row 298 (#1804 ): UNTESTED handoff to Boyd (mos-1502). launch.grantScope shape, fallback and match (vocabulary.mjs), the one writer (instance-settings grantScope), broker grants.scope/grants.scope.set gated by #human alone, in-scope close via 'scope' with grant.scope.used, scope-changed recheck, cli grants scope|scope set, business and bus tests. No node run; project-runtime.test.mjs import pin not yet updated; docs and BUILD.md not updated

row 298 (#1804 ): BUILD.md design D1-D6 and open questions Q1-Q6 for Sage; no code yet
2026-10-23 14:11:35 -05:00 · 2026-10-23 13:57:04 -05:00
36 changed files with 771 additions and 2796 deletions
@@ -1,170 +0,0 @@
-# Row 224 — C2-05b broker lookups and typed tools (#1725)
-
-Owner: Della; reviewer: Dewey. Assignment sage-2795; scope extension sage-2804.
-Base: `4f3fbc25a` (Researcher C2-05a). Branch: `della/row224`.
-Brief: C2-05b in `docs/plans/2026-10-20_case2-rows.md` at `aca16404c`
-and `51cc0445c`; design section 3, 5.3 M3 and 7.2; C2-05a BUILD rulings.
-
-## Execution boundary and progress
-
-Code/docs and local Git only while row 253 holds the gate. No Node (including
-syntax checks), HTTPS Git, queue claim, test or push until Sage's CLEAR.
-Tests are written first; their RED/GREEN runs are deferred, not claimed.
-Queue next is deferred too: its executable uses Node. Sage assigned this row
-explicitly. After 253 and 216 land, rebase under a new branch name.
-
- Pre-flight: query.mjs consumes `{repo,commit,mapping}`; broker cannot import
-  Git/filesystem library code because it is in the sandbox import closure.
-  Runtime injects the host lookup adapter; existing human file/status/sync stay.
- Pre-flight: resolved has no project list and a library is never a checkout.
-  Bundle needs an explicit library flag from launcher business configuration.
- M3 reading: exact creative base is five lookups plus send_message; retain
-  explicitly granted broker web_search/web_fetch for research/companion under
-  landed C2-08 and sage-2804. No generic spec, task, evidence or decision tools. Residual (mos-1308): those
-  reads lack broker action checks; their typed-tool absence is the only fence
-  for creative roles. M1/M2 deny bash; broker-side refusal is outside this row.
-  Mos confirmed this interpretation in mos-1308; design wording fix belongs to Gosalyn. Other definitions retain their current tools.
- Multi-library businesses use an optional project ID; omit it only with one
-  configured library. Universe is required for all five tools, including get.
- Missing library uses the brief's `library-not-configured`; argument errors
-  reuse `invalid-request` and C2-05a query codes. No new action or authority.
-
-## Manifest (draft code, unrun)
-
- bus/src/broker.mjs: five lookup verbs, strict args, holder/business rechecks.
- bus/src/runtime.mjs: host lookup adapter, stale-before-read sync, served pin.
- harness/src/tools.mjs: five schemas; creative exact-set filtering.
- harness/src/bundle.mjs: library flag forwarded to typedTools.
- cli/src/launcher.mjs: one flag derived from trusted business projects.
- bus/tests/library-lookups.test.mjs: real query/broker/socket/runtime cases.
- harness/tests/library-tools.test.mjs: schemas, role snapshots, bundle parity.
- cli/tests/thread-launch.test.mjs: flag reaches a real launched bundle with no library checkout.
- agents/della/work/queue-224/BUILD.md: manifest, rulings and deferred verification ledger.
-
-## Verification ledger
-
-No test or syntax-check run yet. Acceptance requires full bus/cli/harness suites
-and every scripts/test-*.sh on Sage's gate; focused files and affected CLI/
-seat import-closure tests precede that only in an authorized CLEAR.
-
-## Coordination
-
-Huey272 reports no runtime/bundle/launcher overlap. Rocko219 changes launcher
-THREAD_DEFINITIONS checks only, separate from our buildBundle flag argument.
-The launcher argument is required: bundle cannot derive library presence from
-checkout IDs (a library has no agent clone). No role, authority or config schema
-changes; library project entries are already validated and protected by M9.
-
-## Mount and pin impact (inspection only)
-
-No new imports in broker.mjs or tools.mjs; no RUNNER_FILES or sandbox mount
-addition. runtime.mjs is host-only and already imports library index.mjs.
-Bundle forwards only a boolean, never a root/mapping/slot/credential. The
-existing import-closure tests are bus/tests/project-runtime.test.mjs and
-seat/tests/sandbox.test.mjs. Grep found no literal sha256 pin for runtime.mjs
-or bundle.mjs; bundle tests derive current source digests through SOURCES.
-Library sources remain in the existing whole-directory release copy.
-
-## Runs to schedule only after CLEAR
-
-Set TMPDIR=/mnt/storage/scratch/tmp. Focused new bus/harness files first,
-then existing library.test.mjs, library-sync.test.mjs, project-runtime.test.mjs,
-harness creative/tools/spec-tools/bundle files and affected CLI launch tests.
-Follow with the required whole bus/cli/harness suites and Sage's full shell gate.
-No timing claim yet: use the repository/Sage per-file limits and record every
-command, outcome, elapsed time and timeout before acceptance. No focused skip
-or pattern run substitutes for whole-file gate evidence.
-
-## Read-through findings and residuals
-
- Library get requires universe although the older design table omitted it;
-  section 3 isolation rule and C2-05a's accepted API are binding.
- Query type enum matches mapping.TYPES (five values); manuscript is a distinct
-  lookup and not a find type. Unknown host-path/commit/business/accept fields
-  are refused; explicit project is restricted to this business's library list.
- Async reads recheck the live holder and current project revision. A stale
-  read attempts sync, then takes the new served snapshot; a returned fetch
-  failure/divergence keeps serving the old pin. Busy sync uses the current pin.
-  Unreadable state, no served commit or unsafe configuration refuse. Query
-  and sync never hold a SQLite transaction over await.
- Processing halt refuses new agent lookup work and rechecks before returning
-  async results. Existing human library file/status/sync behavior is unchanged.
- Timer sync and reads still use C2-03a's 60-second contract. No timer tuning or
-  resource-limit schema is introduced by this row. Q222 creative reply settings
-  are in C2-06; no reply guard or writing capability is implemented here.
- The generic tool socket's existing 60-second client timeout can precede the
-  server's 120-second Git timeout. This row does not change the generic timeout;
-  a timed-out lookup is read-only and retryable, never a write/outcome claim.
- All tests are authored but unrun. No RED, GREEN, syntax, runtime performance,
-  sandbox, broker/harness suite, shell gate, claim or push evidence exists yet.
-
-## Candidate review checklist (read-through only)
-
- [x] Five verbs mapped to real C2-05a methods, all require universe.
- [x] Default sole library or explicit owned project; no caller repo/commit.
- [x] Human-only file/status/sync gates kept; lookup holder rechecked.
- [x] Async socket dispatch includes lookup verbs through LIBRARY_VERBS.
- [x] Stale/unknown fetch syncs first; results use current immutable served pin.
- [x] Six/eight creative names per mos-1308; other roles retain their tools.
- [x] Launcher -> bundle -> typedTools passes presence without a library clone.
- [x] No imports added to sandbox source closure; no mount change.
- [ ] Execute new tests, RED characterization, full files/suites after CLEAR.
- [ ] Rebase after rows 253/216 land, under a new branch name.
- [ ] Claim/push only in Sage-authorized gap; Dewey review and Sage gate.
-
-Candidate preservation commits are explicitly unrun under sage-2795; they are
-not completion, green-suite or landing claims. No dependencies installed.
-
-Correction: the first committed-range diff --check found a blank line at EOF
-in the new library-tools test, missed while it was untracked. Removed in a
-follow-up local commit; the complete range must be checked again. No tests ran.
-
-## Shared-log receipts for Sage (sage-2815)
-
-The shared logs are unchanged from the base in this row. Sage appends these
-receipts in the landing sweep; they are preserved here, not in the manifest.
-
-For `BUILD-LOG.md`:
-
-```text
-2026-10-22T16:36:30Z | Della row224 C2-05b #1725 preparation | Before: C2-05a queries exist at 4f3fbc25a but no broker lookup verbs or typed tools. Scope: broker/tools plus Sage-authorized runtime/bundle integration, tests and docs. Existing human-only library reads retained; five agent queries require a live holder and trusted configured source. Code/docs only under row253 gate; no Node/test/push/claim. Runtime ownership coordinated with Rocko219/Huey272.
-```
-
-For `docs/SESSIONS.md`:
-
-```text
-2026-10-22T16:36:30Z | Della (sage-2795 / sage-2804, Q220) | Row 224 C2-05b #1725, della/row224 base 4f3fbc25a | Read both pinned briefs and C2-05a source; preparing broker/typed tools and authorized host runtime/bundle seams. No queue command, Node, HTTPS Git, claim, test or push during Gander gate. Dewey reviewer; Rocko/Huey runtime coordination sent. Tests and integration verification deferred to CLEAR.
-```
-
-Local-only draft pins 19c0a7adf/7cf39c390 are superseded by the
-log-free candidate. Saved as local branch della/row224-draft-with-logs before
-rebuilding the unpublished candidate commit; no remote history changed.
-
-## Dewey dewey-0852 and Sage sage-2819 — focused corrections
-
-B1: inline freshness uses max(lastFetch, lastError.at), not lastFetch alone.
-An error within 60 seconds counts as a recent attempt, so later lookups serve
-the old served pin without another fetch. Keep inline sync: the brief requires
-it and businesses without timed libraries have no sync timer. The extended
-failed-fetch test makes reads at +1, +59,999 and +60,000 ms (one attempt total),
-then +60,001 ms (second attempt). All reads must return the old commit.
-
-Required mutant M-B1: remove lastError.at from recentAttempt. The repeated
-reads must fail the attempted-count assertion. This mutant has NOT been run.
-
-Residual (Sage will defer): the first inline fetch in each outage window can
-still exceed the tool timeout (60 seconds, or the runner broker client’s
-30 seconds). Bounding that fetch is out of scope for 224. Subsequent reads
-are paced by persisted lastError.at. No claim of first-read outage latency.
-
-N1: whole bus, cli and harness suites are required, plus the shell gate.
-If the new thread-launch integration test skips due to sandboxProblem(),
-name the skip; a skip is not launcher integration proof.
-N2: cli/tests/thread-launch.test.mjs now depends on library/tests/helpers.mjs
-mappingEntry() and library/tests/fixtures/mapping.json. Changes to that fixture
-must rerun the CLI launch file.
-N3: harness/tests/library-tools.test.mjs compares the type enum to mapping.mjs
-TYPES, so adding a mapped type cannot silently leave the typed tool behind.
-
-These edits are local code/docs only. No Node, RED/GREEN run, mutant, claim,
-HTTPS Git or push. New local pin goes to Dewey/Mos/Sage for focused review.
@@ -1,196 +0,0 @@
-# Row284 C2-05c — supporting scope and served-tree blob (#1789)
-
-Owner Della; reviewer Dewey; gate Sage. Build start sage-3658/3660 (10-23).
-Branch della/row284. Original prerequisite base Honker28346bad7ea3;
-merge fc05bcbc3 carries22423816cf28 and2164f3fbc25a intact. Only conflict was
-CLI thread-launch's added footer tests: retained both full test bodies and
-assertions. No prerequisite code copied. Every prerequisite needs its own
-review/mutants/landing under mos1351; rebase after283 lands.
-
-## Execution status
-
-UNTESTED. No Node, node--check, test or mutant run before Sage CLEAR. First
-own commit is the authorized old-test migration; the implementation follows.
-Sage authorizes an immediate untested push. No queue write or shared-log edit.
-224 stays first;284 is critical to Bubba288. T4 for224 is not a CLEAR yet.
-
-## Binding readings
-
-Brief C2-05c at94c33a43c:1737-1789, Q226, sage2918 and mos1330 item3.
-get defaults canon; explicit playground/supporting opt-in; mismatch null.
-Sort full outgoing/incoming lists supporting, playground, canon before paging,
-keep cross-scope links and universe filter. Manuscript stays canon/playground.
-No all/array scope, write tool, guard, mapping or creative-name-count change.
-
-## mos-1330 old-test migration (separate commit)
-
-All paths below are packages/library/tests/query.test.mjs. Baseline file at
-fc05bcbc3 matches216's file. Source assertions retained; negative calls receive
-explicit scope too, so universe isolation cannot pass on default-scope denial.
-
-Call/assertion 348 -> 348:
-
-```js
-// OLD
-  const rin = await get(s, { universe: 'idea', path: 'Drafts/New World/Characters/Rin.md' });
-// NEW
-  const rin = await get(s, { universe: 'idea', path: 'Drafts/New World/Characters/Rin.md', scope: 'playground' });
-```
-
-Call/assertion 350 -> 350:
-
-```js
-// OLD
-  assert.equal(await get(s, { universe: 'harbor', path: 'Drafts/New World/Characters/Rin.md' }), null);
-// NEW
-  assert.equal(await get(s, { universe: 'harbor', path: 'Drafts/New World/Characters/Rin.md', scope: 'playground' }), null);
-```
-
-Call/assertion 366 -> 366:
-
-```js
-// OLD
-  assert.equal(await get(src(ref, mapping(WITH_BLEND)), { universe: 'blend', path }), null);
-// NEW
-  assert.equal(await get(src(ref, mapping(WITH_BLEND)), { universe: 'blend', path, scope: 'playground' }), null);
-```
-
-Call/assertion 367 -> 367:
-
-```js
-// OLD
-  const own = await get(src(ref), { universe: 'harbor', path });
-// NEW
-  const own = await get(src(ref), { universe: 'harbor', path, scope: 'playground' });
-```
-
-Assertion 349 retained, OLD == NEW:
-
-```js
-  assert.equal(rin.scope, 'playground');
-```
-
-Assertion 368 retained, OLD == NEW:
-
-```js
-  assert.equal(own.scope, 'playground');
-```
-
-The null assertions at350 and366 are the complete OLD/NEW expressions above:
-expectation remains null. Added one separate no-scope playground-get -> null
-behavior test. It is unrun and expected to expose old get behavior until the
-new scope implementation lands. This migration is authorized by mos1330 under
-mos1272; no check removed or weakened. Dewey checks this list in manifest review.
-
-## 283 surface and blob choice
-
-Inspected actual46bad7ea3: optional editor.user is present. reader's parsed
-file records and index entries still discard tree oid. In owned query.mjs use
-the existing bounded listTree(repo, servedCommit) to obtain exact path oid,
-not HEAD and not a user-supplied revision expression. No reader/index edit.
-Tradeoff: one additional bounded tree listing per get; latency unmeasured.
-Recheck after rebasing to283's actual landing.
-
-## Intended owned paths
-
-query.mjs; broker.mjs lookup branch; tools.mjs lookup schemas/descriptions;
-library query.test.mjs/query-fixture.mjs; bus library-lookups.test.mjs;
-harness library-tools.test.mjs; this BUILD.md. Other files are prerequisites.
-
-## Gate
-
-Dewey manifest approval, whole library/bus/harness suites and every
-scripts/test-*.sh on Sage gate. Before review grep all package tests for enum
-pins and canon/playground pairs. Keep shared logs out; send receipts to Sage.
-No test or mutant evidence claimed. Manifest/digest follows complete code.
-
-## Implementation head (UNTESTED, sage-3658)
-
- query scope accepts supporting for find/search/get. get defaults canon,
-  mismatch null. Manuscript passes a separate two-value scope allowlist.
- get returns blob from listTree(source.repo,index.commit) after scope/universe
-  filtering. The same index.commit supplies the text; source HEAD is irrelevant.
- Full outgoing and incoming link lists are stably sorted by supporting,
-  playground,canon before combining/paging. All visible cross-scope links stay;
-  universe/hybrid visibility still applies. Scope metadata isn't added to links.
- Broker only adds optional scope to library.get's strict fields. No new verbs.
- Typed scope expands find/search/get only; manuscript retains its own two-value
-  enum. Names/M3 counts remain the row224 six/eight, no write tools added.
- New tests: book/universe/draft supporting find/search/get; defaults/mismatch;
-  absent supporting prefix; source HEAD advances but each scope's blob equals
-  served:path; 300 outgoing plus300 incoming links ordered across bounded pages,
-  retaining cross-scope links and dropping other-universe links; hybrid source
-  stays canon-only; no all/array scope; manuscript rejects supporting; broker
-  scope/blob forwarding; typed enums and unchanged names. All unrun.
-
-## Additional old assertion pin (brief Gate)
-
-harness/tests/library-tools.test.mjs:49 at23816cf28 (line49, unchanged in this head):
-OLD find scope enum ['canon','playground']; NEW ['canon','playground','supporting'].
-This is the exact scope-enum pin the brief directs updating. Existing six/eight
-name snapshots and TYPES equality assertion are unchanged. The new manuscript
-pin intentionally remains ['canon','playground']. No other two-scope test pin
-was found by rg over packages/*/tests at this build's prerequisite merge.
-
-## Proposed mutation evidence (reviewer confirms final set)
-
-All unrun. Require assertion failures with whole-file runs and pristine restore:
-M1 remove supporting from query SCOPES -> supporting lookup cases.
-M2 drop get's requested-scope comparison -> default/mismatch null cases.
-M3 use source HEAD for blob lookup -> served-tree/advanced-HEAD equality case.
-M4 remove link rank sort -> multi-page outgoing/incoming expected order.
-M5 restrict links to requested scope -> cross-scope link counts/order case.
-M6 drop sees() from visible/link filtering -> second-universe/hybrid cases.
-M7 allow supporting in manuscript validator -> manuscript refusal case.
-M8 omit get scope from broker fields -> real broker supporting get case.
-M9 widen typed manuscript enum -> typed-scope separation case.
-
-## Inspection and pending gate
-
-No production imports change in broker/tools, so no new sandbox closure file
-or mount. query.mjs is host library code and adds existing reader.listTree;
-no new package/export/copy-path file. rg found the one old find scope pin plus
-the intentional new manuscript two-scope pin. Whole library/bus/harness and
-shell gates remain required. CLI integration/merge context is prerequisite224/
-219, not this row's source delta; any changed gate expectation goes to Sage.
-Node checks, tests, mutants and elapsed-time evidence remain absent pending
-CLEAR. The first test-migration commit and this implementation are distinct.
-
-Sage sweep receipt: Della row284 builds on28346bad7ea3 plus intact224 merge;
-mos1330 old-test migration separate, supporting scope/blob implementation and
-fixtures authored, completely UNTESTED. No shared-log/queue write or live action.
-
-## Current assertion anchors after implementation imports
-
-The separate migration commit0ed4fbab9 retains its complete OLD/NEW text
-above. Adding only the fs/path imports in the implementation shifts anchors:
-
-query.test.mjs:130: `const blendCh2 = await get(src(ref, mapping(WITH_BLEND)), { universe: 'blend', path: 'Book One/Chapters/Chapter 02.md' });`
-query.test.mjs:350: `const rin = await get(s, { universe: 'idea', path: 'Drafts/New World/Characters/Rin.md', scope: 'playground' });`
-query.test.mjs:351: `assert.equal(rin.scope, 'playground');`
-query.test.mjs:352: `assert.equal(await get(s, { universe: 'harbor', path: 'Drafts/New World/Characters/Rin.md', scope: 'playground' }), null);`
-query.test.mjs:368: `assert.equal(await get(src(ref, mapping(WITH_BLEND)), { universe: 'blend', path, scope: 'playground' }), null);`
-query.test.mjs:369: `const own = await get(src(ref), { universe: 'harbor', path, scope: 'playground' });`
-query.test.mjs:370: `assert.equal(own.scope, 'playground');`
-
-No result/null assertion changed; scope arguments carry the explicit opt-in.
-
-## Dewey dewey-0941 static review — round2
-
-Static scope fc05bcbc3..47db04eba CLEAN; not a final verdict or test evidence.
-M1-M9 accepted as the final set. Optional M10 not added to this gate.
-N2 taken: keep the existing canon-path supporting-scope mismatch assertion,
-and ADD get(Book One/Support/Notes/Helper.md,scope:supporting) -> null under
-the default mapping with no supporting prefix. The supporting-positive test
-already returns this same path under withSupporting, so the added probe
-pins the missing-prefix case directly. No assertion removed or weakened;
-mos1330's separate migration commit and its retained assertions unchanged.
-
-N1 proposed DEFERRED/follow-up for Sage: retain each tree oid in reader/index
-entries so get can return blob without cat-file/whole ls-tree -r -l per page.
-Current get's result is pinned correctly, but per-page cost grows with the
-library. No performance measurement yet. This optimization needs reader/index
-ownership and separate acceptance/performance evidence; do not silently expand
-284's manifest or change its served-snapshot contract for it.
-
-No Node, tests, mutants or syntax checks run in this round; hold still applies.
@@ -1,211 +0,0 @@
-# Row 283 (#1788) C2-01d build notes (Honker)
-
-Append-only. Design: DESIGN.md d2 16e809457, APPROVE webby-0172. Gate owner Sage, reviewer Webby.
-
-## 2026-10-23 build on 45dca69f6 (sage-3577)
-
-Branch honker/row283-build from origin/refactor 45dca69f6e4bce52834587f66f2ff33ba839ab8a. The old branch
-honker/row283 (16e809457) held only the design, so its two commits were cherry-picked as 398314cf4
-(d1) and 4f66dccde (d2). The DESIGN.md blob equals 16e809457's.
-
-Commits:
- 331653b38: code, README and tests T1-T8.
- 28918824c: the survey.test:73 re-pin, alone (mos-1330 item 4).
- this file.
-
-Nothing has run. No node, test or mutant ran during the build: Darkwing held the slot. Every count
-below is a plan until Sage's CLEAR.
-
-### Drift check (sage-3577)
-
-`git diff --stat 94c33a43c 45dca69f6` (design base to build base) over the paths the tests read or
-hash-pin:
- No change in packages/library, packages/business/src/business.mjs or
-  packages/business/tests/business.test.mjs.
- No test hash-pins a library file. bus library.test and library-sync.test import index.mjs, and
-  stack-copy.test only checks that index.mjs exists.
- webui library-cli.test changed one line and doesn't read scope. The `classify` in webui reads.mjs is
-  the business one, not the library's.
-
-I redo the drift check on BASE..refactor before the in-review move.
-
-### N3 (webby-0169): deepEquals of the mapping output outside packages/library
-
-`git grep -n playground -- 'packages/*/tests/*' ':!packages/library/*'` and the files naming
-`universes` give two files:
- business.test.mjs:20 compares `validateBusinessDocument(...).projects.books` with
-  `checkMapping(mappingEntry())`. That is output against output, so `supporting: []` shows up on both
-  sides. :27 compares only `.playground`.
- library-projects-protected.test.mjs compares file bytes (:31, :32) and change paths (:58), never the
-  mapping output.
-
-No re-pin is needed outside library. Inside library, only the draft deepEqual at mapping.test:48 gains
-`supporting: []`, as the design says.
-
-### Q1 departure (sage-2923) and the :73 re-pin (mos-1330 item 4)
-
-survey.mjs:65 counts `supporting: 0` and formatSurvey prints it. T8 is the only added test
-(survey.test "C2-01d: with --mapping the survey counts supporting files").
-
-mos-1330 item 4, packages/library/tests/survey.test.mjs:73, commit 28918824c:
- old: `'scopes canon 5, playground 1, unmapped 3; indexed 6',`
- new: `'scopes canon 5, playground 1, supporting 0, unmapped 3; indexed 6',`
-
-N2: the pin gains only `supporting 0`. No other text on the line or in that test moved.
-
-### Q2 tradeoff (webby-0169)
-
-A supporting prefix that holds a playground prefix refuses `library-mapping-invalid`. That goes past
-the brief, but it is the fail-closed reading, and it uses an existing code: classify checks supporting
-first, so that playground prefix could never match. The cost is that she can't nest a playground under
-a supporting folder, though she can nest the other way (a playground holding a supporting folder).
-
-### Handoffs
-
- Q4 (webby-0169, sage-2930): the M12 delete rule ("A delete also needs the path to exist at the tip as
-  a 100644 blob", case2 DESIGN.md :308) is not in supportingPath. It binds row 288 (C2-02) via Gitea
-  #1793 comment 30738, with tests for a missing path and a non-100644 entry.
- A save with no `editor` refusing is C2-02's (DESIGN.md section 1).
-
-### Choices the design left open
-
- The book loop is now `againstBooks(owners, list, code)` in mapping.mjs, called once per list. The
-  playground's messages and codes are byte-equal to before.
- A non-string path refuses `library-write-story-path` ("the path must be a string") as part of
-  check 1. A non-array `tree` is a TypeError (DESIGN.md section 3).
- Check 8 builds the tree's names as every path and every folder above it, keyed by
-  `normalize('NFC').toLowerCase()`. A name on the way refuses if its key holds any name other than
-  itself, so a tree that already holds case twins refuses a write to either (R7).
-
-### Mutants (exact strings)
-
-Each applies one replacement to the build tip. Run one at a time, and restore with `git checkout --`
-on the one file before the next.
-
-| Mutant | File | Replace | With | Killed by |
-|---|---|---|---|---|
-| M1 | src/scope.mjs | `const prefix = entry.supporting.find(p => inside(p, path));` | `const prefix = entry.supporting.find(p => inside(p, path) && !entry.playground.some(q => inside(q, path)));` | scope.test "supporting comes before playground", supporting.test "passes at book level" (both-lists path) |
-| M2 | src/mapping.mjs | `if ((inside \|\| holding) && owner !== id)` | `if ((inside \|\| holding) && owner !== id && list !== 'supporting')` | mapping.test "each supporting prefix rule", business.test C2-04 |
-| M3 | src/supporting.mjs | `for (const p of own) if (LINKS.has(modes.get(p)))` | `for (const p of own) if (false && LINKS.has(modes.get(p)))` | supporting.test "symlink or gitlink" |
-| M4 | src/supporting.mjs | `const fold = name => name.normalize('NFC').toLowerCase();` | `const fold = name => name.normalize('NFC');` | supporting.test "case or Unicode form" |
-| M4b | src/supporting.mjs | `const fold = name => name.normalize('NFC').toLowerCase();` | `const fold = name => name.toLowerCase();` | supporting.test "case or Unicode form" (NFD case) |
-| M5 | src/supporting.mjs | `Buffer.byteLength(path, 'utf8') > MAX_BYTES` | `path.length > MAX_BYTES` | supporting.test "1025 bytes" |
-| M6 | src/mapping.mjs | `const IDENT_BAD = /[\u0000-\u001f\u007f-\u009f<>]/;` | `const IDENT_BAD = /[<>]/;` | mapping.test "editor is optional" |
-| M6b | src/mapping.mjs | `const IDENT_BAD = /[\u0000-\u001f\u007f-\u009f<>]/;` | `const IDENT_BAD = /[\u0000-\u001f\u007f-\u009f]/;` | mapping.test "editor is optional" |
-| M7 | src/supporting.mjs | `if (place.scope !== 'supporting' \|\| place.universe !== universe)` | `if (place.scope !== 'supporting')` | supporting.test "outside the universe's supporting folders" |
-| M8 | src/mapping.mjs | `if (sid === pid && s !== p && holds(s, p))` | `if (false && sid === pid && s !== p && holds(s, p))` | mapping.test "each supporting prefix rule" (Workshop case) |
-
-(The `\|` in the table is an escaped `|` in the source text.) Each mutant runs the one test file named,
-plus business.test for M2, under `timeout -k 10 600`. A mutant passes the gate only when its run is red
-on the named test and the restored file's sha256 equals the build tip's.
-
-### Gate plan (on Sage's CLEAR)
-
-1. The touched files whole, each under `timeout -k 10 600`: library mapping, scope, supporting and
-   survey tests, and business.test.mjs. Counts go below.
-2. M1-M8 as above.
-3. The full gate, under mos-1275 timeouts: `node --test packages/library/tests/` and
-   `node --test packages/business/tests/` each under `timeout -k 10 1800`, and every scripts/test-*.sh
-   under `timeout -k 10 300`. pipefail and tee, with skips named (test-task Docker groups).
-4. Before in-review: grep packages/*/tests for a 64-hex pin on any changed file and for the changed
-   message text, then the drift check on BASE..refactor.
-
-## 2026-10-23 Webby early look (webby-0227, static, not a verdict)
-
- E1: business.test.mjs is an existing test file with a 4-line addition after the playground refusal.
-  The in-review request lists it next to survey.test:73.
- E3 fixed: supportingPath now runs the string check before `JSON.stringify`, so a BigInt (or any
-  non-string) path refuses `library-write-story-path` instead of throwing a TypeError.
-  supporting.test's string case now covers 7, null, undefined, 1n and an array.
- E2 open: `editor` takes surrounding whitespace, and git trims it at commit, so the saved ident and
-  the commit ident can differ. DESIGN.md section 1 says "non-empty after trim". Refusing
-  `value.trim() !== value` would change that approved rule, so it went to Sage instead of into the
-  build.
-
-## 2026-10-23 E2 departure (sage-3601)
-
-A departure from DESIGN.md section 1 (which stays unedited). The design says each `editor` value is
-"non-empty after trim". Sage ruled that surrounding whitespace refuses too, because git trims an
-ident at commit, so a padded value would save one name and commit another. mapping.mjs now adds
-`if (value.trim() !== value) bad(`editor.${key} must not start or end with whitespace`)` after the
-IDENT_BAD check. `trim()` covers Unicode whitespace, so U+00A0 and U+3000 refuse as well. Inner
-whitespace is kept ("Her  Middle Name" passes).
-
-T3 gains a case per key for leading, trailing and both-ends spaces, U+00A0 and U+3000, plus one inner
-whitespace pass.
-
-M6 grows a third part:
-
-| Mutant | File | Replace | With | Killed by |
-|---|---|---|---|---|
-| M6c | src/mapping.mjs | `if (value.trim() !== value) bad(` | `if (false && value.trim() !== value) bad(` | mapping.test "editor is optional" (padded cases) |
-
-Fixture grep: `git grep -nE "\beditor\b|\bauthor\b" -- 'packages/library/tests/*' 'packages/business/tests/*'`,
-leaving out mapping.test.mjs, finds nothing. packages/business/tests has no fixtures directory. The
-library fixture mapping.json has no `editor`. The positive control (`vaultPrefix` in mapping.json)
-matches once. No fixture maps an editor or author with surrounding whitespace.
-
-## 2026-10-23 E4 (webby-0230, sage-3606), same departure as E2
-
-Claimed: `queue move 283 in-progress`, op honker-283-start, rev 3642, 19:10:49Z (briefed→in-progress).
-
-Git's ident.c `crud()` strips any byte <= 0x20 and `, : ; < > " \ '` from both ends of an ident. I
-checked that with git 2.55.0: `Jane,` `"Jane"` `'Jane'` `Jane;` `Jane:` `Jane\` and `,Jane` all
-commit as `Jane`, while `Jane.` and `Ja,ne` are kept. mapping.mjs now takes the set from crud()
-rather than from that list: `IDENT_CRUD_END = /^[\u0000-\u0020,:;<>"\\']|[\u0000-\u0020,:;<>"\\']$/`.
-The E2 check became `if (value.trim() !== value || IDENT_CRUD_END.test(value))`, which refuses
-library-mapping-invalid with "editor.<key> must not start or end with whitespace or any of , : ; " ' \".
-`trim()` still catches Unicode whitespace (U+00A0, U+3000), which crud() leaves alone.
-
-Inner characters: IDENT_BAD (`/[\u0000-\u001f\u007f-\u009f<>]/`) already refuses `<`, `>`, newline,
-tab and every other control anywhere in the value. T3 now pins that at the start, the end and the
-middle. Inner `, : ; " ' \` are kept, since git keeps them, and T3 pins that too.
-
-Tests:
- T3 has one case per character in [space, U+00A0, U+3000, `,`, `:`, `;`, `"`, `'`, `\`], at the start
-  and at the end, for each key. `<`, `>`, newline and tab are pinned at the start, end and middle.
-  Four accepted names have inner crud characters.
- New round-trip test, "an accepted editor round-trips through a real git commit unchanged". It
-  commits in a scratch repo with editor `Doe, Jane Q.` / `[email protected].` as author and
-  committer, with GIT_AUTHOR_* and GIT_COMMITTER_* stripped from the env, and asserts `git log`
-  shows exactly the saved values. I preflighted that commit with git 2.55.0 by hand: both values came
-  back unchanged.
-
-M6c now replaces the whole end check (this supersedes the earlier M6c row):
-
-| Mutant | File | Replace | With | Killed by |
-|---|---|---|---|---|
-| M6c | src/mapping.mjs | `if (value.trim() !== value \|\| IDENT_CRUD_END.test(value))` | `if (false)` | mapping.test "editor is optional" (end cases) |
-| M6d | src/mapping.mjs | `if (value.trim() !== value \|\| IDENT_CRUD_END.test(value))` | `if (value.trim() !== value)` | mapping.test "editor is optional" (`,` `:` `;` `"` `'` `\` cases) |
-
-## 2026-10-23 E5 (webby-0236, not blocking), fixed
-
-The round-trip test stripped only GIT_AUTHOR_* and GIT_COMMITTER_*. With GIT_DIR, GIT_WORK_TREE or
-GIT_INDEX_FILE set (inside a hook, say), GIT_DIR beats `-C root` and the commit would land in the
-outer repo, and the test read global and system config. It now deletes GIT_DIR, GIT_WORK_TREE,
-GIT_COMMON_DIR and GIT_INDEX_FILE (as queue/tests/helpers.mjs gitEnv does) and sets
-GIT_CONFIG_GLOBAL=/dev/null and GIT_CONFIG_NOSYSTEM=1 (as ledger.test.mjs does). The `-c user.*`
-ident still applies. Test only; no mutant changes.
-
-## 2026-10-23 sage-2925: optional editor.user (sage-3649)
-
-sage-2925 (recorded in ludwig/row286-r2 agents/ludwig/work/queue-286/BUILD.md, Q4) ruled that row 283
-adds an optional `editor.user`, her Gitea login for the `library-human` slot, which row 288 (C2-02)
-passes to `humanCredential(context, {user})`. It reached this row after the DESIGN.md d2 approval
-(ludwig-0068, bubba-0009, sage-3649), so it departs from DESIGN.md section 1 ("exactly the keys
-`name` and `email`"). DESIGN.md stays unedited.
-
- mapping.mjs: `only(entry.editor, ['name', 'email', 'user'], 'editor')`. When present, `user` must be
-  a string matching USER (`/^[A-Za-z0-9_.-]{1,100}$/`, the entry `user` check), else
-  library-mapping-invalid "editor.user must be a plain account name". The output carries `user` only
-  when given. An absent `editor.user` refusing library-human-missing is 288's (bubba-0009).
- README: the `editor` line names `user` and the end-character rule from E2/E4.
- Tests: T3 (mapping.test "editor is optional") gains one accepted case (`her.login-1`, kept in the
-  output) and refused cases for '', an inner space, '@', 101 characters, 7 and null. They go in
-  mapping.test with the other editor cases, not in the new supporting.test, which tests write paths.
- No test outside mapping.test reads `editor` or pins mapping.mjs or README (git grep).
-
-| Mutant | File | Replace | With | Killed by |
-|---|---|---|---|---|
-| M6e | src/mapping.mjs | `if (Object.hasOwn(entry.editor, 'user') && (typeof entry.editor.user !== 'string' \|\| !USER.test(entry.editor.user)))` | `if (false)` | mapping.test "editor is optional" (editor.user refusals) |
-| M6f | src/mapping.mjs | `...(Object.hasOwn(entry.editor, 'user') ? { user: entry.editor.user } : {})` | `...({})` | mapping.test "editor is optional" (`her.login-1` kept) |
@@ -1,191 +0,0 @@
-# Row 283 (#1788) C2-01d design, draft 2 (Honker)
-
-Brief: docs/plans/2026-10-20_case2-rows.md "C2-01d" at refactor 94c33a43c. Sources: the design at
-agents/gosalyn/work/case2/DESIGN.md b68d79663, the ruling after r11 (:207), the M12 paragraph (:300),
-1.1 (:755) and 1.2 (:817). Base 94c33a43c. Reviewer Webby, gate owner Sage. Nothing is built yet. The
-build waits for 282 to land (sage-2906).
-
-## 1. Mapping (packages/library/src/mapping.mjs)
-
-`supporting`:
- Every universe kind takes an optional `supporting` list: plain `['name','books','playground','supporting']`,
-  hybrid adds it to its seven keys, and a draft gets `['kind','name','playground','supporting']`.
- Each value is checked as a playground prefix is: a string ending in `/` whose body passes `folder()`.
- The output carries `supporting` on every universe, `[]` when absent, the way a draft carries
-  `books: []`. classify then needs no `?? []`. The business writer writes the raw document
-  (organization.mjs:195), not this output, so no business file changes shape.
- The prefix rules, across every entry (ruling after r11):
-  - A supporting prefix holding another supporting prefix, or one listed twice, refuses
-    `library-mapping-invalid`.
-  - A prefix equal to one of its own entry's book folders, or holding one, refuses `library-mapping-invalid`.
-  - A prefix inside or holding another entry's book folder refuses `library-supporting-other-universe`.
-  - Level comes from where the prefix sits, as for the playground: inside one of its own entry's books
-    is book level, and outside every book is universe level. A draft's prefixes are all universe level.
- Between the two lists (my choice, Q2):
-  - A supporting prefix may equal a playground prefix of the same entry. That folder is writable.
-  - A playground prefix may hold a supporting prefix of the same entry. The inner folder is supporting
-    and the rest stays playground.
-  - A supporting prefix that holds a playground prefix refuses `library-mapping-invalid`. classify
-    checks supporting first, so that playground prefix could never match.
-  - A supporting prefix equal to, holding or inside a playground prefix of another entry refuses
-    `library-mapping-invalid`. Otherwise one path would have two universes.
- The book loop at mapping.mjs:128-140 becomes a helper that both lists call with their own code and
-  label. The playground's messages and codes stay byte-equal, so no existing test text moves.
-
-`editor`:
- The entry takes an optional `editor`. When present, it is an object with exactly the keys `name` and
-  `email` (via `only()`). Each value is a string that is non-empty after trim and has no control
-  character (`[\u0000-\u001f\u007f-\u009f]`), `<` or `>` (webby-0169 R1: git drops them from an ident
-  and commits under a different name, so C2-02 would never see a failure). Anything else refuses
-  `library-mapping-invalid`.
- The output carries `editor: { name, email }` only when present, as `user` and `vaultPrefix` do. A save
-  with no `editor` refusing is C2-02's job.
-
-## 2. Scope (scope.mjs)
-
- `classify` gets a supporting loop before the playground loop (design 1.2). It returns `place(...)`
-  with `{ scope: 'supporting', universe, book }`. The book is the book folder holding the prefix, or
-  null at universe level and in a draft. The type and folder come from the first folder under the
-  prefix, as for the playground.
- The `.md` check stays first, so a `.canvas` or `.base` under a supporting prefix stays unmapped.
- The comment above `classify` names the three prefix scopes and the order.
-
-## 3. supportingPath (new supporting.mjs)
-
-`supportingPath(mapping, universe, path, tree)` returns `path` or throws
-`LibraryError('library-write-story-path', ...)`. It is pure and reads no git.
-
- `tree` is the array `listTree` returns (reader.mjs:26, `{ mode, type, oid, size, path }`), so the
-  C2-02 broker passes its listing as it is (Q3). A non-array `tree` throws a TypeError, because that is
-  a caller bug, not a path class.
- The checks run in this order, each with its own message naming the class:
-  1. The path must be a string of at most 1,024 UTF-8 bytes (`Buffer.byteLength`).
-  2. It must have no control character, using the same control class as `editor` (not `<` or `>`).
-  3. It must have no backslash.
-  4. It must not be absolute (a leading `/`).
-  5. It must have no empty, `.` or `..` segment. That also catches `//` and a trailing `/`.
-  6. `classify(mapping, path)` must give scope `supporting` and that same `universe`. This one check
-     covers an unknown universe, an unmapped path, a `.canvas`, `.base` or attachment, a canon or
-     story path, a playground path that isn't also supporting, and another universe's prefix. The scope
-     rule then has one source, and M1 below hits both.
-  7. Every proper prefix of the path (`a`, `a/b`, ...) and the path itself must not be in `tree` with
-     mode `120000` (symlink) or `160000` (gitlink).
-  8. No prefix of the path, and not the path itself, may equal a tree path or a tree directory
-     (derived from the entries' paths) after `normalize('NFC').toLowerCase()` on both sides, unless
-     it equals that tree path exactly. NFC as well as case, because APFS treats NFC and NFD forms of
-     a name as one file (webby-0169 N1).
-     Directories are checked too, because the folders under a supporting prefix are hers to name. A
-     path in a tree that holds both `a.md` and `A.md` refuses, which matches R7.
- The refusal messages quote the path with JSON, except for the control-character class, whose message
-  leaves the path out.
- The delete rule ("A delete also needs the path to exist at the tip as a 100644 blob", M12) isn't in
-  the brief's supportingPath list. It stays with C2-02's delete (Q4).
-  The C2-02 brief doesn't name it (only design :308), so BUILD.md carries it to C2-02 under Handoffs
-  (webby-0169 Q4).
- index.mjs exports `supportingPath`.
-
-## 4. README (packages/library/README.md)
-
- Mapping: `supporting` and its rules, the cross-list rules, and `editor`.
- Refusals: a `library-supporting-other-universe` row, and the new cases in the
-  `library-mapping-invalid` row.
- Scope: supporting first, then playground, then canon.
- A new section, "Agent write paths", for supportingPath and its classes.
-
-## 5. Callers of classify outside files owned (Q1 for Sage)
-
- survey.mjs:65 builds `{ canon: 0, playground: 0, unmapped: 0 }` and increments
-  `scopes[classify(...).scope]`. A supporting file adds `supporting: NaN`, and formatSurvey (:92) never
-  prints it. I propose a departure: add `supporting: 0` and print it, so the line becomes
-  `scopes canon 5, playground 1, supporting 0, unmapped 3; indexed 6`. That re-pins survey.test:73 and
-  adds a count test. Without it, the survey reports garbage once she marks a folder. The departure
-  covers two files, packages/library/src/survey.mjs and packages/library/tests/survey.test.mjs.
- No change in the rest, each for a reason:
-  - reader.mjs:183 skips only unmapped, so supporting files are indexed like playground files.
-  - R5 (:207) flags only canon to playground, as design 1.3 R5 says. A canon link to a supporting file
-    raises nothing.
-  - render.mjs:23 gives supporting a null badge. The supporting badge belongs to C2-10b (design :1415).
-  - mirror.mjs:246 refuses only unmapped. Reading supporting files by scope is C2-05c's.
-  - No bus or webui source filters on scope (git grep at 94c33a43c).
- M9 already protects the whole `projects` key from agent edits (library-projects-protected.test). No
-  test is added there.
-
-## 6. Tests
-
- mapping.test:
-  - T1: `supporting` at book level, at universe level, in a hybrid and in a draft. The output carries
-    it, with `[]` when absent. The draft `deepEqual` at :48 gains `supporting: []`.
-  - T2: one test per prefix rule.
-    - These refuse `library-mapping-invalid`: no trailing `/`, a bad folder, one holding another, one
-      listed twice, one equal to its own book, one holding its own book, one holding a playground
-      prefix, and one overlapping another entry's playground.
-    - These refuse `library-supporting-other-universe`: one inside another universe's book, and one
-      holding another universe's book.
-    - An equal same-entry playground passes.
-  - T3: `editor` passes, and absent passes. It refuses `library-mapping-invalid` for a non-object, an
-    array, an extra key, a missing key, an empty or blank value, a non-string, and a control character,
-    `<` or `>` in either value.
- scope.test, T4:
-  - Supporting at book level, universe level and in a draft each give their universe and book.
-  - A folder in both lists is `supporting`, and a playground-only folder is `playground`.
-  - A supporting `.canvas` or `.base` is unmapped.
- supporting.test (new):
-  - T5 passes at book level, universe level, in a draft, in a both-lists folder, and at exactly 1,024 bytes.
-  - T6 has one refusal per class against a fixture tree with a symlink, a gitlink and a case variant.
-    The classes are:
-    - unmapped, `.canvas`, `.base`, an attachment, canon, playground-only, another universe's
-      supporting prefix, and an unknown universe;
-    - absolute, `..`, `.`, `//`, a trailing `/`, a backslash, a C0 control and DEL;
-    - a symlink folder, a gitlink folder, and a symlink at the path itself;
-    - a case-variant file, a case-variant folder, and an NFD-form variant of an NFC tree name;
-    - 1,025 bytes made with a multi-byte character, so bytes and characters differ.
-  - Each asserts the code `library-write-story-path`.
- business.test: T7 adds one assertion that `validateBusinessDocument` refuses
-  `library-supporting-other-universe`.
- survey.test (only if Q1 is approved): T8 counts one supporting file, and :73 is re-pinned.
-
-## 7. Mutants (exact strings go in BUILD.md)
-
-| Mutant | Change | Killed by |
-|---|---|---|
-| M1 | classify checks playground before supporting (the brief's mutant) | T4 both-lists, T5 both-lists |
-| M2 | the other-universe fail for supporting is dropped | T2 |
-| M3 | the symlink and gitlink check is dropped | T6 |
-| M4 | the case check is dropped | T6 |
-| M4b | check 8 drops `normalize('NFC')` | T6 NFD variant |
-| M5 | the byte length uses `path.length` | T6 1,025 bytes |
-| M6 | the `editor` control-character check is dropped | T3 |
-| M6b | the `editor` `<` and `>` check is dropped | T3 |
-| M7 | supportingPath skips the universe match | T6 other universe |
-| M8 | the supporting-holds-playground check is dropped | T2 |
-
-## 8. Gate
-
- Webby approves the manifest.
- The library and business suites and every scripts/test-*.sh are green on Sage's gate.
- Timeouts (mos-1275): each package `timeout -k 10 1800`, each script `timeout -k 10 300`, each single
-  file and mutant `timeout -k 10 600`. These come from my row 256 gate at 10:34Z.
- Before in-review, grep packages/*/tests for 64-hex pins on the changed files and for the changed
-  message text, then drift-check BASE..refactor.
-
-## 9. Questions
-
- Q1 (Sage): approve the survey.mjs and survey.test.mjs departure in section 5?
- Q2 (Webby): the cross-list rules in section 1?
- Q3 (Webby): `tree` as the `listTree` array?
- Q4 (Webby): the delete's 100644 check stays with C2-02?
- Q5 (Webby): `editor` refuses only blank values and control characters, as the brief says. `<` and `>`
-  would break a git ident. I'd leave them to C2-02's commit step unless you want them refused here.
-
-## 10. Draft 2 (webby-0169)
-
- R1 folded: `editor` refuses `<` and `>` too, with T3 cases and mutant M6b.
- Q2 accepted. BUILD.md records the tradeoff: refusing a supporting prefix that holds a playground
-  prefix goes past the brief, but it is the fail-closed reading and uses an existing code. The cost
-  is that she can't nest a playground under a supporting folder, though she can nest the other way.
- Q3 accepted. Q4: carried to C2-02 under Handoffs in BUILD.md, and Sage was asked to add it to C2-02's brief.
- N1 folded into check 8 (NFC and case), with an NFD case in T6 and mutant M4b.
- N2: the survey.test:73 pin gains only `supporting`, and the count test is the only addition
-  (mos-1330, its own commit).
- N3: before the build, re-grep tests outside packages/library for a `deepEqual` of the mapping output
-  on the build base.
@@ -0,0 +1,92 @@
+# Row 298 (#1804, Q228): the chief-of-staff grant scope
+
+Owner Megavolt, reviewer Dewey. Assigned in sage-3584 (mos-1489), 2026-10-23 18:53Z.
+Base: origin/refactor 45dca69f6. Branch: megavolt/row298.
+Brief: docs/plans/2026-10-23_mvp-readiness-rows.md, "Brief: the chief-of-staff grant scope (Q228)".
+Decision: DECISIONS Q228 (jason-master-restart DECISIONS.md:2278). It replaces Mos's Q190 reading.
+
+## What exists at 45dca69f6 (broker.mjs)
+
+- Raise: `#raiseGrant` (:2558) is chief-only (`grant-chief-only`) and binds a grant body per method:
+  gitea `#giteaGrantBinding` (:2665), host `#hostGrantBinding` (:2599), or host-enroll `enrollBinding`.
+  The decision goes through `#dispatch(..., 'decision.raise', ...)`, routed to the human.
+- Approval: `#approvedGrant` (:1525) returns the binding only for a credential.mint routed to the
+  human and closed with `approvalChoice` by the business's human, via 'cli', or via 'console' with
+  the broker's own human.input (row 252).
+- Start: decision.resolve (:5653-5659) runs `#approvedGrant` after the close and, once the transaction
+  commits, starts `#runEnrollment`, `#runHostGrant` or `#startGitea` with setImmediate.
+- Spend and records: each executor calls `#consumeGrant` and writes the 236 records (grant.call,
+  grant.result, grant.step, grant.applied or grant.failed, gitea_grants or host_grants). Revoke
+  goes through grants.revoke and hosts.revoke, as before.
+- Human-only settings: `#human(s)` (cli, outsideAgent) plus `#mayHuman`, as in veto.set (:4713).
+  The organization file is checked whole by business.mjs `checkLaunch`, and a bad file refuses
+  every read.
+
+## Proposed design (waits on Sage's rulings, Q1-Q6 below)
+
+D1. Storage. The scope gets its own key, `launch.grantScope`, in the organization file. The
+    whole-file check doesn't refuse on it. A separate reader, `grantScope(document)`, returns the
+    parsed scope or, when the key is missing or bad, the empty scope `{}`, plus a `fallback` flag.
+    A bad value can't break every organization read, and it falls back to "everything needs
+    Approve", which is the fail-closed direction. (Q1)
+D2. Shape. `{ gitea?: { agents: [id], projects: [id] }, host?: { agents: [id], hosts: [id],
+    commands: [[argv prefix]] } }`. A request is in scope only if its method has an entry, its agent
+    is listed, and every target is listed: each gitea project, the host, and each command prefix
+    equal to a listed prefix. host-enroll is never in scope, because it adds a host to the registry.
+    (Q2)
+D3. Writer. A new verb, `grants.scope.set { revision, scope }`, CLI-only for the human: `#human(s)`,
+    then `#mayHuman`, with the verb added to LIFECYCLE_HUMAN_VERBS. The tester, the reader and every
+    agent are refused. organization.set's ORGANIZATION_KEYS don't include it, so the chief's tool
+    never reaches it, the same way instances.set and veto.set stay human-only. The write validates
+    strictly and refuses a bad value; only the read falls back. Receipt: `grants.scope` with the old
+    and new sha256. `grants.scope` reads the value for the human, the tester and the chief. (Q3)
+D4. In-scope raise. Inside the raise transaction, `#raiseGrant` checks the binding against the scope
+    and, if it's in scope, closes the new decision at once: op resolved, choice approvalChoice, by
+    `grant-scope`, via `scope`. It writes a `grant.scope.used` event carrying the scope sha256 and
+    revision. `#approvedGrant` accepts via 'scope' only when that event exists for the close's seq
+    and its sha256 matches the scope as read in the same transaction. After the commit, the same
+    setImmediate starts the same executor, so 236's spend, records and revoke are unchanged. The
+    decision is closed before any inbox read, so no inbox item ever shows. (Q4)
+D5. Out-of-scope raise: unchanged. The decision stays open, routed to the human, for the Console
+    and CLI Approve.
+D6. Executor recheck. At the spend, `#consumeGrant` reruns the scope check for a via-'scope'
+    approval. If the scope changed between raise and run and the grant is now out of scope, it
+    fails with `grant.failed scope-changed` and the grant is spent. (Q5)
+
+## Open questions for Sage
+
+Q1. Storage: `launch.grantScope` in the organization file with a lenient reader (D1), or a separate
+    file under the business directory?
+Q2. Shape: is per-method agent, project, host and command lists right? Should host-enroll stay
+    out of scope always?
+Q3. "A scope change needs Approve": is the human's CLI verb itself the Approve (D3)? Or must the
+    chief also be able to raise a scope change that Jason approves in the inbox (a new decision
+    action, more code)? I recommend D3 alone. Should Console get a scope page in this row? I
+    propose no.
+Q4. Recording an in-scope grant as a broker close via 'scope' with a scope event (D4), versus a
+    decision that is never raised (a new table). D4 keeps 236's records and revoke unchanged.
+Q5. Scope narrowed between raise and run: fail scope-changed (D6), or honor the raise-time check?
+Q6. Chief enrollment ("Jason's Approve stays for the chief of staff's enrollment"): I read this
+    as the chief's own instance and credentials, which the human's instances.set and the
+    credential lifecycle already cover. So nothing new is needed in this row. Agree?
+
+## Tests (access by brief; all on scratch stores, fake Gitea, fake host)
+
+T1 agent, chief and tester callers of grants.scope.set are refused, and organization.set with
+   grantScope is refused. T2 a bad or missing grantScope falls back to empty and the grant waits.
+T3 an in-scope gitea request issues with no open decision and no inbox item, and writes the 236
+   records. T4 the same for a host request. T5 out of scope by agent, by project, or by command
+   waits for Approve. T6 host-enroll always waits. T7 a scope change by the human's CLI writes a
+   receipt; a scope change by any other path is refused. T8 an in-scope grant is logged and revoked
+   with grants.revoke or hosts.revoke. T9 scope narrowed before run gives scope-changed.
+
+## Mutants (brief)
+
+M1 the scope check skipped (every chief raise auto-closes): killed by T5 and T6.
+M2 the fallback skipped (a bad value is used as-is or throws): killed by T2.
+M3 the `#human` check removed from grants.scope.set: killed by T1.
+
+## Holds
+
+Darkwing holds the slot: no push, no claim, no queue write, no node and no test run until Sage
+says so. Q188: no agent creates a grant; tests use scratch stores only.
@@ -1,184 +0,0 @@
-# Row 216 build notes (C2-05a, lookup index and queries, #1717)
-
-Phase A only: code, tests and this file. No test, suite or mutant has been run. `node --check` passed on every changed `.mjs`.
-
- Branch: `researcher/row216`
- Base: `d372102882d6858fa77af4aee453f866c886ad5c` (origin/refactor)
- Design: `agents/gosalyn/work/case2/DESIGN.md` on origin/gosalyn/case2-design, section 3 (table at lines 625-631, bullets 633-641), 1.2-1.4, B12, D2
- Brief: `docs/plans/2026-10-20_case2-rows.md`, C2-05a at lines 320-357
-
-## Files
-
-| Path | Status |
-|---|---|
-| `packages/library/src/index-build.mjs` | new |
-| `packages/library/src/query.mjs` | new |
-| `packages/library/src/index.mjs` | edit: 2 export lines added |
-| `packages/library/tests/query-fixture.mjs` | new, test helper |
-| `packages/library/tests/query.test.mjs` | new |
-| `packages/library/tests/index-build.test.mjs` | new |
-| `agents/researcher/work/queue-216/BUILD.md` | new (this file) |
-
-No existing test or source file changed beyond `index.mjs`.
-
-## Design rows and where each is tested
-
-| Design row | Code | Tests (query.test.mjs unless noted) |
-|---|---|---|
-| `library_find` | `find` | find is bound to its universe; every result carries its scope; long list pages; large items page under the cap |
-| `library_get` | `get` | hybrid gets a source file; get lists visible links both ways; get pages its lines |
-| `library_search` | `search` | search returns scoped line hits; item that cannot fit alone is refused |
-| `library_manuscript` | `manuscript` | one chapter at most 400 lines; refused without chapter; hybrid reads a source chapter |
-| `library_universe` | `universeInfo` | universe info reports a hybrid's sources, constraints, notes; unknown universe refused |
-| Hybrid semantics (1.4) | `sees` | a hybrid sees its sources canon minus exclusions, no playground |
-| Unmapped never appears | index build + `sees` | unmapped files never appear (query.test); index holds mapped files only (index-build.test) |
-| Per-commit cache (3) | `indexFor` | same commit, path, mapping return one index; different path, mapping or commit get their own; eight-entry bound; failed read not kept; unchecked mapping refused (index-build.test) |
-| Rebuild time (3, C2-05a gate) | `indexFor` | 3,000-file rebuild, time reported with `t.diagnostic`, no threshold asserted |
-| REPLY_CAP parity | `QUERY_REPLY_CAP` | equals `REPLY_CAP` from harness tools.mjs |
-
-## Choices where the design table is silent or differs
-
-These are departures or gaps. Each is built as stated, so Sage can rule before Phase B. A ruling that changes one of them is a small edit.
-
-1. **Paging arguments (gap a).** The table has no offset. `find` and `search` take an optional `offset` (a position in the filtered list, default 0). A reply carries `next`: the position of the next item, or `null`.
-2. **`library_get` has no universe (gap b).** Built with a required `universe`. Without it the reply could not be isolated. A missing file and a file the universe cannot see both return `null`, so a caller cannot tell them apart. `get` also takes an optional `from` line.
-3. **`get` over the cap (gap c).** Lines page by `from` with `next`. `links_out` and `links_in` come back whole on every page. If the frontmatter and links alone exceed the cap, the call is refused with `query-item-too-large`. A hub note with many backlinks may be refused. This needs a ruling: link paging, or accept the refusal.
-4. **`manuscript` without a chapter (gap d).** Refused with `query-chapter-required`. The design names no list form. A chapter name that matches two visible files is refused with `query-chapter-ambiguous`.
-5. **`search` excerpt (gap e).** The excerpt is the whole line, not a truncation. A line that alone exceeds the cap is refused. Truncating it would cut an item.
-6. **`exclude` form (gap f).** `checkMapping` accepts only a folder path for `exclude` (`folder()`), so an exclusion is a path prefix. There is no type or source form to build. Confirm.
-7. **Pin constraints.** `pin` does not hide any file. It is reported by `universeInfo` only. Confirm.
-8. **Playground through `get`.** `scope` applies to lists. `get` by an explicit path returns a playground file of the caller's own universe. Confirm.
-9. **Links.** A link into a file the universe cannot see is dropped from `links_out` and `links_in`, in line with N1. Links from a visible file that point into another universe are kept in the index (the reader keeps them under R6), and the query layer drops them for universes that cannot see them.
-10. **`find` matching.** Case-insensitive substring over the front matter `name` and the file name. An empty `query` matches every file in scope.
-11. **Cache key.** `repo`, `commit` and a sha256 of the canonical mapping. Keying by commit alone would return the wrong scopes after a mapping change. The cache holds eight entries, least recently used out. Failed reads are not kept.
-12. **`universeInfo`.** Reads only the checked mapping and the served commit. It builds no index.
-13. **Reply commit.** Every reply carries the index commit, which is the served commit passed in.
-
-## Provisional refusal codes (pending Sage approval)
-
-The brief says new refusal codes need Sage's approval first. These are provisional and must not be treated as settled:
-
- `query-argument-invalid`
- `query-universe-unknown`
- `query-chapter-required`
- `query-chapter-ambiguous`
- `query-item-too-large`
-
-Reused, existing codes: `library-mapping-invalid`, plus the reader's `library-git`, `library-commit` through `indexFor`.
-
-## Grep results (grep only, not a test run)
-
- Test references to the changed paths: `packages/library/tests/*.mjs` import `../src/index.mjs` and `../src/mapping.mjs`. `packages/bus/tests/library.test.mjs` and `library-sync.test.mjs` import the library index as a namespace. Neither enumerates its exports, so the two new export lines break no assertion.
- `packages/cli/tests/stack-copy.test.mjs:52` checks that `packages/library/src/index.mjs` exists, and it still does.
- 64-hex pins: none in `packages/library/tests`, none on `index.mjs`, `query.mjs` or `index-build.mjs`.
- `scripts/test-*.sh`: no reference to the new modules.
-
-## Flag for Sage
-
- `packages/library/tests/helpers.mjs` `repo()` builds its fixtures under `tmpdir()`, which is `/tmp`. The launcher rules forbid that. The new tests do not use it; they use `tests/query-fixture.mjs`, which builds under `/mnt/storage/scratch/tmp`. The existing helper should be fixed in a separate row, not here.
-
-## Phase B commands (not run)
-
-Run only after Sage sends "slot clear". Set the scratch TMPDIR first, per the launcher rule.
-
-```
-cd /mnt/storage/src/mosaic-stack/.claude/worktrees/agent-aa3cc98787bc5152c/packages/library
-export TMPDIR=/mnt/storage/scratch/tmp
-node --test tests/query.test.mjs tests/index-build.test.mjs
-node --test tests/*.test.mjs
-```
-
-Also run `packages/bus/tests/library.test.mjs` and `library-sync.test.mjs`, since they import the index.
-
-## Status
-
-Not yet verified. Nothing has been tested and nothing is committed. The working tree holds the Phase A changes. AGENTS.md invariant 8 allows a commit only after the applicable suites are green, so the commit waits for Phase B. The dispatch asked for a local commit in Phase A; Sage to confirm that the commit waits for Phase B.
-
-## Round 2 (2026-10-22, sage-2708, sage-2716): rulings applied, rebased onto aca16404c
-
-Added after the text above; nothing above is edited. "Nothing is committed", "Provisional refusal codes",
-`query-chapter-required` and the tmpdir flag above were true when written and are superseded here.
-
- Branch `researcher/row216-r2`, one local commit on origin/refactor `aca16404c`. Row 268 (C2-01c) is in
-  that base. Row 253 has not landed; the work rebases onto 253's tip before any gate. Not pushed, not run.
- Rulings: `agents/sage/work/queue-216/RULINGS.md` at da9555ca2, rulings 1-13 and the tmpdir flag.
- Drift check, d37210288..aca16404c against my paths: the library files that changed are `mapping.mjs`,
-  `scope.mjs`, `README.md` and the mapping and scope tests. None is a file I add or edit. `query.mjs` reads
-  the checked mapping through them, so the whole library package runs in phase B.
-
-### What changed from phase A
-
-| Ruling | Change in `query.mjs` | Test |
-|---|---|---|
-| 3 `get` over the cap | `links_out` and `links_in` page together with `links_from`; every reply carries `links_next`, `next` and the front matter. A page with lines left carries at least one line. Links take at most half the cap while lines remain. `query-item-too-large` is left for front matter alone or one line alone (or one link alone) | hub note with 900 backlinks pages and adds up; front matter alone and a line alone refused; bad `links_from` |
-| 4 `manuscript` no chapter | `chapter` optional: the first visible chapter in path order. Every reply carries `next_chapter`. `query-chapter-required` removed. Ambiguity still refuses | first chapter and `next_chapter`; ambiguous name refused |
-| 5 `search` long line | hit comes back `{path, line, excerpt: null, excerpt_too_long: true, scope}`, other hits still return | marked hit and unmarked hits in one reply |
-| 6 `exclude` | path-prefix reading only. The test names `EXCLUSION` and `EXCLUDED_PATHS` in `query-fixture.mjs`, so C2-15 (row 267) swaps two constants | exclusion hides from the hybrid and not from the source |
-| 8 hybrid `get` | unchanged code; test added | hybrid gets a source's playground file as `null`; the source gets it with `scope: "playground"` |
-| PRD 1.14 (row 268) | `universeInfo` reports `kind` from the mapping (`draft` included) | four tests below |
-
-PRD 1.14 tests, one each: a lookup naming a `book` leaves `book: null` files out (find and search);
-`library_manuscript` never reads a `book: null` file; a draft universe has no canon, so its lookups return
-files only with `scope: "playground"`; `library_universe` on a draft returns kind, name and prefixes.
-The levels fixture is `WITH_LEVELS` in `query.test.mjs`: harbor gets `Notes/Harbor/` as a universe-level
-playground prefix, and `idea` is a draft over `Drafts/New World/`.
-
-`query-fixture.mjs` builds under `tmpdir()`, as `helpers.mjs` does (ruling "tmpdir flag"). The earlier
-flag about `helpers.mjs` building under `/tmp` is closed by that ruling: the gate sets `TMPDIR`.
-
-Refusal codes now: `query-argument-invalid`, `query-universe-unknown`, `query-chapter-ambiguous`,
-`query-item-too-large`. All four approved in the rulings.
-
-### Grep results (grep only, not a test run)
-
- `git grep` over `packages/*/tests/*` and `scripts/*` for `query.mjs` and `index-build`: no hit outside
-  `packages/library/tests/query*.test.mjs` and `index-build.test.mjs`.
- 64-hex pins naming a library path: none. Positive control: the same pathspec finds the sha256 lines in
-  `packages/cli/tests/case1-hostcheck.test.mjs` and the `packages/library/src/index.mjs` existence check at
-  `packages/cli/tests/stack-copy.test.mjs:52`.
- Tests that read `packages/library/src` as a directory: `packages/cli/tests/stack-release-fixture.mjs:309`
-  copies `packages/library/src` whole into a release fixture. It carries no file list, so two new files break
-  no assertion. `stack-release.test.mjs` is not in the gate unless Sage wants it.
- Tests that import the library index as a namespace: `packages/bus/tests/library.test.mjs` and
-  `library-sync.test.mjs`. Neither enumerates exports, so the two export lines add no break. Both run
-  whole in phase B.
-
-### Run limits (fixed before any run)
-
-Every node file runs as its own `setsid -w timeout -k 10 LIMIT node --test FILE`; nothing runs unbounded.
-
- Node test files: LIMIT 900 s. The library test files have no recorded time. 900 s is above the longest
-  recorded whole-package run I know of (cli, 591 s, row 281 BUILD.md "Runs" step 3), so it holds the 3x rule
-  for any single file. The first run records each file's time, and a file past 300 s gets a limit re-derived
-  from it before the next run. `query.test.mjs` builds a 900-file repo and a 3,000-file index rebuild is in
-  `index-build.test.mjs`; both are the files most likely to need it.
- No shell script is in this row's gate, so no script limit applies.
-
-Any timeout goes to Sage, then Mos, unplaced (mos-1275).
-
-### Phase B (not run; Sage's CLEAR first, then a rebase onto 253's tip)
-
-```
-export TMPDIR=/mnt/storage/scratch/tmp
-cd <worktree>/packages/library
-for f in tests/*.test.mjs; do setsid -w timeout -k 10 900 node --test "$f"; done
-cd ../bus
-for f in tests/library.test.mjs tests/library-sync.test.mjs; do setsid -w timeout -k 10 900 node --test "$f"; done
-cd ../cli
-setsid -w timeout -k 10 900 node --test tests/stack-copy.test.mjs
-```
-
-Mutants I propose (my list, not read off the brief; each is meant to be killed by the named test, and none
-has been thrown; the kill claims are unverified until CLEAR):
-
- M-a: `sees()` returns true for a file of another universe: killed by "find is bound to its universe".
- M-b: the playground filter dropped: killed by "playground appears only when asked for".
- M-c: the hybrid reads a source's playground: killed by "a hybrid gets a source playground file as null".
- M-d: `links_next` always null: killed by the hub paging test.
- M-e: the book filter lets `book: null` through: killed by the PRD 1.14 book test.
-
-### Status
-
-Built, not run. `node --check` has not been run on this round's files (no node before the CLEAR); the
-phase A pass above covered the earlier text only. The commit is local and waits for no gate under Sage's
-sage-2716 instruction, which allows git and docs work only; push and claim wait for Sage's go.
@@ -4,7 +4,7 @@ import { initializeControl, processingStatus } from '../../processing-control/sr
 import { NAME as HARNESS_NAME } from '../../plugins/src/kinds.mjs';
 import { loadRequirements } from '../../tasks/src/requirements.mjs';
 import { MERGE, LandingRefusal, readLanding } from './landing.mjs';
-import { ID_PATTERN, THREAD_DEFINITIONS, END_PROTECTED, forkProblem, forkUrl, credentialKind, validArgv, commandAllowed, HOST_ID, CREATIVE_DEFINITIONS, unhireableAction, giteaName, parseGiteaUrl, covers } from '../../business/src/vocabulary.mjs';
+import { ID_PATTERN, THREAD_DEFINITIONS, END_PROTECTED, forkProblem, forkUrl, credentialKind, validArgv, commandAllowed, HOST_ID, CREATIVE_DEFINITIONS, unhireableAction, giteaName, parseGiteaUrl, covers, grantScopeOf, grantInScope } from '../../business/src/vocabulary.mjs';

 // Kept closed while S1 lands; its vocabulary is the integration authority.
 export const ACTIONS = Object.freeze([
@@ -96,16 +96,7 @@ export const TASK_PAGE_MAX = 200;
 // request allowed past the ordinary 64 KiB envelope (server.mjs and client.mjs), up to its content cap.
 export const PROJECT_FILE_VERBS = Object.freeze(['project.files', 'project.file', 'project.file.save']);
 // C2-03a: library.sync is the human's fetch, and with `accept` the one way past library-diverged.
-// Row 224: pure agent lookups are separate from the three human-only verbs. Listing them
-// here also makes server.mjs await their host effects instead of serializing a Promise as {}.
-const LIBRARY_LOOKUPS = Object.freeze({
-  'library.find': { method: 'find', fields: ['universe', 'query', 'type', 'book', 'scope', 'offset'], required: ['universe', 'query'] },
-  'library.get': { method: 'get', fields: ['universe', 'path', 'scope', 'from', 'links_from'], required: ['universe', 'path'] },
-  'library.search': { method: 'search', fields: ['universe', 'text', 'book', 'scope', 'offset'], required: ['universe', 'text'] },
-  'library.manuscript': { method: 'manuscript', fields: ['universe', 'book', 'scope', 'chapter', 'from', 'to'], required: ['universe', 'book'] },
-  'library.universe': { method: 'universeInfo', fields: ['universe'], required: ['universe'] },
-});
-export const LIBRARY_VERBS = Object.freeze(['library.file', 'library.status', 'library.sync', ...Object.keys(LIBRARY_LOOKUPS)]);
+export const LIBRARY_VERBS = Object.freeze(['library.file', 'library.status', 'library.sync']);
 export const PROJECT_SAVE_VERB = 'project.file.save';
 export const PROJECT_SAVE_REQUEST_MAX = 1024 * 1024 + 64 * 1024;
 export const WEB_VERBS =Object.freeze(['web.search', 'web.fetch']);
@@ -299,6 +290,9 @@ export function writeGrantEvent(store, at, business, body, subject = null) {
  );
  return eid;
 }
+// Row 298 (#1804, Q228): the by of a close the chief's grant scope makes, with via 'scope'. No session
+// closes as it, and #approvedGrant takes it only with the grant.scope.used record of that close.
+const SCOPE_BY = 'grant-scope';
 export const HOSTS_VERBS = Object.freeze(['hosts.status', 'hosts.check', 'hosts.remove', 'hosts.revoke', 'hosts.sweep']);
 // Row 236 (#1742, #436b r5): the Gitea grant path's verbs. run and admin.* are the human's alone.
 export const GRANTS_VERBS = Object.freeze([
@@ -421,6 +415,7 @@ export class Broker {
  #revokeUndo = [];
  #testerOn;
  #roleFile;
+  #grantScope;
  // Row 236 (#436b): giteaGrant and giteaKeys from gitea-grant.mjs, or null, and the remote halves of
  // section 5's restart rows and of revokes a restart cut short, for reconcileGitea.
  #giteaGrant;
@@ -448,11 +443,12 @@ export class Broker {
  #clock = 0;
  #processing;
  // credentialStatus is the runtime's metadata-only Credentials.status(); the broker never gets use().
-  constructor({ store, businesses, secretCheck = () => {}, credentialStatus = () => [], organization = null, project = null, library = null, usage = null, limits = null, harnessOn = null, credentialVerbs = null, hostGrant = null, hostKeys = null, processing = null, testerOn = null, roleFile = null, giteaGrant = null, giteaKeys = null, access = null, accessStamp = null, compactions = null }) {
+  constructor({ store, businesses, secretCheck = () => {}, credentialStatus = () => [], organization = null, project = null, library = null, usage = null, limits = null, harnessOn = null, credentialVerbs = null, hostGrant = null, hostKeys = null, processing = null, testerOn = null, grantScope = null, roleFile = null, giteaGrant = null, giteaKeys = null, access = null, accessStamp = null, compactions = null }) {
    if (!object(businesses) || !Object.keys(businesses).length) fail('invalid-business');
    // Row 194 b15 (sage-2501): the function-argument checks come before anything reads the store.
    if (harnessOn !== null && typeof harnessOn !== 'function') throw new TypeError('harnessOn must be a function');
    if (testerOn !== null && typeof testerOn !== 'function') throw new TypeError('testerOn must be a function');
+    if (grantScope !== null && typeof grantScope !== 'function') throw new TypeError('grantScope must be a function');
    if (roleFile !== null && typeof roleFile !== 'function') throw new TypeError('roleFile must be a function');
    if (access !== null && typeof access !== 'function') throw new TypeError('access must be a function');
    if (accessStamp !== null && typeof accessStamp !== 'function') throw new TypeError('accessStamp must be a function');
@@ -490,6 +486,10 @@ export class Broker {
    // sets bus.tester to exactly true; the bus runtime reads it live, so a hand edit counts at the next
    // tester lifecycle call and at the take. Without it the broker's own copy decides.
    this.#testerOn = testerOn ?? ((business) => this.#business(business).vars?.['bus.tester'] === true);
+    // Row 298 (#1804, Q228): grantScope(business) is launch.grantScope as the organization file stands,
+    // unchecked; the bus runtime reads it live, so the human's write counts at the next raise. Without
+    // it the broker's own copy decides.
+    this.#grantScope = grantScope ?? ((business) => this.#business(business).launch?.grantScope);
    // Row 194 (#1692, D2.3): roleFile(name) loads role definition `name` from the roles directory as it
    // stands, for the hire checks. Without it a hire refuses not-configured.
    this.#roleFile = roleFile;
@@ -1536,12 +1536,67 @@ export class Broker {
    const raise = this.#raised(business, decision);
    if (d?.action !== 'credential.mint' || d.route_to !== 'human' || !raise?.grant) return null;
    const r = this.#closed(decision);
-    if (r?.op !== 'resolved' || r.choice !== raise.approvalChoice || r.by !== this.#business(business).human) return null;
+    if (r?.op !== 'resolved' || r.choice !== raise.approvalChoice) return null;
+    // Row 298 (#1804, Q228, sage-3594 Q4): a scope close counts only with its own grant.scope.used,
+    // which only #scopeClose writes, under the grant actor.
+    if (r.via === 'scope') return r.by === SCOPE_BY && this.#scopeUsed(business, decision, r.seq, raise.grant) ? raise.grant : null;
+    if (r.by !== this.#business(business).human) return null;
    // Row 252 (#1753, design section 3, J14): a console close counts only with its own human.input,
    // which only the broker writes (recordEvent reserves the kind).
    if (!(r.via === 'console' ? this.#consoleInput(business, decision, r) : r.via === 'cli')) return null;
    return raise.grant;
  }
+  // Row 298: the grant.scope.used record of scope close seq. Gitea and host grants only.
+  #scopeUsed(business, decision, seq, grant) {
+    if (grant.method !== 'gitea' && grant.method !== 'host') return false;
+    return Boolean(this.#store.get(
+      `SELECT 1 FROM events WHERE business=? AND ${GRANT_EVIDENCE} AND json_extract(body,'$.action')='grant.scope.used'
+       AND json_extract(body,'$.grantDecision')=? AND json_extract(body,'$.decisionSeq')=? AND json_extract(body,'$.method')=? LIMIT 1`,
+      business, decision, seq, grant.method,
+    ));
+  }
+  // Row 298: the scope the broker applies now. A missing key, a bad value or an unreadable file is the
+  // empty scope, which covers nothing, so every grant waits for the human (brief item 1).
+  #scopeNow(business) {
+    try {
+      return grantScopeOf(this.#grantScope(business)).scope;
+    } catch {
+      return grantScopeOf(undefined).scope;
+    }
+  }
+  // Row 298 (D4, sage-3594 Q2/Q4): after a gitea or host raise, in its transaction. When the raiser is
+  // launch.by, the decision went to the human and the grant is inside the scope, the broker closes it
+  // with the approval choice, via 'scope', writes grant.scope.used and starts the executor, as the
+  // human's Approve does. The spend, the records and the revoke are row 236's and 235's, unchanged.
+  // Anything else is left in the inbox. launch.by is a hand edit, so a chief-of-staff instance the
+  // tester or an instances.set adds never raises in scope (Q6).
+  #scopeClose(s, view) {
+    if (s.role !== this.#business(s.business).launch?.by) return view;
+    const d = this.#store.get('SELECT id,route_to FROM decisions WHERE business=? AND id=?', s.business, view.id);
+    if (d?.route_to !== 'human' || this.#closed(d.id)) return view;
+    const raise = this.#raised(s.business, d.id);
+    const scope = this.#scopeNow(s.business);
+    if (!raise?.grant || !grantInScope(scope, raise.grant)) return view;
+    const seq = Number(
+      this.#store.run(
+        'INSERT INTO decision_events(decision,at,op,by,choice,note,via) VALUES(?,?,?,?,?,?,?)',
+        d.id, this.#now(), 'resolved', SCOPE_BY, raise.approvalChoice, null, 'scope',
+      ).lastInsertRowid,
+    );
+    this.#grantEvent(s.business, {
+      action: 'grant.scope.used', grantDecision: d.id, decisionSeq: seq, method: raise.grant.method,
+      agent: raise.grant.agent, scopeSha256: sha256(JSON.stringify(scope)),
+    }, d.id);
+    // As the resolve's: each executor rechecks all of this itself, so a rollback starts nothing.
+    if (raise.grant.method === 'host') setImmediate(() => this.#runHostGrant(s.business, d.id));
+    if (raise.grant.method === 'gitea') setImmediate(() => this.#startGitea(s.business, d.id));
+    return this.#decisionView(this.#decision(s, d.id));
+  }
+  // Row 298 (D6, sage-3594 Q5): at the spend, a scope close needs its grant still inside the scope.
+  // A narrowed scope ends it scope-changed, and the human's Approve is the way back.
+  #scopeRecheck(business, decision, g) {
+    if (this.#closed(decision)?.via === 'scope' && !grantInScope(this.#scopeNow(business), g)) fail('scope-changed');
+  }
  // Row 252: the console answer's human.input for close row r. Same decision, same seq, same choice,
  // no role or run, and a three-string owner subject.
  #consoleInput(business, decision, r) {
@@ -1774,6 +1829,7 @@ export class Broker {
  }
  // r6 X2 step 1's checks after the spend, R4's binding again. Throws the code that ends the grant.
  #hostGrantRecheck(business, decision, g) {
+    this.#scopeRecheck(business, decision, g);
    if (!this.#hostGrant || !this.#hostKeys) fail('host-not-configured');
    const definition = this.#hostDefinition(business, g.agent);
    if (this.#hostGrant.definitionSha256(definition) !== g.definitionSha256) fail('decision-mismatch');
@@ -2574,7 +2630,7 @@ export class Broker {
        if (!this.#giteaGrant) fail('gitea-not-configured');
        const g = this.#giteaGrant.giteaGrantCheck(a.grant, this.#now().slice(0, 10));
        return this.#store.transaction(() => {
-          const result = this.#dispatch(s, 'decision.raise', a, null, this.#giteaGrantBinding(s.business, g));
+          const result = this.#scopeClose(s, this.#dispatch(s, 'decision.raise', a, null, this.#giteaGrantBinding(s.business, g)));
          this.#secretCheck(result);
          return result;
        });
@@ -2583,7 +2639,7 @@ export class Broker {
      if (a.grant?.method === 'host') {
        const g = this.#hostGrant.hostGrantCheck(a.grant, this.#now().slice(0, 10));
        return this.#store.transaction(() => {
-          const result = this.#dispatch(s, 'decision.raise', a, null, this.#hostGrantBinding(s.business, g));
+          const result = this.#scopeClose(s, this.#dispatch(s, 'decision.raise', a, null, this.#hostGrantBinding(s.business, g)));
          this.#secretCheck(result);
          return result;
        });
@@ -2705,6 +2761,7 @@ export class Broker {
  }
  // Section 4 step 1's checks after the spend. Throws the code that ends the grant.
  #giteaRecheck(business, decision, g) {
+    this.#scopeRecheck(business, decision, g);
    const { b, role, definition } = this.#giteaRole(business, g.agent);
    if (this.#giteaGrant.definitionSha256(definition) !== g.definitionSha256) fail('decision-mismatch');
    if (this.#giteaGrant.identitySha256(role, b.projects) !== g.identitySha256) fail('decision-mismatch');
@@ -4678,6 +4735,8 @@ export class Broker {
      if (CREDENTIAL_VERBS.includes(request.verb)) return this.#requestCredential(s, request.verb, structuredClone(args));
      if (request.verb === 'instance.hire' || request.verb === 'instance.fire')
        return this.#chiefLifecycle(s, request.verb, structuredClone(args));
+      if (request.verb === 'grants.scope' || request.verb === 'grants.scope.set')
+        return this.#grantScopeVerb(s, request.verb, structuredClone(args));
      if (["limits", "limits.set", "organization.set", "organization.revision", "plugins", "plugins.set", "instances", "instances.set", "routes", "routes.set", "veto.set"].includes(request.verb)) {
        // Row 123 (#1617, REQ-COS-1, REQ-LIMIT-1): organization.set is limits.set for a role whose
        // file lists organization.change. It takes the same keys, runs the same write path and
@@ -4775,6 +4834,34 @@ export class Broker {
      throw this.#refused(s, e, request);
    }
  }
+  // Row 298 (#1804, Q228, sage-3594 Q3): the chief's grant scope, read and written by the human at the
+  // cli alone, and the write is the human's Approve of the change. #human is the one check, so an
+  // agent, the chief, the tester and a reader refuse human-required (the Console's cap never gets
+  // here). bindHuman binds only the business's human. The writer is the organization writer's
+  // grantScope; ORGANIZATION_KEYS doesn't name grantScope, so organization.set and limits.set can't
+  // write it. Outside the store transaction, as the organization branch.
+  #grantScopeVerb(s, verb, a) {
+    this.#human(s);
+    if (!this.#organization) fail('not-configured');
+    if (verb === 'grants.scope') keys(a, []);
+    else keys(a, ['revision', 'scope'], ['revision', 'scope']);
+    let result;
+    try {
+      result = this.#organization(s.business, verb, a, s.human);
+    } catch (e) {
+      this.#organizationFail(e, verb);
+    }
+    this.#secretCheck(result);
+    // The change's record: the human proof bindHuman checked, and the old and new scopes' sha256.
+    // The writer's changes.jsonl entry holds the values.
+    if (verb === 'grants.scope.set')
+      this.#store.transaction(() => this.#grantEvent(s.business, {
+        action: 'grant.scope', by: s.human, via: s.via, outsideAgent: s.outsideAgent === true,
+        oldSha256: sha256(JSON.stringify(result.old)), newSha256: sha256(JSON.stringify(result.scope)),
+        transaction: result.transaction ?? null,
+      }));
+    return result;
+  }
  // Row 199 (#1697, design section 6). The token of an issue comes in args from the human's stdin; the
  // secret check above has refused one the bus already holds, a refusal records its code alone, and
  // nothing returned carries it. Outside the store transaction, as the organization branch.
@@ -5134,42 +5221,10 @@ export class Broker {
      throw this.#refused(s, ProjectFailure && e instanceof ProjectFailure ? new BusError(e.code) : e, request);
    }
  }
-  // Row 224 C2-05b: the agent never supplies a host repo, commit or business. Its current
-  // holder and business entry are rechecked before/after awaits; runtime owns Git and queries.
-  async #requestLibraryLookup(s, { verb, args }) {
-    try {
-      this.#agent(s);
-      const business = this.#business(s.business);
-      const projects = Object.entries(business.projects ?? {}).filter(([, entry]) => entry.kind === 'library');
-      if (!projects.length || typeof this.#library?.lookup !== 'function') fail('library-not-configured');
-      const spec = LIBRARY_LOOKUPS[verb];
-      keys(args, ['project', ...spec.fields], spec.required);
-      if (!text(args.universe, 160)) fail('invalid-request');
-      if (args.project === undefined && projects.length !== 1) fail('invalid-request');
-      const project = args.project ?? projects[0][0];
-      if (!text(project, 160) || !projects.some(([name]) => name === project)) fail('library-not-configured');
-      const revision = JSON.stringify(business.projects[project]);
-      const authorize = () => {
-        this.#agent(s);
-        this.#processingGate(s, verb);
-        if (JSON.stringify(this.#business(s.business).projects?.[project]) !== revision) fail('library-not-configured');
-      };
-      const { project: ignored, ...query } = args;
-      authorize();
-      const result = await this.#library.lookup({ business, project }, { method: spec.method, args: query, authorize });
-      authorize();
-      this.#secretCheck(result);
-      return result;
-    } catch (error) {
-      const Failure = this.#library?.LibraryError;
-      throw this.#refused(s, Failure && error instanceof Failure ? new BusError(error.code) : error, { verb, args });
-    }
-  }
  // C2-04 M4: only a verified human reads library text or status. Host Git
  // functions stay injected, preserving this module's sandbox import closure.
  async #requestLibrary(s, request) {
    const { verb, args } = request;
-    if (Object.hasOwn(LIBRARY_LOOKUPS, verb)) return this.#requestLibraryLookup(s, request);
    try {
      this.#human(s);
      const fields = verb === 'library.file' ? ['project', 'path'] : verb === 'library.sync' ? ['project', 'accept'] : ['project'];
@@ -87,38 +87,6 @@ export async function harnessLevels({ log = (e) => process.stderr.write(`plugins
  }
  return (name) => levels.get(name) ?? null;
 }
-// Row 224 C2-05b: a host-only adapter. A failed fetch keeps serving immutable old
-// objects, as C2-03a requires; no caller may select a repo, commit or sync --accept.
-export function createLibraryLookup({ dataRoot, sync, now = () => Date.now() }) {
-  const methods = { find: libraryModule.find, get: libraryModule.get, search: libraryModule.search,
-    manuscript: libraryModule.manuscript, universeInfo: libraryModule.universeInfo };
-  return async (context, { method, args, authorize }) => {
-    if (!Object.hasOwn(methods, method)) throw new libraryModule.LibraryError('query-argument-invalid', 'unknown lookup');
-    authorize();
-    const source = { ...context, dataRoot };
-    let state = await libraryModule.libraryStatus(source);
-    authorize();
-    // sage-2819 / dewey-0852: failed attempts also pace inline retries. Otherwise an
-    // outage makes every lookup refetch while lastFetch remains old or null.
-    const recentAttempt = Math.max(state.lastFetch === null ? -Infinity : Date.parse(state.lastFetch),
-      state.lastError === null ? -Infinity : Date.parse(state.lastError.at));
-    const age = now() - recentAttempt;
-    if (age > libraryModule.SYNC_INTERVAL_MS || age < 0) {
-      try { await sync(source); }
-      catch (error) {
-        // A timer may already be fetching this mirror. Its current served state is still safe.
-        if (!(error instanceof libraryModule.LibraryError) || error.code !== 'library-sync-busy') throw error;
-      }
-      authorize();
-      state = await libraryModule.libraryStatus(source);
-    }
-    if (!state.served) throw new libraryModule.LibraryError('library-commit', 'library has never been synced');
-    authorize();
-    return methods[method]({ repo: libraryModule.mirrorPath(source), commit: state.served,
-      mapping: libraryModule.checkMapping(context.business.projects[context.project]) }, args);
-  };
-}
-
 export async function startBroker({
  dataRoot,
  businesses,
@@ -333,8 +301,6 @@ export async function startBroker({
      store,
      businesses,
      library: {
-        lookup: createLibraryLookup({ dataRoot, sync: context =>
-          processing.work(() => libraryModule.sync(context, syncOptions(context.business))) }),
        readFile: context => libraryModule.readLibraryFile({ ...context, dataRoot }),
        status: context => libraryModule.libraryStatus({ ...context, dataRoot }),
        sync: (context, { accept }) => processing.work(() => libraryModule.sync({ ...context, dataRoot }, { ...syncOptions(context.business), accept })),
@@ -357,6 +323,8 @@ export async function startBroker({
        if(verb==='instances')return instances.read(id,actor);
        // Row 65 (mos-0840): the Console's routing table.
        if(verb==='routes')return settings.routes(id);
+        // Row 298 (#1804, Q228): the chief's grant scope as the file stands, the fallback shown.
+        if(verb==='grants.scope')return instances.grantScopeRead(id);
        // Row 194 (#1692, V5): a delete's checks at the verb, with no write and no reload.
        if(verb==='instances.check')return instances.checkDelete(id,args.instance,actor);
        // Row 194 b6 (webby-0094 B1): a fire's checks against the file, before step A.
@@ -368,6 +336,8 @@ export async function startBroker({
        else if(verb==='plugins.set')result=plugins.set(id,args,actor);
        // Row 194 (#1692, V6): the human's keep and noHire lists, through the instance writer.
        else if(verb==='veto.set')result=instances.veto(id,args,actor);
+        // Row 298: the human's grant scope, through the instance writer.
+        else if(verb==='grants.scope.set')result=instances.grantScope(id,args,actor);
        // Row 194 (D2.1, D2.2): the chief's hire and fire, with the reason in the change context.
        else if(verb==='instance.hire')result=instances.hire(id,args,{actor,context});
        else if(verb==='instance.fire')result=instances.fire(id,{name:args.name},{actor,context});
@@ -399,6 +369,12 @@ export async function startBroker({
          return false;
        }
      },
+      // Row 298 (#1804, Q228): launch.grantScope as the file stands now, unchecked. The broker checks
+      // it; a throw here (an unreadable file) is the empty scope there.
+      grantScope: (id) => {
+        const b = settings ? settings.current(id) : businesses[id];
+        return b?.launch?.grantScope;
+      },
      // Row 194 (#1692, D4.1, B8): bus.tester as the file sets it now; an unreadable file is off.
      testerOn: (id) => {
        try {
@@ -0,0 +1,264 @@
+// Row 298 (#1804, Q228): the chief of staff's grant scope at the broker. The human's grants.scope and
+// grants.scope.set (sage-3594 Q3), the in-scope close via 'scope' with grant.scope.used (Q4), the
+// spend recheck's scope-changed (Q5), and the out-of-scope raise that still waits for the human.
+// Gitea grants run against the fake Gitea in fake-gitea-api.mjs on 127.0.0.1; host grants stop at the
+// spend, as no host key store is configured, and nothing connects to a host. Every token is a fake the
+// fake made and none is printed. The organization writer is a fake here; the real one is
+// packages/business/tests/grant-scope.test.mjs.
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { createHash } from 'node:crypto';
+import { mkdirSync, mkdtempSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { Broker, GRANT_EVIDENCE } from '../src/broker.mjs';
+import { Credentials } from '../src/credentials.mjs';
+import { giteaGrant, giteaKeys } from '../src/gitea-grant.mjs';
+import { hostGrant } from '../src/host-grant.mjs';
+import { Store } from '../src/store.mjs';
+import { checkGrantScope, grantScopeOf } from '../../business/src/vocabulary.mjs';
+import { fakeGiteaApi } from './fake-gitea-api.mjs';
+import { hostRecord } from './host-fixtures.mjs';
+
+const USER = 'demo-coder';
+const ENTRY = { address: '192.0.2.10', port: 22, user: 'jarvis', hostKeys: ['ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHostKeyForTests'] };
+const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
+const sha256 = (x) => createHash('sha256').update(x).digest('hex');
+const dayFrom = (n) => new Date(Date.now() + n * 86400000).toISOString().slice(0, 10);
+const options = [{ key: 'yes', text: 'Yes' }, { key: 'no', text: 'No' }];
+const none = { authority: { withinRole: ['message.send'], crossRole: [] } };
+const DEFINITIONS = {
+  'chief-of-staff': { roleVersion: 2, credentials: [] },
+  pm: { roleVersion: 2, credentials: [] },
+  coder: { roleVersion: 2, credentials: [{ service: 'gitea' }] },
+  ops: { roleVersion: 2, credentials: [{ service: 'host' }] },
+};
+const GITEA = { gitea: { agents: ['coder'], projects: ['app'] } };
+const HOST = { host: { agents: ['ops'], hosts: ['web1'], commandPrefixes: [['systemctl', 'status']] } };
+const REVISION = 'a'.repeat(64);
+async function until(fn, ms = 10000) {
+  const end = Date.now() + ms;
+  while (!fn()) {
+    if (Date.now() > end) throw new Error('timed out');
+    await sleep(20);
+  }
+}
+const rejects = (p, code) => assert.rejects(Promise.resolve().then(p), (e) => (assert.equal(e.code, code), true));
+
+// opts.scope: the value grantScope answers, or a function called at each read.
+async function setup(t, opts = {}) {
+  const dir = mkdtempSync(join(tmpdir(), 'g298-'));
+  t.after(() => rmSync(dir, { recursive: true, force: true }));
+  const gitea = await fakeGiteaApi(t, join(dir, 'tls'));
+  gitea.addUser('acme');
+  gitea.addRepo('acme', 'app');
+  gitea.addRepo('acme', 'lib');
+  const configDir = join(dir, 'cfg');
+  mkdirSync(configDir, { mode: 0o700 });
+  const storeRoot = join(configDir, 'secrets', 'agents');
+  mkdirSync(join(dir, 'data'), { mode: 0o700 });
+  const store = new Store(join(dir, 'data'));
+  const credentials = new Credentials({ references: {}, storeRoot, dataRoot: join(dir, 'data') });
+  t.after(() => {
+    credentials.close();
+    store.close();
+  });
+  const business = {
+    id: 'demo',
+    human: 'jason',
+    arbiters: { technical: 'pm', delivery: 'pm' },
+    roles: {
+      chief: { definition: 'chief-of-staff', ...none },
+      // A second chief-of-staff instance, as an instances.set or the tester could add. It isn't launch.by.
+      chief2: { definition: 'chief-of-staff', ...none },
+      pm: { definition: 'pm', ...none },
+      coder: { definition: 'coder', ...none, identity: { name: 'Coder', email: '[email protected]', gitea: { url: gitea.url, user: USER } }, publish: ['app', 'lib'] },
+      ops: { definition: 'ops', ...none },
+    },
+    definitions: structuredClone(DEFINITIONS),
+    projects: Object.fromEntries(['app', 'lib'].map((p) => [p, { remote: `${gitea.url}/acme/${p}` }])),
+    launch: { by: 'chief', instances: ['pm', 'coder', 'ops'] },
+    vars: { 'bus.tester': true },
+  };
+  const grantApi = giteaGrant({ configDir, ca: gitea.ca, timeoutMs: 5000 });
+  grantApi.writeAdmin('demo', gitea.adminToken, { url: gitea.url, account: 'mosaic-grant', rotateBy: dayFrom(60), setAt: '2026-10-21T00:00:00.000Z' });
+  // The fake organization writer: the scope in a box, checked as the real writer checks it.
+  const box = { value: opts.scope };
+  const orgCalls = [];
+  const organization = (id, verb, args, actor) => {
+    orgCalls.push([verb, actor]);
+    if (verb === 'grants.scope') return { business: id, revision: REVISION, ...grantScopeOf(box.value) };
+    if (verb === 'grants.scope.set') {
+      const scope = checkGrantScope(args.scope);
+      if (scope === null) throw Object.assign(new Error('scope is not a grant scope'), { code: 'invalid-request' });
+      const old = grantScopeOf(box.value).scope;
+      box.value = scope;
+      return { business: id, scope, old, transaction: 'tx-298' };
+    }
+    return { revision: REVISION };
+  };
+  const broker = new Broker({
+    store,
+    businesses: { demo: business },
+    secretCheck: (value) => credentials.assertClean(value),
+    giteaGrant: grantApi,
+    giteaKeys: giteaKeys({ credentials, storeRoot }),
+    hostGrant: hostGrant({ configDir, runRoot: join(configDir, 'secrets', 'run') }),
+    organization,
+    grantScope: () => (typeof box.value === 'function' ? box.value() : box.value),
+  });
+  const caps = {};
+  for (const role of ['chief', 'chief2', 'pm']) {
+    caps[role] = broker.bindLaunch({ business: 'demo', role, run: role + '-run', harness: 'pi', address: role });
+    broker.request(caps[role], { verb: 'role.claim' });
+  }
+  caps.human = broker.bindHuman({ business: 'demo', human: 'jason', via: 'cli', outsideAgent: true });
+  caps.tester = broker.bindTester({ business: 'demo' });
+  caps.reader = broker.bindReader({ business: 'demo' });
+  caps.console = broker.bindConsole({ business: 'demo', human: 'jason', subject: { provider: 'p', iss: 'https://idp.example.test', sub: 's' } });
+  hostRecord(store, { host: 'web1', entry: ENTRY });
+  const call = (who, verb, args = {}) => broker.request(caps[who], { verb, args });
+  const raiseGitea = (over = {}, who = 'chief') =>
+    call(who, 'decision.raise', {
+      action: 'credential.mint', question: 'Grant coder Gitea?', options, recommendation: 'yes', blocking: false,
+      grant: { method: 'gitea', agent: 'coder', target: { projects: ['app'] }, rotateBy: dayFrom(30), ...over },
+    });
+  const raiseHost = (over = {}, who = 'chief') =>
+    call(who, 'decision.raise', {
+      action: 'credential.mint', question: 'Grant ops web1?', options, recommendation: 'yes', blocking: false,
+      grant: { method: 'host', agent: 'ops', host: 'web1', commands: [['systemctl', 'status', 'nginx']], rotateBy: dayFrom(30), ...over },
+    });
+  const grantEvents = () =>
+    store.all(`SELECT body FROM events WHERE business='demo' AND ${GRANT_EVIDENCE} ORDER BY seq`).map((e) => JSON.parse(e.body));
+  const ended = (decision) => grantEvents().findLast((e) => e.grantDecision === decision && ['grant.applied', 'grant.failed'].includes(e.action));
+  const closes = (decision) => store.all('SELECT * FROM decision_events WHERE decision=? ORDER BY seq', decision);
+  const spent = (decision) => grantEvents().filter((e) => e.decision === decision && e.operation?.startsWith('grant.')).map((e) => e.operation);
+  const record = () => store.get("SELECT * FROM gitea_grants WHERE business='demo' AND agent='coder'");
+  return { store, broker, caps, box, orgCalls, call, raiseGitea, raiseHost, grantEvents, ended, closes, spent, record, gitea };
+}
+
+test('row 298 (Q3): only the human at the cli reads or sets the scope; agents, the tester, a reader and the Console refuse', async (t) => {
+  const f = await setup(t);
+  for (const verb of ['grants.scope', 'grants.scope.set']) {
+    const args = verb === 'grants.scope' ? {} : { revision: REVISION, scope: GITEA };
+    for (const who of ['chief', 'chief2', 'pm', 'tester']) await rejects(() => f.call(who, verb, args), 'human-required');
+    await rejects(() => f.call('reader', verb, args), 'read-only');
+    await rejects(() => f.call('console', verb, args), 'human-required');
+  }
+  assert.deepEqual(f.orgCalls, []);
+  assert.equal(f.box.value, undefined);
+  assert.deepEqual(f.grantEvents().filter((e) => e.action === 'grant.scope'), []);
+});
+
+test('row 298 (Q1): organization.set and limits.set refuse a grantScope key, and nothing is written', async (t) => {
+  const f = await setup(t);
+  await rejects(() => f.call('human', 'limits.set', { revision: REVISION, grantScope: GITEA }), 'invalid-request');
+  await rejects(() => f.call('chief', 'organization.set', { revision: REVISION, grantScope: GITEA }), 'invalid-request');
+  assert.deepEqual(f.orgCalls, []);
+  assert.equal(f.box.value, undefined);
+});
+
+test('row 298 (Q3): the human verb writes the scope and a grant.scope record with the human proof and both sha256', async (t) => {
+  const f = await setup(t);
+  assert.deepEqual(await f.call('human', 'grants.scope'), { business: 'demo', revision: REVISION, scope: {}, fallback: false });
+  const r = await f.call('human', 'grants.scope.set', { revision: REVISION, scope: GITEA });
+  assert.deepEqual(r.scope, GITEA);
+  assert.deepEqual(f.orgCalls, [['grants.scope', 'jason'], ['grants.scope.set', 'jason']]);
+  const changes = f.grantEvents().filter((e) => e.action === 'grant.scope');
+  assert.deepEqual(changes, [{
+    action: 'grant.scope', by: 'jason', via: 'cli', outsideAgent: true,
+    oldSha256: sha256(JSON.stringify({})), newSha256: sha256(JSON.stringify(GITEA)), transaction: 'tx-298',
+  }]);
+  await rejects(() => f.call('human', 'grants.scope.set', { revision: REVISION, scope: { gitea: {} } }), 'invalid-request');
+  await rejects(() => f.call('human', 'grants.scope.set', { revision: REVISION }), 'invalid-request');
+  await rejects(() => f.call('human', 'grants.scope.set', { revision: REVISION, scope: {}, extra: 1 }), 'invalid-request');
+  assert.equal(f.grantEvents().filter((e) => e.action === 'grant.scope').length, 1);
+});
+
+test('row 298 (Q4): an in-scope Gitea grant is issued with no inbox item, logged with 236 records, and revocable', async (t) => {
+  const f = await setup(t, { scope: GITEA });
+  const d = await f.raiseGitea();
+  const [close] = f.closes(d.id);
+  assert.deepEqual([close.op, close.by, close.choice, close.via], ['resolved', 'grant-scope', 'yes', 'scope']);
+  const inbox = await f.call('human', 'inbox');
+  assert.ok(!JSON.stringify(inbox).includes(d.id), 'the decision is not in the human inbox');
+  await until(() => f.ended(d.id));
+  await f.broker.giteaIdle();
+  assert.equal(f.ended(d.id).action, 'grant.applied');
+  const used = f.grantEvents().find((e) => e.action === 'grant.scope.used');
+  assert.deepEqual(used, {
+    action: 'grant.scope.used', grantDecision: d.id, decisionSeq: close.seq, method: 'gitea', agent: 'coder', scopeSha256: sha256(JSON.stringify(GITEA)),
+  });
+  assert.deepEqual(f.spent(d.id), ['grant.gitea']);
+  assert.equal(f.record().decision, d.id);
+  // The spend is row 236's: a second start finds it consumed.
+  assert.equal(await f.broker.giteaStart?.('demo', d.id) ?? 'decision-consumed', 'decision-consumed');
+  const out = await f.call('human', 'grants.revoke', { service: 'gitea', agent: 'coder', reason: 'test' });
+  assert.deepEqual(out.serviceLeft, []);
+  assert.ok(f.grantEvents().some((e) => e.action === 'grant.revoked' && e.agent === 'coder'));
+  assert.equal(f.record(), undefined);
+});
+
+test('row 298: an out-of-scope Gitea grant waits for the human, whose Approve still issues it', async (t) => {
+  const f = await setup(t, { scope: GITEA });
+  const d = await f.raiseGitea({ target: { projects: ['app', 'lib'] } });
+  assert.deepEqual(f.closes(d.id), []);
+  assert.ok(JSON.stringify(await f.call('human', 'inbox')).includes(d.id));
+  assert.deepEqual(f.grantEvents().filter((e) => e.action === 'grant.scope.used'), []);
+  await f.call('human', 'decision.resolve', { id: d.id, choice: 'yes' });
+  await until(() => f.ended(d.id));
+  await f.broker.giteaIdle();
+  assert.equal(f.ended(d.id).action, 'grant.applied');
+});
+
+test('row 298: with no scope, a bad scope or an unreadable file, an in-scope-looking grant waits', async (t) => {
+  const bad = { gitea: { agents: ['coder'], projects: ['app'], note: 'not a key' } };
+  for (const scope of [undefined, bad, () => { throw new Error('unreadable'); }]) {
+    const f = await setup(t, { scope });
+    const d = await f.raiseGitea();
+    assert.deepEqual(f.closes(d.id), [], String(scope));
+    assert.deepEqual(f.grantEvents().filter((e) => e.action === 'grant.scope.used'), []);
+  }
+});
+
+test('row 298 (Q6): a chief-of-staff instance that is not launch.by never raises in scope', async (t) => {
+  const f = await setup(t, { scope: GITEA });
+  const d = await f.raiseGitea({}, 'chief2');
+  assert.deepEqual(f.closes(d.id), []);
+});
+
+test('row 298 (Q5): a scope narrowed between the raise and the spend ends the grant scope-changed', async (t) => {
+  let reads = 0;
+  const f = await setup(t, { scope: () => (reads++ === 0 ? GITEA : {}) });
+  const d = await f.raiseGitea();
+  assert.equal(f.closes(d.id)[0].via, 'scope');
+  await until(() => f.ended(d.id));
+  await f.broker.giteaIdle();
+  assert.deepEqual([f.ended(d.id).action, f.ended(d.id).code], ['grant.failed', 'scope-changed']);
+  assert.equal(f.record(), undefined);
+  assert.deepEqual(f.gitea.tokens(USER) ?? [], []);
+});
+
+test('row 298 (Q2): an in-scope host grant is spent with no Approve; ls never covers lsblk, nor a scope command extra arguments', async (t) => {
+  const scope = { host: { agents: ['ops'], hosts: ['web1'], commands: [['ls']], commandPrefixes: [['systemctl', 'status']] } };
+  const f = await setup(t, { scope });
+  const d = await f.raiseHost();
+  assert.equal(f.closes(d.id)[0].via, 'scope');
+  await until(() => f.ended(d.id));
+  // The spend is row 235's. No host key store is configured, so the recheck after it ends here.
+  assert.deepEqual(f.spent(d.id), ['grant.host']);
+  assert.deepEqual([f.ended(d.id).action, f.ended(d.id).code], ['grant.failed', 'host-not-configured']);
+  for (const commands of [[['lsblk']], [['ls', '-l']], [['systemctl', 'restart']]]) {
+    const w = await f.raiseHost({ commands });
+    assert.deepEqual(f.closes(w.id), [], JSON.stringify(commands));
+  }
+});
+
+test('row 298 (Q5): a host scope narrowed before the spend ends scope-changed', async (t) => {
+  let reads = 0;
+  const f = await setup(t, { scope: () => (reads++ === 0 ? HOST : {}) });
+  const d = await f.raiseHost();
+  assert.equal(f.closes(d.id)[0].via, 'scope');
+  await until(() => f.ended(d.id));
+  assert.deepEqual([f.ended(d.id).action, f.ended(d.id).code], ['grant.failed', 'scope-changed']);
+});
@@ -1,251 +0,0 @@
-// Row 224: exercise broker authorization, real C2-05a queries and host served snapshots.
-// All bodies and remotes are made up. External sync is replaced only at its trusted host seam.
-import test from 'node:test';
-import assert from 'node:assert/strict';
-import { mkdirSync, writeFileSync } from 'node:fs';
-import { join } from 'node:path';
-import { Store } from '../src/store.mjs';
-import { Broker } from '../src/broker.mjs';
-import { createLibraryLookup, startBroker } from '../src/runtime.mjs';
-import { serve } from '../src/server.mjs';
-import { Client } from '../src/client.mjs';
-import * as library from '../../library/src/index.mjs';
-import { scratchRepo, note } from '../../library/tests/query-fixture.mjs';
-import { mappingEntry, git } from '../../library/tests/helpers.mjs';
-
-const NOW = Date.parse('2026-10-22T16:00:00.000Z');
-const VERBS = ['library.find', 'library.get', 'library.search', 'library.manuscript', 'library.universe'];
-const GET = { universe: 'harbor', path: 'Book One/Characters/Tomas.md' };
-const ARGS = [
-  { universe: 'harbor', query: 'Tomas' }, GET,
-  { universe: 'harbor', text: 'ferry' }, { universe: 'harbor', book: 'Book One' }, { universe: 'harbor' },
-];
-const TEXTS = {
-  'Book One/Characters/Tomas.md': note('character', 'Tomas', 'He runs the ferry. [[Elsewhere]]'),
-  'Book One/Chapters/01.md': '# A ferry\nOne line.\n',
-  'Book One/Playground/What If.md': note('character', 'Maybe Tomas', 'Unwritten ferry.'),
-  'Second World/Characters/Elsewhere.md': note('character', 'Elsewhere', 'Other ferry.'),
-};
-
-async function world(t, { projects, adapter, claimed = true, now = () => NOW, files = TEXTS } = {}) {
-  const f = scratchRepo(t, files), dataRoot = join(f.root, 'data');
-  mkdirSync(dataRoot);
-  const business = { id: 'acme', human: 'jason', vars: { 'bus.tester': true },
-    projects: projects ?? { books: mappingEntry() }, arbiters: { technical: 'coder', delivery: 'coder' },
-    roles: { coder: { definition: 'coder', authority: { withinRole: [], crossRole: [] } } } };
-  const context = { business, project: 'books', dataRoot };
-  let mirror = null, state = null, fetches = 0;
-  if (business.projects.books?.kind === 'library') {
-    mirror = await library.ensureMirror(context);
-    git(f.repo, '-c', 'protocol.file.allow=always', 'push', '-q', mirror, 'HEAD:refs/heads/served');
-    state = { version: 1, branch: 'main', served: f.commit, lastFetch: new Date(NOW).toISOString(),
-      lastError: null, diverged: null, problems: [] };
-    writeFileSync(join(mirror, library.SYNC_STATE_FILE), JSON.stringify(state), { mode: 0o600 });
-  }
-  const setState = patch => {
-    state = { ...state, ...patch };
-    writeFileSync(join(mirror, library.SYNC_STATE_FILE), JSON.stringify(state), { mode: 0o600 });
-  };
-  const lookup = createLibraryLookup({ dataRoot, now, sync: async () => {
-    fetches++;
-    setState({ lastFetch: new Date(now()).toISOString() });
-    return { state, code: null };
-  } });
-  const store = new Store(dataRoot);
-  t.after(() => store.close());
-  const broker = new Broker({ store, businesses: { acme: business },
-    library: adapter ?? { lookup, LibraryError: library.LibraryError } });
-  const agent = broker.bindLaunch({ business: 'acme', role: 'coder', run: 'r224', harness: 'pi' });
-  if (claimed) broker.request(agent, { verb: 'role.claim' });
-  const human = broker.bindHuman({ business: 'acme', human: 'jason', via: 'cli', outsideAgent: true });
-  const reader = broker.bindReader({ business: 'acme' }), tester = broker.bindTester({ business: 'acme' });
-  const call = (verb, args = {}, cap = agent) => Promise.resolve().then(() => broker.request(cap, { verb, args }));
-  return { ...f, dataRoot, business, context, mirror, store, broker, agent, human, reader, tester,
-    call, lookup, setState, fetches: () => fetches };
-}
-
-test('all five agent verbs read the configured served commit through real queries', async t => {
-  const f = await world(t);
-  const [find, get, search, manuscript, universe] = await Promise.all(VERBS.map((verb, i) => f.call(verb, ARGS[i])));
-  for (const result of [find, get, search, manuscript, universe]) assert.equal(result.commit, f.commit);
-  assert.deepEqual(find.results.map(x => x.path), ['Book One/Characters/Tomas.md']);
-  assert.match(JSON.stringify(get.lines), /He runs the ferry/);
-  assert.deepEqual(get.links_out, []); // The only target is in another universe.
-  assert.ok(search.results.length > 0);
-  assert.ok(search.results.every(x => !x.path.startsWith('Second World/') && x.scope === 'canon'));
-  assert.equal(manuscript.path, 'Book One/Chapters/01.md');
-  assert.deepEqual(universe.books, ['Book One']);
-  assert.equal(f.fetches(), 0);
-  const playground = await f.call('library.find', { universe: 'harbor', query: '', scope: 'playground' });
-  assert.deepEqual(playground.results.map(x => x.path), ['Book One/Playground/What If.md']);
-  assert.equal(await f.call('library.get', { universe: 'harbor', path: 'Second World/Characters/Elsewhere.md' }), null);
-});
-
-test('each verb refuses missing universe and unknown keys before host work', async t => {
-  let calls = 0;
-  const f = await world(t, { adapter: { lookup: () => { calls++; } } });
-  for (const [i, verb] of VERBS.entries()) {
-    const { universe, ...missing } = ARGS[i];
-    await assert.rejects(f.call(verb, missing), { code: 'invalid-request' });
-    for (const extra of [{ repo: '/elsewhere' }, { commit: 'b'.repeat(40) }, { business: 'other' }, { accept: 'b'.repeat(40) }])
-      await assert.rejects(f.call(verb, { ...ARGS[i], ...extra }), { code: 'invalid-request' });
-    await assert.rejects(f.call(verb, { ...ARGS[i], universe: '' }), { code: 'invalid-request' });
-  }
-  assert.equal(calls, 0);
-});
-
-test('no library, missing host adapter and undeclared project refuse library-not-configured', async t => {
-  const noLibrary = await world(t, { projects: {} });
-  const noAdapter = await world(t, { adapter: {} });
-  const f = await world(t);
-  for (const [i, verb] of VERBS.entries()) {
-    await assert.rejects(noLibrary.call(verb, ARGS[i]), { code: 'library-not-configured' });
-    await assert.rejects(noAdapter.call(verb, ARGS[i]), { code: 'library-not-configured' });
-    await assert.rejects(f.call(verb, { ...ARGS[i], project: 'other' }), { code: 'library-not-configured' });
-  }
-  f.business.projects.second = mappingEntry();
-  await assert.rejects(f.call('library.get', GET), { code: 'invalid-request' });
-  assert.equal((await f.call('library.get', { ...GET, project: 'books' })).commit, f.commit);
-});
-
-test('reads need the current holder on each call; human/tester/reader are not agents', async t => {
-  const f = await world(t, { claimed: false });
-  for (const [i, verb] of VERBS.entries()) {
-    await assert.rejects(f.call(verb, ARGS[i]), { code: 'not-holder' });
-    await assert.rejects(f.call(verb, ARGS[i], f.human), { code: 'agent-required' });
-    await assert.rejects(f.call(verb, ARGS[i], f.tester), { code: 'tester-refused' });
-    await assert.rejects(f.call(verb, ARGS[i], f.reader), { code: 'read-only' });
-  }
-  f.broker.request(f.agent, { verb: 'role.claim' });
-  assert.equal((await f.call('library.get', GET)).commit, f.commit);
-  f.broker.request(f.agent, { verb: 'role.release' });
-  await assert.rejects(f.call('library.get', GET), { code: 'not-holder' });
-});
-
-test('releasing a claim during an async lookup fences the response', { timeout: 30_000 }, async t => {
-  let release, entered;
-  const started = new Promise(resolve => { entered = resolve; });
-  const f = await world(t, { adapter: { lookup: async () => {
-    entered(); await new Promise(resolve => { release = resolve; }); return { lines: [[1, 'not returned']] };
-  } } });
-  const pending = f.call('library.get', GET);
-  await started;
-  f.broker.request(f.agent, { verb: 'role.release' });
-  release();
-  await assert.rejects(pending, { code: 'not-holder' });
-});
-
-test('a business library removed during an async read cannot leak its result', { timeout: 30_000 }, async t => {
-  let release, entered;
-  const started = new Promise(resolve => { entered = resolve; });
-  const f = await world(t, { adapter: { lookup: async () => {
-    entered(); await new Promise(resolve => { release = resolve; }); return { lines: [[1, 'not returned']] };
-  } } });
-  const pending = f.call('library.get', GET);
-  await started;
-  delete f.business.projects.books;
-  release();
-  await assert.rejects(pending, { code: 'library-not-configured' });
-});
-
-test('freshness boundary, unknown last fetch and failed fetch still use immutable served state', async t => {
-  const f = await world(t);
-  f.setState({ lastFetch: new Date(NOW - 60_000).toISOString() });
-  await f.call('library.get', GET);
-  assert.equal(f.fetches(), 0);
-  f.setState({ lastFetch: new Date(NOW - 60_001).toISOString() });
-  await f.call('library.get', GET);
-  assert.equal(f.fetches(), 1);
-  f.setState({ lastFetch: null });
-  await f.call('library.universe', { universe: 'harbor' });
-  assert.equal(f.fetches(), 2);
-  let attempted = 0, clock = NOW;
-  const failing = createLibraryLookup({ dataRoot: f.dataRoot, now: () => clock, sync: async () => {
-    attempted++;
-    f.setState({ lastError: { code: 'library-fetch-failed', at: new Date(clock).toISOString() } });
-    return { code: 'library-fetch-failed' };
-  } });
-  f.setState({ lastFetch: null });
-  const result = await failing(f.context, { method: 'get', args: GET, authorize() {} });
-  assert.equal(attempted, 1);
-  assert.equal(result.commit, f.commit);
-  for (const elapsed of [1, 59_999, 60_000]) {
-    clock = NOW + elapsed;
-    const retry = await failing(f.context, { method: 'get', args: GET, authorize() {} });
-    assert.equal(retry.commit, f.commit, 'serve the old pin during the failure cooldown');
-    assert.equal(attempted, 1, 'recent lastError prevents another sync even though lastFetch is null');
-  }
-  clock = NOW + 60_001;
-  assert.equal((await failing(f.context, { method: 'get', args: GET, authorize() {} })).commit, f.commit);
-  assert.equal(attempted, 2, 'retry only after the failed-attempt interval expires');
-});
-
-test('an unreadable sync state fails closed; a busy sync keeps serving the existing pin', async t => {
-  const f = await world(t);
-  const lookup = createLibraryLookup({ dataRoot: f.dataRoot, now: () => NOW, sync: async () => {
-    throw new library.LibraryError('library-sync-busy', 'another fetch');
-  } });
-  f.setState({ lastFetch: null });
-  assert.equal((await lookup(f.context, { method: 'get', args: GET, authorize() {} })).commit, f.commit);
-  writeFileSync(join(f.mirror, library.SYNC_STATE_FILE), '{bad json', { mode: 0o600 });
-  await assert.rejects(f.call('library.get', GET), { code: 'library-state-invalid' });
-});
-
-test('a stale lookup sees the commit published by its sync, not the prior served commit', async t => {
-  const f = await world(t);
-  writeFileSync(join(f.repo, GET.path), note('character', 'Tomas', 'Changed ferry.'));
-  git(f.repo, 'add', '-A'); git(f.repo, 'commit', '-qm', 'second fixture');
-  const next = git(f.repo, 'rev-parse', 'HEAD');
-  const lookup = createLibraryLookup({ dataRoot: f.dataRoot, now: () => NOW, sync: async () => {
-    git(f.repo, '-c', 'protocol.file.allow=always', 'push', '-q', f.mirror, 'HEAD:refs/heads/served');
-    f.setState({ served: next, lastFetch: new Date(NOW).toISOString() });
-    return { code: null };
-  } });
-  f.setState({ lastFetch: null });
-  const result = await lookup(f.context, { method: 'get', args: GET, authorize() {} });
-  assert.equal(result.commit, next);
-  assert.match(JSON.stringify(result.lines), /Changed ferry/);
-});
-
-test('real socket awaits lookup results and rechecks rejected query arguments', { timeout: 30_000 }, async t => {
-  const f = await world(t);
-  const path = join(f.root, 'lookup.sock');
-  const server = await serve({ broker: f.broker, path }); t.after(() => server.close());
-  const client = new Client({ path, cap: f.agent });
-  const result = await client.call('library.get', GET);
-  assert.equal(result.commit, f.commit);
-  await assert.rejects(client.call('library.find', { universe: 'harbor', query: '', scope: 'anything' }), /query-argument-invalid/);
-});
-
-test('runtime actually injects the lookup adapter, without exposing human library.file', { timeout: 30_000 }, async t => {
-  const f = scratchRepo(t, TEXTS), dataRoot = join(f.root, 'runtime'); mkdirSync(dataRoot);
-  const business = { id: 'acme', human: 'jason', projects: { books: mappingEntry() },
-    arbiters: { technical: 'coder', delivery: 'coder' },
-    roles: { coder: { definition: 'coder', authority: { withinRole: [], crossRole: [] } } } };
-  const runtime = await startBroker({ dataRoot, businesses: { acme: business } }); t.after(() => runtime.close());
-  const mirror = library.mirrorPath({ business, project: 'books', dataRoot });
-  git(f.repo, '-c', 'protocol.file.allow=always', 'push', '-q', mirror, 'HEAD:refs/heads/served');
-  writeFileSync(join(mirror, library.SYNC_STATE_FILE), JSON.stringify({ version: 1, branch: 'main', served: f.commit,
-    lastFetch: new Date().toISOString(), lastError: null, diverged: null, problems: [] }), { mode: 0o600 });
-  const cap = runtime.broker.bindLaunch({ business: 'acme', role: 'coder', run: 'r224-runtime', harness: 'pi' });
-  runtime.broker.request(cap, { verb: 'role.claim' });
-  assert.equal((await runtime.broker.request(cap, { verb: 'library.get', args: GET })).commit, f.commit);
-  await assert.rejects(runtime.broker.request(cap, { verb: 'library.file', args: { project: 'books', path: GET.path } }),
-    { code: 'human-required' });
-});
-
-test('C2-05c broker forwards supporting scope and returns the served blob without adding write verbs', async t => {
-  const projects = { books: mappingEntry() };
-  projects.books.universes.harbor.supporting = ['Book One/Support/'];
-  const path = 'Book One/Support/Helper.md';
-  const f = await world(t, { projects, files: { ...TEXTS, [path]: note('summary', 'Helper', 'Supporting fixture.') } });
-  assert.deepEqual((await f.call('library.find', { universe: 'harbor', query: '', scope: 'supporting' })).results.map(x => x.path), [path]);
-  assert.deepEqual((await f.call('library.search', { universe: 'harbor', text: 'Supporting fixture', scope: 'supporting' })).results.map(x => x.path), [path]);
-  assert.equal(await f.call('library.get', { universe: 'harbor', path }), null);
-  const result = await f.call('library.get', { universe: 'harbor', path, scope: 'supporting' });
-  assert.equal(result.scope, 'supporting');
-  assert.equal(result.commit, f.commit);
-  assert.equal(result.blob, git(f.mirror, 'rev-parse', `${f.commit}:${path}`));
-  assert.equal(await f.call('library.get', { universe: 'second', path, scope: 'supporting' }), null);
-  await assert.rejects(f.call('library.manuscript', { universe: 'harbor', book: 'Book One', scope: 'supporting' }), { code: 'query-argument-invalid' });
-});
@@ -175,7 +175,7 @@ function checkLaunch(launch, roles, definitions, file) {
  const where = `${file} launch`;
  requireObject(launch, where);
  if (Object.hasOwn(launch,"max")) refuse(`${where}.max needs migration: mosaic limits migrate --file FILE --models FILE`);
-  rejectUnknownKeys(launch, ["by", "instances", "models", "limits", "threadIdleSeconds", "account", "keep", "noHire"], where);
+  rejectUnknownKeys(launch, ["by", "instances", "models", "limits", "threadIdleSeconds", "account", "keep", "noHire", "grantScope"], where);
  requireId(launch.by, `${where}.by`);
  if (!Object.hasOwn(roles, launch.by)) refuse(`${where}.by names ${launch.by}, which the business file doesn't declare`);
  const launcher = definitions[roles[launch.by].definition];
@@ -212,6 +212,9 @@ function checkLaunch(launch, roles, definitions, file) {
  return {
    by: launch.by, instances, models, limits, threadIdleSeconds, ...(account ? { account } : {}),
    ...(keep ? { keep } : {}), ...(noHire ? { noHire } : {}),
+    // Row 298 (#1804, Q228): the chief's grant scope passes through unchecked. A bad value must not
+    // refuse the whole file; the broker's reader (grantScopeOf) falls back to the empty scope instead.
+    ...(launch.grantScope !== undefined ? { grantScope: structuredClone(launch.grantScope) } : {}),
  };
 }

@@ -14,11 +14,12 @@ import { resolveInstance } from "./resolve.mjs";
 import { loadRole } from "./role.mjs";
 import { refuse } from "./errors.mjs";
 import { isPlainObject, canonicalJson } from "./util.mjs";
-import { CREATIVE_DEFINITIONS, END_PROTECTED, HOST_SERVICE, ID_PATTERN } from "./vocabulary.mjs";
+import { CREATIVE_DEFINITIONS, END_PROTECTED, HOST_SERVICE, ID_PATTERN, checkGrantScope, grantScopeOf } from "./vocabulary.mjs";

 const SET_KEYS = ["revision", "instance", "op", "definition", "vars", "launch", "tracker"];
 const VETO_KEYS = ["revision", "op", "name"];
 const VETO_OPS = ["keep", "unkeep", "nohire", "hire"];
+const SCOPE_KEYS = ["revision", "scope"];
 const id = value => typeof value === "string" && ID_PATTERN.test(value);
 const revisionOk = value => typeof value === "string" && /^[a-f0-9]{64}$/.test(value);
 // Row 194 (D2.2, N3): the vars a hire may set, the ones the chief can already set on an instance.
@@ -302,6 +303,32 @@ export function instanceSettings({ dir, rolesDir, system, levels = () => null, r
    return commit(business, old, next, { revision: args.revision, actor });
  }

+  // Row 298 (#1804, Q228): the chief's grant scope as the file stands. scope is the one the broker
+  // applies, so a bad value reads as {} with fallback true.
+  function grantScopeRead(business) {
+    const { document, revision } = writer.read(business);
+    if (!document.launch) throw new OrganizationError("organization-launch-not-configured");
+    return { business, revision, ...grantScopeOf(document.launch.grantScope) };
+  }
+
+  // Row 298: args { revision, scope }. Human-only at the broker (grants.scope.set), and the only
+  // writer of launch.grantScope: SET_KEYS and the organization.set keys don't name it. The scope is
+  // checked strictly here; {} removes the key. old is what the broker applied before the write,
+  // the fallback included.
+  function grantScope(business, args, actor) {
+    if (!isPlainObject(args) || Object.keys(args).some(key => !SCOPE_KEYS.includes(key))) throw new OrganizationError("invalid-request");
+    if (!revisionOk(args.revision)) throw new OrganizationError("invalid-request");
+    const scope = checkGrantScope(args.scope);
+    if (scope === null) throw new OrganizationError("invalid-request", "scope is not a grant scope");
+    const old = writer.read(business).document;
+    if (!old.launch) throw new OrganizationError("organization-launch-not-configured");
+    const next = structuredClone(old);
+    if (Object.keys(scope).length === 0) delete next.launch.grantScope;
+    else next.launch.grantScope = scope;
+    const before = grantScopeOf(old.launch.grantScope).scope;
+    return { ...commit(business, old, next, { revision: args.revision, actor }), scope, old: before };
+  }
+
  // Row 194 (#1692, D2.2): the chief's hire, after the broker's identity, grant, allowlist and
  // hireable checks. args { name, definition, vars? }. A new name is added and listed. A fired name
  // (declared, not listed) is listed again only with its own definition and no vars. The writer
@@ -419,5 +446,5 @@ export function instanceSettings({ dir, rolesDir, system, levels = () => null, r
    return { ...read(business, actor), transaction: receipt.transaction, restart: false };
  }

-  return { writer, read, set, checkDelete, checkFire, veto, hire, fire };
+  return { writer, read, set, checkDelete, checkFire, veto, hire, fire, grantScope, grantScopeRead };
 }
@@ -299,3 +299,78 @@ export function covers(grant, { business, project, instance }, now, { level } =
  if (!LEVELS.includes(grant.level) || LEVELS.indexOf(grant.level) > LEVELS.indexOf(level)) return false;
  return true;
 }
+
+// Row 298 (#1804, Q228): the chief of staff's grant scope, launch.grantScope in the organization
+// file. Only the human writes it (grants.scope.set). A Gitea or host grant the enrolled chief raises
+// inside it is issued with no per-grant Approve; anything else waits for the human as before. The
+// broker and the writer read these, and they live here because the session sandbox mounts this file
+// (seat/src/sandbox.mjs RUNNER_FILES) and the runner loads broker.mjs.
+//
+// Shape: { gitea?: { agents, projects }, host?: { agents, hosts, commands?, commandPrefixes? } }.
+// Each list is distinct and nonempty. A host entry needs commands or commandPrefixes. A commands
+// entry covers a requested prefix equal to it, token for token. A commandPrefixes entry also covers a
+// requested prefix that extends it with more whole tokens. No entry matches part of a token, so
+// ["ls"] never covers ["lsblk"]. Enrollment (host-enroll) is never in scope. {} is the empty scope.
+export const GRANT_SCOPE_EMPTY = Object.freeze({});
+const SCOPE_IDS = (value) =>
+  Array.isArray(value) && value.length > 0 && value.length <= 256 &&
+  value.every((x) => typeof x === "string" && ID_PATTERN.test(x)) && new Set(value).size === value.length;
+const SCOPE_ARGVS = (value) =>
+  Array.isArray(value) && value.length > 0 && value.length <= 256 && value.every(validArgv) &&
+  new Set(value.map((argv) => JSON.stringify(argv))).size === value.length;
+const SCOPE_PLAIN = (value) => typeof value === "object" && value !== null && !Array.isArray(value) && Object.getPrototypeOf(value) === Object.prototype;
+
+// The scope, rebuilt in a fixed key order so JSON.stringify of it is stable, or null when the value
+// isn't one. The writer refuses null; the readers fall back (grantScopeOf).
+export function checkGrantScope(value) {
+  if (!SCOPE_PLAIN(value) || Object.keys(value).some((k) => k !== "gitea" && k !== "host")) return null;
+  const out = {};
+  if (value.gitea !== undefined) {
+    const g = value.gitea;
+    if (!SCOPE_PLAIN(g) || Object.keys(g).some((k) => k !== "agents" && k !== "projects")) return null;
+    if (!SCOPE_IDS(g.agents) || !SCOPE_IDS(g.projects)) return null;
+    out.gitea = { agents: [...g.agents], projects: [...g.projects] };
+  }
+  if (value.host !== undefined) {
+    const h = value.host;
+    if (!SCOPE_PLAIN(h) || Object.keys(h).some((k) => !["agents", "hosts", "commands", "commandPrefixes"].includes(k))) return null;
+    if (!SCOPE_IDS(h.agents) || !Array.isArray(h.hosts) || !h.hosts.every((x) => typeof x === "string" && HOST_ID.test(x)) || !SCOPE_IDS(h.hosts)) return null;
+    if (h.commands === undefined && h.commandPrefixes === undefined) return null;
+    if (h.commands !== undefined && !SCOPE_ARGVS(h.commands)) return null;
+    if (h.commandPrefixes !== undefined && !SCOPE_ARGVS(h.commandPrefixes)) return null;
+    out.host = {
+      agents: [...h.agents], hosts: [...h.hosts],
+      ...(h.commands !== undefined ? { commands: h.commands.map((argv) => [...argv]) } : {}),
+      ...(h.commandPrefixes !== undefined ? { commandPrefixes: h.commandPrefixes.map((argv) => [...argv]) } : {}),
+    };
+  }
+  return out;
+}
+
+// What the readers use: a missing key is the empty scope, and a bad value falls back to it, with
+// fallback true. The empty scope puts every grant in front of the human, so a bad value fails closed.
+export function grantScopeOf(value) {
+  if (value === undefined) return { scope: GRANT_SCOPE_EMPTY, fallback: false };
+  const scope = checkGrantScope(value);
+  return scope === null ? { scope: GRANT_SCOPE_EMPTY, fallback: true } : { scope, fallback: false };
+}
+
+// Whether a raise's grant body is inside a checked scope. Only gitea and host bodies can be.
+export function grantInScope(scope, body) {
+  if (body?.method === "gitea") {
+    const g = scope.gitea;
+    return Boolean(g) && g.agents.includes(body.agent) &&
+      Array.isArray(body.target?.projects) && body.target.projects.length > 0 &&
+      body.target.projects.every((p) => g.projects.includes(p));
+  }
+  if (body?.method === "host") {
+    const h = scope.host;
+    const same = (a, b) => a.length === b.length && a.every((x, i) => x === b[i]);
+    const extends_ = (argv, prefix) => argv.length >= prefix.length && prefix.every((x, i) => x === argv[i]);
+    return Boolean(h) && h.agents.includes(body.agent) && h.hosts.includes(body.host) &&
+      Array.isArray(body.commands) && body.commands.length > 0 &&
+      body.commands.every((argv) =>
+        (h.commands ?? []).some((c) => same(argv, c)) || (h.commandPrefixes ?? []).some((c) => extends_(argv, c)));
+  }
+  return false;
+}
@@ -27,10 +27,6 @@ test('C2-04: library mappings load without roots, remain frozen, and retain mapp
  assert.deepEqual(validateBusinessDocument(doc, file, { rolesDir: REPO_ROLES }).projects.books.universes.harbor.playground, ['Elsewhere/Playground/']);
  doc.projects.books.universes.harbor.playground = ['Second World/Playground/'];
  refuses(() => validateBusinessDocument(doc, file, { rolesDir: REPO_ROLES }), /library-playground-other-universe/);
-  // C2-01d: a supporting prefix inside another universe's book refuses with its own code.
-  doc.projects.books = mappingEntry();
-  doc.projects.books.universes.harbor.supporting = ['Second World/Notes/'];
-  refuses(() => validateBusinessDocument(doc, file, { rolesDir: REPO_ROLES }), /library-supporting-other-universe/);
  doc.projects.books = { ...mappingEntry(), root: '/forbidden' };
  refuses(() => validateBusinessDocument(doc, file, { rolesDir: REPO_ROLES }), /library-mapping-invalid/);
 });
@@ -0,0 +1,124 @@
+// Row 298 (#1804, Q228): the chief of staff's grant scope, launch.grantScope. The shape check, the
+// readers' fallback, the match rules (sage-3594 Q2) and the one writer. The broker's verbs, the
+// in-scope close and the executors are bus tests (packages/bus/tests/grant-scope.test.mjs).
+import test, { after } from "node:test";
+import assert from "node:assert/strict";
+import { readFileSync, rmSync } from "node:fs";
+import { join } from "node:path";
+import { instanceSettings } from "../src/instance-settings.mjs";
+import { launchSettings } from "../src/launch-settings.mjs";
+import { loadBusiness } from "../src/business.mjs";
+import { checkGrantScope, grantInScope, grantScopeOf } from "../src/vocabulary.mjs";
+import { businessDoc, rolesCopy, systemFor, tmp, writeJson } from "./helpers.mjs";
+
+const roots = [];
+after(() => roots.forEach(root => rmSync(root, { recursive: true, force: true })));
+
+const GITEA = { gitea: { agents: ["coder"], projects: ["app", "lib"] } };
+const HOST = { host: { agents: ["ops"], hosts: ["web1"], commands: [["systemctl", "status", "nginx"]], commandPrefixes: [["ls"]] } };
+const gitea = (over = {}) => ({ method: "gitea", agent: "coder", target: { projects: ["app"] }, ...over });
+const host = (commands, over = {}) => ({ method: "host", agent: "ops", host: "web1", commands, ...over });
+
+function fixture(mutate) {
+  const root = tmp();
+  roots.push(root);
+  const rolesDir = rolesCopy(root);
+  const doc = businessDoc(root, "acme");
+  mutate?.(doc);
+  const dir = join(root, "config");
+  const file = writeJson(join(dir, "businesses", "acme.json"), doc);
+  const settings = instanceSettings({ dir, rolesDir, system: systemFor(root) });
+  const limits = launchSettings({ dir, rolesDir, system: systemFor(root) });
+  const onDisk = () => JSON.parse(readFileSync(file, "utf8"));
+  const log = () => readFileSync(settings.writer.logFile("acme"), "utf8").trim().split("\n").map(line => JSON.parse(line));
+  const revision = () => settings.read("acme").revision;
+  return { root, dir, rolesDir, file, settings, limits, onDisk, log, revision };
+}
+
+test("row 298: checkGrantScope takes the D2 shape and refuses anything else", () => {
+  assert.deepEqual(checkGrantScope({}), {});
+  assert.deepEqual(checkGrantScope(GITEA), GITEA);
+  assert.deepEqual(checkGrantScope(HOST), HOST);
+  assert.deepEqual(checkGrantScope({ host: { agents: ["ops"], hosts: ["web1"], commands: [["uptime"]] } }).host.commands, [["uptime"]]);
+  for (const bad of [
+    null, [], "x", { other: {} }, { gitea: [] }, { gitea: { agents: ["coder"] } }, { gitea: { agents: [], projects: ["app"] } },
+    { gitea: { agents: ["coder", "coder"], projects: ["app"] } }, { gitea: { agents: ["Coder"], projects: ["app"] } },
+    { gitea: { agents: ["coder"], projects: ["app"], extra: 1 } }, { host: { agents: ["ops"], hosts: ["web1"] } },
+    { host: { agents: ["ops"], hosts: ["web_1"], commands: [["ls"]] } }, { host: { agents: ["ops"], hosts: ["web1"], commands: [[]] } },
+    { host: { agents: ["ops"], hosts: ["web1"], commands: [["ls"], ["ls"]] } }, { host: { agents: ["ops"], hosts: ["web1"], commands: [["bin/ls"]] } },
+    { host: { agents: ["ops"], hosts: ["web1"], commandPrefixes: [["ls", ""]] } }, { "host-enroll": {} },
+  ])
+    assert.equal(checkGrantScope(bad), null, JSON.stringify(bad));
+});
+
+test("row 298: a missing scope is empty and a bad one falls back to empty, which covers nothing", () => {
+  assert.deepEqual(grantScopeOf(undefined), { scope: {}, fallback: false });
+  assert.deepEqual(grantScopeOf(GITEA), { scope: GITEA, fallback: false });
+  const bad = { gitea: { agents: ["coder"], projects: ["app"], extra: true } };
+  assert.deepEqual(grantScopeOf(bad), { scope: {}, fallback: true });
+  assert.equal(grantInScope(grantScopeOf(bad).scope, gitea()), false);
+  assert.equal(grantInScope({}, gitea()), false);
+  assert.equal(grantInScope({}, host([["ls"]])), false);
+});
+
+test("row 298: a Gitea grant is in scope only when its agent and every project are listed", () => {
+  assert.equal(grantInScope(GITEA, gitea()), true);
+  assert.equal(grantInScope(GITEA, gitea({ target: { projects: ["app", "lib"] } })), true);
+  assert.equal(grantInScope(GITEA, gitea({ target: { projects: ["app", "old"] } })), false);
+  assert.equal(grantInScope(GITEA, gitea({ agent: "research" })), false);
+  assert.equal(grantInScope(GITEA, gitea({ target: { projects: [] } })), false);
+  assert.equal(grantInScope(HOST, gitea()), false);
+});
+
+test("row 298 (sage-3594 Q2): host commands match whole argv tokens, and enrollment is never in scope", () => {
+  assert.equal(grantInScope(HOST, host([["systemctl", "status", "nginx"]])), true);
+  // A commands entry covers only itself: no extra trailing arguments, no shorter prefix.
+  assert.equal(grantInScope(HOST, host([["systemctl", "status", "nginx", "--now"]])), false);
+  assert.equal(grantInScope(HOST, host([["systemctl", "status"]])), false);
+  // A commandPrefixes entry covers more whole tokens after it, never part of a token.
+  assert.equal(grantInScope(HOST, host([["ls"]])), true);
+  assert.equal(grantInScope(HOST, host([["ls", "-l", "/var"]])), true);
+  assert.equal(grantInScope(HOST, host([["lsblk"]])), false);
+  assert.equal(grantInScope(HOST, host([["ls"], ["lsblk"]])), false);
+  assert.equal(grantInScope(HOST, host([["ls"]], { host: "web2" })), false);
+  assert.equal(grantInScope(HOST, host([["ls"]], { agent: "coder" })), false);
+  assert.equal(grantInScope(HOST, { method: "host-enroll", host: "web1" }), false);
+  assert.equal(grantInScope({ ...HOST, "host-enroll": true }, { method: "host-enroll", host: "web1" }), false);
+});
+
+test("row 298: a bad grantScope in the file still loads, and the read shows the fallback", () => {
+  const f = fixture(doc => { doc.launch.grantScope = { gitea: "everything" }; });
+  const business = loadBusiness("acme", { dir: f.dir, rolesDir: f.rolesDir });
+  assert.deepEqual(business.launch.grantScope, { gitea: "everything" });
+  assert.deepEqual(f.settings.grantScopeRead("acme"), { business: "acme", revision: f.revision(), scope: {}, fallback: true });
+});
+
+test("row 298: the writer checks the scope, logs the change and removes the key for {}", () => {
+  const f = fixture();
+  assert.deepEqual(f.settings.grantScopeRead("acme").scope, {});
+  const r = f.settings.grantScope("acme", { revision: f.revision(), scope: GITEA }, "jason");
+  assert.deepEqual(r.scope, GITEA);
+  assert.deepEqual(r.old, {});
+  assert.ok(typeof r.transaction === "string" && r.transaction.length > 0);
+  assert.deepEqual(f.onDisk().launch.grantScope, GITEA);
+  assert.equal(f.log().at(-1).actor, "jason");
+  const back = f.settings.grantScope("acme", { revision: f.revision(), scope: {} }, "jason");
+  assert.deepEqual(back.old, GITEA);
+  assert.equal(Object.hasOwn(f.onDisk().launch, "grantScope"), false);
+  const bytes = readFileSync(f.file, "utf8");
+  assert.throws(() => f.settings.grantScope("acme", { revision: f.revision(), scope: { gitea: {} } }, "jason"), e => e.code === "invalid-request");
+  assert.throws(() => f.settings.grantScope("acme", { revision: f.revision(), scope: GITEA, extra: 1 }, "jason"), e => e.code === "invalid-request");
+  assert.throws(() => f.settings.grantScope("acme", { revision: "0".repeat(64), scope: GITEA }, "jason"), e => e.code === "revision-conflict");
+  assert.throws(() => f.settings.grantScope("acme", { revision: f.revision(), scope: {} }, "jason"), e => e.code === "organization-no-change");
+  assert.equal(readFileSync(f.file, "utf8"), bytes);
+});
+
+test("row 298 (sage-3594 Q1): the general writers can't write grantScope", () => {
+  const f = fixture();
+  const bytes = readFileSync(f.file, "utf8");
+  assert.throws(() => f.limits.set("acme", { revision: f.revision(), grantScope: GITEA }, "jason"));
+  assert.throws(() => f.limits.set("acme", { revision: f.revision(), grantScope: GITEA }, "chief-of-staff.chief"));
+  assert.throws(() => f.settings.set("acme", { revision: f.revision(), instance: "coder", op: "change", grantScope: GITEA }, "jason"), e => e.code === "invalid-request");
+  assert.throws(() => f.settings.veto("acme", { revision: f.revision(), op: "keep", name: "coder", grantScope: GITEA }, "jason"), e => e.code === "invalid-request");
+  assert.equal(readFileSync(f.file, "utf8"), bytes);
+});
@@ -2,16 +2,20 @@
 // starts the executor of a decision the human said yes to, and admin set, rotate and remove keep the
 // admin slot; those are the human's alone. status is the human's, the tester's or the chief's; revoke
 // and sweep the human's or, with --tester, the tester's. admin set reads the admin token on stdin, never
-// argv, and nothing here prints a token: the answers carry ids and names only.
+// argv, and nothing here prints a token: the answers carry ids and names only. Row 298 (#1804, Q228):
+// scope reads the chief of staff's grant scope and scope set writes it from JSON on stdin; both are
+// the human's, and the set is the human's Approve of the change.
 import { CliError } from "./errors.mjs";

 export const GRANTS_USAGE =
  "mosaic grants status gitea [--json] [--tester] [--business ID] | run DECISION [--business ID] | " +
  "revoke AGENT gitea --reason R [--tester] [--business ID] | sweep gitea [--tester] [--business ID] | " +
  "admin set gitea --url URL --account NAME --rotate-by DATE [--business ID] | " +
-  "admin rotate gitea --rotate-by DATE | admin rotate gitea --finish | admin remove gitea";
+  "admin rotate gitea --rotate-by DATE | admin rotate gitea --finish | admin remove gitea | " +
+  "scope [--business ID] | scope set --revision REV [--business ID] (the scope JSON on stdin)";
 const MAX_TOKEN = 16384;
-const VALUES = ["--business", "--reason", "--url", "--account", "--rotate-by"];
+const MAX_SCOPE = 65536;
+const VALUES = ["--business", "--reason", "--url", "--account", "--rotate-by", "--revision"];

 function parse(args) {
  const out = { positional: [], flags: new Set(), values: {} };
@@ -40,6 +44,21 @@ async function readToken(stdin) {
  return text;
 }

+// Row 298: the whole of stdin, one JSON scope. {} is the empty scope.
+async function readScope(stdin) {
+  let text = "";
+  for await (const chunk of stdin) {
+    text += chunk;
+    if (text.length > MAX_SCOPE) throw new CliError("refused: the scope on stdin is too long", 2);
+  }
+  if (!text.trim()) throw new CliError("refused: no scope on stdin; pipe the scope JSON, {} for none", 4);
+  try {
+    return JSON.parse(text);
+  } catch {
+    throw new CliError("refused: the scope on stdin is not JSON", 4);
+  }
+}
+
 // Each shape: the positional count after the verb, the flags and values it takes and needs.
 const SHAPES = {
  status: { n: 1, flags: ["--json", "--tester"], need: [], may: ["--business"] },
@@ -49,6 +68,8 @@ const SHAPES = {
  "admin set": { n: 1, flags: [], need: ["--url", "--account", "--rotate-by"], may: ["--business"] },
  "admin rotate": { n: 1, flags: ["--finish"], need: [], may: ["--rotate-by", "--business"] },
  "admin remove": { n: 1, flags: [], need: [], may: ["--business"] },
+  scope: { n: 0, flags: [], need: [], may: ["--business"] },
+  "scope set": { n: 0, flags: [], need: ["--revision"], may: ["--business"] },
 };

 const lines = (s) => {
@@ -71,6 +92,9 @@ export async function grantsCommand(args, io, callFor) {
  if (verb === "admin") {
    verb = `admin ${rest[0] ?? ""}`;
    rest = rest.slice(1);
+  } else if (verb === "scope" && rest[0] === "set") {
+    verb = "scope set";
+    rest = rest.slice(1);
  }
  // Own keys only, so `constructor` is a usage error, not a verb.
  const shape = Object.hasOwn(SHAPES, verb ?? "") ? SHAPES[verb] : null;
@@ -79,7 +103,7 @@ export async function grantsCommand(args, io, callFor) {
    [...parsed.flags].some((f) => !shape.flags.includes(f)) ||
    Object.keys(parsed.values).some((v) => !shape.need.includes(v) && !shape.may.includes(v)) ||
    shape.need.some((v) => !Object.hasOwn(parsed.values, v)) ||
-    (verb !== "run" && rest.at(-1) !== "gitea") ||
+    (verb !== "run" && verb !== "scope" && verb !== "scope set" && rest.at(-1) !== "gitea") ||
    (verb === "admin rotate" && parsed.flags.has("--finish") === Object.hasOwn(parsed.values, "--rotate-by"))
  )
    throw new CliError(GRANTS_USAGE, 4);
@@ -93,6 +117,8 @@ export async function grantsCommand(args, io, callFor) {
    else if (verb === "sweep") request = ["grants.sweep", { service: "gitea" }];
    else if (verb === "admin set")
      request = ["grants.admin.set", { service: "gitea", url: v["--url"], account: v["--account"], rotateBy: v["--rotate-by"], token: await readToken(io.stdin) }];
+    else if (verb === "scope") request = ["grants.scope", {}];
+    else if (verb === "scope set") request = ["grants.scope.set", { revision: v["--revision"], scope: await readScope(io.stdin) }];
    else if (verb === "admin rotate")
      request = ["grants.admin.rotate", parsed.flags.has("--finish") ? { service: "gitea", finish: true } : { service: "gitea", rotateBy: v["--rotate-by"] }];
    else request = ["grants.admin.remove", { service: "gitea" }];
@@ -528,7 +528,6 @@ export function createLauncher({
      contract: readFileSync(resolved.contract, "utf8"),
      arbiter: Object.values(b.arbiters).includes(instance),
      tracker,
-      library: Object.values(b.projects ?? {}).some(project => project.kind === "library"),
      credentials,
      session: { run, launchedBy, workspace: inSandbox, toolSocket, turnMarker, checkouts: inSandbox === workspace ? checkouts : checkouts.map((c) => ({ ...c, path: join(inSandbox, relative(workspace, c.path)) })) },
      harness,
@@ -27,7 +27,6 @@ import { bootConfig, loadSystem } from "../src/config.mjs";
 import { startTimeOf } from "../src/host.mjs";
 import { createLauncher } from "../src/launcher.mjs";
 import { fakeHarnesses, fixture, tmp } from "./helpers.mjs";
-import { mappingEntry } from "../../library/tests/helpers.mjs";
 // Row 264a (#1769): a thread made by hand gets the default session the 3k-3l migration gives a
 // legacy thread, with the thread's id.
 const DEFAULT_SESSION = [
@@ -530,24 +529,3 @@ test('C2-09a: terminating one creative thread does not signal an unselected peer
  await until(() => !readSessions(f.dataRoot).some(row => row.run === runs[0]));
  assert.ok(readSessions(f.dataRoot).some(row => row.run === runs[1]));
 });
-
-// Row224: the launcher must derive library presence from business projects, not
-// from session checkouts (a library never has an agent clone).
-test("C2-05b a real launched bundle gets lookups for a library project without a library checkout", { skip, timeout: 60000 }, async t => {
-  const prepared = prepare(t, { idle: 10, edit: doc => {
-    doc.projects.books = mappingEntry();
-    return doc;
-  } });
-  const { f } = prepared;
-  const host = await start(t, prepared);
-  const project = host.call("project.create", { name: "library work", repo: "stack" }).id;
-  const thread = host.call("thread.create", { project, name: "lookup" }).id;
-  await ask(host.call, thread, "inspect bundle");
-  const run = launchLog(f).find(e => e.event === "launch" && e.thread === thread).run;
-  const tools = JSON.parse(readFileSync(join(f.dataRoot, "launches", "acme", run, "bundle", "tools.json"), "utf8"));
-  assert.deepEqual(tools.filter(tool => tool.name.startsWith("library_")).map(tool => tool.name),
-    ["library_find", "library_get", "library_search", "library_manuscript", "library_universe"]);
-  const [session] = threadRuns(f, thread);
-  assert.ok(session);
-  assert.ok(!session.checkouts?.some(checkout => checkout.project === "books"));
-});
@@ -292,7 +292,6 @@ function prompt({ contract, resolved, session, tools, untyped, builtins, persona
 //   resolved     resolveInstance(...) output
 //   contract     the role contract's text
 //   arbiter      true when the business names this instance as an arbiter
-//   library      true when the trusted business configuration has a library project
 //   tracker      true when the broker has task verbs for the business
 //   credentials  the broker's credentialStatus(...) for the instance (metadata only)
 //   session      { run, launchedBy, workspace, toolSocket, turnMarker, checkouts }
@@ -310,11 +309,11 @@ function prompt({ contract, resolved, session, tools, untyped, builtins, persona
 //                (row 213); an instance with persona.sha256 and no personaDir refuses
 // Returns { manifest, files, policy, tools, env } with absolute paths; env is the module's
 // adapter variables, which the host writes into session.json.
-export function buildBundle({ dir, resolved, contract, arbiter = false, tracker = false, library = false, credentials = [], session, harness, route = "primary", routeReason = null, harnessVersion = null, models = null, land = false, skillsDir = null, personaDir = null }) {
+export function buildBundle({ dir, resolved, contract, arbiter = false, tracker = false, credentials = [], session, harness, route = "primary", routeReason = null, harnessVersion = null, models = null, land = false, skillsDir = null, personaDir = null }) {
  if (route !== "primary" && route !== "fallback") throw new BundleError(`route ${JSON.stringify(route)} isn't primary or fallback`);
  const model = sessionModel(resolved, models, route);
  const web = webPlan(resolved, model.harness, harness.builtinWeb());
-  const tools = typedTools({ resolved, arbiter, tracker, library, projects: (session.checkouts ?? []).map((c) => c.project), webTyped: !web.builtin, land });
+  const tools = typedTools({ resolved, arbiter, tracker, projects: (session.checkouts ?? []).map((c) => c.project), webTyped: !web.builtin, land });
  const untyped = untypedActions(resolved, tools);
  const persona = readPersona(resolved, personaDir);
  mkdirSync(dir, { recursive: true, mode: 0o700 });
@@ -78,10 +78,9 @@ const TASK_TOOLS = {

 const MESSAGE_CLASSES = ["REQUEST", "ASSIGNMENT", "REVIEW-REQUEST", "REVIEW-RESULT", "RESULT", "INFO", "DECISION", "REACTION", "BLOCK"];

-// typedTools({ resolved, arbiter, tracker, projects, land, library }) -> [{ name, verb, action, description, parameters }]
+// typedTools({ resolved, arbiter, tracker, projects, land }) -> [{ name, verb, action, description, parameters }]
 //   resolved  resolveInstance(...) output for the session's instance
 //   arbiter   true when the business names this instance as an arbiter
-//   library   true when the trusted business configuration has a library project
 //   tracker   true when the broker has task verbs for the business
 //   projects  the project ids the session has a clone of
 //   land      true when the role and thread hold a merge decision a landing could use (landHeld)
@@ -89,7 +88,7 @@ const MESSAGE_CLASSES = ["REQUEST", "ASSIGNMENT", "REVIEW-REQUEST", "REVIEW-RESU
 // `verb` is the broker verb; the `launch` tool has verb "launch" and goes
 // to the host instead, and "working.push", "working.fetch" and
 // "working.land" go to the host's git socket.
-export function typedTools({ resolved, arbiter = false, tracker = false, projects = [], webTyped = true, land = false, library = false }) {
+export function typedTools({ resolved, arbiter = false, tracker = false, projects = [], webTyped = true, land = false }) {
  const held = new Set([...resolved.limits.authority.withinRole, ...resolved.limits.authority.crossRole]);
  const tools = [];
  const add = (name, verb, action, description, parameters) => tools.push({ name, verb, action, description, parameters });
@@ -223,33 +222,6 @@ export function typedTools({ resolved, arbiter = false, tracker = false, project
      url: str("The https url to fetch", { maxLength: 2048 }),
    }, ["url"]));
  }
-  // Row224: no library clone or token reaches a session. The broker chooses the served
-  // commit and requires a universe on every call; cursors page without cutting replies.
-  if (library) {
-    const universe = str("Universe ID in the configured library", { minLength: 1 });
-    const project = str("Library project ID; omit only when the business has one library");
-    const scope = str("canon by default; playground and supporting are opt-in", { enum: ["canon", "playground", "supporting"] });
-    const manuscriptScope = str("canon by default; playground is opt-in", { enum: ["canon", "playground"] });
-    const book = str("Book folder from library_universe");
-    const offset = { type: "integer", minimum: 0, description: "next from the previous page" };
-    const line = { type: "integer", minimum: 1, description: "One-based line number" };
-    const base = { universe, project };
-    add("library_find", "library.find", null, "Find names in one universe, at the served commit. At most 50 results; continue with next as offset. Playground and supporting are opt-in.", obj({
-      ...base, query: str("Case-insensitive name or filename substring; empty matches all"),
-      type: str("Mapped type", { enum: ["character", "place", "research", "tracker", "summary"] }),
-      book, scope, offset,
-    }, ["universe", "query"]));
-    add("library_get", "library.get", null, "Read a note and its blob at the served commit, canon by default. Playground/supporting paths need matching scope; mismatch returns null. next pages lines; links_next pages visible links in supporting/playground/canon order.", obj({
-      ...base, path: str("Mapped note path relative to the library"), scope, from: line, links_from: offset,
-    }, ["universe", "path"]));
-    add("library_search", "library.search", null, "Search text in one universe at the served commit. At most 50 hits; use next as offset. Playground and supporting are opt-in.", obj({
-      ...base, text: str("Nonempty case-insensitive substring", { minLength: 1 }), book, scope, offset,
-    }, ["universe", "text"]));
-    add("library_manuscript", "library.manuscript", null, "Read one chapter of a book at the served commit, at most 400 lines. Omit chapter for the first; continue with next or next_chapter.", obj({
-      ...base, book, scope: manuscriptScope, chapter: str("Chapter filename without extension"), from: line, to: line,
-    }, ["universe", "book"]));
-    add("library_universe", "library.universe", null, "Read a universe's mapping at the served commit: books, types, playground prefixes, and hybrid sources/constraints/notes or draft metadata.", obj(base, ["universe"]));
-  }
  add("read_spec", "spec.read", null, "Read a project's committed north-star spec and its file history. commit is an optional full reachable commit ID. The file commit, rather than HEAD, is what a decision cites. confirmed says the file commit was authored by the business's human.", obj({
    project: str("Project ID from the business file"),
    commit: str("Optional full historical commit ID", { pattern: "^[0-9a-f]{40}$" }),
@@ -305,11 +277,6 @@ export function typedTools({ resolved, arbiter = false, tracker = false, project
    if (held.has("task.create"))
      add("list_requirements", "requirements", null, "List the approved PRD's requirement ids, each with a one-line title. task_create takes only these. When none fits a request, raise a prd.approve decision instead of creating the task.", obj({}));
  }
-  // mos-1308 / M3: no generic spec, evidence, tracker, decision or write tools. The
-  // C2-08 web grant still supplies broker web reads to companion and research only.
-  if (CREATIVE_DEFINITIONS.includes(resolved.definition))
-    return tools.filter(tool => tool.name === "send_message" || tool.name.startsWith("library_") ||
-      tool.name === "web_search" || tool.name === "web_fetch");
  return tools;
 }

@@ -1,82 +0,0 @@
-// Row224 M3: exact creative tool sets preserve the existing C2-08 web grants.
-import test from 'node:test';
-import assert from 'node:assert/strict';
-import { mkdirSync, readFileSync } from 'node:fs';
-import { join } from 'node:path';
-import { typedTools } from '../src/tools.mjs';
-import { buildBundle } from '../src/bundle.mjs';
-import { TYPES } from '../../library/src/mapping.mjs';
-import { HARNESS, REPO_SKILLS, resolvedFor, scratch } from './helpers.mjs';
-
-const LOOKUPS = ['library_find', 'library_get', 'library_search', 'library_manuscript', 'library_universe'];
-const CREATIVE = ['companion', 'research', 'ideas', 'proofreader', 'fact-checker', 'continuity'];
-const role = (t, definition, harness = 'pi') => resolvedFor(t, 'bean', d => {
-  d.roles.bean = { definition, vars: { harness, model: 'claude-sonnet-5-5', thinking: 'high' } };
-});
-const expected = definition => ['send_message', ...(['companion', 'research'].includes(definition)
-  ? ['web_search', 'web_fetch'] : []), ...LOOKUPS];
-
-test('M3: per-role snapshots contain six names, or eight with the C2-08 web grant', t => {
-  for (const definition of CREATIVE) {
-    const tools = typedTools({ resolved: role(t, definition), library: true, tracker: true, arbiter: true });
-    assert.deepEqual(tools.map(t => t.name), expected(definition), definition);
-    assert.ok(tools.every(t => t.parameters.additionalProperties === false));
-  }
-});
-
-test('every noncreative role gets lookups when a library is configured, not otherwise', t => {
-  for (const instance of ['coder', 'reviewer', 'pm', 'chief']) {
-    const resolved = resolvedFor(t, instance);
-    const ordinary = typedTools({ resolved }).map(t => t.name);
-    assert.ok(!ordinary.some(name => name.startsWith('library_')));
-    const tools = typedTools({ resolved, library: true });
-    assert.deepEqual(tools.filter(t => t.name.startsWith('library_')).map(t => t.name), LOOKUPS);
-    assert.deepEqual(tools.filter(t => !t.name.startsWith('library_')).map(t => t.name), ordinary);
-  }
-});
-
-test('lookup schemas require a universe even for get, include paging, and cannot select repo or commit', t => {
-  const tools = typedTools({ resolved: role(t, 'ideas'), library: true });
-  const required = [ ['universe', 'query'], ['universe', 'path'], ['universe', 'text'], ['universe', 'book'], ['universe'] ];
-  for (const [i, tool] of tools.filter(t => t.name.startsWith('library_')).entries()) {
-    assert.deepEqual(tool.parameters.required, required[i]);
-    assert.equal(tool.verb, LOOKUPS[i].replace('_', '.'));
-    assert.equal(tool.action, null);
-    assert.equal(tool.parameters.additionalProperties, false);
-    for (const key of ['repo', 'commit', 'business', 'accept']) assert.equal(Object.hasOwn(tool.parameters.properties, key), false);
-  }
-  const byName = Object.fromEntries(tools.map(t => [t.name, t]));
-  assert.deepEqual(byName.library_find.parameters.properties.scope.enum, ['canon', 'playground', 'supporting']);
-  assert.deepEqual(byName.library_find.parameters.properties.type.enum, [...TYPES]);
-  assert.equal(byName.library_find.parameters.properties.offset.minimum, 0);
-  assert.equal(byName.library_get.parameters.properties.from.minimum, 1);
-  assert.equal(byName.library_get.parameters.properties.links_from.minimum, 0);
-  assert.equal(byName.library_manuscript.parameters.properties.chapter.type, 'string');
-});
-
-test('bundle flag reaches both harness tool manifests and creative prompt without generic tools', t => {
-  for (const definition of CREATIVE) for (const harness of ['pi', 'claude-code']) {
-    const dir = scratch(t), workspace = join(dir, 'ws'); mkdirSync(workspace);
-    const b = buildBundle({ dir: join(dir, 'bundle'), resolved: role(t, definition, harness), library: true,
-      contract: '# Creative\n', tracker: true, arbiter: true, skillsDir: REPO_SKILLS,
-      session: { run: 'r224', launchedBy: 'chief', workspace, toolSocket: join(dir, 't.sock'), turnMarker: join(dir, 'turn.done') },
-      harness: HARNESS[harness] });
-    assert.deepEqual(b.tools.map(t => t.name), expected(definition), `${definition} ${harness}`);
-    const serialized = JSON.parse(readFileSync(b.files.tools, 'utf8'));
-    assert.deepEqual(serialized.map(t => t.name), expected(definition));
-    const prompt = readFileSync(b.files.prompt, 'utf8');
-    assert.match(prompt, /library_find/);
-    assert.doesNotMatch(prompt, /Bus tools: [^\n]*(read_spec|list_agents|inbox|trail|write_record|raise_decision|list_tasks)/);
-  }
-});
-
-test('C2-05c scope schemas expand only find/search/get, keeping manuscript and tool names unchanged', t => {
-  const tools = typedTools({ resolved: role(t, 'ideas'), library: true });
-  assert.deepEqual(tools.map(t => t.name), ['send_message', ...LOOKUPS]);
-  for (const name of ['library_find', 'library_search', 'library_get']) {
-    const tool = tools.find(t => t.name === name);
-    assert.deepEqual(tool.parameters.properties.scope.enum, ['canon', 'playground', 'supporting']);
-    assert.ok(!tool.parameters.required.includes('scope'));
-  }
-  assert.deepEqual(tools.find(t => t.name === 'library_manuscript').parameters.properties.scope.enum, ['canon', 'playground']);
-});
@@ -31,72 +31,33 @@ deep-frozen copy. `where` names the entry in messages. `fail(code, message)` def
 - `user` is the bot account name from design step 3, required for sync. It is optional in the
  mapping and checked with row 199's account name pattern, `[A-Za-z0-9_.-]`, 1 to 100 characters.
 - `vaultPrefix` is optional, one folder name.
- `editor` is optional, `{ "name", "email" }` plus an optional `"user"`: the ident her Console saves commit under
-  (C2-01d). Each value is text that is non-empty after trim, with no control character
-  (`U+0000`-`U+001F`, `U+007F`-`U+009F`), `<` or `>`, and no whitespace or git-stripped character at
-  either end. `user` is her Gitea login for the `library-human` slot (sage-2925), checked as the
-  entry's `user` is. `editor` and its `user` come back only when given; a save without them refuses
-  in C2-02.
 - `types` maps a folder name to `character`, `place`, `research`, `tracker` or `summary`.
  `manuscript` lists folder names and shares none with `types`.
 - A universe has `name`, `books` and `playground`. A hybrid adds `kind: "hybrid"`, two or more
  plain-universe `sources`, `constraints` (each one `{ "exclude": ... }` or
  `{ "pin": { "entity", "field", "value" } }`) and `notes`, and may have `books: []`. A draft
  universe has only `kind: "draft"`, `name` and one or more `playground` prefixes, and comes back as
-  `{ kind: "draft", name, books: [], playground, supporting }`. `kind` is absent, `"hybrid"` or `"draft"`.
+  `{ kind: "draft", name, books: [], playground }`. `kind` is absent, `"hybrid"` or `"draft"`.
 - A playground prefix ends in `/` and has one of three levels (C2-01c). Book level lies inside one of
  its own entry's book folders. Universe level, in a plain universe or a hybrid, lies outside every
  book folder. A draft's prefixes all lie outside every book folder. No prefix holds another or is
  listed twice, across every entry.
- Every universe kind may also have `supporting`, a list of prefixes where agents may write (C2-01d,
-  M12). It comes back on every universe, `[]` when absent. A supporting prefix follows the playground's
-  rules: it ends in `/`, has the same three levels, holds no other supporting prefix and is listed
-  once, across every entry.
- Between the two lists: a supporting prefix may equal a playground prefix of its own entry, and a
-  playground prefix may hold one of its own entry's supporting prefixes. A supporting prefix may not
-  hold a playground prefix, which scope would then never reach, and may not equal, hold or lie inside
-  another entry's playground prefix.

 Refusals:

 | Code | When |
 |---|---|
 | `library-playground-other-universe` | a playground prefix lies inside, or holds, a book folder of another entry |
-| `library-supporting-other-universe` | a supporting prefix lies inside, or holds, a book folder of another entry |
-| `library-mapping-invalid` | any other shape fault: unknown key, bad remote or branch, an unknown `kind`, a book folder in two universes, a book folder that holds another, a playground or supporting prefix that holds another of its list or is listed twice, a prefix equal to a book folder or holding its own entry's book, a supporting prefix that holds a playground prefix or overlaps another entry's, a bad `editor`, a draft with `books` or with no prefix, a hybrid source that is unknown, a hybrid or a draft |
+| `library-mapping-invalid` | any other shape fault: unknown key, bad remote or branch, an unknown `kind`, a book folder in two universes, a book folder that holds another, a playground prefix that holds another or is listed twice, a prefix equal to a book folder or holding its own entry's book, a draft with `books` or with no prefix, a hybrid source that is unknown, a hybrid or a draft |

 ## Scope

 `classify(mapping, path)` decides scope from the path alone. Only paths ending in lowercase `.md` are
-mapped. It checks prefixes first, supporting before playground. A path under any entry's supporting
-prefix is `supporting`, and otherwise one under a playground prefix is `playground`. Either way that
-entry is `universe` and the book folder holding the prefix is `book`, or `null` at universe level and
+mapped. It checks prefixes first. A path under any entry's playground prefix is `playground`, with that
+entry as `universe` and the book folder holding the prefix as `book`, or `null` at universe level and
 in a draft. Any other path under a book folder is `canon`. Everything else is `unmapped`. The type is
-the first folder after the prefix, or after the book: a `types` name, `manuscript`, or `null`.
-
-## Agent write paths
-
-`supportingPath(mapping, universe, path, tree)` returns `path` when an agent may write it in that
-universe, else it refuses `library-write-story-path` (C2-01d, M12). `tree` is the array `listTree`
-returns for the commit the write lands on; anything else is a TypeError. It reads no git. The checks
-run in this order, so a path with two faults always names the same one:
-
-1. a string of at most 1,024 UTF-8 bytes;
-2. no control character (the `editor` class), and the message leaves the path out;
-3. no backslash;
-4. not absolute;
-5. no empty, `.` or `..` segment, which also refuses `//` and a trailing `/`;
-6. `classify` gives `supporting` in that same universe, which refuses unmapped, `.canvas`, `.base`
-   and attachment paths, canon, a playground-only folder and another universe's prefix;
-7. no folder on the way, and not the path itself, is a symlink (`120000`) or gitlink (`160000`) in
-   `tree`;
-8. no folder on the way, and not the path itself, matches a tree path or tree folder after
-   `normalize('NFC').toLowerCase()` unless it is that exact name. APFS folds case and Unicode form,
-   so her checkout would put the file somewhere else. A tree that already holds case twins refuses a
-   write to either (R7).
-
-A delete's further rule, that the path exists at the tip as a `100644` blob, belongs to the C2-02
-broker.
+the first folder after the playground prefix, or after the book: a `types` name, `manuscript`, or
+`null`.

 ## Reader

@@ -1,75 +0,0 @@
-// The lookup index of design 3 (C2-05a): types, names, links and backlinks for one commit of her repo.
-// It is built from the reader's output, so it holds only mapped, readable files: R1, R2 and R7 leave a
-// file out, and an unresolved link is not in it. It is cached in memory by commit id. The key also
-// carries the repo path and a digest of the mapping, because one commit reads differently under another
-// mapping. The index is not universe-aware; query.mjs decides what a universe may see.
-import { createHash } from 'node:crypto';
-import { readLibrary } from './reader.mjs';
-import { raise } from './problems.mjs';
-
-const CACHE_LIMIT = 8;
-const cache = new Map();
-
-const push = (map, key, value) => {
-  if (!map.has(key)) map.set(key, []);
-  map.get(key).push(value);
-};
-// A file's name for lookups: its front matter `name` when it is text, else its file name.
-const displayName = file => {
-  const name = file.frontmatter?.name;
-  return typeof name === 'string' && name.trim() ? name.trim() : file.name;
-};
-// A link as the index keeps it: the file at the other end, its line, and the field when front matter holds it.
-const linkAt = (path, link) => ({ path, line: link.line, ...(link.field === undefined ? {} : { field: link.field }) });
-
-// Builds the index from readLibrary's output. Pure: no git, no clock.
-export function buildIndex(library, mapping) {
-  const files = new Map(), types = new Map(), names = new Map(), linksOut = new Map(), linksIn = new Map();
-  for (const file of library.files) {
-    const name = displayName(file);
-    files.set(file.path, {
-      path: file.path, scope: file.scope, universe: file.universe, book: file.book, type: file.type,
-      folder: file.folder, stem: file.name, name, frontmatter: file.frontmatter, lines: file.lines,
-    });
-    if (file.type !== null) push(types, file.type, file.path);
-    push(names, name.toLowerCase(), file.path);
-    linksOut.set(file.path, file.links.map(link => linkAt(link.path, link)));
-    for (const link of file.links) push(linksIn, link.path, linkAt(file.path, link));
-  }
-  return Object.freeze({
-    commit: library.commit, mapping, files, paths: [...files.keys()], types, names, linksOut, linksIn,
-    problems: library.problems,
-  });
-}
-
-const digest = mapping => createHash('sha256').update(JSON.stringify(mapping)).digest('hex');
-
-// The index for one commit under one mapping, read once and kept in memory. A repeat call returns the same
-// object. Past CACHE_LIMIT entries the oldest goes. A failed read is not kept.
-export async function indexFor({ repo, commit, mapping }) {
-  if (!mapping || mapping.kind !== 'library') raise('library-mapping-invalid', 'expected a checked library mapping');
-  const key = JSON.stringify([repo, commit, digest(mapping)]);
-  if (cache.has(key)) {
-    const hit = cache.get(key);
-    cache.delete(key);
-    cache.set(key, hit);
-    return hit;
-  }
-  const pending = readLibrary({ repo, commit, mapping }).then(library => buildIndex(library, mapping));
-  cache.set(key, pending);
-  while (cache.size > CACHE_LIMIT) cache.delete(cache.keys().next().value);
-  try {
-    return await pending;
-  } catch (error) {
-    if (cache.get(key) === pending) cache.delete(key);
-    throw error;
-  }
-}
-
-export function clearIndexCache() {
-  cache.clear();
-}
-
-export function indexCacheSize() {
-  return cache.size;
-}
@@ -2,12 +2,9 @@
 export { LibraryError, RULES, problem, sortProblems } from './problems.mjs';
 export { checkMapping, TYPES } from './mapping.mjs';
 export { classify } from './scope.mjs';
-export { supportingPath } from './supporting.mjs';
 export { extractLinks, parseWikilink, resolver, formOf, isAttachment } from './links.mjs';
 export { readLibrary, listTree, readTexts, parseFile, parseFrontMatter, headCommit, MAX_BLOB, LINK_FIELDS } from './reader.mjs';
 export { renderItems, KINDS, NOTICES, UNREADABLE } from './render.mjs';
 export { survey, formatSurvey, surveyMain } from './survey.mjs';
 export { SYNC_STATE_FILE, mirrorPath, ensureMirror, withLibraryLock, servedCommit, readSyncState, libraryStatus, readLibraryFile } from './mirror.mjs';
 export { syncCommand, sync, ASKPASS, SLOT, SYNC_INTERVAL_MS } from './sync.mjs';
-export { buildIndex, indexFor, clearIndexCache, indexCacheSize } from './index-build.mjs';
-export { sees, find, get, search, manuscript, universeInfo, QUERY_REPLY_CAP, LOOKUP_LIMIT, MANUSCRIPT_LINES } from './query.mjs';
@@ -1,9 +1,8 @@
 // The library project entry of a business file (design 1.1): her folders mapped onto universes,
 // books, type folders, manuscript folders and playground prefixes at three levels (ruling after r11,
-// C2-01c): inside one of the entry's books, outside every book, or in a draft universe. Supporting
-// prefixes (C2-01d) follow the same rules and are where agents may write (M12). A pure validator.
-// Business file loading wires it in C2-04, which passes its own `fail` so the refusal reads as a
-// business file problem. Agents can't write this entry (M9, C2-04).
+// C2-01c): inside one of the entry's books, outside every book, or in a draft universe. A pure validator. Business file
+// loading wires it in C2-04, which passes its own `fail` so the refusal reads as a business file
+// problem. Agents can't write this entry (M9, C2-04).
 import { raise } from './problems.mjs';

 export const TYPES = Object.freeze(['character', 'place', 'research', 'tracker', 'summary']);
@@ -13,12 +12,6 @@ const BRANCH = /^[A-Za-z0-9][A-Za-z0-9._/-]{0,127}$/;
 const USER = /^[A-Za-z0-9_.-]{1,100}$/;
 const CONSTRAINT_KEYS = ['exclude', 'pin'];
 const KINDS = ['hybrid', 'draft'];
-// C2-01d (F41): the editor ident her Console saves commit under. Git drops `<` and `>` from an ident
-// and commits under a different name, so they refuse here (webby-0169 R1).
-const IDENT_BAD = /[\u0000-\u001f\u007f-\u009f<>]/;
-// Git's ident.c crud() strips any byte <= 0x20 and , : ; < > " \ ' from both ends of an ident, so a
-// value that starts or ends with one would save one name and commit another (sage-3601, sage-3606).
-const IDENT_CRUD_END = /^[\u0000-\u0020,:;<>"\\']|[\u0000-\u0020,:;<>"\\']$/;

 // A folder segment from her vault: spaces and capitals are fine, separators, control characters
 // and dot names are not.
@@ -47,7 +40,7 @@ export function checkMapping(entry, where = 'library', { fail = raise } = {}) {
  };

  object(entry, '');
-  only(entry, ['kind', 'remote', 'branch', 'user', 'vaultPrefix', 'editor', 'universes', 'types', 'manuscript'], 'entry');
+  only(entry, ['kind', 'remote', 'branch', 'user', 'vaultPrefix', 'universes', 'types', 'manuscript'], 'entry');
  if (entry.kind !== 'library') bad('kind must be "library"');
  let url;
  try { url = new URL(entry.remote); } catch { bad('remote must be an https:// URL'); }
@@ -59,20 +52,6 @@ export function checkMapping(entry, where = 'library', { fail = raise } = {}) {
  if (Object.hasOwn(entry, 'user') && (typeof entry.user !== 'string' || !USER.test(entry.user)))
    bad('user must be a plain account name');
  if (Object.hasOwn(entry, 'vaultPrefix') && !segment(entry.vaultPrefix)) bad('vaultPrefix must be one folder name');
-  if (Object.hasOwn(entry, 'editor')) {
-    object(entry.editor, 'editor');
-    only(entry.editor, ['name', 'email', 'user'], 'editor');
-    // Her Gitea login for the library-human slot, which C2-02 passes in (sage-2925). Optional here.
-    if (Object.hasOwn(entry.editor, 'user') && (typeof entry.editor.user !== 'string' || !USER.test(entry.editor.user)))
-      bad('editor.user must be a plain account name');
-    for (const key of ['name', 'email']) {
-      const value = entry.editor[key];
-      if (typeof value !== 'string' || !value.trim() || IDENT_BAD.test(value))
-        bad(`editor.${key} must be non-empty text with no control character, < or >`);
-      if (value.trim() !== value || IDENT_CRUD_END.test(value))
-        bad(`editor.${key} must not start or end with whitespace or any of , : ; " ' \\`);
-    }
-  }

  object(entry.types, 'types');
  for (const [name, type] of Object.entries(entry.types)) {
@@ -85,7 +64,6 @@ export function checkMapping(entry, where = 'library', { fail = raise } = {}) {
  object(entry.universes, 'universes');
  if (!Object.keys(entry.universes).length) bad('universes must name at least one universe');
  const universes = {}, bookOwner = new Map(), prefixes = [], prefixOwner = new Map();
-  const supports = [], supportOwner = new Map();
  for (const [id, universe] of Object.entries(entry.universes)) {
    const name = `universes.${id}`;
    if (!ID.test(id)) bad(`universe id ${JSON.stringify(id)} is not a plain id`);
@@ -93,8 +71,8 @@ export function checkMapping(entry, where = 'library', { fail = raise } = {}) {
    if (Object.hasOwn(universe, 'kind') && !KINDS.includes(universe.kind)) bad(`${name}.kind must be "hybrid" or "draft"`);
    const hybrid = universe.kind === 'hybrid', draft = universe.kind === 'draft';
    if (draft && Object.hasOwn(universe, 'books')) bad(`${name} is a draft and takes no books`);
-    only(universe, hybrid ? ['kind', 'name', 'sources', 'books', 'playground', 'supporting', 'constraints', 'notes']
-      : draft ? ['kind', 'name', 'playground', 'supporting'] : ['name', 'books', 'playground', 'supporting'], name);
+    only(universe, hybrid ? ['kind', 'name', 'sources', 'books', 'playground', 'constraints', 'notes']
+      : draft ? ['kind', 'name', 'playground'] : ['name', 'books', 'playground'], name);
    if (typeof universe.name !== 'string' || !universe.name.trim() || universe.name.length > 128 || /[\u0000-\u001f]/.test(universe.name))
      bad(`${name}.name must be a short display name`);
    const books = draft ? [] : list(universe.books, `${name}.books`, folder, 'a folder path');
@@ -103,14 +81,12 @@ export function checkMapping(entry, where = 'library', { fail = raise } = {}) {
      if (bookOwner.has(book)) bad(`book folder ${JSON.stringify(book)} is in two universes`);
      bookOwner.set(book, id);
    }
-    const prefix = value => typeof value === 'string' && value.endsWith('/') && folder(value.slice(0, -1));
-    const playground = list(universe.playground ?? [], `${name}.playground`, prefix, 'a folder path ending in /');
+    const playground = list(universe.playground ?? [], `${name}.playground`,
+      value => typeof value === 'string' && value.endsWith('/') && folder(value.slice(0, -1)), 'a folder path ending in /');
    if (draft && !playground.length) bad(`${name}.playground must name at least one prefix`);
-    for (const p of playground) { prefixes.push(p); prefixOwner.set(p, id); }
-    const supporting = list(universe.supporting ?? [], `${name}.supporting`, prefix, 'a folder path ending in /');
-    for (const p of supporting) { supports.push(p); supportOwner.set(p, id); }
-    if (draft) { universes[id] = { kind: 'draft', name: universe.name, books, playground, supporting }; continue; }
-    const out = { name: universe.name, books, playground, supporting };
+    for (const prefix of playground) { prefixes.push(prefix); prefixOwner.set(prefix, id); }
+    if (draft) { universes[id] = { kind: 'draft', name: universe.name, books, playground }; continue; }
+    const out = { name: universe.name, books, playground };
    if (hybrid) {
      out.kind = 'hybrid';
      out.sources = list(universe.sources, `${name}.sources`, value => typeof value === 'string' && ID.test(value), 'a universe id');
@@ -148,36 +124,18 @@ export function checkMapping(entry, where = 'library', { fail = raise } = {}) {
  for (const a of books) for (const b of books) if (a !== b && holds(a, b)) bad(`book folder ${JSON.stringify(a)} holds book folder ${JSON.stringify(b)}`);
  for (const a of prefixes) for (const b of prefixes) if (a !== b && holds(a, b)) bad(`playground ${JSON.stringify(a)} holds playground ${JSON.stringify(b)}`);
  if (new Set(prefixes).size !== prefixes.length) bad('a playground prefix is listed twice');
-  for (const a of supports) for (const b of supports) if (a !== b && holds(a, b)) bad(`supporting ${JSON.stringify(a)} holds supporting ${JSON.stringify(b)}`);
-  if (new Set(supports).size !== supports.length) bad('a supporting prefix is listed twice');
  // A prefix's level comes from where it sits (ruling after r11). Inside one of its own entry's books
  // is book level, outside every book is universe level, and a draft's prefixes are all outside. Scope
  // checks prefixes first (scope.mjs), so a prefix equal to or holding a book would turn that book
-  // into playground or supporting.
-  const againstBooks = (owners, list, code) => {
-    for (const [prefix, id] of owners) {
-      for (const [book, owner] of bookOwner) {
-        const at = `universes.${id}.${list} ${JSON.stringify(prefix)}`;
-        if (prefix === `${book}/`) bad(`${at} is the whole book folder ${JSON.stringify(book)}`);
-        const inside = holds(book, prefix), holding = holds(prefix, book);
-        if ((inside || holding) && owner !== id)
-          fail(code, `${where} ${at} ${inside ? 'lies inside' : 'holds'} book folder ${JSON.stringify(book)} of universes.${owner}`);
-        if (holding) bad(`${at} holds its own book folder ${JSON.stringify(book)}`);
-      }
-    }
-  };
-  againstBooks(prefixOwner, 'playground', 'library-playground-other-universe');
-  againstBooks(supportOwner, 'supporting', 'library-supporting-other-universe');
-  // C2-01d, between the lists. A supporting prefix may equal a playground prefix of its own entry, and
-  // a playground may hold one of its own entry's supporting prefixes. A supporting prefix that holds a
-  // playground would hide it, since scope checks supporting first. Any overlap across entries would
-  // give one path two universes.
-  for (const [s, sid] of supportOwner) {
-    for (const [p, pid] of prefixOwner) {
-      const at = `universes.${sid}.supporting ${JSON.stringify(s)}`;
-      if (sid !== pid && (s === p || holds(s, p) || holds(p, s)))
-        bad(`${at} overlaps playground ${JSON.stringify(p)} of universes.${pid}`);
-      if (sid === pid && s !== p && holds(s, p)) bad(`${at} holds playground ${JSON.stringify(p)}`);
+  // into playground.
+  for (const [prefix, id] of prefixOwner) {
+    for (const [book, owner] of bookOwner) {
+      const at = `universes.${id}.playground ${JSON.stringify(prefix)}`;
+      if (prefix === `${book}/`) bad(`${at} is the whole book folder ${JSON.stringify(book)}`);
+      const inside = holds(book, prefix), holding = holds(prefix, book);
+      if ((inside || holding) && owner !== id)
+        fail('library-playground-other-universe', `${where} ${at} ${inside ? 'lies inside' : 'holds'} book folder ${JSON.stringify(book)} of universes.${owner}`);
+      if (holding) bad(`${at} holds its own book folder ${JSON.stringify(book)}`);
    }
  }

@@ -185,8 +143,6 @@ export function checkMapping(entry, where = 'library', { fail = raise } = {}) {
    kind: 'library', remote: entry.remote, branch: entry.branch,
    ...(Object.hasOwn(entry, 'user') ? { user: entry.user } : {}),
    ...(Object.hasOwn(entry, 'vaultPrefix') ? { vaultPrefix: entry.vaultPrefix } : {}),
-    ...(Object.hasOwn(entry, 'editor') ? { editor: { name: entry.editor.name, email: entry.editor.email,
-      ...(Object.hasOwn(entry.editor, 'user') ? { user: entry.editor.user } : {}) } } : {}),
    universes, types: { ...entry.types }, manuscript,
  });
 }
@@ -1,250 +0,0 @@
-// The lookup queries of design 3 (C2-05a): find, get, search, manuscript and universeInfo. Each takes a
-// source {repo, commit, mapping} and an argument object, and returns a reply that fits QUERY_REPLY_CAP.
-// Universe isolation is here, in sees(): a file reaches a reply only when sees() allows it. Scope comes
-// from the path (D2). Unmapped files are not in the index, so they never appear. Lists page by position
-// and never cut an item. A search line too long to fit alone comes back as a marked hit with no excerpt;
-// a find item, a file's front matter or one of its lines that cannot fit alone is refused.
-import { raise } from './problems.mjs';
-import { TYPES } from './mapping.mjs';
-import { indexFor } from './index-build.mjs';
-import { listTree } from './reader.mjs';
-
-// The same cap as packages/harness/src/tools.mjs REPLY_CAP. The query tests assert the two stay equal.
-export const QUERY_REPLY_CAP = 40_000;
-export const LOOKUP_LIMIT = 50;
-export const MANUSCRIPT_LINES = 400;
-const SCOPES = Object.freeze(['canon', 'playground', 'supporting']);
-const MANUSCRIPT_SCOPES = Object.freeze(['canon', 'playground']);
-const SCOPE_RANK = Object.freeze({ supporting: 0, playground: 1, canon: 2 });
-
-const bytes = value => JSON.stringify(value).length;
-const invalid = message => raise('query-argument-invalid', message);
-const inside = (folder, path) => path.startsWith(folder.endsWith('/') ? folder : `${folder}/`);
-
-function textArg(value, name) {
-  if (typeof value !== 'string') invalid(`${name} must be text`);
-  return value;
-}
-function scopeArg(value, allowed = SCOPES) {
-  if (value === undefined) return 'canon';
-  if (!allowed.includes(value)) invalid(`scope must be one of ${allowed.join(", ")}`);
-  return value;
-}
-function positionArg(value, name, fallback) {
-  if (value === undefined) return fallback;
-  if (!Number.isSafeInteger(value) || value < 1) invalid(`${name} must be a line number of 1 or more`);
-  return value;
-}
-function offsetArg(value) {
-  if (value === undefined) return 0;
-  if (!Number.isSafeInteger(value) || value < 0) invalid('offset must be a whole number of 0 or more');
-  return value;
-}
-function universeArg(mapping, value) {
-  if (typeof value !== 'string' || !value) invalid('universe is required');
-  if (!Object.hasOwn(mapping.universes, value)) raise('query-universe-unknown', `this library has no universe ${JSON.stringify(value)}`);
-  return value;
-}
-
-// Whether universe U may see a file. Its own files, in either scope. A hybrid also sees the canon of
-// its declared sources, minus the folders its exclude constraints name. A hybrid never sees a source's
-// playground. Pin constraints do not hide anything; they are reported by universeInfo only.
-export function sees(mapping, universe, file) {
-  if (file.universe === universe) return true;
-  const entry = mapping.universes[universe];
-  if (entry.kind !== 'hybrid' || !entry.sources.includes(file.universe) || file.scope !== 'canon') return false;
-  return !entry.constraints.some(c => c.exclude !== undefined && inside(c.exclude, file.path));
-}
-
-// The files one universe may see in one scope, with optional book and type filters, in path order.
-async function visible(source, universe, { scope, book, type }) {
-  const index = await indexFor(source);
-  const files = index.paths
-    .map(path => index.files.get(path))
-    .filter(file => file.scope === scope && sees(index.mapping, universe, file)
-      && (book === undefined || file.book === book) && (type === undefined || file.type === type));
-  return { index, files };
-}
-
-// A reply whose size is over the cap is refused, never cut.
-function checked(reply) {
-  if (bytes(reply) > QUERY_REPLY_CAP) raise('query-item-too-large', `the reply is over the ${QUERY_REPLY_CAP}-character cap`);
-  return reply;
-}
-
-// Picks items from `offset`, at most `limit`, while the reply still fits. build(picked, next) returns
-// the reply; `next` is the position of the first item not picked, or null when none is left. An item
-// that cannot fit even alone is refused: skipping it would hide it, and cutting it would break it.
-function fitPage(items, { offset = 0, limit = LOOKUP_LIMIT, build }) {
-  const picked = [];
-  let at = offset;
-  while (at < items.length && picked.length < limit) {
-    // The size check uses items.length for `next`, the widest number a cursor can take, so a page never runs over.
-    if (bytes(build([...picked, items[at]], items.length)) > QUERY_REPLY_CAP) {
-      if (!picked.length) raise('query-item-too-large', `the item at position ${at} alone is over the ${QUERY_REPLY_CAP}-character cap`);
-      break;
-    }
-    picked.push(items[at]);
-    at += 1;
-  }
-  return checked(build(picked, at < items.length ? at : null));
-}
-
-// find: the files whose name or file name holds `query`, case-insensitive. Up to 50 per page.
-export async function find(source, { universe: name, query, type, book, scope, offset } = {}) {
-  const universe = universeArg(source.mapping, name);
-  const needle = textArg(query, 'query').toLowerCase();
-  if (type !== undefined && !TYPES.includes(type)) invalid(`type must be one of ${TYPES.join(', ')}`);
-  const { index, files } = await visible(source, universe, {
-    scope: scopeArg(scope), book: book === undefined ? undefined : textArg(book, 'book'), type,
-  });
-  const hits = files.filter(file => file.name.toLowerCase().includes(needle) || file.stem.toLowerCase().includes(needle));
-  return fitPage(hits, {
-    offset: offsetArg(offset),
-    build: (picked, next) => ({
-      commit: index.commit,
-      results: picked.map(file => ({
-        path: file.path, type: file.type, name: file.name, appears_in: file.frontmatter?.appears_in ?? null,
-        scope: file.scope, universe: file.universe, book: file.book,
-      })),
-      next,
-    }),
-  });
-}
-
-// get: one file in the requested scope (canon default), its served-tree blob, front matter,
-// lines and visible links both ways. Links keep all visible scopes, ordered supporting/playground/canon.
-// Returns null when the file is missing or not visible, so a caller cannot tell the two apart. Lines page
-// by `from` (reply `next`), links page together by `links_from` (reply `links_next`); `links_out` come
-// before `links_in`. Every page carries the front matter. Links take at most half the cap, so a hub note
-// with many backlinks stays readable and still leaves room for lines. A page with lines left carries at
-// least one line, so links shrink when a line needs the room; read on with `from: next` and
-// `links_from: links_next`. A `from` past the last line returns links alone. Only front matter, or a
-// line that cannot fit with no links beside it, is refused.
-export async function get(source, { universe: name, path, scope, from, links_from: linksFrom } = {}) {
-  const universe = universeArg(source.mapping, name);
-  const requestedScope = scopeArg(scope);
-  const startLine = positionArg(from, 'from', 1);
-  const linkStart = offsetArg(linksFrom);
-  if (typeof path !== 'string') invalid('path must be text');
-  const index = await indexFor(source);
-  const file = index.files.get(path);
-  if (!file || file.scope !== requestedScope || !sees(index.mapping, universe, file)) return null;
-  const reachable = links => links.filter(link => {
-    const other = index.files.get(link.path);
-    return other !== undefined && sees(index.mapping, universe, other);
-  }).sort((a, b) => SCOPE_RANK[index.files.get(a.path).scope] - SCOPE_RANK[index.files.get(b.path).scope]);
-  const outs = reachable(index.linksOut.get(file.path) ?? []);
-  const ins = reachable(index.linksIn.get(file.path) ?? []);
-  const links = [...outs.map(link => ({ out: true, link })), ...ins.map(link => ({ out: false, link }))];
-  // The reader/index does not keep tree oids. Resolve only in this immutable served
-  // snapshot, never HEAD; listTree already checks/bounds the tree and its object IDs.
-  const entry = (await listTree(source.repo, index.commit)).find(entry => entry.path === file.path);
-  if (!entry || entry.mode !== '100644' || entry.type !== 'blob') raise('library-commit', 'indexed file is absent from the served tree');
-  const blob = entry.oid;
-  const lines = file.lines.slice(startLine - 1);
-  const linkRest = Math.max(0, links.length - linkStart);
-  const page = (nLines, nLinks) => {
-    const taken = links.slice(linkStart, linkStart + nLinks);
-    return {
-      path: file.path, commit: index.commit, blob, scope: file.scope, frontmatter: file.frontmatter,
-      lines: lines.slice(0, nLines),
-      links_out: taken.filter(item => item.out).map(item => item.link),
-      links_in: taken.filter(item => !item.out).map(item => item.link),
-      next: nLines < lines.length ? startLine + nLines : null,
-      links_next: nLinks < linkRest ? linkStart + nLinks : null,
-    };
-  };
-  // How many leading items fit in `room`, by each item's own size.
-  const count = (items, room) => {
-    let used = 0, n = 0;
-    while (n < items.length && used + bytes(items[n]) + 1 <= room) used += bytes(items[n++]) + 1;
-    return n;
-  };
-  const base = bytes(page(0, 0));
-  if (base > QUERY_REPLY_CAP) raise('query-item-too-large', `the front matter of ${file.path} alone is over the ${QUERY_REPLY_CAP}-character cap`);
-  if (lines.length && bytes(page(1, 0)) > QUERY_REPLY_CAP) {
-    raise('query-item-too-large', `line ${lines[0][0]} of ${file.path} alone is over the ${QUERY_REPLY_CAP}-character cap`);
-  }
-  const rest = links.slice(linkStart);
-  let nLinks = count(rest, (lines.length ? Math.floor(QUERY_REPLY_CAP / 2) : QUERY_REPLY_CAP) - base);
-  if (!nLinks && rest.length) nLinks = count(rest, QUERY_REPLY_CAP - base);
-  if (!nLinks && rest.length) raise('query-item-too-large', `a link of ${file.path} alone is over the ${QUERY_REPLY_CAP}-character cap`);
-  while (lines.length && nLinks > 0 && bytes(page(1, nLinks)) > QUERY_REPLY_CAP) nLinks = Math.floor(nLinks / 2);
-  let nLines = Math.max(lines.length ? 1 : 0, count(lines, QUERY_REPLY_CAP - bytes(page(0, nLinks))));
-  while (nLines > 1 && bytes(page(nLines, nLinks)) > QUERY_REPLY_CAP) nLines -= 1;
-  return checked(page(nLines, nLinks));
-}
-
-// search: lines whose text holds `text`, case-insensitive. The excerpt is the whole line. Up to 50 per page.
-export async function search(source, { universe: name, text, book, scope, offset } = {}) {
-  const universe = universeArg(source.mapping, name);
-  const needle = textArg(text, 'text').toLowerCase();
-  if (!needle) invalid('text must not be empty');
-  const { index, files } = await visible(source, universe, {
-    scope: scopeArg(scope), book: book === undefined ? undefined : textArg(book, 'book'),
-  });
-  const hits = [];
-  for (const file of files) {
-    for (const [line, body] of file.lines) {
-      if (!body.toLowerCase().includes(needle)) continue;
-      const hit = { path: file.path, line, excerpt: body, scope: file.scope };
-      // The excerpt is the whole line. A line too long to fit alone is marked, not cut and not refused.
-      hits.push(bytes({ commit: index.commit, results: [hit], next: Number.MAX_SAFE_INTEGER }) > QUERY_REPLY_CAP
-        ? { path: file.path, line, excerpt: null, excerpt_too_long: true, scope: file.scope } : hit);
-    }
-  }
-  return fitPage(hits, {
-    offset: offsetArg(offset),
-    build: (picked, next) => ({ commit: index.commit, results: picked, next }),
-  });
-}
-
-// manuscript: one chapter file of a book, by its file name, up to 400 lines per call from `from` to `to`.
-// Without a chapter it returns the book's first chapter file in path order. Every reply carries
-// `next_chapter`, the next chapter file's name in path order or null. A name that matches two visible
-// files is refused. Files outside every book (book null) are never chapters of a book.
-export async function manuscript(source, { universe: name, book, scope, chapter, from, to } = {}) {
-  const universe = universeArg(source.mapping, name);
-  const bookName = textArg(book, 'book');
-  const chapterName = chapter === undefined ? undefined : textArg(chapter, 'chapter');
-  const start = positionArg(from, 'from', 1);
-  const end = positionArg(to, 'to', Infinity);
-  if (end < start) invalid('to must not be before from');
-  const { index, files } = await visible(source, universe, { scope: scopeArg(scope, MANUSCRIPT_SCOPES), book: bookName, type: 'manuscript' });
-  let at = 0;
-  if (chapterName !== undefined) {
-    const matches = files.filter(file => file.stem === chapterName);
-    if (matches.length > 1) raise('query-chapter-ambiguous', `${matches.length} visible files are named ${JSON.stringify(chapterName)}`);
-    if (!matches.length) return null;
-    at = files.indexOf(matches[0]);
-  }
-  const file = files[at];
-  if (!file) return null;
-  const nextChapter = files[at + 1]?.stem ?? null;
-  return fitPage(file.lines.slice(start - 1, end), {
-    limit: MANUSCRIPT_LINES,
-    build: (picked, next) => ({
-      path: file.path, commit: index.commit, scope: file.scope, lines: picked,
-      next: next === null ? null : start + next, next_chapter: nextChapter,
-    }),
-  });
-}
-
-// universeInfo: a universe's kind, name, books, playground prefixes, type folders and manuscript folders.
-// A hybrid adds its sources, constraints and notes. A draft has no books and no canon: its kind, name
-// and prefixes are the whole answer beside the mapping's types. It reads only the checked mapping and the
-// served commit.
-export async function universeInfo(source, { universe: name } = {}) {
-  const universe = universeArg(source.mapping, name);
-  const entry = source.mapping.universes[universe];
-  const hybrid = entry.kind === 'hybrid';
-  return checked({
-    commit: source.commit, universe, name: entry.name, kind: entry.kind ?? 'universe',
-    books: entry.books, playground: entry.playground, types: source.mapping.types, manuscript: source.mapping.manuscript,
-    ...(hybrid ? {
-      sources: entry.sources, constraints: entry.constraints,
-      ...(entry.notes === undefined ? {} : { notes: entry.notes }),
-    } : {}),
-  });
-}
@@ -2,22 +2,16 @@
 // Paths are repo-relative and compared exactly, case included (R7 handles case-only twins).
 const inside = (folder, path) => path.startsWith(folder.endsWith('/') ? folder : `${folder}/`);

-// { scope: 'supporting' | 'playground' | 'canon', universe, book, type, folder } or { scope: 'unmapped' }.
-// Prefixes come first (ruling after r11, C2-01c), supporting before playground (C2-01d, design 1.2):
-// a `.md` file under any entry's supporting prefix is supporting, and otherwise one under a playground
-// prefix is playground. Either way `universe` is that entry and `book` is the book folder that holds
-// the prefix, or null at universe level and in a draft. Otherwise a `.md` file in a book folder is
-// canon. `type` is the mapped type of the first folder under the prefix or under the book (canon),
+// { scope: 'playground' | 'canon', universe, book, type, folder } or { scope: 'unmapped' }.
+// Prefixes come first (ruling after r11, C2-01c): a `.md` file under any entry's playground prefix is
+// playground, with that entry as `universe` and the book folder that holds the prefix as `book`, or
+// null at universe level and in a draft. Otherwise a `.md` file in a book folder is canon. `type` is
+// the mapped type of the first folder under the prefix (playground) or under the book (canon),
 // 'manuscript' for a manuscript folder, else null. `folder` is that folder name. checkMapping keeps
-// prefixes of one list from overlapping, and keeps a supporting prefix from holding a playground
-// prefix, so the first match is the only one that counts.
+// prefixes from overlapping, so at most one matches.
 export function classify(mapping, path) {
  if (typeof path !== 'string' || !path.endsWith('.md')) return { scope: 'unmapped' };
  const entries = Object.entries(mapping.universes);
-  for (const [universe, entry] of entries) {
-    const prefix = entry.supporting.find(p => inside(p, path));
-    if (prefix) return place(mapping, path, prefix, { scope: 'supporting', universe, book: entry.books.find(b => inside(b, prefix)) ?? null });
-  }
  for (const [universe, entry] of entries) {
    const prefix = entry.playground.find(p => inside(p, path));
    if (prefix) return place(mapping, path, prefix, { scope: 'playground', universe, book: entry.books.find(b => inside(b, prefix)) ?? null });
@@ -1,49 +0,0 @@
-// C2-01d (M12): the paths an agent may write. A path passes only under a supporting prefix of the
-// named universe, and only if nothing in the tree could turn the write into something else: a
-// symlink or gitlink on the way, or a name that differs from a tree name only in case or Unicode
-// form (APFS folds both, so her checkout would put the file somewhere else). Pure; reads no git.
-import { LibraryError } from './problems.mjs';
-import { classify } from './scope.mjs';
-
-const CONTROL = /[\u0000-\u001f\u007f-\u009f]/;
-const MAX_BYTES = 1024;
-const LINKS = new Set(['120000', '160000']);
-const fold = name => name.normalize('NFC').toLowerCase();
-
-// `tree` is the array listTree returns ({ mode, type, oid, size, path }). Returns `path` or throws
-// library-write-story-path naming the class. Checks run in a fixed order, so a path with two faults
-// always names the same one.
-export function supportingPath(mapping, universe, path, tree) {
-  if (!Array.isArray(tree)) throw new TypeError('supportingPath needs the listTree array');
-  const refuse = message => { throw new LibraryError('library-write-story-path', message); };
-  if (typeof path !== 'string') refuse('the path must be a string');
-  const at = JSON.stringify(path);
-  if (Buffer.byteLength(path, 'utf8') > MAX_BYTES) refuse(`${at} is longer than ${MAX_BYTES} bytes`);
-  if (CONTROL.test(path)) refuse('the path holds a control character');
-  if (path.includes('\\')) refuse(`${at} holds a backslash`);
-  if (path.startsWith('/')) refuse(`${at} is absolute`);
-  const parts = path.split('/');
-  if (parts.some(part => part === '' || part === '.' || part === '..')) refuse(`${at} has an empty, . or .. segment`);
-  const place = classify(mapping, path);
-  if (place.scope !== 'supporting' || place.universe !== universe)
-    refuse(`${at} is not under a supporting folder of universe ${JSON.stringify(universe)}`);
-  const own = parts.map((_, i) => parts.slice(0, i + 1).join('/'));
-  const modes = new Map(tree.map(entry => [entry.path, entry.mode]));
-  for (const p of own) if (LINKS.has(modes.get(p))) refuse(`${at} goes through the symlink or gitlink ${JSON.stringify(p)}`);
-  const names = new Map();
-  for (const entry of tree) {
-    const segs = entry.path.split('/');
-    for (let i = 1; i <= segs.length; i++) {
-      const name = segs.slice(0, i).join('/');
-      const key = fold(name);
-      if (!names.has(key)) names.set(key, new Set());
-      names.get(key).add(name);
-    }
-  }
-  for (const p of own) {
-    const seen = names.get(fold(p));
-    if (seen && [...seen].some(name => name !== p))
-      refuse(`${at} differs only in case or Unicode form from ${JSON.stringify([...seen].find(name => name !== p))}`);
-  }
-  return path;
-}
@@ -62,7 +62,7 @@ export async function survey({ repo, commit, mapping }) {
    forms, attachments, fields,
  };
  if (mapping) {
-    const scopes = { canon: 0, playground: 0, supporting: 0, unmapped: 0 };
+    const scopes = { canon: 0, playground: 0, unmapped: 0 };
    for (const entry of entries) scopes[classify(mapping, entry.path).scope]++;
    const library = await readLibrary({ repo, commit: head, mapping });
    const steps = Object.fromEntries(STEPS.map(s => [s, 0]));
@@ -89,7 +89,7 @@ export function formatSurvey(s) {
  out.push(`body links ${FORMS.map(f => `${f} ${s.forms[f]}`).join(', ')}; attachment ${s.attachments}`);
  for (const [field, c] of Object.entries(s.fields)) out.push(`field ${field} wikilink ${c.wikilink}, name ${c.name}`);
  if (s.scopes) {
-    out.push(`scopes canon ${s.scopes.canon}, playground ${s.scopes.playground}, supporting ${s.scopes.supporting}, unmapped ${s.scopes.unmapped}; indexed ${s.indexed}`);
+    out.push(`scopes canon ${s.scopes.canon}, playground ${s.scopes.playground}, unmapped ${s.scopes.unmapped}; indexed ${s.indexed}`);
    out.push(`resolved ${STEPS.map(st => `${st} ${s.steps[st]}`).join(', ')}, unresolved ${s.steps.unresolved}`);
    out.push(`problems ${Object.entries(s.problems).map(([code, n]) => `${code} ${n}`).join(', ')}`);
  }
@@ -1,91 +0,0 @@
-// Index tests (C2-05a): the cache key and its bound, failed reads, mapped-only contents, and the rebuild
-// time on a 3,000-file fixture. Fixtures are made up and built under the scratch area.
-import { test } from 'node:test';
-import assert from 'node:assert/strict';
-import { symlinkSync, writeFileSync } from 'node:fs';
-import { join } from 'node:path';
-import { performance } from 'node:perf_hooks';
-import { clearIndexCache, indexCacheSize, indexFor } from '../src/index-build.mjs';
-import { git, mapping, MARKER } from './helpers.mjs';
-import { note, scratchRepo } from './query-fixture.mjs';
-
-const FILES = {
-  'Book One/Characters/Mara Vell.md': note('character', 'Mara Vell', MARKER),
-  'Book One/Chapters/Chapter 01.md': '# One\n[[Mara Vell]]\n',
-  'Inbox Note.md': `${MARKER}\n`,
-};
-
-// A mapping whose harbor universe has the given display name. Each name gives a new cache key.
-const named = name => mapping(e => ({ ...e, universes: { ...e.universes, harbor: { ...e.universes.harbor, name } } }));
-
-test('the same commit, repo path and mapping return the same index, and only mapped files are in it', async t => {
-  clearIndexCache();
-  const { repo, commit } = scratchRepo(t, FILES);
-  const a = await indexFor({ repo, commit, mapping: mapping() });
-  const b = await indexFor({ repo, commit, mapping: mapping() });
-  assert.equal(a, b);
-  assert.equal(indexCacheSize(), 1);
-  assert.equal(a.commit, commit);
-  assert.ok(a.files.has('Book One/Characters/Mara Vell.md'));
-  assert.ok(!a.files.has('Inbox Note.md'));
-  assert.deepEqual(a.names.get('mara vell'), ['Book One/Characters/Mara Vell.md']);
-  assert.deepEqual(a.linksIn.get('Book One/Characters/Mara Vell.md').map(l => l.path), ['Book One/Chapters/Chapter 01.md']);
-});
-
-test('a different repo path, mapping or commit gets its own index', async t => {
-  clearIndexCache();
-  const { root, repo, commit } = scratchRepo(t, FILES);
-  const base = await indexFor({ repo, commit, mapping: mapping() });
-  const alias = join(root, 'alias');
-  symlinkSync(repo, alias);
-  assert.notEqual(await indexFor({ repo: alias, commit, mapping: mapping() }), base);
-  assert.notEqual(await indexFor({ repo, commit, mapping: named('Renamed Harbor') }), base);
-  writeFileSync(join(repo, 'Book One/Places/New.md'), note('place', 'New'));
-  git(repo, 'add', '-A');
-  git(repo, 'commit', '-qm', 'second');
-  const next = git(repo, 'rev-parse', 'HEAD');
-  const later = await indexFor({ repo, commit: next, mapping: mapping() });
-  assert.notEqual(later, base);
-  assert.equal(later.commit, next);
-  assert.ok(later.files.has('Book One/Places/New.md'));
-});
-
-test('the cache holds at most eight indexes and evicts the least recently used', async t => {
-  clearIndexCache();
-  const { repo, commit } = scratchRepo(t, FILES);
-  const maps = Array.from({ length: 9 }, (_, i) => named(`Harbor ${i}`));
-  const first = await indexFor({ repo, commit, mapping: maps[0] });
-  for (const m of maps.slice(1)) await indexFor({ repo, commit, mapping: m });
-  assert.equal(indexCacheSize(), 8);
-  assert.notEqual(await indexFor({ repo, commit, mapping: maps[0] }), first);
-  assert.equal(indexCacheSize(), 8);
-});
-
-test('a failed read is not kept in the cache', async t => {
-  clearIndexCache();
-  const { repo } = scratchRepo(t, FILES);
-  await assert.rejects(indexFor({ repo, commit: '0'.repeat(40), mapping: mapping() }));
-  assert.equal(indexCacheSize(), 0);
-});
-
-test('a missing or unchecked mapping is refused before any read', async t => {
-  clearIndexCache();
-  const { repo, commit } = scratchRepo(t, FILES);
-  await assert.rejects(indexFor({ repo, commit, mapping: undefined }), { code: 'library-mapping-invalid' });
-  await assert.rejects(indexFor({ repo, commit, mapping: { kind: 'hybrid' } }), { code: 'library-mapping-invalid' });
-});
-
-test('a 3,000-file rebuild completes and its time is reported', { timeout: 300_000 }, async t => {
-  clearIndexCache();
-  const folders = ['Characters', 'Places', 'Research'];
-  const files = {};
-  for (let i = 0; i < 3000; i++) {
-    files[`Book One/${folders[i % 3]}/Note ${i}.md`] = note('character', `Note ${i}`, `Body ${i} [[Note ${(i + 1) % 3000}]]`);
-  }
-  const { repo, commit } = scratchRepo(t, files);
-  const started = performance.now();
-  const index = await indexFor({ repo, commit, mapping: mapping() });
-  const ms = performance.now() - started;
-  t.diagnostic(`3,000-file index rebuild: ${ms.toFixed(0)} ms`);
-  assert.equal(index.paths.length, 3000);
-});
@@ -1,9 +1,5 @@
 import test from 'node:test';
 import assert from 'node:assert/strict';
-import { execFileSync } from 'node:child_process';
-import { mkdtempSync, rmSync } from 'node:fs';
-import { tmpdir } from 'node:os';
-import { join } from 'node:path';
 import { checkMapping, classify, LibraryError } from '../src/index.mjs';
 import { mapping, mappingEntry } from './helpers.mjs';

@@ -49,7 +45,7 @@ test('C2-01c: universe-level prefixes lie outside every book, in a plain univers

 test('C2-01c: a draft takes kind, name and playground only, and comes back frozen with books []', () => {
  const m = mapping(e => { e.universes.idea = draft(); return e; });
-  assert.deepEqual(m.universes.idea, { kind: 'draft', name: 'New World', books: [], playground: ['Drafts/New World/'], supporting: [] });
+  assert.deepEqual(m.universes.idea, { kind: 'draft', name: 'New World', books: [], playground: ['Drafts/New World/'] });
  assert.ok(Object.isFrozen(m.universes.idea) && Object.isFrozen(m.universes.idea.books) && Object.isFrozen(m.universes.idea.playground));
  refuses(e => { e.universes.idea = { ...draft(), books: ['New World'] }; return e; }, 'library-mapping-invalid', /universes.idea is a draft and takes no books/);
  refuses(e => { e.universes.idea = { ...draft(), books: [] }; return e; }, 'library-mapping-invalid', /takes no books/);
@@ -60,107 +56,6 @@ test('C2-01c: a draft takes kind, name and playground only, and comes back froze
    refuses(e => { e.universes.harbor.kind = kind; return e; }, 'library-mapping-invalid', /universes.harbor.kind must be "hybrid" or "draft"/);
 });

-test('C2-01d: supporting prefixes at book level, universe level, in a hybrid and in a draft, [] when absent', () => {
-  const m = mapping(e => {
-    e.universes.harbor.supporting = ['Book One/Notes/', 'Harbor Notes/'];
-    e.universes.cross = { kind: 'hybrid', name: 'Cross', sources: ['harbor', 'second'], books: [], supporting: ['Crossover Notes/'] };
-    e.universes.idea = { ...draft(), supporting: ['Drafts/New World Notes/'] };
-    return e;
-  });
-  assert.deepEqual(m.universes.harbor.supporting, ['Book One/Notes/', 'Harbor Notes/']);
-  assert.deepEqual(m.universes.cross.supporting, ['Crossover Notes/']);
-  assert.deepEqual(m.universes.idea.supporting, ['Drafts/New World Notes/']);
-  assert.deepEqual(m.universes.second.supporting, []);
-  assert.ok(Object.isFrozen(m.universes.harbor.supporting) && Object.isFrozen(m.universes.second.supporting));
-  assert.deepEqual(mapping().universes.harbor.supporting, []);
-});
-
-test('C2-01d: each supporting prefix rule refuses with its code', () => {
-  const invalid = (change, pattern) => refuses(change, 'library-mapping-invalid', pattern);
-  invalid(e => { e.universes.harbor.supporting = ['Book One/Notes']; return e; }, /universes.harbor.supporting holds "Book One\/Notes", which is not a folder path ending in \//);
-  invalid(e => { e.universes.harbor.supporting = ['Book One/../Notes/']; return e; }, /which is not a folder path ending in \//);
-  invalid(e => { e.universes.harbor.supporting = 'Book One/Notes/'; return e; }, /universes.harbor.supporting must be a list/);
-  invalid(e => { e.universes.harbor.supporting = ['Book One/Notes/', 'Book One/Notes/Deep/']; return e; },
-    /supporting "Book One\/Notes\/" holds supporting "Book One\/Notes\/Deep\/"/);
-  invalid(e => { e.universes.harbor.supporting = ['Ideas/']; e.universes.idea = { ...draft(), supporting: ['Ideas/'] }; return e; },
-    /a supporting prefix is listed twice/);
-  invalid(e => { e.universes.harbor.supporting = ['Book One/']; return e; }, /universes.harbor.supporting "Book One\/" is the whole book folder "Book One"/);
-  invalid(e => { e.universes.harbor.books = ['Shelf/Book One']; e.universes.harbor.playground = []; e.universes.harbor.supporting = ['Shelf/']; return e; },
-    /universes.harbor.supporting "Shelf\/" holds its own book folder "Shelf\/Book One"/);
-  // Supporting is checked first in scope, so a supporting prefix holding a playground would hide it.
-  invalid(e => { e.universes.harbor.supporting = ['Book One/Workshop/']; e.universes.harbor.playground = ['Book One/Workshop/Playground/']; return e; },
-    /universes.harbor.supporting "Book One\/Workshop\/" holds playground "Book One\/Workshop\/Playground\/"/);
-  // Across entries any overlap would give one path two universes.
-  for (const [supporting, playground] of [['Ideas/', 'Ideas/'], ['Ideas/Deep/', 'Ideas/'], ['Ideas/', 'Ideas/Deep/']])
-    invalid(e => { e.universes.harbor.supporting = [supporting]; e.universes.idea = draft([playground]); return e; },
-      new RegExp(`universes.harbor.supporting "${supporting}" overlaps playground "${playground}" of universes.idea`));
-  refuses(e => { e.universes.harbor.supporting = ['Second World/Notes/']; return e; },
-    'library-supporting-other-universe', /universes.harbor.supporting "Second World\/Notes\/" lies inside book folder "Second World" of universes.second/);
-  refuses(e => { e.universes.second.books = ['Worlds/Second']; e.universes.harbor.supporting = ['Worlds/']; return e; },
-    'library-supporting-other-universe', /universes.harbor.supporting "Worlds\/" holds book folder "Worlds\/Second" of universes.second/);
-  refuses(e => { e.universes.idea = { ...draft(), supporting: ['Book One/Idea Notes/'] }; return e; },
-    'library-supporting-other-universe', /universes.idea.supporting "Book One\/Idea Notes\/" lies inside book folder "Book One" of universes.harbor/);
-});
-
-test('C2-01d: between the lists, a supporting prefix may equal its own playground, and a playground may hold its own supporting', () => {
-  const same = mapping(e => { e.universes.harbor.supporting = ['Book One/Playground/']; return e; });
-  assert.deepEqual([same.universes.harbor.playground, same.universes.harbor.supporting], [['Book One/Playground/'], ['Book One/Playground/']]);
-  const nested = mapping(e => { e.universes.harbor.supporting = ['Book One/Playground/Notes/']; return e; });
-  assert.deepEqual(nested.universes.harbor.supporting, ['Book One/Playground/Notes/']);
-});
-
-test('C2-01d: editor is optional, kept when given, and refuses anything but a plain name and email', () => {
-  assert.equal(Object.hasOwn(mapping(), 'editor'), false);
-  const editor = { name: 'Her Name', email: '[email protected]' };
-  const m = mapping(e => ({ ...e, editor }));
-  assert.deepEqual(m.editor, editor);
-  assert.notEqual(m.editor, editor);
-  assert.ok(Object.isFrozen(m.editor));
-  const invalid = (value, pattern) => refuses(e => ({ ...e, editor: value }), 'library-mapping-invalid', pattern);
-  for (const value of [null, 'Her Name', 7, ['Her Name', '[email protected]']]) invalid(value, /editor must be an object/);
-  invalid({ ...editor, signingKey: 'x' }, /editor has unknown key "signingKey"/);
-  // sage-2925: an optional Gitea login for her save, checked as the entry's user is.
-  assert.deepEqual(mapping(e => ({ ...e, editor: { ...editor, user: 'her.login-1' } })).editor, { ...editor, user: 'her.login-1' });
-  for (const user of ['', 'her login', 'her@host', 'a'.repeat(101), 7, null])
-    invalid({ ...editor, user }, /editor.user must be a plain account name/);
-  invalid({ name: 'Her Name' }, /editor.email must be non-empty text with no control character, < or >/);
-  invalid({ email: '[email protected]' }, /editor.name must be non-empty text/);
-  for (const bad of ['', '   ', 7, null, 'a\u0000b', 'a\nb', 'a\u001fb', 'a\u007fb', 'a\u0085b', 'a\u009fb', '<her>', 'a<b', 'a>b']) {
-    invalid({ ...editor, name: bad }, /editor.name must be non-empty text with no control character, < or >/);
-    invalid({ ...editor, email: bad }, /editor.email must be non-empty text with no control character, < or >/);
-  }
-  // sage-3601, sage-3606: git's crud() strips whitespace and , : ; < > " \ ' from both ends of an
-  // ident, so a value starting or ending with one refuses. Inner < > and controls refuse above.
-  const ends = [' ', '\u00a0', '\u3000', ',', ':', ';', '"', "'", '\\'];
-  for (const c of ends) for (const padded of [`${c}Her Name`, `Her Name${c}`]) {
-    invalid({ ...editor, name: padded }, /editor.name must not start or end with whitespace or any of , : ; " ' \\/);
-    invalid({ ...editor, email: padded }, /editor.email must not start or end with whitespace or any of , : ; " ' \\/);
-  }
-  for (const c of ['<', '>', '\n', '\t']) for (const padded of [`${c}Her Name`, `Her Name${c}`, `Her${c}Name`])
-    invalid({ ...editor, name: padded }, /editor.name must be non-empty text with no control character, < or >/);
-  assert.equal(mapping(e => ({ ...e, editor: { name: 'Her  Middle Name', email: '[email protected]' } })).editor.name, 'Her  Middle Name');
-  for (const name of ['Doe, Jane Q.', 'Jane: "Q" Doe', "O'Neil", 'Back\\slash Name'])
-    assert.equal(mapping(e => ({ ...e, editor: { name, email: '[email protected]' } })).editor.name, name);
-});
-
-// sage-3606: an accepted editor commits under exactly the saved ident, as author and committer. A
-// future git that strips more from an ident fails here.
-test('C2-01d: an accepted editor round-trips through a real git commit unchanged', t => {
-  const editor = mapping(e => ({ ...e, editor: { name: 'Doe, Jane Q.', email: '[email protected].' } })).editor;
-  const root = mkdtempSync(join(tmpdir(), 'library-ident-'));
-  t.after(() => rmSync(root, { recursive: true, force: true }));
-  // An ident in the environment would win over -c, so the commit runs without one. GIT_DIR and its
-  // family would beat -C (inside a hook, say), and git reads no global or system config (webby-0236 E5).
-  const env = Object.fromEntries(Object.entries(process.env).filter(([k]) => !/^GIT_(AUTHOR|COMMITTER)_/.test(k)));
-  for (const k of ['GIT_DIR', 'GIT_WORK_TREE', 'GIT_COMMON_DIR', 'GIT_INDEX_FILE']) delete env[k];
-  Object.assign(env, { GIT_CONFIG_GLOBAL: '/dev/null', GIT_CONFIG_NOSYSTEM: '1' });
-  const git = (...args) => execFileSync('git', ['-c', `user.name=${editor.name}`, '-c', `user.email=${editor.email}`,
-    '-c', 'commit.gpgsign=false', '-c', 'core.hooksPath=/dev/null', '-C', root, ...args], { encoding: 'utf8', env });
-  git('init', '-q');
-  git('commit', '-q', '--allow-empty', '-m', 'ident');
-  assert.equal(git('log', '-1', '--format=%an%n%ae%n%cn%n%ce'), `${editor.name}\n${editor.email}\n${editor.name}\n${editor.email}\n`);
-});
-
 test('no playground prefix holds another, and no book folder holds another', () => {
  refuses(e => { e.universes.harbor.playground = ['Book One/Playground/', 'Book One/Playground/Deep/']; return e; },
    'library-mapping-invalid', /holds playground/);
@@ -1,50 +0,0 @@
-// Scratch repos for the query and index tests (C2-05a). They are built under tmpdir(), as helpers.mjs
-// repo() does; the gate sets TMPDIR under /mnt/storage/scratch/tmp, never /tmp (RULINGS "tmpdir flag").
-// Bodies are made up.
-import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from 'node:fs';
-import { tmpdir } from 'node:os';
-import { dirname, join } from 'node:path';
-import { git } from './helpers.mjs';
-
-// A repo with one commit holding `files` (path -> text). Removed when the test ends.
-export function scratchRepo(t, files) {
-  const root = mkdtempSync(join(tmpdir(), 'r216-'));
-  t.after(() => rmSync(root, { recursive: true, force: true }));
-  const repo = join(root, 'books');
-  mkdirSync(repo);
-  git(repo, 'init', '-q', '-b', 'main');
-  for (const [path, text] of Object.entries(files)) {
-    mkdirSync(dirname(join(repo, path)), { recursive: true });
-    writeFileSync(join(repo, path), text);
-  }
-  git(repo, 'add', '-A');
-  git(repo, 'commit', '-qm', 'fixture');
-  return { root, repo, commit: git(repo, 'rev-parse', 'HEAD') };
-}
-
-// A note: front matter with a type and a name, optional extra front matter lines, then a body.
-export const note = (type, name, body = '', extra = []) => ['---', `type: ${type}`, `name: ${name}`, ...extra, '---', body, ''].join('\n');
-
-// The one exclusion the hybrid tests use, and the paths it hides. C2-15 (row 267) replaces the reading of
-// `exclude` (a path prefix today); swapping these two constants is the whole change to the tests.
-export const EXCLUSION = { exclude: 'Book One/Research' };
-export const EXCLUDED_PATHS = ['Book One/Research/Ferry Logs.md'];
-
-// C2-05c: synthetic scope fixture, including same-prefix precedence and a draft.
-export const SUPPORT_FILES = {
-  'Book One/Characters/Canon.md': note('character', 'Canon', 'Scope fixture canon.'),
-  'Book One/Playground/Plan.md': note('summary', 'Plan', 'Scope fixture playground.'),
-  'Book One/Support/Notes/Helper.md': note('summary', 'Helper', 'Scope fixture supporting.'),
-  'Notes/HarborSupport/Loose.md': note('summary', 'Loose', 'Scope fixture supporting loose.'),
-  'Drafts/Idea/Support/Seed.md': note('summary', 'Seed', 'Scope fixture supporting draft.'),
-};
-export const withSupporting = entry => ({
-  ...entry,
-  universes: {
-    ...entry.universes,
-    harbor: { ...entry.universes.harbor,
-      playground: [...entry.universes.harbor.playground, 'Book One/Support/'],
-      supporting: ['Book One/Support/', 'Notes/HarborSupport/'] },
-    idea: { kind: 'draft', name: 'Idea', playground: ['Drafts/Idea/'], supporting: ['Drafts/Idea/Support/'] },
-  },
-});
@@ -1,466 +0,0 @@
-// Query tests for design 3 (C2-05a): universe isolation, scope labels, unmapped files, hybrids, paging
-// under the reply cap, refusals and manuscript paging. Fixtures are made up and built under the scratch area.
-import { test } from 'node:test';
-import { writeFileSync } from 'node:fs';
-import { join } from 'node:path';
-import assert from 'node:assert/strict';
-import { REPLY_CAP } from '../../harness/src/tools.mjs';
-import { find, get, search, manuscript, universeInfo, QUERY_REPLY_CAP, LOOKUP_LIMIT, MANUSCRIPT_LINES } from '../src/query.mjs';
-import { mapping, MARKER, git } from './helpers.mjs';
-import { scratchRepo, note, EXCLUSION, EXCLUDED_PATHS, SUPPORT_FILES, withSupporting } from './query-fixture.mjs';
-
-// A hybrid over harbor and second. Its one constraint is EXCLUSION (query-fixture.mjs) and it declares no
-// books or playground.
-const WITH_BLEND = e => ({
-  ...e,
-  universes: {
-    ...e.universes,
-    blend: {
-      kind: 'hybrid', name: 'Blend', sources: ['harbor', 'second'], books: [], playground: [],
-      constraints: [EXCLUSION], notes: 'made-up hybrid',
-    },
-  },
-});
-
-// PRD 1.14 levels (C2-01c): harbor gets a universe-level playground prefix outside every book, and a draft
-// universe has only playground prefixes. Files there have book null.
-const WITH_LEVELS = e => ({
-  ...WITH_BLEND(e),
-  universes: {
-    ...WITH_BLEND(e).universes,
-    harbor: { ...e.universes.harbor, playground: ['Book One/Playground/', 'Notes/Harbor/'] },
-    idea: { kind: 'draft', name: 'New World', playground: ['Drafts/New World/'] },
-  },
-});
-const LEVEL_FILES = {
-  'Notes/Harbor/Scraps.md': note('summary', 'Scraps', `${MARKER} loose`),
-  'Notes/Harbor/Chapters/Idea Chapter.md': `# Idea\n${MARKER} unbooked chapter\n`,
-  'Drafts/New World/Characters/Rin.md': note('character', 'Rin', `${MARKER} draft`),
-  'Drafts/New World/Summary.md': note('summary', 'Summary', `${MARKER} draft`),
-};
-
-const FILES = {
-  'Book One/Characters/Mara Vell.md': note('character', 'Mara Vell', `Grey eyes. ${MARKER}`,
-    ['appears_in: "[[Book One/Chapters/Chapter 01]]"', 'relationships:', '  - "[[Tomas]]"']),
-  'Book One/Characters/Tomas.md': note('character', 'Tomas', MARKER),
-  'Book One/Chapters/Chapter 01.md': `# One\n${MARKER} [[Mara Vell]] met [[Book One/Places/Harbor Town|the harbor]].\n`,
-  'Book One/Chapters/Chapter 02.md': 'Quiet. [[Ferry Logs]] [[Ilse]]\n',
-  'Book One/Places/Harbor Town.md': note('place', 'Harbor Town', `Salt. ${MARKER}`),
-  'Book One/Research/Ferry Logs.md': note('research', 'Ferry Logs', `Timetable. ${MARKER}`),
-  'Book One/Playground/What If.md': note('summary', 'What If', `${MARKER} [[Mara Vell]]`),
-  'Second World/Characters/Ilse.md': note('character', 'Ilse', `${MARKER} Ilse.`),
-  'Second World/Chapters/01.md': '# Elsewhere\n[[Ilse]] waits.\n',
-  'Inbox Note.md': `${MARKER}\n`,
-  'Book One/Board.canvas': '{"nodes":[]}\n',
-};
-
-const src = (ref, map = mapping()) => ({ repo: ref.repo, commit: ref.commit, mapping: map });
-const paths = reply => reply.results.map(r => r.path);
-
-test('the query reply cap equals the harness reply cap', () => {
-  assert.equal(QUERY_REPLY_CAP, REPLY_CAP);
-});
-
-test('find is bound to its universe and refuses a call without one', async t => {
-  const s = src(scratchRepo(t, FILES));
-  const names = paths(await find(s, { universe: 'harbor', query: '' }));
-  assert.ok(names.length > 0);
-  assert.ok(names.every(p => p.startsWith('Book One/')));
-  assert.ok(!names.includes('Second World/Characters/Ilse.md'));
-  await assert.rejects(find(s, { query: '' }), { code: 'query-argument-invalid' });
-  await assert.rejects(find(s, { universe: 'nowhere', query: '' }), { code: 'query-universe-unknown' });
-});
-
-test('every result carries its scope, and playground appears only when asked for', async t => {
-  const s = src(scratchRepo(t, FILES));
-  const canon = (await find(s, { universe: 'harbor', query: '' })).results;
-  assert.ok(canon.every(r => r.scope === 'canon'));
-  assert.ok(!canon.some(r => r.path.includes('/Playground/')));
-  const play = (await find(s, { universe: 'harbor', query: '', scope: 'playground' })).results;
-  assert.deepEqual(play.map(r => r.path), ['Book One/Playground/What If.md']);
-  assert.ok(play.every(r => r.scope === 'playground'));
-});
-
-test('unmapped files never appear in any reply', async t => {
-  const s = src(scratchRepo(t, FILES));
-  assert.deepEqual((await find(s, { universe: 'harbor', query: 'Inbox' })).results, []);
-  assert.deepEqual((await find(s, { universe: 'harbor', query: 'Board' })).results, []);
-  const hits = (await search(s, { universe: 'harbor', text: MARKER })).results;
-  assert.ok(hits.length > 0);
-  assert.ok(hits.every(r => r.path !== 'Inbox Note.md' && r.path !== 'Book One/Board.canvas'));
-});
-
-test('a hybrid sees its sources canon, minus exclusions, and no playground', async t => {
-  const s = src(scratchRepo(t, FILES), mapping(WITH_BLEND));
-  const reply = await find(s, { universe: 'blend', query: '' });
-  assert.deepEqual(paths(reply).sort(), [
-    'Book One/Characters/Mara Vell.md', 'Book One/Characters/Tomas.md', 'Book One/Chapters/Chapter 01.md',
-    'Book One/Chapters/Chapter 02.md', 'Book One/Places/Harbor Town.md',
-    'Second World/Characters/Ilse.md', 'Second World/Chapters/01.md',
-  ]);
-  assert.ok(reply.results.every(r => r.scope === 'canon' && ['harbor', 'second'].includes(r.universe)));
-  assert.deepEqual((await find(s, { universe: 'blend', query: '', scope: 'playground' })).results, []);
-  assert.deepEqual((await find(s, { universe: 'blend', query: 'Ferry' })).results, []);
-});
-
-test('a hybrid gets a source file it can see, and not an excluded or foreign one', async t => {
-  const ref = scratchRepo(t, FILES);
-  const hybrid = src(ref, mapping(WITH_BLEND));
-  const ilse = await get(hybrid, { universe: 'blend', path: 'Second World/Characters/Ilse.md' });
-  assert.equal(ilse.scope, 'canon');
-  assert.ok(ilse.links_in.some(l => l.path === 'Second World/Chapters/01.md'));
-  assert.equal(await get(hybrid, { universe: 'blend', path: 'Book One/Research/Ferry Logs.md' }), null);
-  assert.equal(await get(src(ref), { universe: 'harbor', path: 'Second World/Characters/Ilse.md' }), null);
-});
-
-test('get lists visible links both ways and drops a target another universe cannot see', async t => {
-  const ref = scratchRepo(t, FILES);
-  const harbor = src(ref);
-  const ch1 = await get(harbor, { universe: 'harbor', path: 'Book One/Chapters/Chapter 01.md' });
-  assert.ok(ch1.links_out.some(l => l.path === 'Book One/Characters/Mara Vell.md' && l.line === 2));
-  assert.ok(ch1.links_out.some(l => l.path === 'Book One/Places/Harbor Town.md'));
-  const ch2 = await get(harbor, { universe: 'harbor', path: 'Book One/Chapters/Chapter 02.md' });
-  assert.ok(ch2.links_out.some(l => l.path === 'Book One/Research/Ferry Logs.md'));
-  assert.ok(!ch2.links_out.some(l => l.path === 'Second World/Characters/Ilse.md'));
-  const mara = await get(harbor, { universe: 'harbor', path: 'Book One/Characters/Mara Vell.md' });
-  assert.ok(mara.links_in.some(l => l.path === 'Book One/Chapters/Chapter 01.md'));
-  assert.ok(mara.links_in.some(l => l.path === 'Book One/Playground/What If.md'));
-  assert.ok(mara.links_out.some(l => l.path === 'Book One/Characters/Tomas.md' && l.field === 'relationships'));
-  assert.ok(mara.links_out.some(l => l.path === 'Book One/Chapters/Chapter 01.md' && l.field === 'appears_in'));
-  const blendCh2 = await get(src(ref, mapping(WITH_BLEND)), { universe: 'blend', path: 'Book One/Chapters/Chapter 02.md' });
-  assert.ok(blendCh2.links_out.some(l => l.path === 'Second World/Characters/Ilse.md'));
-});
-
-test('a long list pages by position, never cuts an item, and returns 50 per page', async t => {
-  const files = { ...FILES };
-  for (let i = 1; i <= 120; i++) files[`Book One/Places/Note ${i}.md`] = note('place', `Note ${i}`);
-  const s = src(scratchRepo(t, files));
-  const seen = [];
-  let offset = 0;
-  for (let pages = 0; pages < 10; pages++) {
-    const reply = await find(s, { universe: 'harbor', query: 'Note', offset });
-    assert.ok(JSON.stringify(reply).length <= QUERY_REPLY_CAP);
-    assert.ok(reply.results.length <= LOOKUP_LIMIT);
-    if (pages === 0) assert.equal(reply.results.length, LOOKUP_LIMIT);
-    seen.push(...paths(reply));
-    if (reply.next === null) break;
-    offset = reply.next;
-  }
-  assert.equal(seen.length, 120);
-  assert.equal(new Set(seen).size, 120);
-});
-
-test('a page stays under the reply cap when items are large', async t => {
-  const big = 'x'.repeat(2000);
-  const files = { ...FILES };
-  for (let i = 1; i <= 40; i++) files[`Book One/Places/Big ${i}.md`] = note('place', `Big ${i}`, '', [`appears_in: "${big}"`]);
-  const s = src(scratchRepo(t, files));
-  const first = await find(s, { universe: 'harbor', query: 'Big' });
-  assert.ok(JSON.stringify(first).length <= QUERY_REPLY_CAP);
-  assert.ok(first.results.length > 0 && first.results.length < 40);
-  assert.notEqual(first.next, null);
-  const seen = [];
-  let offset = 0;
-  for (let pages = 0; pages < 10; pages++) {
-    const reply = await find(s, { universe: 'harbor', query: 'Big', offset });
-    assert.ok(JSON.stringify(reply).length <= QUERY_REPLY_CAP);
-    seen.push(...paths(reply));
-    if (reply.next === null) break;
-    offset = reply.next;
-  }
-  assert.equal(new Set(seen).size, 40);
-});
-
-test('a search line too long to fit alone comes back marked, with no excerpt, and the other hits still return', async t => {
-  const huge = 'y'.repeat(QUERY_REPLY_CAP + 1000);
-  const s = src(scratchRepo(t, { ...FILES, 'Book One/Places/Wall.md': note('place', 'Wall', `${huge} ${MARKER}`) }));
-  const reply = await search(s, { universe: 'harbor', text: 'yyyyyyyy' });
-  assert.deepEqual(reply.results, [{ path: 'Book One/Places/Wall.md', line: 5, excerpt: null, excerpt_too_long: true, scope: 'canon' }]);
-  const mixed = await search(s, { universe: 'harbor', text: MARKER.toLowerCase() });
-  assert.ok(mixed.results.some(r => r.excerpt_too_long === true));
-  assert.ok(mixed.results.some(r => typeof r.excerpt === 'string' && !('excerpt_too_long' in r)));
-  assert.ok(JSON.stringify(mixed).length <= QUERY_REPLY_CAP);
-});
-
-test('a find item that cannot fit alone is refused, not cut', async t => {
-  const huge = 'y'.repeat(QUERY_REPLY_CAP + 1000);
-  const s = src(scratchRepo(t, { ...FILES, 'Book One/Places/Wall.md': note('place', 'Wall', '', [`appears_in: "${huge}"`]) }));
-  await assert.rejects(find(s, { universe: 'harbor', query: 'Wall' }), { code: 'query-item-too-large' });
-});
-
-test('get pages its lines, and the next line picks up where the page stopped', async t => {
-  const body = `${Array.from({ length: 500 }, (_, i) => `Line ${i + 1} ${'z'.repeat(120)}`).join('\n')}\n`;
-  const s = src(scratchRepo(t, { ...FILES, 'Book One/Chapters/Long.md': body }));
-  const first = await get(s, { universe: 'harbor', path: 'Book One/Chapters/Long.md' });
-  assert.equal(first.lines[0][0], 1);
-  assert.ok(first.lines.length < 501);
-  assert.notEqual(first.next, null);
-  let from = 1, count = 0;
-  for (let pages = 0; pages < 10; pages++) {
-    const page = await get(s, { universe: 'harbor', path: 'Book One/Chapters/Long.md', from });
-    count += page.lines.length;
-    if (page.next === null) break;
-    from = page.next;
-  }
-  assert.equal(count, 501);
-});
-
-test('get refuses a file whose front matter alone is over the cap, and a line alone is over the cap', async t => {
-  const huge = 'q'.repeat(QUERY_REPLY_CAP + 1000);
-  const s = src(scratchRepo(t, {
-    ...FILES,
-    'Book One/Places/Heavy.md': note('place', 'Heavy', '', [`appears_in: "${huge}"`]),
-    'Book One/Chapters/Wide.md': `${huge}\n`,
-  }));
-  await assert.rejects(get(s, { universe: 'harbor', path: 'Book One/Places/Heavy.md' }), { code: 'query-item-too-large' });
-  await assert.rejects(get(s, { universe: 'harbor', path: 'Book One/Chapters/Wide.md' }), { code: 'query-item-too-large' });
-});
-
-test('get pages the links of a hub note, every page carries the front matter, and the pages add up', async t => {
-  const files = { ...FILES };
-  for (let i = 1; i <= 900; i++) files[`Book One/Chapters/Mention ${i}.md`] = `[[Tomas]] ${'w'.repeat(60)}\n`;
-  const s = src(scratchRepo(t, files));
-  const seen = [];
-  const PAST_END = 1000;
-  let linksFrom = 0, pages = 0, lines = 0, from = 1;
-  for (; pages < 40; pages++) {
-    const page = await get(s, { universe: 'harbor', path: 'Book One/Characters/Tomas.md', from, links_from: linksFrom });
-    assert.ok(JSON.stringify(page).length <= QUERY_REPLY_CAP);
-    assert.equal(page.frontmatter.name, 'Tomas');
-    seen.push(...page.links_in.map(l => l.path));
-    if (from !== PAST_END) lines += page.lines.length;
-    // Once the lines are read, ask past the last one: the page then carries links alone.
-    from = page.next ?? PAST_END;
-    if (page.links_next === null && page.next === null) break;
-    if (page.links_next !== null) linksFrom = page.links_next;
-  }
-  assert.ok(pages > 1, 'the hub needed more than one page');
-  assert.ok(pages < 40);
-  assert.equal(seen.filter(p => p.startsWith('Book One/Chapters/Mention ')).length, 900);
-  assert.equal(new Set(seen).size, seen.length, 'no link comes back twice');
-  assert.equal(lines, 6, 'the five lines of the note and the empty one after its last newline');
-  const tail = await get(s, { universe: 'harbor', path: 'Book One/Characters/Tomas.md', from: PAST_END });
-  assert.deepEqual(tail.lines, []);
-  assert.equal(tail.next, null);
-});
-
-test('get rejects a bad links_from', async t => {
-  const s = src(scratchRepo(t, FILES));
-  await assert.rejects(get(s, { universe: 'harbor', path: 'Book One/Characters/Tomas.md', links_from: -1 }), { code: 'query-argument-invalid' });
-  const past = await get(s, { universe: 'harbor', path: 'Book One/Characters/Tomas.md', links_from: 99 });
-  assert.deepEqual([past.links_out, past.links_in, past.links_next], [[], [], null]);
-});
-
-test('search returns scoped line hits, case-insensitively, and refuses empty text', async t => {
-  const s = src(scratchRepo(t, FILES));
-  const reply = await search(s, { universe: 'harbor', text: 'marker' });
-  assert.ok(reply.results.length > 0);
-  assert.ok(reply.results.every(r => r.scope === 'canon' && r.path.startsWith('Book One/') && Number.isInteger(r.line)));
-  assert.ok(reply.results.some(r => r.path === 'Book One/Chapters/Chapter 01.md' && r.line === 2));
-  await assert.rejects(search(s, { universe: 'harbor', text: '' }), { code: 'query-argument-invalid' });
-});
-
-test('a manuscript call returns one chapter, at most 400 lines, and names its next line', async t => {
-  const long = `${Array.from({ length: 900 }, (_, i) => `Scene ${i + 1}`).join('\n')}\n`;
-  const s = src(scratchRepo(t, { ...FILES, 'Book One/Chapters/Long Chapter.md': long }));
-  const first = await manuscript(s, { universe: 'harbor', book: 'Book One', chapter: 'Long Chapter' });
-  assert.equal(first.lines.length, MANUSCRIPT_LINES);
-  assert.equal(first.next, MANUSCRIPT_LINES + 1);
-  const second = await manuscript(s, { universe: 'harbor', book: 'Book One', chapter: 'Long Chapter', from: first.next });
-  assert.equal(second.lines[0][0], MANUSCRIPT_LINES + 1);
-});
-
-test('a manuscript call without a chapter returns the first chapter in path order and names the next', async t => {
-  const s = src(scratchRepo(t, FILES));
-  const first = await manuscript(s, { universe: 'harbor', book: 'Book One' });
-  assert.equal(first.path, 'Book One/Chapters/Chapter 01.md');
-  assert.equal(first.next_chapter, 'Chapter 02');
-  const last = await manuscript(s, { universe: 'harbor', book: 'Book One', chapter: 'Chapter 02' });
-  assert.equal(last.path, 'Book One/Chapters/Chapter 02.md');
-  assert.equal(last.next_chapter, null);
-  assert.equal(await manuscript(s, { universe: 'harbor', book: 'Book One', chapter: 'Nope' }), null);
-});
-
-test('a chapter name that matches two visible files is refused', async t => {
-  const s = src(scratchRepo(t, { ...FILES, 'Book One/Chapters/Part/Chapter 01.md': 'Again.\n' }));
-  await assert.rejects(manuscript(s, { universe: 'harbor', book: 'Book One', chapter: 'Chapter 01' }), { code: 'query-chapter-ambiguous' });
-});
-
-test('a hybrid reads a source chapter through its declared sources only', async t => {
-  const ref = scratchRepo(t, FILES);
-  const hybrid = await manuscript(src(ref, mapping(WITH_BLEND)), { universe: 'blend', book: 'Second World', chapter: '01' });
-  assert.equal(hybrid.path, 'Second World/Chapters/01.md');
-  assert.equal(hybrid.scope, 'canon');
-  assert.equal(await manuscript(src(ref), { universe: 'harbor', book: 'Second World', chapter: '01' }), null);
-});
-
-test('universe info reports a hybrid sources, constraints and notes, and refuses an unknown universe', async t => {
-  const s = src(scratchRepo(t, FILES), mapping(WITH_BLEND));
-  const blend = await universeInfo(s, { universe: 'blend' });
-  assert.equal(blend.kind, 'hybrid');
-  assert.deepEqual(blend.sources, ['harbor', 'second']);
-  assert.deepEqual(blend.constraints, [EXCLUSION]);
-  assert.equal(blend.notes, 'made-up hybrid');
-  const harbor = await universeInfo(s, { universe: 'harbor' });
-  assert.equal(harbor.kind, 'universe');
-  assert.equal(harbor.sources, undefined);
-  await assert.rejects(universeInfo(s, { universe: 'ghost' }), { code: 'query-universe-unknown' });
-});
-
-test('an exclusion hides what it names from a hybrid and from nothing else', async t => {
-  const ref = scratchRepo(t, FILES);
-  const hybrid = src(ref, mapping(WITH_BLEND));
-  const seen = paths(await find(hybrid, { universe: 'blend', query: '' }));
-  for (const path of EXCLUDED_PATHS) assert.ok(!seen.includes(path), `${path} stays hidden`);
-  const own = paths(await find(src(ref), { universe: 'harbor', query: '' }));
-  for (const path of EXCLUDED_PATHS) assert.ok(own.includes(path), `${path} stays visible to its own universe`);
-});
-
-test('PRD 1.14: a lookup that names a book leaves book-null files out', async t => {
-  const s = src(scratchRepo(t, { ...FILES, ...LEVEL_FILES }), mapping(WITH_LEVELS));
-  const all = paths(await find(s, { universe: 'harbor', query: '', scope: 'playground' }));
-  assert.deepEqual(all.sort(), ['Book One/Playground/What If.md', 'Notes/Harbor/Chapters/Idea Chapter.md', 'Notes/Harbor/Scraps.md']);
-  const booked = await find(s, { universe: 'harbor', query: '', scope: 'playground', book: 'Book One' });
-  assert.deepEqual(paths(booked), ['Book One/Playground/What If.md']);
-  assert.ok(booked.results.every(r => r.book === 'Book One'));
-  const hits = (await search(s, { universe: 'harbor', text: 'unbooked', scope: 'playground' })).results;
-  assert.deepEqual(hits.map(r => r.path), ['Notes/Harbor/Chapters/Idea Chapter.md']);
-  assert.deepEqual((await search(s, { universe: 'harbor', text: 'unbooked', scope: 'playground', book: 'Book One' })).results, []);
-});
-
-test('PRD 1.14: library_manuscript never reads a book-null file', async t => {
-  const s = src(scratchRepo(t, { ...FILES, ...LEVEL_FILES }), mapping(WITH_LEVELS));
-  // The unbooked file sits under a manuscript folder, so it has type manuscript and book null.
-  const listed = await find(s, { universe: 'harbor', query: 'Idea', scope: 'playground' });
-  assert.deepEqual(listed.results.map(r => [r.path, r.type, r.book]), [['Notes/Harbor/Chapters/Idea Chapter.md', 'manuscript', null]]);
-  assert.equal(await manuscript(s, { universe: 'harbor', book: 'Book One', scope: 'playground', chapter: 'Idea Chapter' }), null);
-  assert.equal(await manuscript(s, { universe: 'harbor', book: 'Book One', scope: 'playground' }), null);
-  assert.equal(await manuscript(s, { universe: 'harbor', book: 'Notes', scope: 'playground', chapter: 'Idea Chapter' }), null);
-});
-
-test('PRD 1.14: a draft universe has no canon, so its lookups return files only with scope playground', async t => {
-  const s = src(scratchRepo(t, { ...FILES, ...LEVEL_FILES }), mapping(WITH_LEVELS));
-  assert.deepEqual((await find(s, { universe: 'idea', query: '' })).results, []);
-  assert.deepEqual((await search(s, { universe: 'idea', text: MARKER })).results, []);
-  const found = await find(s, { universe: 'idea', query: '', scope: 'playground' });
-  assert.deepEqual(paths(found).sort(), ['Drafts/New World/Characters/Rin.md', 'Drafts/New World/Summary.md']);
-  assert.ok(found.results.every(r => r.scope === 'playground' && r.universe === 'idea' && r.book === null));
-  const hits = (await search(s, { universe: 'idea', text: 'draft', scope: 'playground' })).results;
-  assert.equal(hits.length, 2);
-  const rin = await get(s, { universe: 'idea', path: 'Drafts/New World/Characters/Rin.md', scope: 'playground' });
-  assert.equal(rin.scope, 'playground');
-  assert.equal(await get(s, { universe: 'harbor', path: 'Drafts/New World/Characters/Rin.md', scope: 'playground' }), null);
-});
-
-test('PRD 1.14: library_universe on a draft returns its kind, name and prefixes', async t => {
-  const s = src(scratchRepo(t, { ...FILES, ...LEVEL_FILES }), mapping(WITH_LEVELS));
-  const draft = await universeInfo(s, { universe: 'idea' });
-  assert.equal(draft.kind, 'draft');
-  assert.equal(draft.name, 'New World');
-  assert.deepEqual(draft.playground, ['Drafts/New World/']);
-  assert.deepEqual(draft.books, []);
-  assert.equal(draft.sources, undefined);
-});
-
-test('a hybrid gets a source playground file as null, while the source gets it with scope playground', async t => {
-  const ref = scratchRepo(t, FILES);
-  const path = 'Book One/Playground/What If.md';
-  assert.equal(await get(src(ref, mapping(WITH_BLEND)), { universe: 'blend', path, scope: 'playground' }), null);
-  const own = await get(src(ref), { universe: 'harbor', path, scope: 'playground' });
-  assert.equal(own.scope, 'playground');
-});
-
-// mos-1330 item3: the new get contract defaults to canon even for an explicit playground path.
-test('C2-05c get without scope returns null for a playground path', async t => {
-  const s = src(scratchRepo(t, FILES));
-  assert.equal(await get(s, { universe: 'harbor', path: 'Book One/Playground/What If.md' }), null);
-});
-
-// Row284: scope is explicit for get as well as lists; blob and lines share a served snapshot.
-test('C2-05c supporting find/search/get are opt-in at book, universe and draft level', async t => {
-  const s = src(scratchRepo(t, SUPPORT_FILES), mapping(withSupporting));
-  const expected = ['Book One/Support/Notes/Helper.md', 'Notes/HarborSupport/Loose.md'];
-  assert.deepEqual(paths(await find(s, { universe: 'harbor', query: '', scope: 'supporting' })), expected);
-  assert.deepEqual((await search(s, { universe: 'harbor', text: 'Scope fixture', scope: 'supporting' })).results.map(x => x.path), expected);
-  assert.deepEqual(paths(await find(s, { universe: 'harbor', query: '' })), ['Book One/Characters/Canon.md']);
-  assert.deepEqual((await search(s, { universe: 'harbor', text: 'Scope fixture' })).results.map(x => x.path), ['Book One/Characters/Canon.md']);
-  for (const path of expected) {
-    assert.equal(await get(s, { universe: 'harbor', path }), null);
-    assert.equal(await get(s, { universe: 'harbor', path, scope: 'playground' }), null);
-    assert.equal((await get(s, { universe: 'harbor', path, scope: 'supporting' })).scope, 'supporting');
-    assert.equal(await get(s, { universe: 'second', path, scope: 'supporting' }), null);
-  }
-  const draftPath = 'Drafts/Idea/Support/Seed.md';
-  assert.deepEqual(paths(await find(s, { universe: 'idea', query: '', scope: 'supporting' })), [draftPath]);
-  assert.equal((await get(s, { universe: 'idea', path: draftPath, scope: 'supporting' })).scope, 'supporting');
-  assert.equal(await get(s, { universe: 'idea', path: draftPath }), null);
-  assert.equal((await find(s, { universe: 'harbor', query: '', book: 'Book One', scope: 'supporting' })).results.length, 1);
-});
-
-test('C2-05c an absent supporting prefix returns nothing without refusal', async t => {
-  const s = src(scratchRepo(t, SUPPORT_FILES));
-  assert.deepEqual((await find(s, { universe: 'harbor', query: '', scope: 'supporting' })).results, []);
-  assert.deepEqual((await search(s, { universe: 'harbor', text: 'Scope fixture', scope: 'supporting' })).results, []);
-  assert.equal(await get(s, { universe: 'harbor', path: 'Book One/Characters/Canon.md', scope: 'supporting' }), null);
-  assert.equal(await get(s, { universe: 'harbor', path: 'Book One/Support/Notes/Helper.md', scope: 'supporting' }), null);
-});
-
-test('C2-05c each get blob equals its served tree object, even after source HEAD advances', async t => {
-  const ref = scratchRepo(t, SUPPORT_FILES), s = src(ref, mapping(withSupporting));
-  const canon = 'Book One/Characters/Canon.md';
-  const priorBlob = git(ref.repo, 'rev-parse', `${ref.commit}:${canon}`);
-  writeFileSync(join(ref.repo, canon), note('character', 'Canon changed', 'New HEAD must not be read.'));
-  git(ref.repo, 'add', '-A'); git(ref.repo, 'commit', '-qm', 'advance head fixture');
-  assert.notEqual(git(ref.repo, 'rev-parse', `HEAD:${canon}`), priorBlob);
-  for (const [scope, path] of [['canon', canon], ['playground', 'Book One/Playground/Plan.md'], ['supporting', 'Book One/Support/Notes/Helper.md']]) {
-    const result = await get(s, { universe: 'harbor', path, scope });
-    assert.equal(result.commit, ref.commit);
-    assert.equal(result.blob, git(ref.repo, 'rev-parse', `${ref.commit}:${path}`));
-    assert.ok(!JSON.stringify(result.lines).includes('New HEAD must not be read'));
-  }
-});
-
-test('C2-05c full outgoing and incoming links stay in scope order across pages without losing cross-scope links', async t => {
-  const files = {}, groups = { supporting: [], playground: [], canon: [] };
-  for (const [scope, folder] of [['canon', 'Book One/Characters'], ['playground', 'Book One/Playground'], ['supporting', 'Book One/Support']]) {
-    for (let n = 0; n < 100; n++) {
-      const path = `${folder}/${scope}-${String(n).padStart(3, '0')}-${'x'.repeat(80)}.md`;
-      groups[scope].push(path);
-      files[path] = `[[Book One/Characters/Hub]]\n`;
-    }
-  }
-  const all = [...groups.canon, ...groups.playground, ...groups.supporting];
-  files['Book One/Characters/Hub.md'] = all.map(path => `[[${path.slice(0, -3)}]]`).join('\n');
-  // Other-universe links are never returned, regardless of rank.
-  files['Second World/Other.md'] = '[[Book One/Characters/Hub]]\n';
-  const s = src(scratchRepo(t, files), mapping(withSupporting));
-  const outs = [], ins = [];
-  let offset = 0, pages = 0;
-  for (; pages < 20; pages++) {
-    const page = await get(s, { universe: 'harbor', path: 'Book One/Characters/Hub.md', from: 999_999, links_from: offset });
-    assert.ok(JSON.stringify(page).length <= QUERY_REPLY_CAP);
-    outs.push(...page.links_out.map(x => x.path)); ins.push(...page.links_in.map(x => x.path));
-    if (page.links_next === null) break;
-    offset = page.links_next;
-  }
-  const expected = [...groups.supporting, ...groups.playground, ...groups.canon];
-  assert.ok(pages > 0 && pages < 20, 'links occupy multiple bounded pages');
-  assert.deepEqual(outs, expected);
-  assert.deepEqual(ins, expected);
-  assert.equal(new Set(outs).size, 300);
-  assert.equal(new Set(ins).size, 300);
-});
-
-test('C2-05c manuscript still refuses supporting rather than silently widening its scope', async t => {
-  const s = src(scratchRepo(t, SUPPORT_FILES), mapping(withSupporting));
-  await assert.rejects(manuscript(s, { universe: 'harbor', book: 'Book One', scope: 'supporting' }), { code: 'query-argument-invalid' });
-});
-
-test('C2-05c scope expansion keeps hybrid sources canon-only and refuses all/array scopes', async t => {
-  const s = src(scratchRepo(t, SUPPORT_FILES), mapping(entry => withSupporting(WITH_BLEND(entry))));
-  assert.deepEqual((await find(s, { universe: 'blend', query: '', scope: 'supporting' })).results, []);
-  assert.equal(await get(s, { universe: 'blend', path: 'Book One/Support/Notes/Helper.md', scope: 'supporting' }), null);
-  assert.equal((await get(s, { universe: 'blend', path: 'Book One/Characters/Canon.md' })).scope, 'canon');
-  for (const scope of ['all', ['canon', 'supporting']])
-    await assert.rejects(get(s, { universe: 'harbor', path: 'Book One/Characters/Canon.md', scope }), { code: 'query-argument-invalid' });
-});
@@ -53,44 +53,3 @@ test('C2-01c: a canon file linking into a draft gives R6, and into its own unive
    assert.deepEqual(codes(path), [], path);
  }
 });
-
-// Supporting prefixes at three levels (C2-01d). Harbor's book-level prefix sits in both lists, and a
-// second book-level prefix is supporting only.
-const supporting = () => mapping(e => {
-  e.universes.harbor.playground = ['Book One/Playground/', 'Book One/Sketches/'];
-  e.universes.harbor.supporting = ['Book One/Playground/', 'Book One/Notes/', 'Harbor Notes/'];
-  e.universes.idea = { kind: 'draft', name: 'New World', playground: ['Drafts/New World/'], supporting: ['Drafts/New World Notes/'] };
-  return e;
-});
-
-test('C2-01d: each supporting level gives its universe, and its book or null', () => {
-  const m = supporting();
-  assert.deepEqual(classify(m, 'Book One/Notes/Characters/Mara.md'),
-    { scope: 'supporting', universe: 'harbor', book: 'Book One', type: 'character', folder: 'Characters' });
-  assert.deepEqual(classify(m, 'Harbor Notes/Places/Island.md'),
-    { scope: 'supporting', universe: 'harbor', book: null, type: 'place', folder: 'Places' });
-  assert.deepEqual(classify(m, 'Harbor Notes/Loose.md'), { scope: 'supporting', universe: 'harbor', book: null, type: null, folder: null });
-  assert.deepEqual(classify(m, 'Drafts/New World Notes/Chapters/Open.md'),
-    { scope: 'supporting', universe: 'idea', book: null, type: 'manuscript', folder: 'Chapters' });
-  assert.deepEqual(classify(m, 'Drafts/New World/Ana.md'), { scope: 'playground', universe: 'idea', book: null, type: null, folder: null });
-  assert.deepEqual(classify(m, 'Book One/Places/Dock.md'), { scope: 'canon', universe: 'harbor', book: 'Book One', type: 'place', folder: 'Places' });
-});
-
-test('C2-01d: supporting comes before playground; a folder in both lists is supporting, one in the playground only stays playground', () => {
-  const m = supporting();
-  assert.deepEqual(classify(m, 'Book One/Playground/What If.md'),
-    { scope: 'supporting', universe: 'harbor', book: 'Book One', type: null, folder: null });
-  assert.deepEqual(classify(m, 'Book One/Sketches/Research/Tides.md'),
-    { scope: 'playground', universe: 'harbor', book: 'Book One', type: 'research', folder: 'Research' });
-  // A playground may hold a supporting prefix of its own entry: the inner folder is supporting.
-  const nested = mapping(e => { e.universes.harbor.supporting = ['Book One/Playground/Notes/']; return e; });
-  assert.equal(classify(nested, 'Book One/Playground/Notes/A.md').scope, 'supporting');
-  assert.equal(classify(nested, 'Book One/Playground/A.md').scope, 'playground');
-});
-
-test('C2-01d: only .md files are supporting; a .canvas or .base under a supporting prefix is unmapped', () => {
-  const m = supporting();
-  for (const path of ['Book One/Notes/Board.canvas', 'Harbor Notes/Table.base', 'Drafts/New World Notes/Map.canvas',
-    'Harbor Notes/cover.png', 'Harbor Notesx/a.md'])
-    assert.deepEqual(classify(m, path), { scope: 'unmapped' }, path);
-});
@@ -1,91 +0,0 @@
-import test from 'node:test';
-import assert from 'node:assert/strict';
-import { LibraryError, supportingPath } from '../src/index.mjs';
-import { mapping } from './helpers.mjs';
-
-// C2-01d (M12): the path checks an agent write passes. The tree is a listTree array built by hand,
-// with a symlink, a gitlink, case twins and an NFC name, so no git is needed.
-const m = mapping(e => {
-  e.universes.harbor.playground = ['Book One/Playground/', 'Book One/Sketches/'];
-  e.universes.harbor.supporting = ['Book One/Playground/', 'Book One/Notes/', 'Harbor Notes/'];
-  e.universes.second.supporting = ['Second Notes/'];
-  e.universes.idea = { kind: 'draft', name: 'New World', playground: ['Drafts/New World/'], supporting: ['Drafts/New World Notes/'] };
-  return e;
-});
-const blob = (path, mode = '100644') => ({ mode, type: mode === '160000' ? 'commit' : 'blob', oid: '0'.repeat(40), size: 1, path });
-const tree = [
-  blob('Book One/Characters/Mara Vell.md'),
-  blob('Book One/Notes/Existing.md'),
-  blob('Book One/Notes/Linked', '120000'),
-  blob('Book One/Notes/Vendor', '160000'),
-  blob('Book One/Notes/Pointer.md', '120000'),
-  blob('Book One/Notes/Case/Twin.md'),
-  blob('Book One/Notes/Café.md'),
-  blob('Harbor Notes/Places/Island.md'),
-];
-const refuses = (universe, path, pattern) => assert.throws(() => supportingPath(m, universe, path, tree),
-  e => e instanceof LibraryError && e.code === 'library-write-story-path' && pattern.test(e.message), JSON.stringify(path));
-
-test('C2-01d: a path passes at book level, universe level, in a draft and in a folder in both lists', () => {
-  for (const [universe, path] of [['harbor', 'Book One/Notes/Characters/New.md'], ['harbor', 'Book One/Notes/Existing.md'],
-    ['harbor', 'Harbor Notes/Places/Island.md'], ['harbor', 'Harbor Notes/Loose.md'], ['idea', 'Drafts/New World Notes/Ana.md'],
-    ['harbor', 'Book One/Playground/What If.md'], ['second', 'Second Notes/A.md'], ['harbor', 'Book One/Notes/Café.md']])
-    assert.equal(supportingPath(m, universe, path, tree), path);
-  assert.equal(supportingPath(m, 'harbor', 'Book One/Notes/x.md', []), 'Book One/Notes/x.md');
-});
-
-test('C2-01d: a path of exactly 1024 bytes passes, and 1025 bytes made of multi-byte characters refuses', () => {
-  const prefix = 'Harbor Notes/';
-  const exact = `${prefix}${'a'.repeat(1024 - prefix.length - 3)}.md`;
-  assert.equal(Buffer.byteLength(exact), 1024);
-  assert.equal(supportingPath(m, 'harbor', exact, tree), exact);
-  // é is two bytes: 1025 bytes but far fewer characters.
-  const name = 'é'.repeat((1025 - prefix.length - 3 - 1) / 2);
-  const long = `${prefix}${name}a.md`;
-  assert.equal(Buffer.byteLength(long), 1025);
-  assert.ok(long.length < 1024);
-  refuses('harbor', long, /is longer than 1024 bytes/);
-});
-
-test('C2-01d: a path outside the universe\'s supporting folders refuses', () => {
-  const outside = /is not under a supporting folder of universe/;
-  for (const path of ['Inbox Note.md', 'Book One/Notes/Board.canvas', 'Book One/Notes/Table.base', 'Book One/Notes/cover.png',
-    'Book One/Characters/Mara Vell.md', 'Book One/Sketches/Idea.md', 'Drafts/New World/Ana.md', 'Second Notes/A.md', 'Book One/Notes.md'])
-    refuses('harbor', path, outside);
-  refuses('idea', 'Book One/Notes/A.md', /universe "idea"/);
-  refuses('nowhere', 'Book One/Notes/A.md', /universe "nowhere"/);
-});
-
-test('C2-01d: malformed paths refuse by class, in order', () => {
-  refuses('harbor', '/Book One/Notes/A.md', /"\/Book One\/Notes\/A.md" is absolute/);
-  for (const path of ['Book One/Notes/../Notes/A.md', 'Book One/Notes/./A.md', 'Book One//Notes/A.md', 'Book One/Notes/A/', 'Book One/Notes/..'])
-    refuses('harbor', path, /has an empty, \. or \.\. segment/);
-  refuses('harbor', 'Book One/Notes/A\\B.md', /holds a backslash/);
-  for (const c of ['\u0000', '\u0001', '\n', '\u001f', '\u007f', '\u0085', '\u009f'])
-    assert.throws(() => supportingPath(m, 'harbor', `Book One/Notes/A${c}.md`, tree),
-      e => e.code === 'library-write-story-path' && e.message === 'library-write-story-path: the path holds a control character');
-  for (const path of [7, null, undefined, 1n, ['Book One/Notes/A.md']]) refuses('harbor', path, /the path must be a string/);
-  // A backslash in a path that is also absolute names the backslash: the order is fixed.
-  refuses('harbor', '/a\\b.md', /holds a backslash/);
-  assert.throws(() => supportingPath(m, 'harbor', 'Book One/Notes/A.md', { 'Book One/Notes/A.md': '100644' }), TypeError);
-  assert.throws(() => supportingPath(m, 'harbor', 'Book One/Notes/A.md'), TypeError);
-});
-
-test('C2-01d: a symlink or gitlink on the way, or at the path itself, refuses', () => {
-  refuses('harbor', 'Book One/Notes/Linked/A.md', /goes through the symlink or gitlink "Book One\/Notes\/Linked"/);
-  refuses('harbor', 'Book One/Notes/Vendor/Deep/A.md', /goes through the symlink or gitlink "Book One\/Notes\/Vendor"/);
-  refuses('harbor', 'Book One/Notes/Pointer.md', /goes through the symlink or gitlink "Book One\/Notes\/Pointer.md"/);
-});
-
-test('C2-01d: a name that differs from a tree name only in case or Unicode form refuses, at the file or any folder', () => {
-  refuses('harbor', 'Book One/Notes/existing.md', /differs only in case or Unicode form from "Book One\/Notes\/Existing.md"/);
-  refuses('harbor', 'Book One/Notes/case/New.md', /differs only in case or Unicode form from "Book One\/Notes\/Case"/);
-  refuses('harbor', 'Book One/Notes/CASE/Twin.md', /from "Book One\/Notes\/Case"/);
-  refuses('harbor', 'Harbor notes/A.md', /is not under a supporting folder/);
-  // NFD e + combining acute against the NFC name in the tree: one file on APFS.
-  refuses('harbor', 'Book One/Notes/Café.md', /differs only in case or Unicode form from "Book One\/Notes\/Café.md"/);
-  // A tree that already holds case twins refuses a write to either (R7).
-  const twins = [...tree, blob('Book One/Notes/existing.md')];
-  for (const path of ['Book One/Notes/Existing.md', 'Book One/Notes/existing.md'])
-    assert.throws(() => supportingPath(m, 'harbor', path, twins), e => e.code === 'library-write-story-path' && /differs only in case/.test(e.message));
-});
@@ -1,6 +1,6 @@
 import test from 'node:test';
 import assert from 'node:assert/strict';
-import { readFileSync, writeFileSync } from 'node:fs';
+import { writeFileSync } from 'node:fs';
 import { join } from 'node:path';
 import { spawnSync } from 'node:child_process';
 import { fileURLToPath } from 'node:url';
@@ -70,23 +70,12 @@ test('with --mapping the survey adds scope, resolver step and problem counts', a
  assert.equal(out.code, 0, out.stderr);
  const tail = out.stdout.trimEnd().split('\n').slice(-3);
  assert.deepEqual(tail, [
-    'scopes canon 5, playground 1, supporting 0, unmapped 3; indexed 6',
+    'scopes canon 5, playground 1, unmapped 3; indexed 6',
    'resolved root 2, vault-prefix 1, relative 2, shortest 3, unresolved 0',
    'problems R1 0, R2 3, R3 0, R4 0, R5 0, R6 0, R7 0']);
  for (const s of NEVER) assert.ok(!out.stdout.includes(s), s);
 });

-test('C2-01d: with --mapping the survey counts supporting files', async t => {
-  const r = repo(t);
-  const entry = JSON.parse(readFileSync(join(FIXTURES, 'mapping.json'), 'utf8'));
-  entry.universes.harbor.supporting = ['Book One/Places/'];
-  const file = join(r.root, 'supporting.json');
-  writeFileSync(file, JSON.stringify(entry));
-  const out = await run(['survey', r.repo, '--mapping', file]);
-  assert.equal(out.code, 0, out.stderr);
-  assert.match(out.stdout, /^scopes canon 4, playground 1, supporting 1, unmapped 3; indexed 6$/m);
-});
-
 test('survey exit codes: usage 4, bad mapping 3, unreadable repo 2', async t => {
  const r = repo(t);
  for (const args of [[], ['scan', r.repo], ['survey'], ['survey', r.repo, '--mapping'], ['survey', r.repo, '--other'], ['survey', r.repo, r.repo]])
Author	SHA1	Message	Date
jason.woltje	7a141269c1	row 298 (#1804 ): UNTESTED handoff to Boyd (mos-1502). launch.grantScope shape, fallback and match (vocabulary.mjs), the one writer (instance-settings grantScope), broker grants.scope/grants.scope.set gated by #human alone, in-scope close via 'scope' with grant.scope.used, scope-changed recheck, cli grants scope\|scope set, business and bus tests. No node run; project-runtime.test.mjs import pin not yet updated; docs and BUILD.md not updated	2026-10-23 14:11:35 -05:00
jason.woltje	2b6f889f4d	row 298 (#1804 ): BUILD.md design D1-D6 and open questions Q1-Q6 for Sage; no code yet	2026-10-23 13:57:04 -05:00