plans: Case 2 briefs. C2-13a factory profile from gosalyn-0057 items 1-3 (--pm, --claude under the --node rule, no proxy flags), row 190 tokens to whichever lands second. New C2-01b for row 212's notes N1-N3, N4 to the C2-12 setup sheet, N5 to C2-10b (webby-0041, sage-1517)

docs/plans/2026-10-20_case2-rows.md

@@ -98,6 +98,55 @@ every `scripts/test-*.sh`.
 
 ---
 
+## C2-01b survey escapes, list item lines and attachment embeds
+
+### Problem
+
+Webby's row 212 review (webby-0041, `agents/webby/work/queue-212/REVIEW-r1.md`, approve on bdf18272a)
+left three notes that change C2-01's code. Row 212 lands as approved, and these come after it.
+- N1. The comment at `packages/library/src/survey.mjs:76` is false. `JSON.stringify` leaves C1 and bidi
+  controls raw, so a folder name can carry them into the survey output.
+- N2. A front matter link reports its key's line, not its list item's (`reader.mjs:156`, `:162-165`). Two
+  links under `relationships:` both point at the key, and so do their R4, R5 and R6 problems.
+- N3. `links.mjs:2` reads `![[x]]` embeds as links, so an embedded image that is unmapped gives R4 "a link
+  to no file". Design 1.3 says nothing about embeds.
+
+### Owner and reviewer
+
+- Owner: Gosalyn.
+- Reviewer: Webby.
+- After: C2-01.
+
+### Files owned
+
+`packages/library/src/survey.mjs`, `src/reader.mjs`, `src/links.mjs`, `packages/library/README.md` where
+it describes these, and `packages/library/tests/`.
+
+### What ships
+
+- N1. The survey prints U+0080 to U+009F, U+200E, U+200F, U+202A to U+202E and U+2066 to U+2069 in any
+  name as `\uXXXX` escapes, and the comment says what the code does.
+- N2. A link in a front matter block list reports its list item's line. A link in a scalar or flow value
+  keeps the key's line.
+- N3 (sage-1517, Gosalyn's proposal). An embed whose target has an extension other than `.md` is an
+  attachment. It is neither resolved nor indexed, and it never gives R4. The survey still counts it as an
+  embed. An embed with no extension or with `.md` resolves as a link, so an unresolved one is R4.
+
+Tests: one fixture folder name per escaped range prints escaped. Two links under one block list key report
+two different lines, and their problems carry those lines. `![[cover.png]]` gives no problem and counts as
+an embed, `![[missing-note]]` gives R4, and `![[note.md]]` resolves.
+
+### Out of scope
+
+The index and queries (C2-05a), and webby-0041 N4 and N5, which go to C2-12 and C2-10b.
+
+### Gate
+
+Webby approves the manifest. The library tests are green on Sage's gate, along with every
+`scripts/test-*.sh`.
+
+---
+
 ## C2-08 creative roles, persona file and block, M1, M2, M6, M10, prompt passed by file
 
 ### Problem
@@ -382,6 +431,8 @@ The setup sheet in plain words:
 - That a short link to a name that also exists in another of her repos can point somewhere else for the
   agents, and that a full-path link avoids this.
 - What changes for Bean and Chet: short cited items, no passages (design 4).
+- That a list of links in a note's properties uses the quoted form Obsidian's property editor writes,
+  `appears_in: ["[[A]]", "[[B]]"]`. The unquoted `[[[A]], [[B]]]` is R3 (webby-0041 N4).
 
 The survey run sheet gives the exact `library survey` command with C2-01's real flags, and states what
 the output holds: names and counts only.
@@ -690,9 +741,11 @@ Design 7.4. The chat view renders a cited reply through `renderItems`: each item
 with a scope badge (canon, playground or web) and "changed since" when the file's last commit is newer
 than the cited one. Each notice shows its fixed line. A status line reads `library.status`: the served
 commit and its age, `library-diverged`, a fetch error, and the count of R-problems with a link to the
-list.
+list. A web cite's `url` renders as a link only when its scheme is `https`, and as plain text otherwise.
+`renderItems` doesn't check the scheme (`packages/library/src/render.mjs:14-16`, webby-0041 N5).
 
-Tests: webui tests for items, scope badges, notices, "changed since" and the status line.
+Tests: webui tests for items, scope badges, notices, "changed since" and the status line, and a web cite
+with an `http:` and a `javascript:` url that each render as text.
 
 ### Out of scope
 
@@ -736,8 +789,12 @@ precheck prints only variable names, never values (webby-0034 N2, webby-0035).
 `/srv/mosaic`, never from the release, because `mosaic` can write the release.
 
 Inputs. `--profile factory|library` (default `library`), `--user`, `--home`, `--business`, `--copy ID`,
-`--node PATH`, and the Console's serve flags after `--`. Row 195 calls it with those names.
+`--node PATH`, with `factory` only `--pm` and `--claude PATH`, and the Console's serve flags after `--`.
+Row 195 calls it with those names. `library` refuses `--pm` and `--claude`.
 - `--node` must be an absolute path to a root-owned regular file outside `<home>`.
+- `--claude` follows the `--node` rule: an absolute path to a root-owned regular file outside `<home>`, so
+  nothing running as `<user>` can replace the binary the bus runs (sage-1517, darkwing on gosalyn-0057).
+  Row 195 installs claude under a root-owned prefix to match.
 - The copy id must be exactly 40 lowercase hex characters naming a directory that holds
   `scripts/mosaic`, directly under `<home>/.local/share/mosaic-stack/copies`. That is the rule
   `copy_root` uses (`scripts/stack-copy.sh:6`, `:20`). Anything else refuses before the render.
@@ -760,9 +817,11 @@ Inputs. `--profile factory|library` (default `library`), `--user`, `--home`, `--
   - It refuses `--checkout`. Her host has no canonical checkout, and the queue store refuses a read
     from the copy, so the queue panel isn't part of Case 2 (webby-0036 N4).
   - It refuses `--board`. Case 2 runs no control board, and design 9.3 says why the default stays.
-  The factory profile takes the same set plus an optional `--tester-port N` in 1024..65535, never equal
-  to `--port`, because Case 1's acceptance uses the tester. Row 195 names any other difference in its
-  own brief.
+  The factory profile (gosalyn-0057 items 1-3, sage-1517) takes `--port N` in 1..1023 and `--business ID`,
+  both required, and an optional `--tester-port N` in 1024..65535, never equal to `--port`, because
+  Case 1's acceptance uses the tester. .53 has no proxy, so `factory` refuses `--public-host`,
+  `--auth-header`, `--allow-user`, `--proof-header`, `--proof-file` and `--send`. It refuses `--checkout`
+  and `--board` as `library` does, and any other flag.
 
 The render. It renders two system units from the checkout's existing templates and changes neither:
 `[email protected]` from `packages/cli/systemd/mosaic-bus.service.in`, enabled as
@@ -777,7 +836,13 @@ The render. It renders two system units from the checkout's existing templates a
   node's directory is already in it, so with `--node /usr/bin/node` a node in `/usr/local/bin` would
   come first and the bus would run it.
 - `@FLAGS@` is the checked serve flags, in the order given.
-- `@PM_FLAGS@` and `@CLAUDE_ENV@` render empty.
+- `@PM_FLAGS@` is ` --pm` when `factory` is given `--pm`, as `scripts/bus-service.sh:69-70` renders it,
+  and empty otherwise.
+- `@CLAUDE_ENV@` is the line `Environment=MOSAIC_CLAUDE_BIN=<--claude>` when `factory` is given
+  `--claude`, and empty otherwise.
+- Row 190 (round 3, in review) adds `@CONFIG_ENV@` and `@SESSION_ENV@` to the templates. They aren't on
+  refactor, and the render refuses an unknown token, so whichever of rows 190 and 230 lands second adds
+  both to this script with tests. A comment at the script's token list says so (gosalyn-0057 item 4).
 - `%h` becomes the literal `--home`, because in a system unit `%h` is root's home.
 - After the render it refuses any `@[A-Z_]+@` or `%h` left in either unit.
 
@@ -817,7 +882,8 @@ none, and it refuses one. It also refuses:
   (`scripts/webui-service.sh:266-273`).
 - on a re-install, an installed unit that differs from the render in anything but the copy id. So the
   node path and serve flags must equal the installed ones. The copy id is the one value that may
-  change, so a re-pin or a rollback to another copy re-renders both units together (row 195).
+  change, so a re-pin or a rollback to another copy re-renders both units together (row 195). With
+  `factory`, `--pm` and `--claude` must also match the installed bus unit.
 
 It writes both units under `/etc/systemd/system/` as `root:root` 0644. It never uses `systemctl link`,
 and it refuses a symlink at either unit path. It opens no file under `<home>`. It only stats the copy
@@ -849,7 +915,9 @@ checks below. C2-13b adds the library checks to the same file. It refuses unless
   `mosaic` process bind the port, a session included, and makes the Console's capability pointless
   (design 9.3, mos-1100).
 - When some instance's harness is claude-code, one marker prompt run through the host's claude with
-  `--system-prompt-file` shows that it replaces the default prompt. The claude version is printed. With
+  `--system-prompt-file` shows that it replaces the default prompt. The claude version is printed. The
+  host's claude is the installed bus unit's `MOSAIC_CLAUDE_BIN` when the unit sets one, as `factory`
+  with `--claude` does, and `claude` on PATH otherwise. With
   the design's model path, Bean and Chet run pi, so this check is skipped unless she adds a claude-code
   specialist.
 - When an instance's provider is `zai`, `<configDir>/secrets/claude-session.env` exists, is a regular
@@ -871,6 +939,9 @@ It also prints free memory and verifies that HOME is `<home>`.
 - both units hold the four hardening lines once, in order, and only the Console holds the two
   capability lines
 - a check of the script for `systemctl link` finds nothing
+- with `factory`, `--pm` renders an `ExecStart=` ending in `bus start <business> --pm` with one `--pm`,
+  and `--claude` renders exactly one `Environment=MOSAIC_CLAUDE_BIN=` line with that path. Without them
+  both tokens render empty
 
 These cases refuse:
 - an installed unit edited to `User=root`
@@ -888,13 +959,17 @@ These cases refuse:
 - a copy id that is short, uppercase, holds `/` or `..`, or names no directory
 - with `library`: `--port 7332`, a missing proof pair, a proof file owned by root, at 0644, a symlink, or
   under the data root, `--tester-port`, `--checkout`, `--board`, a `--business` different from the
-  unit's, and an unknown flag. With `factory`: `--tester-port` equal to `--port`.
+  unit's, `--pm`, `--claude`, and an unknown flag. With `factory`: `--tester-port` equal to `--port`, a
+  missing `--port` or `--business`, each of `--public-host`, `--auth-header`, `--allow-user`,
+  `--proof-header`, `--proof-file` and `--send`, a `--claude` that is relative, not root-owned or under
+  `<home>`, and a re-install with a different `--pm` or `--claude`.
 
 The precheck runs against a scratch data root. Each refusal has a case. A fake `node` printing v22
 refuses, a fake `bwrap` that exits 1 refuses, and an unprivileged port start at or below the Console's
 port refuses. The claude check runs against a fake claude that appends rather than replaces, and that
 case refuses. With no claude-code instance the claude check doesn't run, and a test shows a missing
-claude passes. The key file refuses when missing, at 0644, a symlink, with `ZAI_API_KEY=` empty, and
+claude passes. When the bus unit sets `MOSAIC_CLAUDE_BIN`, the check runs that binary: a replacing fake
+there passes while an appending fake sits first on PATH, and the swap refuses. The key file refuses when missing, at 0644, a symlink, with `ZAI_API_KEY=` empty, and
 with `ZAI_API_KEY=x` followed by `ZAI_API_KEY=`. A search of the test output for the fixture key value
 finds nothing. `factory` passes with the tester on and refuses a business file with a library project.
 `library` refuses with the tester on.