docs: close remote credential and private review access findings

BUILD-LOG.md

@@ -5374,3 +5374,5 @@ Gander: after Duckworth-0100 design approval with C1-C5, prepared the two host-s
 2026-10-23T01:37:55Z | Gyro 571 push guard | identity gyro/purpose push: exit 0 documented degraded-pass CANNOT_ASSERT credential-unresolvable, scratch audit gyro-q195-ci-queue-audit.jsonl; no credential fallback or CI-green claim.
 
 2026-10-23T01:41:59Z | Gyro sage-3121 A1-A3 PRD alignment | Before: 8d209016b adds a current Connections graph, excludes new Markdown stories in converted books and defaults archiveFolder. After: parent/W4 align with PRD1.17 d6 sha256 886b93c571f87bfbb2f27ee3113b6800a32d8f89196d95ace33566031bee380a: clickable editor links only; graph/tests later pending J-b; new different-path Markdown in a converted book remains canon until import, only recreated converted old paths are unmapped; archive folder is human-set in library mapping with no default, missing folder refuses conversion. Static A1-A3/11-brief checks pass; W4 locator/extractor/access/remote/recovery blocks unchanged. Local commit only, push held for Sage's named gap while Gizmoduck holds 270+271 run5. No product/build/browser/worker/queue/live action. Fenton gets local SHA through shared object store.
+
+2026-10-23T01:49:08Z | Gyro fenton-0012 B1/B2 and N1-N6, mos-1379 | B1: off-host remote must deny the real shared jason.woltje seat-helper credential as well as seat identities until #431; private visibility/dummy-token denial is insufficient; W3b/A16/A26 require that future fixture proof. B2 follows mos-1379: human-only editor.agentReadComments and editor.agentReadTrackedDeletions both default false, comment/original/markup reads/resolves/index/context refuse when off; final access remains D9 and no role allowlist/per-document grant. N1 staging-ref allowlist and retained private refused/published audit refs; N2 URLs literal with fidelity-report loss and confirmation; N3 future paths marked new or predecessor row; N4 rename/sharing wording fixed; N5 historical thread text not refreshed; N6 protected VM1012 backup cited in P5. Static checks pass, locator JSON/package/projection mechanics retained. Local commit only; HTTPS push still held for Sage's named gap. No credentials tested/read/printed, no product/build/browser/worker/queue/live action. Fenton gets exact local SHA/blobs.

docs/SESSIONS.md

@@ -1562,3 +1562,4 @@ are never rewritten or removed; corrections are new entries.
 2026-10-23T00:52:58Z | Gyro (Codex gpt-6.1-sol, mos-1366/1367) | Vikunja571 Q235-Q237 O2 parent/W4 format-policy rewrite on gyro/editor-o2 | Canonical queue next gyro: nothing. Prepared P1-P6 and B1-B4 docs, baseline W4 import 1ac76a417; no product/build/browser/worker/private-file/queue/live action. Mos impact map fold precedes review/push handoff.
 2026-10-23T01:37:07Z | Gyro (Codex gpt-6.1-sol, mos-1368/1372/1375) | Vikunja571 O2 parent/W4 revision complete for review | P1-P6/B1-B4 and A17-A41/Q1-Q16 folded; same-thread Case 2 lookups/support writes, human-set host-pushed off-host remote, Hermes/restore/counting/order/role gates. Static docs checks pass; old locator/projection mechanics retained, authority/access review reopened. No code, build/browser/worker run, private conversion, queue or live action. Direct Fenton/Mos/Sage handoff after push.
 2026-10-23T01:41:59Z | Gyro (Codex gpt-6.1-sol, sage-3121) | 571 PRD d6 A1-A3 alignment | Both designs corrected and statically checked; local commit for Fenton in shared repo object store. HTTPS push held for Sage gap, independent review pending. No product, test-slot, queue or live change.
+2026-10-23T01:49:08Z | Gyro (Codex gpt-6.1-sol, fenton-0012/mos-1379) | 571 B1/B2 and N1-N6 docs corrections | Real-helper denial gate and two off-by-default human review settings; static acceptance/brief/immutable-mechanics checks pass. Local candidate for Fenton via shared Git objects; no HTTPS push before Sage gap, no runtime or credential experiment.

docs/plans/2026-10-21_q195-writing-editor.md

@@ -40,7 +40,10 @@ under the existing Q223 scopes. W4/W4b and the approved Case 2 PRD remain prereq
 DOCX reads. mos-1372 D9 reopens W4: reads through Case 2 lookups use the same live business,
 project, universe and source scope as Markdown, in any authorized thread/room. No O2-only
 conversation, per-document grant or per-send share gates those reads. D9 is a marked choice
-in PRD 1.17 for Jason, not an already approved tool/policy change. No unsaved-draft reader,
+in PRD 1.17 for Jason, not an already approved tool/policy change. mos-1379 adds two human-only
+settings, both off by default: editor.agentReadComments for comment stories, and
+editor.agentReadTrackedDeletions for original/markup views. Final accepted text remains
+under D9's ordinary project/universe access. No role-level allowlist or per-document grant. No unsaved-draft reader,
 native WordCraft execute/save route or agent proposal that inserts story prose is introduced.
 
 D4. Pins and saved-context records stay on the bus through a reviewed schema change.
@@ -218,7 +221,11 @@ the canonical book manifest's chapter metadata (bounded validated fields plus pr
 extension values), with source bytes retained in the archive. type/name/appears_in/relationships
 are indexed from that manifest, not lost or read from stale Markdown. DOCX custom properties
 may mirror them but are not a second authority. A reviewed importer must cover headings,
-emphasis, footnotes, lists, block quotes, scene breaks, raw HTML, embeds and URLs. Use row154's
+emphasis, footnotes, lists, block quotes, scene breaks, raw HTML, embeds and URLs. v1 refuses OOXML hyperlinks: the importer emits Markdown URLs as
+literal label plus URL text, without w:hyperlink/r:id, and lists the lost click behavior in
+the fidelity report for human confirmation. Bare URLs stay literal. Wiki tokens stay exact
+and host-clickable. This is an explicitly handled literal mode, not silent hyperlink loss.
+If the URL cannot be retained safely as literal text, refuse before archiving. Use row154's
 reviewed markdown-it source for the parser plus a first-party AST-to-WordCraft-DOCX adapter;
 never rely on WordCraft's measured lossy Markdown importer. Unsupported raw HTML stays an
 explicit refusal, never executed. Fixtures cover every construct and independently compare
@@ -319,7 +326,8 @@ have one authoritative archive-prefix value; the library mapping and editor cann
 Archive prefixes cannot overlap playground/supporting prefixes. Conversion preserves bytes
 and history rather than deleting data, per Mos's PRD reading. No seat retires Hermes or
 starts a conversion under this design assignment. The first real conversion of Melanie's books
-also requires Jason's recorded go bound to the selected book scope. No agent/tool or ordinary setting/request flag can substitute for these release/go gates. Initial missing/revoked readiness refuses before any archive, conversion commit or catalogue
+also requires Jason's recorded go bound to the selected book scope, including mos-1374's protected
+manual VM1012 backup before the first real import (a separate human-owned P5 step). No agent/tool or ordinary setting/request flag can substitute for these release/go gates. Initial missing/revoked readiness refuses before any archive, conversion commit or catalogue
 mutation. In-flight readiness loss after archive push follows the pending recovery protocol,
 never a false no-mutation refusal. Scratch fixtures remain testable in an
 isolated store inaccessible to production routes. Design approval never starts conversion.
@@ -378,10 +386,19 @@ mos-1368 C4 / mos-1372 D7 / mos-1375 resolve the Q176 conflict: `editor.remoteUR
 human-only setting, default unset. Only the host process pushes; agents never push. The URL
 points off the stack host, for example a private Gitea repo. A same-host bare/filesystem or
 loopback repo cannot be the default or qualify. A human provisions/selects the private
-remote and host-only auth before production opening; neither is created by this design. Only the stack host has its push credential; no seat grant/account/token
-can list, fetch, clone, fork or push it. Do not expose its credential/URL through the frame,
+remote and host-only auth before production opening; neither is created by this design. Only the stack host has its push credential; no seat credential can list, fetch, clone, fork or push it. Until #431 fixes the current
+seat helper routing through jason.woltje (mos-1106), mere private-repo status is insufficient.
+Use an off-host instance/account outside both that helper principal's and seat credentials'
+reach; a separate instance is the safe option. An owner/org on the existing Gitea is eligible
+only if actual helper-based denial proves that jason.woltje has no access. Never treat a
+fresh dummy-token refusal as evidence that the real seat helper cannot reach the remote. Do not expose its credential/URL through the frame,
 tool responses or logs. Allow only the configured host-owned remote, verified branch and
-fast-forward CAS push; refuse object alternates, unexpected remotes and divergence. Each
+fast-forward CAS push; allow only refs/heads/writing-published and host-owned
+refs/heads/import-staging/<operation-id>. Refuse object alternates, other push targets,
+unexpected remotes and divergence. Before publication a refused candidate's staging ref
+stays private and ineligible for readers, marked refused in the journal; after publication
+keep it as an audit reference to the canonical commit. No automatic remote ref deletion,
+force-push or claim that aborted staging commits became current story history. Each
 accepted local save commits/publishes immediately; host push follows without a human action.
 Receipts distinguish locally committed from off-host synced and expose retry/readback status,
 never call an unpushed commit durable. A human-only remote retry deadline defaults 30 seconds;
@@ -389,7 +406,9 @@ failed push preserves local commits and blocks conversion, with a visible pendin
 Before irreversible archive push, the staged DOCX commit must already be acknowledged by
 the off-host remote. Source archive push uses the separate existing human library writer.
 No force push or seat-token fallback. W3b tests remote acknowledgment, outage/divergence,
-restart recovery and absence of seat access; W7 proves remote-ready state before archiving.
+restart recovery and denial through the actual seat credential-helper route as well as
+individual seat identities, without printing/storing credential values. Use an authorized
+empty fixture remote for this future gate, never private writing. Failure holds the remote gate; W7 proves remote-ready state before archiving.
 The human-set remote covers the DOCX git store/history/manifest. Ordinary Case 2 messages,
 run evidence and supporting notes keep their existing approved storage policy; the old W4
 private-only/no-backup transcript model is withdrawn. Stack-copy is not a story backup. Deployment/provisioning is separate.
@@ -441,7 +460,7 @@ never edit the story. Resize at most once per animation frame while dragging, te
 prevent iframe pointer interception, and call resized at drag end. Before unmount, ask dirty;
 no response after the human-configurable one-second default counts as dirty. Navigation,
 refresh, sign-out and tab close preserve or warn about uncommitted work. Credential expiry
-revokes sharing and blocks saves, retaining the local draft for copying or reauthentication.
+blocks human context attachments and saves, retaining the local draft for copying or reauthentication.
 
 D21. Full-feature acceptance uses an invented DOCX with styled headings, footnote reference
 and body, a comment anchored to text, tracked insertion/deletion and a section/page layout
@@ -487,10 +506,14 @@ D24. Native WordCraft MCP is not an agent bridge. After W4/W4b and PRD approval,
 reader backs Case 2 find/get/search/manuscript/universe lookups in any authorized thread or
 room. Standard library_doc_write/delete still write only supporting Markdown. The host
 applies existing live project/universe/source-scope checks before every extraction/index hit
-and reply; no per-document grant/share or special conversation is required. No raw store
+and reply; no per-document grant/share or special conversation is required. The two mos-1379
+human settings separately gate comments and original/markup review text; off means refuse
+without text, including citation resolution, search/index and context attachments. No raw store
 mount/git credential/native execute channel reaches an agent. October 27 Markdown semantics
 stay intact; after conversion old source lookups return the conversion record and current
-DOCX, with explicit historical archived reads separated. Store access is host code only.
+DOCX, with explicit historical archived reads separated. Store access is host code only. Final-view access remains D9; comments require
+editor.agentReadComments and original/markup require editor.agentReadTrackedDeletions,
+both human-only/off by default under mos-1379. Off refuses without returning review text.
 
 D25. Proposed DOCX citations bind `{business,project,document,commit,blob,part,paragraph,
 start,end,textView,quote,quoteDigest}`. Parts are explicit document body, footnote/endnote
@@ -521,7 +544,7 @@ D27. W5 creates read-only flags and cited findings outside the document: Jump to
 Dismiss, not Accept/Replace/Apply. No comment node, tracked change, sentence suggestion patch
 or metadata insertion is written into a chapter by an agent. Chat can discuss ideas, consistency
 and wording, but its text is never passed to the engine as a replacement. “Ask the agent about
-this passage” sends only a resolvable committed locator after the sharing gate, never the draft.
+this passage” sends only a resolvable committed locator after committed-reader and review-setting checks, never the draft.
 Local dictionary replacement remains an ordinary human action, not an agent proposal.
 
 Free chat replaces the old short-item-only M5 premise under Q223. A human-only require-citation
@@ -730,7 +753,7 @@ Services and no fallback I/O. Human local thesaurus lookup/replacement lives ins
 reviewed adapter, not a general parent execute channel. Test wrong origins/sources/tokens,
 stale generations, document switches, replay, malformed/oversized payloads, dirty timeout,
 F6 escape and chat paste isolation. Refuse all disabled I/O/network routes. Test full-feature
-DOCX save/reopen, no comments/revision loss, and exact source/wiki preservation on adoption.
+DOCX save/reopen, no comments/revision loss, and exact source/wiki preservation on fixture conversion.
 CSP tests compare shell/error/redirect headers byte-for-byte and assert only the approved
 frame HTML delta, no PDF iframe, no inline bootstrap and no additional CSP source. Repeat
 W3b's save-volume/latency measurements through actual embedded typing before release.
@@ -784,11 +807,17 @@ publication to an agent until W4/W4b. Human-only settings with version checks/de
 `editor.commitCadenceMs` 0, `editor.saveGroupPauseMs` 2000 and `editor.saveGroupMaxMs` 15000,
 `editor.archiveFolder` unset/no default (library mapping), `editor.conversionHumans` owner-only,
 `editor.markdownImportMaxBytes` 1048576 (1..16777216 integer),
-`editor.remoteURL` unset/off-host-only, `editor.remoteRetryDeadlineMs` 30000 (1000–300000 integer), sharing visible-chip-per-send and require-citation off. UI/CLI use the same backend validation.
+`editor.remoteURL` unset/off-host-only,
+`editor.agentReadComments` false, `editor.agentReadTrackedDeletions` false, `editor.remoteRetryDeadlineMs` 30000 (1000–300000 integer), sharing visible-chip-per-send and require-citation off. UI/CLI use the same backend validation.
 The archive-folder key uses D11's path/collision checks and one canonical library-mapping
 value. Validate allowed human IDs and remote destinations against owned projects/host policy;
 no setting grants agent story writes or substitutes for release/go authority.
 All new keys have UI/CLI default/change/boundary/unknown-key/agent-refusal tests.
+The two review-access keys accept booleans only, default false. Test each UI/CLI default,
+change and agent-write refusal; original/markup require the tracked-deletions setting,
+comment parts require the comments setting, and a comment in original/markup requires both.
+Default final-body reads remain available. Disablement invalidates cached review access and
+cursor settings revisions; it does not promise erasure of already delivered chat history.
 Both save-group keys use D13's bounds and cross-field validation. Test defaults, valid changes,
 fractional/nonfinite/out-of-range values, pause > maximum, stale settings versions and agent
 write refusals for each key through both interfaces, with prior values preserved on refusal. Migration/restore, grant revocation, tester separation, concurrent repin,
@@ -872,7 +901,10 @@ agent reads/writes, deployment and a relaxed CSP.
 
 ### Gate
 
-Independent writer/security review, writing/bus/WebUI tests and G1. No accepted-save receipt
+Independent writer/security review, writing/bus/WebUI tests and G1. The off-host remote gate
+must prove denial through the actual seat helper credential path and actual seat identities
+against an authorized empty fixture remote; a fresh dummy token is insufficient. Keep auth
+tracing off and record only access outcomes, never helper output/credential values. No accepted-save receipt
 may precede its commit/ref/index. Measure commits/hour, snapshot serialization latency,
 served-save latency and git repository
 growth over a scripted long-chapter fixture typing session, including pauses, continuous
@@ -912,7 +944,7 @@ A restricted engine and writer are not yet an all-day writing workspace beside p
 D10/D16-D22's navigation and clickable editor links, familiar full WordCraft surface, splitter, settings controls, save/sync
 status and local right-click/ribbon thesaurus. Two distinct DOCX chapters keep their separately pinned ordinary chat drafts
 and cursors; background unread metadata never wakes a run. No remount on chat polls. Test
-keyboard divider/tabs, dirty navigation, credential expiry, stale pins, disabled sharing before
+keyboard divider/tabs, dirty navigation, credential expiry, stale pins, disabled DOCX context attachments before
 W4b and a writer's multi-document fixture session. Full footnotes/comments/tracked changes/
 page layout and local synonyms must all save and reopen. A converted chapter appears once; its labelled archive cannot be edited. Test click-through wikilinks split
 across formatted runs and unresolved-target refusal. No first-release deferral of those
@@ -1132,6 +1164,13 @@ The source archive and private DOCX repository cannot publish atomically through
 `packages/library/README.md`, `packages/writing/README.md`, `packages/webui/README.md`,
 `docs/case2/{SETUP-SHEET.md,SURVEY-RUN.md}`.
 
+Path status at stack pin 062646487: library index-build/query modules and tests are created
+by C2-05a (row216); guard by C2-06 (217); supporting by C2-01d (283); write by C2-02 (288).
+W7 waits for those file-owner handoffs. `packages/cli/src/library.mjs`,
+`packages/webui/src/library-http.mjs` and `packages/business/tests/vocabulary.test.mjs`
+are new W7 paths, not existing files at that pin. All packages/writing paths are new except
+for the serial W3b/W4b handoffs already named; recheck exact filenames on the accepted base.
+
 ### What ships
 
 D11/D12's human import and conversion manifest/journal, exact-source archive with converted

docs/plans/2026-10-22_q195-docx-citations.md

@@ -22,7 +22,8 @@ Markdown precursor, under the same production-opening gate as import.
 The October 27 release stays Markdown. Production import/new-story opening waits for W4b,
 W7, the post-10-27 release, the approved Case 2 PRD/brief amendment, Hermes retirement
 (#423 step 5) and configured off-host durability. The first real use on Melanie's books
-also waits for Jason's scoped go. All starts are human-only; `library.convert` has no role
+also waits for Jason's scoped go and mos-1374's protected manual VM1012 backup before the
+first real import, handled by its authorized human operator, not this design seat. All starts are human-only; `library.convert` has no role
 grant or agent request path and stays a hard wait unless an approved PRD changes it.
 Nothing in this document authorizes conversion, new private story creation or deployment.
 Q234's exact frame CSP, mos-1363 and S0 M1–M14 remain unchanged implementation gates.
@@ -30,7 +31,10 @@ Q234's exact frame CSP, mos-1363 and S0 M1–M14 remain unchanged implementation
 mos-1372 D9 replaces the prior W4 O2-only-conversation, per-document-grant and per-send-share
 requirements for Case 2 lookups. Agents read converted stories through the normal Case 2
 lookups in any thread or room under the same live project/universe/source-scope checks as
-Markdown canon/playground. They can then use existing supporting-Markdown write tools under
+Markdown canon/playground. Final accepted text follows that access. Under mos-1379,
+editor.agentReadComments and editor.agentReadTrackedDeletions are human-only booleans,
+both false by default. The former gates comment stories; the latter gates original/markup
+views. This is two settings, not a role-level allowlist or per-document grant. They can then use existing supporting-Markdown write tools under
 Q223. The agent never writes a story/DOCX/archive file. D9 is marked as a choice for Jason
 in PRD 1.17 approval; it is design text, not an already approved role/policy expansion.
 No code may rely on that changed requirement before the approved PRD and independent review.
@@ -53,6 +57,8 @@ records, always marked and non-canon; default/current queries never opt into it.
 source lookup returns a typed conversion record and routes an authorized DOCX read, never
 stale Markdown or fake DOCX lines. Historical line cites still verify at commit/blob and
 show converted/historical state; archive access alone is not current story authorization.
+Pre-conversion text already in thread history is not rewritten/refreshed; its cites verify
+against their original commit/blob and show historical/converted state, not the current DOCX.
 A Markdown file recreated at a converted old path is unmapped, neither canon nor playground,
 excluded from lookups and flagged to the human. A new Markdown story at a different path in
 a converted book stays canon until import, flagged and offered for human import; no automatic
@@ -60,7 +66,11 @@ conversion. Existing playground scope rules remain. Clickable DOCX editor links
 DOCX graph exists yet. A Connections graph and its tests wait for Jason's J-b answer.
 
 Every conversion runs the pinned extractor before archiving and refuses unsupported output.
-An independently reviewed importer preserves every wiki token and front-matter key; metadata
+An independently reviewed importer preserves every wiki token and front-matter key.
+The v1 extractor does not accept OOXML hyperlinks: emit Markdown label/URL as literal text
+with a fidelity-report entry for lost clickable behavior, never w:hyperlink/r:id. Bare URLs
+stay literal; wiki links stay exact and host-clickable. Unsafe/unrepresentable URLs refuse.
+This handled literal mode is explicitly confirmed before archive push; metadata
 moves to the canonical manifest (type/name/appears_in/relationships feed the index). Links
 resolve across Markdown/DOCX through owned aliases, not host paths. A lost link fails the
 fidelity report. Plain links/front-matter values resolve or raise R4; unresolved chapter
@@ -236,7 +246,7 @@ extractor supports them; never guess equivalent namespaces.
 | body | word/document.xml | main | final by default; existing project/universe access |
 | footnote | word/footnotes.xml | w:footnote/@w:id | own story; same project/universe access as its document |
 | endnote | word/endnotes.xml | w:endnote/@w:id | own story; same project/universe access as its document |
-| comment | word/comments.xml | w:comment/@w:id | explicit part request; same project/universe access |
+| comment | word/comments.xml | w:comment/@w:id | explicit part request plus human comments setting; same project/universe access |
 | layout | word/headerN.xml, word/footerN.xml (N positive decimal) | none | denied in v1 |
 | supporting | separately declared non-story document | separate identity | C2 tools/scopes only; no DOCX scope inheritance |
 | opaque | media, styles, numbering, theme, fonts, custom XML, embedded objects | none | no raw bytes through O2 reader |
@@ -307,9 +317,12 @@ kind paragraph-mark-insert or paragraph-mark-delete with its revision ID;
 it never becomes a whole-paragraph deletion span. A mark-only insertion's
 text stays in original; a mark-only deletion's text stays in final. Inline
 run revisions remain independent. No view edits or accepts/rejects changes.
-Original/markup and comments are explicit view/part requests under the same project/universe
-authorization; no per-document grant is added. A default final-body read never silently
-includes deleted revisions or comment stories. Revision author/date metadata
+Original/markup require editor.agentReadTrackedDeletions=true; comment stories require
+editor.agentReadComments=true. Both are human-only and false by default (mos-1379); a comment
+in original/markup needs both. Check them in addition to ordinary project/universe access,
+refusing with editor-access-refused and no text when off. No role-level allowlist or
+per-document grant is added. A final-body read stays available and never silently includes
+deleted revisions/comments. Human editor review/save remains full-featured and unaffected. Revision author/date metadata
 is omitted from agent responses in v1.
 
 Closed story/run leaf table (all names in w namespace unless stated):
@@ -520,8 +533,10 @@ free chat plus optional checked line/DOCX citations under requireCitation. No pe
 export grant or O2-only session is a hidden prerequisite.
 
 The cursor authority revision is the server's current project grant, universe/mapping/scope
-revision and format-publication generation for the bound caller/session. It contains no
-sharing human or writing_access_events/writing_shares sequence. Recheck before every page,
+revision, the two human review-settings revisions and format-publication generation for
+the bound caller/session. It contains no
+sharing human or writing_access_events/writing_shares sequence. Check the review settings before every part/view/citation/search/index/context attachment,
+not only on first open. No request boolean can enable them. Recheck before every page,
 resolution, index hit and message insertion. Scope revocation and format changes invalidate
 cached authorization; metadata for missing/foreign IDs uses the same refusal as before.
 
@@ -540,10 +555,19 @@ remain on the bus through their reviewed schema, with no share-token authority l
 `editor.remoteURL` is a human-only setting, default unset. No same-host bare/filesystem/loopback
 remote is the default or qualifies as off-host durability. The human selects an off-stack-host
 private destination (for example private Gitea) and separately configures host-only auth.
+Until #431 corrects the real seat helper's shared jason.woltje credential route, the remote
+must be on a host/account that principal and all seat credentials cannot reach; private
+visibility alone proves nothing. Prefer a separate off-host instance. An existing-instance
+owner/org qualifies only after denial through the actual helper credential path proves no
+jason.woltje access. W3b tests that real helper route and seat identities against an authorized
+empty fixture remote, without printing/logging credential values; no dummy-token substitute.
 Only the host process pushes. No seat token can list/fetch/clone/fork/push the writing repo,
 no seat gets its credential, and no raw Gitea grant or store mount is created. Validate the
 owned remote, TLS/host policy and off-host storage identity; reject URL userinfo, unexpected
-remotes/object alternates and non-fast-forward updates. No silent fallback or force push.
+remotes/object alternates and non-fast-forward updates. Allow host pushes only to refs/heads/writing-published and
+refs/heads/import-staging/<operation-id>. A refused candidate retains a private non-reader
+staging ref and journal status; after publication the staging ref stays as an audit link.
+No automatic deletion or force-update of staging refs. No silent fallback or force push.
 
 Every writing-store commit pushes there. Agents read the local publication immediately;
 receipts/UI distinguish local commit and remote pending/failed/synced. Missing remote blocks
@@ -599,7 +623,7 @@ These are required future fixture gates, not implementation results.
 | A03 | XML ID absent/duplicate and ordinal behavior | missing/mismatched paraId cannot silently choose another node |
 | A04 | Emoji, combining characters, tabs, breaks and split runs | UTF-16 offsets, normalization and whitespace collapse fail |
 | A05 | Literal split-run wiki forms retained | no path/URL fetch; malformed/cross-paragraph tokens stay text |
-| A06 | Final/original/markup independently verified with moves/deletions | default final-body request cannot silently include deletion/comment stories; explicit part/view is separate, no document rewrite |
+| A06 | Final/original/markup independently verified with moves/deletions; review settings off by default | final read succeeds; original/markup or comment request/resolve refuses until matching human setting, both needed for original comment; no document rewrite |
 | A07 | Body/note/endnote/comment exact ownership | orphan/dangling/cross-document references and duplicate IDs refuse |
 | A08 | Package allowlist, aliases, CRC, XML/ZIP limits | external rel, macro, traversal, symlink, entity, ZIP bomb and timeout refuse |
 | A09 | Commit snapshot and publication ordering | next latest after Saved gets new commit; no worktree/draft fallback |
@@ -609,7 +633,7 @@ These are required future fixture gates, not implementation results.
 | A13 | Selection chip points only at committed text; ordinary lookup authority independent | draft mapping refuses; missing chip does not deny an authorized lookup |
 | A14 | Normal project/universe/source-scope checks in every thread/room | pin, guessed ID, foreign universe and revoked holder cannot grant access |
 | A15 | Latest after acknowledged save; explicit historical cite stays immutable | chip/per-send snapshot cannot force stale latest results |
-| A16 | Host-only store and remote credentials; checked reader routes only | no worker store mount, arbitrary git/engine access or seat remote token |
+| A16 | Host-only store and remote credentials; checked reader routes only | no worker store mount, arbitrary git/engine access or seat remote token; actual seat helper credential denied, not just a dummy token |
 | A17 | Existing Case 2 message/transcript policy | no O2-only/raw-session backdoor that skips existing thread/project checks; no false erasure promise |
 | A18 | Reader/resolve/flag plus existing Case 2 lookups/supporting writer after gates | native MCP, execute, save, replacement and story comment writes refuse |
 | A19 | Unconverted/support Markdown unchanged; converted path returns record and DOCX | no stale archive as chapter or DOCX-as-lines; historical line cite verifies by old commit/blob |
@@ -619,7 +643,7 @@ These are required future fixture gates, not implementation results.
 | A23 | Sibling chapter save | currentCommit/stale/cursor for untouched document remain unchanged |
 | A24 | Full page and oversized paragraph | end before overflow; first oversized row refuses without text; no unreachable subrange claim |
 | A25 | Every read/write/tool surface uses existing Case 2 isolation | same document ID across business/universe or replayed cursor refuses |
-| A26 | Host-only off-host remote and per-save push | unset/local-only/unexpected remote refuses opening; push outage visible, local next lookup still fresh |
+| A26 | Host-only off-host remote and per-save push | unset/local-only/helper-readable/unexpected remote refuses opening; real helper denial tested; push outage visible, local next lookup still fresh |
 | A27 | Conversion restore accounting and durable journal reconciliation | pre-conversion --restore loses counted row but cannot revive Markdown; no lost-event concealment |
 | A28 | Reopened M1 supports same-thread DOCX-read then supporting-note write | any room/project-authorized caller works; no per-document/share token; story/archive write refuses |
 | A29 | Readiness is reviewed runtime/extractor plus approved PRD, not caller fields | no request/go/setting can assert release or Hermes retirement |