Untested: record R7 reload ordering and slot boundaries (#1802)

Quackerjack stops row 296 here. BUILD.md holds the verified reads, the proposed
harness design, the open decisions for Lena, and the R2 learning that R7 depends on.
No test or code changes in this commit.

BUILD-LOG.md

@@ -5411,3 +5411,10 @@ Row 299 (573, #1806, Gander, Filbert): before, the P10 band test timed a fault r
 2026-10-23T17:29:46Z | Gyro Vikunja571 sage-3542 Connections amendment | Branch gyro/editor-connections-design cut exactly from landed PRD1.17 30e6bb680; read REQ-LIB-5 in that PRD. Replaced stale J-b waits in parent and W4. Proposed W8 owns current authorized Markdown/DOCX links/backlinks list, labels, versioned refresh, leakage refusals and fixture tests. Build order under mos-1470/comment961 is W7 closed routing candidate, W8 landing, then W7 human first-real-import opening. No REQ-LIB-8 condition or acceptance change. Q234/mos-1363/S0 M1-M14 and post-10-27/MVP priority fixed. Static diff, twelve brief sections and append-only checks pass. No repo Node, tests, build, browser, queue mutation or live action. Fenton reviews after authorized docs branch push; Sage lands on approval.
 
 2026-10-23T17:32:37Z | Gyro sage-3544 fenton-0016 N1/N2 delta | Before: W7 Gate/final real-conversion list omit the W8 build-order cross-reference and W8 human-view filtering cites agent settings. After: both locations explicitly put W8 landing before human opening as mos-1470 build order, not acceptance; comment/tracked-deletion links are not current story links and never appear in the human Connections view regardless of agent settings. New commit atop approved 5af060fb5, no amend. Static diff and append-only checks pass. Docs only, no repo Node/tests/live action. Fenton checks only this delta.
+
+## 2026-10-23 — Lena, row 296 / #1802 FED R7 start
+
+Before: R4 and R6 landed in base 45dca69f6; no scratch two-instance acceptance script.
+Plan: preserve Quackerjack handoff c6ab9bdc9, add isolated script/CLI test harness with real
+Console proof in transient user services, map assertions and two mutants for Filbert.
+Untested: all Node/tests and shared gate wait for Sage CLEAR; no production or live state changes.

agents/della/work/queue-224/BUILD.md

@@ -1,170 +0,0 @@
-# Row 224 — C2-05b broker lookups and typed tools (#1725)
-
-Owner: Della; reviewer: Dewey. Assignment sage-2795; scope extension sage-2804.
-Base: `4f3fbc25a` (Researcher C2-05a). Branch: `della/row224`.
-Brief: C2-05b in `docs/plans/2026-10-20_case2-rows.md` at `aca16404c`
-and `51cc0445c`; design section 3, 5.3 M3 and 7.2; C2-05a BUILD rulings.
-
-## Execution boundary and progress
-
-Code/docs and local Git only while row 253 holds the gate. No Node (including
-syntax checks), HTTPS Git, queue claim, test or push until Sage's CLEAR.
-Tests are written first; their RED/GREEN runs are deferred, not claimed.
-Queue next is deferred too: its executable uses Node. Sage assigned this row
-explicitly. After 253 and 216 land, rebase under a new branch name.
-
-- Pre-flight: query.mjs consumes `{repo,commit,mapping}`; broker cannot import
-  Git/filesystem library code because it is in the sandbox import closure.
-  Runtime injects the host lookup adapter; existing human file/status/sync stay.
-- Pre-flight: resolved has no project list and a library is never a checkout.
-  Bundle needs an explicit library flag from launcher business configuration.
-- M3 reading: exact creative base is five lookups plus send_message; retain
-  explicitly granted broker web_search/web_fetch for research/companion under
-  landed C2-08 and sage-2804. No generic spec, task, evidence or decision tools. Residual (mos-1308): those
-  reads lack broker action checks; their typed-tool absence is the only fence
-  for creative roles. M1/M2 deny bash; broker-side refusal is outside this row.
-  Mos confirmed this interpretation in mos-1308; design wording fix belongs to Gosalyn. Other definitions retain their current tools.
-- Multi-library businesses use an optional project ID; omit it only with one
-  configured library. Universe is required for all five tools, including get.
-- Missing library uses the brief's `library-not-configured`; argument errors
-  reuse `invalid-request` and C2-05a query codes. No new action or authority.
-
-## Manifest (draft code, unrun)
-
-- bus/src/broker.mjs: five lookup verbs, strict args, holder/business rechecks.
-- bus/src/runtime.mjs: host lookup adapter, stale-before-read sync, served pin.
-- harness/src/tools.mjs: five schemas; creative exact-set filtering.
-- harness/src/bundle.mjs: library flag forwarded to typedTools.
-- cli/src/launcher.mjs: one flag derived from trusted business projects.
-- bus/tests/library-lookups.test.mjs: real query/broker/socket/runtime cases.
-- harness/tests/library-tools.test.mjs: schemas, role snapshots, bundle parity.
-- cli/tests/thread-launch.test.mjs: flag reaches a real launched bundle with no library checkout.
-- agents/della/work/queue-224/BUILD.md: manifest, rulings and deferred verification ledger.
-
-## Verification ledger
-
-No test or syntax-check run yet. Acceptance requires full bus/cli/harness suites
-and every scripts/test-*.sh on Sage's gate; focused files and affected CLI/
-seat import-closure tests precede that only in an authorized CLEAR.
-
-## Coordination
-
-Huey272 reports no runtime/bundle/launcher overlap. Rocko219 changes launcher
-THREAD_DEFINITIONS checks only, separate from our buildBundle flag argument.
-The launcher argument is required: bundle cannot derive library presence from
-checkout IDs (a library has no agent clone). No role, authority or config schema
-changes; library project entries are already validated and protected by M9.
-
-## Mount and pin impact (inspection only)
-
-No new imports in broker.mjs or tools.mjs; no RUNNER_FILES or sandbox mount
-addition. runtime.mjs is host-only and already imports library index.mjs.
-Bundle forwards only a boolean, never a root/mapping/slot/credential. The
-existing import-closure tests are bus/tests/project-runtime.test.mjs and
-seat/tests/sandbox.test.mjs. Grep found no literal sha256 pin for runtime.mjs
-or bundle.mjs; bundle tests derive current source digests through SOURCES.
-Library sources remain in the existing whole-directory release copy.
-
-## Runs to schedule only after CLEAR
-
-Set TMPDIR=/mnt/storage/scratch/tmp. Focused new bus/harness files first,
-then existing library.test.mjs, library-sync.test.mjs, project-runtime.test.mjs,
-harness creative/tools/spec-tools/bundle files and affected CLI launch tests.
-Follow with the required whole bus/cli/harness suites and Sage's full shell gate.
-No timing claim yet: use the repository/Sage per-file limits and record every
-command, outcome, elapsed time and timeout before acceptance. No focused skip
-or pattern run substitutes for whole-file gate evidence.
-
-## Read-through findings and residuals
-
-- Library get requires universe although the older design table omitted it;
-  section 3 isolation rule and C2-05a's accepted API are binding.
-- Query type enum matches mapping.TYPES (five values); manuscript is a distinct
-  lookup and not a find type. Unknown host-path/commit/business/accept fields
-  are refused; explicit project is restricted to this business's library list.
-- Async reads recheck the live holder and current project revision. A stale
-  read attempts sync, then takes the new served snapshot; a returned fetch
-  failure/divergence keeps serving the old pin. Busy sync uses the current pin.
-  Unreadable state, no served commit or unsafe configuration refuse. Query
-  and sync never hold a SQLite transaction over await.
-- Processing halt refuses new agent lookup work and rechecks before returning
-  async results. Existing human library file/status/sync behavior is unchanged.
-- Timer sync and reads still use C2-03a's 60-second contract. No timer tuning or
-  resource-limit schema is introduced by this row. Q222 creative reply settings
-  are in C2-06; no reply guard or writing capability is implemented here.
-- The generic tool socket's existing 60-second client timeout can precede the
-  server's 120-second Git timeout. This row does not change the generic timeout;
-  a timed-out lookup is read-only and retryable, never a write/outcome claim.
-- All tests are authored but unrun. No RED, GREEN, syntax, runtime performance,
-  sandbox, broker/harness suite, shell gate, claim or push evidence exists yet.
-
-## Candidate review checklist (read-through only)
-
-- [x] Five verbs mapped to real C2-05a methods, all require universe.
-- [x] Default sole library or explicit owned project; no caller repo/commit.
-- [x] Human-only file/status/sync gates kept; lookup holder rechecked.
-- [x] Async socket dispatch includes lookup verbs through LIBRARY_VERBS.
-- [x] Stale/unknown fetch syncs first; results use current immutable served pin.
-- [x] Six/eight creative names per mos-1308; other roles retain their tools.
-- [x] Launcher -> bundle -> typedTools passes presence without a library clone.
-- [x] No imports added to sandbox source closure; no mount change.
-- [ ] Execute new tests, RED characterization, full files/suites after CLEAR.
-- [ ] Rebase after rows 253/216 land, under a new branch name.
-- [ ] Claim/push only in Sage-authorized gap; Dewey review and Sage gate.
-
-Candidate preservation commits are explicitly unrun under sage-2795; they are
-not completion, green-suite or landing claims. No dependencies installed.
-
-Correction: the first committed-range diff --check found a blank line at EOF
-in the new library-tools test, missed while it was untracked. Removed in a
-follow-up local commit; the complete range must be checked again. No tests ran.
-
-## Shared-log receipts for Sage (sage-2815)
-
-The shared logs are unchanged from the base in this row. Sage appends these
-receipts in the landing sweep; they are preserved here, not in the manifest.
-
-For `BUILD-LOG.md`:
-
-```text
-2026-10-22T16:36:30Z | Della row224 C2-05b #1725 preparation | Before: C2-05a queries exist at 4f3fbc25a but no broker lookup verbs or typed tools. Scope: broker/tools plus Sage-authorized runtime/bundle integration, tests and docs. Existing human-only library reads retained; five agent queries require a live holder and trusted configured source. Code/docs only under row253 gate; no Node/test/push/claim. Runtime ownership coordinated with Rocko219/Huey272.
-```
-
-For `docs/SESSIONS.md`:
-
-```text
-2026-10-22T16:36:30Z | Della (sage-2795 / sage-2804, Q220) | Row 224 C2-05b #1725, della/row224 base 4f3fbc25a | Read both pinned briefs and C2-05a source; preparing broker/typed tools and authorized host runtime/bundle seams. No queue command, Node, HTTPS Git, claim, test or push during Gander gate. Dewey reviewer; Rocko/Huey runtime coordination sent. Tests and integration verification deferred to CLEAR.
-```
-
-Local-only draft pins 19c0a7adf/7cf39c390 are superseded by the
-log-free candidate. Saved as local branch della/row224-draft-with-logs before
-rebuilding the unpublished candidate commit; no remote history changed.
-
-## Dewey dewey-0852 and Sage sage-2819 — focused corrections
-
-B1: inline freshness uses max(lastFetch, lastError.at), not lastFetch alone.
-An error within 60 seconds counts as a recent attempt, so later lookups serve
-the old served pin without another fetch. Keep inline sync: the brief requires
-it and businesses without timed libraries have no sync timer. The extended
-failed-fetch test makes reads at +1, +59,999 and +60,000 ms (one attempt total),
-then +60,001 ms (second attempt). All reads must return the old commit.
-
-Required mutant M-B1: remove lastError.at from recentAttempt. The repeated
-reads must fail the attempted-count assertion. This mutant has NOT been run.
-
-Residual (Sage will defer): the first inline fetch in each outage window can
-still exceed the tool timeout (60 seconds, or the runner broker client’s
-30 seconds). Bounding that fetch is out of scope for 224. Subsequent reads
-are paced by persisted lastError.at. No claim of first-read outage latency.
-
-N1: whole bus, cli and harness suites are required, plus the shell gate.
-If the new thread-launch integration test skips due to sandboxProblem(),
-name the skip; a skip is not launcher integration proof.
-N2: cli/tests/thread-launch.test.mjs now depends on library/tests/helpers.mjs
-mappingEntry() and library/tests/fixtures/mapping.json. Changes to that fixture
-must rerun the CLI launch file.
-N3: harness/tests/library-tools.test.mjs compares the type enum to mapping.mjs
-TYPES, so adding a mapped type cannot silently leave the typed tool behind.
-
-These edits are local code/docs only. No Node, RED/GREEN run, mutant, claim,
-HTTPS Git or push. New local pin goes to Dewey/Mos/Sage for focused review.

agents/della/work/queue-284/BUILD.md

@@ -1,196 +0,0 @@
-# Row284 C2-05c — supporting scope and served-tree blob (#1789)
-
-Owner Della; reviewer Dewey; gate Sage. Build start sage-3658/3660 (10-23).
-Branch della/row284. Original prerequisite base Honker28346bad7ea3;
-merge fc05bcbc3 carries22423816cf28 and2164f3fbc25a intact. Only conflict was
-CLI thread-launch's added footer tests: retained both full test bodies and
-assertions. No prerequisite code copied. Every prerequisite needs its own
-review/mutants/landing under mos1351; rebase after283 lands.
-
-## Execution status
-
-UNTESTED. No Node, node--check, test or mutant run before Sage CLEAR. First
-own commit is the authorized old-test migration; the implementation follows.
-Sage authorizes an immediate untested push. No queue write or shared-log edit.
-224 stays first;284 is critical to Bubba288. T4 for224 is not a CLEAR yet.
-
-## Binding readings
-
-Brief C2-05c at94c33a43c:1737-1789, Q226, sage2918 and mos1330 item3.
-get defaults canon; explicit playground/supporting opt-in; mismatch null.
-Sort full outgoing/incoming lists supporting, playground, canon before paging,
-keep cross-scope links and universe filter. Manuscript stays canon/playground.
-No all/array scope, write tool, guard, mapping or creative-name-count change.
-
-## mos-1330 old-test migration (separate commit)
-
-All paths below are packages/library/tests/query.test.mjs. Baseline file at
-fc05bcbc3 matches216's file. Source assertions retained; negative calls receive
-explicit scope too, so universe isolation cannot pass on default-scope denial.
-
-Call/assertion 348 -> 348:
-
-```js
-// OLD
-  const rin = await get(s, { universe: 'idea', path: 'Drafts/New World/Characters/Rin.md' });
-// NEW
-  const rin = await get(s, { universe: 'idea', path: 'Drafts/New World/Characters/Rin.md', scope: 'playground' });
-```
-
-Call/assertion 350 -> 350:
-
-```js
-// OLD
-  assert.equal(await get(s, { universe: 'harbor', path: 'Drafts/New World/Characters/Rin.md' }), null);
-// NEW
-  assert.equal(await get(s, { universe: 'harbor', path: 'Drafts/New World/Characters/Rin.md', scope: 'playground' }), null);
-```
-
-Call/assertion 366 -> 366:
-
-```js
-// OLD
-  assert.equal(await get(src(ref, mapping(WITH_BLEND)), { universe: 'blend', path }), null);
-// NEW
-  assert.equal(await get(src(ref, mapping(WITH_BLEND)), { universe: 'blend', path, scope: 'playground' }), null);
-```
-
-Call/assertion 367 -> 367:
-
-```js
-// OLD
-  const own = await get(src(ref), { universe: 'harbor', path });
-// NEW
-  const own = await get(src(ref), { universe: 'harbor', path, scope: 'playground' });
-```
-
-Assertion 349 retained, OLD == NEW:
-
-```js
-  assert.equal(rin.scope, 'playground');
-```
-
-Assertion 368 retained, OLD == NEW:
-
-```js
-  assert.equal(own.scope, 'playground');
-```
-
-The null assertions at350 and366 are the complete OLD/NEW expressions above:
-expectation remains null. Added one separate no-scope playground-get -> null
-behavior test. It is unrun and expected to expose old get behavior until the
-new scope implementation lands. This migration is authorized by mos1330 under
-mos1272; no check removed or weakened. Dewey checks this list in manifest review.
-
-## 283 surface and blob choice
-
-Inspected actual46bad7ea3: optional editor.user is present. reader's parsed
-file records and index entries still discard tree oid. In owned query.mjs use
-the existing bounded listTree(repo, servedCommit) to obtain exact path oid,
-not HEAD and not a user-supplied revision expression. No reader/index edit.
-Tradeoff: one additional bounded tree listing per get; latency unmeasured.
-Recheck after rebasing to283's actual landing.
-
-## Intended owned paths
-
-query.mjs; broker.mjs lookup branch; tools.mjs lookup schemas/descriptions;
-library query.test.mjs/query-fixture.mjs; bus library-lookups.test.mjs;
-harness library-tools.test.mjs; this BUILD.md. Other files are prerequisites.
-
-## Gate
-
-Dewey manifest approval, whole library/bus/harness suites and every
-scripts/test-*.sh on Sage gate. Before review grep all package tests for enum
-pins and canon/playground pairs. Keep shared logs out; send receipts to Sage.
-No test or mutant evidence claimed. Manifest/digest follows complete code.
-
-## Implementation head (UNTESTED, sage-3658)
-
-- query scope accepts supporting for find/search/get. get defaults canon,
-  mismatch null. Manuscript passes a separate two-value scope allowlist.
-- get returns blob from listTree(source.repo,index.commit) after scope/universe
-  filtering. The same index.commit supplies the text; source HEAD is irrelevant.
-- Full outgoing and incoming link lists are stably sorted by supporting,
-  playground,canon before combining/paging. All visible cross-scope links stay;
-  universe/hybrid visibility still applies. Scope metadata isn't added to links.
-- Broker only adds optional scope to library.get's strict fields. No new verbs.
-- Typed scope expands find/search/get only; manuscript retains its own two-value
-  enum. Names/M3 counts remain the row224 six/eight, no write tools added.
-- New tests: book/universe/draft supporting find/search/get; defaults/mismatch;
-  absent supporting prefix; source HEAD advances but each scope's blob equals
-  served:path; 300 outgoing plus300 incoming links ordered across bounded pages,
-  retaining cross-scope links and dropping other-universe links; hybrid source
-  stays canon-only; no all/array scope; manuscript rejects supporting; broker
-  scope/blob forwarding; typed enums and unchanged names. All unrun.
-
-## Additional old assertion pin (brief Gate)
-
-harness/tests/library-tools.test.mjs:49 at23816cf28 (line49, unchanged in this head):
-OLD find scope enum ['canon','playground']; NEW ['canon','playground','supporting'].
-This is the exact scope-enum pin the brief directs updating. Existing six/eight
-name snapshots and TYPES equality assertion are unchanged. The new manuscript
-pin intentionally remains ['canon','playground']. No other two-scope test pin
-was found by rg over packages/*/tests at this build's prerequisite merge.
-
-## Proposed mutation evidence (reviewer confirms final set)
-
-All unrun. Require assertion failures with whole-file runs and pristine restore:
-M1 remove supporting from query SCOPES -> supporting lookup cases.
-M2 drop get's requested-scope comparison -> default/mismatch null cases.
-M3 use source HEAD for blob lookup -> served-tree/advanced-HEAD equality case.
-M4 remove link rank sort -> multi-page outgoing/incoming expected order.
-M5 restrict links to requested scope -> cross-scope link counts/order case.
-M6 drop sees() from visible/link filtering -> second-universe/hybrid cases.
-M7 allow supporting in manuscript validator -> manuscript refusal case.
-M8 omit get scope from broker fields -> real broker supporting get case.
-M9 widen typed manuscript enum -> typed-scope separation case.
-
-## Inspection and pending gate
-
-No production imports change in broker/tools, so no new sandbox closure file
-or mount. query.mjs is host library code and adds existing reader.listTree;
-no new package/export/copy-path file. rg found the one old find scope pin plus
-the intentional new manuscript two-scope pin. Whole library/bus/harness and
-shell gates remain required. CLI integration/merge context is prerequisite224/
-219, not this row's source delta; any changed gate expectation goes to Sage.
-Node checks, tests, mutants and elapsed-time evidence remain absent pending
-CLEAR. The first test-migration commit and this implementation are distinct.
-
-Sage sweep receipt: Della row284 builds on28346bad7ea3 plus intact224 merge;
-mos1330 old-test migration separate, supporting scope/blob implementation and
-fixtures authored, completely UNTESTED. No shared-log/queue write or live action.
-
-## Current assertion anchors after implementation imports
-
-The separate migration commit0ed4fbab9 retains its complete OLD/NEW text
-above. Adding only the fs/path imports in the implementation shifts anchors:
-
-query.test.mjs:130: `const blendCh2 = await get(src(ref, mapping(WITH_BLEND)), { universe: 'blend', path: 'Book One/Chapters/Chapter 02.md' });`
-query.test.mjs:350: `const rin = await get(s, { universe: 'idea', path: 'Drafts/New World/Characters/Rin.md', scope: 'playground' });`
-query.test.mjs:351: `assert.equal(rin.scope, 'playground');`
-query.test.mjs:352: `assert.equal(await get(s, { universe: 'harbor', path: 'Drafts/New World/Characters/Rin.md', scope: 'playground' }), null);`
-query.test.mjs:368: `assert.equal(await get(src(ref, mapping(WITH_BLEND)), { universe: 'blend', path, scope: 'playground' }), null);`
-query.test.mjs:369: `const own = await get(src(ref), { universe: 'harbor', path, scope: 'playground' });`
-query.test.mjs:370: `assert.equal(own.scope, 'playground');`
-
-No result/null assertion changed; scope arguments carry the explicit opt-in.
-
-## Dewey dewey-0941 static review — round2
-
-Static scope fc05bcbc3..47db04eba CLEAN; not a final verdict or test evidence.
-M1-M9 accepted as the final set. Optional M10 not added to this gate.
-N2 taken: keep the existing canon-path supporting-scope mismatch assertion,
-and ADD get(Book One/Support/Notes/Helper.md,scope:supporting) -> null under
-the default mapping with no supporting prefix. The supporting-positive test
-already returns this same path under withSupporting, so the added probe
-pins the missing-prefix case directly. No assertion removed or weakened;
-mos1330's separate migration commit and its retained assertions unchanged.
-
-N1 proposed DEFERRED/follow-up for Sage: retain each tree oid in reader/index
-entries so get can return blob without cat-file/whole ls-tree -r -l per page.
-Current get's result is pinned correctly, but per-page cost grows with the
-library. No performance measurement yet. This optimization needs reader/index
-ownership and separate acceptance/performance evidence; do not silently expand
-284's manifest or change its served-snapshot contract for it.
-
-No Node, tests, mutants or syntax checks run in this round; hold still applies.

agents/honker/work/queue-283/BUILD.md

@@ -1,211 +0,0 @@
-# Row 283 (#1788) C2-01d build notes (Honker)
-
-Append-only. Design: DESIGN.md d2 16e809457, APPROVE webby-0172. Gate owner Sage, reviewer Webby.
-
-## 2026-10-23 build on 45dca69f6 (sage-3577)
-
-Branch honker/row283-build from origin/refactor 45dca69f6e4bce52834587f66f2ff33ba839ab8a. The old branch
-honker/row283 (16e809457) held only the design, so its two commits were cherry-picked as 398314cf4
-(d1) and 4f66dccde (d2). The DESIGN.md blob equals 16e809457's.
-
-Commits:
-- 331653b38: code, README and tests T1-T8.
-- 28918824c: the survey.test:73 re-pin, alone (mos-1330 item 4).
-- this file.
-
-Nothing has run. No node, test or mutant ran during the build: Darkwing held the slot. Every count
-below is a plan until Sage's CLEAR.
-
-### Drift check (sage-3577)
-
-`git diff --stat 94c33a43c 45dca69f6` (design base to build base) over the paths the tests read or
-hash-pin:
-- No change in packages/library, packages/business/src/business.mjs or
-  packages/business/tests/business.test.mjs.
-- No test hash-pins a library file. bus library.test and library-sync.test import index.mjs, and
-  stack-copy.test only checks that index.mjs exists.
-- webui library-cli.test changed one line and doesn't read scope. The `classify` in webui reads.mjs is
-  the business one, not the library's.
-
-I redo the drift check on BASE..refactor before the in-review move.
-
-### N3 (webby-0169): deepEquals of the mapping output outside packages/library
-
-`git grep -n playground -- 'packages/*/tests/*' ':!packages/library/*'` and the files naming
-`universes` give two files:
-- business.test.mjs:20 compares `validateBusinessDocument(...).projects.books` with
-  `checkMapping(mappingEntry())`. That is output against output, so `supporting: []` shows up on both
-  sides. :27 compares only `.playground`.
-- library-projects-protected.test.mjs compares file bytes (:31, :32) and change paths (:58), never the
-  mapping output.
-
-No re-pin is needed outside library. Inside library, only the draft deepEqual at mapping.test:48 gains
-`supporting: []`, as the design says.
-
-### Q1 departure (sage-2923) and the :73 re-pin (mos-1330 item 4)
-
-survey.mjs:65 counts `supporting: 0` and formatSurvey prints it. T8 is the only added test
-(survey.test "C2-01d: with --mapping the survey counts supporting files").
-
-mos-1330 item 4, packages/library/tests/survey.test.mjs:73, commit 28918824c:
-- old: `'scopes canon 5, playground 1, unmapped 3; indexed 6',`
-- new: `'scopes canon 5, playground 1, supporting 0, unmapped 3; indexed 6',`
-
-N2: the pin gains only `supporting 0`. No other text on the line or in that test moved.
-
-### Q2 tradeoff (webby-0169)
-
-A supporting prefix that holds a playground prefix refuses `library-mapping-invalid`. That goes past
-the brief, but it is the fail-closed reading, and it uses an existing code: classify checks supporting
-first, so that playground prefix could never match. The cost is that she can't nest a playground under
-a supporting folder, though she can nest the other way (a playground holding a supporting folder).
-
-### Handoffs
-
-- Q4 (webby-0169, sage-2930): the M12 delete rule ("A delete also needs the path to exist at the tip as
-  a 100644 blob", case2 DESIGN.md :308) is not in supportingPath. It binds row 288 (C2-02) via Gitea
-  #1793 comment 30738, with tests for a missing path and a non-100644 entry.
-- A save with no `editor` refusing is C2-02's (DESIGN.md section 1).
-
-### Choices the design left open
-
-- The book loop is now `againstBooks(owners, list, code)` in mapping.mjs, called once per list. The
-  playground's messages and codes are byte-equal to before.
-- A non-string path refuses `library-write-story-path` ("the path must be a string") as part of
-  check 1. A non-array `tree` is a TypeError (DESIGN.md section 3).
-- Check 8 builds the tree's names as every path and every folder above it, keyed by
-  `normalize('NFC').toLowerCase()`. A name on the way refuses if its key holds any name other than
-  itself, so a tree that already holds case twins refuses a write to either (R7).
-
-### Mutants (exact strings)
-
-Each applies one replacement to the build tip. Run one at a time, and restore with `git checkout --`
-on the one file before the next.
-
-| Mutant | File | Replace | With | Killed by |
-|---|---|---|---|---|
-| M1 | src/scope.mjs | `const prefix = entry.supporting.find(p => inside(p, path));` | `const prefix = entry.supporting.find(p => inside(p, path) && !entry.playground.some(q => inside(q, path)));` | scope.test "supporting comes before playground", supporting.test "passes at book level" (both-lists path) |
-| M2 | src/mapping.mjs | `if ((inside \|\| holding) && owner !== id)` | `if ((inside \|\| holding) && owner !== id && list !== 'supporting')` | mapping.test "each supporting prefix rule", business.test C2-04 |
-| M3 | src/supporting.mjs | `for (const p of own) if (LINKS.has(modes.get(p)))` | `for (const p of own) if (false && LINKS.has(modes.get(p)))` | supporting.test "symlink or gitlink" |
-| M4 | src/supporting.mjs | `const fold = name => name.normalize('NFC').toLowerCase();` | `const fold = name => name.normalize('NFC');` | supporting.test "case or Unicode form" |
-| M4b | src/supporting.mjs | `const fold = name => name.normalize('NFC').toLowerCase();` | `const fold = name => name.toLowerCase();` | supporting.test "case or Unicode form" (NFD case) |
-| M5 | src/supporting.mjs | `Buffer.byteLength(path, 'utf8') > MAX_BYTES` | `path.length > MAX_BYTES` | supporting.test "1025 bytes" |
-| M6 | src/mapping.mjs | `const IDENT_BAD = /[\u0000-\u001f\u007f-\u009f<>]/;` | `const IDENT_BAD = /[<>]/;` | mapping.test "editor is optional" |
-| M6b | src/mapping.mjs | `const IDENT_BAD = /[\u0000-\u001f\u007f-\u009f<>]/;` | `const IDENT_BAD = /[\u0000-\u001f\u007f-\u009f]/;` | mapping.test "editor is optional" |
-| M7 | src/supporting.mjs | `if (place.scope !== 'supporting' \|\| place.universe !== universe)` | `if (place.scope !== 'supporting')` | supporting.test "outside the universe's supporting folders" |
-| M8 | src/mapping.mjs | `if (sid === pid && s !== p && holds(s, p))` | `if (false && sid === pid && s !== p && holds(s, p))` | mapping.test "each supporting prefix rule" (Workshop case) |
-
-(The `\|` in the table is an escaped `|` in the source text.) Each mutant runs the one test file named,
-plus business.test for M2, under `timeout -k 10 600`. A mutant passes the gate only when its run is red
-on the named test and the restored file's sha256 equals the build tip's.
-
-### Gate plan (on Sage's CLEAR)
-
-1. The touched files whole, each under `timeout -k 10 600`: library mapping, scope, supporting and
-   survey tests, and business.test.mjs. Counts go below.
-2. M1-M8 as above.
-3. The full gate, under mos-1275 timeouts: `node --test packages/library/tests/` and
-   `node --test packages/business/tests/` each under `timeout -k 10 1800`, and every scripts/test-*.sh
-   under `timeout -k 10 300`. pipefail and tee, with skips named (test-task Docker groups).
-4. Before in-review: grep packages/*/tests for a 64-hex pin on any changed file and for the changed
-   message text, then the drift check on BASE..refactor.
-
-## 2026-10-23 Webby early look (webby-0227, static, not a verdict)
-
-- E1: business.test.mjs is an existing test file with a 4-line addition after the playground refusal.
-  The in-review request lists it next to survey.test:73.
-- E3 fixed: supportingPath now runs the string check before `JSON.stringify`, so a BigInt (or any
-  non-string) path refuses `library-write-story-path` instead of throwing a TypeError.
-  supporting.test's string case now covers 7, null, undefined, 1n and an array.
-- E2 open: `editor` takes surrounding whitespace, and git trims it at commit, so the saved ident and
-  the commit ident can differ. DESIGN.md section 1 says "non-empty after trim". Refusing
-  `value.trim() !== value` would change that approved rule, so it went to Sage instead of into the
-  build.
-
-## 2026-10-23 E2 departure (sage-3601)
-
-A departure from DESIGN.md section 1 (which stays unedited). The design says each `editor` value is
-"non-empty after trim". Sage ruled that surrounding whitespace refuses too, because git trims an
-ident at commit, so a padded value would save one name and commit another. mapping.mjs now adds
-`if (value.trim() !== value) bad(`editor.${key} must not start or end with whitespace`)` after the
-IDENT_BAD check. `trim()` covers Unicode whitespace, so U+00A0 and U+3000 refuse as well. Inner
-whitespace is kept ("Her  Middle Name" passes).
-
-T3 gains a case per key for leading, trailing and both-ends spaces, U+00A0 and U+3000, plus one inner
-whitespace pass.
-
-M6 grows a third part:
-
-| Mutant | File | Replace | With | Killed by |
-|---|---|---|---|---|
-| M6c | src/mapping.mjs | `if (value.trim() !== value) bad(` | `if (false && value.trim() !== value) bad(` | mapping.test "editor is optional" (padded cases) |
-
-Fixture grep: `git grep -nE "\beditor\b|\bauthor\b" -- 'packages/library/tests/*' 'packages/business/tests/*'`,
-leaving out mapping.test.mjs, finds nothing. packages/business/tests has no fixtures directory. The
-library fixture mapping.json has no `editor`. The positive control (`vaultPrefix` in mapping.json)
-matches once. No fixture maps an editor or author with surrounding whitespace.
-
-## 2026-10-23 E4 (webby-0230, sage-3606), same departure as E2
-
-Claimed: `queue move 283 in-progress`, op honker-283-start, rev 3642, 19:10:49Z (briefed→in-progress).
-
-Git's ident.c `crud()` strips any byte <= 0x20 and `, : ; < > " \ '` from both ends of an ident. I
-checked that with git 2.55.0: `Jane,` `"Jane"` `'Jane'` `Jane;` `Jane:` `Jane\` and `,Jane` all
-commit as `Jane`, while `Jane.` and `Ja,ne` are kept. mapping.mjs now takes the set from crud()
-rather than from that list: `IDENT_CRUD_END = /^[\u0000-\u0020,:;<>"\\']|[\u0000-\u0020,:;<>"\\']$/`.
-The E2 check became `if (value.trim() !== value || IDENT_CRUD_END.test(value))`, which refuses
-library-mapping-invalid with "editor.<key> must not start or end with whitespace or any of , : ; " ' \".
-`trim()` still catches Unicode whitespace (U+00A0, U+3000), which crud() leaves alone.
-
-Inner characters: IDENT_BAD (`/[\u0000-\u001f\u007f-\u009f<>]/`) already refuses `<`, `>`, newline,
-tab and every other control anywhere in the value. T3 now pins that at the start, the end and the
-middle. Inner `, : ; " ' \` are kept, since git keeps them, and T3 pins that too.
-
-Tests:
-- T3 has one case per character in [space, U+00A0, U+3000, `,`, `:`, `;`, `"`, `'`, `\`], at the start
-  and at the end, for each key. `<`, `>`, newline and tab are pinned at the start, end and middle.
-  Four accepted names have inner crud characters.
-- New round-trip test, "an accepted editor round-trips through a real git commit unchanged". It
-  commits in a scratch repo with editor `Doe, Jane Q.` / `[email protected].` as author and
-  committer, with GIT_AUTHOR_* and GIT_COMMITTER_* stripped from the env, and asserts `git log`
-  shows exactly the saved values. I preflighted that commit with git 2.55.0 by hand: both values came
-  back unchanged.
-
-M6c now replaces the whole end check (this supersedes the earlier M6c row):
-
-| Mutant | File | Replace | With | Killed by |
-|---|---|---|---|---|
-| M6c | src/mapping.mjs | `if (value.trim() !== value \|\| IDENT_CRUD_END.test(value))` | `if (false)` | mapping.test "editor is optional" (end cases) |
-| M6d | src/mapping.mjs | `if (value.trim() !== value \|\| IDENT_CRUD_END.test(value))` | `if (value.trim() !== value)` | mapping.test "editor is optional" (`,` `:` `;` `"` `'` `\` cases) |
-
-## 2026-10-23 E5 (webby-0236, not blocking), fixed
-
-The round-trip test stripped only GIT_AUTHOR_* and GIT_COMMITTER_*. With GIT_DIR, GIT_WORK_TREE or
-GIT_INDEX_FILE set (inside a hook, say), GIT_DIR beats `-C root` and the commit would land in the
-outer repo, and the test read global and system config. It now deletes GIT_DIR, GIT_WORK_TREE,
-GIT_COMMON_DIR and GIT_INDEX_FILE (as queue/tests/helpers.mjs gitEnv does) and sets
-GIT_CONFIG_GLOBAL=/dev/null and GIT_CONFIG_NOSYSTEM=1 (as ledger.test.mjs does). The `-c user.*`
-ident still applies. Test only; no mutant changes.
-
-## 2026-10-23 sage-2925: optional editor.user (sage-3649)
-
-sage-2925 (recorded in ludwig/row286-r2 agents/ludwig/work/queue-286/BUILD.md, Q4) ruled that row 283
-adds an optional `editor.user`, her Gitea login for the `library-human` slot, which row 288 (C2-02)
-passes to `humanCredential(context, {user})`. It reached this row after the DESIGN.md d2 approval
-(ludwig-0068, bubba-0009, sage-3649), so it departs from DESIGN.md section 1 ("exactly the keys
-`name` and `email`"). DESIGN.md stays unedited.
-
-- mapping.mjs: `only(entry.editor, ['name', 'email', 'user'], 'editor')`. When present, `user` must be
-  a string matching USER (`/^[A-Za-z0-9_.-]{1,100}$/`, the entry `user` check), else
-  library-mapping-invalid "editor.user must be a plain account name". The output carries `user` only
-  when given. An absent `editor.user` refusing library-human-missing is 288's (bubba-0009).
-- README: the `editor` line names `user` and the end-character rule from E2/E4.
-- Tests: T3 (mapping.test "editor is optional") gains one accepted case (`her.login-1`, kept in the
-  output) and refused cases for '', an inner space, '@', 101 characters, 7 and null. They go in
-  mapping.test with the other editor cases, not in the new supporting.test, which tests write paths.
-- No test outside mapping.test reads `editor` or pins mapping.mjs or README (git grep).
-
-| Mutant | File | Replace | With | Killed by |
-|---|---|---|---|---|
-| M6e | src/mapping.mjs | `if (Object.hasOwn(entry.editor, 'user') && (typeof entry.editor.user !== 'string' \|\| !USER.test(entry.editor.user)))` | `if (false)` | mapping.test "editor is optional" (editor.user refusals) |
-| M6f | src/mapping.mjs | `...(Object.hasOwn(entry.editor, 'user') ? { user: entry.editor.user } : {})` | `...({})` | mapping.test "editor is optional" (`her.login-1` kept) |

agents/honker/work/queue-283/DESIGN.md

@@ -1,191 +0,0 @@
-# Row 283 (#1788) C2-01d design, draft 2 (Honker)
-
-Brief: docs/plans/2026-10-20_case2-rows.md "C2-01d" at refactor 94c33a43c. Sources: the design at
-agents/gosalyn/work/case2/DESIGN.md b68d79663, the ruling after r11 (:207), the M12 paragraph (:300),
-1.1 (:755) and 1.2 (:817). Base 94c33a43c. Reviewer Webby, gate owner Sage. Nothing is built yet. The
-build waits for 282 to land (sage-2906).
-
-## 1. Mapping (packages/library/src/mapping.mjs)
-
-`supporting`:
-- Every universe kind takes an optional `supporting` list: plain `['name','books','playground','supporting']`,
-  hybrid adds it to its seven keys, and a draft gets `['kind','name','playground','supporting']`.
-- Each value is checked as a playground prefix is: a string ending in `/` whose body passes `folder()`.
-- The output carries `supporting` on every universe, `[]` when absent, the way a draft carries
-  `books: []`. classify then needs no `?? []`. The business writer writes the raw document
-  (organization.mjs:195), not this output, so no business file changes shape.
-- The prefix rules, across every entry (ruling after r11):
-  - A supporting prefix holding another supporting prefix, or one listed twice, refuses
-    `library-mapping-invalid`.
-  - A prefix equal to one of its own entry's book folders, or holding one, refuses `library-mapping-invalid`.
-  - A prefix inside or holding another entry's book folder refuses `library-supporting-other-universe`.
-  - Level comes from where the prefix sits, as for the playground: inside one of its own entry's books
-    is book level, and outside every book is universe level. A draft's prefixes are all universe level.
-- Between the two lists (my choice, Q2):
-  - A supporting prefix may equal a playground prefix of the same entry. That folder is writable.
-  - A playground prefix may hold a supporting prefix of the same entry. The inner folder is supporting
-    and the rest stays playground.
-  - A supporting prefix that holds a playground prefix refuses `library-mapping-invalid`. classify
-    checks supporting first, so that playground prefix could never match.
-  - A supporting prefix equal to, holding or inside a playground prefix of another entry refuses
-    `library-mapping-invalid`. Otherwise one path would have two universes.
-- The book loop at mapping.mjs:128-140 becomes a helper that both lists call with their own code and
-  label. The playground's messages and codes stay byte-equal, so no existing test text moves.
-
-`editor`:
-- The entry takes an optional `editor`. When present, it is an object with exactly the keys `name` and
-  `email` (via `only()`). Each value is a string that is non-empty after trim and has no control
-  character (`[\u0000-\u001f\u007f-\u009f]`), `<` or `>` (webby-0169 R1: git drops them from an ident
-  and commits under a different name, so C2-02 would never see a failure). Anything else refuses
-  `library-mapping-invalid`.
-- The output carries `editor: { name, email }` only when present, as `user` and `vaultPrefix` do. A save
-  with no `editor` refusing is C2-02's job.
-
-## 2. Scope (scope.mjs)
-
-- `classify` gets a supporting loop before the playground loop (design 1.2). It returns `place(...)`
-  with `{ scope: 'supporting', universe, book }`. The book is the book folder holding the prefix, or
-  null at universe level and in a draft. The type and folder come from the first folder under the
-  prefix, as for the playground.
-- The `.md` check stays first, so a `.canvas` or `.base` under a supporting prefix stays unmapped.
-- The comment above `classify` names the three prefix scopes and the order.
-
-## 3. supportingPath (new supporting.mjs)
-
-`supportingPath(mapping, universe, path, tree)` returns `path` or throws
-`LibraryError('library-write-story-path', ...)`. It is pure and reads no git.
-
-- `tree` is the array `listTree` returns (reader.mjs:26, `{ mode, type, oid, size, path }`), so the
-  C2-02 broker passes its listing as it is (Q3). A non-array `tree` throws a TypeError, because that is
-  a caller bug, not a path class.
-- The checks run in this order, each with its own message naming the class:
-  1. The path must be a string of at most 1,024 UTF-8 bytes (`Buffer.byteLength`).
-  2. It must have no control character, using the same control class as `editor` (not `<` or `>`).
-  3. It must have no backslash.
-  4. It must not be absolute (a leading `/`).
-  5. It must have no empty, `.` or `..` segment. That also catches `//` and a trailing `/`.
-  6. `classify(mapping, path)` must give scope `supporting` and that same `universe`. This one check
-     covers an unknown universe, an unmapped path, a `.canvas`, `.base` or attachment, a canon or
-     story path, a playground path that isn't also supporting, and another universe's prefix. The scope
-     rule then has one source, and M1 below hits both.
-  7. Every proper prefix of the path (`a`, `a/b`, ...) and the path itself must not be in `tree` with
-     mode `120000` (symlink) or `160000` (gitlink).
-  8. No prefix of the path, and not the path itself, may equal a tree path or a tree directory
-     (derived from the entries' paths) after `normalize('NFC').toLowerCase()` on both sides, unless
-     it equals that tree path exactly. NFC as well as case, because APFS treats NFC and NFD forms of
-     a name as one file (webby-0169 N1).
-     Directories are checked too, because the folders under a supporting prefix are hers to name. A
-     path in a tree that holds both `a.md` and `A.md` refuses, which matches R7.
-- The refusal messages quote the path with JSON, except for the control-character class, whose message
-  leaves the path out.
-- The delete rule ("A delete also needs the path to exist at the tip as a 100644 blob", M12) isn't in
-  the brief's supportingPath list. It stays with C2-02's delete (Q4).
-  The C2-02 brief doesn't name it (only design :308), so BUILD.md carries it to C2-02 under Handoffs
-  (webby-0169 Q4).
-- index.mjs exports `supportingPath`.
-
-## 4. README (packages/library/README.md)
-
-- Mapping: `supporting` and its rules, the cross-list rules, and `editor`.
-- Refusals: a `library-supporting-other-universe` row, and the new cases in the
-  `library-mapping-invalid` row.
-- Scope: supporting first, then playground, then canon.
-- A new section, "Agent write paths", for supportingPath and its classes.
-
-## 5. Callers of classify outside files owned (Q1 for Sage)
-
-- survey.mjs:65 builds `{ canon: 0, playground: 0, unmapped: 0 }` and increments
-  `scopes[classify(...).scope]`. A supporting file adds `supporting: NaN`, and formatSurvey (:92) never
-  prints it. I propose a departure: add `supporting: 0` and print it, so the line becomes
-  `scopes canon 5, playground 1, supporting 0, unmapped 3; indexed 6`. That re-pins survey.test:73 and
-  adds a count test. Without it, the survey reports garbage once she marks a folder. The departure
-  covers two files, packages/library/src/survey.mjs and packages/library/tests/survey.test.mjs.
-- No change in the rest, each for a reason:
-  - reader.mjs:183 skips only unmapped, so supporting files are indexed like playground files.
-  - R5 (:207) flags only canon to playground, as design 1.3 R5 says. A canon link to a supporting file
-    raises nothing.
-  - render.mjs:23 gives supporting a null badge. The supporting badge belongs to C2-10b (design :1415).
-  - mirror.mjs:246 refuses only unmapped. Reading supporting files by scope is C2-05c's.
-  - No bus or webui source filters on scope (git grep at 94c33a43c).
-- M9 already protects the whole `projects` key from agent edits (library-projects-protected.test). No
-  test is added there.
-
-## 6. Tests
-
-- mapping.test:
-  - T1: `supporting` at book level, at universe level, in a hybrid and in a draft. The output carries
-    it, with `[]` when absent. The draft `deepEqual` at :48 gains `supporting: []`.
-  - T2: one test per prefix rule.
-    - These refuse `library-mapping-invalid`: no trailing `/`, a bad folder, one holding another, one
-      listed twice, one equal to its own book, one holding its own book, one holding a playground
-      prefix, and one overlapping another entry's playground.
-    - These refuse `library-supporting-other-universe`: one inside another universe's book, and one
-      holding another universe's book.
-    - An equal same-entry playground passes.
-  - T3: `editor` passes, and absent passes. It refuses `library-mapping-invalid` for a non-object, an
-    array, an extra key, a missing key, an empty or blank value, a non-string, and a control character,
-    `<` or `>` in either value.
-- scope.test, T4:
-  - Supporting at book level, universe level and in a draft each give their universe and book.
-  - A folder in both lists is `supporting`, and a playground-only folder is `playground`.
-  - A supporting `.canvas` or `.base` is unmapped.
-- supporting.test (new):
-  - T5 passes at book level, universe level, in a draft, in a both-lists folder, and at exactly 1,024 bytes.
-  - T6 has one refusal per class against a fixture tree with a symlink, a gitlink and a case variant.
-    The classes are:
-    - unmapped, `.canvas`, `.base`, an attachment, canon, playground-only, another universe's
-      supporting prefix, and an unknown universe;
-    - absolute, `..`, `.`, `//`, a trailing `/`, a backslash, a C0 control and DEL;
-    - a symlink folder, a gitlink folder, and a symlink at the path itself;
-    - a case-variant file, a case-variant folder, and an NFD-form variant of an NFC tree name;
-    - 1,025 bytes made with a multi-byte character, so bytes and characters differ.
-  - Each asserts the code `library-write-story-path`.
-- business.test: T7 adds one assertion that `validateBusinessDocument` refuses
-  `library-supporting-other-universe`.
-- survey.test (only if Q1 is approved): T8 counts one supporting file, and :73 is re-pinned.
-
-## 7. Mutants (exact strings go in BUILD.md)
-
-| Mutant | Change | Killed by |
-|---|---|---|
-| M1 | classify checks playground before supporting (the brief's mutant) | T4 both-lists, T5 both-lists |
-| M2 | the other-universe fail for supporting is dropped | T2 |
-| M3 | the symlink and gitlink check is dropped | T6 |
-| M4 | the case check is dropped | T6 |
-| M4b | check 8 drops `normalize('NFC')` | T6 NFD variant |
-| M5 | the byte length uses `path.length` | T6 1,025 bytes |
-| M6 | the `editor` control-character check is dropped | T3 |
-| M6b | the `editor` `<` and `>` check is dropped | T3 |
-| M7 | supportingPath skips the universe match | T6 other universe |
-| M8 | the supporting-holds-playground check is dropped | T2 |
-
-## 8. Gate
-
-- Webby approves the manifest.
-- The library and business suites and every scripts/test-*.sh are green on Sage's gate.
-- Timeouts (mos-1275): each package `timeout -k 10 1800`, each script `timeout -k 10 300`, each single
-  file and mutant `timeout -k 10 600`. These come from my row 256 gate at 10:34Z.
-- Before in-review, grep packages/*/tests for 64-hex pins on the changed files and for the changed
-  message text, then drift-check BASE..refactor.
-
-## 9. Questions
-
-- Q1 (Sage): approve the survey.mjs and survey.test.mjs departure in section 5?
-- Q2 (Webby): the cross-list rules in section 1?
-- Q3 (Webby): `tree` as the `listTree` array?
-- Q4 (Webby): the delete's 100644 check stays with C2-02?
-- Q5 (Webby): `editor` refuses only blank values and control characters, as the brief says. `<` and `>`
-  would break a git ident. I'd leave them to C2-02's commit step unless you want them refused here.
-
-## 10. Draft 2 (webby-0169)
-
-- R1 folded: `editor` refuses `<` and `>` too, with T3 cases and mutant M6b.
-- Q2 accepted. BUILD.md records the tradeoff: refusing a supporting prefix that holds a playground
-  prefix goes past the brief, but it is the fail-closed reading and uses an existing code. The cost
-  is that she can't nest a playground under a supporting folder, though she can nest the other way.
-- Q3 accepted. Q4: carried to C2-02 under Handoffs in BUILD.md, and Sage was asked to add it to C2-02's brief.
-- N1 folded into check 8 (NFC and case), with an NFD case in T6 and mutant M4b.
-- N2: the survey.test:73 pin gains only `supporting`, and the count test is the only addition
-  (mos-1330, its own commit).
-- N3: before the build, re-grep tests outside packages/library for a `deepEqual` of the mapping output
-  on the build base.

agents/lena/work/queue-296/BUILD.md

@@ -0,0 +1,266 @@
+# Row 296: FED R7, scratch two-instance acceptance (#1802)
+
+## Start
+
+- Started 2026-10-23 18:53:27Z, on Sage's sage-3583 (mos-1489).
+- Base: origin/refactor 45dca69f6 (pinned; local copy used, no fetch: fetch runs the credential node script, which
+  is held during Darkwing's re-pin window).
+- Branch: quackerjack/row296 in worktree quackerjack-fed-r5-row296.
+- Brief: docs/plans/2026-10-23_mvp-readiness-rows.md at 45dca69f6, section "Brief: FED R7, scratch two-instance
+  acceptance" (line 77).
+- Constraints from Sage: scratch roots only (mktemp -d under /mnt/storage/scratch/tmp), never ~/.mosaic-dev or
+  the live bus. No push, claim, queue write, node or test run until CLEAR.
+
+## What the brief asks for (summary)
+
+- One script test under scripts/ with its harness in packages/*/tests/, as row 190's tests are.
+- Two configs, two data roots, two Consoles, one fake OP. Consoles start outside agent ancestry in a transient
+  user unit. They never use the live stack's units, ports or sockets. The script removes its units on exit (trap).
+- Test (design section 7 R7 gate): Jason's test identity, granted collaborator on one hub project, signs in,
+  makes a thread, sends to the granted instance, gets the reply in the thread, is refused on another project and
+  on board reads, is revoked, is refused again, and the run ends. The factory shows nothing of the hub.
+- Mutants: grant project list widened to `*`; revocation claim end skipped.
+- Gate: Filbert approves the manifest; the script test and every scripts/test-*.sh green on Sage's gate; no unit,
+  port or socket of the script outlives the run. R8 (live window) stays row 209.
+
+## Open reads before design
+
+- R4 and R6 candidates (the brief says it builds on their combined candidate). Confirm what they expose: the
+  hub sign-in, grant and revocation paths, and the Console's board-read refusal.
+- Row 190's test harness (several instances on one uid): how it starts units and cleans up.
+- Transient user unit support on this host (systemd-run --user), and how the existing tests detect it.
+
+## Status
+
+- 18:53Z: worktree created, brief read. No code yet.
+
+## Handoff 2026-10-23 19:10:09Z (Mos ruling Q245, mos-1503)
+
+Row 296 moves to Lena (Codex seat, thread db27faca-85fb-4ca0-9fc7-78d740d3fa3a, branch lena/row296). Quackerjack
+stops here: no builds, no claim, no queue writes. This design is the handoff; Lena continues it.
+
+Base: 45dca69f6. R4 landed as 2efd127ce (ancestor of the base, checked with merge-base --is-ancestor). R6 landed as
+d3059c2c3 (row 294). R7 is claimable once Darkwing's window ends (Sage, sage-3592).
+
+What I verified by reading (not by running):
+- packages/cli/src/access.mjs:65 reads `system.federation?.peers ?? []` (the R6 seam).
+- packages/bus/src/user-cli.mjs exists at base (the user-cli transport).
+- Row 190's tests (packages/cli/tests/stack-instances.test.mjs, stack-release.test.mjs T56, stack-release-fixture.mjs)
+  drive stand-in units and fixtures. They do not start real transient user units. Not a model for R7's Consoles.
+- Real transient-unit launch pattern: packages/conversation/src/cohort.mjs (`scopeAvailable()` and `ScopeLauncher`,
+  systemd-run --user --scope -p Delegate=yes --unit=...; MANAGER_ENV = XDG_RUNTIME_DIR, DBUS_SESSION_BUS_ADDRESS).
+- Test-only spawn of systemd-run in packages/conversation/tests is the nearest precedent for start/stop cleanup.
+
+What I did NOT verify (so treat as open): the hub sign-in, grant, revocation and board-read paths in R4/R6 code; the
+Console startup flags; whether the fake OP can be a local stand-in; the trap-based unit cleanup.
+
+Design (proposal, not yet checked against code):
+1. scripts/test-federation-acceptance.sh: the entry point. Creates a mktemp -d scratch root under
+   /mnt/storage/scratch/tmp (never ~/.mosaic-dev, never the live bus). trap removes every unit it started and the
+   scratch root. Refuses to run if a transient unit name collides.
+2. Two configs (instance A = hub-side granted seat, instance B = collaborator's home), each with its own
+   MOSAIC_CONFIG, data root and federation.self; federation.peers names the other.
+3. One fake OP: a local stand-in that issues Jason's test identity. Its port and socket are per-run, not the live ones.
+4. Two Consoles, each in its own transient user unit (systemd-run --user --unit=mosaic-r7-<run>-<A|B>); outside agent
+   ancestry; ports picked per run.
+5. Test flow (the R7 gate): identity -> grant on one hub project -> sign in -> thread -> send to granted instance ->
+   reply in thread -> refused on another project -> refused on board reads -> revoke -> refused after revoke -> run
+   ends. Factory output must show nothing of the hub.
+6. Mutants: (a) grant project list widened to `*`, must fail the other-project refusal; (b) revocation claim end
+   skipped, must fail the refusal-after-revoke check.
+
+Unresolved decisions for Lena (I did not decide these):
+- Whether the harness lives in packages/cli/tests (matching row 190) or packages/conversation/tests (matching
+  cohort.mjs). Brief says packages/*/tests/; pick the one that owns the Console start path.
+- Fake OP: in-process HTTP stand-in versus file-backed identity. No preference recorded.
+- Port selection: fixed range per run vs OS-assigned. Brief forbids the live ports; it does not pick a range.
+
+R2 and R5 learning:
+- R2 (row 203, #1701) landed as a4da4e6df. I built it. Relevant to R7: validateFederation in
+  scripts/mosaic-config.mjs rejects unknown keys and bad ids, and test-config.sh has an FED block
+  (expect_fed_refusal). Use federation.self/peers exactly as row 203 validates them.
+  Mutant runner pattern: one textual edit that must occur exactly once, then a named test must fail; restore from git.
+  Name filter gotcha: `node --test --test-name-pattern` skips subtests whose parent does not match; include the
+  parent name (T57 for row 203).
+- R5: I did not build R5 in this session and have no first-hand notes on it. Ask Sage for R5's landing sha and notes.
+
+Status: design written; no code, no test runs, no claim, no push of the test files. Next owner: Lena.
+
+## Lena continuation, 2026-10-23
+
+Owner: Lena, thread db27faca-85fb-4ca0-9fc7-78d740d3fa3a. Branch lena/row296.
+Base remains 45dca69f6. Quackerjack's handoff c6ab9bdc9 preserved by cherry-pick ad84c1e45.
+Issue #1802 exists. Reviewer Filbert. Sage owns queue state, shared test slot and landing.
+Status: Untested. All Node, tests and credential-helper fetch/push held for Sage CLEAR (sage-3615).
+The earlier canonical `queue next lena` read finished with `nothing` and a rendered-view warning;
+no queue state was changed. Lena's owner registration is Sage's action.
+
+### Design decisions sent to Sage (lena-0003)
+
+- Harness under packages/cli/tests, beside row 190's instance proof; shell entry under scripts/.
+- Existing HTTPS fakeOidc helper, its generated scratch CA trusted through NODE_EXTRA_CA_CERTS
+  by each real Console CLI. One fake OP, two client ids; no TLS verification bypass.
+- Kernel-assigned loopback ports (0), discovered from each Console's startup log. Public origins
+  are distinct *.example.test HTTPS names; HTTP requests model the loopback reverse proxy with
+  exact Host and Origin. This proves the Console boundary, not a deployed HTTPS front end (R8).
+- Transient user service units, not scopes: a scope leaves ancestry beneath the caller; the real
+  user proof walks ancestry. Each Console runs the existing cli.mjs serve --sso --send verb.
+- Real startHost broker process and createLauncher. Only the harness adapter is a test stand-in,
+  as in thread-revoke.test.mjs. A real sandboxed run replies through the broker.
+- Scratch-only setup and access grant/revoke use real human CLI transport from a transient service.
+  No injected principal verifier, direct bindHuman/bindUser, or simulated user transport.
+- Every service has a unique per-run prefix and is recorded before launch. Shell EXIT/INT/TERM
+  traps stop only these services, wait for collection and verify socket and port closure.
+- Claim-end assertion reads append-only claim history independently of the launcher's final
+  shutdown so the claim-end mutant cannot be hidden by endLaunch's cleanup.
+
+### Implementation plan
+
+Goal: an executable scratch proof of federation section 7's R7 gate, without live state.
+Architecture: shell lifecycle owner, Node test driver, test-only host fixture, existing real Console CLI.
+Tech: Bash, Node ESM/node:test, systemd user transient services, existing fake OP and bwrap adapter.
+Spec: docs/plans/2026-10-23_mvp-readiness-rows.md, FED R7, plus preserved handoff above.
+
+Constraints: scratch only under /mnt/storage/scratch/tmp; no live units/ports/sockets/configs or
+credential reads; no production behavior/policy changes; no old test edits without Mos via Sage.
+
+Review focus: partial startup cleanup; signals; unit name collision; mismatched hub/factory sessions;
+claim end versus process exit. Each must have explicit assertions or a negative cleanup exercise.
+
+- [ ] Write acceptance driver assertions: Jason test sub binds as collaborator (owner is another
+  fixture identity), one allowed project/instance, thread send and correlated RESULT, private
+  project creation/read refused, board reads refused, factory has no hub objects, revoke denies
+  session and re-login, claim history records access-revoked and runner ends.
+- [ ] Write shell lifecycle: scratch HOME/TMPDIR, unique unit ledger, bounded command timeout,
+  traps stop/collect only this run's units, verify recorded sockets and ports no longer listen.
+- [ ] Write host fixture using startHost(bootConfig), createLauncher with fakeHarnesses and the
+  existing thread adapter. Prepare two named configs through bootstrap before fixture edits;
+  supply only generated test client slots. Setup/grant/revoke through real human transport.
+- [ ] On Sage CLEAR run only the new script, fix failures in new files and record exact results.
+- [ ] Prepare explicit once-only mutant patches: R5 projects widened to ['*']; R4 #claimEnd call
+  skipped. On Sage CLEAR prove each gives an assertion failure, restore bytes in finally.
+- [ ] Publish manifest (paths, hashes, assertion mapping, old-test numstat), request Filbert review,
+  push additive commits to lena/row296 only. Sage runs shared suites and gate and lands the row.
+
+Pre-existing test changes: none (numstat: empty).
+
+### Source inspection corrections before first execution
+
+- The real webui chat is channel-gated. Scratch businesses enable only harness pi and channel webui;
+  the loader fixture re-exports the unchanged webui channel. The adapter replacement is exactly
+  fakeHarnesses' pi.adapter export; no product file gains a fixture branch.
+- startHost creates a real broker child and a real Unix proof socket; it is hosted in the test
+  driver. The two Console services run the exact same-tree webui CLI, which is required by
+  verifyPrincipal. Human setup runs the exact same-tree human-cli through humanTransport.
+- The earlier in-process host proposal did not need a separate host fixture: startHost exposes
+  the production launcher API directly, so the only helper file is federation-human.mjs.
+- Read-only SQLite inspects claim evidence while the broker remains the sole writer. The test
+  also checks the registered runner and engine pids/start times are gone after revocation.
+- `--kill-after-start` kills the test process after both services have listened; Node teardown
+  hooks cannot run. The shell trap owns service cleanup independently. This is an expected-red
+  exercise; acceptance requires its kill marker, nonzero exit and successful cleanup line.
+- Main driver environment is a whitelist (PATH, scratch HOME/TMPDIR, systemd manager transport,
+  R7 run ids). Console/human services use env -i. No host preload or credential env is carried.
+- No Node or test has run. Bash syntax and git diff --check passed during preparation.
+
+### Binding design correction: sage-3625, 2026-10-23 19:17:35Z
+
+Sage rejected the transient-unit approach: "no transient systemd user units used to satisfy the
+human proof"; such a unit makes the ancestry walk miss the development agent, and creates host
+state under mos-1438. This direction replaces the brief/handoff's unit requirement for this build.
+No unit was created by the superseded draft, and no Node/test execution occurred.
+
+Current design, replacing the earlier proposals above:
+
+- Consoles are ordinary spawned child processes in their own process groups; no systemd commands,
+  units, user manager or manager environment are involved.
+- Test-only federation-host.mjs follows channel-fixture.mjs's mock.module pattern. It re-exports
+  real readProcess and replaces verifyHuman's readProcess argument with real process fields plus
+  ppid=1. This is explicitly a stand-in for Jason's shell, NOT a real ancestry acceptance proof.
+  Real pid/uid/startTime/nonce/path checks still run; verifyPrincipal still checks the Console's
+  actual direct parent path for user calls. No product source receives this override.
+- Each fixture host runs real startBroker and createLauncher. Its local host API is the existing
+  thread-revoke.test.mjs pattern, with only the pi adapter replaced via fakeHarnesses.
+- Setup/grant/revoke are plain children using real CLI wrappers against that fixture proof seam.
+- Shell records each detached group's leader pid and start time, checks both before signalling,
+  and verifies no live group member, TCP listener or Unix listener remains. Killed-driver mode
+  bypasses every Node teardown hook and still leaves cleanup to the shell trap.
+- Read-only claim evidence and actual runner/engine exit remain independent assertions.
+- Gate limitation: this proves the revised scratch integration, not real outside-agent ancestry,
+  transient unit cleanup, TLS proxy deployment or live federation. R8 remains row 209.
+- R5 landing found in git log: ddfb29af7 (#1700).
+- Targeted Node/tests remain held. Sage permits the first lena/row296 push in the 19:41Z gap,
+  with MOSAIC_GITEA_CREDENTIAL_FILE unset. 226 and 283 have earlier slots.
+
+Current files: shell entry; federation-acceptance.test.mjs; fixtures/federation-host.mjs and
+fixtures/federation-human.mjs; this BUILD; mutant runner; manifest; append-only logs; preserved
+Quackerjack BUILD at ad84c1e45. No pre-existing test modification (numstat empty).
+
+### First candidate, 2026-10-23
+
+Implementation is prepared under sage-3625, not yet executed. Static checks: Bash parser accepts
+scripts/test-federation-acceptance.sh; Python ast.parse accepts mutants.py; git diff --check clean.
+No test outcome is claimed. The root node_modules links the existing canonical install so the
+future targeted run needs no install or network. No webui editor build is involved.
+
+M1 now requires the user project-list leak assertion (`R7 ungranted project must not appear`),
+so it proves exposure through the actual Console transport rather than only inspecting grant
+configuration. The private-project thread-create refusal and exact grant-list check follow it.
+M2 requires `R7 revoke must end the claim as access-revoked` before any host teardown.
+
+Sage opened the push gap early in sage-3644 (19:23:04Z). The first candidate is committed as
+Untested, for push only to lena/row296 with MOSAIC_GITEA_CREDENTIAL_FILE unset. Node, acceptance,
+negative cleanup exercise and mutants still wait for the test slot. Full suites/gate are Sage's.
+
+### Filbert static review, filbert-296-first-push-static, 19:28:51Z
+
+Review pinned f06a1f78c against 45dca69f6. Filbert verified all nine manifest hashes from Git
+objects, no product/pre-existing test changes, no systemd calls, fixture-only ancestry override,
+real path/uid/startTime/nonce checks, group ledger identity checks and child-only CA trust.
+He ran nothing. The verdict remains pending execution and gate evidence.
+
+- C1 confirmed by inspection: subprocess.run(timeout=280) kills the shell on timeout and can
+  bypass its trap, while the shell's own deadline plus cleanup can exceed 280 seconds. Removed
+  the outer Python timeout (the simpler alternative Filbert explicitly allowed). Python now
+  waits for the shell's bounded run and EXIT/TERM cleanup. Source restoration remains in finally.
+- N1 retained limitation: a SIGKILL between spawn and the pid/startTime ledger append can leave
+  an unrecorded group. The killed-driver exercise begins after both Consoles are recorded and
+  does not cover that gap. Cleanup claims apply to recorded groups; no universal crash-proof
+  process creation claim is made.
+- N2 addressed before the mutant run: the named readonly claim-history assertion now runs after
+  revoke and before waiting for the run's end. A skipped #claimEnd therefore cannot first fail
+  the run-end wait. The final latest-op check still runs after engine/runner exit. If M2 instead
+  fails an earlier condition, its runner must say NOT KILLED; diagnose the first failure on the
+  same pinned candidate, retain the intended assertion, and rerun on Sage CLEAR. Never accept a
+  timeout or change the mutant's expected assertion merely to mark it killed.
+- N3 deferred cosmetic fixture detail: wrap() returns fn(value) without await, so async rejection
+  skips its code mapping. This is not an authorization or cleanup change; the rejection still
+  propagates, and no verdict relies on that fixture mapping.
+- N4: corrected the exact-grant assertion's indentation in the new test.
+- N5: prepare() first calls bootstrap --instance, then overwrites that bootstrap-generated
+  config inside the unique disposable scratch HOME with fixture Console/provider settings.
+  This is fixture-only setup, not a product/bootstrap overwrite path or a live-config operation.
+  There remains one selected config per scratch instance, with the same marked data root.
+
+Still Untested. No Node, acceptance, mutant, negative cleanup or CLI suite run. Static validation
+only; execution waits for Sage's test window. Follow-up push needs a currently authorized gap.
+
+### Push receipt and N2 ordering proof, 2026-10-23 19:31Z
+
+Sage sage-3659 authorized push before 19:38Z. e855f82e1846f094927c3de69aea1a801253736a
+was pushed to origin/lena/row296 with MOSAIC_GITEA_CREDENTIAL_FILE unset. No Node/tests ran.
+
+N2, filbert-296-c1-ack: this path is synchronous after a successful reload. accessCommand awaits
+reload at access.mjs:289; reload awaits the access.reload transport at :297. broker.mjs:4645
+calls #revokeLost before constructing its reply. #revokeLost (:1025–1034) calls #claimEnd inside
+Store.transaction, which executes COMMIT before returning (store.mjs:282–302). server.mjs:160–161
+calls broker.request and then writes the response. Therefore the claim record is committed before
+the successful CLI call returns; no asynchronous sweep is required for this assertion. A refused
+reload can be reported by the CLI with exit 0, but then immediate revocation evidence is absent
+and this test must fail; that is not a race the test should hide. No polling change is needed.
+
+T3 package comparison (sage-3659): the four planned runs execute only the new dedicated
+federation-acceptance.test.mjs and its fixture host/human children. They do not execute stack-copy,
+stack-release or the whole CLI suite. Existing helpers are imported; no old test module is run.
+Asked Researcher to confirm against row216. Full CLI suite remains a later Sage gate requirement,
+outside the targeted T3 command list. All test resources are unique scratch state.

agents/lena/work/queue-296/MANIFEST.md

@@ -0,0 +1,67 @@
+# Row 296 / #1802 — C1 follow-up candidate (Untested)
+
+Base: 45dca69f6. Branch: lena/row296. Reviewer: Filbert. Gate owner: Sage.
+Handoff: c6ab9bdc9 preserved as ad84c1e45, including
+agents/quackerjack/work/queue-296/BUILD.md. Every changed path is in MANIFEST.sha256,
+except this manifest and the checksum file itself. No product file or pre-existing test changed.
+Pre-existing test numstat: empty. BUILD-LOG.md and docs/SESSIONS.md are append-only additions.
+
+Binding ruling: sage-3625 replaces the brief's transient-unit start with plain child Consoles and
+explicit test stand-ins. **This candidate does not prove genuine outside-agent ancestry.**
+It creates no transient systemd unit and makes no systemd CLI call. R8 remains row 209.
+
+## What is real, and what is a stand-in
+
+- Two configs created by bootstrap --instance hub/factory, two marked data roots, real Console
+  cli.mjs serve --sso --send, real broker runtime and launcher, real path-bound human-cli and
+  user-cli wrappers, real access loader, CLI writes/reload, grant filters and revocation.
+- One existing HTTPS fakeOidc server, two issuer/client identities. Its generated CA is trusted
+  only through NODE_EXTRA_CA_CERTS in this test's child environment, never any trust store.
+- federation-host.mjs replaces verifyHuman's readProcess argument with actual process fields plus
+  ppid=1, exactly the test pattern Sage named. This stands in for Jason's shell on setup,
+  grant/revoke and both Consoles' transports. The actual Console parent/path check remains.
+  There is no product parameter, environment switch or altered verifier default.
+- fakeHarnesses replaces only the pi harness adapter() with a scratch shell invoking the existing
+  thread-adapter.mjs. The existing webui channel is re-exported unchanged. No network model runs.
+- Public HTTPS origins are modelled through HTTP loopback requests with matching Host/Origin;
+  reverse-proxy TLS deployment is outside this scratch proof.
+
+## Acceptance map
+
+All checks live in `FED R7 scratch two-instance acceptance` in
+packages/cli/tests/federation-acceptance.test.mjs.
+
+| Requirement | Assertion/evidence |
+| --- | --- |
+| Isolated instances | different config paths/data roots/ports; scratch HOME/TMPDIR; two named markers from bootstrap; port 0, forbidden live ports 7330–7332 checked |
+| Jason is collaborator, not owner | owner melanie; access user jason-test, home factory, fake sub jason-test-sub; hub /api/config user=true |
+| One project, one granted instance | actual access grant CLI, projects=[shared], instances=[assistant]; user project list contains shared only |
+| Thread and reply | create thread on shared, POST message, correlated RESULT with in_reply_to=sent.id, from_role=assistant, to_role=user, body contains question |
+| Other project refused | private project absent from listing; create on private returns 403 access-refused |
+| Board reads refused | /api/board, /api/bus/inbox and /api/bus/tasks return 403 owner-only |
+| Factory sees no hub objects | Jason sub refused at factory; factory owner sees factory-only project and no threads; hub cookie gets 401 at factory |
+| Revoke takes effect | actual access revoke CLI; existing hub session 401 and re-login 403 |
+| Claim and process ended | live run before revoke; end log exitCode=0; no registered sessions; engine and runner pid/startTime gone; readonly claim history has revoke/access-revoked before the process-end wait, latest op=revoke afterward |
+| Normal cleanup | EXIT trap terminates only recorded pid/startTime-checked groups; checks no live group member, no recorded TCP/Unix listener, no other scratch Unix listener, removes scratch directory/socket files |
+| Killed-driver cleanup | --kill-after-start prints both-Consoles-started marker then SIGKILLs test driver; shell performs the same independent cleanup; expected nonzero run with successful cleanup line |
+
+## Verification commands (held for Sage CLEAR)
+
+- scripts/test-federation-acceptance.sh — must exit 0, one acceptance test passes, cleanup line present.
+- scripts/test-federation-acceptance.sh --kill-after-start — must exit nonzero, print the explicit
+  interruption marker and `R7 cleanup: no child groups, ports or sockets remain; no units created`.
+- python3 agents/lena/work/queue-296/mutants.py M1 — once-only R5 grant projects -> ['*']; must fail
+  `R7 ungranted project must not appear` and verify cleanup, then restore original source bytes. Python relies on the shell's own run deadline and cleanup; no outer killing timeout.
+- python3 agents/lena/work/queue-296/mutants.py M2 — once-only R4 claim end omitted; must fail
+  `R7 revoke must end the claim as access-revoked` before shutdown, verify cleanup and restore bytes.
+- Sage's gate: the new script plus every scripts/test-*.sh; full applicable suites per Sage's slot.
+
+Status: no Node, acceptance or mutant run. Static Bash syntax, Python parsing and diff checks only.
+The script never silently skips a missing tool/sandbox/provider: prerequisites fail the acceptance.
+Ordinary CLI suites skip the dedicated test until invoked by its owning script.
+
+Static-review follow-up: filbert-296-first-push-static. C1 removes Python's outer timeout so it
+cannot SIGKILL the shell before EXIT cleanup. N2 moves the named claim-history assertion before
+the process-end wait. N1's spawn-to-ledger SIGKILL gap is retained and documented in BUILD.md;
+--kill-after-start exercises the fully recorded groups. N3 remains a cosmetic fixture limitation.
+N4 indentation corrected. N5 scratch-bootstrap config overwrite is explicitly fixture-only.

agents/lena/work/queue-296/MANIFEST.sha256

@@ -0,0 +1,9 @@
+6e0193ba91cbd20edd3acfbc57ae9af2f016e6d2c3587b434a9085b3a02c493c  BUILD-LOG.md
+72029331a22f33433ad14ff08fe8b24d59f79e784009b12fd9c5b74c9e524f13  docs/SESSIONS.md
+87239327014c49abbe130c17881bb48e13d96545bf9f3e09b6f4aed46e11453b  agents/quackerjack/work/queue-296/BUILD.md
+6f32d7e5e0c2c1ee086949a68b176a9d1fefb8ad0df562f5ce72b0c01d21e7a0  agents/lena/work/queue-296/BUILD.md
+bd6e9fd9e3f7aa0ee6702401776ef7bd3e39562059a11b87aaaf2a427904381b  agents/lena/work/queue-296/mutants.py
+89a15e62aa6f951596b764993afeff7e33eeaa3a4f45d31599eba7d27a4000ad  packages/cli/tests/federation-acceptance.test.mjs
+86b76565f5afe9efdd076ef61cc54e40c447d235f77b95818d0d601ce036effa  packages/cli/tests/fixtures/federation-host.mjs
+b12a9bad4be083f2439c3363738b9763fa0061228f84d501a385ade48fea90e4  packages/cli/tests/fixtures/federation-human.mjs
+4008361f062a2f21b6075c500060196e10a48351fd7d95b25d681f36b4fa801a  scripts/test-federation-acceptance.sh

agents/lena/work/queue-296/mutants.py

@@ -0,0 +1,51 @@
+#!/usr/bin/env python3
+"""R7 mutants. Run only on Sage CLEAR in Lena's isolated candidate.
+
+Every replacement must occur once. Product bytes are restored even on timeout
+or failure. A killed mutant must contain the named assertion in the script's
+output; startup errors and timeout alone are not evidence. The shell owns its
+own timeout and EXIT/TERM cleanup. Do not put a killing Python timeout around it.
+"""
+from pathlib import Path
+import subprocess
+import sys
+
+repo = Path(__file__).resolve().parents[4]
+mutants = {
+    'M1': (
+        'packages/cli/src/access.mjs',
+        'projects: resolveProjects(list(parsed.values["--projects"]), rows),',
+        'projects: ["*"],',
+        'R7 ungranted project must not appear',
+    ),
+    'M2': (
+        'packages/bus/src/broker.mjs',
+        "this.#claimEnd({ business: t.business }, h, 'revoke', null, 'access-revoked', by);",
+        "/* R7 mutant: skip ending the revoked claim */",
+        'R7 revoke must end the claim as access-revoked',
+    ),
+}
+if len(sys.argv) != 2 or sys.argv[1] not in mutants:
+    raise SystemExit('usage: mutants.py M1|M2')
+name = sys.argv[1]
+file, before, after, assertion = mutants[name]
+path = repo / file
+original = path.read_bytes()
+text = original.decode()
+if text.count(before) != 1:
+    raise SystemExit(f'{name}: anchor count {text.count(before)}, expected 1')
+try:
+    path.write_text(text.replace(before, after))
+    result = subprocess.run(['scripts/test-federation-acceptance.sh'], cwd=repo,
+                            stdout=subprocess.PIPE, stderr=subprocess.STDOUT,
+                            text=True)
+    print(result.stdout, end='')
+    if result.returncode == 0 or assertion not in result.stdout:
+        raise SystemExit(f'{name}: NOT KILLED by expected assertion')
+    if 'R7 cleanup: no child groups, ports or sockets remain; no units created' not in result.stdout:
+        raise SystemExit(f'{name}: cleanup not verified')
+    print(f'{name}: KILLED by {assertion}')
+finally:
+    path.write_bytes(original)
+    if path.read_bytes() != original:
+        raise SystemExit(f'{name}: restore failed')

agents/quackerjack/work/queue-296/BUILD.md

@@ -0,0 +1,87 @@
+# Row 296: FED R7, scratch two-instance acceptance (#1802)
+
+## Start
+
+- Started 2026-10-23 18:53:27Z, on Sage's sage-3583 (mos-1489).
+- Base: origin/refactor 45dca69f6 (pinned; local copy used, no fetch: fetch runs the credential node script, which
+  is held during Darkwing's re-pin window).
+- Branch: quackerjack/row296 in worktree quackerjack-fed-r5-row296.
+- Brief: docs/plans/2026-10-23_mvp-readiness-rows.md at 45dca69f6, section "Brief: FED R7, scratch two-instance
+  acceptance" (line 77).
+- Constraints from Sage: scratch roots only (mktemp -d under /mnt/storage/scratch/tmp), never ~/.mosaic-dev or
+  the live bus. No push, claim, queue write, node or test run until CLEAR.
+
+## What the brief asks for (summary)
+
+- One script test under scripts/ with its harness in packages/*/tests/, as row 190's tests are.
+- Two configs, two data roots, two Consoles, one fake OP. Consoles start outside agent ancestry in a transient
+  user unit. They never use the live stack's units, ports or sockets. The script removes its units on exit (trap).
+- Test (design section 7 R7 gate): Jason's test identity, granted collaborator on one hub project, signs in,
+  makes a thread, sends to the granted instance, gets the reply in the thread, is refused on another project and
+  on board reads, is revoked, is refused again, and the run ends. The factory shows nothing of the hub.
+- Mutants: grant project list widened to `*`; revocation claim end skipped.
+- Gate: Filbert approves the manifest; the script test and every scripts/test-*.sh green on Sage's gate; no unit,
+  port or socket of the script outlives the run. R8 (live window) stays row 209.
+
+## Open reads before design
+
+- R4 and R6 candidates (the brief says it builds on their combined candidate). Confirm what they expose: the
+  hub sign-in, grant and revocation paths, and the Console's board-read refusal.
+- Row 190's test harness (several instances on one uid): how it starts units and cleans up.
+- Transient user unit support on this host (systemd-run --user), and how the existing tests detect it.
+
+## Status
+
+- 18:53Z: worktree created, brief read. No code yet.
+
+## Handoff 2026-10-23 19:10:09Z (Mos ruling Q245, mos-1503)
+
+Row 296 moves to Lena (Codex seat, thread db27faca-85fb-4ca0-9fc7-78d740d3fa3a, branch lena/row296). Quackerjack
+stops here: no builds, no claim, no queue writes. This design is the handoff; Lena continues it.
+
+Base: 45dca69f6. R4 landed as 2efd127ce (ancestor of the base, checked with merge-base --is-ancestor). R6 landed as
+d3059c2c3 (row 294). R7 is claimable once Darkwing's window ends (Sage, sage-3592).
+
+What I verified by reading (not by running):
+- packages/cli/src/access.mjs:65 reads `system.federation?.peers ?? []` (the R6 seam).
+- packages/bus/src/user-cli.mjs exists at base (the user-cli transport).
+- Row 190's tests (packages/cli/tests/stack-instances.test.mjs, stack-release.test.mjs T56, stack-release-fixture.mjs)
+  drive stand-in units and fixtures. They do not start real transient user units. Not a model for R7's Consoles.
+- Real transient-unit launch pattern: packages/conversation/src/cohort.mjs (`scopeAvailable()` and `ScopeLauncher`,
+  systemd-run --user --scope -p Delegate=yes --unit=...; MANAGER_ENV = XDG_RUNTIME_DIR, DBUS_SESSION_BUS_ADDRESS).
+- Test-only spawn of systemd-run in packages/conversation/tests is the nearest precedent for start/stop cleanup.
+
+What I did NOT verify (so treat as open): the hub sign-in, grant, revocation and board-read paths in R4/R6 code; the
+Console startup flags; whether the fake OP can be a local stand-in; the trap-based unit cleanup.
+
+Design (proposal, not yet checked against code):
+1. scripts/test-federation-acceptance.sh: the entry point. Creates a mktemp -d scratch root under
+   /mnt/storage/scratch/tmp (never ~/.mosaic-dev, never the live bus). trap removes every unit it started and the
+   scratch root. Refuses to run if a transient unit name collides.
+2. Two configs (instance A = hub-side granted seat, instance B = collaborator's home), each with its own
+   MOSAIC_CONFIG, data root and federation.self; federation.peers names the other.
+3. One fake OP: a local stand-in that issues Jason's test identity. Its port and socket are per-run, not the live ones.
+4. Two Consoles, each in its own transient user unit (systemd-run --user --unit=mosaic-r7-<run>-<A|B>); outside agent
+   ancestry; ports picked per run.
+5. Test flow (the R7 gate): identity -> grant on one hub project -> sign in -> thread -> send to granted instance ->
+   reply in thread -> refused on another project -> refused on board reads -> revoke -> refused after revoke -> run
+   ends. Factory output must show nothing of the hub.
+6. Mutants: (a) grant project list widened to `*`, must fail the other-project refusal; (b) revocation claim end
+   skipped, must fail the refusal-after-revoke check.
+
+Unresolved decisions for Lena (I did not decide these):
+- Whether the harness lives in packages/cli/tests (matching row 190) or packages/conversation/tests (matching
+  cohort.mjs). Brief says packages/*/tests/; pick the one that owns the Console start path.
+- Fake OP: in-process HTTP stand-in versus file-backed identity. No preference recorded.
+- Port selection: fixed range per run vs OS-assigned. Brief forbids the live ports; it does not pick a range.
+
+R2 and R5 learning:
+- R2 (row 203, #1701) landed as a4da4e6df. I built it. Relevant to R7: validateFederation in
+  scripts/mosaic-config.mjs rejects unknown keys and bad ids, and test-config.sh has an FED block
+  (expect_fed_refusal). Use federation.self/peers exactly as row 203 validates them.
+  Mutant runner pattern: one textual edit that must occur exactly once, then a named test must fail; restore from git.
+  Name filter gotcha: `node --test --test-name-pattern` skips subtests whose parent does not match; include the
+  parent name (T57 for row 203).
+- R5: I did not build R5 in this session and have no first-hand notes on it. Ask Sage for R5's landing sha and notes.
+
+Status: design written; no code, no test runs, no claim, no push of the test files. Next owner: Lena.

agents/researcher/work/queue-216/BUILD.md

@@ -1,184 +0,0 @@
-# Row 216 build notes (C2-05a, lookup index and queries, #1717)
-
-Phase A only: code, tests and this file. No test, suite or mutant has been run. `node --check` passed on every changed `.mjs`.
-
-- Branch: `researcher/row216`
-- Base: `d372102882d6858fa77af4aee453f866c886ad5c` (origin/refactor)
-- Design: `agents/gosalyn/work/case2/DESIGN.md` on origin/gosalyn/case2-design, section 3 (table at lines 625-631, bullets 633-641), 1.2-1.4, B12, D2
-- Brief: `docs/plans/2026-10-20_case2-rows.md`, C2-05a at lines 320-357
-
-## Files
-
-| Path | Status |
-|---|---|
-| `packages/library/src/index-build.mjs` | new |
-| `packages/library/src/query.mjs` | new |
-| `packages/library/src/index.mjs` | edit: 2 export lines added |
-| `packages/library/tests/query-fixture.mjs` | new, test helper |
-| `packages/library/tests/query.test.mjs` | new |
-| `packages/library/tests/index-build.test.mjs` | new |
-| `agents/researcher/work/queue-216/BUILD.md` | new (this file) |
-
-No existing test or source file changed beyond `index.mjs`.
-
-## Design rows and where each is tested
-
-| Design row | Code | Tests (query.test.mjs unless noted) |
-|---|---|---|
-| `library_find` | `find` | find is bound to its universe; every result carries its scope; long list pages; large items page under the cap |
-| `library_get` | `get` | hybrid gets a source file; get lists visible links both ways; get pages its lines |
-| `library_search` | `search` | search returns scoped line hits; item that cannot fit alone is refused |
-| `library_manuscript` | `manuscript` | one chapter at most 400 lines; refused without chapter; hybrid reads a source chapter |
-| `library_universe` | `universeInfo` | universe info reports a hybrid's sources, constraints, notes; unknown universe refused |
-| Hybrid semantics (1.4) | `sees` | a hybrid sees its sources canon minus exclusions, no playground |
-| Unmapped never appears | index build + `sees` | unmapped files never appear (query.test); index holds mapped files only (index-build.test) |
-| Per-commit cache (3) | `indexFor` | same commit, path, mapping return one index; different path, mapping or commit get their own; eight-entry bound; failed read not kept; unchecked mapping refused (index-build.test) |
-| Rebuild time (3, C2-05a gate) | `indexFor` | 3,000-file rebuild, time reported with `t.diagnostic`, no threshold asserted |
-| REPLY_CAP parity | `QUERY_REPLY_CAP` | equals `REPLY_CAP` from harness tools.mjs |
-
-## Choices where the design table is silent or differs
-
-These are departures or gaps. Each is built as stated, so Sage can rule before Phase B. A ruling that changes one of them is a small edit.
-
-1. **Paging arguments (gap a).** The table has no offset. `find` and `search` take an optional `offset` (a position in the filtered list, default 0). A reply carries `next`: the position of the next item, or `null`.
-2. **`library_get` has no universe (gap b).** Built with a required `universe`. Without it the reply could not be isolated. A missing file and a file the universe cannot see both return `null`, so a caller cannot tell them apart. `get` also takes an optional `from` line.
-3. **`get` over the cap (gap c).** Lines page by `from` with `next`. `links_out` and `links_in` come back whole on every page. If the frontmatter and links alone exceed the cap, the call is refused with `query-item-too-large`. A hub note with many backlinks may be refused. This needs a ruling: link paging, or accept the refusal.
-4. **`manuscript` without a chapter (gap d).** Refused with `query-chapter-required`. The design names no list form. A chapter name that matches two visible files is refused with `query-chapter-ambiguous`.
-5. **`search` excerpt (gap e).** The excerpt is the whole line, not a truncation. A line that alone exceeds the cap is refused. Truncating it would cut an item.
-6. **`exclude` form (gap f).** `checkMapping` accepts only a folder path for `exclude` (`folder()`), so an exclusion is a path prefix. There is no type or source form to build. Confirm.
-7. **Pin constraints.** `pin` does not hide any file. It is reported by `universeInfo` only. Confirm.
-8. **Playground through `get`.** `scope` applies to lists. `get` by an explicit path returns a playground file of the caller's own universe. Confirm.
-9. **Links.** A link into a file the universe cannot see is dropped from `links_out` and `links_in`, in line with N1. Links from a visible file that point into another universe are kept in the index (the reader keeps them under R6), and the query layer drops them for universes that cannot see them.
-10. **`find` matching.** Case-insensitive substring over the front matter `name` and the file name. An empty `query` matches every file in scope.
-11. **Cache key.** `repo`, `commit` and a sha256 of the canonical mapping. Keying by commit alone would return the wrong scopes after a mapping change. The cache holds eight entries, least recently used out. Failed reads are not kept.
-12. **`universeInfo`.** Reads only the checked mapping and the served commit. It builds no index.
-13. **Reply commit.** Every reply carries the index commit, which is the served commit passed in.
-
-## Provisional refusal codes (pending Sage approval)
-
-The brief says new refusal codes need Sage's approval first. These are provisional and must not be treated as settled:
-
-- `query-argument-invalid`
-- `query-universe-unknown`
-- `query-chapter-required`
-- `query-chapter-ambiguous`
-- `query-item-too-large`
-
-Reused, existing codes: `library-mapping-invalid`, plus the reader's `library-git`, `library-commit` through `indexFor`.
-
-## Grep results (grep only, not a test run)
-
-- Test references to the changed paths: `packages/library/tests/*.mjs` import `../src/index.mjs` and `../src/mapping.mjs`. `packages/bus/tests/library.test.mjs` and `library-sync.test.mjs` import the library index as a namespace. Neither enumerates its exports, so the two new export lines break no assertion.
-- `packages/cli/tests/stack-copy.test.mjs:52` checks that `packages/library/src/index.mjs` exists, and it still does.
-- 64-hex pins: none in `packages/library/tests`, none on `index.mjs`, `query.mjs` or `index-build.mjs`.
-- `scripts/test-*.sh`: no reference to the new modules.
-
-## Flag for Sage
-
-- `packages/library/tests/helpers.mjs` `repo()` builds its fixtures under `tmpdir()`, which is `/tmp`. The launcher rules forbid that. The new tests do not use it; they use `tests/query-fixture.mjs`, which builds under `/mnt/storage/scratch/tmp`. The existing helper should be fixed in a separate row, not here.
-
-## Phase B commands (not run)
-
-Run only after Sage sends "slot clear". Set the scratch TMPDIR first, per the launcher rule.
-
-```
-cd /mnt/storage/src/mosaic-stack/.claude/worktrees/agent-aa3cc98787bc5152c/packages/library
-export TMPDIR=/mnt/storage/scratch/tmp
-node --test tests/query.test.mjs tests/index-build.test.mjs
-node --test tests/*.test.mjs
-```
-
-Also run `packages/bus/tests/library.test.mjs` and `library-sync.test.mjs`, since they import the index.
-
-## Status
-
-Not yet verified. Nothing has been tested and nothing is committed. The working tree holds the Phase A changes. AGENTS.md invariant 8 allows a commit only after the applicable suites are green, so the commit waits for Phase B. The dispatch asked for a local commit in Phase A; Sage to confirm that the commit waits for Phase B.
-
-## Round 2 (2026-10-22, sage-2708, sage-2716): rulings applied, rebased onto aca16404c
-
-Added after the text above; nothing above is edited. "Nothing is committed", "Provisional refusal codes",
-`query-chapter-required` and the tmpdir flag above were true when written and are superseded here.
-
-- Branch `researcher/row216-r2`, one local commit on origin/refactor `aca16404c`. Row 268 (C2-01c) is in
-  that base. Row 253 has not landed; the work rebases onto 253's tip before any gate. Not pushed, not run.
-- Rulings: `agents/sage/work/queue-216/RULINGS.md` at da9555ca2, rulings 1-13 and the tmpdir flag.
-- Drift check, d37210288..aca16404c against my paths: the library files that changed are `mapping.mjs`,
-  `scope.mjs`, `README.md` and the mapping and scope tests. None is a file I add or edit. `query.mjs` reads
-  the checked mapping through them, so the whole library package runs in phase B.
-
-### What changed from phase A
-
-| Ruling | Change in `query.mjs` | Test |
-|---|---|---|
-| 3 `get` over the cap | `links_out` and `links_in` page together with `links_from`; every reply carries `links_next`, `next` and the front matter. A page with lines left carries at least one line. Links take at most half the cap while lines remain. `query-item-too-large` is left for front matter alone or one line alone (or one link alone) | hub note with 900 backlinks pages and adds up; front matter alone and a line alone refused; bad `links_from` |
-| 4 `manuscript` no chapter | `chapter` optional: the first visible chapter in path order. Every reply carries `next_chapter`. `query-chapter-required` removed. Ambiguity still refuses | first chapter and `next_chapter`; ambiguous name refused |
-| 5 `search` long line | hit comes back `{path, line, excerpt: null, excerpt_too_long: true, scope}`, other hits still return | marked hit and unmarked hits in one reply |
-| 6 `exclude` | path-prefix reading only. The test names `EXCLUSION` and `EXCLUDED_PATHS` in `query-fixture.mjs`, so C2-15 (row 267) swaps two constants | exclusion hides from the hybrid and not from the source |
-| 8 hybrid `get` | unchanged code; test added | hybrid gets a source's playground file as `null`; the source gets it with `scope: "playground"` |
-| PRD 1.14 (row 268) | `universeInfo` reports `kind` from the mapping (`draft` included) | four tests below |
-
-PRD 1.14 tests, one each: a lookup naming a `book` leaves `book: null` files out (find and search);
-`library_manuscript` never reads a `book: null` file; a draft universe has no canon, so its lookups return
-files only with `scope: "playground"`; `library_universe` on a draft returns kind, name and prefixes.
-The levels fixture is `WITH_LEVELS` in `query.test.mjs`: harbor gets `Notes/Harbor/` as a universe-level
-playground prefix, and `idea` is a draft over `Drafts/New World/`.
-
-`query-fixture.mjs` builds under `tmpdir()`, as `helpers.mjs` does (ruling "tmpdir flag"). The earlier
-flag about `helpers.mjs` building under `/tmp` is closed by that ruling: the gate sets `TMPDIR`.
-
-Refusal codes now: `query-argument-invalid`, `query-universe-unknown`, `query-chapter-ambiguous`,
-`query-item-too-large`. All four approved in the rulings.
-
-### Grep results (grep only, not a test run)
-
-- `git grep` over `packages/*/tests/*` and `scripts/*` for `query.mjs` and `index-build`: no hit outside
-  `packages/library/tests/query*.test.mjs` and `index-build.test.mjs`.
-- 64-hex pins naming a library path: none. Positive control: the same pathspec finds the sha256 lines in
-  `packages/cli/tests/case1-hostcheck.test.mjs` and the `packages/library/src/index.mjs` existence check at
-  `packages/cli/tests/stack-copy.test.mjs:52`.
-- Tests that read `packages/library/src` as a directory: `packages/cli/tests/stack-release-fixture.mjs:309`
-  copies `packages/library/src` whole into a release fixture. It carries no file list, so two new files break
-  no assertion. `stack-release.test.mjs` is not in the gate unless Sage wants it.
-- Tests that import the library index as a namespace: `packages/bus/tests/library.test.mjs` and
-  `library-sync.test.mjs`. Neither enumerates exports, so the two export lines add no break. Both run
-  whole in phase B.
-
-### Run limits (fixed before any run)
-
-Every node file runs as its own `setsid -w timeout -k 10 LIMIT node --test FILE`; nothing runs unbounded.
-
-- Node test files: LIMIT 900 s. The library test files have no recorded time. 900 s is above the longest
-  recorded whole-package run I know of (cli, 591 s, row 281 BUILD.md "Runs" step 3), so it holds the 3x rule
-  for any single file. The first run records each file's time, and a file past 300 s gets a limit re-derived
-  from it before the next run. `query.test.mjs` builds a 900-file repo and a 3,000-file index rebuild is in
-  `index-build.test.mjs`; both are the files most likely to need it.
-- No shell script is in this row's gate, so no script limit applies.
-
-Any timeout goes to Sage, then Mos, unplaced (mos-1275).
-
-### Phase B (not run; Sage's CLEAR first, then a rebase onto 253's tip)
-
-```
-export TMPDIR=/mnt/storage/scratch/tmp
-cd <worktree>/packages/library
-for f in tests/*.test.mjs; do setsid -w timeout -k 10 900 node --test "$f"; done
-cd ../bus
-for f in tests/library.test.mjs tests/library-sync.test.mjs; do setsid -w timeout -k 10 900 node --test "$f"; done
-cd ../cli
-setsid -w timeout -k 10 900 node --test tests/stack-copy.test.mjs
-```
-
-Mutants I propose (my list, not read off the brief; each is meant to be killed by the named test, and none
-has been thrown; the kill claims are unverified until CLEAR):
-
-- M-a: `sees()` returns true for a file of another universe: killed by "find is bound to its universe".
-- M-b: the playground filter dropped: killed by "playground appears only when asked for".
-- M-c: the hybrid reads a source's playground: killed by "a hybrid gets a source playground file as null".
-- M-d: `links_next` always null: killed by the hub paging test.
-- M-e: the book filter lets `book: null` through: killed by the PRD 1.14 book test.
-
-### Status
-
-Built, not run. `node --check` has not been run on this round's files (no node before the CLEAR); the
-phase A pass above covered the earlier text only. The commit is local and waits for no gate under Sage's
-sage-2716 instruction, which allows git and docs work only; push and claim wait for Sage's go.

docs/SESSIONS.md

@@ -1593,3 +1593,4 @@ are never rewritten or removed; corrections are new entries.
 2026-10-23T17:48:43Z | Scrooge (629b6cd3) | Row 252 Console inbox Approve and Deny (#1753) | Rebased onto 306 landing as 580037105 (range-diff all =), slot run bus 907/0 webui 410/0 cli 943/0, in-review revs 3608/3609, Webby r1 APPROVE, J1-J19 specs to Sage; Sage landed 45ea3fa0d (done rev 3616). Part 1 mutant results were never in BUILD.md; they went to Sage by T3 (scrooge-0252-mutant-specs).
 2026-10-23 | Sage (1ef1e4f8) | Rows 308 and 252 landings, 571 Connections design amendment, Vikunja 597 | 308 (PRD 1.17, #1815) landed 30e6bb680 and 252 (#1753) landed 45ea3fa0d (replay of 580037105 onto 30e6bb680, range-diff all =), each after a full gate on the landed tree (252 also J1-J19, J11c and J18 equivalent); Gyro's 571 amendment (Fenton APPROVE) landed e8bb13df8; Vikunja 570, 435 and 597 done, canonical webui esbuild 0.28.2; queue revs 3589-3616 committed 59f013247
 2026-10-23 | Sage (1ef1e4f8) | Vikunja 571 W build rows; rows 13, 42, 257 and 289 check | Filed the design's ten W rows as queue rows 309-318 (revs 3617-3626, owners set to unassigned 3627-3636, queue commit 293b42fee pushed); Vikunja 571 done (comment 994). Row 13's candidate fd72d2689 is on refactor, gate is Monday's row 7 ledger run; 42 paused under mos-1184; 257 post-v1; 289 waits on 214 and 288. Slot released 17:56Z.
+- 2026-10-23 — lena (Codex, db27faca): row 296 / #1802 FED R7; recovered Quackerjack design on lena/row296, inspecting acceptance paths; Node/tests held pending Sage CLEAR, no live changes.

packages/bus/src/broker.mjs

@@ -96,16 +96,7 @@ export const TASK_PAGE_MAX = 200;
 // request allowed past the ordinary 64 KiB envelope (server.mjs and client.mjs), up to its content cap.
 export const PROJECT_FILE_VERBS = Object.freeze(['project.files', 'project.file', 'project.file.save']);
 // C2-03a: library.sync is the human's fetch, and with `accept` the one way past library-diverged.
-// Row 224: pure agent lookups are separate from the three human-only verbs. Listing them
-// here also makes server.mjs await their host effects instead of serializing a Promise as {}.
-const LIBRARY_LOOKUPS = Object.freeze({
-  'library.find': { method: 'find', fields: ['universe', 'query', 'type', 'book', 'scope', 'offset'], required: ['universe', 'query'] },
-  'library.get': { method: 'get', fields: ['universe', 'path', 'scope', 'from', 'links_from'], required: ['universe', 'path'] },
-  'library.search': { method: 'search', fields: ['universe', 'text', 'book', 'scope', 'offset'], required: ['universe', 'text'] },
-  'library.manuscript': { method: 'manuscript', fields: ['universe', 'book', 'scope', 'chapter', 'from', 'to'], required: ['universe', 'book'] },
-  'library.universe': { method: 'universeInfo', fields: ['universe'], required: ['universe'] },
-});
-export const LIBRARY_VERBS = Object.freeze(['library.file', 'library.status', 'library.sync', ...Object.keys(LIBRARY_LOOKUPS)]);
+export const LIBRARY_VERBS = Object.freeze(['library.file', 'library.status', 'library.sync']);
 export const PROJECT_SAVE_VERB = 'project.file.save';
 export const PROJECT_SAVE_REQUEST_MAX = 1024 * 1024 + 64 * 1024;
 export const WEB_VERBS =Object.freeze(['web.search', 'web.fetch']);
@@ -5134,42 +5125,10 @@ export class Broker {
       throw this.#refused(s, ProjectFailure && e instanceof ProjectFailure ? new BusError(e.code) : e, request);
     }
   }
-  // Row 224 C2-05b: the agent never supplies a host repo, commit or business. Its current
-  // holder and business entry are rechecked before/after awaits; runtime owns Git and queries.
-  async #requestLibraryLookup(s, { verb, args }) {
-    try {
-      this.#agent(s);
-      const business = this.#business(s.business);
-      const projects = Object.entries(business.projects ?? {}).filter(([, entry]) => entry.kind === 'library');
-      if (!projects.length || typeof this.#library?.lookup !== 'function') fail('library-not-configured');
-      const spec = LIBRARY_LOOKUPS[verb];
-      keys(args, ['project', ...spec.fields], spec.required);
-      if (!text(args.universe, 160)) fail('invalid-request');
-      if (args.project === undefined && projects.length !== 1) fail('invalid-request');
-      const project = args.project ?? projects[0][0];
-      if (!text(project, 160) || !projects.some(([name]) => name === project)) fail('library-not-configured');
-      const revision = JSON.stringify(business.projects[project]);
-      const authorize = () => {
-        this.#agent(s);
-        this.#processingGate(s, verb);
-        if (JSON.stringify(this.#business(s.business).projects?.[project]) !== revision) fail('library-not-configured');
-      };
-      const { project: ignored, ...query } = args;
-      authorize();
-      const result = await this.#library.lookup({ business, project }, { method: spec.method, args: query, authorize });
-      authorize();
-      this.#secretCheck(result);
-      return result;
-    } catch (error) {
-      const Failure = this.#library?.LibraryError;
-      throw this.#refused(s, Failure && error instanceof Failure ? new BusError(error.code) : error, { verb, args });
-    }
-  }
   // C2-04 M4: only a verified human reads library text or status. Host Git
   // functions stay injected, preserving this module's sandbox import closure.
   async #requestLibrary(s, request) {
     const { verb, args } = request;
-    if (Object.hasOwn(LIBRARY_LOOKUPS, verb)) return this.#requestLibraryLookup(s, request);
     try {
       this.#human(s);
       const fields = verb === 'library.file' ? ['project', 'path'] : verb === 'library.sync' ? ['project', 'accept'] : ['project'];

packages/bus/src/runtime.mjs

@@ -87,38 +87,6 @@ export async function harnessLevels({ log = (e) => process.stderr.write(`plugins
   }
   return (name) => levels.get(name) ?? null;
 }
-// Row 224 C2-05b: a host-only adapter. A failed fetch keeps serving immutable old
-// objects, as C2-03a requires; no caller may select a repo, commit or sync --accept.
-export function createLibraryLookup({ dataRoot, sync, now = () => Date.now() }) {
-  const methods = { find: libraryModule.find, get: libraryModule.get, search: libraryModule.search,
-    manuscript: libraryModule.manuscript, universeInfo: libraryModule.universeInfo };
-  return async (context, { method, args, authorize }) => {
-    if (!Object.hasOwn(methods, method)) throw new libraryModule.LibraryError('query-argument-invalid', 'unknown lookup');
-    authorize();
-    const source = { ...context, dataRoot };
-    let state = await libraryModule.libraryStatus(source);
-    authorize();
-    // sage-2819 / dewey-0852: failed attempts also pace inline retries. Otherwise an
-    // outage makes every lookup refetch while lastFetch remains old or null.
-    const recentAttempt = Math.max(state.lastFetch === null ? -Infinity : Date.parse(state.lastFetch),
-      state.lastError === null ? -Infinity : Date.parse(state.lastError.at));
-    const age = now() - recentAttempt;
-    if (age > libraryModule.SYNC_INTERVAL_MS || age < 0) {
-      try { await sync(source); }
-      catch (error) {
-        // A timer may already be fetching this mirror. Its current served state is still safe.
-        if (!(error instanceof libraryModule.LibraryError) || error.code !== 'library-sync-busy') throw error;
-      }
-      authorize();
-      state = await libraryModule.libraryStatus(source);
-    }
-    if (!state.served) throw new libraryModule.LibraryError('library-commit', 'library has never been synced');
-    authorize();
-    return methods[method]({ repo: libraryModule.mirrorPath(source), commit: state.served,
-      mapping: libraryModule.checkMapping(context.business.projects[context.project]) }, args);
-  };
-}
-
 export async function startBroker({
   dataRoot,
   businesses,
@@ -333,8 +301,6 @@ export async function startBroker({
       store,
       businesses,
       library: {
-        lookup: createLibraryLookup({ dataRoot, sync: context =>
-          processing.work(() => libraryModule.sync(context, syncOptions(context.business))) }),
         readFile: context => libraryModule.readLibraryFile({ ...context, dataRoot }),
         status: context => libraryModule.libraryStatus({ ...context, dataRoot }),
         sync: (context, { accept }) => processing.work(() => libraryModule.sync({ ...context, dataRoot }, { ...syncOptions(context.business), accept })),

packages/bus/tests/library-lookups.test.mjs

@@ -1,251 +0,0 @@
-// Row 224: exercise broker authorization, real C2-05a queries and host served snapshots.
-// All bodies and remotes are made up. External sync is replaced only at its trusted host seam.
-import test from 'node:test';
-import assert from 'node:assert/strict';
-import { mkdirSync, writeFileSync } from 'node:fs';
-import { join } from 'node:path';
-import { Store } from '../src/store.mjs';
-import { Broker } from '../src/broker.mjs';
-import { createLibraryLookup, startBroker } from '../src/runtime.mjs';
-import { serve } from '../src/server.mjs';
-import { Client } from '../src/client.mjs';
-import * as library from '../../library/src/index.mjs';
-import { scratchRepo, note } from '../../library/tests/query-fixture.mjs';
-import { mappingEntry, git } from '../../library/tests/helpers.mjs';
-
-const NOW = Date.parse('2026-10-22T16:00:00.000Z');
-const VERBS = ['library.find', 'library.get', 'library.search', 'library.manuscript', 'library.universe'];
-const GET = { universe: 'harbor', path: 'Book One/Characters/Tomas.md' };
-const ARGS = [
-  { universe: 'harbor', query: 'Tomas' }, GET,
-  { universe: 'harbor', text: 'ferry' }, { universe: 'harbor', book: 'Book One' }, { universe: 'harbor' },
-];
-const TEXTS = {
-  'Book One/Characters/Tomas.md': note('character', 'Tomas', 'He runs the ferry. [[Elsewhere]]'),
-  'Book One/Chapters/01.md': '# A ferry\nOne line.\n',
-  'Book One/Playground/What If.md': note('character', 'Maybe Tomas', 'Unwritten ferry.'),
-  'Second World/Characters/Elsewhere.md': note('character', 'Elsewhere', 'Other ferry.'),
-};
-
-async function world(t, { projects, adapter, claimed = true, now = () => NOW, files = TEXTS } = {}) {
-  const f = scratchRepo(t, files), dataRoot = join(f.root, 'data');
-  mkdirSync(dataRoot);
-  const business = { id: 'acme', human: 'jason', vars: { 'bus.tester': true },
-    projects: projects ?? { books: mappingEntry() }, arbiters: { technical: 'coder', delivery: 'coder' },
-    roles: { coder: { definition: 'coder', authority: { withinRole: [], crossRole: [] } } } };
-  const context = { business, project: 'books', dataRoot };
-  let mirror = null, state = null, fetches = 0;
-  if (business.projects.books?.kind === 'library') {
-    mirror = await library.ensureMirror(context);
-    git(f.repo, '-c', 'protocol.file.allow=always', 'push', '-q', mirror, 'HEAD:refs/heads/served');
-    state = { version: 1, branch: 'main', served: f.commit, lastFetch: new Date(NOW).toISOString(),
-      lastError: null, diverged: null, problems: [] };
-    writeFileSync(join(mirror, library.SYNC_STATE_FILE), JSON.stringify(state), { mode: 0o600 });
-  }
-  const setState = patch => {
-    state = { ...state, ...patch };
-    writeFileSync(join(mirror, library.SYNC_STATE_FILE), JSON.stringify(state), { mode: 0o600 });
-  };
-  const lookup = createLibraryLookup({ dataRoot, now, sync: async () => {
-    fetches++;
-    setState({ lastFetch: new Date(now()).toISOString() });
-    return { state, code: null };
-  } });
-  const store = new Store(dataRoot);
-  t.after(() => store.close());
-  const broker = new Broker({ store, businesses: { acme: business },
-    library: adapter ?? { lookup, LibraryError: library.LibraryError } });
-  const agent = broker.bindLaunch({ business: 'acme', role: 'coder', run: 'r224', harness: 'pi' });
-  if (claimed) broker.request(agent, { verb: 'role.claim' });
-  const human = broker.bindHuman({ business: 'acme', human: 'jason', via: 'cli', outsideAgent: true });
-  const reader = broker.bindReader({ business: 'acme' }), tester = broker.bindTester({ business: 'acme' });
-  const call = (verb, args = {}, cap = agent) => Promise.resolve().then(() => broker.request(cap, { verb, args }));
-  return { ...f, dataRoot, business, context, mirror, store, broker, agent, human, reader, tester,
-    call, lookup, setState, fetches: () => fetches };
-}
-
-test('all five agent verbs read the configured served commit through real queries', async t => {
-  const f = await world(t);
-  const [find, get, search, manuscript, universe] = await Promise.all(VERBS.map((verb, i) => f.call(verb, ARGS[i])));
-  for (const result of [find, get, search, manuscript, universe]) assert.equal(result.commit, f.commit);
-  assert.deepEqual(find.results.map(x => x.path), ['Book One/Characters/Tomas.md']);
-  assert.match(JSON.stringify(get.lines), /He runs the ferry/);
-  assert.deepEqual(get.links_out, []); // The only target is in another universe.
-  assert.ok(search.results.length > 0);
-  assert.ok(search.results.every(x => !x.path.startsWith('Second World/') && x.scope === 'canon'));
-  assert.equal(manuscript.path, 'Book One/Chapters/01.md');
-  assert.deepEqual(universe.books, ['Book One']);
-  assert.equal(f.fetches(), 0);
-  const playground = await f.call('library.find', { universe: 'harbor', query: '', scope: 'playground' });
-  assert.deepEqual(playground.results.map(x => x.path), ['Book One/Playground/What If.md']);
-  assert.equal(await f.call('library.get', { universe: 'harbor', path: 'Second World/Characters/Elsewhere.md' }), null);
-});
-
-test('each verb refuses missing universe and unknown keys before host work', async t => {
-  let calls = 0;
-  const f = await world(t, { adapter: { lookup: () => { calls++; } } });
-  for (const [i, verb] of VERBS.entries()) {
-    const { universe, ...missing } = ARGS[i];
-    await assert.rejects(f.call(verb, missing), { code: 'invalid-request' });
-    for (const extra of [{ repo: '/elsewhere' }, { commit: 'b'.repeat(40) }, { business: 'other' }, { accept: 'b'.repeat(40) }])
-      await assert.rejects(f.call(verb, { ...ARGS[i], ...extra }), { code: 'invalid-request' });
-    await assert.rejects(f.call(verb, { ...ARGS[i], universe: '' }), { code: 'invalid-request' });
-  }
-  assert.equal(calls, 0);
-});
-
-test('no library, missing host adapter and undeclared project refuse library-not-configured', async t => {
-  const noLibrary = await world(t, { projects: {} });
-  const noAdapter = await world(t, { adapter: {} });
-  const f = await world(t);
-  for (const [i, verb] of VERBS.entries()) {
-    await assert.rejects(noLibrary.call(verb, ARGS[i]), { code: 'library-not-configured' });
-    await assert.rejects(noAdapter.call(verb, ARGS[i]), { code: 'library-not-configured' });
-    await assert.rejects(f.call(verb, { ...ARGS[i], project: 'other' }), { code: 'library-not-configured' });
-  }
-  f.business.projects.second = mappingEntry();
-  await assert.rejects(f.call('library.get', GET), { code: 'invalid-request' });
-  assert.equal((await f.call('library.get', { ...GET, project: 'books' })).commit, f.commit);
-});
-
-test('reads need the current holder on each call; human/tester/reader are not agents', async t => {
-  const f = await world(t, { claimed: false });
-  for (const [i, verb] of VERBS.entries()) {
-    await assert.rejects(f.call(verb, ARGS[i]), { code: 'not-holder' });
-    await assert.rejects(f.call(verb, ARGS[i], f.human), { code: 'agent-required' });
-    await assert.rejects(f.call(verb, ARGS[i], f.tester), { code: 'tester-refused' });
-    await assert.rejects(f.call(verb, ARGS[i], f.reader), { code: 'read-only' });
-  }
-  f.broker.request(f.agent, { verb: 'role.claim' });
-  assert.equal((await f.call('library.get', GET)).commit, f.commit);
-  f.broker.request(f.agent, { verb: 'role.release' });
-  await assert.rejects(f.call('library.get', GET), { code: 'not-holder' });
-});
-
-test('releasing a claim during an async lookup fences the response', { timeout: 30_000 }, async t => {
-  let release, entered;
-  const started = new Promise(resolve => { entered = resolve; });
-  const f = await world(t, { adapter: { lookup: async () => {
-    entered(); await new Promise(resolve => { release = resolve; }); return { lines: [[1, 'not returned']] };
-  } } });
-  const pending = f.call('library.get', GET);
-  await started;
-  f.broker.request(f.agent, { verb: 'role.release' });
-  release();
-  await assert.rejects(pending, { code: 'not-holder' });
-});
-
-test('a business library removed during an async read cannot leak its result', { timeout: 30_000 }, async t => {
-  let release, entered;
-  const started = new Promise(resolve => { entered = resolve; });
-  const f = await world(t, { adapter: { lookup: async () => {
-    entered(); await new Promise(resolve => { release = resolve; }); return { lines: [[1, 'not returned']] };
-  } } });
-  const pending = f.call('library.get', GET);
-  await started;
-  delete f.business.projects.books;
-  release();
-  await assert.rejects(pending, { code: 'library-not-configured' });
-});
-
-test('freshness boundary, unknown last fetch and failed fetch still use immutable served state', async t => {
-  const f = await world(t);
-  f.setState({ lastFetch: new Date(NOW - 60_000).toISOString() });
-  await f.call('library.get', GET);
-  assert.equal(f.fetches(), 0);
-  f.setState({ lastFetch: new Date(NOW - 60_001).toISOString() });
-  await f.call('library.get', GET);
-  assert.equal(f.fetches(), 1);
-  f.setState({ lastFetch: null });
-  await f.call('library.universe', { universe: 'harbor' });
-  assert.equal(f.fetches(), 2);
-  let attempted = 0, clock = NOW;
-  const failing = createLibraryLookup({ dataRoot: f.dataRoot, now: () => clock, sync: async () => {
-    attempted++;
-    f.setState({ lastError: { code: 'library-fetch-failed', at: new Date(clock).toISOString() } });
-    return { code: 'library-fetch-failed' };
-  } });
-  f.setState({ lastFetch: null });
-  const result = await failing(f.context, { method: 'get', args: GET, authorize() {} });
-  assert.equal(attempted, 1);
-  assert.equal(result.commit, f.commit);
-  for (const elapsed of [1, 59_999, 60_000]) {
-    clock = NOW + elapsed;
-    const retry = await failing(f.context, { method: 'get', args: GET, authorize() {} });
-    assert.equal(retry.commit, f.commit, 'serve the old pin during the failure cooldown');
-    assert.equal(attempted, 1, 'recent lastError prevents another sync even though lastFetch is null');
-  }
-  clock = NOW + 60_001;
-  assert.equal((await failing(f.context, { method: 'get', args: GET, authorize() {} })).commit, f.commit);
-  assert.equal(attempted, 2, 'retry only after the failed-attempt interval expires');
-});
-
-test('an unreadable sync state fails closed; a busy sync keeps serving the existing pin', async t => {
-  const f = await world(t);
-  const lookup = createLibraryLookup({ dataRoot: f.dataRoot, now: () => NOW, sync: async () => {
-    throw new library.LibraryError('library-sync-busy', 'another fetch');
-  } });
-  f.setState({ lastFetch: null });
-  assert.equal((await lookup(f.context, { method: 'get', args: GET, authorize() {} })).commit, f.commit);
-  writeFileSync(join(f.mirror, library.SYNC_STATE_FILE), '{bad json', { mode: 0o600 });
-  await assert.rejects(f.call('library.get', GET), { code: 'library-state-invalid' });
-});
-
-test('a stale lookup sees the commit published by its sync, not the prior served commit', async t => {
-  const f = await world(t);
-  writeFileSync(join(f.repo, GET.path), note('character', 'Tomas', 'Changed ferry.'));
-  git(f.repo, 'add', '-A'); git(f.repo, 'commit', '-qm', 'second fixture');
-  const next = git(f.repo, 'rev-parse', 'HEAD');
-  const lookup = createLibraryLookup({ dataRoot: f.dataRoot, now: () => NOW, sync: async () => {
-    git(f.repo, '-c', 'protocol.file.allow=always', 'push', '-q', f.mirror, 'HEAD:refs/heads/served');
-    f.setState({ served: next, lastFetch: new Date(NOW).toISOString() });
-    return { code: null };
-  } });
-  f.setState({ lastFetch: null });
-  const result = await lookup(f.context, { method: 'get', args: GET, authorize() {} });
-  assert.equal(result.commit, next);
-  assert.match(JSON.stringify(result.lines), /Changed ferry/);
-});
-
-test('real socket awaits lookup results and rechecks rejected query arguments', { timeout: 30_000 }, async t => {
-  const f = await world(t);
-  const path = join(f.root, 'lookup.sock');
-  const server = await serve({ broker: f.broker, path }); t.after(() => server.close());
-  const client = new Client({ path, cap: f.agent });
-  const result = await client.call('library.get', GET);
-  assert.equal(result.commit, f.commit);
-  await assert.rejects(client.call('library.find', { universe: 'harbor', query: '', scope: 'anything' }), /query-argument-invalid/);
-});
-
-test('runtime actually injects the lookup adapter, without exposing human library.file', { timeout: 30_000 }, async t => {
-  const f = scratchRepo(t, TEXTS), dataRoot = join(f.root, 'runtime'); mkdirSync(dataRoot);
-  const business = { id: 'acme', human: 'jason', projects: { books: mappingEntry() },
-    arbiters: { technical: 'coder', delivery: 'coder' },
-    roles: { coder: { definition: 'coder', authority: { withinRole: [], crossRole: [] } } } };
-  const runtime = await startBroker({ dataRoot, businesses: { acme: business } }); t.after(() => runtime.close());
-  const mirror = library.mirrorPath({ business, project: 'books', dataRoot });
-  git(f.repo, '-c', 'protocol.file.allow=always', 'push', '-q', mirror, 'HEAD:refs/heads/served');
-  writeFileSync(join(mirror, library.SYNC_STATE_FILE), JSON.stringify({ version: 1, branch: 'main', served: f.commit,
-    lastFetch: new Date().toISOString(), lastError: null, diverged: null, problems: [] }), { mode: 0o600 });
-  const cap = runtime.broker.bindLaunch({ business: 'acme', role: 'coder', run: 'r224-runtime', harness: 'pi' });
-  runtime.broker.request(cap, { verb: 'role.claim' });
-  assert.equal((await runtime.broker.request(cap, { verb: 'library.get', args: GET })).commit, f.commit);
-  await assert.rejects(runtime.broker.request(cap, { verb: 'library.file', args: { project: 'books', path: GET.path } }),
-    { code: 'human-required' });
-});
-
-test('C2-05c broker forwards supporting scope and returns the served blob without adding write verbs', async t => {
-  const projects = { books: mappingEntry() };
-  projects.books.universes.harbor.supporting = ['Book One/Support/'];
-  const path = 'Book One/Support/Helper.md';
-  const f = await world(t, { projects, files: { ...TEXTS, [path]: note('summary', 'Helper', 'Supporting fixture.') } });
-  assert.deepEqual((await f.call('library.find', { universe: 'harbor', query: '', scope: 'supporting' })).results.map(x => x.path), [path]);
-  assert.deepEqual((await f.call('library.search', { universe: 'harbor', text: 'Supporting fixture', scope: 'supporting' })).results.map(x => x.path), [path]);
-  assert.equal(await f.call('library.get', { universe: 'harbor', path }), null);
-  const result = await f.call('library.get', { universe: 'harbor', path, scope: 'supporting' });
-  assert.equal(result.scope, 'supporting');
-  assert.equal(result.commit, f.commit);
-  assert.equal(result.blob, git(f.mirror, 'rev-parse', `${f.commit}:${path}`));
-  assert.equal(await f.call('library.get', { universe: 'second', path, scope: 'supporting' }), null);
-  await assert.rejects(f.call('library.manuscript', { universe: 'harbor', book: 'Book One', scope: 'supporting' }), { code: 'query-argument-invalid' });
-});

packages/business/tests/business.test.mjs

@@ -27,10 +27,6 @@ test('C2-04: library mappings load without roots, remain frozen, and retain mapp
   assert.deepEqual(validateBusinessDocument(doc, file, { rolesDir: REPO_ROLES }).projects.books.universes.harbor.playground, ['Elsewhere/Playground/']);
   doc.projects.books.universes.harbor.playground = ['Second World/Playground/'];
   refuses(() => validateBusinessDocument(doc, file, { rolesDir: REPO_ROLES }), /library-playground-other-universe/);
-  // C2-01d: a supporting prefix inside another universe's book refuses with its own code.
-  doc.projects.books = mappingEntry();
-  doc.projects.books.universes.harbor.supporting = ['Second World/Notes/'];
-  refuses(() => validateBusinessDocument(doc, file, { rolesDir: REPO_ROLES }), /library-supporting-other-universe/);
   doc.projects.books = { ...mappingEntry(), root: '/forbidden' };
   refuses(() => validateBusinessDocument(doc, file, { rolesDir: REPO_ROLES }), /library-mapping-invalid/);
 });

packages/cli/src/launcher.mjs

@@ -528,7 +528,6 @@ export function createLauncher({
       contract: readFileSync(resolved.contract, "utf8"),
       arbiter: Object.values(b.arbiters).includes(instance),
       tracker,
-      library: Object.values(b.projects ?? {}).some(project => project.kind === "library"),
       credentials,
       session: { run, launchedBy, workspace: inSandbox, toolSocket, turnMarker, checkouts: inSandbox === workspace ? checkouts : checkouts.map((c) => ({ ...c, path: join(inSandbox, relative(workspace, c.path)) })) },
       harness,

packages/cli/tests/federation-acceptance.test.mjs

@@ -0,0 +1,234 @@
+// FED R7 / #1802. Run through scripts/test-federation-acceptance.sh: it owns
+// the child process groups and scratch lifetime. Ordinary CLI suites skip it.
+// sage-3625: federation-host.mjs supplies a labelled readProcess ancestry
+// stand-in for setup, grant/revoke and both Console transports. This is NOT
+// a genuine outside-agent human proof. Product transports/grant checks stay real.
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { spawn, spawnSync } from 'node:child_process';
+import { closeSync, cpSync, existsSync, mkdirSync, openSync, readFileSync, writeFileSync } from 'node:fs';
+import { request } from 'node:http';
+import { join, dirname } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { businessDoc, launchDoc, writeJson } from '../../business/tests/helpers.mjs';
+import { REPO_SKILLS } from '../../harness/tests/helpers.mjs';
+import { DatabaseSync } from 'node:sqlite';
+import { SESSION_COOKIE } from '../../webui/src/sso.mjs';
+import { fakeOidc } from '../../webui/tests/helpers/fake-oidc.mjs';
+import { socketPath, REPO } from '../src/config.mjs';
+import { startTimeOf } from '../src/host.mjs';
+import { launchLogFile, readSessions } from '../../seat/src/session.mjs';
+
+const root = process.env.MOSAIC_R7_ROOT;
+const helper = fileURLToPath(new URL('./fixtures/federation-human.mjs', import.meta.url));
+const adapterModule = fileURLToPath(new URL('./fixtures/thread-adapter.mjs', import.meta.url));
+const webCli = join(REPO, 'packages/webui/src/cli.mjs');
+const cli = join(REPO, 'packages/cli/src/cli.mjs');
+const pause = ms => new Promise(r => setTimeout(r, ms));
+const json = path => JSON.parse(readFileSync(path, 'utf8'));
+
+function run(cmd, args, options = {}) {
+  const r = spawnSync(cmd, args, { encoding: 'utf8', timeout: 30000, ...options });
+  assert.equal(r.status, 0, `${cmd} ${args.join(' ')}: ${r.stderr ?? ''} ${r.error?.message ?? ''}`);
+  return r.stdout;
+}
+async function until(read, label, ms = 20000) {
+  const end = Date.now() + ms;
+  while (Date.now() < end) {
+    const value = await read();
+    if (value) return value;
+    await pause(50);
+  }
+  assert.fail(`R7 assertion: ${label}`);
+}
+
+function http(instance, path, { cookie, body, method = body === undefined ? 'GET' : 'POST' } = {}) {
+  return new Promise((resolve, reject) => {
+    const text = body === undefined ? undefined : JSON.stringify(body);
+    const headers = { host: new URL(instance.origin).host };
+    if (cookie) headers.cookie = cookie;
+    if (text !== undefined) Object.assign(headers, { origin: instance.origin, 'sec-fetch-site': 'same-origin', 'content-type': 'application/json', 'content-length': Buffer.byteLength(text) });
+    const req = request({ host: '127.0.0.1', port: instance.port, path, method, headers, timeout: 5000 }, res => {
+      let data = '';
+      res.on('data', c => data += c);
+      res.on('end', () => resolve({ status: res.statusCode, headers: res.headers, body: data && String(res.headers['content-type']).startsWith('application/json') ? JSON.parse(data) : data }));
+    });
+    req.on('error', reject);
+    req.on('timeout', () => req.destroy(new Error('R7 HTTP timeout')));
+    req.end(text);
+  });
+}
+let serial = 0;
+function child(instance, label, command) {
+  const log = join(root, `${instance.name}-${label}.log`);
+  const fd = openSync(log, 'a', 0o600);
+  let proc;
+  try { proc = spawn(command[0], command.slice(1), { detached: true, env: instance.env, stdio: ['ignore', fd, fd] }); }
+  finally { closeSync(fd); }
+  proc.on('error', e => { console.error(`R7 child ${label}: ${e.message}`); });
+  assert.ok(proc.pid, `R7 ${label} spawned`);
+  const start = startTimeOf(proc.pid);
+  assert.ok(start, `R7 ${label} start time recorded`);
+  // EXIT trap owns the detached group even if Node's test driver is killed.
+  writeFileSync(join(root, 'groups'), `${proc.pid} ${start}\n`, { flag: 'a' });
+  proc.unref();
+  return { log, proc };
+}
+// Jason-shell ancestry stand-in is in the fixture host; transport/path are real.
+function human(instance, verb, args = {}) {
+  const out = join(root, `human-${++serial}.json`);
+  run(process.execPath, [helper, socketPath(instance.dataRoot), instance.name, verb, JSON.stringify(args), out], { env: instance.env });
+  return json(out);
+}
+// R5/R4 CLI with that same labelled fixture proof, never a live human shell.
+function access(instance, args) {
+  return run(process.execPath, [cli, 'access', ...args, '--business', instance.name], { env: instance.env });
+}
+
+function prepare(name, iss, ca) {
+  const home = process.env.HOME;
+  const env = { HOME: home, PATH: process.env.PATH, TMPDIR: process.env.TMPDIR };
+  run(join(REPO, 'scripts/bootstrap.sh'), ['--instance', name], { env });
+  const config = join(home, '.config', `mosaic-${name}`, 'config.json');
+  const system = json(config), dataRoot = system.dataRoot, configDir = dirname(config);
+  const fixtureRoot = join(root, name);
+  mkdirSync(fixtureRoot, { recursive: true });
+  const doc = businessDoc(fixtureRoot, name);
+  doc.human = 'melanie';
+  doc.plugins = { harness: ['pi'], channel: ['webui'] };
+  doc.roles.chief.vars = { harness: 'pi', model: 'claude-opus-5-5', thinking: 'high' };
+  doc.roles.assistant = { definition: 'assistant', vars: { harness: 'pi', model: 'claude-sonnet-5-5', thinking: 'high' } };
+  doc.launch = launchDoc('chief', ['coder', 'assistant'], { opus: 1, sonnet: 2 });
+  doc.launch.threadIdleSeconds = 3600;
+  for (const role of Object.values(doc.roles)) role.vars = { harness: 'pi', model: 'glm-5.3-flash', thinking: 'high', ...role.vars };
+  writeJson(join(configDir, 'businesses', `${name}.json`), doc);
+  const origin = `https://${name}.example.test`;
+  system.console = { sso: { publicOrigin: origin, providers: [{ id: 'test-op', issuer: iss.issuer, clientId: iss.clientId,
+    clientSecret: { slot: name }, algs: ['RS256'], subjects: [{ sub: 'owner-sub', name: 'melanie' }] }] } };
+  system.federation = { self: name, peers: [{ id: name === 'hub' ? 'factory' : 'hub', origin: `https://${name === 'hub' ? 'factory' : 'hub'}.example.test`, label: name === 'hub' ? 'Factory' : 'Hub' }] };
+  writeJson(config, system);
+  writeJson(join(configDir, 'access.json'), { accessVersion: 1, revision: 1, users: [], grants: [] });
+  // Generated fake OP material only; never copies a host slot or credential.
+  writeJson(join(configDir, 'secrets/mosaic-stack', name), iss.clientSecret);
+  cpSync(REPO_SKILLS, join(dataRoot, 'skills-enabled'), { recursive: true });
+  const projectRoot = doc.projects.stack.root;
+  const gitEnv = { ...env, GIT_CONFIG_NOSYSTEM: '1', GIT_CONFIG_GLOBAL: '/dev/null' };
+  const git = (...args) => run('git', ['-c', 'user.name=R7 fixture', '-c', '[email protected]', '-C', projectRoot, ...args], { env: gitEnv });
+  git('init', '-q', '-b', 'main');
+  writeFileSync(join(projectRoot, 'file.txt'), `${name} fixture\n`);
+  git('add', 'file.txt'); git('commit', '-q', '-m', 'scratch fixture');
+  const adapter = join(fixtureRoot, 'adapter.sh');
+  writeFileSync(adapter, `exec '${process.execPath}' '${adapterModule}'\n`);
+  return { name, origin, configDir, dataRoot, adapter, env: { ...env, MOSAIC_CONFIG: config, NODE_EXTRA_CA_CERTS: ca }, port: null };
+}
+
+async function signIn(instance, op, iss, sub) {
+  const start = await http(instance, '/auth/login');
+  assert.equal(start.status, 303, JSON.stringify(start.body));
+  const location = new URL(start.headers.location);
+  const { code } = op.grant(iss, location.href, { sub });
+  const cookie = start.headers['set-cookie'][0].split(';')[0];
+  const result = await http(instance, `/auth/callback?${new URLSearchParams({ code, state: location.searchParams.get('state') })}`, { cookie });
+  const session = (result.headers['set-cookie'] ?? []).find(c => c.startsWith(`${SESSION_COOKIE}=`) && !c.includes('Max-Age=0'))?.split(';')[0];
+  return { ...result, cookie: session };
+}
+const logs = i => existsSync(launchLogFile(i.dataRoot, i.name)) ? readFileSync(launchLogFile(i.dataRoot, i.name), 'utf8').trim().split('\n').filter(Boolean).map(JSON.parse) : [];
+
+function claimHistory(instance, run) {
+  const store = new DatabaseSync(join(instance.dataRoot, 'bus/bus.sqlite'), { readOnly: true });
+  try { return store.prepare('SELECT op, reason FROM thread_claims WHERE holder_run=? ORDER BY seq').all(run); }
+  finally { store.close(); }
+}
+
+test('FED R7 scratch two-instance acceptance', { skip: !root && 'run scripts/test-federation-acceptance.sh', timeout: 180000 }, async t => {
+  const op = await fakeOidc();
+  t.after(() => op.close());
+  const hubIssuer = op.issuer('hub'), factoryIssuer = op.issuer('factory');
+  assert.notEqual(hubIssuer.clientId, factoryIssuer.clientId);
+  const ca = join(root, 'fake-op-ca.pem'); writeFileSync(ca, op.cert);
+  assert.ok(![7330, 7331, 7332].includes(Number(new URL(op.base).port)));
+  writeFileSync(join(root, 'ports'), `${new URL(op.base).port}\n`, { flag: 'a' });
+  const hub = prepare('hub', hubIssuer, ca), factory = prepare('factory', factoryIssuer, ca);
+  assert.notEqual(hub.dataRoot, factory.dataRoot);
+  assert.notEqual(hub.env.MOSAIC_CONFIG, factory.env.MOSAIC_CONFIG);
+  for (const i of [hub, factory]) {
+    const ready = join(root, `${i.name}-host.ready`);
+    const host = child(i, 'host', [process.execPath, '--experimental-test-module-mocks',
+      fileURLToPath(new URL('./fixtures/federation-host.mjs', import.meta.url)), i.name, i.adapter, ready]);
+    await until(() => existsSync(ready), `${i.name} fixture host ready; ${host.log}`);
+    writeFileSync(join(root, 'sockets'), `${socketPath(i.dataRoot)}\n`, { flag: 'a' });
+  }
+  const shared = human(hub, 'project.create', { name: 'hub-shared', repo: 'stack' }).id;
+  const privateProject = human(hub, 'project.create', { name: 'hub-private' }).id;
+  human(factory, 'project.create', { name: 'factory-only' });
+  access(hub, ['user', 'add', 'jason-test', '--home', 'factory', '--subject', 'test-op:jason-test-sub', '--revision', '1']);
+  access(hub, ['grant', '--user', 'jason-test', '--projects', shared, '--instances', 'assistant', '--level', 'collaborator', '--revision', '2']);
+  for (const i of [hub, factory]) {
+    const { log } = child(i, 'console', [process.execPath, webCli, 'serve', '--port', '0', '--business', i.name, '--board', 'http://127.0.0.1:1', '--sso', '--send']);
+    i.port = Number(await until(() => existsSync(log) && readFileSync(log, 'utf8').match(/Mosaic Console: http:\/\/127\.0\.0\.1:(\d+)\//)?.[1], `${i.name} Console started`));
+    assert.ok(![7330, 7331, 7332].includes(i.port));
+    writeFileSync(join(root, 'ports'), `${i.port}\n`, { flag: 'a' });
+  }
+  assert.notEqual(hub.port, factory.port);
+  if (process.env.MOSAIC_R7_INTERRUPT === '1') {
+    console.log('R7 interruption: both Consoles started; killing test driver');
+    process.kill(process.pid, 'SIGKILL');
+    await pause(60000);
+  }
+  const signed = await signIn(hub, op, hubIssuer, 'jason-test-sub');
+  assert.equal(signed.status, 303, JSON.stringify(signed.body)); assert.ok(signed.cookie);
+  const cookie = signed.cookie;
+  const config = await http(hub, '/api/config', { cookie });
+  assert.equal(config.status, 200); assert.equal(config.body.user, true);
+  const projects = await http(hub, '/api/chat/projects', { cookie });
+  assert.equal(projects.status, 200, JSON.stringify(projects.body));
+  assert.deepEqual(projects.body.rows.map(p => p.id), [shared], 'R7 ungranted project must not appear');
+  const created = await http(hub, '/api/chat/threads', { cookie, body: { project: shared, instance: 'assistant', name: 'Jason scratch thread' } });
+  assert.equal(created.status, 200, JSON.stringify(created.body));
+  const thread = created.body.id;
+  const sent = await http(hub, `/api/chat/threads/${thread}/messages`, { cookie, body: { body: 'R7 scratch question' } });
+  assert.equal(sent.status, 200, JSON.stringify(sent.body));
+  const reply = await until(async () => {
+    const r = await http(hub, `/api/chat/threads/${thread}/messages`, { cookie });
+    assert.equal(r.status, 200, JSON.stringify(r.body));
+    return r.body.rows.find(m => m.class === 'RESULT' && m.in_reply_to === sent.body.id);
+  }, 'granted instance replies in Jason thread');
+  assert.equal(reply.from_role, 'assistant'); assert.equal(reply.to_role, 'user');
+  assert.match(reply.body, /R7 scratch question/);
+  const refused = await http(hub, '/api/chat/threads', { cookie, body: { project: privateProject, instance: 'assistant', name: 'must refuse' } });
+  assert.equal(refused.status, 403); assert.equal(refused.body.error, 'access-refused');
+  assert.deepEqual(json(join(hub.configDir, 'access.json')).grants[0].projects, [shared], 'R7 grant must name exactly one project');
+  for (const path of ['/api/board', '/api/bus/inbox', '/api/bus/tasks']) {
+    const r = await http(hub, path, { cookie });
+    assert.equal(r.status, 403, path); assert.equal(r.body.error, 'owner-only', path);
+  }
+  const factoryLogin = await signIn(factory, op, factoryIssuer, 'jason-test-sub');
+  assert.equal(factoryLogin.status, 403); assert.equal(factoryLogin.cookie, undefined);
+  const factoryOwner = await signIn(factory, op, factoryIssuer, 'owner-sub');
+  assert.equal(factoryOwner.status, 303); assert.ok(factoryOwner.cookie);
+  const factoryProjects = await http(factory, '/api/chat/projects', { cookie: factoryOwner.cookie });
+  assert.equal(factoryProjects.status, 200);
+  assert.deepEqual(factoryProjects.body.rows.map(p => p.name), ['factory-only']);
+  const factoryThreads = await http(factory, '/api/chat/threads', { cookie: factoryOwner.cookie });
+  assert.equal(factoryThreads.status, 200); assert.deepEqual(factoryThreads.body.rows, []);
+  const hubCookieAtFactory = await http(factory, '/api/chat/projects', { cookie });
+  assert.equal(hubCookieAtFactory.status, 401);
+  const [launch] = logs(hub).filter(e => e.event === 'launch' && e.thread === thread);
+  assert.ok(launch, 'R7 sandboxed run launched');
+  const liveRun = readSessions(hub.dataRoot).find(s => s.run === launch.run);
+  assert.ok(liveRun, 'R7 run remains live before revoke');
+  access(hub, ['revoke', '--user', 'jason-test', '--revision', '3']);
+  const after = await http(hub, '/api/chat/projects', { cookie });
+  assert.equal(after.status, 401); assert.equal(after.body.error, 'sign-in required');
+  assert.equal((await signIn(hub, op, hubIssuer, 'jason-test-sub')).status, 403);
+  // Pin the claim before waiting for process exit: a missing broker revocation
+  // must fail this assertion, even if it also prevents the runner from ending.
+  assert.ok(claimHistory(hub, launch.run).some(r => r.op === 'revoke' && r.reason === 'access-revoked'),
+    'R7 revoke must end the claim as access-revoked');
+  const ended = await until(() => logs(hub).find(e => e.event === 'end' && e.run === launch.run), 'revoked run ended');
+  assert.equal(ended.exitCode, 0, JSON.stringify(ended));
+  assert.deepEqual(readSessions(hub.dataRoot), []);
+  await until(() => startTimeOf(liveRun.pid) !== liveRun.startTime && startTimeOf(liveRun.runnerPid) !== liveRun.runnerStartTime, 'revoked engine and runner processes gone');
+  assert.equal(claimHistory(hub, launch.run).at(-1).op, 'revoke', 'R7 shutdown must not replace missing revocation with release');
+  assert.deepEqual(human(factory, 'thread.list'), []);
+});

packages/cli/tests/fixtures/federation-host.mjs

@@ -0,0 +1,67 @@
+// FED R7 fixture, sage-3625: the ancestry walk is a stand-in for Jason's
+// shell. Keep this override in a test-only process, never in product code.
+// As channel-fixture.mjs, real pid/uid/argv/startTime/nonce checks remain;
+// verifyHuman sees ppid=1 instead of walking the development agent's tree.
+import { mock } from 'node:test';
+const humanUrl = new URL('../../../bus/src/human.mjs', import.meta.url).href;
+const real = await import(humanUrl);
+mock.module(humanUrl, { namedExports: {
+  readProcess: real.readProcess,
+  verifyHuman: (proof, options) => real.verifyHuman(proof, {
+    ...options, readProcess: pid => ({ ...real.readProcess(pid), ppid: 1 }),
+  }),
+} });
+const { startBroker } = await import('../../../bus/src/runtime.mjs');
+const { BusError } = await import('../../../bus/src/broker.mjs');
+const { loadSystem, bootConfig } = await import('../../src/config.mjs');
+const { createLauncher } = await import('../../src/launcher.mjs');
+const { fakeHarnesses } = await import('../helpers.mjs');
+const { writeFileSync } = await import('node:fs');
+const [business, adapter, ready] = process.argv.slice(2);
+const system = loadSystem();
+const runtime = await startBroker(bootConfig({ system, businessId: business }));
+const hooks = [], cleanups = [];
+const ops = {
+  identity: m => runtime.identity(m.cap),
+  authorizeLaunch: m => runtime.authorizeLaunch(m.cap, m.instance),
+  refuse: m => runtime.refuse(m.cap, m.code, m.subject),
+  endLaunch: m => runtime.endLaunch(m.record),
+  credentialStatus: m => runtime.credentialStatus(m.business, m.role),
+  threadsState: m => runtime.threadsState(m.business),
+  threadIdle: m => runtime.threadIdle(m.record),
+  mayLaunch: m => runtime.mayLaunch(m),
+  landHeld: m => runtime.landHeld(m.record),
+  landHolders: m => runtime.landHolders(m.business),
+  landRelease: m => runtime.landRelease(m.record),
+  sessionClears: m => runtime.sessionClears(m.business),
+  lifecycleRequests: m => runtime.lifecycleRequests(m.business),
+};
+const wrap = fn => async value => {
+  try { return fn(value); }
+  catch (e) { throw Object.assign(new Error(e.message), { code: e instanceof BusError ? e.code : 'fixture-host-refused' }); }
+};
+const host = {
+  business, path: runtime.path, dataRoot: system.dataRoot,
+  op: wrap(m => { if (!Object.hasOwn(ops, m.op)) throw new BusError('invalid-host-request'); return ops[m.op](m); }),
+  bindLaunch: wrap(record => runtime.bindLaunch(record)),
+  beforeClose: fn => void hooks.push(fn),
+};
+const launcher = createLauncher({ host, system,
+  makeLoader: await fakeHarnesses({ after: fn => cleanups.push(fn) }, { pi: adapter }, write => write('channel', 'webui',
+    `export * from ${JSON.stringify(new URL('../../../plugins/channel/webui/index.mjs', import.meta.url).href)};`)),
+  readOnly: [new URL('./thread-adapter.mjs', import.meta.url).pathname],
+  harnessVersion: '0.85.1', sessionDefaults: { pollInterval: 600000 }, threadTickMs: 100,
+});
+let closing = false;
+async function close() {
+  if (closing) return;
+  closing = true;
+  for (const fn of hooks) await fn(0);
+  await runtime.close();
+  for (const fn of cleanups) await fn();
+  process.exit(0);
+}
+process.once('SIGTERM', close);
+process.once('SIGINT', close);
+await launcher.listen();
+writeFileSync(ready, 'ready\n', { mode: 0o600 });

packages/cli/tests/fixtures/federation-human.mjs

@@ -0,0 +1,7 @@
+// R7 fixture: actual human-cli path with the fixture host's labelled ancestry override.
+// This stands in for Jason's shell (sage-3625); it does not prove real human ancestry.
+import { writeFileSync } from 'node:fs';
+import { humanTransport } from '../../src/transport.mjs';
+const [socket, business, verb, args, out] = process.argv.slice(2);
+const result = await humanTransport({ socket, business })(verb, JSON.parse(args));
+writeFileSync(out, JSON.stringify(result), { mode: 0o600 });

packages/cli/tests/thread-launch.test.mjs

@@ -27,7 +27,6 @@ import { bootConfig, loadSystem } from "../src/config.mjs";
 import { startTimeOf } from "../src/host.mjs";
 import { createLauncher } from "../src/launcher.mjs";
 import { fakeHarnesses, fixture, tmp } from "./helpers.mjs";
-import { mappingEntry } from "../../library/tests/helpers.mjs";
 // Row 264a (#1769): a thread made by hand gets the default session the 3k-3l migration gives a
 // legacy thread, with the thread's id.
 const DEFAULT_SESSION = [
@@ -530,24 +529,3 @@ test('C2-09a: terminating one creative thread does not signal an unselected peer
   await until(() => !readSessions(f.dataRoot).some(row => row.run === runs[0]));
   assert.ok(readSessions(f.dataRoot).some(row => row.run === runs[1]));
 });
-
-// Row224: the launcher must derive library presence from business projects, not
-// from session checkouts (a library never has an agent clone).
-test("C2-05b a real launched bundle gets lookups for a library project without a library checkout", { skip, timeout: 60000 }, async t => {
-  const prepared = prepare(t, { idle: 10, edit: doc => {
-    doc.projects.books = mappingEntry();
-    return doc;
-  } });
-  const { f } = prepared;
-  const host = await start(t, prepared);
-  const project = host.call("project.create", { name: "library work", repo: "stack" }).id;
-  const thread = host.call("thread.create", { project, name: "lookup" }).id;
-  await ask(host.call, thread, "inspect bundle");
-  const run = launchLog(f).find(e => e.event === "launch" && e.thread === thread).run;
-  const tools = JSON.parse(readFileSync(join(f.dataRoot, "launches", "acme", run, "bundle", "tools.json"), "utf8"));
-  assert.deepEqual(tools.filter(tool => tool.name.startsWith("library_")).map(tool => tool.name),
-    ["library_find", "library_get", "library_search", "library_manuscript", "library_universe"]);
-  const [session] = threadRuns(f, thread);
-  assert.ok(session);
-  assert.ok(!session.checkouts?.some(checkout => checkout.project === "books"));
-});

packages/harness/src/bundle.mjs

@@ -292,7 +292,6 @@ function prompt({ contract, resolved, session, tools, untyped, builtins, persona
 //   resolved     resolveInstance(...) output
 //   contract     the role contract's text
 //   arbiter      true when the business names this instance as an arbiter
-//   library      true when the trusted business configuration has a library project
 //   tracker      true when the broker has task verbs for the business
 //   credentials  the broker's credentialStatus(...) for the instance (metadata only)
 //   session      { run, launchedBy, workspace, toolSocket, turnMarker, checkouts }
@@ -310,11 +309,11 @@ function prompt({ contract, resolved, session, tools, untyped, builtins, persona
 //                (row 213); an instance with persona.sha256 and no personaDir refuses
 // Returns { manifest, files, policy, tools, env } with absolute paths; env is the module's
 // adapter variables, which the host writes into session.json.
-export function buildBundle({ dir, resolved, contract, arbiter = false, tracker = false, library = false, credentials = [], session, harness, route = "primary", routeReason = null, harnessVersion = null, models = null, land = false, skillsDir = null, personaDir = null }) {
+export function buildBundle({ dir, resolved, contract, arbiter = false, tracker = false, credentials = [], session, harness, route = "primary", routeReason = null, harnessVersion = null, models = null, land = false, skillsDir = null, personaDir = null }) {
   if (route !== "primary" && route !== "fallback") throw new BundleError(`route ${JSON.stringify(route)} isn't primary or fallback`);
   const model = sessionModel(resolved, models, route);
   const web = webPlan(resolved, model.harness, harness.builtinWeb());
-  const tools = typedTools({ resolved, arbiter, tracker, library, projects: (session.checkouts ?? []).map((c) => c.project), webTyped: !web.builtin, land });
+  const tools = typedTools({ resolved, arbiter, tracker, projects: (session.checkouts ?? []).map((c) => c.project), webTyped: !web.builtin, land });
   const untyped = untypedActions(resolved, tools);
   const persona = readPersona(resolved, personaDir);
   mkdirSync(dir, { recursive: true, mode: 0o700 });

packages/harness/src/tools.mjs

@@ -78,10 +78,9 @@ const TASK_TOOLS = {
 
 const MESSAGE_CLASSES = ["REQUEST", "ASSIGNMENT", "REVIEW-REQUEST", "REVIEW-RESULT", "RESULT", "INFO", "DECISION", "REACTION", "BLOCK"];
 
-// typedTools({ resolved, arbiter, tracker, projects, land, library }) -> [{ name, verb, action, description, parameters }]
+// typedTools({ resolved, arbiter, tracker, projects, land }) -> [{ name, verb, action, description, parameters }]
 //   resolved  resolveInstance(...) output for the session's instance
 //   arbiter   true when the business names this instance as an arbiter
-//   library   true when the trusted business configuration has a library project
 //   tracker   true when the broker has task verbs for the business
 //   projects  the project ids the session has a clone of
 //   land      true when the role and thread hold a merge decision a landing could use (landHeld)
@@ -89,7 +88,7 @@ const MESSAGE_CLASSES = ["REQUEST", "ASSIGNMENT", "REVIEW-REQUEST", "REVIEW-RESU
 // `verb` is the broker verb; the `launch` tool has verb "launch" and goes
 // to the host instead, and "working.push", "working.fetch" and
 // "working.land" go to the host's git socket.
-export function typedTools({ resolved, arbiter = false, tracker = false, projects = [], webTyped = true, land = false, library = false }) {
+export function typedTools({ resolved, arbiter = false, tracker = false, projects = [], webTyped = true, land = false }) {
   const held = new Set([...resolved.limits.authority.withinRole, ...resolved.limits.authority.crossRole]);
   const tools = [];
   const add = (name, verb, action, description, parameters) => tools.push({ name, verb, action, description, parameters });
@@ -223,33 +222,6 @@ export function typedTools({ resolved, arbiter = false, tracker = false, project
       url: str("The https url to fetch", { maxLength: 2048 }),
     }, ["url"]));
   }
-  // Row224: no library clone or token reaches a session. The broker chooses the served
-  // commit and requires a universe on every call; cursors page without cutting replies.
-  if (library) {
-    const universe = str("Universe ID in the configured library", { minLength: 1 });
-    const project = str("Library project ID; omit only when the business has one library");
-    const scope = str("canon by default; playground and supporting are opt-in", { enum: ["canon", "playground", "supporting"] });
-    const manuscriptScope = str("canon by default; playground is opt-in", { enum: ["canon", "playground"] });
-    const book = str("Book folder from library_universe");
-    const offset = { type: "integer", minimum: 0, description: "next from the previous page" };
-    const line = { type: "integer", minimum: 1, description: "One-based line number" };
-    const base = { universe, project };
-    add("library_find", "library.find", null, "Find names in one universe, at the served commit. At most 50 results; continue with next as offset. Playground and supporting are opt-in.", obj({
-      ...base, query: str("Case-insensitive name or filename substring; empty matches all"),
-      type: str("Mapped type", { enum: ["character", "place", "research", "tracker", "summary"] }),
-      book, scope, offset,
-    }, ["universe", "query"]));
-    add("library_get", "library.get", null, "Read a note and its blob at the served commit, canon by default. Playground/supporting paths need matching scope; mismatch returns null. next pages lines; links_next pages visible links in supporting/playground/canon order.", obj({
-      ...base, path: str("Mapped note path relative to the library"), scope, from: line, links_from: offset,
-    }, ["universe", "path"]));
-    add("library_search", "library.search", null, "Search text in one universe at the served commit. At most 50 hits; use next as offset. Playground and supporting are opt-in.", obj({
-      ...base, text: str("Nonempty case-insensitive substring", { minLength: 1 }), book, scope, offset,
-    }, ["universe", "text"]));
-    add("library_manuscript", "library.manuscript", null, "Read one chapter of a book at the served commit, at most 400 lines. Omit chapter for the first; continue with next or next_chapter.", obj({
-      ...base, book, scope: manuscriptScope, chapter: str("Chapter filename without extension"), from: line, to: line,
-    }, ["universe", "book"]));
-    add("library_universe", "library.universe", null, "Read a universe's mapping at the served commit: books, types, playground prefixes, and hybrid sources/constraints/notes or draft metadata.", obj(base, ["universe"]));
-  }
   add("read_spec", "spec.read", null, "Read a project's committed north-star spec and its file history. commit is an optional full reachable commit ID. The file commit, rather than HEAD, is what a decision cites. confirmed says the file commit was authored by the business's human.", obj({
     project: str("Project ID from the business file"),
     commit: str("Optional full historical commit ID", { pattern: "^[0-9a-f]{40}$" }),
@@ -305,11 +277,6 @@ export function typedTools({ resolved, arbiter = false, tracker = false, project
     if (held.has("task.create"))
       add("list_requirements", "requirements", null, "List the approved PRD's requirement ids, each with a one-line title. task_create takes only these. When none fits a request, raise a prd.approve decision instead of creating the task.", obj({}));
   }
-  // mos-1308 / M3: no generic spec, evidence, tracker, decision or write tools. The
-  // C2-08 web grant still supplies broker web reads to companion and research only.
-  if (CREATIVE_DEFINITIONS.includes(resolved.definition))
-    return tools.filter(tool => tool.name === "send_message" || tool.name.startsWith("library_") ||
-      tool.name === "web_search" || tool.name === "web_fetch");
   return tools;
 }
 

packages/harness/tests/library-tools.test.mjs

@@ -1,82 +0,0 @@
-// Row224 M3: exact creative tool sets preserve the existing C2-08 web grants.
-import test from 'node:test';
-import assert from 'node:assert/strict';
-import { mkdirSync, readFileSync } from 'node:fs';
-import { join } from 'node:path';
-import { typedTools } from '../src/tools.mjs';
-import { buildBundle } from '../src/bundle.mjs';
-import { TYPES } from '../../library/src/mapping.mjs';
-import { HARNESS, REPO_SKILLS, resolvedFor, scratch } from './helpers.mjs';
-
-const LOOKUPS = ['library_find', 'library_get', 'library_search', 'library_manuscript', 'library_universe'];
-const CREATIVE = ['companion', 'research', 'ideas', 'proofreader', 'fact-checker', 'continuity'];
-const role = (t, definition, harness = 'pi') => resolvedFor(t, 'bean', d => {
-  d.roles.bean = { definition, vars: { harness, model: 'claude-sonnet-5-5', thinking: 'high' } };
-});
-const expected = definition => ['send_message', ...(['companion', 'research'].includes(definition)
-  ? ['web_search', 'web_fetch'] : []), ...LOOKUPS];
-
-test('M3: per-role snapshots contain six names, or eight with the C2-08 web grant', t => {
-  for (const definition of CREATIVE) {
-    const tools = typedTools({ resolved: role(t, definition), library: true, tracker: true, arbiter: true });
-    assert.deepEqual(tools.map(t => t.name), expected(definition), definition);
-    assert.ok(tools.every(t => t.parameters.additionalProperties === false));
-  }
-});
-
-test('every noncreative role gets lookups when a library is configured, not otherwise', t => {
-  for (const instance of ['coder', 'reviewer', 'pm', 'chief']) {
-    const resolved = resolvedFor(t, instance);
-    const ordinary = typedTools({ resolved }).map(t => t.name);
-    assert.ok(!ordinary.some(name => name.startsWith('library_')));
-    const tools = typedTools({ resolved, library: true });
-    assert.deepEqual(tools.filter(t => t.name.startsWith('library_')).map(t => t.name), LOOKUPS);
-    assert.deepEqual(tools.filter(t => !t.name.startsWith('library_')).map(t => t.name), ordinary);
-  }
-});
-
-test('lookup schemas require a universe even for get, include paging, and cannot select repo or commit', t => {
-  const tools = typedTools({ resolved: role(t, 'ideas'), library: true });
-  const required = [ ['universe', 'query'], ['universe', 'path'], ['universe', 'text'], ['universe', 'book'], ['universe'] ];
-  for (const [i, tool] of tools.filter(t => t.name.startsWith('library_')).entries()) {
-    assert.deepEqual(tool.parameters.required, required[i]);
-    assert.equal(tool.verb, LOOKUPS[i].replace('_', '.'));
-    assert.equal(tool.action, null);
-    assert.equal(tool.parameters.additionalProperties, false);
-    for (const key of ['repo', 'commit', 'business', 'accept']) assert.equal(Object.hasOwn(tool.parameters.properties, key), false);
-  }
-  const byName = Object.fromEntries(tools.map(t => [t.name, t]));
-  assert.deepEqual(byName.library_find.parameters.properties.scope.enum, ['canon', 'playground', 'supporting']);
-  assert.deepEqual(byName.library_find.parameters.properties.type.enum, [...TYPES]);
-  assert.equal(byName.library_find.parameters.properties.offset.minimum, 0);
-  assert.equal(byName.library_get.parameters.properties.from.minimum, 1);
-  assert.equal(byName.library_get.parameters.properties.links_from.minimum, 0);
-  assert.equal(byName.library_manuscript.parameters.properties.chapter.type, 'string');
-});
-
-test('bundle flag reaches both harness tool manifests and creative prompt without generic tools', t => {
-  for (const definition of CREATIVE) for (const harness of ['pi', 'claude-code']) {
-    const dir = scratch(t), workspace = join(dir, 'ws'); mkdirSync(workspace);
-    const b = buildBundle({ dir: join(dir, 'bundle'), resolved: role(t, definition, harness), library: true,
-      contract: '# Creative\n', tracker: true, arbiter: true, skillsDir: REPO_SKILLS,
-      session: { run: 'r224', launchedBy: 'chief', workspace, toolSocket: join(dir, 't.sock'), turnMarker: join(dir, 'turn.done') },
-      harness: HARNESS[harness] });
-    assert.deepEqual(b.tools.map(t => t.name), expected(definition), `${definition} ${harness}`);
-    const serialized = JSON.parse(readFileSync(b.files.tools, 'utf8'));
-    assert.deepEqual(serialized.map(t => t.name), expected(definition));
-    const prompt = readFileSync(b.files.prompt, 'utf8');
-    assert.match(prompt, /library_find/);
-    assert.doesNotMatch(prompt, /Bus tools: [^\n]*(read_spec|list_agents|inbox|trail|write_record|raise_decision|list_tasks)/);
-  }
-});
-
-test('C2-05c scope schemas expand only find/search/get, keeping manuscript and tool names unchanged', t => {
-  const tools = typedTools({ resolved: role(t, 'ideas'), library: true });
-  assert.deepEqual(tools.map(t => t.name), ['send_message', ...LOOKUPS]);
-  for (const name of ['library_find', 'library_search', 'library_get']) {
-    const tool = tools.find(t => t.name === name);
-    assert.deepEqual(tool.parameters.properties.scope.enum, ['canon', 'playground', 'supporting']);
-    assert.ok(!tool.parameters.required.includes('scope'));
-  }
-  assert.deepEqual(tools.find(t => t.name === 'library_manuscript').parameters.properties.scope.enum, ['canon', 'playground']);
-});

packages/library/README.md

@@ -31,72 +31,33 @@ deep-frozen copy. `where` names the entry in messages. `fail(code, message)` def
 - `user` is the bot account name from design step 3, required for sync. It is optional in the
   mapping and checked with row 199's account name pattern, `[A-Za-z0-9_.-]`, 1 to 100 characters.
 - `vaultPrefix` is optional, one folder name.
-- `editor` is optional, `{ "name", "email" }` plus an optional `"user"`: the ident her Console saves commit under
-  (C2-01d). Each value is text that is non-empty after trim, with no control character
-  (`U+0000`-`U+001F`, `U+007F`-`U+009F`), `<` or `>`, and no whitespace or git-stripped character at
-  either end. `user` is her Gitea login for the `library-human` slot (sage-2925), checked as the
-  entry's `user` is. `editor` and its `user` come back only when given; a save without them refuses
-  in C2-02.
 - `types` maps a folder name to `character`, `place`, `research`, `tracker` or `summary`.
   `manuscript` lists folder names and shares none with `types`.
 - A universe has `name`, `books` and `playground`. A hybrid adds `kind: "hybrid"`, two or more
   plain-universe `sources`, `constraints` (each one `{ "exclude": ... }` or
   `{ "pin": { "entity", "field", "value" } }`) and `notes`, and may have `books: []`. A draft
   universe has only `kind: "draft"`, `name` and one or more `playground` prefixes, and comes back as
-  `{ kind: "draft", name, books: [], playground, supporting }`. `kind` is absent, `"hybrid"` or `"draft"`.
+  `{ kind: "draft", name, books: [], playground }`. `kind` is absent, `"hybrid"` or `"draft"`.
 - A playground prefix ends in `/` and has one of three levels (C2-01c). Book level lies inside one of
   its own entry's book folders. Universe level, in a plain universe or a hybrid, lies outside every
   book folder. A draft's prefixes all lie outside every book folder. No prefix holds another or is
   listed twice, across every entry.
-- Every universe kind may also have `supporting`, a list of prefixes where agents may write (C2-01d,
-  M12). It comes back on every universe, `[]` when absent. A supporting prefix follows the playground's
-  rules: it ends in `/`, has the same three levels, holds no other supporting prefix and is listed
-  once, across every entry.
-- Between the two lists: a supporting prefix may equal a playground prefix of its own entry, and a
-  playground prefix may hold one of its own entry's supporting prefixes. A supporting prefix may not
-  hold a playground prefix, which scope would then never reach, and may not equal, hold or lie inside
-  another entry's playground prefix.
 
 Refusals:
 
 | Code | When |
 |---|---|
 | `library-playground-other-universe` | a playground prefix lies inside, or holds, a book folder of another entry |
-| `library-supporting-other-universe` | a supporting prefix lies inside, or holds, a book folder of another entry |
-| `library-mapping-invalid` | any other shape fault: unknown key, bad remote or branch, an unknown `kind`, a book folder in two universes, a book folder that holds another, a playground or supporting prefix that holds another of its list or is listed twice, a prefix equal to a book folder or holding its own entry's book, a supporting prefix that holds a playground prefix or overlaps another entry's, a bad `editor`, a draft with `books` or with no prefix, a hybrid source that is unknown, a hybrid or a draft |
+| `library-mapping-invalid` | any other shape fault: unknown key, bad remote or branch, an unknown `kind`, a book folder in two universes, a book folder that holds another, a playground prefix that holds another or is listed twice, a prefix equal to a book folder or holding its own entry's book, a draft with `books` or with no prefix, a hybrid source that is unknown, a hybrid or a draft |
 
 ## Scope
 
 `classify(mapping, path)` decides scope from the path alone. Only paths ending in lowercase `.md` are
-mapped. It checks prefixes first, supporting before playground. A path under any entry's supporting
-prefix is `supporting`, and otherwise one under a playground prefix is `playground`. Either way that
-entry is `universe` and the book folder holding the prefix is `book`, or `null` at universe level and
+mapped. It checks prefixes first. A path under any entry's playground prefix is `playground`, with that
+entry as `universe` and the book folder holding the prefix as `book`, or `null` at universe level and
 in a draft. Any other path under a book folder is `canon`. Everything else is `unmapped`. The type is
-the first folder after the prefix, or after the book: a `types` name, `manuscript`, or `null`.
-
-## Agent write paths
-
-`supportingPath(mapping, universe, path, tree)` returns `path` when an agent may write it in that
-universe, else it refuses `library-write-story-path` (C2-01d, M12). `tree` is the array `listTree`
-returns for the commit the write lands on; anything else is a TypeError. It reads no git. The checks
-run in this order, so a path with two faults always names the same one:
-
-1. a string of at most 1,024 UTF-8 bytes;
-2. no control character (the `editor` class), and the message leaves the path out;
-3. no backslash;
-4. not absolute;
-5. no empty, `.` or `..` segment, which also refuses `//` and a trailing `/`;
-6. `classify` gives `supporting` in that same universe, which refuses unmapped, `.canvas`, `.base`
-   and attachment paths, canon, a playground-only folder and another universe's prefix;
-7. no folder on the way, and not the path itself, is a symlink (`120000`) or gitlink (`160000`) in
-   `tree`;
-8. no folder on the way, and not the path itself, matches a tree path or tree folder after
-   `normalize('NFC').toLowerCase()` unless it is that exact name. APFS folds case and Unicode form,
-   so her checkout would put the file somewhere else. A tree that already holds case twins refuses a
-   write to either (R7).
-
-A delete's further rule, that the path exists at the tip as a `100644` blob, belongs to the C2-02
-broker.
+the first folder after the playground prefix, or after the book: a `types` name, `manuscript`, or
+`null`.
 
 ## Reader
 

packages/library/src/index-build.mjs

@@ -1,75 +0,0 @@
-// The lookup index of design 3 (C2-05a): types, names, links and backlinks for one commit of her repo.
-// It is built from the reader's output, so it holds only mapped, readable files: R1, R2 and R7 leave a
-// file out, and an unresolved link is not in it. It is cached in memory by commit id. The key also
-// carries the repo path and a digest of the mapping, because one commit reads differently under another
-// mapping. The index is not universe-aware; query.mjs decides what a universe may see.
-import { createHash } from 'node:crypto';
-import { readLibrary } from './reader.mjs';
-import { raise } from './problems.mjs';
-
-const CACHE_LIMIT = 8;
-const cache = new Map();
-
-const push = (map, key, value) => {
-  if (!map.has(key)) map.set(key, []);
-  map.get(key).push(value);
-};
-// A file's name for lookups: its front matter `name` when it is text, else its file name.
-const displayName = file => {
-  const name = file.frontmatter?.name;
-  return typeof name === 'string' && name.trim() ? name.trim() : file.name;
-};
-// A link as the index keeps it: the file at the other end, its line, and the field when front matter holds it.
-const linkAt = (path, link) => ({ path, line: link.line, ...(link.field === undefined ? {} : { field: link.field }) });
-
-// Builds the index from readLibrary's output. Pure: no git, no clock.
-export function buildIndex(library, mapping) {
-  const files = new Map(), types = new Map(), names = new Map(), linksOut = new Map(), linksIn = new Map();
-  for (const file of library.files) {
-    const name = displayName(file);
-    files.set(file.path, {
-      path: file.path, scope: file.scope, universe: file.universe, book: file.book, type: file.type,
-      folder: file.folder, stem: file.name, name, frontmatter: file.frontmatter, lines: file.lines,
-    });
-    if (file.type !== null) push(types, file.type, file.path);
-    push(names, name.toLowerCase(), file.path);
-    linksOut.set(file.path, file.links.map(link => linkAt(link.path, link)));
-    for (const link of file.links) push(linksIn, link.path, linkAt(file.path, link));
-  }
-  return Object.freeze({
-    commit: library.commit, mapping, files, paths: [...files.keys()], types, names, linksOut, linksIn,
-    problems: library.problems,
-  });
-}
-
-const digest = mapping => createHash('sha256').update(JSON.stringify(mapping)).digest('hex');
-
-// The index for one commit under one mapping, read once and kept in memory. A repeat call returns the same
-// object. Past CACHE_LIMIT entries the oldest goes. A failed read is not kept.
-export async function indexFor({ repo, commit, mapping }) {
-  if (!mapping || mapping.kind !== 'library') raise('library-mapping-invalid', 'expected a checked library mapping');
-  const key = JSON.stringify([repo, commit, digest(mapping)]);
-  if (cache.has(key)) {
-    const hit = cache.get(key);
-    cache.delete(key);
-    cache.set(key, hit);
-    return hit;
-  }
-  const pending = readLibrary({ repo, commit, mapping }).then(library => buildIndex(library, mapping));
-  cache.set(key, pending);
-  while (cache.size > CACHE_LIMIT) cache.delete(cache.keys().next().value);
-  try {
-    return await pending;
-  } catch (error) {
-    if (cache.get(key) === pending) cache.delete(key);
-    throw error;
-  }
-}
-
-export function clearIndexCache() {
-  cache.clear();
-}
-
-export function indexCacheSize() {
-  return cache.size;
-}

packages/library/src/index.mjs

@@ -2,12 +2,9 @@
 export { LibraryError, RULES, problem, sortProblems } from './problems.mjs';
 export { checkMapping, TYPES } from './mapping.mjs';
 export { classify } from './scope.mjs';
-export { supportingPath } from './supporting.mjs';
 export { extractLinks, parseWikilink, resolver, formOf, isAttachment } from './links.mjs';
 export { readLibrary, listTree, readTexts, parseFile, parseFrontMatter, headCommit, MAX_BLOB, LINK_FIELDS } from './reader.mjs';
 export { renderItems, KINDS, NOTICES, UNREADABLE } from './render.mjs';
 export { survey, formatSurvey, surveyMain } from './survey.mjs';
 export { SYNC_STATE_FILE, mirrorPath, ensureMirror, withLibraryLock, servedCommit, readSyncState, libraryStatus, readLibraryFile } from './mirror.mjs';
 export { syncCommand, sync, ASKPASS, SLOT, SYNC_INTERVAL_MS } from './sync.mjs';
-export { buildIndex, indexFor, clearIndexCache, indexCacheSize } from './index-build.mjs';
-export { sees, find, get, search, manuscript, universeInfo, QUERY_REPLY_CAP, LOOKUP_LIMIT, MANUSCRIPT_LINES } from './query.mjs';

packages/library/src/mapping.mjs

@@ -1,9 +1,8 @@
 // The library project entry of a business file (design 1.1): her folders mapped onto universes,
 // books, type folders, manuscript folders and playground prefixes at three levels (ruling after r11,
-// C2-01c): inside one of the entry's books, outside every book, or in a draft universe. Supporting
-// prefixes (C2-01d) follow the same rules and are where agents may write (M12). A pure validator.
-// Business file loading wires it in C2-04, which passes its own `fail` so the refusal reads as a
-// business file problem. Agents can't write this entry (M9, C2-04).
+// C2-01c): inside one of the entry's books, outside every book, or in a draft universe. A pure validator. Business file
+// loading wires it in C2-04, which passes its own `fail` so the refusal reads as a business file
+// problem. Agents can't write this entry (M9, C2-04).
 import { raise } from './problems.mjs';
 
 export const TYPES = Object.freeze(['character', 'place', 'research', 'tracker', 'summary']);
@@ -13,12 +12,6 @@ const BRANCH = /^[A-Za-z0-9][A-Za-z0-9._/-]{0,127}$/;
 const USER = /^[A-Za-z0-9_.-]{1,100}$/;
 const CONSTRAINT_KEYS = ['exclude', 'pin'];
 const KINDS = ['hybrid', 'draft'];
-// C2-01d (F41): the editor ident her Console saves commit under. Git drops `<` and `>` from an ident
-// and commits under a different name, so they refuse here (webby-0169 R1).
-const IDENT_BAD = /[\u0000-\u001f\u007f-\u009f<>]/;
-// Git's ident.c crud() strips any byte <= 0x20 and , : ; < > " \ ' from both ends of an ident, so a
-// value that starts or ends with one would save one name and commit another (sage-3601, sage-3606).
-const IDENT_CRUD_END = /^[\u0000-\u0020,:;<>"\\']|[\u0000-\u0020,:;<>"\\']$/;
 
 // A folder segment from her vault: spaces and capitals are fine, separators, control characters
 // and dot names are not.
@@ -47,7 +40,7 @@ export function checkMapping(entry, where = 'library', { fail = raise } = {}) {
   };
 
   object(entry, '');
-  only(entry, ['kind', 'remote', 'branch', 'user', 'vaultPrefix', 'editor', 'universes', 'types', 'manuscript'], 'entry');
+  only(entry, ['kind', 'remote', 'branch', 'user', 'vaultPrefix', 'universes', 'types', 'manuscript'], 'entry');
   if (entry.kind !== 'library') bad('kind must be "library"');
   let url;
   try { url = new URL(entry.remote); } catch { bad('remote must be an https:// URL'); }
@@ -59,20 +52,6 @@ export function checkMapping(entry, where = 'library', { fail = raise } = {}) {
   if (Object.hasOwn(entry, 'user') && (typeof entry.user !== 'string' || !USER.test(entry.user)))
     bad('user must be a plain account name');
   if (Object.hasOwn(entry, 'vaultPrefix') && !segment(entry.vaultPrefix)) bad('vaultPrefix must be one folder name');
-  if (Object.hasOwn(entry, 'editor')) {
-    object(entry.editor, 'editor');
-    only(entry.editor, ['name', 'email', 'user'], 'editor');
-    // Her Gitea login for the library-human slot, which C2-02 passes in (sage-2925). Optional here.
-    if (Object.hasOwn(entry.editor, 'user') && (typeof entry.editor.user !== 'string' || !USER.test(entry.editor.user)))
-      bad('editor.user must be a plain account name');
-    for (const key of ['name', 'email']) {
-      const value = entry.editor[key];
-      if (typeof value !== 'string' || !value.trim() || IDENT_BAD.test(value))
-        bad(`editor.${key} must be non-empty text with no control character, < or >`);
-      if (value.trim() !== value || IDENT_CRUD_END.test(value))
-        bad(`editor.${key} must not start or end with whitespace or any of , : ; " ' \\`);
-    }
-  }
 
   object(entry.types, 'types');
   for (const [name, type] of Object.entries(entry.types)) {
@@ -85,7 +64,6 @@ export function checkMapping(entry, where = 'library', { fail = raise } = {}) {
   object(entry.universes, 'universes');
   if (!Object.keys(entry.universes).length) bad('universes must name at least one universe');
   const universes = {}, bookOwner = new Map(), prefixes = [], prefixOwner = new Map();
-  const supports = [], supportOwner = new Map();
   for (const [id, universe] of Object.entries(entry.universes)) {
     const name = `universes.${id}`;
     if (!ID.test(id)) bad(`universe id ${JSON.stringify(id)} is not a plain id`);
@@ -93,8 +71,8 @@ export function checkMapping(entry, where = 'library', { fail = raise } = {}) {
     if (Object.hasOwn(universe, 'kind') && !KINDS.includes(universe.kind)) bad(`${name}.kind must be "hybrid" or "draft"`);
     const hybrid = universe.kind === 'hybrid', draft = universe.kind === 'draft';
     if (draft && Object.hasOwn(universe, 'books')) bad(`${name} is a draft and takes no books`);
-    only(universe, hybrid ? ['kind', 'name', 'sources', 'books', 'playground', 'supporting', 'constraints', 'notes']
-      : draft ? ['kind', 'name', 'playground', 'supporting'] : ['name', 'books', 'playground', 'supporting'], name);
+    only(universe, hybrid ? ['kind', 'name', 'sources', 'books', 'playground', 'constraints', 'notes']
+      : draft ? ['kind', 'name', 'playground'] : ['name', 'books', 'playground'], name);
     if (typeof universe.name !== 'string' || !universe.name.trim() || universe.name.length > 128 || /[\u0000-\u001f]/.test(universe.name))
       bad(`${name}.name must be a short display name`);
     const books = draft ? [] : list(universe.books, `${name}.books`, folder, 'a folder path');
@@ -103,14 +81,12 @@ export function checkMapping(entry, where = 'library', { fail = raise } = {}) {
       if (bookOwner.has(book)) bad(`book folder ${JSON.stringify(book)} is in two universes`);
       bookOwner.set(book, id);
     }
-    const prefix = value => typeof value === 'string' && value.endsWith('/') && folder(value.slice(0, -1));
-    const playground = list(universe.playground ?? [], `${name}.playground`, prefix, 'a folder path ending in /');
+    const playground = list(universe.playground ?? [], `${name}.playground`,
+      value => typeof value === 'string' && value.endsWith('/') && folder(value.slice(0, -1)), 'a folder path ending in /');
     if (draft && !playground.length) bad(`${name}.playground must name at least one prefix`);
-    for (const p of playground) { prefixes.push(p); prefixOwner.set(p, id); }
-    const supporting = list(universe.supporting ?? [], `${name}.supporting`, prefix, 'a folder path ending in /');
-    for (const p of supporting) { supports.push(p); supportOwner.set(p, id); }
-    if (draft) { universes[id] = { kind: 'draft', name: universe.name, books, playground, supporting }; continue; }
-    const out = { name: universe.name, books, playground, supporting };
+    for (const prefix of playground) { prefixes.push(prefix); prefixOwner.set(prefix, id); }
+    if (draft) { universes[id] = { kind: 'draft', name: universe.name, books, playground }; continue; }
+    const out = { name: universe.name, books, playground };
     if (hybrid) {
       out.kind = 'hybrid';
       out.sources = list(universe.sources, `${name}.sources`, value => typeof value === 'string' && ID.test(value), 'a universe id');
@@ -148,36 +124,18 @@ export function checkMapping(entry, where = 'library', { fail = raise } = {}) {
   for (const a of books) for (const b of books) if (a !== b && holds(a, b)) bad(`book folder ${JSON.stringify(a)} holds book folder ${JSON.stringify(b)}`);
   for (const a of prefixes) for (const b of prefixes) if (a !== b && holds(a, b)) bad(`playground ${JSON.stringify(a)} holds playground ${JSON.stringify(b)}`);
   if (new Set(prefixes).size !== prefixes.length) bad('a playground prefix is listed twice');
-  for (const a of supports) for (const b of supports) if (a !== b && holds(a, b)) bad(`supporting ${JSON.stringify(a)} holds supporting ${JSON.stringify(b)}`);
-  if (new Set(supports).size !== supports.length) bad('a supporting prefix is listed twice');
   // A prefix's level comes from where it sits (ruling after r11). Inside one of its own entry's books
   // is book level, outside every book is universe level, and a draft's prefixes are all outside. Scope
   // checks prefixes first (scope.mjs), so a prefix equal to or holding a book would turn that book
-  // into playground or supporting.
-  const againstBooks = (owners, list, code) => {
-    for (const [prefix, id] of owners) {
-      for (const [book, owner] of bookOwner) {
-        const at = `universes.${id}.${list} ${JSON.stringify(prefix)}`;
-        if (prefix === `${book}/`) bad(`${at} is the whole book folder ${JSON.stringify(book)}`);
-        const inside = holds(book, prefix), holding = holds(prefix, book);
-        if ((inside || holding) && owner !== id)
-          fail(code, `${where} ${at} ${inside ? 'lies inside' : 'holds'} book folder ${JSON.stringify(book)} of universes.${owner}`);
-        if (holding) bad(`${at} holds its own book folder ${JSON.stringify(book)}`);
-      }
-    }
-  };
-  againstBooks(prefixOwner, 'playground', 'library-playground-other-universe');
-  againstBooks(supportOwner, 'supporting', 'library-supporting-other-universe');
-  // C2-01d, between the lists. A supporting prefix may equal a playground prefix of its own entry, and
-  // a playground may hold one of its own entry's supporting prefixes. A supporting prefix that holds a
-  // playground would hide it, since scope checks supporting first. Any overlap across entries would
-  // give one path two universes.
-  for (const [s, sid] of supportOwner) {
-    for (const [p, pid] of prefixOwner) {
-      const at = `universes.${sid}.supporting ${JSON.stringify(s)}`;
-      if (sid !== pid && (s === p || holds(s, p) || holds(p, s)))
-        bad(`${at} overlaps playground ${JSON.stringify(p)} of universes.${pid}`);
-      if (sid === pid && s !== p && holds(s, p)) bad(`${at} holds playground ${JSON.stringify(p)}`);
+  // into playground.
+  for (const [prefix, id] of prefixOwner) {
+    for (const [book, owner] of bookOwner) {
+      const at = `universes.${id}.playground ${JSON.stringify(prefix)}`;
+      if (prefix === `${book}/`) bad(`${at} is the whole book folder ${JSON.stringify(book)}`);
+      const inside = holds(book, prefix), holding = holds(prefix, book);
+      if ((inside || holding) && owner !== id)
+        fail('library-playground-other-universe', `${where} ${at} ${inside ? 'lies inside' : 'holds'} book folder ${JSON.stringify(book)} of universes.${owner}`);
+      if (holding) bad(`${at} holds its own book folder ${JSON.stringify(book)}`);
     }
   }
 
@@ -185,8 +143,6 @@ export function checkMapping(entry, where = 'library', { fail = raise } = {}) {
     kind: 'library', remote: entry.remote, branch: entry.branch,
     ...(Object.hasOwn(entry, 'user') ? { user: entry.user } : {}),
     ...(Object.hasOwn(entry, 'vaultPrefix') ? { vaultPrefix: entry.vaultPrefix } : {}),
-    ...(Object.hasOwn(entry, 'editor') ? { editor: { name: entry.editor.name, email: entry.editor.email,
-      ...(Object.hasOwn(entry.editor, 'user') ? { user: entry.editor.user } : {}) } } : {}),
     universes, types: { ...entry.types }, manuscript,
   });
 }

packages/library/src/query.mjs

@@ -1,250 +0,0 @@
-// The lookup queries of design 3 (C2-05a): find, get, search, manuscript and universeInfo. Each takes a
-// source {repo, commit, mapping} and an argument object, and returns a reply that fits QUERY_REPLY_CAP.
-// Universe isolation is here, in sees(): a file reaches a reply only when sees() allows it. Scope comes
-// from the path (D2). Unmapped files are not in the index, so they never appear. Lists page by position
-// and never cut an item. A search line too long to fit alone comes back as a marked hit with no excerpt;
-// a find item, a file's front matter or one of its lines that cannot fit alone is refused.
-import { raise } from './problems.mjs';
-import { TYPES } from './mapping.mjs';
-import { indexFor } from './index-build.mjs';
-import { listTree } from './reader.mjs';
-
-// The same cap as packages/harness/src/tools.mjs REPLY_CAP. The query tests assert the two stay equal.
-export const QUERY_REPLY_CAP = 40_000;
-export const LOOKUP_LIMIT = 50;
-export const MANUSCRIPT_LINES = 400;
-const SCOPES = Object.freeze(['canon', 'playground', 'supporting']);
-const MANUSCRIPT_SCOPES = Object.freeze(['canon', 'playground']);
-const SCOPE_RANK = Object.freeze({ supporting: 0, playground: 1, canon: 2 });
-
-const bytes = value => JSON.stringify(value).length;
-const invalid = message => raise('query-argument-invalid', message);
-const inside = (folder, path) => path.startsWith(folder.endsWith('/') ? folder : `${folder}/`);
-
-function textArg(value, name) {
-  if (typeof value !== 'string') invalid(`${name} must be text`);
-  return value;
-}
-function scopeArg(value, allowed = SCOPES) {
-  if (value === undefined) return 'canon';
-  if (!allowed.includes(value)) invalid(`scope must be one of ${allowed.join(", ")}`);
-  return value;
-}
-function positionArg(value, name, fallback) {
-  if (value === undefined) return fallback;
-  if (!Number.isSafeInteger(value) || value < 1) invalid(`${name} must be a line number of 1 or more`);
-  return value;
-}
-function offsetArg(value) {
-  if (value === undefined) return 0;
-  if (!Number.isSafeInteger(value) || value < 0) invalid('offset must be a whole number of 0 or more');
-  return value;
-}
-function universeArg(mapping, value) {
-  if (typeof value !== 'string' || !value) invalid('universe is required');
-  if (!Object.hasOwn(mapping.universes, value)) raise('query-universe-unknown', `this library has no universe ${JSON.stringify(value)}`);
-  return value;
-}
-
-// Whether universe U may see a file. Its own files, in either scope. A hybrid also sees the canon of
-// its declared sources, minus the folders its exclude constraints name. A hybrid never sees a source's
-// playground. Pin constraints do not hide anything; they are reported by universeInfo only.
-export function sees(mapping, universe, file) {
-  if (file.universe === universe) return true;
-  const entry = mapping.universes[universe];
-  if (entry.kind !== 'hybrid' || !entry.sources.includes(file.universe) || file.scope !== 'canon') return false;
-  return !entry.constraints.some(c => c.exclude !== undefined && inside(c.exclude, file.path));
-}
-
-// The files one universe may see in one scope, with optional book and type filters, in path order.
-async function visible(source, universe, { scope, book, type }) {
-  const index = await indexFor(source);
-  const files = index.paths
-    .map(path => index.files.get(path))
-    .filter(file => file.scope === scope && sees(index.mapping, universe, file)
-      && (book === undefined || file.book === book) && (type === undefined || file.type === type));
-  return { index, files };
-}
-
-// A reply whose size is over the cap is refused, never cut.
-function checked(reply) {
-  if (bytes(reply) > QUERY_REPLY_CAP) raise('query-item-too-large', `the reply is over the ${QUERY_REPLY_CAP}-character cap`);
-  return reply;
-}
-
-// Picks items from `offset`, at most `limit`, while the reply still fits. build(picked, next) returns
-// the reply; `next` is the position of the first item not picked, or null when none is left. An item
-// that cannot fit even alone is refused: skipping it would hide it, and cutting it would break it.
-function fitPage(items, { offset = 0, limit = LOOKUP_LIMIT, build }) {
-  const picked = [];
-  let at = offset;
-  while (at < items.length && picked.length < limit) {
-    // The size check uses items.length for `next`, the widest number a cursor can take, so a page never runs over.
-    if (bytes(build([...picked, items[at]], items.length)) > QUERY_REPLY_CAP) {
-      if (!picked.length) raise('query-item-too-large', `the item at position ${at} alone is over the ${QUERY_REPLY_CAP}-character cap`);
-      break;
-    }
-    picked.push(items[at]);
-    at += 1;
-  }
-  return checked(build(picked, at < items.length ? at : null));
-}
-
-// find: the files whose name or file name holds `query`, case-insensitive. Up to 50 per page.
-export async function find(source, { universe: name, query, type, book, scope, offset } = {}) {
-  const universe = universeArg(source.mapping, name);
-  const needle = textArg(query, 'query').toLowerCase();
-  if (type !== undefined && !TYPES.includes(type)) invalid(`type must be one of ${TYPES.join(', ')}`);
-  const { index, files } = await visible(source, universe, {
-    scope: scopeArg(scope), book: book === undefined ? undefined : textArg(book, 'book'), type,
-  });
-  const hits = files.filter(file => file.name.toLowerCase().includes(needle) || file.stem.toLowerCase().includes(needle));
-  return fitPage(hits, {
-    offset: offsetArg(offset),
-    build: (picked, next) => ({
-      commit: index.commit,
-      results: picked.map(file => ({
-        path: file.path, type: file.type, name: file.name, appears_in: file.frontmatter?.appears_in ?? null,
-        scope: file.scope, universe: file.universe, book: file.book,
-      })),
-      next,
-    }),
-  });
-}
-
-// get: one file in the requested scope (canon default), its served-tree blob, front matter,
-// lines and visible links both ways. Links keep all visible scopes, ordered supporting/playground/canon.
-// Returns null when the file is missing or not visible, so a caller cannot tell the two apart. Lines page
-// by `from` (reply `next`), links page together by `links_from` (reply `links_next`); `links_out` come
-// before `links_in`. Every page carries the front matter. Links take at most half the cap, so a hub note
-// with many backlinks stays readable and still leaves room for lines. A page with lines left carries at
-// least one line, so links shrink when a line needs the room; read on with `from: next` and
-// `links_from: links_next`. A `from` past the last line returns links alone. Only front matter, or a
-// line that cannot fit with no links beside it, is refused.
-export async function get(source, { universe: name, path, scope, from, links_from: linksFrom } = {}) {
-  const universe = universeArg(source.mapping, name);
-  const requestedScope = scopeArg(scope);
-  const startLine = positionArg(from, 'from', 1);
-  const linkStart = offsetArg(linksFrom);
-  if (typeof path !== 'string') invalid('path must be text');
-  const index = await indexFor(source);
-  const file = index.files.get(path);
-  if (!file || file.scope !== requestedScope || !sees(index.mapping, universe, file)) return null;
-  const reachable = links => links.filter(link => {
-    const other = index.files.get(link.path);
-    return other !== undefined && sees(index.mapping, universe, other);
-  }).sort((a, b) => SCOPE_RANK[index.files.get(a.path).scope] - SCOPE_RANK[index.files.get(b.path).scope]);
-  const outs = reachable(index.linksOut.get(file.path) ?? []);
-  const ins = reachable(index.linksIn.get(file.path) ?? []);
-  const links = [...outs.map(link => ({ out: true, link })), ...ins.map(link => ({ out: false, link }))];
-  // The reader/index does not keep tree oids. Resolve only in this immutable served
-  // snapshot, never HEAD; listTree already checks/bounds the tree and its object IDs.
-  const entry = (await listTree(source.repo, index.commit)).find(entry => entry.path === file.path);
-  if (!entry || entry.mode !== '100644' || entry.type !== 'blob') raise('library-commit', 'indexed file is absent from the served tree');
-  const blob = entry.oid;
-  const lines = file.lines.slice(startLine - 1);
-  const linkRest = Math.max(0, links.length - linkStart);
-  const page = (nLines, nLinks) => {
-    const taken = links.slice(linkStart, linkStart + nLinks);
-    return {
-      path: file.path, commit: index.commit, blob, scope: file.scope, frontmatter: file.frontmatter,
-      lines: lines.slice(0, nLines),
-      links_out: taken.filter(item => item.out).map(item => item.link),
-      links_in: taken.filter(item => !item.out).map(item => item.link),
-      next: nLines < lines.length ? startLine + nLines : null,
-      links_next: nLinks < linkRest ? linkStart + nLinks : null,
-    };
-  };
-  // How many leading items fit in `room`, by each item's own size.
-  const count = (items, room) => {
-    let used = 0, n = 0;
-    while (n < items.length && used + bytes(items[n]) + 1 <= room) used += bytes(items[n++]) + 1;
-    return n;
-  };
-  const base = bytes(page(0, 0));
-  if (base > QUERY_REPLY_CAP) raise('query-item-too-large', `the front matter of ${file.path} alone is over the ${QUERY_REPLY_CAP}-character cap`);
-  if (lines.length && bytes(page(1, 0)) > QUERY_REPLY_CAP) {
-    raise('query-item-too-large', `line ${lines[0][0]} of ${file.path} alone is over the ${QUERY_REPLY_CAP}-character cap`);
-  }
-  const rest = links.slice(linkStart);
-  let nLinks = count(rest, (lines.length ? Math.floor(QUERY_REPLY_CAP / 2) : QUERY_REPLY_CAP) - base);
-  if (!nLinks && rest.length) nLinks = count(rest, QUERY_REPLY_CAP - base);
-  if (!nLinks && rest.length) raise('query-item-too-large', `a link of ${file.path} alone is over the ${QUERY_REPLY_CAP}-character cap`);
-  while (lines.length && nLinks > 0 && bytes(page(1, nLinks)) > QUERY_REPLY_CAP) nLinks = Math.floor(nLinks / 2);
-  let nLines = Math.max(lines.length ? 1 : 0, count(lines, QUERY_REPLY_CAP - bytes(page(0, nLinks))));
-  while (nLines > 1 && bytes(page(nLines, nLinks)) > QUERY_REPLY_CAP) nLines -= 1;
-  return checked(page(nLines, nLinks));
-}
-
-// search: lines whose text holds `text`, case-insensitive. The excerpt is the whole line. Up to 50 per page.
-export async function search(source, { universe: name, text, book, scope, offset } = {}) {
-  const universe = universeArg(source.mapping, name);
-  const needle = textArg(text, 'text').toLowerCase();
-  if (!needle) invalid('text must not be empty');
-  const { index, files } = await visible(source, universe, {
-    scope: scopeArg(scope), book: book === undefined ? undefined : textArg(book, 'book'),
-  });
-  const hits = [];
-  for (const file of files) {
-    for (const [line, body] of file.lines) {
-      if (!body.toLowerCase().includes(needle)) continue;
-      const hit = { path: file.path, line, excerpt: body, scope: file.scope };
-      // The excerpt is the whole line. A line too long to fit alone is marked, not cut and not refused.
-      hits.push(bytes({ commit: index.commit, results: [hit], next: Number.MAX_SAFE_INTEGER }) > QUERY_REPLY_CAP
-        ? { path: file.path, line, excerpt: null, excerpt_too_long: true, scope: file.scope } : hit);
-    }
-  }
-  return fitPage(hits, {
-    offset: offsetArg(offset),
-    build: (picked, next) => ({ commit: index.commit, results: picked, next }),
-  });
-}
-
-// manuscript: one chapter file of a book, by its file name, up to 400 lines per call from `from` to `to`.
-// Without a chapter it returns the book's first chapter file in path order. Every reply carries
-// `next_chapter`, the next chapter file's name in path order or null. A name that matches two visible
-// files is refused. Files outside every book (book null) are never chapters of a book.
-export async function manuscript(source, { universe: name, book, scope, chapter, from, to } = {}) {
-  const universe = universeArg(source.mapping, name);
-  const bookName = textArg(book, 'book');
-  const chapterName = chapter === undefined ? undefined : textArg(chapter, 'chapter');
-  const start = positionArg(from, 'from', 1);
-  const end = positionArg(to, 'to', Infinity);
-  if (end < start) invalid('to must not be before from');
-  const { index, files } = await visible(source, universe, { scope: scopeArg(scope, MANUSCRIPT_SCOPES), book: bookName, type: 'manuscript' });
-  let at = 0;
-  if (chapterName !== undefined) {
-    const matches = files.filter(file => file.stem === chapterName);
-    if (matches.length > 1) raise('query-chapter-ambiguous', `${matches.length} visible files are named ${JSON.stringify(chapterName)}`);
-    if (!matches.length) return null;
-    at = files.indexOf(matches[0]);
-  }
-  const file = files[at];
-  if (!file) return null;
-  const nextChapter = files[at + 1]?.stem ?? null;
-  return fitPage(file.lines.slice(start - 1, end), {
-    limit: MANUSCRIPT_LINES,
-    build: (picked, next) => ({
-      path: file.path, commit: index.commit, scope: file.scope, lines: picked,
-      next: next === null ? null : start + next, next_chapter: nextChapter,
-    }),
-  });
-}
-
-// universeInfo: a universe's kind, name, books, playground prefixes, type folders and manuscript folders.
-// A hybrid adds its sources, constraints and notes. A draft has no books and no canon: its kind, name
-// and prefixes are the whole answer beside the mapping's types. It reads only the checked mapping and the
-// served commit.
-export async function universeInfo(source, { universe: name } = {}) {
-  const universe = universeArg(source.mapping, name);
-  const entry = source.mapping.universes[universe];
-  const hybrid = entry.kind === 'hybrid';
-  return checked({
-    commit: source.commit, universe, name: entry.name, kind: entry.kind ?? 'universe',
-    books: entry.books, playground: entry.playground, types: source.mapping.types, manuscript: source.mapping.manuscript,
-    ...(hybrid ? {
-      sources: entry.sources, constraints: entry.constraints,
-      ...(entry.notes === undefined ? {} : { notes: entry.notes }),
-    } : {}),
-  });
-}

packages/library/src/scope.mjs

@@ -2,22 +2,16 @@
 // Paths are repo-relative and compared exactly, case included (R7 handles case-only twins).
 const inside = (folder, path) => path.startsWith(folder.endsWith('/') ? folder : `${folder}/`);
 
-// { scope: 'supporting' | 'playground' | 'canon', universe, book, type, folder } or { scope: 'unmapped' }.
-// Prefixes come first (ruling after r11, C2-01c), supporting before playground (C2-01d, design 1.2):
-// a `.md` file under any entry's supporting prefix is supporting, and otherwise one under a playground
-// prefix is playground. Either way `universe` is that entry and `book` is the book folder that holds
-// the prefix, or null at universe level and in a draft. Otherwise a `.md` file in a book folder is
-// canon. `type` is the mapped type of the first folder under the prefix or under the book (canon),
+// { scope: 'playground' | 'canon', universe, book, type, folder } or { scope: 'unmapped' }.
+// Prefixes come first (ruling after r11, C2-01c): a `.md` file under any entry's playground prefix is
+// playground, with that entry as `universe` and the book folder that holds the prefix as `book`, or
+// null at universe level and in a draft. Otherwise a `.md` file in a book folder is canon. `type` is
+// the mapped type of the first folder under the prefix (playground) or under the book (canon),
 // 'manuscript' for a manuscript folder, else null. `folder` is that folder name. checkMapping keeps
-// prefixes of one list from overlapping, and keeps a supporting prefix from holding a playground
-// prefix, so the first match is the only one that counts.
+// prefixes from overlapping, so at most one matches.
 export function classify(mapping, path) {
   if (typeof path !== 'string' || !path.endsWith('.md')) return { scope: 'unmapped' };
   const entries = Object.entries(mapping.universes);
-  for (const [universe, entry] of entries) {
-    const prefix = entry.supporting.find(p => inside(p, path));
-    if (prefix) return place(mapping, path, prefix, { scope: 'supporting', universe, book: entry.books.find(b => inside(b, prefix)) ?? null });
-  }
   for (const [universe, entry] of entries) {
     const prefix = entry.playground.find(p => inside(p, path));
     if (prefix) return place(mapping, path, prefix, { scope: 'playground', universe, book: entry.books.find(b => inside(b, prefix)) ?? null });

packages/library/src/supporting.mjs

@@ -1,49 +0,0 @@
-// C2-01d (M12): the paths an agent may write. A path passes only under a supporting prefix of the
-// named universe, and only if nothing in the tree could turn the write into something else: a
-// symlink or gitlink on the way, or a name that differs from a tree name only in case or Unicode
-// form (APFS folds both, so her checkout would put the file somewhere else). Pure; reads no git.
-import { LibraryError } from './problems.mjs';
-import { classify } from './scope.mjs';
-
-const CONTROL = /[\u0000-\u001f\u007f-\u009f]/;
-const MAX_BYTES = 1024;
-const LINKS = new Set(['120000', '160000']);
-const fold = name => name.normalize('NFC').toLowerCase();
-
-// `tree` is the array listTree returns ({ mode, type, oid, size, path }). Returns `path` or throws
-// library-write-story-path naming the class. Checks run in a fixed order, so a path with two faults
-// always names the same one.
-export function supportingPath(mapping, universe, path, tree) {
-  if (!Array.isArray(tree)) throw new TypeError('supportingPath needs the listTree array');
-  const refuse = message => { throw new LibraryError('library-write-story-path', message); };
-  if (typeof path !== 'string') refuse('the path must be a string');
-  const at = JSON.stringify(path);
-  if (Buffer.byteLength(path, 'utf8') > MAX_BYTES) refuse(`${at} is longer than ${MAX_BYTES} bytes`);
-  if (CONTROL.test(path)) refuse('the path holds a control character');
-  if (path.includes('\\')) refuse(`${at} holds a backslash`);
-  if (path.startsWith('/')) refuse(`${at} is absolute`);
-  const parts = path.split('/');
-  if (parts.some(part => part === '' || part === '.' || part === '..')) refuse(`${at} has an empty, . or .. segment`);
-  const place = classify(mapping, path);
-  if (place.scope !== 'supporting' || place.universe !== universe)
-    refuse(`${at} is not under a supporting folder of universe ${JSON.stringify(universe)}`);
-  const own = parts.map((_, i) => parts.slice(0, i + 1).join('/'));
-  const modes = new Map(tree.map(entry => [entry.path, entry.mode]));
-  for (const p of own) if (LINKS.has(modes.get(p))) refuse(`${at} goes through the symlink or gitlink ${JSON.stringify(p)}`);
-  const names = new Map();
-  for (const entry of tree) {
-    const segs = entry.path.split('/');
-    for (let i = 1; i <= segs.length; i++) {
-      const name = segs.slice(0, i).join('/');
-      const key = fold(name);
-      if (!names.has(key)) names.set(key, new Set());
-      names.get(key).add(name);
-    }
-  }
-  for (const p of own) {
-    const seen = names.get(fold(p));
-    if (seen && [...seen].some(name => name !== p))
-      refuse(`${at} differs only in case or Unicode form from ${JSON.stringify([...seen].find(name => name !== p))}`);
-  }
-  return path;
-}

packages/library/src/survey.mjs

@@ -62,7 +62,7 @@ export async function survey({ repo, commit, mapping }) {
     forms, attachments, fields,
   };
   if (mapping) {
-    const scopes = { canon: 0, playground: 0, supporting: 0, unmapped: 0 };
+    const scopes = { canon: 0, playground: 0, unmapped: 0 };
     for (const entry of entries) scopes[classify(mapping, entry.path).scope]++;
     const library = await readLibrary({ repo, commit: head, mapping });
     const steps = Object.fromEntries(STEPS.map(s => [s, 0]));
@@ -89,7 +89,7 @@ export function formatSurvey(s) {
   out.push(`body links ${FORMS.map(f => `${f} ${s.forms[f]}`).join(', ')}; attachment ${s.attachments}`);
   for (const [field, c] of Object.entries(s.fields)) out.push(`field ${field} wikilink ${c.wikilink}, name ${c.name}`);
   if (s.scopes) {
-    out.push(`scopes canon ${s.scopes.canon}, playground ${s.scopes.playground}, supporting ${s.scopes.supporting}, unmapped ${s.scopes.unmapped}; indexed ${s.indexed}`);
+    out.push(`scopes canon ${s.scopes.canon}, playground ${s.scopes.playground}, unmapped ${s.scopes.unmapped}; indexed ${s.indexed}`);
     out.push(`resolved ${STEPS.map(st => `${st} ${s.steps[st]}`).join(', ')}, unresolved ${s.steps.unresolved}`);
     out.push(`problems ${Object.entries(s.problems).map(([code, n]) => `${code} ${n}`).join(', ')}`);
   }

packages/library/tests/index-build.test.mjs

@@ -1,91 +0,0 @@
-// Index tests (C2-05a): the cache key and its bound, failed reads, mapped-only contents, and the rebuild
-// time on a 3,000-file fixture. Fixtures are made up and built under the scratch area.
-import { test } from 'node:test';
-import assert from 'node:assert/strict';
-import { symlinkSync, writeFileSync } from 'node:fs';
-import { join } from 'node:path';
-import { performance } from 'node:perf_hooks';
-import { clearIndexCache, indexCacheSize, indexFor } from '../src/index-build.mjs';
-import { git, mapping, MARKER } from './helpers.mjs';
-import { note, scratchRepo } from './query-fixture.mjs';
-
-const FILES = {
-  'Book One/Characters/Mara Vell.md': note('character', 'Mara Vell', MARKER),
-  'Book One/Chapters/Chapter 01.md': '# One\n[[Mara Vell]]\n',
-  'Inbox Note.md': `${MARKER}\n`,
-};
-
-// A mapping whose harbor universe has the given display name. Each name gives a new cache key.
-const named = name => mapping(e => ({ ...e, universes: { ...e.universes, harbor: { ...e.universes.harbor, name } } }));
-
-test('the same commit, repo path and mapping return the same index, and only mapped files are in it', async t => {
-  clearIndexCache();
-  const { repo, commit } = scratchRepo(t, FILES);
-  const a = await indexFor({ repo, commit, mapping: mapping() });
-  const b = await indexFor({ repo, commit, mapping: mapping() });
-  assert.equal(a, b);
-  assert.equal(indexCacheSize(), 1);
-  assert.equal(a.commit, commit);
-  assert.ok(a.files.has('Book One/Characters/Mara Vell.md'));
-  assert.ok(!a.files.has('Inbox Note.md'));
-  assert.deepEqual(a.names.get('mara vell'), ['Book One/Characters/Mara Vell.md']);
-  assert.deepEqual(a.linksIn.get('Book One/Characters/Mara Vell.md').map(l => l.path), ['Book One/Chapters/Chapter 01.md']);
-});
-
-test('a different repo path, mapping or commit gets its own index', async t => {
-  clearIndexCache();
-  const { root, repo, commit } = scratchRepo(t, FILES);
-  const base = await indexFor({ repo, commit, mapping: mapping() });
-  const alias = join(root, 'alias');
-  symlinkSync(repo, alias);
-  assert.notEqual(await indexFor({ repo: alias, commit, mapping: mapping() }), base);
-  assert.notEqual(await indexFor({ repo, commit, mapping: named('Renamed Harbor') }), base);
-  writeFileSync(join(repo, 'Book One/Places/New.md'), note('place', 'New'));
-  git(repo, 'add', '-A');
-  git(repo, 'commit', '-qm', 'second');
-  const next = git(repo, 'rev-parse', 'HEAD');
-  const later = await indexFor({ repo, commit: next, mapping: mapping() });
-  assert.notEqual(later, base);
-  assert.equal(later.commit, next);
-  assert.ok(later.files.has('Book One/Places/New.md'));
-});
-
-test('the cache holds at most eight indexes and evicts the least recently used', async t => {
-  clearIndexCache();
-  const { repo, commit } = scratchRepo(t, FILES);
-  const maps = Array.from({ length: 9 }, (_, i) => named(`Harbor ${i}`));
-  const first = await indexFor({ repo, commit, mapping: maps[0] });
-  for (const m of maps.slice(1)) await indexFor({ repo, commit, mapping: m });
-  assert.equal(indexCacheSize(), 8);
-  assert.notEqual(await indexFor({ repo, commit, mapping: maps[0] }), first);
-  assert.equal(indexCacheSize(), 8);
-});
-
-test('a failed read is not kept in the cache', async t => {
-  clearIndexCache();
-  const { repo } = scratchRepo(t, FILES);
-  await assert.rejects(indexFor({ repo, commit: '0'.repeat(40), mapping: mapping() }));
-  assert.equal(indexCacheSize(), 0);
-});
-
-test('a missing or unchecked mapping is refused before any read', async t => {
-  clearIndexCache();
-  const { repo, commit } = scratchRepo(t, FILES);
-  await assert.rejects(indexFor({ repo, commit, mapping: undefined }), { code: 'library-mapping-invalid' });
-  await assert.rejects(indexFor({ repo, commit, mapping: { kind: 'hybrid' } }), { code: 'library-mapping-invalid' });
-});
-
-test('a 3,000-file rebuild completes and its time is reported', { timeout: 300_000 }, async t => {
-  clearIndexCache();
-  const folders = ['Characters', 'Places', 'Research'];
-  const files = {};
-  for (let i = 0; i < 3000; i++) {
-    files[`Book One/${folders[i % 3]}/Note ${i}.md`] = note('character', `Note ${i}`, `Body ${i} [[Note ${(i + 1) % 3000}]]`);
-  }
-  const { repo, commit } = scratchRepo(t, files);
-  const started = performance.now();
-  const index = await indexFor({ repo, commit, mapping: mapping() });
-  const ms = performance.now() - started;
-  t.diagnostic(`3,000-file index rebuild: ${ms.toFixed(0)} ms`);
-  assert.equal(index.paths.length, 3000);
-});

packages/library/tests/mapping.test.mjs

@@ -1,9 +1,5 @@
 import test from 'node:test';
 import assert from 'node:assert/strict';
-import { execFileSync } from 'node:child_process';
-import { mkdtempSync, rmSync } from 'node:fs';
-import { tmpdir } from 'node:os';
-import { join } from 'node:path';
 import { checkMapping, classify, LibraryError } from '../src/index.mjs';
 import { mapping, mappingEntry } from './helpers.mjs';
 
@@ -49,7 +45,7 @@ test('C2-01c: universe-level prefixes lie outside every book, in a plain univers
 
 test('C2-01c: a draft takes kind, name and playground only, and comes back frozen with books []', () => {
   const m = mapping(e => { e.universes.idea = draft(); return e; });
-  assert.deepEqual(m.universes.idea, { kind: 'draft', name: 'New World', books: [], playground: ['Drafts/New World/'], supporting: [] });
+  assert.deepEqual(m.universes.idea, { kind: 'draft', name: 'New World', books: [], playground: ['Drafts/New World/'] });
   assert.ok(Object.isFrozen(m.universes.idea) && Object.isFrozen(m.universes.idea.books) && Object.isFrozen(m.universes.idea.playground));
   refuses(e => { e.universes.idea = { ...draft(), books: ['New World'] }; return e; }, 'library-mapping-invalid', /universes.idea is a draft and takes no books/);
   refuses(e => { e.universes.idea = { ...draft(), books: [] }; return e; }, 'library-mapping-invalid', /takes no books/);
@@ -60,107 +56,6 @@ test('C2-01c: a draft takes kind, name and playground only, and comes back froze
     refuses(e => { e.universes.harbor.kind = kind; return e; }, 'library-mapping-invalid', /universes.harbor.kind must be "hybrid" or "draft"/);
 });
 
-test('C2-01d: supporting prefixes at book level, universe level, in a hybrid and in a draft, [] when absent', () => {
-  const m = mapping(e => {
-    e.universes.harbor.supporting = ['Book One/Notes/', 'Harbor Notes/'];
-    e.universes.cross = { kind: 'hybrid', name: 'Cross', sources: ['harbor', 'second'], books: [], supporting: ['Crossover Notes/'] };
-    e.universes.idea = { ...draft(), supporting: ['Drafts/New World Notes/'] };
-    return e;
-  });
-  assert.deepEqual(m.universes.harbor.supporting, ['Book One/Notes/', 'Harbor Notes/']);
-  assert.deepEqual(m.universes.cross.supporting, ['Crossover Notes/']);
-  assert.deepEqual(m.universes.idea.supporting, ['Drafts/New World Notes/']);
-  assert.deepEqual(m.universes.second.supporting, []);
-  assert.ok(Object.isFrozen(m.universes.harbor.supporting) && Object.isFrozen(m.universes.second.supporting));
-  assert.deepEqual(mapping().universes.harbor.supporting, []);
-});
-
-test('C2-01d: each supporting prefix rule refuses with its code', () => {
-  const invalid = (change, pattern) => refuses(change, 'library-mapping-invalid', pattern);
-  invalid(e => { e.universes.harbor.supporting = ['Book One/Notes']; return e; }, /universes.harbor.supporting holds "Book One\/Notes", which is not a folder path ending in \//);
-  invalid(e => { e.universes.harbor.supporting = ['Book One/../Notes/']; return e; }, /which is not a folder path ending in \//);
-  invalid(e => { e.universes.harbor.supporting = 'Book One/Notes/'; return e; }, /universes.harbor.supporting must be a list/);
-  invalid(e => { e.universes.harbor.supporting = ['Book One/Notes/', 'Book One/Notes/Deep/']; return e; },
-    /supporting "Book One\/Notes\/" holds supporting "Book One\/Notes\/Deep\/"/);
-  invalid(e => { e.universes.harbor.supporting = ['Ideas/']; e.universes.idea = { ...draft(), supporting: ['Ideas/'] }; return e; },
-    /a supporting prefix is listed twice/);
-  invalid(e => { e.universes.harbor.supporting = ['Book One/']; return e; }, /universes.harbor.supporting "Book One\/" is the whole book folder "Book One"/);
-  invalid(e => { e.universes.harbor.books = ['Shelf/Book One']; e.universes.harbor.playground = []; e.universes.harbor.supporting = ['Shelf/']; return e; },
-    /universes.harbor.supporting "Shelf\/" holds its own book folder "Shelf\/Book One"/);
-  // Supporting is checked first in scope, so a supporting prefix holding a playground would hide it.
-  invalid(e => { e.universes.harbor.supporting = ['Book One/Workshop/']; e.universes.harbor.playground = ['Book One/Workshop/Playground/']; return e; },
-    /universes.harbor.supporting "Book One\/Workshop\/" holds playground "Book One\/Workshop\/Playground\/"/);
-  // Across entries any overlap would give one path two universes.
-  for (const [supporting, playground] of [['Ideas/', 'Ideas/'], ['Ideas/Deep/', 'Ideas/'], ['Ideas/', 'Ideas/Deep/']])
-    invalid(e => { e.universes.harbor.supporting = [supporting]; e.universes.idea = draft([playground]); return e; },
-      new RegExp(`universes.harbor.supporting "${supporting}" overlaps playground "${playground}" of universes.idea`));
-  refuses(e => { e.universes.harbor.supporting = ['Second World/Notes/']; return e; },
-    'library-supporting-other-universe', /universes.harbor.supporting "Second World\/Notes\/" lies inside book folder "Second World" of universes.second/);
-  refuses(e => { e.universes.second.books = ['Worlds/Second']; e.universes.harbor.supporting = ['Worlds/']; return e; },
-    'library-supporting-other-universe', /universes.harbor.supporting "Worlds\/" holds book folder "Worlds\/Second" of universes.second/);
-  refuses(e => { e.universes.idea = { ...draft(), supporting: ['Book One/Idea Notes/'] }; return e; },
-    'library-supporting-other-universe', /universes.idea.supporting "Book One\/Idea Notes\/" lies inside book folder "Book One" of universes.harbor/);
-});
-
-test('C2-01d: between the lists, a supporting prefix may equal its own playground, and a playground may hold its own supporting', () => {
-  const same = mapping(e => { e.universes.harbor.supporting = ['Book One/Playground/']; return e; });
-  assert.deepEqual([same.universes.harbor.playground, same.universes.harbor.supporting], [['Book One/Playground/'], ['Book One/Playground/']]);
-  const nested = mapping(e => { e.universes.harbor.supporting = ['Book One/Playground/Notes/']; return e; });
-  assert.deepEqual(nested.universes.harbor.supporting, ['Book One/Playground/Notes/']);
-});
-
-test('C2-01d: editor is optional, kept when given, and refuses anything but a plain name and email', () => {
-  assert.equal(Object.hasOwn(mapping(), 'editor'), false);
-  const editor = { name: 'Her Name', email: '[email protected]' };
-  const m = mapping(e => ({ ...e, editor }));
-  assert.deepEqual(m.editor, editor);
-  assert.notEqual(m.editor, editor);
-  assert.ok(Object.isFrozen(m.editor));
-  const invalid = (value, pattern) => refuses(e => ({ ...e, editor: value }), 'library-mapping-invalid', pattern);
-  for (const value of [null, 'Her Name', 7, ['Her Name', '[email protected]']]) invalid(value, /editor must be an object/);
-  invalid({ ...editor, signingKey: 'x' }, /editor has unknown key "signingKey"/);
-  // sage-2925: an optional Gitea login for her save, checked as the entry's user is.
-  assert.deepEqual(mapping(e => ({ ...e, editor: { ...editor, user: 'her.login-1' } })).editor, { ...editor, user: 'her.login-1' });
-  for (const user of ['', 'her login', 'her@host', 'a'.repeat(101), 7, null])
-    invalid({ ...editor, user }, /editor.user must be a plain account name/);
-  invalid({ name: 'Her Name' }, /editor.email must be non-empty text with no control character, < or >/);
-  invalid({ email: '[email protected]' }, /editor.name must be non-empty text/);
-  for (const bad of ['', '   ', 7, null, 'a\u0000b', 'a\nb', 'a\u001fb', 'a\u007fb', 'a\u0085b', 'a\u009fb', '<her>', 'a<b', 'a>b']) {
-    invalid({ ...editor, name: bad }, /editor.name must be non-empty text with no control character, < or >/);
-    invalid({ ...editor, email: bad }, /editor.email must be non-empty text with no control character, < or >/);
-  }
-  // sage-3601, sage-3606: git's crud() strips whitespace and , : ; < > " \ ' from both ends of an
-  // ident, so a value starting or ending with one refuses. Inner < > and controls refuse above.
-  const ends = [' ', '\u00a0', '\u3000', ',', ':', ';', '"', "'", '\\'];
-  for (const c of ends) for (const padded of [`${c}Her Name`, `Her Name${c}`]) {
-    invalid({ ...editor, name: padded }, /editor.name must not start or end with whitespace or any of , : ; " ' \\/);
-    invalid({ ...editor, email: padded }, /editor.email must not start or end with whitespace or any of , : ; " ' \\/);
-  }
-  for (const c of ['<', '>', '\n', '\t']) for (const padded of [`${c}Her Name`, `Her Name${c}`, `Her${c}Name`])
-    invalid({ ...editor, name: padded }, /editor.name must be non-empty text with no control character, < or >/);
-  assert.equal(mapping(e => ({ ...e, editor: { name: 'Her  Middle Name', email: '[email protected]' } })).editor.name, 'Her  Middle Name');
-  for (const name of ['Doe, Jane Q.', 'Jane: "Q" Doe', "O'Neil", 'Back\\slash Name'])
-    assert.equal(mapping(e => ({ ...e, editor: { name, email: '[email protected]' } })).editor.name, name);
-});
-
-// sage-3606: an accepted editor commits under exactly the saved ident, as author and committer. A
-// future git that strips more from an ident fails here.
-test('C2-01d: an accepted editor round-trips through a real git commit unchanged', t => {
-  const editor = mapping(e => ({ ...e, editor: { name: 'Doe, Jane Q.', email: '[email protected].' } })).editor;
-  const root = mkdtempSync(join(tmpdir(), 'library-ident-'));
-  t.after(() => rmSync(root, { recursive: true, force: true }));
-  // An ident in the environment would win over -c, so the commit runs without one. GIT_DIR and its
-  // family would beat -C (inside a hook, say), and git reads no global or system config (webby-0236 E5).
-  const env = Object.fromEntries(Object.entries(process.env).filter(([k]) => !/^GIT_(AUTHOR|COMMITTER)_/.test(k)));
-  for (const k of ['GIT_DIR', 'GIT_WORK_TREE', 'GIT_COMMON_DIR', 'GIT_INDEX_FILE']) delete env[k];
-  Object.assign(env, { GIT_CONFIG_GLOBAL: '/dev/null', GIT_CONFIG_NOSYSTEM: '1' });
-  const git = (...args) => execFileSync('git', ['-c', `user.name=${editor.name}`, '-c', `user.email=${editor.email}`,
-    '-c', 'commit.gpgsign=false', '-c', 'core.hooksPath=/dev/null', '-C', root, ...args], { encoding: 'utf8', env });
-  git('init', '-q');
-  git('commit', '-q', '--allow-empty', '-m', 'ident');
-  assert.equal(git('log', '-1', '--format=%an%n%ae%n%cn%n%ce'), `${editor.name}\n${editor.email}\n${editor.name}\n${editor.email}\n`);
-});
-
 test('no playground prefix holds another, and no book folder holds another', () => {
   refuses(e => { e.universes.harbor.playground = ['Book One/Playground/', 'Book One/Playground/Deep/']; return e; },
     'library-mapping-invalid', /holds playground/);

packages/library/tests/query-fixture.mjs

@@ -1,50 +0,0 @@
-// Scratch repos for the query and index tests (C2-05a). They are built under tmpdir(), as helpers.mjs
-// repo() does; the gate sets TMPDIR under /mnt/storage/scratch/tmp, never /tmp (RULINGS "tmpdir flag").
-// Bodies are made up.
-import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from 'node:fs';
-import { tmpdir } from 'node:os';
-import { dirname, join } from 'node:path';
-import { git } from './helpers.mjs';
-
-// A repo with one commit holding `files` (path -> text). Removed when the test ends.
-export function scratchRepo(t, files) {
-  const root = mkdtempSync(join(tmpdir(), 'r216-'));
-  t.after(() => rmSync(root, { recursive: true, force: true }));
-  const repo = join(root, 'books');
-  mkdirSync(repo);
-  git(repo, 'init', '-q', '-b', 'main');
-  for (const [path, text] of Object.entries(files)) {
-    mkdirSync(dirname(join(repo, path)), { recursive: true });
-    writeFileSync(join(repo, path), text);
-  }
-  git(repo, 'add', '-A');
-  git(repo, 'commit', '-qm', 'fixture');
-  return { root, repo, commit: git(repo, 'rev-parse', 'HEAD') };
-}
-
-// A note: front matter with a type and a name, optional extra front matter lines, then a body.
-export const note = (type, name, body = '', extra = []) => ['---', `type: ${type}`, `name: ${name}`, ...extra, '---', body, ''].join('\n');
-
-// The one exclusion the hybrid tests use, and the paths it hides. C2-15 (row 267) replaces the reading of
-// `exclude` (a path prefix today); swapping these two constants is the whole change to the tests.
-export const EXCLUSION = { exclude: 'Book One/Research' };
-export const EXCLUDED_PATHS = ['Book One/Research/Ferry Logs.md'];
-
-// C2-05c: synthetic scope fixture, including same-prefix precedence and a draft.
-export const SUPPORT_FILES = {
-  'Book One/Characters/Canon.md': note('character', 'Canon', 'Scope fixture canon.'),
-  'Book One/Playground/Plan.md': note('summary', 'Plan', 'Scope fixture playground.'),
-  'Book One/Support/Notes/Helper.md': note('summary', 'Helper', 'Scope fixture supporting.'),
-  'Notes/HarborSupport/Loose.md': note('summary', 'Loose', 'Scope fixture supporting loose.'),
-  'Drafts/Idea/Support/Seed.md': note('summary', 'Seed', 'Scope fixture supporting draft.'),
-};
-export const withSupporting = entry => ({
-  ...entry,
-  universes: {
-    ...entry.universes,
-    harbor: { ...entry.universes.harbor,
-      playground: [...entry.universes.harbor.playground, 'Book One/Support/'],
-      supporting: ['Book One/Support/', 'Notes/HarborSupport/'] },
-    idea: { kind: 'draft', name: 'Idea', playground: ['Drafts/Idea/'], supporting: ['Drafts/Idea/Support/'] },
-  },
-});

packages/library/tests/query.test.mjs

@@ -1,466 +0,0 @@
-// Query tests for design 3 (C2-05a): universe isolation, scope labels, unmapped files, hybrids, paging
-// under the reply cap, refusals and manuscript paging. Fixtures are made up and built under the scratch area.
-import { test } from 'node:test';
-import { writeFileSync } from 'node:fs';
-import { join } from 'node:path';
-import assert from 'node:assert/strict';
-import { REPLY_CAP } from '../../harness/src/tools.mjs';
-import { find, get, search, manuscript, universeInfo, QUERY_REPLY_CAP, LOOKUP_LIMIT, MANUSCRIPT_LINES } from '../src/query.mjs';
-import { mapping, MARKER, git } from './helpers.mjs';
-import { scratchRepo, note, EXCLUSION, EXCLUDED_PATHS, SUPPORT_FILES, withSupporting } from './query-fixture.mjs';
-
-// A hybrid over harbor and second. Its one constraint is EXCLUSION (query-fixture.mjs) and it declares no
-// books or playground.
-const WITH_BLEND = e => ({
-  ...e,
-  universes: {
-    ...e.universes,
-    blend: {
-      kind: 'hybrid', name: 'Blend', sources: ['harbor', 'second'], books: [], playground: [],
-      constraints: [EXCLUSION], notes: 'made-up hybrid',
-    },
-  },
-});
-
-// PRD 1.14 levels (C2-01c): harbor gets a universe-level playground prefix outside every book, and a draft
-// universe has only playground prefixes. Files there have book null.
-const WITH_LEVELS = e => ({
-  ...WITH_BLEND(e),
-  universes: {
-    ...WITH_BLEND(e).universes,
-    harbor: { ...e.universes.harbor, playground: ['Book One/Playground/', 'Notes/Harbor/'] },
-    idea: { kind: 'draft', name: 'New World', playground: ['Drafts/New World/'] },
-  },
-});
-const LEVEL_FILES = {
-  'Notes/Harbor/Scraps.md': note('summary', 'Scraps', `${MARKER} loose`),
-  'Notes/Harbor/Chapters/Idea Chapter.md': `# Idea\n${MARKER} unbooked chapter\n`,
-  'Drafts/New World/Characters/Rin.md': note('character', 'Rin', `${MARKER} draft`),
-  'Drafts/New World/Summary.md': note('summary', 'Summary', `${MARKER} draft`),
-};
-
-const FILES = {
-  'Book One/Characters/Mara Vell.md': note('character', 'Mara Vell', `Grey eyes. ${MARKER}`,
-    ['appears_in: "[[Book One/Chapters/Chapter 01]]"', 'relationships:', '  - "[[Tomas]]"']),
-  'Book One/Characters/Tomas.md': note('character', 'Tomas', MARKER),
-  'Book One/Chapters/Chapter 01.md': `# One\n${MARKER} [[Mara Vell]] met [[Book One/Places/Harbor Town|the harbor]].\n`,
-  'Book One/Chapters/Chapter 02.md': 'Quiet. [[Ferry Logs]] [[Ilse]]\n',
-  'Book One/Places/Harbor Town.md': note('place', 'Harbor Town', `Salt. ${MARKER}`),
-  'Book One/Research/Ferry Logs.md': note('research', 'Ferry Logs', `Timetable. ${MARKER}`),
-  'Book One/Playground/What If.md': note('summary', 'What If', `${MARKER} [[Mara Vell]]`),
-  'Second World/Characters/Ilse.md': note('character', 'Ilse', `${MARKER} Ilse.`),
-  'Second World/Chapters/01.md': '# Elsewhere\n[[Ilse]] waits.\n',
-  'Inbox Note.md': `${MARKER}\n`,
-  'Book One/Board.canvas': '{"nodes":[]}\n',
-};
-
-const src = (ref, map = mapping()) => ({ repo: ref.repo, commit: ref.commit, mapping: map });
-const paths = reply => reply.results.map(r => r.path);
-
-test('the query reply cap equals the harness reply cap', () => {
-  assert.equal(QUERY_REPLY_CAP, REPLY_CAP);
-});
-
-test('find is bound to its universe and refuses a call without one', async t => {
-  const s = src(scratchRepo(t, FILES));
-  const names = paths(await find(s, { universe: 'harbor', query: '' }));
-  assert.ok(names.length > 0);
-  assert.ok(names.every(p => p.startsWith('Book One/')));
-  assert.ok(!names.includes('Second World/Characters/Ilse.md'));
-  await assert.rejects(find(s, { query: '' }), { code: 'query-argument-invalid' });
-  await assert.rejects(find(s, { universe: 'nowhere', query: '' }), { code: 'query-universe-unknown' });
-});
-
-test('every result carries its scope, and playground appears only when asked for', async t => {
-  const s = src(scratchRepo(t, FILES));
-  const canon = (await find(s, { universe: 'harbor', query: '' })).results;
-  assert.ok(canon.every(r => r.scope === 'canon'));
-  assert.ok(!canon.some(r => r.path.includes('/Playground/')));
-  const play = (await find(s, { universe: 'harbor', query: '', scope: 'playground' })).results;
-  assert.deepEqual(play.map(r => r.path), ['Book One/Playground/What If.md']);
-  assert.ok(play.every(r => r.scope === 'playground'));
-});
-
-test('unmapped files never appear in any reply', async t => {
-  const s = src(scratchRepo(t, FILES));
-  assert.deepEqual((await find(s, { universe: 'harbor', query: 'Inbox' })).results, []);
-  assert.deepEqual((await find(s, { universe: 'harbor', query: 'Board' })).results, []);
-  const hits = (await search(s, { universe: 'harbor', text: MARKER })).results;
-  assert.ok(hits.length > 0);
-  assert.ok(hits.every(r => r.path !== 'Inbox Note.md' && r.path !== 'Book One/Board.canvas'));
-});
-
-test('a hybrid sees its sources canon, minus exclusions, and no playground', async t => {
-  const s = src(scratchRepo(t, FILES), mapping(WITH_BLEND));
-  const reply = await find(s, { universe: 'blend', query: '' });
-  assert.deepEqual(paths(reply).sort(), [
-    'Book One/Characters/Mara Vell.md', 'Book One/Characters/Tomas.md', 'Book One/Chapters/Chapter 01.md',
-    'Book One/Chapters/Chapter 02.md', 'Book One/Places/Harbor Town.md',
-    'Second World/Characters/Ilse.md', 'Second World/Chapters/01.md',
-  ]);
-  assert.ok(reply.results.every(r => r.scope === 'canon' && ['harbor', 'second'].includes(r.universe)));
-  assert.deepEqual((await find(s, { universe: 'blend', query: '', scope: 'playground' })).results, []);
-  assert.deepEqual((await find(s, { universe: 'blend', query: 'Ferry' })).results, []);
-});
-
-test('a hybrid gets a source file it can see, and not an excluded or foreign one', async t => {
-  const ref = scratchRepo(t, FILES);
-  const hybrid = src(ref, mapping(WITH_BLEND));
-  const ilse = await get(hybrid, { universe: 'blend', path: 'Second World/Characters/Ilse.md' });
-  assert.equal(ilse.scope, 'canon');
-  assert.ok(ilse.links_in.some(l => l.path === 'Second World/Chapters/01.md'));
-  assert.equal(await get(hybrid, { universe: 'blend', path: 'Book One/Research/Ferry Logs.md' }), null);
-  assert.equal(await get(src(ref), { universe: 'harbor', path: 'Second World/Characters/Ilse.md' }), null);
-});
-
-test('get lists visible links both ways and drops a target another universe cannot see', async t => {
-  const ref = scratchRepo(t, FILES);
-  const harbor = src(ref);
-  const ch1 = await get(harbor, { universe: 'harbor', path: 'Book One/Chapters/Chapter 01.md' });
-  assert.ok(ch1.links_out.some(l => l.path === 'Book One/Characters/Mara Vell.md' && l.line === 2));
-  assert.ok(ch1.links_out.some(l => l.path === 'Book One/Places/Harbor Town.md'));
-  const ch2 = await get(harbor, { universe: 'harbor', path: 'Book One/Chapters/Chapter 02.md' });
-  assert.ok(ch2.links_out.some(l => l.path === 'Book One/Research/Ferry Logs.md'));
-  assert.ok(!ch2.links_out.some(l => l.path === 'Second World/Characters/Ilse.md'));
-  const mara = await get(harbor, { universe: 'harbor', path: 'Book One/Characters/Mara Vell.md' });
-  assert.ok(mara.links_in.some(l => l.path === 'Book One/Chapters/Chapter 01.md'));
-  assert.ok(mara.links_in.some(l => l.path === 'Book One/Playground/What If.md'));
-  assert.ok(mara.links_out.some(l => l.path === 'Book One/Characters/Tomas.md' && l.field === 'relationships'));
-  assert.ok(mara.links_out.some(l => l.path === 'Book One/Chapters/Chapter 01.md' && l.field === 'appears_in'));
-  const blendCh2 = await get(src(ref, mapping(WITH_BLEND)), { universe: 'blend', path: 'Book One/Chapters/Chapter 02.md' });
-  assert.ok(blendCh2.links_out.some(l => l.path === 'Second World/Characters/Ilse.md'));
-});
-
-test('a long list pages by position, never cuts an item, and returns 50 per page', async t => {
-  const files = { ...FILES };
-  for (let i = 1; i <= 120; i++) files[`Book One/Places/Note ${i}.md`] = note('place', `Note ${i}`);
-  const s = src(scratchRepo(t, files));
-  const seen = [];
-  let offset = 0;
-  for (let pages = 0; pages < 10; pages++) {
-    const reply = await find(s, { universe: 'harbor', query: 'Note', offset });
-    assert.ok(JSON.stringify(reply).length <= QUERY_REPLY_CAP);
-    assert.ok(reply.results.length <= LOOKUP_LIMIT);
-    if (pages === 0) assert.equal(reply.results.length, LOOKUP_LIMIT);
-    seen.push(...paths(reply));
-    if (reply.next === null) break;
-    offset = reply.next;
-  }
-  assert.equal(seen.length, 120);
-  assert.equal(new Set(seen).size, 120);
-});
-
-test('a page stays under the reply cap when items are large', async t => {
-  const big = 'x'.repeat(2000);
-  const files = { ...FILES };
-  for (let i = 1; i <= 40; i++) files[`Book One/Places/Big ${i}.md`] = note('place', `Big ${i}`, '', [`appears_in: "${big}"`]);
-  const s = src(scratchRepo(t, files));
-  const first = await find(s, { universe: 'harbor', query: 'Big' });
-  assert.ok(JSON.stringify(first).length <= QUERY_REPLY_CAP);
-  assert.ok(first.results.length > 0 && first.results.length < 40);
-  assert.notEqual(first.next, null);
-  const seen = [];
-  let offset = 0;
-  for (let pages = 0; pages < 10; pages++) {
-    const reply = await find(s, { universe: 'harbor', query: 'Big', offset });
-    assert.ok(JSON.stringify(reply).length <= QUERY_REPLY_CAP);
-    seen.push(...paths(reply));
-    if (reply.next === null) break;
-    offset = reply.next;
-  }
-  assert.equal(new Set(seen).size, 40);
-});
-
-test('a search line too long to fit alone comes back marked, with no excerpt, and the other hits still return', async t => {
-  const huge = 'y'.repeat(QUERY_REPLY_CAP + 1000);
-  const s = src(scratchRepo(t, { ...FILES, 'Book One/Places/Wall.md': note('place', 'Wall', `${huge} ${MARKER}`) }));
-  const reply = await search(s, { universe: 'harbor', text: 'yyyyyyyy' });
-  assert.deepEqual(reply.results, [{ path: 'Book One/Places/Wall.md', line: 5, excerpt: null, excerpt_too_long: true, scope: 'canon' }]);
-  const mixed = await search(s, { universe: 'harbor', text: MARKER.toLowerCase() });
-  assert.ok(mixed.results.some(r => r.excerpt_too_long === true));
-  assert.ok(mixed.results.some(r => typeof r.excerpt === 'string' && !('excerpt_too_long' in r)));
-  assert.ok(JSON.stringify(mixed).length <= QUERY_REPLY_CAP);
-});
-
-test('a find item that cannot fit alone is refused, not cut', async t => {
-  const huge = 'y'.repeat(QUERY_REPLY_CAP + 1000);
-  const s = src(scratchRepo(t, { ...FILES, 'Book One/Places/Wall.md': note('place', 'Wall', '', [`appears_in: "${huge}"`]) }));
-  await assert.rejects(find(s, { universe: 'harbor', query: 'Wall' }), { code: 'query-item-too-large' });
-});
-
-test('get pages its lines, and the next line picks up where the page stopped', async t => {
-  const body = `${Array.from({ length: 500 }, (_, i) => `Line ${i + 1} ${'z'.repeat(120)}`).join('\n')}\n`;
-  const s = src(scratchRepo(t, { ...FILES, 'Book One/Chapters/Long.md': body }));
-  const first = await get(s, { universe: 'harbor', path: 'Book One/Chapters/Long.md' });
-  assert.equal(first.lines[0][0], 1);
-  assert.ok(first.lines.length < 501);
-  assert.notEqual(first.next, null);
-  let from = 1, count = 0;
-  for (let pages = 0; pages < 10; pages++) {
-    const page = await get(s, { universe: 'harbor', path: 'Book One/Chapters/Long.md', from });
-    count += page.lines.length;
-    if (page.next === null) break;
-    from = page.next;
-  }
-  assert.equal(count, 501);
-});
-
-test('get refuses a file whose front matter alone is over the cap, and a line alone is over the cap', async t => {
-  const huge = 'q'.repeat(QUERY_REPLY_CAP + 1000);
-  const s = src(scratchRepo(t, {
-    ...FILES,
-    'Book One/Places/Heavy.md': note('place', 'Heavy', '', [`appears_in: "${huge}"`]),
-    'Book One/Chapters/Wide.md': `${huge}\n`,
-  }));
-  await assert.rejects(get(s, { universe: 'harbor', path: 'Book One/Places/Heavy.md' }), { code: 'query-item-too-large' });
-  await assert.rejects(get(s, { universe: 'harbor', path: 'Book One/Chapters/Wide.md' }), { code: 'query-item-too-large' });
-});
-
-test('get pages the links of a hub note, every page carries the front matter, and the pages add up', async t => {
-  const files = { ...FILES };
-  for (let i = 1; i <= 900; i++) files[`Book One/Chapters/Mention ${i}.md`] = `[[Tomas]] ${'w'.repeat(60)}\n`;
-  const s = src(scratchRepo(t, files));
-  const seen = [];
-  const PAST_END = 1000;
-  let linksFrom = 0, pages = 0, lines = 0, from = 1;
-  for (; pages < 40; pages++) {
-    const page = await get(s, { universe: 'harbor', path: 'Book One/Characters/Tomas.md', from, links_from: linksFrom });
-    assert.ok(JSON.stringify(page).length <= QUERY_REPLY_CAP);
-    assert.equal(page.frontmatter.name, 'Tomas');
-    seen.push(...page.links_in.map(l => l.path));
-    if (from !== PAST_END) lines += page.lines.length;
-    // Once the lines are read, ask past the last one: the page then carries links alone.
-    from = page.next ?? PAST_END;
-    if (page.links_next === null && page.next === null) break;
-    if (page.links_next !== null) linksFrom = page.links_next;
-  }
-  assert.ok(pages > 1, 'the hub needed more than one page');
-  assert.ok(pages < 40);
-  assert.equal(seen.filter(p => p.startsWith('Book One/Chapters/Mention ')).length, 900);
-  assert.equal(new Set(seen).size, seen.length, 'no link comes back twice');
-  assert.equal(lines, 6, 'the five lines of the note and the empty one after its last newline');
-  const tail = await get(s, { universe: 'harbor', path: 'Book One/Characters/Tomas.md', from: PAST_END });
-  assert.deepEqual(tail.lines, []);
-  assert.equal(tail.next, null);
-});
-
-test('get rejects a bad links_from', async t => {
-  const s = src(scratchRepo(t, FILES));
-  await assert.rejects(get(s, { universe: 'harbor', path: 'Book One/Characters/Tomas.md', links_from: -1 }), { code: 'query-argument-invalid' });
-  const past = await get(s, { universe: 'harbor', path: 'Book One/Characters/Tomas.md', links_from: 99 });
-  assert.deepEqual([past.links_out, past.links_in, past.links_next], [[], [], null]);
-});
-
-test('search returns scoped line hits, case-insensitively, and refuses empty text', async t => {
-  const s = src(scratchRepo(t, FILES));
-  const reply = await search(s, { universe: 'harbor', text: 'marker' });
-  assert.ok(reply.results.length > 0);
-  assert.ok(reply.results.every(r => r.scope === 'canon' && r.path.startsWith('Book One/') && Number.isInteger(r.line)));
-  assert.ok(reply.results.some(r => r.path === 'Book One/Chapters/Chapter 01.md' && r.line === 2));
-  await assert.rejects(search(s, { universe: 'harbor', text: '' }), { code: 'query-argument-invalid' });
-});
-
-test('a manuscript call returns one chapter, at most 400 lines, and names its next line', async t => {
-  const long = `${Array.from({ length: 900 }, (_, i) => `Scene ${i + 1}`).join('\n')}\n`;
-  const s = src(scratchRepo(t, { ...FILES, 'Book One/Chapters/Long Chapter.md': long }));
-  const first = await manuscript(s, { universe: 'harbor', book: 'Book One', chapter: 'Long Chapter' });
-  assert.equal(first.lines.length, MANUSCRIPT_LINES);
-  assert.equal(first.next, MANUSCRIPT_LINES + 1);
-  const second = await manuscript(s, { universe: 'harbor', book: 'Book One', chapter: 'Long Chapter', from: first.next });
-  assert.equal(second.lines[0][0], MANUSCRIPT_LINES + 1);
-});
-
-test('a manuscript call without a chapter returns the first chapter in path order and names the next', async t => {
-  const s = src(scratchRepo(t, FILES));
-  const first = await manuscript(s, { universe: 'harbor', book: 'Book One' });
-  assert.equal(first.path, 'Book One/Chapters/Chapter 01.md');
-  assert.equal(first.next_chapter, 'Chapter 02');
-  const last = await manuscript(s, { universe: 'harbor', book: 'Book One', chapter: 'Chapter 02' });
-  assert.equal(last.path, 'Book One/Chapters/Chapter 02.md');
-  assert.equal(last.next_chapter, null);
-  assert.equal(await manuscript(s, { universe: 'harbor', book: 'Book One', chapter: 'Nope' }), null);
-});
-
-test('a chapter name that matches two visible files is refused', async t => {
-  const s = src(scratchRepo(t, { ...FILES, 'Book One/Chapters/Part/Chapter 01.md': 'Again.\n' }));
-  await assert.rejects(manuscript(s, { universe: 'harbor', book: 'Book One', chapter: 'Chapter 01' }), { code: 'query-chapter-ambiguous' });
-});
-
-test('a hybrid reads a source chapter through its declared sources only', async t => {
-  const ref = scratchRepo(t, FILES);
-  const hybrid = await manuscript(src(ref, mapping(WITH_BLEND)), { universe: 'blend', book: 'Second World', chapter: '01' });
-  assert.equal(hybrid.path, 'Second World/Chapters/01.md');
-  assert.equal(hybrid.scope, 'canon');
-  assert.equal(await manuscript(src(ref), { universe: 'harbor', book: 'Second World', chapter: '01' }), null);
-});
-
-test('universe info reports a hybrid sources, constraints and notes, and refuses an unknown universe', async t => {
-  const s = src(scratchRepo(t, FILES), mapping(WITH_BLEND));
-  const blend = await universeInfo(s, { universe: 'blend' });
-  assert.equal(blend.kind, 'hybrid');
-  assert.deepEqual(blend.sources, ['harbor', 'second']);
-  assert.deepEqual(blend.constraints, [EXCLUSION]);
-  assert.equal(blend.notes, 'made-up hybrid');
-  const harbor = await universeInfo(s, { universe: 'harbor' });
-  assert.equal(harbor.kind, 'universe');
-  assert.equal(harbor.sources, undefined);
-  await assert.rejects(universeInfo(s, { universe: 'ghost' }), { code: 'query-universe-unknown' });
-});
-
-test('an exclusion hides what it names from a hybrid and from nothing else', async t => {
-  const ref = scratchRepo(t, FILES);
-  const hybrid = src(ref, mapping(WITH_BLEND));
-  const seen = paths(await find(hybrid, { universe: 'blend', query: '' }));
-  for (const path of EXCLUDED_PATHS) assert.ok(!seen.includes(path), `${path} stays hidden`);
-  const own = paths(await find(src(ref), { universe: 'harbor', query: '' }));
-  for (const path of EXCLUDED_PATHS) assert.ok(own.includes(path), `${path} stays visible to its own universe`);
-});
-
-test('PRD 1.14: a lookup that names a book leaves book-null files out', async t => {
-  const s = src(scratchRepo(t, { ...FILES, ...LEVEL_FILES }), mapping(WITH_LEVELS));
-  const all = paths(await find(s, { universe: 'harbor', query: '', scope: 'playground' }));
-  assert.deepEqual(all.sort(), ['Book One/Playground/What If.md', 'Notes/Harbor/Chapters/Idea Chapter.md', 'Notes/Harbor/Scraps.md']);
-  const booked = await find(s, { universe: 'harbor', query: '', scope: 'playground', book: 'Book One' });
-  assert.deepEqual(paths(booked), ['Book One/Playground/What If.md']);
-  assert.ok(booked.results.every(r => r.book === 'Book One'));
-  const hits = (await search(s, { universe: 'harbor', text: 'unbooked', scope: 'playground' })).results;
-  assert.deepEqual(hits.map(r => r.path), ['Notes/Harbor/Chapters/Idea Chapter.md']);
-  assert.deepEqual((await search(s, { universe: 'harbor', text: 'unbooked', scope: 'playground', book: 'Book One' })).results, []);
-});
-
-test('PRD 1.14: library_manuscript never reads a book-null file', async t => {
-  const s = src(scratchRepo(t, { ...FILES, ...LEVEL_FILES }), mapping(WITH_LEVELS));
-  // The unbooked file sits under a manuscript folder, so it has type manuscript and book null.
-  const listed = await find(s, { universe: 'harbor', query: 'Idea', scope: 'playground' });
-  assert.deepEqual(listed.results.map(r => [r.path, r.type, r.book]), [['Notes/Harbor/Chapters/Idea Chapter.md', 'manuscript', null]]);
-  assert.equal(await manuscript(s, { universe: 'harbor', book: 'Book One', scope: 'playground', chapter: 'Idea Chapter' }), null);
-  assert.equal(await manuscript(s, { universe: 'harbor', book: 'Book One', scope: 'playground' }), null);
-  assert.equal(await manuscript(s, { universe: 'harbor', book: 'Notes', scope: 'playground', chapter: 'Idea Chapter' }), null);
-});
-
-test('PRD 1.14: a draft universe has no canon, so its lookups return files only with scope playground', async t => {
-  const s = src(scratchRepo(t, { ...FILES, ...LEVEL_FILES }), mapping(WITH_LEVELS));
-  assert.deepEqual((await find(s, { universe: 'idea', query: '' })).results, []);
-  assert.deepEqual((await search(s, { universe: 'idea', text: MARKER })).results, []);
-  const found = await find(s, { universe: 'idea', query: '', scope: 'playground' });
-  assert.deepEqual(paths(found).sort(), ['Drafts/New World/Characters/Rin.md', 'Drafts/New World/Summary.md']);
-  assert.ok(found.results.every(r => r.scope === 'playground' && r.universe === 'idea' && r.book === null));
-  const hits = (await search(s, { universe: 'idea', text: 'draft', scope: 'playground' })).results;
-  assert.equal(hits.length, 2);
-  const rin = await get(s, { universe: 'idea', path: 'Drafts/New World/Characters/Rin.md', scope: 'playground' });
-  assert.equal(rin.scope, 'playground');
-  assert.equal(await get(s, { universe: 'harbor', path: 'Drafts/New World/Characters/Rin.md', scope: 'playground' }), null);
-});
-
-test('PRD 1.14: library_universe on a draft returns its kind, name and prefixes', async t => {
-  const s = src(scratchRepo(t, { ...FILES, ...LEVEL_FILES }), mapping(WITH_LEVELS));
-  const draft = await universeInfo(s, { universe: 'idea' });
-  assert.equal(draft.kind, 'draft');
-  assert.equal(draft.name, 'New World');
-  assert.deepEqual(draft.playground, ['Drafts/New World/']);
-  assert.deepEqual(draft.books, []);
-  assert.equal(draft.sources, undefined);
-});
-
-test('a hybrid gets a source playground file as null, while the source gets it with scope playground', async t => {
-  const ref = scratchRepo(t, FILES);
-  const path = 'Book One/Playground/What If.md';
-  assert.equal(await get(src(ref, mapping(WITH_BLEND)), { universe: 'blend', path, scope: 'playground' }), null);
-  const own = await get(src(ref), { universe: 'harbor', path, scope: 'playground' });
-  assert.equal(own.scope, 'playground');
-});
-
-// mos-1330 item3: the new get contract defaults to canon even for an explicit playground path.
-test('C2-05c get without scope returns null for a playground path', async t => {
-  const s = src(scratchRepo(t, FILES));
-  assert.equal(await get(s, { universe: 'harbor', path: 'Book One/Playground/What If.md' }), null);
-});
-
-// Row284: scope is explicit for get as well as lists; blob and lines share a served snapshot.
-test('C2-05c supporting find/search/get are opt-in at book, universe and draft level', async t => {
-  const s = src(scratchRepo(t, SUPPORT_FILES), mapping(withSupporting));
-  const expected = ['Book One/Support/Notes/Helper.md', 'Notes/HarborSupport/Loose.md'];
-  assert.deepEqual(paths(await find(s, { universe: 'harbor', query: '', scope: 'supporting' })), expected);
-  assert.deepEqual((await search(s, { universe: 'harbor', text: 'Scope fixture', scope: 'supporting' })).results.map(x => x.path), expected);
-  assert.deepEqual(paths(await find(s, { universe: 'harbor', query: '' })), ['Book One/Characters/Canon.md']);
-  assert.deepEqual((await search(s, { universe: 'harbor', text: 'Scope fixture' })).results.map(x => x.path), ['Book One/Characters/Canon.md']);
-  for (const path of expected) {
-    assert.equal(await get(s, { universe: 'harbor', path }), null);
-    assert.equal(await get(s, { universe: 'harbor', path, scope: 'playground' }), null);
-    assert.equal((await get(s, { universe: 'harbor', path, scope: 'supporting' })).scope, 'supporting');
-    assert.equal(await get(s, { universe: 'second', path, scope: 'supporting' }), null);
-  }
-  const draftPath = 'Drafts/Idea/Support/Seed.md';
-  assert.deepEqual(paths(await find(s, { universe: 'idea', query: '', scope: 'supporting' })), [draftPath]);
-  assert.equal((await get(s, { universe: 'idea', path: draftPath, scope: 'supporting' })).scope, 'supporting');
-  assert.equal(await get(s, { universe: 'idea', path: draftPath }), null);
-  assert.equal((await find(s, { universe: 'harbor', query: '', book: 'Book One', scope: 'supporting' })).results.length, 1);
-});
-
-test('C2-05c an absent supporting prefix returns nothing without refusal', async t => {
-  const s = src(scratchRepo(t, SUPPORT_FILES));
-  assert.deepEqual((await find(s, { universe: 'harbor', query: '', scope: 'supporting' })).results, []);
-  assert.deepEqual((await search(s, { universe: 'harbor', text: 'Scope fixture', scope: 'supporting' })).results, []);
-  assert.equal(await get(s, { universe: 'harbor', path: 'Book One/Characters/Canon.md', scope: 'supporting' }), null);
-  assert.equal(await get(s, { universe: 'harbor', path: 'Book One/Support/Notes/Helper.md', scope: 'supporting' }), null);
-});
-
-test('C2-05c each get blob equals its served tree object, even after source HEAD advances', async t => {
-  const ref = scratchRepo(t, SUPPORT_FILES), s = src(ref, mapping(withSupporting));
-  const canon = 'Book One/Characters/Canon.md';
-  const priorBlob = git(ref.repo, 'rev-parse', `${ref.commit}:${canon}`);
-  writeFileSync(join(ref.repo, canon), note('character', 'Canon changed', 'New HEAD must not be read.'));
-  git(ref.repo, 'add', '-A'); git(ref.repo, 'commit', '-qm', 'advance head fixture');
-  assert.notEqual(git(ref.repo, 'rev-parse', `HEAD:${canon}`), priorBlob);
-  for (const [scope, path] of [['canon', canon], ['playground', 'Book One/Playground/Plan.md'], ['supporting', 'Book One/Support/Notes/Helper.md']]) {
-    const result = await get(s, { universe: 'harbor', path, scope });
-    assert.equal(result.commit, ref.commit);
-    assert.equal(result.blob, git(ref.repo, 'rev-parse', `${ref.commit}:${path}`));
-    assert.ok(!JSON.stringify(result.lines).includes('New HEAD must not be read'));
-  }
-});
-
-test('C2-05c full outgoing and incoming links stay in scope order across pages without losing cross-scope links', async t => {
-  const files = {}, groups = { supporting: [], playground: [], canon: [] };
-  for (const [scope, folder] of [['canon', 'Book One/Characters'], ['playground', 'Book One/Playground'], ['supporting', 'Book One/Support']]) {
-    for (let n = 0; n < 100; n++) {
-      const path = `${folder}/${scope}-${String(n).padStart(3, '0')}-${'x'.repeat(80)}.md`;
-      groups[scope].push(path);
-      files[path] = `[[Book One/Characters/Hub]]\n`;
-    }
-  }
-  const all = [...groups.canon, ...groups.playground, ...groups.supporting];
-  files['Book One/Characters/Hub.md'] = all.map(path => `[[${path.slice(0, -3)}]]`).join('\n');
-  // Other-universe links are never returned, regardless of rank.
-  files['Second World/Other.md'] = '[[Book One/Characters/Hub]]\n';
-  const s = src(scratchRepo(t, files), mapping(withSupporting));
-  const outs = [], ins = [];
-  let offset = 0, pages = 0;
-  for (; pages < 20; pages++) {
-    const page = await get(s, { universe: 'harbor', path: 'Book One/Characters/Hub.md', from: 999_999, links_from: offset });
-    assert.ok(JSON.stringify(page).length <= QUERY_REPLY_CAP);
-    outs.push(...page.links_out.map(x => x.path)); ins.push(...page.links_in.map(x => x.path));
-    if (page.links_next === null) break;
-    offset = page.links_next;
-  }
-  const expected = [...groups.supporting, ...groups.playground, ...groups.canon];
-  assert.ok(pages > 0 && pages < 20, 'links occupy multiple bounded pages');
-  assert.deepEqual(outs, expected);
-  assert.deepEqual(ins, expected);
-  assert.equal(new Set(outs).size, 300);
-  assert.equal(new Set(ins).size, 300);
-});
-
-test('C2-05c manuscript still refuses supporting rather than silently widening its scope', async t => {
-  const s = src(scratchRepo(t, SUPPORT_FILES), mapping(withSupporting));
-  await assert.rejects(manuscript(s, { universe: 'harbor', book: 'Book One', scope: 'supporting' }), { code: 'query-argument-invalid' });
-});
-
-test('C2-05c scope expansion keeps hybrid sources canon-only and refuses all/array scopes', async t => {
-  const s = src(scratchRepo(t, SUPPORT_FILES), mapping(entry => withSupporting(WITH_BLEND(entry))));
-  assert.deepEqual((await find(s, { universe: 'blend', query: '', scope: 'supporting' })).results, []);
-  assert.equal(await get(s, { universe: 'blend', path: 'Book One/Support/Notes/Helper.md', scope: 'supporting' }), null);
-  assert.equal((await get(s, { universe: 'blend', path: 'Book One/Characters/Canon.md' })).scope, 'canon');
-  for (const scope of ['all', ['canon', 'supporting']])
-    await assert.rejects(get(s, { universe: 'harbor', path: 'Book One/Characters/Canon.md', scope }), { code: 'query-argument-invalid' });
-});

packages/library/tests/scope.test.mjs

@@ -53,44 +53,3 @@ test('C2-01c: a canon file linking into a draft gives R6, and into its own unive
     assert.deepEqual(codes(path), [], path);
   }
 });
-
-// Supporting prefixes at three levels (C2-01d). Harbor's book-level prefix sits in both lists, and a
-// second book-level prefix is supporting only.
-const supporting = () => mapping(e => {
-  e.universes.harbor.playground = ['Book One/Playground/', 'Book One/Sketches/'];
-  e.universes.harbor.supporting = ['Book One/Playground/', 'Book One/Notes/', 'Harbor Notes/'];
-  e.universes.idea = { kind: 'draft', name: 'New World', playground: ['Drafts/New World/'], supporting: ['Drafts/New World Notes/'] };
-  return e;
-});
-
-test('C2-01d: each supporting level gives its universe, and its book or null', () => {
-  const m = supporting();
-  assert.deepEqual(classify(m, 'Book One/Notes/Characters/Mara.md'),
-    { scope: 'supporting', universe: 'harbor', book: 'Book One', type: 'character', folder: 'Characters' });
-  assert.deepEqual(classify(m, 'Harbor Notes/Places/Island.md'),
-    { scope: 'supporting', universe: 'harbor', book: null, type: 'place', folder: 'Places' });
-  assert.deepEqual(classify(m, 'Harbor Notes/Loose.md'), { scope: 'supporting', universe: 'harbor', book: null, type: null, folder: null });
-  assert.deepEqual(classify(m, 'Drafts/New World Notes/Chapters/Open.md'),
-    { scope: 'supporting', universe: 'idea', book: null, type: 'manuscript', folder: 'Chapters' });
-  assert.deepEqual(classify(m, 'Drafts/New World/Ana.md'), { scope: 'playground', universe: 'idea', book: null, type: null, folder: null });
-  assert.deepEqual(classify(m, 'Book One/Places/Dock.md'), { scope: 'canon', universe: 'harbor', book: 'Book One', type: 'place', folder: 'Places' });
-});
-
-test('C2-01d: supporting comes before playground; a folder in both lists is supporting, one in the playground only stays playground', () => {
-  const m = supporting();
-  assert.deepEqual(classify(m, 'Book One/Playground/What If.md'),
-    { scope: 'supporting', universe: 'harbor', book: 'Book One', type: null, folder: null });
-  assert.deepEqual(classify(m, 'Book One/Sketches/Research/Tides.md'),
-    { scope: 'playground', universe: 'harbor', book: 'Book One', type: 'research', folder: 'Research' });
-  // A playground may hold a supporting prefix of its own entry: the inner folder is supporting.
-  const nested = mapping(e => { e.universes.harbor.supporting = ['Book One/Playground/Notes/']; return e; });
-  assert.equal(classify(nested, 'Book One/Playground/Notes/A.md').scope, 'supporting');
-  assert.equal(classify(nested, 'Book One/Playground/A.md').scope, 'playground');
-});
-
-test('C2-01d: only .md files are supporting; a .canvas or .base under a supporting prefix is unmapped', () => {
-  const m = supporting();
-  for (const path of ['Book One/Notes/Board.canvas', 'Harbor Notes/Table.base', 'Drafts/New World Notes/Map.canvas',
-    'Harbor Notes/cover.png', 'Harbor Notesx/a.md'])
-    assert.deepEqual(classify(m, path), { scope: 'unmapped' }, path);
-});

packages/library/tests/supporting.test.mjs

@@ -1,91 +0,0 @@
-import test from 'node:test';
-import assert from 'node:assert/strict';
-import { LibraryError, supportingPath } from '../src/index.mjs';
-import { mapping } from './helpers.mjs';
-
-// C2-01d (M12): the path checks an agent write passes. The tree is a listTree array built by hand,
-// with a symlink, a gitlink, case twins and an NFC name, so no git is needed.
-const m = mapping(e => {
-  e.universes.harbor.playground = ['Book One/Playground/', 'Book One/Sketches/'];
-  e.universes.harbor.supporting = ['Book One/Playground/', 'Book One/Notes/', 'Harbor Notes/'];
-  e.universes.second.supporting = ['Second Notes/'];
-  e.universes.idea = { kind: 'draft', name: 'New World', playground: ['Drafts/New World/'], supporting: ['Drafts/New World Notes/'] };
-  return e;
-});
-const blob = (path, mode = '100644') => ({ mode, type: mode === '160000' ? 'commit' : 'blob', oid: '0'.repeat(40), size: 1, path });
-const tree = [
-  blob('Book One/Characters/Mara Vell.md'),
-  blob('Book One/Notes/Existing.md'),
-  blob('Book One/Notes/Linked', '120000'),
-  blob('Book One/Notes/Vendor', '160000'),
-  blob('Book One/Notes/Pointer.md', '120000'),
-  blob('Book One/Notes/Case/Twin.md'),
-  blob('Book One/Notes/Café.md'),
-  blob('Harbor Notes/Places/Island.md'),
-];
-const refuses = (universe, path, pattern) => assert.throws(() => supportingPath(m, universe, path, tree),
-  e => e instanceof LibraryError && e.code === 'library-write-story-path' && pattern.test(e.message), JSON.stringify(path));
-
-test('C2-01d: a path passes at book level, universe level, in a draft and in a folder in both lists', () => {
-  for (const [universe, path] of [['harbor', 'Book One/Notes/Characters/New.md'], ['harbor', 'Book One/Notes/Existing.md'],
-    ['harbor', 'Harbor Notes/Places/Island.md'], ['harbor', 'Harbor Notes/Loose.md'], ['idea', 'Drafts/New World Notes/Ana.md'],
-    ['harbor', 'Book One/Playground/What If.md'], ['second', 'Second Notes/A.md'], ['harbor', 'Book One/Notes/Café.md']])
-    assert.equal(supportingPath(m, universe, path, tree), path);
-  assert.equal(supportingPath(m, 'harbor', 'Book One/Notes/x.md', []), 'Book One/Notes/x.md');
-});
-
-test('C2-01d: a path of exactly 1024 bytes passes, and 1025 bytes made of multi-byte characters refuses', () => {
-  const prefix = 'Harbor Notes/';
-  const exact = `${prefix}${'a'.repeat(1024 - prefix.length - 3)}.md`;
-  assert.equal(Buffer.byteLength(exact), 1024);
-  assert.equal(supportingPath(m, 'harbor', exact, tree), exact);
-  // é is two bytes: 1025 bytes but far fewer characters.
-  const name = 'é'.repeat((1025 - prefix.length - 3 - 1) / 2);
-  const long = `${prefix}${name}a.md`;
-  assert.equal(Buffer.byteLength(long), 1025);
-  assert.ok(long.length < 1024);
-  refuses('harbor', long, /is longer than 1024 bytes/);
-});
-
-test('C2-01d: a path outside the universe\'s supporting folders refuses', () => {
-  const outside = /is not under a supporting folder of universe/;
-  for (const path of ['Inbox Note.md', 'Book One/Notes/Board.canvas', 'Book One/Notes/Table.base', 'Book One/Notes/cover.png',
-    'Book One/Characters/Mara Vell.md', 'Book One/Sketches/Idea.md', 'Drafts/New World/Ana.md', 'Second Notes/A.md', 'Book One/Notes.md'])
-    refuses('harbor', path, outside);
-  refuses('idea', 'Book One/Notes/A.md', /universe "idea"/);
-  refuses('nowhere', 'Book One/Notes/A.md', /universe "nowhere"/);
-});
-
-test('C2-01d: malformed paths refuse by class, in order', () => {
-  refuses('harbor', '/Book One/Notes/A.md', /"\/Book One\/Notes\/A.md" is absolute/);
-  for (const path of ['Book One/Notes/../Notes/A.md', 'Book One/Notes/./A.md', 'Book One//Notes/A.md', 'Book One/Notes/A/', 'Book One/Notes/..'])
-    refuses('harbor', path, /has an empty, \. or \.\. segment/);
-  refuses('harbor', 'Book One/Notes/A\\B.md', /holds a backslash/);
-  for (const c of ['\u0000', '\u0001', '\n', '\u001f', '\u007f', '\u0085', '\u009f'])
-    assert.throws(() => supportingPath(m, 'harbor', `Book One/Notes/A${c}.md`, tree),
-      e => e.code === 'library-write-story-path' && e.message === 'library-write-story-path: the path holds a control character');
-  for (const path of [7, null, undefined, 1n, ['Book One/Notes/A.md']]) refuses('harbor', path, /the path must be a string/);
-  // A backslash in a path that is also absolute names the backslash: the order is fixed.
-  refuses('harbor', '/a\\b.md', /holds a backslash/);
-  assert.throws(() => supportingPath(m, 'harbor', 'Book One/Notes/A.md', { 'Book One/Notes/A.md': '100644' }), TypeError);
-  assert.throws(() => supportingPath(m, 'harbor', 'Book One/Notes/A.md'), TypeError);
-});
-
-test('C2-01d: a symlink or gitlink on the way, or at the path itself, refuses', () => {
-  refuses('harbor', 'Book One/Notes/Linked/A.md', /goes through the symlink or gitlink "Book One\/Notes\/Linked"/);
-  refuses('harbor', 'Book One/Notes/Vendor/Deep/A.md', /goes through the symlink or gitlink "Book One\/Notes\/Vendor"/);
-  refuses('harbor', 'Book One/Notes/Pointer.md', /goes through the symlink or gitlink "Book One\/Notes\/Pointer.md"/);
-});
-
-test('C2-01d: a name that differs from a tree name only in case or Unicode form refuses, at the file or any folder', () => {
-  refuses('harbor', 'Book One/Notes/existing.md', /differs only in case or Unicode form from "Book One\/Notes\/Existing.md"/);
-  refuses('harbor', 'Book One/Notes/case/New.md', /differs only in case or Unicode form from "Book One\/Notes\/Case"/);
-  refuses('harbor', 'Book One/Notes/CASE/Twin.md', /from "Book One\/Notes\/Case"/);
-  refuses('harbor', 'Harbor notes/A.md', /is not under a supporting folder/);
-  // NFD e + combining acute against the NFC name in the tree: one file on APFS.
-  refuses('harbor', 'Book One/Notes/Café.md', /differs only in case or Unicode form from "Book One\/Notes\/Café.md"/);
-  // A tree that already holds case twins refuses a write to either (R7).
-  const twins = [...tree, blob('Book One/Notes/existing.md')];
-  for (const path of ['Book One/Notes/Existing.md', 'Book One/Notes/existing.md'])
-    assert.throws(() => supportingPath(m, 'harbor', path, twins), e => e.code === 'library-write-story-path' && /differs only in case/.test(e.message));
-});

packages/library/tests/survey.test.mjs

@@ -1,6 +1,6 @@
 import test from 'node:test';
 import assert from 'node:assert/strict';
-import { readFileSync, writeFileSync } from 'node:fs';
+import { writeFileSync } from 'node:fs';
 import { join } from 'node:path';
 import { spawnSync } from 'node:child_process';
 import { fileURLToPath } from 'node:url';
@@ -70,23 +70,12 @@ test('with --mapping the survey adds scope, resolver step and problem counts', a
   assert.equal(out.code, 0, out.stderr);
   const tail = out.stdout.trimEnd().split('\n').slice(-3);
   assert.deepEqual(tail, [
-    'scopes canon 5, playground 1, supporting 0, unmapped 3; indexed 6',
+    'scopes canon 5, playground 1, unmapped 3; indexed 6',
     'resolved root 2, vault-prefix 1, relative 2, shortest 3, unresolved 0',
     'problems R1 0, R2 3, R3 0, R4 0, R5 0, R6 0, R7 0']);
   for (const s of NEVER) assert.ok(!out.stdout.includes(s), s);
 });
 
-test('C2-01d: with --mapping the survey counts supporting files', async t => {
-  const r = repo(t);
-  const entry = JSON.parse(readFileSync(join(FIXTURES, 'mapping.json'), 'utf8'));
-  entry.universes.harbor.supporting = ['Book One/Places/'];
-  const file = join(r.root, 'supporting.json');
-  writeFileSync(file, JSON.stringify(entry));
-  const out = await run(['survey', r.repo, '--mapping', file]);
-  assert.equal(out.code, 0, out.stderr);
-  assert.match(out.stdout, /^scopes canon 4, playground 1, supporting 1, unmapped 3; indexed 6$/m);
-});
-
 test('survey exit codes: usage 4, bad mapping 3, unreadable repo 2', async t => {
   const r = repo(t);
   for (const args of [[], ['scan', r.repo], ['survey'], ['survey', r.repo, '--mapping'], ['survey', r.repo, '--other'], ['survey', r.repo, r.repo]])

scripts/test-federation-acceptance.sh

@@ -0,0 +1,111 @@
+#!/usr/bin/env bash
+# FED R7 / #1802. Scratch acceptance with labelled ancestry stand-in (sage-3625).
+# No systemd units. All children run in owned process groups, removed on exit.
+set -euo pipefail
+R7_INTERRUPT=0
+case "${1:-}" in
+  '') ;;
+  --kill-after-start) R7_INTERRUPT=1 ;;
+  *) echo 'usage: scripts/test-federation-acceptance.sh [--kill-after-start]' >&2; exit 2 ;;
+esac
+[ "$#" -le 1 ] || exit 2
+for R7_TOOL in ss rg timeout node ps awk; do
+  command -v "$R7_TOOL" >/dev/null || { echo "R7 requires $R7_TOOL" >&2; exit 1; }
+done
+cd "$(dirname "${BASH_SOURCE[0]}")/.."
+R7_ROOT="$(mktemp -d /mnt/storage/scratch/tmp/r7.XXXXXXXX)"
+mkdir -p "$R7_ROOT/home" "$R7_ROOT/tmp"
+touch "$R7_ROOT/groups" "$R7_ROOT/ports" "$R7_ROOT/sockets"
+
+cleanup() {
+  local result=$? pid start raw port socket listeners cleanup_failed=0 attempt
+  local -a fields
+  trap - EXIT INT TERM
+  if [ -n "${R7_DRIVER:-}" ]; then
+    kill -TERM "$R7_DRIVER" 2>/dev/null || true
+    wait "$R7_DRIVER" 2>/dev/null || true
+  fi
+  # A detached child is its group's leader. Confirm pid/start time/group before
+  # signalling only groups in this run's ledger; never a live stack process.
+  while read -r pid start; do
+    [ -n "$pid" ] || continue
+    if [ -r "/proc/$pid/stat" ]; then
+      raw="$(cat "/proc/$pid/stat")"
+      read -r -a fields <<< "${raw##*) }"
+      if [ "${fields[19]}" != "$start" ] || [ "${fields[2]}" != "$pid" ]; then
+        echo "R7 cleanup failed: group identity changed: $pid" >&2
+        result=1; cleanup_failed=1
+        continue
+      fi
+      kill -TERM -- "-$pid" 2>/dev/null || true
+      for ((attempt=0; attempt<800; attempt++)); do
+        ps -eo pgid=,stat= | awk -v g="$pid" '$1==g && $2 !~ /^Z/ {found=1} END {exit !found}' || break
+        sleep 0.05
+      done
+      kill -KILL -- "-$pid" 2>/dev/null || true
+      for ((attempt=0; attempt<40; attempt++)); do
+        ps -eo pgid=,stat= | awk -v g="$pid" '$1==g && $2 !~ /^Z/ {found=1} END {exit !found}' || break
+        sleep 0.05
+      done
+    fi
+    # Zombies hold no tools/listeners and are reaped by their parent. The test
+    # requires no live member of an owned group, including orphan descendants.
+    if ps -eo pgid=,stat= | awk -v g="$pid" '$1==g && $2 !~ /^Z/ {found=1} END {exit !found}'; then
+      echo "R7 cleanup failed: group $pid still has a live process" >&2
+      result=1; cleanup_failed=1
+    fi
+  done < "$R7_ROOT/groups"
+  while IFS= read -r port; do
+    [ -n "$port" ] || continue
+    if ! listeners="$(ss -H -ltn "sport = :$port")"; then
+      echo "R7 cleanup failed: cannot inspect port $port" >&2
+      result=1; cleanup_failed=1
+    elif [ -n "$listeners" ]; then
+      echo "R7 cleanup failed: port $port still listens" >&2
+      result=1; cleanup_failed=1
+    fi
+  done < "$R7_ROOT/ports"
+  while IFS= read -r socket; do
+    [ -n "$socket" ] || continue
+    if ! listeners="$(ss -H -lx)"; then
+      echo "R7 cleanup failed: cannot inspect socket $socket" >&2
+      result=1; cleanup_failed=1
+    elif printf '%s\n' "$listeners" | rg -F -- "$socket" >/dev/null; then
+      echo "R7 cleanup failed: socket $socket still listens" >&2
+      result=1; cleanup_failed=1
+    fi
+  done < "$R7_ROOT/sockets"
+  if listeners="$(ss -H -lx)"; then
+    if printf '%s\n' "$listeners" | rg -F -- "$R7_ROOT/" >/dev/null; then
+      echo 'R7 cleanup failed: another scratch Unix listener remains' >&2
+      result=1; cleanup_failed=1
+    fi
+  else
+    result=1; cleanup_failed=1
+  fi
+  if [ "$result" -ne 0 ]; then
+    for raw in "$R7_ROOT"/*.log; do
+      [ -f "$raw" ] || continue
+      echo "R7 diagnostic: ${raw##*/}" >&2
+      tail -40 "$raw" >&2
+    done
+  fi
+  rm -rf -- "$R7_ROOT"
+  if [ -e "$R7_ROOT" ]; then
+    echo 'R7 cleanup failed: scratch directory remains' >&2
+    result=1; cleanup_failed=1
+  fi
+  if [ "$cleanup_failed" -eq 0 ]; then echo 'R7 cleanup: no child groups, ports or sockets remain; no units created'; fi
+  exit "$result"
+}
+trap cleanup EXIT
+trap 'exit 130' INT
+trap 'exit 143' TERM
+# No host configuration, preload hooks, credentials or agent env in fixtures.
+# The ancestry stand-in lives only in federation-host.mjs, per sage-3625.
+timeout -k 10 210 env -i PATH="$PATH" HOME="$R7_ROOT/home" TMPDIR="$R7_ROOT/tmp" \
+  MOSAIC_R7_ROOT="$R7_ROOT" MOSAIC_R7_INTERRUPT="$R7_INTERRUPT" \
+  node --test --test-concurrency=1 packages/cli/tests/federation-acceptance.test.mjs &
+R7_DRIVER=$!
+wait "$R7_DRIVER"
+R7_DRIVER=