Row 286 C2-03b: sage-2922 files-owned extension; Q4 back to Sage (user is the bot fetch identity)

agents/ludwig/work/queue-286/BUILD.md

@@ -61,6 +61,14 @@ Status: plan only. No code and no node yet. Row 258 comes first in my order.
    refuses `library-human-missing` before any git call when the slot is missing or fails the file checks
    (lstat: regular file, our uid, 0600). Her Gitea user: Q4.
 
+## Files owned extension (sage-2922)
+
+Added to the brief's list: `packages/bus/src/runtime.mjs` (`syncOptions` at :211-217 and the timer's
+call at :533) and `packages/library/src/mirror.mjs` (the state key list at :222). sage-2922 wrote
+`packages/library/src/runtime.mjs`, but the file is `packages/bus/src/runtime.mjs`. In mirror.mjs
+the row 222 contract holds: keys are added and none renamed. Before in-review I grep `packages/*/tests`
+for hash pins and path reads on both files and check them against every in-review manifest.
+
 ## Scope questions (for Dewey and Sage before code)
 
 - Q1. The askpass TOCTOU above. Is it accepted as is, or should the helper be a node script that does
@@ -73,7 +81,14 @@ Status: plan only. No code and no node yet. Row 258 comes first in my order.
   `packages/bus/src/runtime.mjs` (`syncOptions` and the timer's call) and
   `packages/library/src/mirror.mjs` (the state key list for `credential`). I'd add both to the
   manifest, with only those hunks changed.
-- Q4. Her Gitea user for `library-human`. The entry's `user` (`mapping.mjs:52`) is today the sync
+- Q3: approved, sage-2922. See above.
+- Q4: sage-2922 allowed `user` only if design 7.2 or the ruling after r11 makes it her account. Neither
+  does. `packages/library/README.md:31` at 94c33a43c says "`user` is the bot account name from design
+  step 3, required for sync", so it is the fetch identity and can't be reused for her save. Back to Sage.
+  My recommendation: `humanCredential(context, {user})` takes her login as a parameter, so this row adds no
+  mapping field. The row that adds the save, C2-02 or C2-11a with `editor`, names the field. That
+  needs a mapping schema change, which is Sage's call.
+- Q4 (original). Her Gitea user for `library-human`. The entry's `user` (`mapping.mjs:52`) is today the sync
   user, the bot's. The design names `editor {name, email}` (C2-11a) but no Gitea login. My
   recommendation: the entry's `user` becomes her Gitea login, used only with slot `library-human`. The
   fallback fetch keeps that same user too, because the bot slot was set up for it. Otherwise this row