docs: name save-group settings and enforce adoption gates

BUILD-LOG.md

@@ -5354,3 +5354,7 @@ Gander: after Duckworth-0100 design approval with C1-C5, prepared the two host-s
 2026-10-22T23:09:50Z | Gyro fenton-0006 push guard | identity gyro, purpose push, exit 0 documented degraded-pass CANNOT_ASSERT credential-unresolvable; audit gyro-q195-ci-queue-audit.jsonl. No fallback credentials or CI-green claim.
 
 2026-10-22T23:10:14Z | Gyro mos-1358 ruling recorded | Q36 / Vikunja 562 keeps C2 superseded notices OPEN with Jason. Markdown adoption refusal until W4b PASS is now a separate settled Mos build-order ruling, not a Jason question. D12 and Q2 distinguish them; no notice build authorized.
+
+2026-10-22T23:13:27Z | Gyro Q195 O2 fenton-0007 F7/F8 | Named human-only editor.saveGroupPauseMs=2000 and editor.saveGroupMaxMs=15000 with integer/range/cross-field validation and W3a UI/CLI refusal tests. W3b owns production adoption refusal until W4b; isolated fixture conversion remains testable without request-flag bypass. W4b owns adoption module/API tests and reviewed lifting only with committed-reader/citation readiness and, if Q36 approves, the separate notice row PASS. Q36 unresolved stays closed. Static ten-brief, setting-key/bounds, refusal/lift ownership and two-question checks pass. Docs only; no build, browser/worker run, product/queue/live change. Fenton checks F7/F8 on next push.
+
+2026-10-22T23:13:48Z | Gyro mos-1359 / r3 push guard | D13 records save-group timing as Mos's accepted reading of Q226 F41, not Jason's ruling; both defaults remain human-only settings. Push guard identity gyro/purpose push: exit 0 documented degraded-pass, CANNOT_ASSERT credential-unresolvable; audit gyro-q195-ci-queue-audit.jsonl, no credential fallback or CI-green claim.

docs/SESSIONS.md

@@ -1551,3 +1551,4 @@ are never rewritten or removed; corrections are new entries.
 2026-10-22 14:48 UTC | Researcher (Sonnet 5.5, 9bac0794) | Rows 220 and 216 resumed (sage-2708, sage-2716, sage-2719); local commits only | 220 e4a204836 on researcher/row220-r2 (on ea6dc9eff): C1 run tests, C2 default-reader M7 test, configDirectory fixture scope, BUILD.md round 2b. 216 4f3fbc25a on researcher/row216-r2 (on aca16404c): index cache, find/get/search/manuscript/universeInfo, PRD 1.14 levels. Nothing pushed, claimed or run; node --check not run. Waits for Sage's CLEAR and go; rebase onto 253 on a new branch before any gate.
 2026-10-22T23:03:39Z | Gyro (Codex gpt-6.1-sol, mos-1356) | Q195/Q231/Q233 O2 design rewrite, gyro/editor-o2 from c4f77373f | Canonical queue next gyro: nothing. Ten docs-only briefs; full-feature WordCraft, independent 15-crate/199-package security review, editor-only CSP candidate, instant git DOCX saves and retained Markdown/wiki sources, committed-only DOCX citation gate, no agent story prose. Static structure/source-anchor/scope checks only; no code, build/run, queue or live change. Fenton review requested after push.
 2026-10-22T23:09:38Z | Gyro (Codex gpt-6.1-sol, fenton-0006) | Q195 O2 design corrections on gyro/editor-o2 | F1 requirement boundary sent to Mos, adoption gated; F2-F6 source-checked docs fixes prepared. Ten briefs and two open owner items checked statically. No implementation, build/browser/worker run, queue or live action; Fenton re-check after push.
+2026-10-22T23:13:27Z | Gyro (Codex gpt-6.1-sol, fenton-0007) | Q195 O2 r3 F7/F8 | Save-group keys/defaults/validation and W3b refusal/W4b lift ownership explicit. Static docs checks only. Q36 remains open; no implementation or gate lift. Direct Fenton/Mos handoff after push.

docs/plans/2026-10-21_q195-writing-editor.md

@@ -234,8 +234,10 @@ D13. Setting `editor.commitCadenceMs` is human-only in UI and CLI, default 0. Ze
 submit immediately when a save group closes, not on every keystroke. WordCraft coalesces
 typing into an undo step (`crates/engine/src/session.rs:403-404`). Define a save group as
 that undo group, closed by a non-typing mutation, cursor/navigation change, explicit Save,
-a typing pause (human-only default 2 seconds), or a maximum active typing span (human-only
-default 15 seconds). Timer checkpoints need not split the user's undo history. Complete
+a typing pause (`editor.saveGroupPauseMs`, human-only default 2000 ms), or a maximum active
+typing span (`editor.saveGroupMaxMs`, human-only default 15000 ms). Validate finite integers:
+pause 100–60000 ms, maximum span 500–300000 ms, and pause <= maximum span. Refuse invalid
+or out-of-range values without changing the prior settings. Timer checkpoints need not split the user's undo history. Complete
 comments, review changes, layout changes and undo/redo close a group immediately. Finish
 IME composition before sealing its group. No per-key serialization or git commit.
 
@@ -246,6 +248,13 @@ The UI marks unsealed typing as unsaved, never Saved. No save waits for a later
 acknowledgment or for an agent turn. Unchanged revisions are status reads, not save requests.
 No source or message text in logs. W3b measures the tradeoff rather than assuming compressed
 DOCX commits delta efficiently.
+
+Mos's reading of Q226 F41, mos-1359: with cadence 0, each closed save group commits at once,
+at most 2 seconds after a typing pause or 15 seconds into continuous typing at these defaults.
+Unsealed typing shows as unsaved. Automatic submission with a seconds-long delay counts as
+“instantly committed” in this reading. This is Mos's interpretation, not a new Jason ruling.
+Jason can change both human-only timing settings through W3a.
+
 D14. Every accepted save has immutable bytes, document ID, revision, expected base blob,
 request ID and authenticated human identity. Serialize saves per document in revision order.
 Under the git lock, compare the base, make one commit and advance the canonical served ref
@@ -650,8 +659,11 @@ Pins keyed by business, human, project and stable document ID; path is display/r
 Reuse verb-sensitive ownership/grant checks. Stale grant/path/thread redacts content and unread
 counts but permits owned-pin deletion. Store saved-context envelopes on the bus, deny their
 publication to an agent until W4/W4b. Human-only settings with version checks/defaults include
-commit cadence 0, sharing visible-chip-per-send and require-citation off. UI/CLI use the same
-backend validation. Migration/restore, grant revocation, tester separation, concurrent repin,
+`editor.commitCadenceMs` 0, `editor.saveGroupPauseMs` 2000 and `editor.saveGroupMaxMs` 15000,
+sharing visible-chip-per-send and require-citation off. UI/CLI use the same backend validation.
+Both save-group keys use D13's bounds and cross-field validation. Test defaults, valid changes,
+fractional/nonfinite/out-of-range values, pause > maximum, stale settings versions and agent
+write refusals for each key through both interfaces, with prior values preserved on refusal. Migration/restore, grant revocation, tester separation, concurrent repin,
 unknown key and agent settings-write refusal tests are required. Sage assigns the schema edge;
 record the exact `<edge>.sql` path before acceptance (for example 3l-3m, never a guessed edge).
 Every table-adding row updates schema.sql, schema tests and T46's four-list accounting in
@@ -701,6 +713,13 @@ preserve full rich state via Markdown round trips. Next-lookup visibility needs
 D10-D15: authenticated human open/adopt/save/readback operations, exact schemas, one immediate
 commit per accepted save, revision ordering, base CAS, deduplication and served-ref publication
 before Saved. New writing store stays outside worker roots; all agent reads refuse before W4b.
+W3b ships the production adopt verb closed: refuse adoption of every real project document
+with `editor-adoption-unavailable` until the reviewed W4b release passes, per mos-1358.
+Refusal tests assert no DOCX, manifest, git commit or superseded record is created and the
+Markdown stays byte-identical. Test the actual human API, not just a hidden button. No human
+setting or request flag can lift this gate. Pure fixture conversion remains testable through
+an isolated scratch store unavailable to production routes; a caller cannot label a real
+project as a fixture. W4b owns the later release of the production refusal.
 Tests cover comments/notes/revisions/layout, every wikilink fixture form, byte-identical retained
 Markdown/front matter, malformed DOCX/ZIP limits, no-op status, stale base, lost replies,
 backpressure, rapid autosaves and remote push pending/diverged. A mocked clock alone cannot
@@ -846,6 +865,8 @@ An approved DOCX citation design still needs enforcement across bus, tools, gran
 
 `packages/writing/src/{read.mjs,citations.mjs,index.mjs}`,
 `packages/writing/tests/{read.test.mjs,citations.test.mjs}`,
+`packages/writing/src/adopt-markdown.mjs`, `packages/writing/tests/adopt-markdown.test.mjs`,
+`packages/bus/tests/writing-save.test.mjs`, `packages/webui/tests/writing-save.test.mjs`,
 `packages/bus/src/{broker.mjs,store.mjs,server.mjs}`,
 `packages/bus/src/migrations/<edge>.sql` (edge allocated by Sage at landing order),
 `packages/bus/schema.sql`, `packages/bus/tests/schema.test.mjs`,
@@ -867,6 +888,17 @@ After a successful human save, the next authorized lookup returns that commit, n
 pre-save view. All agent write/execute/save attempts into story content refuse. Pinning alone
 never grants reads. Named migration files use Sage's allocated version edge before acceptance.
 
+W4b owns lifting W3b's production adoption refusal only in its independently approved release,
+with server-owned readiness for the committed reader, citation resolver and sharing enforcement.
+No agent, human setting or request flag asserts readiness. Q36 unresolved keeps adoption closed.
+If Q36 approves notices, lifting also waits for the separately approved C2 notice row to pass;
+otherwise follow Jason's recorded Q36 disposition without inventing a notice implementation.
+Tests prove refusal before readiness, after revoked/missing readiness, and while required notice
+readiness is absent; a ready authorized human adoption succeeds and its new committed DOCX is
+readable through the checked tool on the next lookup. Keep isolated fixture adoption available.
+Run both package and human API refusal/success tests. This row owns the adoption module/tests
+listed above after W3b's handoff. No gate is lifted by this documentation change.
+
 ### Out of scope
 
 Expanding Case 2 Markdown semantics without its own approved amendment, unsaved reads,
@@ -875,7 +907,8 @@ native MCP and agent story writes.
 ### Gate
 
 Independent policy/parser/tool review, writing/bus/harness/business/WebUI tests and G1, plus
-fixture bypass probes. No partial rollout where UI hides context but another tool can read it.
+fixture bypass probes and the production adoption refusal/lift tests. No partial rollout where
+UI hides context but another tool can read it, or adoption succeeds before all required gates.
 
 ### Handoffs