docs: align editor conversion boundary and host restore with PRD d8

BUILD-LOG.md

@@ -5387,3 +5387,5 @@ Gander: after Duckworth-0100 design approval with C1-C5, prepared the two host-s
 Row 299 (573, #1806, Gander, Filbert): before, the P10 band test timed a fault run minus a separate baseline run, and a loaded whole-suite run went red. Mos approved direct timing from host /proc/uptime stamps with ambient load only (mos-1409). After: rebased onto 80793d824 as ffa93b054 (range-diff 3/3 =, manifest 277ace0b unchanged). Gate 07:26Z-07:50Z: case1 whole 3x 53/0/0, cli whole 917/0/0 (59 files, load 1.54-7.17), P10 inner 2.27 s, outer 4.01 s, M1-M6 killed. M4's planned guard return then exact outer-reason failure counts as its kill (sage-3271, mos-1426). Filbert APPROVE c31084 rev 3485, N1 M1 margin 0.02 s. 299 LANDED ffb2fedfb 08:03Z, done rev 3487, #1806 closed c31087; queue commit 8a35ffadb (revs 3474-3487). Row 303: Duckworth APPROVE c31079 rev 3480 with C1, the whole-file gate. Rows 219 (bfa421b6c) and 295 r2 (b16cef1d0) rebases: Dewey static clean. Corrections: Launchpad and Gander have no token, and the CLI refuses another seat's token file, so I posted both requests as sage (c31082, c31083). My sage-3265 wording led Duckworth to poll queue show into Gander's slot (07:20Z-07:26Z); I ruled it ambient load (sage-3274).
 2026-10-23T10:48:40Z | Sage, rows 302, 295 and 219 landings, the Docker pool diagnostic, rows for Vikunja 590 and 591 | Before: refactor 1ac655005. 302 (#1809, Gizmoduck, Dewey) LANDED 3ed9fd754 08:49Z: 7 commits onto 1ac655005, range-diff all =, tree = gated merge 783602e06; queue commit 07802dc57 (revs 3488-3494). Row 219's gate went 11/3 in test-release.sh: release activate's health check failed because Docker could not create sage-diag1437_default, since all predefined address pools were used up. Under mos-1437 I reproduced it on clean 07802dc57 (11/3, the same stderr). I then removed 18 unused gate _default networks, and the rerun went 14/0 with the run-task marker ok. Mos accepted the removal and ruled that a probe that can create something waits for the go and a removal waits for the report (mos-1438). 295 (#1801, Morgana, Dewey) round 2 gate on d68b4300d (manifest e94c9aeb) was green. It LANDED 2efd127ce 10:10Z: 9 commits onto 07802dc57, HEAD~1 tree = gated a86592ffc. Done rev 3502, #1801 c31105, P19 414 c911. 219 (#1720, Rocko, Dewey): the restart on the post-295 merge 054da642f (manifest 4a2271dd, my mos-1439 call) passed node 2523/0/2 and shells 449/0, with 24 mutants killed. It LANDED 5fdfd7275 10:40Z (8 row commits plus packet-only evidence, tree e86a84a85 = gated). Done rev 3509, #1720 c31110, P19 416 c913. Queue commit 90633c864 (revs 3495-3510). Brief docs/plans/2026-10-23_gate-env-rows.md names rows for 590 (claude-session slug) and 591 (compose network cleanup), and DEFERRED.md gets 219 N1 (U6). Row 272 (Huey) conflicts with 5fdfd7275 in code, so it moves back to in-progress for a rebase. Its new fallback is bounded to a session.list access-refused on an omitted-session route (sage-3357). Corrections: my network create probe ran before Mos's go, and the removal ran before the report. My first slot-order line put the diag start at 09:44Z; it was about 09:41Z. My 219 push piped its output through grep, but the after-fetch confirmed origin. Queue commit 90633c864 also carries Huey's rev 3510 (272 back to in-progress), and its message names only 3495-3509.
 
+
+2026-10-23T11:03:46Z | Gyro Vikunja571 mos-1444 PRD d8 follow-on | Branch gyro/editor-571-d8 from origin/refactor c16e943b9. Both designs now keep library.convert outside ACTIONS/ROUTED and broker processing, retain REQ-WAIT-1/hard-wait test unchanged, constrain unmarked story eligibility to mapped book/playground scope, and add whole-host pre-import restore recovery from remote import manifests plus the Gitea archive commit. Lookups refuse until one current version is proven; VM1012 restore needs Jason present under Q185. W7 no longer owns hard-waits.test.mjs. Canonical queue next gyro returned nothing; direct Mos assignment governs. Static diff, exact replacement and append-only checks pass. No code, tests, build, browser, private-file or live action. Fenton re-check requested after authorized branch push.

docs/SESSIONS.md

@@ -1575,3 +1575,4 @@ are never rewritten or removed; corrections are new entries.
 - 2026-10-23T07:59:57Z | filbert (Claude Opus 5.5, T3 048f3c63) | row 299 manifest round 1 (#1806, Vikunja 573, Gander, manifest 277ace0b on ffa93b054) | approve in 31084, rev 3485; static on git objects (blobs = reviewed 1ec2b9765, product = base 80793d824); gate receipts 63db96d8b read, not rerun: case1 53/0 x3, cli 917/0 (59 files), M1-M6 killed; N1 M1 margin 0.02 s
 - 2026-10-23T08:10:29Z | sage (Opus 5.5, 1ef1e4f8) | 299 gate and landing, 303 review, 219/295 rebases | 299 LANDED ffb2fedfb 08:03Z (done 3487, #1806 c31087); queue-commit 8a35ffadb (revs 3474-3487); 303 Duckworth approve rev 3480; requests posted as sage for 303 (c31082) and 299 (c31083); 219 full restart on bfa421b6c from 08:08Z (sage-3283)
 - 2026-10-23T10:48:40Z | sage (Opus 5.5, 1ef1e4f8) | 302/295/219 landings, Docker pool diag, 590/591 briefs, 272 rebase | 302 LANDED 3ed9fd754, 295 LANDED 2efd127ce, 219 LANDED 5fdfd7275 (#1720 c31110, P19 416 c913); test-release 11/3 from exhausted Docker pools, 18 networks removed (mos-1437/1438); queue-commit 90633c864 (revs 3495-3510, 3510 Huey's); 272 rebase and fallback ruled (sage-3357)
+2026-10-23T11:03:46Z | Gyro (Codex gpt-6.1-sol, mos-1444) | Vikunja571 PRD d8 docs alignment | R6 vocabulary boundary, mapped-folder eligibility and R14 whole-host recovery updated in parent/W4; static checks only, no tests or live changes. Fenton reviews; Sage lands.

docs/plans/2026-10-21_q195-writing-editor.md

@@ -265,7 +265,9 @@ After each file's conversion publication, the authorized format map is a typed h
 sourceCommit,conversionCommit}`. kind is chapter or supporting-document; current chapter
 format is docx, supporting format markdown; state is current or converted-archive. scope distinguishes canon, playground, supporting
 and archived without format-based promotion. Type-folder entity notes remain Markdown;
-an unmarked-folder story is eligible for human selection, one file at a time (mos-1368 Q18). location
+a story file in an unmarked folder inside a book or playground is eligible for human selection,
+one file at a time. A story file outside every book and playground is unmapped and converts
+only after the human maps its folder, per PRD 1.17 REQ-LIB-8 and mos-1368 Q18. location
 is an opaque owned location, never a host path/capability. Publish only entries the caller's
 live scopes allow, no title/path leak from denied documents. Agents get this map through
 reviewed library/universe lookup results and normal authorized Case 2 context so they know formats
@@ -321,8 +323,9 @@ amendment, W4b PASS and live committed-reader/citation readiness, W7 reviewed im
 release, Hermes retirement (#423 step 5, with its old write/store access removed), verified
 host-only off-host durability and an authenticated human start. `library.convert` is a
 human-only CLI/Console verb run through the host async processing adapter, outside agent
-vocabulary/role grants and off the read-verb list. Its action remains a hard wait under
-REQ-WAIT-2/3 until the approved PRD says otherwise; it never joins ROUTED silently.
+vocabulary/role grants and off the read-verb list. It is not in ACTIONS or ROUTED and never
+reaches the broker. A role file naming an action outside the vocabulary is already refused.
+REQ-WAIT-1 and its hard-wait test remain unchanged (mos-1444 R6).
 `editor.conversionHumans` is human-only, default business owner only. Folder setting/mapping
 have one authoritative archive-prefix value; the library mapping and editor cannot disagree.
 Archive prefixes cannot overlap playground/supporting prefixes. Conversion preserves bytes
@@ -1155,7 +1158,7 @@ The source archive and private DOCX repository cannot publish atomically through
 `packages/bus/tests/{writing-save.test.mjs,chapter-format.test.mjs,schema.test.mjs,conversion-events.test.mjs}`,
 `packages/harness/src/tools.mjs`, `packages/harness/tests/chapter-format.test.mjs`,
 `packages/business/src/{vocabulary.mjs,business.mjs}`,
-`packages/business/tests/{vocabulary.test.mjs,business.test.mjs,hard-waits.test.mjs}`,
+`packages/business/tests/{vocabulary.test.mjs,business.test.mjs}`,
 `scripts/mosaic`, `packages/cli/src/library.mjs`, `packages/cli/tests/library-convert.test.mjs`,
 `roles/{companion,continuity,fact-checker,ideas,proofreader,research}.md`,
 `packages/webui/src/{writing-http.mjs,library-http.mjs,cli.mjs,serve.mjs,bus.mjs}`,
@@ -1214,6 +1217,11 @@ bus restore. Test the third case explicitly: convert, then rollback --restore a
 backup, losing the bus conversion event while archive and DOCX commits remain. The normal
 counted-event approval/loss protocol applies; reconcile immutable commits/journal with new
 recovery events before lookups resume. Never revive Markdown or replay authorization grants.
+The fourth recovery case restores the whole host from a backup taken before an import,
+losing its writing store and host import records as well as bus events. Rebuild the host
+record from the import manifests on the writing store's off-host remote and the archive
+commit in Gitea. Chapter lookups refuse until recovery proves one current version.
+Restoring VM 1012 boots it, so Jason is present under Q185 (mos-1444 R14).
 Old release capability preflight must refuse converted projects it cannot interpret.
 
 Update the six creative .md role contracts' obsolete 'Every item cites the lines' text:
@@ -1222,8 +1230,9 @@ source format/scope from the map, archived never canon, and no story/conversion
 still use only their approved lookups/message/supporting-write tools. Schema/role expansion
 waits for the approved PRD, and existing role JSON never grants library.convert. Expose the
 human CLI/Console conversion verb through runtime/processing.work and async readback, not
-the agent tool list. Hard-wait tests are at business/tests/hard-waits.test.mjs:22; the new
-action remains GATED_ONLY unless the approved PRD explicitly changes it.
+the agent tool list. library.convert is absent from ACTIONS and ROUTED; host processing
+never sends it to the broker. Role vocabulary validation already refuses an unknown action.
+REQ-WAIT-1 and packages/business/tests/hard-waits.test.mjs remain unchanged (mos-1444 R6).
 
 The importer lives at `packages/writing/src/import-markdown.mjs`, owns a reviewed AST mapping
 from vendored markdown-it to the WordCraft DOCX model, and validates source token/metadata,

docs/plans/2026-10-22_q195-docx-citations.md

@@ -15,8 +15,9 @@ from the reviewed baseline except their replaced per-document-scope wording.
 Q235–Q237 P1–P6 and mos-1372 D1/D2 settle the design basis: canon and playground story
 files become DOCX, retaining universe/book and source scope. Type-folder notes, agent files,
 instructions, PRDs, character sheets, summaries and supporting documentation stay Markdown.
-An unmarked-folder story is eligible; the human selects one story file at a time. New
-stories start directly as DOCX in the human-selected universe/book or playground, without a
+A story file in an unmarked folder inside a book or playground is eligible, and the human
+selects one story file at a time. An unmapped story file converts only after the human maps
+its folder. New stories start directly as DOCX in the human-selected universe/book or playground, without a
 Markdown precursor, under the same production-opening gate as import.
 
 The October 27 release stays Markdown. Production import/new-story opening waits for W4b,
@@ -24,7 +25,9 @@ W7, the post-10-27 release, the approved Case 2 PRD/brief amendment, Hermes reti
 (#423 step 5) and configured off-host durability. The first real use on Melanie's books
 also waits for Jason's scoped go and mos-1374's protected manual VM1012 backup before the
 first real import, handled by its authorized human operator, not this design seat. All starts are human-only; `library.convert` has no role
-grant or agent request path and stays a hard wait unless an approved PRD changes it.
+grant or agent request path. It is not in ACTIONS or ROUTED; the human host processing
+adapter never sends it to the broker. A role file naming an action outside the vocabulary
+is already refused. REQ-WAIT-1 and its hard-wait test remain unchanged (mos-1444 R6).
 Nothing in this document authorizes conversion, new private story creation or deployment.
 Q234's exact frame CSP, mos-1363 and S0 M1–M14 remain unchanged implementation gates.
 
@@ -592,9 +595,10 @@ join stack-release COUNTED and T46 exactly once, so post-backup conversion event
 to --events and the existing restore approval/counting behavior. No new private conversation,
 per-document grant or per-send share tables are created for D9.
 
-Three recovery cases are required: (1) crash after durable DOCX staging but before archive
+Four recovery cases are required: (1) crash after durable DOCX staging but before archive
 push, (2) crash after archive push before publication, and (3) rollback --restore from a
-pre-conversion bus backup while archive commits and O2 documents remain. The source is pinned
+pre-conversion bus backup while archive commits and O2 documents remain, and (4) a whole-host
+restore from a backup taken before an import. The source is pinned
 until final publication in cases1/2; after archive push state is visibly pending, never
 'original untouched'. Case3 drops conversion rows only through the counted/approved restore
 path. The durable host conversion journal/format registry is not restored from that older bus
@@ -606,6 +610,12 @@ pending operation to the human. Do not replay chapter text into an old index or
 Incompatible old binaries cannot activate converted projects through the supported controller;
 raw privileged rollback tampering is outside the guarantee. Never rewrite git/run history.
 
+Case4 also loses the local writing store and host import records. Recovery rebuilds the
+host record from the import manifests on the writing store's off-host remote and the
+archive commit in Gitea. Chapter lookups refuse until it proves one current version;
+missing or inconsistent remote evidence cannot revive old Markdown as current. Restoring
+VM 1012 boots it, so Jason is present under Q185 (mos-1444 R14).
+
 Hermes retirement (#423 step5) is a production-opening prerequisite, with old story-write and
 store-read access removed before any conversion/new-story operation. W7 checks its retirement
 receipt and host capability preflight; no design seat retires services or accesses Melanie's
@@ -644,7 +654,7 @@ These are required future fixture gates, not implementation results.
 | A24 | Full page and oversized paragraph | end before overflow; first oversized row refuses without text; no unreachable subrange claim |
 | A25 | Every read/write/tool surface uses existing Case 2 isolation | same document ID across business/universe or replayed cursor refuses |
 | A26 | Host-only off-host remote and per-save push | unset/local-only/helper-readable/unexpected remote refuses opening; real helper denial tested; push outage visible, local next lookup still fresh |
-| A27 | Conversion restore accounting and durable journal reconciliation | pre-conversion --restore loses counted row but cannot revive Markdown; no lost-event concealment |
+| A27 | Conversion restore accounting and durable journal reconciliation | pre-conversion bus --restore or whole-host restore reconciles remote manifests and archive commit; lookups refuse until one current version is proven; no lost-event concealment |
 | A28 | Reopened M1 supports same-thread DOCX-read then supporting-note write | any room/project-authorized caller works; no per-document/share token; story/archive write refuses |
 | A29 | Readiness is reviewed runtime/extractor plus approved PRD, not caller fields | no request/go/setting can assert release or Hermes retirement |
 | A30 | Canonical schemas and complete selections | unknown keys, inconsistent ranges, xmlId null mismatch and noncanonical story IDs refuse |