gosalyn: C2-06 brief Q222 round 2 for Webby webby-0144: M11 compares against the on-disk human and replyLimits on document and written and refuses agent actor shapes, an unreadable business file checks at the defaults, keys read by Object.hasOwn and Number.isInteger, the verb refuses unknown keys, the new tests, the residual line, cites at aca16404c, and the hold moves to Q30 (mos-1305, design f164dcef8)

docs/plans/2026-10-20_case2-rows.md

@@ -379,8 +379,8 @@ every agent-to-human message in a library business.
 ### Files owned
 
 - `packages/library/src/guard.mjs` and its export.
-- `packages/business/src/business.mjs`: `replyLimits` in `TOP_KEYS` (`:21`), any value accepted.
-- `packages/business/src/organization.mjs`: the M11 check in `write` (`:177`), next to M9.
+- `packages/business/src/business.mjs`: `replyLimits` in `TOP_KEYS` (`:24`), any value accepted.
+- `packages/business/src/organization.mjs`: the M11 check in `write` (`:180`), next to M9 (`:191-193`, `:199-200`).
 - `packages/cli/src/limits.mjs`: the `mosaic limits replies --file <json>` verb, which calls
   `library.limits.set`.
 - `packages/bus/src/broker.mjs`: the pre-check on `message.send` to `human`, the page store beside the
@@ -403,38 +403,50 @@ Every M5 limit is a setting (Q222, mos-1302), as the design's ruling after r11 o
 out: the seven `replyLimits` keys, their defaults and valid values. The defaults are 10 items, 1,200
 characters of item text, 3 ideas of 120 characters (Q219, mos-1299), 300 for the other kinds, and
 max(12, 25%) for a correction. The guard reads the business file on each check, not the broker's copy
-from start. Each key that is missing, `null`, a string, a fraction, negative, below its minimum or above
-its ceiling uses its default, and the guard has no path without a number. `library.status` shows the
-limits in force and the keys that fell back. M11: only the human's `library.limits.set` changes them,
-and `organizationWriter.write` refuses a changed `replyLimits` from any other actor with
-`organization-reply-limits-human-only`. A refusal reason names the key and its value in force.
+from start. If the file is missing, unreadable, not JSON or not an object at check time, the guard
+checks at the defaults and `library.status` shows `reply-limits-unreadable`. It never skips the check. A
+key is read only by `Object.hasOwn` and used only if `Number.isInteger` and in range. Anything else uses
+its default: missing, `null`, a boolean, a string, an array, an object, a fraction, `NaN`, negative, below
+its minimum or above its ceiling. The guard has no path without a number. `library.status` shows the
+limits in force, the keys that fell back and the idea residual, `ideasPerReply` times `ideaLength`.
+M11: only the human's `library.limits.set` changes them, and the verb refuses an unknown key with
+`invalid-request`. `organizationWriter.write` compares against the on-disk file, `old.replyLimits` and
+`old.human`, on `document` and on `written` as M9 does. It refuses a changed `replyLimits` with
+`organization-reply-limits-human-only` unless the actor is `old.human` and is neither `tester` nor
+`<definition>.<role>` for a role in `old.roles`. A refusal reason names the key and its value in force.
 
 The setup sheet's limits paragraph gives the defaults, says they are settings that she or Jason can
-change, and drops "You or Jason can ask for lower limits".
+change, and drops "You or Jason can ask for lower limits". One line says that raised limits make the
+guard looser, with the idea residual as the example (webby-0144 N5).
 
 Tests: one pass and one refusal for each check in M5 and 5.2, each default limit refused one past its
 boundary and accepted at it, so 4 ideas and a 121-character idea refuse. Each goes through the runner's
 RESULT path and through `send_message`, and once with a non-creative sender in a library business. The
 `messages` count is unchanged on each refusal. Settings tests: a changed value takes effect on the next
-reply with no restart, in both directions. Each invalid value above, a non-object `replyLimits` and a
-missing one use the defaults, and the business file still loads. M11 tests: the human's
+reply with no restart, in both directions. Each invalid value above, `true`, `[7]`, `{}` and `"5"`
+included, a non-object `replyLimits`, an array and a missing one use the defaults, and the business file
+still loads. With the business file unreadable at check time, an over-limit reply refuses and `messages`
+is unchanged. M11 tests: the human's
 `library.limits.set` works, and an out-of-range value refuses `invalid-request` with the file unchanged.
 `library.limits.set` from an agent session refuses `human-required` and from the tester
 `tester-refused`. The chief of staff's `organization.set`, the tester's `instances.set` and a direct
-`write` with a changed `replyLimits` refuse, and the file and `changes.jsonl` are unchanged. A mutant
-without the writer check fails.
+`write` with a changed `replyLimits` refuse. A direct `write` that changes both `human`, to its own
+actor, and `replyLimits` refuses. With a dotted human id equal to a role's `<definition>.<role>`, that
+role's write refuses. `library.limits.set` with an unknown key refuses `invalid-request`. In each refusal
+the file and `changes.jsonl` are unchanged. A mutant without the writer check fails, and so does one that
+compares `document.human` instead of `old.human`.
 
 ### Out of scope
 
 The runner retry and the runner's notices (C2-07). The Console's rendering (C2-10b). Any classifier of
 prose. The idea-text residual is 360 characters per reply at the defaults, closed by Jason in Q219 (design
-5.1, 10 step 8). Any change to the reply format waits for Jason's Q29.
+5.1, 10 step 8). Any change to the reply format waits for Jason's Q30 (mos-1305).
 
 ### Gate
 
 Webby approves the manifest. The library, bus, business, cli and harness suites are green on Sage's
 gate, along with every `scripts/test-*.sh`. The build doesn't start until Mos relays Jason's answer to
-Q29 (mos-1302).
+Q30 (mos-1305), which follows his Q29 answer.
 
 ---