morgana: row 193 design r5 (sage-1373 item 1, mos-1023 item 2): one user sentence names decisions, inbox entries, claims, tasks and project files; governance pin checks each

agents/morgana/work/queue-193/DESIGN.md

@@ -1,6 +1,6 @@
 # Row 193 design: many humans per business, human roles, private and shared threads
 
-Morgana (Opus 5.5), 2026-10-20. Revision 4: duckworth-0011 B3 and N5. Revision 3: duckworth-0008 B1, B2 and N1-N4, sage-1368. Revision 2: sage-1354 (5.7 private from the owner, 193b split) and gizmoduck-0018 (coverage and the R4 predicate in FED r4.1). Gitea #1691, queue row 193, brief `docs/plans/2026-10-20_human-users.md`
+Morgana (Opus 5.5), 2026-10-20. Revision 5: sage-1373 item 1 (mos-1023 item 2), the user sentence names every record the owner sees. Revision 4: duckworth-0011 B3 and N5. Revision 3: duckworth-0008 B1, B2 and N1-N4, sage-1368. Revision 2: sage-1354 (5.7 private from the owner, 193b split) and gizmoduck-0018 (coverage and the R4 predicate in FED r4.1). Gitea #1691, queue row 193, brief `docs/plans/2026-10-20_human-users.md`
 (blob f7472d1e47b1). Reviewer Duckworth, gate owner Sage. Base: `refactor` at 53bb59462.
 
 Read for this design: COMMON.md (53bb59462), the brief, Gizmoduck's federation design r4.4 (b67bc6de9 on
@@ -303,8 +303,13 @@ Every read an owner or reader session has, and its side of the line:
 | `project.list`, `names` | projects and instance names | business-wide for the owner, visible |
 
 So a decision a user-thread run raises shows in the owner's `inbox` or `decisions`, with the free text the
-run wrote, and a record it writes shows in the owner's `project.file`. Either can quote the user. 5.7 doesn't call it private. The users' help text (R5) and the
-Console's share and thread pages say so: "Decisions your thread's agent raises, and records it writes to the project, go to the business owner."
+run wrote. Its role claims show in `agents`, its task writes in `tasks`, and a record it writes in
+`project.file`. Any of these can quote the user, and 5.7 doesn't call them private. The users' help text
+(R5) and the Console's share and thread pages say so in one sentence, which FED R6 reuses (mos-1023 item 2,
+duckworth-0012 N21):
+
+> The business owner sees your thread's agent's decisions, inbox entries, claims, tasks and project files,
+> but not your messages.
 
 The gated-raise route. A user-thread run's uncited gated raise or hard wait routes to the human (broker.mjs:1677-1680).
 FED r4.5 (acd5f1f42, B9) settled this with no guard: the tester guard at :1683 (`tester-thread-human`) is not
@@ -405,8 +410,9 @@ Bus, each in `packages/bus/tests/` (193b1: viewer, mixed grants, board reads, th
 - Board reads refuse users and viewers.
 - Governance pin (B1, sage-1368): a user-thread run raises a decision; it shows in the owner's
   `decisions recent` with its question text, and `inbox` lists it when routed to the human; the run's
-  `record.write` shows in the owner's `project.file` (B3); the user's message bodies stay hidden from the
-  owner's `trail` and `replies`.
+  role claim shows in the owner's `agents`, its task write in `tasks`, and its `record.write` in
+  `project.file` (B3, sage-1373); the user's message bodies stay hidden from the owner's `trail` and
+  `replies`. The test names each item of the 5.7 user sentence, so the sentence and the pin match.
 - `trail`, for the owner, a reader session and the tester (193b1): a user's thread message as `subject`
   fails `message-not-found`; a decision trail that reaches such a message omits it, its deliveries and its
   events. Once the thread is shared with the owner, the owner's trail shows it.