mosaicstack/stack
25
0 Fork 1
Code Issues 404 Pull Requests 13 Packages Projects Releases 15 Wiki Activity

docs: fix O2 review gates, shipping and save semantics

Browse Source
This commit is contained in:
jason.woltje committed 2026-10-22 18:10:14 -05:00
1 parent e012bab0be
commit 17a48a7782
3 files changed
+138 -41
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

docs/SESSIONS.md
+1
View File
@@ -1550,3 +1550,4 @@ are never rewritten or removed; corrections are new entries.
2026-10-22T17:55:40Z | Sage (Opus 5.5, 1ef1e4f8) | Row 253 landing; post-253 doc sweep | 253 LANDED 48e450ce8. Sweep on sage/sweep-253: Gosalyn Case 2 design and rows, 229 design, Gyro 0acbdb0d8, Della 179391055, 268 docs, seat dirs for Della, Scrooge, Huey, Louie and Ludwig, human-users-build:70 under Q173, DEFERRED 253 N1, 198 N2, row 203 text, 224 residual and 206 sharee list, and seat log lines.
2026-10-22 14:48 UTC | Researcher (Sonnet 5.5, 9bac0794) | Rows 220 and 216 resumed (sage-2708, sage-2716, sage-2719); local commits only | 220 e4a204836 on researcher/row220-r2 (on ea6dc9eff): C1 run tests, C2 default-reader M7 test, configDirectory fixture scope, BUILD.md round 2b. 216 4f3fbc25a on researcher/row216-r2 (on aca16404c): index cache, find/get/search/manuscript/universeInfo, PRD 1.14 levels. Nothing pushed, claimed or run; node --check not run. Waits for Sage's CLEAR and go; rebase onto 253 on a new branch before any gate.
2026-10-22T23:03:39Z | Gyro (Codex gpt-6.1-sol, mos-1356) | Q195/Q231/Q233 O2 design rewrite, gyro/editor-o2 from c4f77373f | Canonical queue next gyro: nothing. Ten docs-only briefs; full-feature WordCraft, independent 15-crate/199-package security review, editor-only CSP candidate, instant git DOCX saves and retained Markdown/wiki sources, committed-only DOCX citation gate, no agent story prose. Static structure/source-anchor/scope checks only; no code, build/run, queue or live change. Fenton review requested after push.
2026-10-22T23:09:38Z | Gyro (Codex gpt-6.1-sol, fenton-0006) | Q195 O2 design corrections on gyro/editor-o2 | F1 requirement boundary sent to Mos, adoption gated; F2-F6 source-checked docs fixes prepared. Ten briefs and two open owner items checked statically. No implementation, build/browser/worker run, queue or live action; Fenton re-check after push.
docs/plans/2026-10-21_q195-writing-editor.md
+131 -41
View File
@@ -130,13 +130,21 @@ Louie's existing generated artifacts establish the narrow candidate below. The g
HTML also contains an inline module bootstrap (`dist/web/index.html:9` in Louie's scratch
artifact). W2 externalizes that bootstrap and its styles into reviewed self-hosted files.
No `unsafe-inline` script exception, nonce exception or broad `unsafe-eval` is proposed.
No browser enforcement measurement or relaxed policy was run in this docs-only task.
No browser enforcement measurement or relaxed policy was run in this docs-only rewrite.
S0 must measure before Jason is asked: serve Louie's existing artifact in an isolated scratch
harness with an externalized, reviewed bootstrap, under the exact candidate response header.
Do not rebuild WordCraft or mount the Console/live stack for that check. Try style-src 'self'
first after CSS externalization. Drop 'unsafe-inline' if the measured canvas/UI needs none.
Record browser/version, artifact/wrapper hashes, full headers and all CSP violations while
loading, embedding, editing the full-feature fixture, resizing and exporting a snapshot.
S0 must reach zero violations with required functions intact, or report the actual failures
and hold the question. The final measured header supersedes this source-inferred candidate.
| Directive | Shell, unchanged | O2 iframe document only, proposed |
|---|---|---|
| default-src | `'self'` | `'self'` |
| script-src | `'self'` | `'self' 'wasm-unsafe-eval'` |
| style-src | `'self' 'unsafe-inline'` | `'self' 'unsafe-inline'` (no new allowance) |
| style-src | `'self' 'unsafe-inline'` | test `'self'` first; retain `'unsafe-inline'` only if S0's measurement proves necessary (no new allowance) |
| connect-src / font-src | `'self'` / `'self'` | `'self'` / `'self'`, only reviewed asset reads permitted by adapter code |
| object-src / base-uri | `'none'` / `'none'` | `'none'` / `'none'` |
| frame-ancestors | `'none'` | `'self'` |
@@ -160,13 +168,14 @@ on success and every refusal path. The frame is not mounted before the approval
## Rich storage, saves and the Markdown boundary
D10. Canonical editable O2 content is DOCX in git, including styles, sections/page layout,
D10. The default document unit is one DOCX per chapter, grouped by a book manifest.
Do not put a whole multi-chapter book into one default save ZIP. Canonical editable O2 content is DOCX in git, including styles, sections/page layout,
footnotes, comments and tracked changes. No Markdown-to-DOCX-to-Markdown save loop. Each
managed document has a stable document ID and manifest naming its canonical DOCX path,
source origin, format revision, current blob and commit. DOCX and manifest changes publish
atomically in one commit. They are not two editable masters.
D11. Existing Markdown remains byte-for-byte at its current path. Human adoption into O2
D11. Existing Markdown remains byte-for-byte at its current path. Human adoption into O2, gated by the open D12 decision and W4b PASS,
creates a DOCX working document in the separate O2 writing project and retains the original
Markdown, front matter and all wikilink forms as source evidence. The adoption manifest
records the source commit/blob/path and new document ID. The UI labels the old source and
@@ -176,6 +185,13 @@ master, rewrites its links, or claims the retained source is the current edited
The adoption adapter preserves `[[target]]`, `[[target|label]]`, `[[target#heading]]` and
embeds as exact literal text in the DOCX body, with source-token metadata in the manifest.
It must not rely on WordCraft's default Markdown exporter to reconstruct those bytes.
Match wiki tokens across adjacent DOCX runs, including formatting changes within a token.
W3b adoption and W4 extraction must test split-run tokens, not scan each run independently.
First release: literal wikilinks are clickable through the host's owned-document resolver;
unmapped targets display unresolved and never fall through to a file path or external URL.
The retained Markdown keeps Obsidian's original graph only. DOCX edits do not update that
graph, so its links become historical after adoption. This stale-source issue is part of
D12's open notice decision, not a claim of live Obsidian graph parity.
Front matter and unsupported source blocks are retained in the source, never discarded.
A fidelity report and a human confirmation precede adoption. A failed token/format check
refuses adoption and leaves the original untouched. Rich editing in the new DOCX does not
@@ -192,18 +208,44 @@ MVP reader/writer semantics and remain selectable in the existing library interf
Requirement boundary for Mos: making Case 2's existing library_get/library_manuscript or
supporting-doc writer follow an adopted DOCX, indexing DOCX as a `.md` story, or keeping a
live Markdown projection synchronized would change a Case 2 requirement. None is authorized
by this design. If shared-library integration is required instead of the separate O2 project,
Mos must take that requirement change to Jason before that integration is built. It is not
hidden inside a format-conversion row or added to today's CSP approval question.
by this design without a Case 2 amendment.
D13. Setting `editor.commitCadenceMs` is human-only in UI and CLI, default 0. Zero submits a
save after each completed document transaction, including comments, review changes, section
layout and undo/redo. IME composition commits only when the composition completes. A human
may choose a positive autosave delay; it changes when a save is submitted, never whether an
accepted save immediately commits. Ctrl/Cmd+S always flushes without delay. No save is held
for a later batch, a timer after acknowledgment, or an agent turn. Unchanged revisions are
already-saved status reads, not new save requests. There is no source or message text in logs.
OPEN with Jason as Q36 / Vikunja 562 (mos-1358, Fenton F1): leaving that original readable without a notice lets agents mistake
stale Markdown for the current chapter. Before W4b, the new current DOCX would also be
unavailable, contrary to Q226 F41's next-lookup availability. Recommendation: the O2 store
owns a superseded record `{sourceCommit,sourceBlob,sourcePath,documentId,adoptionCommit}`.
Case 2 library readers return a `superseded` notice with that record, and C2-06 displays it
on replies citing the old source. This notice behavior is not decided and must not be built
before Jason answers Q36. Keep original Markdown bytes unchanged.
Mos ruling, mos-1358: human adoption of a Markdown chapter stays refused until W4b passes.
This is settled build order within O2, separate from Jason's open notice decision. If Q36
approves notices, the reviewed notice path must also pass before that adoption workflow ships. Until this is resolved, do not adopt existing books
or present O2 as replacing the current Case 2 chapter workflow. Scratch/new-document fixtures
can exercise the human editor while this gate is closed.
These reader/reply changes alter Case 2 semantics and are a recommendation for Mos to take
to Jason, not authorized by this O2 brief. No row here owns the C2 reader/reply changes.
Sage adds their exact paths and acceptance through a separately approved brief amendment
only after that ruling. A synchronized Markdown projection is not an implicit fallback.
This open item remains alongside CSP in the owner checklist until Mos resolves it.
D13. Setting `editor.commitCadenceMs` is human-only in UI and CLI, default 0. Zero means
submit immediately when a save group closes, not on every keystroke. WordCraft coalesces
typing into an undo step (`crates/engine/src/session.rs:403-404`). Define a save group as
that undo group, closed by a non-typing mutation, cursor/navigation change, explicit Save,
a typing pause (human-only default 2 seconds), or a maximum active typing span (human-only
default 15 seconds). Timer checkpoints need not split the user's undo history. Complete
comments, review changes, layout changes and undo/redo close a group immediately. Finish
IME composition before sealing its group. No per-key serialization or git commit.
A human may choose a positive cadence delay after group closure. It changes submission,
never whether an accepted save commits immediately. Ctrl/Cmd+S flushes the current group
without delay. In-flight save snapshots are immutable; later groups queue in revision order.
The UI marks unsealed typing as unsaved, never Saved. No save waits for a later batch after
acknowledgment or for an agent turn. Unchanged revisions are status reads, not save requests.
No source or message text in logs. W3b measures the tradeoff rather than assuming compressed
DOCX commits delta efficiently.
D14. Every accepted save has immutable bytes, document ID, revision, expected base blob,
request ID and authenticated human identity. Serialize saves per document in revision order.
Under the git lock, compare the base, make one commit and advance the canonical served ref
@@ -326,7 +368,7 @@ A locator is immutable within its commit; after another commit, show stale and r
old quoted version, never auto-relocate a flag to similar text.
W4's separate reviewed design must fix the precise XML/relationship allowlist, paragraph
fallback, tracked-change reading view (default final accepted reading, source revision history
fallback, split-run wikilink matching, tracked-change reading view (default final accepted reading, source revision history
retained), footnote/comment ownership, quote verification, non-story supporting scopes,
authorization, paging, and denial of external relationships/macros/ZIP bombs. It must cover
source-like text inside comments and tracked deletions without treating it as instructions.
@@ -382,8 +424,9 @@ author the code. Fenton reviews this design and can review code only when not it
G1. Future code acceptance runs each touched test file independently and affected package
suites on Sage's slot after MVP priority, plus required repository checks. Source builds need
pinned tools, reproducible hashes, license/source manifests and independent review. Browser
proofs use scratch fixtures only, after the CSP ruling. Tests never use a live stack, private
pinned tools, reproducible hashes, license/source manifests and independent review. Integration browser
proofs use scratch fixtures only, after the CSP ruling. S0's pre-ruling scratch measurement
of the existing artifact is separate and precedes the exact-delta question. Tests never use a live stack, private
books or host credentials. These are future gates, not checks run for this docs rewrite.
## S0 independent WordCraft source security review
@@ -404,25 +447,33 @@ An independent source and trust-boundary review is a prerequisite, not a build s
`docs/reviews/2026-10-22_q195-wordcraft-security.md`,
`docs/reviews/2026-10-22_q195-wordcraft-security.json`,
`docs/reviews/2026-10-22_q195-editor-csp.md`.
`docs/reviews/2026-10-22_q195-editor-csp.md`,
`/mnt/storage/scratch/q195-csp-review/<review-id>/` (review-owned isolated harness/receipts).
### What ships
D6-D9's source/dependency/license inventory, native I/O/network analysis, mandatory adapter
restrictions, residual risks, source hash/feature manifest and verdict. The CSP report names
full old/new headers, affected response routes, baseline artifact hashes and disabled PDF
preview/inline-bootstrap mitigation. Distinguish source inference from browser proof.
preview/inline-bootstrap mitigation. Execute D8's isolated existing-artifact measurement
before the CSP question, including the narrower style policy trial. After preliminary source
safety review, run with fixture-only data, no credentials and no external network. Own the scratch harness
under `/mnt/storage/scratch/q195-csp-review/<review-id>/`; keep its source/hash/header/violation
receipts in the review report. No WordCraft compilation or Console policy change. Distinguish
source inference from actual browser evidence. Zero CSP violations and complete required
function coverage are necessary for a measured-policy recommendation.
Review all 15 crates, all 199 target dependencies and applicable fonts/build scripts/notices.
### Out of scope
Production code, a relaxed live policy, source imports, building the O2 integration, private
Production code, a relaxed live policy, source imports, compiling WordCraft/O2, private
files and an approval on Jason's behalf. No queued build row until this review passes.
### Gate
Sage records PASS only on both independent review reports with no unresolved blocker and
explicit required mitigations. Mos then asks Jason the one exact CSP question. A failure
explicit required mitigations and the pre-ruling measured header/zero-violation evidence.
Mos then asks Jason the exact CSP question. D12 remains a separate open Case 2 item. A failure
holds every O2 build row. Changed target dependencies or a wider CSP re-open this gate.
### Handoffs
@@ -447,12 +498,13 @@ WordCraft's 29-headword table is inadequate. O2 needs a local reviewed dataset a
`packages/webui/third_party/thesaurus/`,
`packages/webui/editor-data/{import-wordnet.mjs,build-thesaurus.mjs,BUILD.json}`,
`packages/webui/tests/thesaurus-data.test.mjs`.
`packages/webui/tests/thesaurus-data.test.mjs`, `packages/webui/src/public/thesaurus/`.
### What ships
D22's source text/license/provenance and deterministic derived data. Compare the pinned
archive hash, per-file hashes, Princeton license, counts and two converter outputs. A missing
archive hash, per-file hashes, Princeton license, counts and two converter outputs. Runtime
data goes under shipped `src/public/thesaurus/`; source/converter folders are build inputs only. A missing
license, changed source, malformed record or unexplained count change refuses the build.
### Out of scope
@@ -498,7 +550,9 @@ vendor input. Build offline from reviewed sources with pinned Rust/Cargo 1.99.1,
wasm-bindgen 0.2.129 and wasm-opt 131, plus tool binary hashes. External bootstrap and CSS
replace generated inline markup. Record every input/output hash, size and tool version.
Two different absolute roots must yield identical integration outputs. New sizes are
measured; the 44,179,239-byte baseline is not promised after patches.
measured; the 44,179,239-byte baseline is not promised after patches. All served runtime
HTML/JS/CSS/WASM/fonts/data land in shipped `src/public/wordcraft/`; the route never reads
unshipped `wordcraft/` or `third_party/` build-input directories at runtime.
### Out of scope
@@ -547,7 +601,8 @@ stale generations, document switches, replay, malformed/oversized payloads, dirt
F6 escape and chat paste isolation. Refuse all disabled I/O/network routes. Test full-feature
DOCX save/reopen, no comments/revision loss, and exact source/wiki preservation on adoption.
CSP tests compare shell/error/redirect headers byte-for-byte and assert only the approved
frame HTML delta, no PDF iframe, no inline bootstrap and no additional CSP source.
frame HTML delta, no PDF iframe, no inline bootstrap and no additional CSP source. Repeat
W3b's save-volume/latency measurements through actual embedded typing before release.
### Out of scope
@@ -580,11 +635,12 @@ state with current grants, not browser defaults that an agent can widen.
### Files owned
`packages/bus/{schema.sql,src/store.mjs,src/broker.mjs,src/editor-pins.mjs}`,
`packages/bus/src/migrations/editor-o2-pins.sql`,
`packages/bus/src/migrations/<edge>.sql` (edge allocated by Sage at landing order),
`packages/business/src/{editor-settings.mjs,business.mjs,cli.mjs}`,
`packages/plugins/channel/webui/index.mjs`,
`packages/webui/src/{chat.mjs,chat-http.mjs,cli.mjs}`,
`packages/bus/tests/editor-pins.test.mjs`, `packages/bus/tests/schema.test.mjs`,
`scripts/stack-release.sh`, `packages/cli/tests/stack-release.test.mjs`,
`packages/business/tests/editor-settings.test.mjs`, `packages/plugins/tests/editor-pins.test.mjs`,
`packages/webui/tests/editor-pins.test.mjs`.
@@ -597,7 +653,10 @@ publication to an agent until W4/W4b. Human-only settings with version checks/de
commit cadence 0, sharing visible-chip-per-send and require-citation off. UI/CLI use the same
backend validation. Migration/restore, grant revocation, tester separation, concurrent repin,
unknown key and agent settings-write refusal tests are required. Sage assigns the schema edge;
if naming conventions require another exact migration path, amend this brief before acceptance.
record the exact `<edge>.sql` path before acceptance (for example 3l-3m, never a guessed edge).
Every table-adding row updates schema.sql, schema tests and T46's four-list accounting in
stack-release.test.mjs:913, plus stack-release.sh COUNTED when applicable. Classify each table
exactly once with restore/write-accounting evidence. The same rule applies to W4b and W5.
### Out of scope
@@ -633,6 +692,8 @@ preserve full rich state via Markdown round trips. Next-lookup visibility needs
`packages/writing/tests/{store.test.mjs,adopt-markdown.test.mjs,fixtures/}`,
`packages/bus/src/{broker.mjs,client.mjs,server.mjs}`,
`packages/webui/src/{cli.mjs,writing-http.mjs}`,
`scripts/stack-copy.sh`, `packages/cli/tests/stack-copy.test.mjs`,
`packages/seat/tests/sandbox.test.mjs`,
`packages/bus/tests/writing-save.test.mjs`, `packages/webui/tests/writing-save.test.mjs`.
### What ships
@@ -646,6 +707,16 @@ backpressure, rapid autosaves and remote push pending/diverged. A mocked clock a
prove instant commit: assert ref and committed reader state before the HTTP response. No extra
runtime fetch, credential exposure, shared bot or force push.
Extend stack-copy.sh COPY_PATHS (currently :29-41) to ship `packages/writing/src`, package
metadata and runtime notices. Test an isolated pinned copy with no checkout/build-input
fallback: host open/save works and every web/WASM/thesaurus asset resolves. Runtime service
registration lives in bus/server.mjs. Keep runner-loaded broker.mjs and harness tools free
of static/dynamic imports from writing; use injected host services over existing typed bus
calls, never mount the writing store. RUNNER_FILES at seat/src/sandbox.mjs:50 and the exact
transitive-import walk at seat/tests/sandbox.test.mjs:45 must stay green. If this architecture
cannot avoid an import-closure change, amend exact owned sandbox paths before implementation.
W4b/W5 retain this same separation and rerun the closure/no-store-mount checks.
### Out of scope
Case 2 reader/mapping changes, synchronized Markdown projections, native legacy import,
@@ -654,8 +725,15 @@ agent reads/writes, deployment and a relaxed CSP.
### Gate
Independent writer/security review, writing/bus/WebUI tests and G1. No accepted-save receipt
may precede its commit/ref/index. Static ownership checks prove no generic agent root includes
the store. Any Case 2 requirement change follows D12 to Mos and Jason before implementation.
may precede its commit/ref/index. Measure commits/hour, snapshot serialization latency,
served-save latency and git repository
growth over a scripted long-chapter fixture typing session, including pauses, continuous
input, notes/comments/revisions and explicit Save. Report document ZIP size and retained
history size before/after git packing, with the actual save-group settings. No assumed delta
compression or fixed capacity claim. Independent review accepts the measured defaults before
release. Pinned-copy asset/service tests and sandbox import/mount checks pass. Static ownership
checks prove no generic agent root includes the store. D12's adoption gate remains closed.
Any Case 2 requirement change follows D12 to Mos and Jason before implementation.
### Handoffs
@@ -688,7 +766,8 @@ status and local right-click/ribbon thesaurus. Two pinned documents keep separat
and cursors; background unread metadata never wakes a run. No remount on chat polls. Test
keyboard divider/tabs, dirty navigation, credential expiry, stale pins, disabled sharing before
W4b and a writer's multi-document fixture session. Full footnotes/comments/tracked changes/
page layout and local synonyms must all save and reopen. No first-release deferral of those
page layout and local synonyms must all save and reopen. Test click-through wikilinks split
across formatted runs and unresolved-target refusal. No first-release deferral of those
features. Distinguish retained Markdown source from the canonical DOCX working document.
### Out of scope
@@ -742,7 +821,8 @@ Agent read enablement, code, live docs, story replacement proposals and a CSP ru
Independent APPROVE and Sage's accepted implementation brief, with no unresolved locator or
permission ambiguity. Changes to a Case 2 requirement go to Jason through Mos before code.
Only after that review may W4b implement access. Outer O2 plan approval alone does not pass W4.
Only after that review may W4b implement access. Resolve D12's superseded-source/adoption
requirement through Mos and Jason, with separate C2 reader/reply ownership before adoption. Outer O2 plan approval alone does not pass W4.
### Handoffs
@@ -766,9 +846,12 @@ An approved DOCX citation design still needs enforcement across bus, tools, gran
`packages/writing/src/{read.mjs,citations.mjs,index.mjs}`,
`packages/writing/tests/{read.test.mjs,citations.test.mjs}`,
`packages/bus/src/{broker.mjs,store.mjs}`,
`packages/bus/src/migrations/editor-o2-citations.sql`,
`packages/bus/src/{broker.mjs,store.mjs,server.mjs}`,
`packages/bus/src/migrations/<edge>.sql` (edge allocated by Sage at landing order),
`packages/bus/schema.sql`, `packages/bus/tests/schema.test.mjs`,
`scripts/stack-release.sh`, `packages/cli/tests/stack-release.test.mjs`,
`packages/harness/src/tools.mjs`, `packages/harness/tests/editor-tools.test.mjs`,
`packages/seat/tests/sandbox.test.mjs`, `packages/cli/tests/stack-copy.test.mjs`,
`packages/business/src/vocabulary.mjs`,
`roles/{companion,ideas,research,proofreader,fact-checker,continuity}.json`,
`packages/bus/tests/editor-access.test.mjs`, `packages/webui/src/public/writing-pane.js`,
@@ -815,9 +898,12 @@ replacement sentence. The old W5 replacement proposal flow violates Q223/Q233 an
### Files owned
`packages/writing/src/flags.mjs`, `packages/writing/tests/flags.test.mjs`,
`packages/bus/src/{broker.mjs,store.mjs}`,
`packages/bus/src/migrations/editor-o2-flags.sql`,
`packages/bus/src/{broker.mjs,store.mjs,server.mjs}`,
`packages/bus/src/migrations/<edge>.sql` (edge allocated by Sage at landing order),
`packages/bus/schema.sql`, `packages/bus/tests/schema.test.mjs`,
`scripts/stack-release.sh`, `packages/cli/tests/stack-release.test.mjs`,
`packages/harness/src/tools.mjs`, `packages/harness/tests/editor-flags.test.mjs`,
`packages/seat/tests/sandbox.test.mjs`, `packages/cli/tests/stack-copy.test.mjs`,
`packages/webui/src/public/{writing-pane.js,chat.js}`,
`packages/webui/tests/{editor-flags.test.mjs,chat-browser.test.mjs}`.
@@ -851,11 +937,15 @@ The reviewer sends the verdict directly to the owner and Sage; revisions repeat
This is a docs-only rewrite. Source and existing build artifacts were inspected, not built
or run. The 44,179,239-byte figure and format findings remain Louie's pinned measurements.
Static checks cover branch/base, row fields/dependencies, source anchors, source/measurement
pins, one owner question, documentation-only scope and append-only logs. No security PASS,
pins, the CSP question and open D12 item, documentation-only scope and append-only logs. No security PASS,
CSP approval, DOCX citation approval or implementation acceptance is claimed here.
After S0 passes, Mos asks only: approve the exact editor-frame CSP delta in S0's reviewed
report, with the shell unchanged? Recommendation: allow only `'wasm-unsafe-eval'` for that
frame document and `'self'` framing, keep embedded PDF preview disabled, and add no other
allowance. If the reviewed measurement differs from D8, replace the question with that exact
reviewed delta. This sentence is not Jason's approval and does not enable the frame.
Q1. After S0's scratch measurement passes, approve its exact editor-frame CSP header with
the shell unchanged? Recommend only the measured WASM compilation and same-origin framing
allowances, embedded PDF preview disabled, and no inline-style allowance if the narrower
trial works. Use the full measured header, not D8's source-inferred candidate.
Q2. OPEN with Jason as Q36 / Vikunja 562: approve superseded notices in C2 readers and
C2-06 replies citing adopted sources? Recommend yes. Original files stay unchanged. No notice
implementation before that ruling. Separately settled by Mos in mos-1358: refuse human
Markdown adoption until W4b passes. That build-order gate is not another Jason question.