero failed, one rebuild skip because pinned
@@ -787,17 +810,26 @@ The push queue guard ran as `MOSAIC_GIT_IDENTITY=gyro` for `gyro/editor-design`,
 audit at `/mnt/storage/scratch/gyro-q195-ci-queue-audit.jsonl`. No identity fallback or guard
 bypass was used. CI status was not asserted. Fenton reviews the combined draft through Mos.
 
+## Review-fix verification receipt
+
+Checked 2026-10-22T16:06:34Z (from `date -u`) against `aca16404c`. Addressed fenton-0004 F1-F8:
+grant-aware pins and revoked-access redaction, refreshed source references, model-only
+seat allocation, the unbriefed save dependency, deliberate tabs below 76rem, the explicit
+J7 replacement, seat-name wording and six owner-choice questions. Additional reference
+refresh: `public/bus.js` moved by 24 lines, and the Visual editor README heading is at 572.
+The code behavior cited there is unchanged. The O3 recommendation and companion report
+measurements are unchanged. Fenton re-checks this revision before approval.
+
+Validation is static: current-source anchors, seven complete brief templates, six checklist
+lines, documentation-only diff and append-only logs. No build, product suite, gate-slot
+reservation or live action is part of this review fix. The earlier 10-pass/one-skip result
+above is the original draft's test receipt, not a new test run on `aca16404c`.
+
 ## Jason's checklist
 
-- Q1. Choose O3: Word-like DOM editor plus headless WordCraft DOCX export. Recommend yes for the first release.
+- Q1. Choose O3 with Markdown source, generated DOCX, and footnotes/comments/tracked changes/page layout deferred? Recommend yes.
-- Q2. Are footnotes, comments, tracked changes or page layout required in that first release? Recommend defer them, or choose O2 for a richer editor after its bridge is proved.
+- Q2. Ship writing controls, safe chapter saves and local WordNet synonyms first, after the Case 2 dependencies? Recommend yes.
-- Q3. Allow O2's scoped WebAssembly/CSP change if you choose it? Recommend no blanket exception and a separate security gate.
+- Q3. Store pins and saved-source message context on the bus through the reviewed schema/API change? Recommend yes.
-- Q4. Keep Markdown as the first editable git source, with generated DOCX for DesignCraft. Recommend yes, never two editable masters.
+- Q4. Share saved context only when Melanie enables the visible chip for that send? Recommend yes.
-- Q5. Ship writing controls, safe chapter saves and local WordNet synonyms first. Recommend yes, behind Case 2's shared-file rows.
+- Q5. Keep Q176, with no agent prose and no unsaved-draft reads? Recommend yes. Any later relaxation requires Accept/Reject and a separate Save.
-- Q6. Store pins and saved-source message context on the bus through the reviewed schema/API change. Recommend yes.
+- Q6 (O2 only, if Q1 is declined). Require a Q167 D3 CSP exception and rich-document citation design before O2? Recommend yes.
-- Q7. Pin by owner and document path, with explicit repair after a move. Recommend yes.
-- Q8. Share saved context only when Melanie enables the visible chip for that send. Recommend yes.
-- Q9. Keep saves explicit and unsaved drafts in the current tab initially. Recommend yes.
-- Q10. Permit agents to read unsaved drafts or propose new prose? Recommend no initially, retaining Q176 and cited corrections.
-- Q11. If proposals are enabled later, require Accept/Reject and a separate Save. Recommend yes.
-- Q12. If O2 stores DOCX, approve a separate rich-document citation and library-policy design? Recommend yes before agent context.