docs(v574): record static approval and trace evidence requirements

docs(v574): audit fixture comparisons and plan trace proof
test(git): disable detached fixture maintenance per mos-1369
2026-10-22 20:25:05 -05:00 · 2026-10-22 20:19:24 -05:00 · 2026-10-22 20:19:06 -05:00 · 2026-10-22 18:55:11 -05:00 · 2026-10-22 18:54:51 -05:00 · 2026-10-22 18:54:51 -05:00
22 changed files with 3977 additions and 690 deletions
@@ -5344,3 +5344,25 @@ Gander: after Duckworth-0100 design approval with C1-C5, prepared the two host-s
 2026-10-22T18:11:57Z | Sage | Row 275 (#1780, Morgana, Duckworth) LANDED 3410df7c3. Before: refactor at 48e450ce8; viewers had no verb list of their own and board reads were not refused to users. After: a fast-forward of 3 commits; manifest 39847b15 (4 paths) blobs match; gate 17:52:12Z-18:05:00Z green (whole files 7/22/6, bus 834, cli 861, harness 151, business 231, seat 167, 10 scripts with 3 named skips), M6 and M10 killed; Duckworth APPROVE rev 3260 (comment 30717); note and done by sage-2897; #1780 comment 30728 and closed. N1 (board refusal test as a loop over BOARD_VERBS) is non-blocking.

 2026-10-22 18:11:58 UTC | Gander row276 #1781 prepared, gate pending | Before: row253 left5legacy Case1 AS_USER calls unsupervised across sudo pty sessions. After: candidate uses its unchanged supervisor with per-call inner/outer budgets, separate streams, strict display-only failure trailer, fake-only paired process-model cases and15unique mutants. Duckworth0182 B1 corrected the plan before product code;0183 cleared build. Parse-only Bash checks pass; no Node, behavioral test, host, unit or config action. Runtime gate and publication await Sage.
+
+2026-10-22T22:51:32Z | Megavolt | Row 207 (193c, #1705): rebased onto 01983cd3f as 712f79c0a; gate green under sage-3041 (access.test 31/31, M1-M8 killed on named tests, cli 894/894, ten scripts under mos-1275 limits). Correction: the first run's kill check grepped TAP "not ok" against node's spec output and was stopped and rerun. Runs note in 9bb406c6c.
+
+2026-10-22T22:51:32Z | Sage | Row 207 (#1705, Megavolt, Duckworth) LANDED c4f77373f. Before: refactor at f0e3dcdf4; mosaic access had no user verbs. After: fast-forward of 4 commits, a cherry-pick of the gated 01983cd3f..9bb406c6c (range-diff 4/4 equal, patch-ids equal, the 4 manifest blobs equal; the base moved only by the #1797 brief, which no test reads; no open branch touches the manifest). Duckworth APPROVE c30849 rev 3356; done rev after the note. N1 (any-business refusal untested) DEFERRED. No live change. Correction: my first 207 review request ran under timeout 120, which killed it while it wrote the outcome; the comment (c30841) had posted, so I removed the dead lock and resolved it at rev 3350.
+
+2026-10-22T23:03:39Z | Gyro Q195 O2 rewrite, #1752 / Vikunja #448, mos-1356 | Before: landed O3 design 95e3f7166/blob 4cb59999. After: Q231/Q233 full WordCraft O2 design on gyro/editor-o2 from refactor c4f77373f; canonical git DOCX, original Markdown/wiki preservation, human cadence default 0 with instant accepted-save commits, full rich-feature first slice. Ten briefs include independent source/dependency security clearance before any build queue entry, exact editor-only CSP approval gate, restricted source/build/bridge, separate reviewed DOCX citation gate and flags-only agent access. Existing Case 2 semantics unchanged; any integration requirement change goes through Mos to Jason. Static checks: ten briefs/seven fields, independent reviewers, unique anchors, current source/base/blob pins, docs scope and append-only logs pass. No builds, browser/worker runs, code, queue or live changes. Fenton review pending; CSP and implementation gates remain closed.
+
+2026-10-22T23:03:53Z | Gyro Q195 O2 push guard | CI queue guard identity gyro / purpose push returned exit 0, documented degraded-pass: CANNOT_ASSERT credential-unresolvable. Audit: /mnt/storage/scratch/gyro-q195-ci-queue-audit.jsonl. No credential fallback or CI-green claim.
+
+2026-10-22T23:09:38Z | Gyro Q195 O2 fenton-0006 fixes | Before: e012bab0b left stale-source ambiguity, incomplete migration/shipping ownership, undefined typing transactions and an unmeasured CSP gate. After: D12 explicitly routes superseded-source/C2 reply notices to Mos/Jason and refuses adoption before W4b/notice path; Q2 remains open. F2-F6 add schema-edge placeholders and restore-accounting files, shipped runtime data/writing closure with no sandbox store mount, per-chapter DOCX and 2s-pause/15s-span save groups, volume/latency/growth gates, split-run clickable wikilinks and historical Obsidian graph warning, and S0 isolated existing-artifact CSP measurement before exact-header approval. Static ten-brief/ownership/settings/checklist checks pass. No build/browser run, product/queue/live change. Independent re-check pending.
+
+2026-10-22T23:09:50Z | Gyro fenton-0006 push guard | identity gyro, purpose push, exit 0 documented degraded-pass CANNOT_ASSERT credential-unresolvable; audit gyro-q195-ci-queue-audit.jsonl. No fallback credentials or CI-green claim.
+
+2026-10-22T23:10:14Z | Gyro mos-1358 ruling recorded | Q36 / Vikunja 562 keeps C2 superseded notices OPEN with Jason. Markdown adoption refusal until W4b PASS is now a separate settled Mos build-order ruling, not a Jason question. D12 and Q2 distinguish them; no notice build authorized.
+
+2026-10-22T23:13:27Z | Gyro Q195 O2 fenton-0007 F7/F8 | Named human-only editor.saveGroupPauseMs=2000 and editor.saveGroupMaxMs=15000 with integer/range/cross-field validation and W3a UI/CLI refusal tests. W3b owns production adoption refusal until W4b; isolated fixture conversion remains testable without request-flag bypass. W4b owns adoption module/API tests and reviewed lifting only with committed-reader/citation readiness and, if Q36 approves, the separate notice row PASS. Q36 unresolved stays closed. Static ten-brief, setting-key/bounds, refusal/lift ownership and two-question checks pass. Docs only; no build, browser/worker run, product/queue/live change. Fenton checks F7/F8 on next push.
+
+2026-10-22T23:13:48Z | Gyro mos-1359 / r3 push guard | D13 records save-group timing as Mos's accepted reading of Q226 F41, not Jason's ruling; both defaults remain human-only settings. Push guard identity gyro/purpose push: exit 0 documented degraded-pass, CANNOT_ASSERT credential-unresolvable; audit gyro-q195-ci-queue-audit.jsonl, no credential fallback or CI-green claim.
+
+2026-10-22T23:23:42Z | Rocko, W4 #1799 | Before, D24-D26 had no separate exact DOCX citation/access contract. After, 15e91538f proposed a versioned schema, parser/story/view/refusal rules, live authorization/sharing and generic/git/session bypass closure, compatibility gates and 22 acceptance rows. Two JSON examples parse, diff check clean; no code or implementation acceptance. Megavolt review pending.
+
+2026-10-22T23:55:11Z | Sage, W4 #1799 docs landing | Megavolt reviewed four rounds (CHANGES 15e91538f, 019a0ea5b, 54246cb32; APPROVE 994c3f7fb, #1799 c30868/c30870/c30876/c30884). Landed here as cherry-picks: docs/plans/2026-10-22_q195-docx-citations.md blob 2af460ab7 and docs/reviews/2026-10-22_q195-docx-citations.md blob bedde1716, both new files. 32 acceptance rows go to W4b; R4-N1 (re-migration after a pre-W4b restore keeps the rotated fence and needs owner confirmation) goes into W4b's brief and A32. W4 is design-approved only: its gate still needs Sage's W4b implementation brief, which waits for S0 (#1798) PASS. Q36 open, adoption closed. Docs only, no test reads these files.
@@ -0,0 +1,68 @@
+# Vikunja574: deterministic fixture Git before/after comparisons
+
+Owner Gander, gate Sage. mos-1369 A4 and mos-1370; sage-3107 and sage-3110. Take574 before573, as separate candidates. Base062646487451993302c768c6812b827c834e952b (origin/refactor at start), branchgander/v574. No queue move before Sage places the row. Build/push authorized now; every test/proof run waits Sage CLEAR after270+271 run5. Row292 remains independently held for final base and C1 review.
+
+## Exact authorized delta
+
+Only prepend `-c maintenance.auto=false -c gc.auto=0` to each fixture helper's Git argv. No production change, environment change, assertion change or fingerprint/snapshot change. Full-root comparisons still include .git. Production checkout.mjs's SAFE argv already contains both flags; gitEnv() alone does not. The helper called gitEnv() but skipped SAFE.
+
+- packages/seat/tests/checkout.test.mjs:git34-35 commits fixture roots; once():88-91 fingerprints root including.git. Whole clone comparison246-249 also covers it.
+- packages/seat/tests/working.test.mjs:git27-28 commits fixture repositories; fingerprint():40 and refusal checks83-86/120-122 cover the whole root.
+- packages/cli/tests/git-socket.test.mjs:gitIn32-33 commits projects; fingerprint():43 and once79-101 cover project/.git.
+- packages/cli/tests/lifecycle.test.mjs:gitIn47-49, commit71; snapshot459 walks every regular file, T11 compares pb.root831/839 including project/.git. Outside original list, explicitly authorized sage-3110 / mos-1370 before editing.
+
+Static preservation check removes only the four inserted argv elements from each candidate file and requires exact equality with its base blob. Thus every original assertion, fingerprint and snapshot byte stays intact. No new tests mirror the flags; runtime evidence is the requested trace over real fixture commits and whole files.
+
+## Named but unchanged
+
+- bus/grant-enroll.test.mjs imports fingerprint from host-grant.mjs for SSH host keys. No fixture Git helper or Git command; unchanged.
+- bus/grant-executor.test.mjs uses SSH-key fingerprints; its commit references are grant transaction steps, not Git fixture commits. No Git helper; unchanged.
+- bus/host-tools.test.mjs:28 hashes decoded SSH public-key bytes. No Git helper; unchanged.
+- conversation/reader.test.mjs:52/71/73 fingerprints session fixture files, but creates no Git repository and makes no Git call. Unchanged.
+
+## Other fixture audit, screened and unchanged
+
+- cli/lifecycle.test.mjs: whole-root .git snapshot is exposed; now included by explicit scope ruling above.
+- cli/launcher.test.mjs: fixture commits, but the before/after byte check961-971 names the sessions JSON file, not the repository tree or Git object directory. No maintenance-lock fingerprint exposure in that comparison.
+- cli/thread-launch.test.mjs and session-launch.test.mjs: fixture repositories, but compared before/transcripts/events/session-store values are application histories or evidence directories, not a whole .git tree. Unchanged.
+- cli/publish-socket.test.mjs and seat/publish.test.mjs: fixture commits, with ref values and fake-Gitea request/credential assertions. No whole-root fingerprint/snapshot; unchanged.
+- seat/landing.test.mjs: fixture commits support gate/root-path checks. The tree() helper builds a fixture and comparisons concern gate steps/results and output, not a whole-root byte inventory. Unchanged.
+- harness/git-tools.test.mjs: fixture commits support advertised object/ref and request assertions; no source-root byte fingerprint. Unchanged.
+- project/project.test.mjs, human-file.test.mjs and read.test.mjs: before/after checks use HEAD/status, spec content, or a record path; no full .git inventory including maintenance.lock. tester-init.test.mjs checks created records and identity. Unchanged.
+- bus/project-files.test.mjs via spec-fixtures.mjs: state() compares rev-parse HEAD and status --porcelain; detached maintenance changes neither asserted logical value. Unchanged.
+- library/mirror.test.mjs and sync.test.mjs via helpers.mjs: before/after byte checks name the sync-state file; comparison does not inventory Git objects/maintenance.lock. Unchanged.
+- cli/stack-copy.test.mjs: tree() compares published copies, which exclude source .git; source fixture already configures gc.auto0. No whole-source-repo .git fingerprint. Unchanged.
+- cli/stack-release-fixture.mjs and release tests: fp() compares unit, wrapper, pointer and store bytes, and tree() comparisons cover data/copies; source fixture.git is outside those roots and already sets gc.auto0. Unchanged.
+- webui/pinned-copy.test.mjs: fixture commits and gc.auto0; before/after assertion names config bytes and copied output, not source.git inventory. Unchanged.
+- queue/store.test.mjs via helpers.mjs: snap337 compares queue/view/.git/mosaic-queue.head only, not object/maintenance-lock paths. review tests compare request/log records. Unchanged.
+- ledger/ledger.test.mjs: Git fixture history is read as logical commits/timestamps, no whole-root .git fingerprint comparison found. Unchanged.
+
+This is an audit of fixture before/after comparisons, not a claim every unflagged fixture Git helper is fixed. No outside named scope was changed without approval. Mos's provided probe /mnt/storage/scratch/mos-1369/maint-lock-probe.py was read only, never executed.
+
+## Trace and gate plan, no execution yet
+
+Real Git: /usr/bin/git, `git version 2.55.0` (read-only version query). gitEnv() retains PATH and scrubs outer tracing env, so an outer GIT_TRACE2 alone would be vacuous. On CLEAR create an executable git shim in own scratch, outside the candidate. It only exports GIT_TRACE2 to a per-run absolute trace path and execs /usr/bin/git with the unchanged argv. The candidate contains no shim.
+
+Positive control first: a fresh fixture-style repo/commit WITHOUT either flag, traced through that shim, must show a maintenance child_start. Do not accept a missing/empty trace as success. Allow the detached positive-control child to finish and verify its scratch repo is idle before the flagged proof.
+
+Flagged control and four touched files whole then use the shim. Require observed fixture commit commands in each applicable trace and zero maintenance child_start. Classify a maintenance child by the trace's child_start and `maintenance run --auto` command, not by a substring in this plan. Save the raw trace, tested SHA, exact command/timeouts, command/child counts, and restored-tree check. No assertion weakening or .git exclusion is allowed. Any old red, timeout, maintenance child, or missing positive control stops for Sage/Mos before a retry.
+
+Recommended slot scope: positive/flagged fixture control plus the four touched files whole with GIT_TRACE2, and any broader seat/CLI suite Sage requests. Record per-file timeout-k10 at least3x successful historical whole-file receipt with headroom before launch; use900s where timing is unknown. TMPDIR from mktemp-d /mnt/storage/scratch/tmp/gXXXXXX, never /tmp. Pipefail/tee and busy check before each start. Trace runs are test work and are not authorized before CLEAR. No dependencies installed and no live ports/units/config accessed. Session registration remains Sage's.
+
+## Filbert static approval and proof refinements
+
+filbert-v574-7da38224-gander statically approves source65e919e5c / packet7da382244 / manifestcdda41f5. No runtime proof yet. Their independent audit found no missed fixture within the whole-root .git race class.
+
+P1: checkout and working tests resolve command-v-git when loading their own command wrappers. The trace shim therefore lives in a stable absolute scratch bin directory for the entire run, including fixture hooks. It chains only to /usr/bin/git2.55.0 and is not deleted until all calls and detached children finish.
+
+P2: add GIT_TRACE2_EVENT alongside GIT_TRACE2 in the scratch shim, pointing at a per-run directory. Git writes one JSON event file per process, avoiding interleaved event lines. Count child_start argv tokens for maintenance/run/--auto exactly and report actual fixture commit start counts alongside zero maintenance. The shim only sets tracing variables and execs the real git; no Git argv/config or candidate file is changed by tracing.
+
+P3: both positive and flagged controls call the real gitEnv() from checkout.mjs, with PATH resolving that same shim. A shell-only unflagged commit is not sufficient. Positive requires observed fixture commit and maintenance child_start; flagged requires observed fixture commit and zero such child. No missing/empty trace counts as a pass.
+
+P4: after each traced whole file, wait for no git process whose /proc cwd is under that run TMPDIR, including deleted cwd, before counting. Detached maintenance could write events after Node exits. Save the cwd sweep and count trace only after the writer set is empty. A nonempty/unstable writer set is a stop, never silently ignored.
+
+P5: green fingerprints alone are not the proof. The trace commit count and maintenance-child count are required for every changed suite.
+
+Additional screened files from Filbert, unchanged: bus/publish.test.mjs lists JSON files only; discord/git.test.mjs checks .vault-locks only; stack-release-external checks named files and tree(e.state); queue/write.test.mjs lists gitDir entries filtered to .tmp. Shared helpers plugins/tests/helpers, runs/tests/helpers, conversation/tests/harness and case-sudo-fixture make no Git calls.
+
+Follow-up note, outside574: product Git commits in queue/src/store.mjs, discord/src/git.mjs and harness/src/tools.mjs do not carry both maintenance flags. No whole-root .git fingerprint currently covers those roots. A future fingerprint test there must account for detached maintenance. This note authorizes no product change or assertion change here. working.mjs fetches at183/237/245 and harness git-tools fetch249 use --no-auto-maintenance; existing production checkout SAFE has both flags.
@@ -0,0 +1,4 @@
+721af7a3745dae10d0dad9226e7ba5ce32754b5da7367aa13f970d7f03677a3c  packages/cli/tests/git-socket.test.mjs
+a0cae5797886b729600dcbcad8e38ec94f97143c77fd91648050417c2d5630f7  packages/cli/tests/lifecycle.test.mjs
+cb3941fed464fd4c88aac7c05bb32db1b1776858650979523f64dc6fc3baf7d3  packages/seat/tests/checkout.test.mjs
+22cbdd43fc11c6f234d0f2c1512d5039839d1242fd421e62f2aa3d3db1c9de05  packages/seat/tests/working.test.mjs
@@ -0,0 +1,30 @@
+[
+  {
+    "file": "packages/cli/tests/git-socket.test.mjs",
+    "base_sha256": "ec4bbbc98adab6561205e5ec8e2f2495f1f55224da53e567c7a72e36b5410709",
+    "candidate_sha256": "721af7a3745dae10d0dad9226e7ba5ce32754b5da7367aa13f970d7f03677a3c",
+    "only_inserted_argv_flags": true,
+    "assertions_and_fingerprint_unchanged": true
+  },
+  {
+    "file": "packages/cli/tests/lifecycle.test.mjs",
+    "base_sha256": "5ce79205c4ca6e5f6e77671968ce9d8b8ebfdbdde07b31676f2d05b284acb938",
+    "candidate_sha256": "a0cae5797886b729600dcbcad8e38ec94f97143c77fd91648050417c2d5630f7",
+    "only_inserted_argv_flags": true,
+    "assertions_and_fingerprint_unchanged": true
+  },
+  {
+    "file": "packages/seat/tests/checkout.test.mjs",
+    "base_sha256": "663040d7c737aba6403e6397bacf1325b558cc14df3e5677f0a28f9499c45127",
+    "candidate_sha256": "cb3941fed464fd4c88aac7c05bb32db1b1776858650979523f64dc6fc3baf7d3",
+    "only_inserted_argv_flags": true,
+    "assertions_and_fingerprint_unchanged": true
+  },
+  {
+    "file": "packages/seat/tests/working.test.mjs",
+    "base_sha256": "15234267a0e28c53b13a4219ea45e71608722fb137d1f266adfd3f80040eb7c6",
+    "candidate_sha256": "22cbdd43fc11c6f234d0f2c1512d5039839d1242fd421e62f2aa3d3db1c9de05",
+    "only_inserted_argv_flags": true,
+    "assertions_and_fingerprint_unchanged": true
+  }
+]
@@ -0,0 +1,15 @@
+{
+  "vikunja": 574,
+  "queue": "pending Sage placement",
+  "gate": "sage",
+  "base": "062646487451993302c768c6812b827c834e952b",
+  "source": "65e919e5cef30911b9902f410549da431423cec4",
+  "branch": "gander/v574",
+  "manifest": "cdda41f5baa6b04e6e5bb9b82beff8e00ceef440c6702565cc86944f249bb5d3",
+  "tests": "NOT RUN; no trace/Node/test until Sage CLEAR",
+  "scope_authority": [
+    "mos-1369",
+    "sage-3110",
+    "mos-1370"
+  ]
+}
@@ -0,0 +1,310 @@
+# Row 203, FED R2: the federation key in the system config (#1701)
+
+Owner Quackerjack, reviewer Webby, gate owner Sage. Brief: docs/plans/2026-10-20_federation-r1-r2-r5.md,
+"Brief: FED R2". Design: DESIGN.md section 3.1 (D1), section 4 (the key shape), section 7 row R2, at
+gizmoduck/federation-design b93f098f0.
+
+Base: aca16404c, rebased onto f2735bb6a (origin/refactor, shared object store). Rebased onto 253's tip
+only if 253 lands first, under a new branch name.
+
+## Commits
+
+- 0eb4b6f1f, rebased to e704a18ae: the loader, the first FED R2 tests, and these notes.
+- Second commit on top of e704a18ae (sage-2998): B1 and B2 below, the fixture fix, and the notes
+  rewrite. Its sha goes in the status line once committed.
+
+## Shape
+
+```json
+"federation": {
+  "self": "hub",
+  "peers": [{ "id": "factory", "origin": "https://mosaic.woltje.com", "label": "Software factory" }]
+}
+```
+
+- Optional. Absent: the config loads and prints what it printed before (no `federation` in the output).
+- `self` and each `peers[].id` match `^[a-z][a-z0-9-]{0,31}$`. A peer id may not equal `self` or another peer's id.
+- `peers[].origin` must be an https origin exactly as `new URL(origin).origin` returns it: no path, no query,
+  no userinfo, no trailing slash.
+- `peers[].label` is a non-empty string of at most 80 characters.
+- Labels and URLs only. Nothing here grants trust to a peer (section 3.1 D1, section 3.2 W1).
+
+## Readers of the key
+
+Two readers read the raw key. Nothing else reads it (`git grep "federation"` at e704a18ae):
+
+1. The loader, `scripts/mosaic-config.mjs` (`validate`, the `federation` branch). This is the only reader of
+   the validated value. Its output is read by the CLI and business code, which read named fields only.
+   The output is checked in `scripts/test-config.sh`.
+2. The stack-release probe, `config_checks` in `scripts/stack-release.sh` (B1, below). It reads the config
+   file itself, before a copy is activated or rolled back to, and asks whether the target copy's loader
+   refuses a key the config holds.
+
+Stale wording, NOT changed in this row (Sage rulings sage-2808 and sage-2809):
+`packages/cli/src/access.mjs` is out of row 203. Megavolt's row 207 changes that file. Follow-up, to be
+carried to DEFERRED by Sage:
+- access.mjs lines 26-27 (`ACCESS_HELP` comment): "Peer homes are empty until the federation key lands
+  (row 203)". Still partly true after this row, since the access context does not read the key.
+- access.mjs line 36 (inside the `ACCESS_HELP` string, user-visible help): "Peer homes are not read yet
+  (row 203 adds the federation key)". The same claim, in help text. No test in `packages/cli/tests` pins it
+  (`git grep` for "row 203" and "Peer homes" finds nothing in tests).
+- access.mjs line 44 comment: "peers is empty until row 203".
+- `packages/cli/README.md` line 1107: "until row 203 adds the". Outside the manifest; flagged in the
+  same follow-up.
+
+Behavior after this row: `accessContextFor` still returns `peers: []` (access.mjs line 58). Row 203 adds the
+config key only, so grants naming a peer home still refuse. Wiring the key into the access context is not in
+the FED R2 brief.
+
+## B1: the stack-release probe (sage-2998, in scope)
+
+Webby's early look (webby-0189): a config holding `federation` and no `console` passed `config_checks`, because
+the probe looked only for `console`. A rollback or activate to a pre-203 copy would then pass its checks, and
+that copy's loader refuses `unsupported configuration key: "federation"` on the next read.
+
+Fix (scripts/stack-release.sh, `config_checks`):
+- The probe's node check now reads `console` or `federation` (`Object.hasOwn(d,"console")||Object.hasOwn(d,"federation")`).
+- The refusal keeps the check name `config-console-key`, so existing callers and tests do not change. The
+  message now reads "holds a console or federation key". This is a wording change to an existing refusal,
+  and `KEY_MSG` in `packages/cli/tests/stack-release.test.mjs` moves with it.
+- The new test is `row 203: a config whose federation key the target loader refuses ...` in
+  `packages/cli/tests/stack-release.test.mjs`, after the row 200 console test. Target B's loader has no
+  federation key in its list, so it refuses the key. Activate to B and rollback to B are both refused, and
+  a rollback succeeds once the key is removed.
+
+Fixture (packages/cli/tests/stack-release-fixture.mjs, line 300): `LOADER_OLD` builds B's loader by a string
+replace on the `rejectUnknownKeys` list. Adding `federation` to that list in this row left the replace with no
+match, and the fixture's `assert.notEqual(LOADER_OLD, LOADER)` would fail at load. The replace now targets
+`"execution", "console", "federation"]`, so B's loader refuses both keys. This regression came from my
+e704a18ae, and the fix is in this commit.
+
+## B2: a case and a mutant for each refusal (sage-2998: "one mutant per refusal")
+
+Webby's list is covered below. Each refusal has a case in `scripts/test-config.sh` (FED R2 block) and a
+mutant. M5 is killed by the self case; M13 covers the duplicate half of the id check that M5 did not reach.
+
+## Refusals and their tests
+
+`scripts/test-config.sh`, FED R2 block:
+
+| Case | Refusal (exit 2) | Mutant (killed by) |
+|---|---|---|
+| valid key loads and is in the output | none | base |
+| unknown top-level sub-key | `unsupported federation key: "extra"` | M1 |
+| unknown peer sub-key | `unsupported federation.peers[0] key: "trust"` | M2 |
+| origin over http | `federation.peers[0].origin must be an https origin ...` | M3 |
+| origin with a path | same | M4 |
+| origin with userinfo | same | M4 |
+| origin with a trailing slash | same | M4 |
+| peer id equal to self | `federation.peers[0].id ... is already named` | M5 |
+| duplicate peer id | `federation.peers[1].id "factory" is already named` | M13 |
+| peer label empty | `federation.peers[0].label must be a non-empty string ...` | M6 |
+| peer label over 80 characters | `federation.peers[0].label must be ...` | M12 |
+| federation not an object | `"federation" must be a JSON object` | M7 |
+| self does not match the pattern | `federation.self must match ...` | M8 |
+| peers not an array | `federation.peers must be an array` | M9 |
+| peer not an object | `federation.peers[0] must be a JSON object` | M10 |
+| peer id does not match the pattern | `federation.peers[0].id must match ...` | M11 |
+| self missing | `federation.self must match ...` | M15 |
+| peer id missing | `federation.peers[0].id must match ...` | M16 |
+| peer label missing | `federation.peers[0].label must be ...` | M17 |
+| no federation key | loads, no federation output | base |
+| B1: target loader refuses federation | `config-console-key` refusal (stack-release.test) | M14 |
+
+Mutant plan (run on Sage's gate only, one edit each, a named test must fail). Before the gate each edit string
+must occur exactly once in its file. I checked all of M1 to M17 with grep -cF: each is 1. The
+gate's mutant runner checks the count again before it applies each edit:
+
+- M1: `rejectUnknownKeys(value, ["self", "peers"], "federation");` removed. Killed by "federation unknown sub-key".
+- M2: `rejectUnknownKeys(peer, ["id", "origin", "label"], where);` removed. Killed by "federation peer unknown sub-key".
+- M3: `url.protocol !== "https:" ||` removed. Killed by "origin over http".
+- M4: `|| url.origin !== value` removed. Killed by "origin with a path", "origin with userinfo" and
+  "origin with a trailing slash".
+- M5: `if (ids.has(peer.id)) {` changed to `if (false) {`. Killed by "peer id equal to self".
+- M6: `peer.label.trim() === "" ||` removed. Killed by "peer label empty".
+- M7: `if (!isPlainObject(value)) {` changed to `if (false) {`. Killed by "federation not an object".
+- M8: `|| !FEDERATION_ID_PATTERN.test(value.self)` removed. Killed by "self does not match the pattern".
+- M9: `if (!Array.isArray(value.peers)) {` changed to `if (false) {`. Killed by "peers not an array".
+- M10: `if (!isPlainObject(peer)) {` changed to `if (false) {`. Killed by "peer not an object".
+- M11: `|| !FEDERATION_ID_PATTERN.test(peer.id)` removed. Killed by "peer id does not match the pattern".
+- M12: ` || peer.label.length > FEDERATION_LABEL_MAX` removed. Killed by "peer label over 80 characters".
+- M13: `    ids.add(peer.id);` removed. Killed by "duplicate peer id".
+- M14 (stack-release.sh): `||Object.hasOwn(d,"federation")` removed. Killed by the row 203 federation test in
+  `stack-release.test.mjs`.
+- M15: `typeof value.self !== "string" || ` removed. Killed by "federation self missing". Without the typeof
+  half, an absent self passes the pattern (`/^[a-z]…$/.test(undefined)` is true).
+- M16: `typeof peer.id !== "string" || ` removed. Killed by "federation peer id missing". Same reason.
+- M17: `typeof peer.label !== "string" || ` removed. Killed by "federation peer label missing". Without it, a
+  missing label throws a TypeError at `.trim()` (exit 1), not the exit 2 refusal.
+
+## Boundaries
+
+- No config is written. `~/.config/mosaic-dev/config.json` is not touched. Tests use `$SANDBOX` only.
+- No change to `packages/cli/src`, `scripts/bootstrap.sh`, or any reader beyond the stack-release probe.
+
+## Manifest (sha256 of committed blobs; the list is the review scope)
+
+- scripts/mosaic-config.mjs
+- scripts/test-config.sh
+- scripts/stack-release.sh (B1)
+- packages/cli/tests/stack-release.test.mjs (B1 test, KEY_MSG)
+- packages/cli/tests/stack-release-fixture.mjs (B's loader fixture; without this, the suite fails to load)
+- agents/quackerjack/work/queue-203/BUILD.md
+
+## Slot estimate (for Sage's gap)
+
+- test-config.sh: about 5 min, padded.
+- The cli suite: about 5 min, padded.
+- stack-release.test.mjs: up to 1800 s, per Sage. It copies the loader, so it runs whole at the gate (Webby N3).
+- Mutants M1–M13 and M15–M17 each re-run the FED block of test-config.sh. M14 re-runs stack-release.test.mjs.
+  The per-mutant cost is not measured: this run has not been timed.
+
+## Status
+
+- e704a18ae: the loader, first tests and notes, rebased onto f2735bb6a.
+- 8d34a9e94: B1, B2, the fixture fix and the notes rewrite (Mos approved the two old-test edits, mos-1346).
+- Third commit on top: B3 cases M15–M17 and these notes (sha in the message to Sage and Webby).
+- NOT YET RUN: no node during Gander's slot. The test-config.sh, cli and stack-release gates run when Sage
+  announces a CLEAR. `bash -n` passes on both shell scripts.
+- Not pushed, not claimed. Per invariant 8 the gate runs before any commit is called green.
+
+## Review notes (Webby, webby-0189, answered here)
+
+- B1: fixed as above (scope per sage-2998). The probe's check name `config-console-key` is kept on purpose (Webby
+  N5, Sage): renaming it would change callers and tests for no gain in this row. The message says "console or
+  federation key"; the name is the only old word left.
+- B3 (webby-0191): missing self, missing peer id, and missing peer label each have a case and a mutant (M15–M17).
+  The typeof halves are the only thing refusing an absent value, since the pattern test coerces undefined.
+- B2: a case and a mutant for each uncovered refusal, plus the trailing-slash case under M4 (N4) and the
+  duplicate-peer case (M13).
+- N1: this file is rewritten with the current base and status.
+- N2: consumers checked by `git grep "mosaic-config"`. The loader's output is read by `packages/cli/src/config.mjs`,
+  `packages/business/src/*.mjs`, `packages/webui/src/sso-config.mjs`, `packages/seat/src/seat.mjs`,
+  `packages/discord/src/binding.mjs`, `packages/conversation/src/guard.mjs`, and the shell scripts that call
+  `validate` (bootstrap.sh, common.sh, instance.sh, land-work.sh, stack-copy.sh, stack-release.sh,
+  conductor-apply.sh). Checked by `git grep "federation"` over packages and scripts: no reader outside the
+  loader and the stack-release probe mentions `federation`. I did NOT read each call site for which fields it
+  uses; that is still open for Webby's static read. Not run.
+- N3: the cli stack-release tests copy the loader; they run whole at the gate. Listed in the manifest and
+  the slot estimate.
+- N4: trailing-slash case added (see table; M4).
+
+## Gate on the rebased tip (Sage sage-3055, sage-3057; claim rev 3361)
+
+Brief pin: docs/plans/2026-10-20_federation-r1-r2-r5.md re-pinned to 8adfb261f (sage-203-repin). "Brief: FED R2"
+is byte-identical between b624ddd49 and 8adfb261f (Sage's diff).
+
+Rebase: onto origin/refactor c7b754d7b (row 207 landed at c4f77373f on that tip). The three commits are now
+93a491d73 (loader), 284d55cf2 (stack-release probe and fixture), 7c543fd4a (B3 cases). Blob check against the
+pre-rebase candidate d5428c1a8 (`git rev-parse <commit>:<path>`), all six identical:
+
+| blob | path |
+|---|---|
+| 4c26453a0 | scripts/mosaic-config.mjs |
+| 06b9d8ea2 | scripts/test-config.sh |
+| 92bd6f7d0 | scripts/stack-release.sh |
+| beb8da252 | packages/cli/tests/stack-release.test.mjs |
+| f080bf2f5 | packages/cli/tests/stack-release-fixture.mjs |
+| 6f29dbbde | agents/quackerjack/work/queue-203/BUILD.md (pre-gate-commit blob) |
+
+Timeouts (Mos mos-1275: `timeout -k 10 <S>` per script, at least 3x its longest run; written here before the
+first run). Basis: row 202's gate on this machine (scratch g202gatelBKGE0): cli suite 620.3 s (duration_ms
+620297.68, EXIT=0); the ten scripts together finished in about 2.5 min, so no single script was measured on its own.
+Figures are set above 3x of those, and the stack-release.test run is set from Sage's up-to-1800 s estimate.
+They are estimates, not measured. A timeout hit is a red and goes to Mos first. Mos rules on these figures.
+
+| target | timeout S (seconds) | basis |
+|---|---|---|
+| scripts/test-auth.sh | 900 | 3x of a row 202 script, padded |
+| scripts/test-conductor.sh | 900 | same |
+| scripts/test-config.sh | 900 | same; also each mutant run of the FED block |
+| scripts/test-discord.sh | 900 | same |
+| scripts/test-extension-package.sh | 900 | same |
+| scripts/test-foundation.sh | 900 | same |
+| scripts/test-land-work.sh | 900 | same |
+| scripts/test-queue.sh | 900 | same |
+| scripts/test-release.sh | 900 | same |
+| scripts/test-task.sh | 900 | same |
+| packages/cli suite | 2400 | 3x of 620 s is 1861 s |
+| stack-release.test.mjs (whole) | 5400 | 3x of Sage's 1800 s estimate |
+
+Run command shape: `timeout -k 10 <S> <cmd>`. Queue verbs are never wrapped in a timeout.
+
+Mutant kill rule: each of M1-M17 must fail on an assertion, not on a crash. The mutant run records the failing
+test name. Skips are named in the gate record.
+
+## Gate results on 7309260ae (23:00-23:16Z)
+
+- stack-release.test.mjs, whole: 219 pass, 0 fail, 0 skipped, 583.5 s (timeout 5400 s).
+- test-config.sh: selftest 51 pass, 0 fail, EXIT 0, 2.4 s (timeout 900 s).
+- Mutants, one run each, file restored from git after each. Each run of M1-M13 and M15-M17 is 2.4 s
+  (the first run is the timing: 2.4 s, so the 900 s timeout is far above it).
+
+| mutant | result | killed by (FAIL line in test-config.sh, or stack-release.test) |
+|---|---|---|
+| M1 | killed | federation unknown sub-key |
+| M2 | killed | federation peer unknown sub-key |
+| M3 | killed | federation peer origin over http |
+| M4 | killed | federation peer origin with a path (also userinfo, trailing slash) |
+| M5 | killed | federation peer id equal to self (also duplicate peer id) |
+| M6 | killed | federation peer label empty |
+| M7 | killed | federation not an object |
+| M8 | killed | federation self pattern |
+| M9 | killed | federation peers not an array |
+| M10 | killed | federation peer not an object |
+| M11 | killed | federation peer id pattern |
+| M12 | killed | federation peer label over 80 characters |
+| M13 | killed | duplicate peer id |
+| M14 | killed | row 203 subtest of T57 in stack-release.test.mjs (parent T57 also fails) |
+| M15 | killed | federation self missing |
+| M16 | killed | federation peer id missing |
+| M17 | killed | federation peer label missing |
+
+Correction (new entry; the kill-text column in the mutant plan above is kept as written): the plan named
+the kill labels for M8 and M11 as "self does not match the pattern" and "peer id does not match the pattern".
+Those labels are not in the test file. The assertions that fail are "federation self pattern" and
+"federation peer id pattern". Both mutants are killed; only the label text in the plan was wrong.
+
+M14 note: `node --test --test-name-pattern="row 203"` runs zero inner tests, because the row 203 case is a
+t.test subtest of T57 and the filter skips the parent. The first automated M14 run reported SURVIVED for
+that reason (rc 0 in 0.9 s, no FAIL line). It was re-run with `--test-name-pattern="T57|row 203"`: the row
+203 subtest fails (rc 1), so M14 is killed. The automated result is the wrong one and is not the gate record.
+
+## cli suite (23:20-23:37Z)
+
+- First run (timeout 2400 s, 627.6 s): 895 tests, 816 pass, 77 fail, 2 cancelled, EXIT 1. Cause: this worktree
+  had no node_modules, so scripts/case2-persona-import.mjs (and the other suites that import it) could not
+  resolve package 'yaml' (declared at 2.9.0 in package.json). Not a federation failure. Not in the gate record.
+- Fix in the environment only: node_modules symlinked to /mnt/storage/src/mosaic-stack/node_modules (the row 202
+  recipe). The symlink is excluded through .git/info/exclude and is not committed.
+- Rerun (timeout 2400 s, 621.9 s): 895 tests, 895 pass, 0 fail, 0 cancelled, 0 skipped, EXIT 0.
+
+## Gate summary (23:00-23:40Z, rebased tip c7b754d7b, code tree 7309260ae)
+
+| gate item | result | timeout S | measured |
+|---|---|---|---|
+| stack-release.test.mjs, whole | 219 pass, 0 fail, 0 skipped | 5400 | 583.5 s |
+| test-config.sh | 51 pass, 0 fail | 900 | 2.4 s |
+| mutants M1-M17 (named assertion) | 17 of 17 killed | 900 (per run) | 2.4 s per config run; M14 by row 203 subtest |
+| cli suite (npm test) | 895 pass, 0 fail, 0 skipped | 2400 | 621.9 s |
+| test-auth.sh | 15 pass, 0 fail | 900 | 1 s |
+| test-conductor.sh | 17 pass, 0 fail | 900 | 6 s |
+| test-config.sh | 51 pass, 0 fail | 900 | 2 s |
+| test-discord.sh | 81 pass, 0 fail | 900 | 8 s |
+| test-extension-package.sh | 18 pass, 0 fail | 900 | 1 s |
+| test-foundation.sh | 44 pass, 0 fail | 900 | 41 s |
+| test-land-work.sh | 86 pass, 0 fail | 900 | 12 s |
+| test-queue.sh | 28 pass, 0 fail, 1 skip | 900 | 21 s |
+| test-release.sh | 14 pass, 0 fail | 900 | 2 s |
+| test-task.sh | 91 pass, 0 fail, 2 skip | 900 | 14 s |
+
+Named skips:
+- test-queue.sh: `queue verify and render --check` skipped. This checkout is not the queue's canonical root
+  (/mnt/storage/src/mosaic-stack). The check runs on the canonical checkout only.
+- test-task.sh: two live-provider cases skipped by design (row 244: no provider call in the gate).
+
+Timeouts: the ten per-script figures above were written before the first run and were not changed. Every script
+finished far inside its timeout. No timeout was hit, and none was placed around a queue verb.
+
+Environment: the first cli run failed for a missing node_modules in the worktree; see the cli section above.
+The rerun is the gate record.
@@ -1549,3 +1549,12 @@ are never rewritten or removed; corrections are new entries.
 2026-10-22 | Della | Row258 E01 3094e3bfa focused manifest review | APPROVED 11-path manifest/static F1/F2/N1 corrections; file and full-blob digest recipes verified. M1-M11 fixed; all execution/landing evidence still required in CLEAR. No shared-log edit, Node, tests, HTTPS Git or live action.
 2026-10-22T17:55:40Z | Sage (Opus 5.5, 1ef1e4f8) | Row 253 landing; post-253 doc sweep | 253 LANDED 48e450ce8. Sweep on sage/sweep-253: Gosalyn Case 2 design and rows, 229 design, Gyro 0acbdb0d8, Della 179391055, 268 docs, seat dirs for Della, Scrooge, Huey, Louie and Ludwig, human-users-build:70 under Q173, DEFERRED 253 N1, 198 N2, row 203 text, 224 residual and 206 sharee list, and seat log lines.
 2026-10-22 14:48 UTC | Researcher (Sonnet 5.5, 9bac0794) | Rows 220 and 216 resumed (sage-2708, sage-2716, sage-2719); local commits only | 220 e4a204836 on researcher/row220-r2 (on ea6dc9eff): C1 run tests, C2 default-reader M7 test, configDirectory fixture scope, BUILD.md round 2b. 216 4f3fbc25a on researcher/row216-r2 (on aca16404c): index cache, find/get/search/manuscript/universeInfo, PRD 1.14 levels. Nothing pushed, claimed or run; node --check not run. Waits for Sage's CLEAR and go; rebase onto 253 on a new branch before any gate.
+2026-10-22 | Megavolt | row 207 (193c, #1705) mosaic access user add/remove | gate green on 712f79c0a (31/31, M1-M8 killed, cli 894/894, ten scripts); pushed megavolt/row207-r3 9bb406c6c; to Duckworth.
+2026-10-22T22:51:32Z | Sage (Opus 5.5, 1ef1e4f8) | Post-207 gap: brief push, row 292 add, stuck-request repair, 207 landing | #1797 brief f0e3dcdf4 pushed; row 292 (#1797, Gander) briefed after 270/271/203. Dead queue locks removed twice; requests for 207/270 abandoned and reposted as jarvis (c30841, c30845), 291 requested (c30846); verdicts posted for Duckworth (c30847, c30849) and Webby (c30848). 207 LANDED c4f77373f, #1705 closed c30855, P19 269 c808. DEFERRED: 207 N1, 270 N6.
+2026-10-22T23:03:39Z | Gyro (Codex gpt-6.1-sol, mos-1356) | Q195/Q231/Q233 O2 design rewrite, gyro/editor-o2 from c4f77373f | Canonical queue next gyro: nothing. Ten docs-only briefs; full-feature WordCraft, independent 15-crate/199-package security review, editor-only CSP candidate, instant git DOCX saves and retained Markdown/wiki sources, committed-only DOCX citation gate, no agent story prose. Static structure/source-anchor/scope checks only; no code, build/run, queue or live change. Fenton review requested after push.
+2026-10-22T23:09:38Z | Gyro (Codex gpt-6.1-sol, fenton-0006) | Q195 O2 design corrections on gyro/editor-o2 | F1 requirement boundary sent to Mos, adoption gated; F2-F6 source-checked docs fixes prepared. Ten briefs and two open owner items checked statically. No implementation, build/browser/worker run, queue or live action; Fenton re-check after push.
+2026-10-22T23:13:27Z | Gyro (Codex gpt-6.1-sol, fenton-0007) | Q195 O2 r3 F7/F8 | Save-group keys/defaults/validation and W3b refusal/W4b lift ownership explicit. Static docs checks only. Q36 remains open; no implementation or gate lift. Direct Fenton/Mos handoff after push.
+2026-10-22 23:23:42Z | rocko | Q195 O2 W4 #1799 committed DOCX citation/access design | pushed rocko/q195-w4-design-20261022 at 15e91538f; blob 662abdb7; direct handoff to Megavolt; static docs checks only, review pending; Q36 open/adoption closed.
+2026-10-22 | Megavolt (Claude Opus 5.5) | Q195 O2 W4 DOCX citation/access design review (#1799, sage-3061/3067) | four rounds: CHANGES 15e91538f, 019a0ea5b, 54246cb32; APPROVE 994c3f7fb (verdict 67f82a12d, unpushed pending CLEAR); M1 closed with no ruling; R4-N1 to W4b
+2026-10-22 23:48Z | rocko | Q195 O2 W4 #1799 design approved | W4 #1799 design approved at 994c3f7fb (Megavolt 67f82a12d), 32 acceptance rows assigned to W4b; static docs/public-fixture inspection only, no implementation PASS. Q36 remains OPEN and adoption CLOSED. Sage's accepted implementation brief remains required. Row219 remains separately held pending your next direction.
+2026-10-22T23:55:11Z | Sage (Opus 5.5, 1ef1e4f8) | Row 203 landing, O2 design landing, W4 docs landing | 203 LANDED a4da4e6df (Webby c30877, rev 3366), #1701 closed c30882, P19 269 c835. O2 design (mos-1360/1361) pushed 25c09f19f, blob 322ec50f matches fenton-0008. W4 #1799 APPROVE round 4 posted c30884; design 2af460ab7 and review bedde1716 land here. Queue revs 3360-3368 in 4ca270307. 270+271 r4 rebased by Gizmoduck onto 25c09f19f for new Duckworth rounds.
@@ -0,0 +1,981 @@
+# Q195 O2 W4: committed DOCX citations and access
+
+Design for Gitea #1799, assignment sage-3060/mos-1360. Owner Rocko;
+independent reviewer Megavolt. Normative parent: `e36bce352`,
+`docs/plans/2026-10-21_q195-writing-editor.md`, blob
+`322ec50f2669cffc0f8256d6beffdaccc4d8dba8`, D12, D24-D26, W4 and W4b.
+This is a proposed implementation contract, not access enablement or a parser
+security PASS. Reviewer owns the separate verdict file; the author does not
+write an approval there.
+
+## 1. Gates and compatibility
+
+W4b implements this contract only after independent W4 APPROVE and Sage's
+accepted implementation brief, S0 and its other parent gates. A release must
+ship extractor, resolver, authorization and sharing together; no partial
+agent read rollout. Missing server readiness refuses every O2 read, resolve,
+share and flag. A human setting, pin or request field cannot assert readiness.
+W5 owns flags, not chapter writes. No agent execute, edit, replace, save,
+tracked-change or comment-writing operation is introduced.
+
+Q36 / Vikunja 562 is OPEN. Production Markdown adoption remains closed under
+mos-1358, independently of whether this design is approved. If Jason approves
+superseded notices, a separate C2 reader/reply row must implement and pass
+them before adoption; otherwise Mos records Jason's disposition before any
+adoption brief proceeds. This document neither implements nor decides notices.
+
+Existing C2 Markdown, its line-cite schema, library grants and supporting-doc
+writer remain unchanged. An authorized old Markdown original is historical
+source, never the current DOCX or a permission to its later edits. No DOCX
+paragraph is called a line. Following an adopted source from a C2 read,
+indexing it as Markdown, changing C2 replies or a synchronized Markdown
+projection requires a separately approved Case 2 amendment through Mos/Jason.
+W4b must test old C2 fixtures unchanged alongside the new discriminated DOCX
+contract. It may migrate only new O2 records, with a named schema edge Sage
+allocates; it must not reinterpret existing line citations in place.
+
+## 2. Trust and document identity
+
+The host reader alone opens `<dataRoot>/writing/<business>/<project>/`.
+Business, project and document are opaque IDs resolved through the host's
+owned manifest, never request paths. Each document has a stable ID and one
+canonical DOCX path; a rename does not change its identity. A copy/new import
+gets a new document ID and no inherited grant, share, pin or cache authority.
+Origin metadata is evidence only. Copying a source does not launder access.
+
+A read snapshots one reachable committed manifest and its DOCX blob from the
+same commit. It never combines HEAD's manifest with another commit's DOCX.
+The reader accepts only server-resolved commits reachable from that document's
+published history; arbitrary git objects and another document's same blob
+are not selectable. Historical access also requires the document's current
+live authorization. Removed history, missing blobs or missing extractor
+revisions refuse; there is no worktree, export or engine-memory fallback.
+The commit/blob field is a locator, not an authority token.
+
+The project's sole publication ref is `refs/heads/writing-published`; only
+the human writer advances it, atomically and without force updates. Each
+commit contains the book manifest. For a document, its publication commits
+are the first-parent commits on that ref that add or change its DOCX blob or
+its canonical manifest entry (including deletion/reinstatement). The first
+commit is a publication; a sibling-only save is not. `currentCommit` is the
+latest such commit for this document at the captured ref tip. Version latest
+selects that commit; a locator commit must be one of those publication commits,
+not an arbitrary intervening project commit. Deleted document entries refuse
+current reads, including history, until explicitly reinstated and granted.
+Published history is exactly that document's reachable publication sequence.
+A sibling save does not change its currentCommit, stale flag or cursor.
+Staleness is still exact commit inequality within that document, even if a
+human deliberately saves an earlier byte-identical blob as a new publication.
+
+The writer's successful commit publishes atomically before Saved. A latest
+lookup begun after that receipt resolves that published commit, not an old
+cache entry. A lookup already in progress remains internally on its captured
+commit. Return the captured version explicitly; never label it latest after
+observing a newer publish. Recheck live grants immediately before returning
+content, not just before asynchronous extraction.
+
+## 3. Exact wire schema, version 1
+
+All objects reject unknown keys. IDs are nonempty ASCII `[A-Za-z0-9_-]{1,128}`;
+commits/blobs are lowercase 40-hex Git object IDs in the repository's current
+SHA-1 object format. A future object format requires a new schema revision.
+Digest values are lowercase 64-hex SHA-256. Integers are safe nonnegative
+JSON integers. No floats, coercion, duplicate JSON keys or implicit defaults
+except the explicitly listed request defaults below. These are proposed O2-only records.
+
+A locator is exactly:
+
+```json
+{
+  "kind": "docx-range", "version": 1,
+  "business": "acme", "project": "book", "document": "chapter_1",
+  "commit": "<40 lowercase hex>", "blob": "<40 lowercase hex>",
+  "extractor": {"id": "mosaic-docx-text-v1", "revision": "<64 lowercase hex>"},
+  "part": {"class": "body", "name": "word/document.xml", "story": "main"},
+  "paragraph": {"ordinal": 0, "xmlId": null},
+  "start": 0, "end": 5, "textView": "final", "quote": "Hello",
+  "quoteDigest": "<sha256 of UTF-8 quote>"
+}
+```
+
+Part triples are exact: body/main uses the body part; footnote/endnote/comment
+uses its class-matching part and a canonical nonnegative decimal story ID
+(`0` or `[1-9][0-9]*`), never a user path. Paragraph `xmlId` is JSON null
+when absent. A textView is always recorded in every locator; there is no
+resolver default. quote is a nonempty valid Unicode string bounded to 16,384
+code points and 64 KiB UTF-8. Unknown enum values or unexpected types refuse.
+
+The ordinal-primary rule below deliberately refines D25's wording ("IDs
+when present, otherwise ordinal"): a possibly duplicated paraId is a required
+cross-check, never the lookup key. This is an O2-only design choice for Sage's
+implementation brief, not an amendment to Case 2.
+
+`paragraph.ordinal` is the zero-based paragraph index within the selected
+story, in deterministic XML document order, including empty paragraphs and
+table-cell paragraphs. `xmlId` is null exactly when the selected node has no w14:paraId, otherwise the literal eight-hex `w14:paraId`,
+canonicalized uppercase. Ordinal is always present: paraId alone is not
+unique or stable enough. The key is mandatory: passing null for a node that has the attribute refuses.
+The non-null value must equal that node's attribute; duplicated IDs do not
+trigger a search, since ordinal selects the node. Mismatches refuse.
+Thus identical paragraphs remain distinct. `start < end <= codePointLength`
+selects one paragraph, end exclusive. A multi-paragraph selection has the exact wrapper below, not a bare array:
+
+```json
+{
+  "kind":"docx-selection", "version":1,
+  "business":"acme", "project":"book", "document":"chapter_1",
+  "commit":"<40 lowercase hex>", "blob":"<40 lowercase hex>",
+  "extractor":{"id":"mosaic-docx-text-v1","revision":"<64 lowercase hex>"},
+  "part":{"class":"body","name":"word/document.xml","story":"main"},
+  "textView":"final",
+  "ranges":[
+    {"paragraph":{"ordinal":0,"xmlId":null},"start":1,"end":5,"quote":"ello","quoteDigest":"<64 lowercase hex>"},
+    {"paragraph":{"ordinal":1,"xmlId":null},"start":0,"end":5,"quote":"World","quoteDigest":"<64 lowercase hex>"}
+  ]
+}
+```
+
+It has 2..32 ranges, all sharing the wrapper's exact document, publication,
+blob, extractor, view and part. Ordinals are consecutive and increasing.
+First range ends at its paragraph length, last starts at zero; intermediate
+ranges cover whole paragraphs. Each range verifies its own quote/digest;
+no inserted newline is included in any digest. Empty intermediate paragraphs
+are represented by start=end=0, quote="" and SHA-256 of empty UTF-8; the first
+and last are nonempty. Total quote budget is 16,384 code points and 64 KiB
+UTF-8 for the entire selection. A one-paragraph selection uses docx-range
+only: there is one canonical representation. No auto-merging, cross-story
+selection or clipping. Resolver's locator union and a range chip accept
+either exact kind. An atomic selection fails entirely if any range fails;
+a response never returns only the valid fragments.
+
+`extractor.revision` is the digest of a canonical build manifest containing
+extractor source blob IDs, projection rules revision and locked parser/ZIP
+library versions. The release pins that manifest and independently verifies
+its digest. It is not caller-supplied executable code or a mutable version
+label. Its canonical manifest is exactly `{manifestVersion:1,id,rulesRevision,
+sources,dependencies,formattingProperties}`. id is mosaic-docx-text-v1,
+rulesRevision is integer 1; sources is a path-sorted array of `{path,blob}`
+for every extractor/transitive source input; dependencies is a name-sorted
+array of `{name,version,integrity}` from the lock, including ZIP/XML parsers;
+formattingProperties is a sorted unique array of expanded XML names.
+Duplicate keys/entries refuse. Canonical bytes are compact JSON, UTF-8,
+no BOM/newline, recursively lexicographic ASCII object-key order; strings
+escape only quote/backslash and U+0000..001F (lowercase four-hex \u escapes),
+with other scalar values literal. Arrays preserve the specified sorted order,
+integers are decimal without leading zeroes. revision is SHA-256 of those
+bytes. Independent tooling must reproduce it. Server readiness is derived
+from the verified release artifact containing that manifest and its reviewed
+formatting list, not any human-authored config field.
+Resolver requires that exact available revision; changed extraction
+rules create a new revision, never silently reinterpret an old locator.
+
+A paragraph extraction record is exactly:
+
+```json
+{
+  "part": {"class": "footnote", "name": "word/footnotes.xml", "story": "7"},
+  "paragraph": {"ordinal": 0, "xmlId": null},
+  "textView": "final", "text": "Note text", "length": 9,
+  "textDigest": "<sha256 UTF-8 text>",
+  "anchors": [], "wikiTokens": []
+}
+```
+
+Anchors have the exact shape `{kind,story,offset}`; allowed
+kinds are `footnote-reference`, `endnote-reference`, `comment-start`,
+`comment-end`, `comment-reference`; story is a canonical decimal nonnegative XML
+ID string (`0` or `[1-9][0-9]*`, the same as note/comment locator stories),
+offset a code-point boundary in this record. They never grant
+access to their target. wikiTokens have exactly `{start,end,literal,form,target,label,heading}`.
+form is link/label/heading/embed; label and heading are null except in their
+corresponding form. target is 1..256 code points without `[`, `]`, `|`, `#`,
+control characters or newline; a label/heading is 1..256 code points without
+brackets, `|`, `#`, controls or newline. literal is respectively `[[target]]`,
+`[[target|label]]`, `[[target#heading]]` or `![[target]]`. start/end are exact
+paragraph code-point bounds, including the exclamation for embed. No nested
+forms or combined label+heading/embed variants are interpreted in v1; they
+remain text. Tokens are maximal nonoverlapping complete forms in left-to-right
+order, with their literal equal to the text slice. They are not instructions
+or external links. All text
+and metadata are untrusted document data. Part/story IDs, excerpts and
+comment content never enter system prompts as instructions.
+
+## 4. Story classes and package validation
+
+Version 1 accepts transitional WordprocessingML namespace
+`http://schemas.openxmlformats.org/wordprocessingml/2006/main`, relationships
+`http://schemas.openxmlformats.org/package/2006/relationships`, office
+relationship types rooted at
+`http://schemas.openxmlformats.org/officeDocument/2006/relationships/`, and
+`w14:paraId` from `http://schemas.microsoft.com/office/word/2010/wordml`.
+Prefixes are irrelevant; expanded namespace/local names decide. Strict OOXML
+and unknown alternate-content choices refuse until a separately pinned
+extractor supports them; never guess equivalent namespaces.
+
+| Class | Exact part names | Story selector | Agent exposure |
+| --- | --- | --- | --- |
+| body | word/document.xml | main | final by default, explicit grant |
+| footnote | word/footnotes.xml | w:footnote/@w:id | own story plus owning document grant |
+| endnote | word/endnotes.xml | w:endnote/@w:id | own story plus owning document grant |
+| comment | word/comments.xml | w:comment/@w:id | only explicit comment scope |
+| layout | word/headerN.xml, word/footerN.xml (N positive decimal) | none | denied in v1 |
+| supporting | separately declared non-story document | separate identity | C2 tools/scopes only; no DOCX scope inheritance |
+| opaque | media, styles, numbering, theme, fonts, custom XML, embedded objects | none | no raw bytes through O2 reader |
+
+Body/note/comment ownership comes solely from relationships in that committed
+package, not filenames supplied by a request. A note/comment belongs to one
+DOCX, never the book or an adjacent chapter. Classify reserved notes by
+w:type in {separator, continuationSeparator, continuationNotice}, with any
+canonical signed integer ID (`0` or `-?[1-9][0-9]*`, no plus/leading zeroes),
+not by sign. A normal note has absent type or type normal and a canonical
+nonnegative ID; unknown types refuse. Reserved notes are structural and never
+readable stories. Any document reference to a reserved note refuses, including
+an id-0 continuation separator; the reference must resolve to a normal note. Duplicate story IDs, dangling references or overlapping
+ambiguous comment ownership refuse extraction. Unreferenced comment/note
+stories are not agent-readable. Cross-paragraph comment anchors may be
+recorded, but never concatenate their text with body text.
+
+The root `_rels/.rels` must contain exactly one internal officeDocument
+relationship to `word/document.xml`. Its matching content type is
+`application/vnd.openxmlformats-officedocument.wordprocessingml.document.main+xml`.
+Optional footnotes/endnotes/comments each have at most one matching internal
+relationship and their matching `...wordprocessingml.{footnotes,endnotes,comments}+xml`
+content type. Their relationship targets must be the exact part names above.
+Reject normalized-path aliases, absolute paths, traversal, encoded separators,
+backslashes, duplicate ZIP names, symlink entries, encryption and overlapping
+ZIP data. Never extract ZIP entries onto the filesystem.
+
+Only internal relationships of types officeDocument, styles, numbering,
+settings, webSettings, fontTable, theme, image, header, footer, footnotes,
+endnotes and comments are accepted. Resolve internal targets relative to the
+owning part within the package, reject escape and validate existence/type.
+Reject every external relationship, hyperlink relationship, altChunk,
+attachedTemplate, OLE, package embedding, VBA/macro content type or executable
+part. Textual literal wiki links need no relationship. Unsupported rich
+constructs refuse the agent projection, not the human save: the human can
+retain a full document without it becoming readable to agents.
+
+Parse XML without DTDs, external entities, XInclude or network/file resolution.
+Reject DOCTYPE/entity declarations. Bound before allocation: compressed blob
+32 MiB, total expanded bytes 128 MiB, each entry 16 MiB, 2048 entries,
+expansion ratio 100:1 both per entry and for the total (nonempty expanded data with zero compressed bytes refuses), XML depth 128, 1,000,000 nodes, 100,000 paragraphs,
+1,000,000 code points per paragraph and 10,000,000 per document. Extraction
+has a 5 s host deadline and bounded worker memory of 256 MiB. Exceeding any
+bound yields `editor-document-unsupported`, no truncated success. These are
+initial server safety ceilings, not grants or business quota settings;
+changing them requires reviewed parser evidence. CRC/size mismatches refuse.
+
+## 5. Deterministic reading views
+
+`textView` enum is `final`, `original`, `markup`. Default requests use final.
+Final is the accepted-reading projection, not an accept-changes operation.
+A text run is visible in final iff no ancestor is w:del or w:moveFrom; in
+original iff no ancestor is w:ins or w:moveTo. This ancestor veto applies to
+nested revisions, so an insertion inside a deletion is absent in both final
+and original. Markup includes both in source order with revision spans for
+every revision container (nested spans may overlap). w:t and w:delText use
+the same ancestor rule, never special substring searches. Revision IDs are
+canonical nonnegative decimals; malformed or unmatched move ranges refuse.
+
+Paragraph-mark revisions under pPr/rPr mark only the paragraph boundary,
+not the runs' text. A mark-only w:ins or w:del changes **no projected text**
+in final or original: run content follows the ancestor rule alone. Although
+accepting a mark deletion in Word joins paragraphs, this locator projection
+never merges, splits or renumbers XML paragraphs in any view. It preserves
+the text on both sides as separate ordinal records. In markup a paragraph
+mark contributes a zero-width span at that paragraph's code-point length,
+kind paragraph-mark-insert or paragraph-mark-delete with its revision ID;
+it never becomes a whole-paragraph deletion span. A mark-only insertion's
+text stays in original; a mark-only deletion's text stays in final. Inline
+run revisions remain independent. No view edits or accepts/rejects changes.
+Original/markup and comments require separate scopes, so final body access
+never reveals hidden deletion/comment text. Revision author/date metadata
+is omitted from agent responses in v1.
+
+Closed story/run leaf table (all names in w namespace unless stated):
+
+| Leaves | Text/anchor contribution |
+| --- | --- |
+| t, delText | decoded text subject to view/ancestor rule |
+| tab | U+0009 |
+| br, cr | U+000A, regardless of page/column type; layout kind does not affect offsets |
+| noBreakHyphen | U+2011 |
+| softHyphen | U+00AD |
+| annotationRef | zero text; only allowed in comment story |
+| separator, continuationSeparator, continuationNotice | structural only, allowed only inside reserved footnote/endnote stories; never projected |
+| footnoteRef, endnoteRef | zero text; only in matching note story |
+| footnoteReference, endnoteReference | zero text; matching anchor at current offset with canonical story ID |
+| commentRangeStart, commentRangeEnd, commentReference | zero text; matching comment-start/end/reference anchor |
+| moveFromRangeStart, moveFromRangeEnd, moveToRangeStart, moveToRangeEnd | zero text; validate paired IDs, do not duplicate revision text |
+| bookmarkStart, bookmarkEnd, permStart, permEnd, proofErr, lastRenderedPageBreak | zero text; structural only, never access grants |
+| sym, ptab | refuse requested story (font/position dependent) |
+| fldChar, instrText, delInstrText, fldSimple | refuse requested story, including field results |
+| drawing, pict, object, txbxContent, subDoc, altChunk | refuse requested story |
+
+Leaf validation covers **the entire selected XML part**, including all its
+normal and reserved stories, before any requested story is projected. Reserved
+separator/continuation notes are structurally validated against this same
+closed vocabulary, with separator/continuationSeparator/continuationNotice
+permitted only there, never a readable locator story. Each reserved ID/type
+must be internally consistent; duplicate IDs within a part refuse. A separator
+leaf in a normal note/body/comment refuses. A valid separator in a reserved
+note does not make readable footnotes/endnotes unsupported.
+
+The table is exhaustive for story/run leaves; unknown leaves refuse, including
+nontext leaves not explicitly named. Formatting properties belong only to
+the separately closed manifest list. Anchors/range marks under invisible
+revision ancestors are omitted in that view but still structurally validated.
+Comment author data and ACL-like Word permission markers never supply Mosaic
+authority. Unknown extension/AlternateContent text is unsupported, not ignored.
+
+Walk direct story paragraphs and table cells in XML order, including nested
+tables in their containing cell order. Paragraph ordinals do not change with
+view. Concatenate visible text across adjacent runs with no invented spaces.
+Preserve decoded Unicode as stored: no NFC, case folding or whitespace
+collapse. xml:space text remains
+literal. Offsets count Unicode scalar values, not UTF-16 units or graphemes;
+unpaired surrogates/invalid XML characters refuse. Field instructions,
+hidden/vanished text and text boxes are not silently omitted: their presence
+in a requested story makes v1 projection unsupported. Field results and
+unknown semantic text-bearing elements likewise refuse until specified.
+The projection traverses only these containers in the w namespace:
+body, footnote, endnote, comment, tbl, tr, tc, p, r, ins, del, moveFrom,
+moveTo, smartTag and sdtContent. A document root wraps body; note/comment
+part roots wrap their corresponding stories. sdt may contain sdtPr (ignored
+properties) and sdtContent only. Hyperlink containers are unsupported even
+without a relationship. Unknown text-bearing containers refuse. Nontext
+subtrees pPr, rPr, tblPr, tblGrid, trPr, tcPr and sdtPr may be ignored only
+if they contain no story text elements, field codes, external references,
+objects or unknown namespaces. Structural-leaf behavior is defined only by
+the closed table above. w:sectPr is layout-only, with relationship targets
+validated normally.
+Formatting-property descendants are a closed W4b release artifact: its full
+expanded-name list is included in the extractor manifest and independently
+reviewed before enablement; any name absent from that list refuses. This
+artifact can narrow the allowed property subtrees, never add a text-bearing
+container to this v1 contract. Missing artifact is no readiness, not a
+permissive descendant-text scraper.
+
+Reference marks contribute anchors at the current text boundary, not invented
+note numbers or inline comment bodies. Each note/comment is separately paged.
+A single range cannot straddle a view, paragraph or story; the selection wrapper
+may cover contiguous paragraphs only under section 3. Extract literal
+`[[target]]`, `[[target|label]]`, `[[target#heading]]` and `![[target]]`
+after concatenating visible runs within one paragraph, so split-run tokens
+survive formatting changes. Preserve complete literal bytes as UTF-8 after
+XML decoding and code-point start/end; never follow OS paths or external URLs.
+Targets resolve only via the host's owned-document resolver, with independent
+authorization; unresolved targets stay literal and marked unresolved in human
+UI. No link parsing grants reads. Nested/unclosed bracket sequences remain
+plain text, and tokens cannot cross paragraph/view boundaries.
+
+## 6. Reading APIs, verification, paging and staleness
+
+These are proposed typed tool schemas over the existing runner socket, not
+native WordCraft MCP. Caller/session/business come from the bound broker.
+Agents cannot override them using object fields.
+
+- `editor_read_committed({project,document,version,textView,part,cursor,limit})`:
+  project, document, version and part are required; only textView, cursor and
+  limit may be omitted. version is exactly `{mode:"latest"}` or
+  `{mode:"commit",commit}`; part is
+  one class/name/story triple above; textView defaults final; cursor is null
+  on first page, limit 1..100 (default 20). No path, blob or draft argument.
+- `editor_resolve_citation({locator})`: verify the exact immutable range;
+  it does not search for a nearby quote. Return exact quote and locator plus
+  `currentCommit` and `stale` after current authorization.
+- `editor_flag` is W5's metadata-only write; W5 must validate the same
+  locator before storing a flag and may not write into the document.
+
+Read response is exactly `{version:1, business,project,document,commit,blob,
+extractor,textView,part,rows,nextCursor,currentCommit,stale}`. Each row has the
+extraction record above. The public envelope contains no absolute paths or
+raw package attributes. `nextCursor` is null at end; `currentCommit` is the
+current published document commit; stale is exactly commit != currentCommit.
+A resolver response is exactly `{version:1,locator,currentCommit,stale}`:
+the verified quote is the locator's quote, with no separate unverified text.
+There is no default "first part" or automatic descent into notes/comments. The broker-bound business must equal
+locator.business; a mismatch is editor-access-refused before object lookup.
+Markup additionally requires `revisionSpans` on each
+row: array of `{kind,id,start,end}`, kind insert/delete/move-from/move-to/
+paragraph-mark-insert/paragraph-mark-delete (mark spans have start=end),
+with null-free canonical decimal IDs and valid boundaries; other views omit
+that key. Limits cap output at 64 KiB UTF-8 JSON per response, including envelope and cursor. End a page before the first complete
+row that would overflow, and return a cursor for that row. This is normal
+paging, not partial-row success. If that first row cannot fit even on an
+otherwise empty page, return editor-range-too-large with no text. Such a
+paragraph is unsupported for agent reading in v1; no subrange read exists.
+A human-visible "paragraph exceeds agent reading limit" reason appears only
+after authorization. The human editor/save is unaffected. All empty paragraphs
+still produce rows and advance the cursor. No page can return the same cursor
+without progress.
+
+Cursor is a host-authenticated opaque token binding principal, session,
+project/document, commit/blob, extractor, view, part, next ordinal, the complete
+authority revision vector defined in section 7 and expiration (5 minutes). It carries no plaintext content.
+Tampering, reuse by another session, wrong request parameters or a revoked
+scope refuses. A latest cursor continues its captured snapshot with stale
+metadata if a save intervenes; starting again with null cursor returns the
+new publication. Cursor is not a capability and grants are rechecked every
+page. Repeated ordinal ranges are stable within one committed projection.
+
+Resolver steps: authorize the current principal tuple, live scopes and exact/historical share (there is no separate undefined historical-view scope); load
+that commit's manifest/blob; validate package; run the exact pinned extractor;
+select exact part/story/ordinal and mandatory XML-ID value; select code-point range;
+require literal quote equality and SHA-256(UTF-8 quote) equality. Require both
+blob and commit membership, not digest alone. Any mismatch refuses
+`editor-citation-invalid` without guessed text. After newer publication the
+old valid locator returns `stale:true` with old text; it never auto-relocates
+to identical paragraphs or another note. Jump opens that committed view with
+an explicit old-version label. If current grant no longer allows it, even
+old quote resolution refuses and the UI hides cached content.
+
+Errors: `editor-context-unavailable` for missing readiness; `editor-access-refused`
+for absent ownership/grant/share (same response for nonexistent or foreign IDs);
+`editor-document-unsupported` for parser limits or unsupported features after
+authorization; `editor-version-unavailable` for authorized missing history or
+extractor; `editor-citation-invalid` for locator/quote mismatch;
+`editor-cursor-invalid` for invalid paging; `editor-range-too-large` for size.
+The exact refusal envelope is `{ok:false,error:{code,message}}`; code is one
+of those enum strings or editor-policy-conflict/editor-sharing-unsupported
+(both 409, defined in section 7), and message is fixed server text for that code (no user
+input). Both missing/foreign and ungranted IDs use the same code/message/status
+403. Syntax errors before identity lookup use editor-citation-invalid, 400;
+context unavailable is 503, cursor-invalid 400, version unavailable 409,
+unsupported/range-too-large 422. Successful tools return `{ok:true,result}`
+where result is the defined response; errors never include result/partial
+rows. Return no source text, XML, path or untrusted parser error in refusals.
+
+## 7. Authority data, dedicated sessions and sharing
+
+### 7.1 Scope and principal records
+
+O2 context is permitted only in newly created **O2-dedicated conversations
+and execution sessions**. Existing C2 threads/sessions cannot be converted,
+attached to O2 context or resumed/forked into O2 mode; new IDs and a fresh
+empty context are mandatory. There is no mixed-thread turn. The UI offers
+"Open dedicated writing conversation", never silently changes an existing
+chat's permissions. Existing C2-02 supporting-doc writes and C2-06 replies
+retain their semantics. The narrowing below belongs only to this explicitly
+opted-in O2 mode, closing review M1 without a Case 2 amendment. It changes
+neither the Case 2 schema nor the meaning of its replies/line citations.
+
+Authorization principal is a tuple, not a seat's display name:
+`{business,human,agentInstance,conversation,executionSession}`. human is the
+stable authenticated identity that owns the O2 conversation; agentInstance
+and executionSession come from its bound broker run. The request cannot
+supply/replace them. All human readers and all agent lookups require live
+R5 project/universe access plus the O2 grant below; role files grant the
+operation only. The business owner is not an implicit reader of someone
+else's private conversation. A viewer can read only their authorized human
+view, never write a share/settings change or invoke an agent by sharing.
+An owner/collaborator with current project write access may share within
+their own readable O2 scope. Agent scope and sharing human scope intersect;
+a human cannot share a part or view they lack.
+
+O2 scopes live in the new append-only bus table writing_access_events, not
+access.json or role-file wildcard changes. Proposed human-only verb
+`editor.access.set({project,document,subject,scope,expectedRevision})` takes
+subject exactly `{kind:"human"|"agent",id}`; agent id is the business's
+bus agent **instance ID**, equal to principal.agentInstance, never a role
+definition ID or a seat display name. scope is exactly
+`{enabled,parts,views,history,mayShare}`. parts is a sorted unique nonempty
+subset of body/footnote/endnote/comment (all stories within the selected
+class); views is a sorted unique nonempty subset final/original/markup;
+history and mayShare are booleans. mayShare must be false for agent subjects.
+enabled=false revokes all access; even its otherwise populated scope cannot
+authorize. No wildcards or implicit note/comment inheritance. A comment
+requires parts including comment and the requested view. history=true permits
+older publications subject to a matching share; history=false permits only
+the current publication. The document is always explicit.
+
+Only the existing business-owner human proof may write these policy grants,
+through the existing trusted human CLI or authenticated write-enabled Console
+transport, with the existing origin/session/proof checks. No new proof file,
+caller or exemption. Not tester, agent, viewer or collaborator policy writes.
+Sharing and scope are different: an authorized collaborator may send context
+but cannot change grants. expectedRevision is the latest sequence for that
+business/project/document/subject, zero when none. Compare, append and audit
+are atomic; conflict returns editor-policy-conflict (409, fixed message).
+Receipt is `{ok:true,result:{id,revision,previousRevision,scopeDigest}}`, where
+revision is the appended seq, id is host-generated, and scopeDigest is SHA-256
+of canonical scope JSON using section 3 serialization. Missing grant denies.
+
+Each access decision records an authority vector exactly
+`{restoreEpoch,humanAccess,agentAccess,projectAccess,threadAccess,sharingPolicy,share}`.
+humanAccess and agentAccess are the respective latest writing_access_events
+seq values; projectAccess is the existing R5 access revision; threadAccess
+is the latest O2 conversation membership-event seq; sharingPolicy is the
+latest writing_policy_events seq; share is the exact writing_shares seq.
+restoreEpoch is the independent restore-fence epoch in section 7.5.
+Missing inputs deny rather than zero-default except initial policy explicitly
+materialized by the human writer as the default. A cursor binds every value;
+any change invalidates it. Each new lookup reevaluates rights, including a
+revocation between asynchronous extraction and response emission.
+
+### 7.2 One human per context; settings and chip requests
+
+An O2 conversation has exactly one owner human and one agent instance. No
+second human joins it in v1: a thread-share attempt refuses
+editor-sharing-unsupported (409), rather than borrowing the sender's grants
+for someone else. A second human starts a separate O2 conversation, supplies
+their own grant/share and gets no previous content. This is a new O2 mode,
+not a restriction on existing C2 sharing. Human and agent must still have
+matching business/project/universe rights. Read-only previews cannot send.
+
+Human-only `editor.sharing.set({conversation,mode,expectedRevision})` is
+available only to that authenticated owner with current write access over
+the same trusted write transports. mode is off/visible-chip-per-send/
+conversation-current. It atomically appends writing_policy_events and returns
+`{ok:true,result:{id,revision,previousRevision,mode}}`. Default is the explicit
+visible-chip-per-send policy on new conversation creation. Selecting off
+immediately invalidates **all** prior shares, reads, resolves and cursors for
+that conversation, not only new sends. Selecting another mode later does
+not revive shares from the earlier policy revision. No pin changes a mode.
+
+In visible-chip-per-send the human sends exactly
+`{conversation,message,expectedPolicyRevision,chip}` via the human send path.
+message is human-authored free-chat text; W4b's bounded human API handles it,
+never an agent-supplied impersonation. chip is null or one of:
+
+- `{kind:"range",document,baseCommit,selection}` where selection is one
+  docx-range/docx-selection locator, with its business/project/document/
+  commit equal to the server-owned conversation/document and baseCommit.
+- `{kind:"document",document,baseCommit,parts,views,history}` selecting a
+  whole-document **exact publication**, with explicit part/view lists and
+  history boolean constrained by both grants.
+
+Both chips require a server-issued human editor selection token as an
+additional required `selectionToken` key. It binds authenticated login,
+conversation, document, baseCommit, saved editor model revision, and either
+exact locator or whole-document scope digest, expires in 2 minutes and is
+single-use. The human editor adapter creates it only after exact mapping to
+the committed projection. The request supplies no draft text or engine path
+for mapping; mismatched/edited selection fails locally and server-side.
+A stale base or document change before send refuses, requiring a fresh
+visible chip; an old citation remains resolvable through its already-sent
+share while authorized. Null chip sends no editor context. Before readiness,
+the chip says unavailable and sends no document ID, title, path or selection.
+
+A range share permits only editor_resolve_citation for that exact locator
+(or a range wholly contained within it with newly verified quote/digest).
+It always refuses editor_read_committed, since rows would expose surrounding
+text. A document exact share allows paging only its named publication,
+parts/views; it never grants future saves. No implicit body-to-note/comment
+or final-to-markup expansion occurs.
+
+conversation-current is an explicit human policy with a persistent visible
+indicator and a required whole-document chip. The same chip fields bind
+baseCommit and scope, but the share record has versionMode=latest: baseCommit
+is the acknowledged publication at issuance, not a future-version ceiling.
+The next authorized latest lookup after Saved follows currentCommit within
+the granted part/view/history bounds. This exception to exact-version sharing
+exists only in this explicit mode. Range chips are refused in this mode,
+not silently upgraded. Pins and earlier exact shares never become latest.
+
+Latest shares expire on explicit policy revocation, owner grant loss, O2
+conversation close or **execution-session end/clear**. This means the new
+O2 execution session, not the Console login, bus connection or a C2 thread
+session. Relaunch/clear requires a fresh chip; a dropped socket/login does
+not silently widen or prolong one. Exact shares may remain verifiable across
+execution sessions through their same human conversation while live policy,
+history permission and grants hold, but never supply replay context to a
+new agent session without a new share. Their scope is citation verification
+only after the issuing execution session ends. No cross-human context reuse.
+
+### 7.3 Stored share schema
+
+The immutable writing_shares payload is exactly
+`{version,id,restoreEpoch,business,project,document,conversation,executionSession,message,
+human,agentInstance,mode,versionMode,baseCommit,blob,extractor,scope,selection,
+authority,policyRevision,issuedAt}`. version=1; IDs use section 3 grammar;
+mode is the policy at issuance; versionMode is exact/latest; baseCommit/blob
+are the acknowledged snapshot and extractor is its exact pinned revision.
+scope is `{parts,views,history}` as above; selection is the verified locator
+for a range, otherwise null. authority is the complete revision vector at
+issuance; its share field equals this row's seq (assigned atomically).
+restoreEpoch must equal authority.restoreEpoch and the live independent
+fence. issuedAt is canonical UTC millisecond ISO timestamp. policyRevision equals
+authority.sharingPolicy. message names a new writing_messages row, not a C2
+message. A unique `(conversation,message,document)` constraint and operation
+idempotency key prevent duplicate grants on retry. No user-provided human,
+agentInstance, authority, issuedAt, blob or share id is accepted.
+A scope decrease/revocation denies even historical shares; an unrelated new
+policy revision also invalidates prior policy-bound shares. A human who
+needs them again explicitly reshares. Missing session/share is no context.
+
+### 7.4 Dedicated storage and every output surface
+
+Every turn receiving O2 context runs with the new O2-only allowlist of
+read/resolve/flag plus its dedicated conversation reply. No generic file,
+shell, git, supporting-doc writer or arbitrary outgoing tool is available.
+This narrows only new O2 sessions, never C2 turns. All agent output from such
+a turn is conservatively O2-derived; it stays in the dedicated conversation
+with the union of the document provenance/scopes. No semantic quote detector
+or agent self-labelling supplies this boundary. Human text and titles in that
+conversation use the same dedicated storage, so a human pasting an O2 passage
+cannot accidentally route it into an old renderer. O2 replies never enter
+C2-06 processing. An O2 flag is metadata stored by W5, not a story edit.
+
+| Existing surface | Required O2 behavior |
+| --- | --- |
+| threads/<business>/<thread>/session and claude-projects | no O2 content, prompt, model transcript, title or derived reply |
+| threads/<business>/<thread>/sessions/<session>/session and claude-projects | same; O2 mode never binds these native stores |
+| session-workspaces/<business>/<instance>/<session> | no O2 text or exports; no store mount |
+| launches/<business>/<run> including bundle, turns, runner.log and session | opaque IDs/status only, never O2 prompts/output; host transient O2 adapter instead |
+| bus events, messages, message_threads and existing sessions rows | no O2 text/titles/quotes; only fixed readiness/status audit with opaque IDs if needed |
+| Console legacy thread view | no O2 rows; dedicated writing view reauthorizes every read |
+| CLI thread, talk, follow and raw-session tools | no O2 content; unsupported mode refuses, not generic rendering |
+| Discord journal.mjs/context.mjs and control-board Discord delivery | no O2 conversation subscriptions/context/output; fixed unavailable notice only |
+| <dataRoot>/runs write-once evidence | never O2 text, prompts, titles, excerpts, stdout/stderr or derived output; only opaque run status |
+| bus-host/sessions.json, launch logs and activity projections | IDs/liveness only, no document or conversation title |
+
+Host-only `<dataRoot>/writing-context/` (0700 owner, no generic mount/remote)
+holds the immutable dedicated message/share objects defined below, transient
+O2 adapter material and any unavoidable encrypted native transcript. Object
+files are regular 0600 owner files, no symlink/hardlink aliases. This is an
+O2-classified content store; it is never included in the bus release backup,
+post-attempt store, stack-copy, rehearse input or generic backup. Revocation
+changes permission at read time, never rewrites a write-once run record. It is keyed to O2 session, not an alias/symlink into seat stores.
+Release readiness requires an independently tested adapter that prevents
+plaintext native persistence/logging outside this boundary, including crash
+and timeout paths. If either Pi or Claude cannot meet it, that harness's O2
+tools stay off; do not expose the session then attempt post-hoc redaction of
+write-once run records. Readiness is per adapter. No O2 text enters immutable
+legacy evidence, even briefly. Stored dedicated replies are authorized afresh
+at read time; live grant loss hides cached UI content and prevents prompt
+replay/fork. Revocation cannot erase already delivered knowledge and the UI
+must not promise that it can.
+
+O2-derived exports, extraction indexes, caches, previews, source copies and
+git history retain document classification outside generic roots and C2
+library mappings. O2 repositories have **no git remotes**. No push, mirror,
+fork, plaintext backup or remote replication of an O2 repository is allowed,
+including through human credentials; no seat Gitea account can discover,
+list, fork or clone one. Backup transport is out of scope and disabled, not
+an implied exception. Stack-copy/release copies source code and extractor
+artifacts only, never writing/, writing-context/, writing-control/, O2 content
+objects, exports or repository object directories. The separate release bus
+backup retains metadata rows only, under the private-store rules below;
+it is not a source copy or permission to read context. No raw O2 Gitea grant may be minted.
+Validate absence of remotes at store creation, before save/read and activation;
+a new remote or object alternate disables O2, rather than trusting a read-only
+mount. Symlinks, hardlinks, alternate worktrees and parent mounts must not
+expose it to generic tools. Native engine APIs remain human-only.
+
+### 7.5 Named migration and rollback contract
+
+W4b adds the following new STRICT append-only bus tables (seq INTEGER primary
+key, at TEXT canonical timestamp, id TEXT unique, all other fields NOT NULL
+unless stated). Each row also has restore_epoch TEXT NOT NULL, equal to the
+independent current fence epoch at write time. Every update/delete/replace
+refuses; latest seq **within that epoch** is state.
+JSON columns contain the exact canonical schema named above, not arbitrary
+unvalidated JSON. No existing C2 messages/events/sessions column changes.
+
+| Table | Additional columns and key |
+| --- | --- |
+| writing_access_events | business TEXT, project TEXT, document TEXT, subject_kind TEXT (human/agent), subject_id TEXT, by_human TEXT, previous_revision INTEGER, scope_json TEXT, operation_id TEXT UNIQUE; latest per document/subject |
+| writing_conversations | business TEXT, project TEXT, owner_human TEXT, agent_instance TEXT; one creation row per id, private O2 identity only |
+| writing_conversation_events | conversation TEXT FK, op TEXT (close), by_human TEXT; latest membership/close revision, creation seq is initial threadAccess |
+| writing_execution_sessions | conversation TEXT FK, execution_session TEXT UNIQUE, adapter_revision TEXT; no native transcript path |
+| writing_session_events | execution_session TEXT FK, op TEXT (end/clear), by_principal TEXT; terminal event invalidates latest shares |
+| writing_policy_events | conversation TEXT FK, mode TEXT, by_human TEXT, previous_revision INTEGER, operation_id TEXT UNIQUE |
+| writing_messages | conversation TEXT FK, execution_session TEXT FK nullable for human-only messages, from_kind TEXT (human/agent), from_id TEXT, content_ref TEXT, content_digest TEXT, operation_id TEXT UNIQUE |
+| writing_shares | conversation TEXT FK, message TEXT FK, document TEXT, payload_ref TEXT, payload_digest TEXT, operation_id TEXT UNIQUE; UNIQUE(conversation,message,document) |
+
+Each table also has business/project columns if not otherwise listed; FK and
+application checks require agreement, not just ID existence. The canonical message content object is exactly `{version:1,business,project,row,nonce,body,provenance}`:
+row is the owning writing_messages row ID; nonce is fresh cryptographically
+random 32-byte lowercase hex, stored only inside the private object, not its
+metadata backup. body is
+the complete human/agent message string; provenance is an array of `{document,share,commit,blob,extractor}`,
+sorted by document/share; every entry requires live scopes. The share content
+object is exactly `{version:1,business,project,row,nonce,payload}`, where row
+is its writing_shares row ID, nonce has the same fresh/private rule, and
+payload is the full section 7.3 record including any quoted selection.
+Neither message bodies nor share payloads/quotes enter bus.sqlite, WAL,
+events, SQL error logs or backup manifests. Human messages with no O2
+attachment have provenance=[] but use the same private content store.
+content_ref/payload_ref are opaque 64-hex object names, not paths; their
+corresponding digest equals SHA-256 of the exact canonical UTF-8 object.
+Objects reside at writing-context/objects/<business>/<row>/<digest>.json;
+row/business/project must match both reference metadata and the authorized
+caller. No cross-business or cross-row deduplication; retention is per owning
+row and cannot delete another business's object. The private random nonce
+prevents a metadata digest from confirming a guessed short body. No remote or
+release-backup copy. Write/flush the immutable object before committing its
+bus reference. A failed transaction leaves only an inaccessible orphan,
+never a visible partial message/share; a missing or mismatched object refuses.
+Object reads always require current authority, not knowledge of a digest.
+No
+existing renderer queries these new tables; generic bus recordEvent and
+recordTask cannot write their rows. Access/policy/shares use only the trusted
+handlers and atomic transactions. Grant seq values are table-specific, with
+kind-qualified revision vector fields; never compare unrelated seq counters.
+
+Sage allocates the schema edge; migration creates these empty tables and
+triggers, with no backfill/conversion of C2 citations, messages or raw sessions.
+Production adoption stays refused. The writer registers new documents without
+creating grants; the owner explicitly sets both human/agent document scopes.
+O2 session creation and its default policy are one atomic operation behind
+owner write proof; receipt `{id,executionSession,policyRevision}` contains no
+content. No legacy thread/session can be attached by guessed ID.
+
+Old release rollback must not render O2 data. The new store schema version
+normally makes old binaries refuse opening it, but security does not depend
+on that: even a restored pre-W4b database reader can see only its unchanged
+legacy tables with no O2 content. O2 messages/share/provenance remain in new
+tables, never a tagged body in existing messages. Activating a pre-W4b copy
+disables O2 context, never converts dedicated conversations to C2 or exports
+transcripts for compatibility. O2 repositories/stores remain outside copies.
+A rollback probe uses recognizable secret fixture text in O2-only content objects,
+then invokes old Console/CLI/Discord/raw-session renderers: none may emit it,
+its title, quote or prompt. No live rollback is part of acceptance testing.
+
+#### Release backup, restore counting and independent revocation fence
+
+The existing release behavior must be explicitly accounted for: at this base
+`scripts/stack-release.sh:474-493` copies bus.sqlite into
+`<dataRoot>/backups/stack/<ACT>/bus/`; restore_store at :498ff moves current
+bus/ to `<dataRoot>/bus.post-attempt-<stamp><suffix>/`. rehearse reads backup
+stores, and release never prunes them. These paths remain **O2-classified
+metadata stores** even though content/quotes are outside SQLite. Directories
+are 0700 owner and files (including SQLite/WAL/SHM if present) 0600 owner,
+with ownership, symlink/hardlink and generic mount checks. No remote, mirror,
+seat token access or generic export. rehearse may read metadata for validation
+only and cannot load content objects, emit quotes or restore readiness.
+
+Release does not silently delete evidence. A separate explicit human/ops
+retention action may prune a stopped backup/post-attempt tree only after
+checking it is not the selected recovery set or needed restore evidence,
+recording its IDs/digests and a prune receipt. No automatic age-based prune,
+no editing of retained metadata, no pruning runs/ under this policy. Until
+that separately reviewed action exists, keep these private local metadata
+trees indefinitely; it grants no content access. writing-context objects
+have a distinct reviewed retention process and are never backed up by release.
+
+W4b owns the release guard changes, not a follow-up: all eight writing_*
+tables above join COUNTED in scripts/stack-release.sh:420 and the T46 table
+classification in packages/cli/tests/stack-release.test.mjs:913. They are
+non-event writers, not classified as ignorable tables or double-counted as
+generic events. Jason's existing exact --events N confirmation remains
+required when the combined post-backup row count is nonzero. A restore plan
+also compares writing row identities with the proposed source store; equal
+aggregate counts cannot conceal a dropped revocation replaced by another row.
+A schema with any unclassified writing_* table refuses restore readiness.
+
+An **independent host-private fence** lives outside bus/ and every backup:
+`<dataRoot>/writing-control/restore-fence.json`, directory 0700, regular file
+0600, no links/mounts/remote/source-copy/rehearse access. Its exact schema is
+`{version:1,epoch,restoreOperation,droppedRowsDigest,confirmedBusinesses}`.
+epoch is a host-generated opaque ID; restoreOperation is null before the
+first restore, otherwise a host-generated opaque operation ID; droppedRowsDigest
+is SHA-256 of the canonical sorted dropped `(table,id)` list (empty allowed);
+confirmedBusinesses is a sorted unique array of authenticated business IDs.
+Only the trusted release controller and existing owner-proof handler write
+it by durable atomic replacement; agents/testers/request paths cannot.
+It is not a human-editable readiness setting: verified release readiness is
+still required, and this file is an additional independent deny fence.
+
+**First creation:** the compatible release controller durably creates the
+fence as part of W4b's first schema migration, before committing those empty
+tables or enabling any handler. It uses a fresh epoch, restoreOperation=null,
+droppedRowsDigest=SHA-256 of the canonical UTF-8 empty JSON array `[]`, and
+confirmedBusinesses=[]. Every initial writing row uses that epoch. A normal
+never-restored store does **not** require editor.restore.confirm: the
+confirmation gate applies only when restoreOperation is non-null. Initial
+live grants/shares and verified artifact readiness are still mandatory.
+
+Initialization is allowed only when the pre-migration schema has no writing_*
+tables/history and there is no existing fence. If a crash leaves a durable
+initial fence but the schema transaction uncommitted, migration resumes with
+that same epoch, not another initial state. If writing tables/history exist
+and the fence is missing/malformed, fail closed; never repair by creating a
+new initial fence. Creating an initial fence is not a way around a previous
+restore or revocation. W4b acceptance exercises both migration crash orders.
+
+Before **any** store swap/restore (not just one with nonzero counts), the
+current compatible controller durably creates a fresh epoch, records dropped
+writing rows and clears confirmedBusinesses. If fencing fails, restore
+refuses before changing bus/. A crash anywhere keeps O2 denied. Old snapshot
+rows have old restore_epoch; they cannot authorize even if their grant,
+policy or share says enabled. Automatic failure recovery and rehearse-driven
+restore use the same fence. Normal code rollback without store restore
+keeps the fence and leaves O2 off on incompatible code. A pre-W4b controller
+is not allowed to restore an O2-enabled data root: the active controller's
+capability preflight refuses it; operations must use the compatible restore
+controller even when the target runtime is old.
+
+After restore, the verified W4b runtime remains unavailable for O2 in every
+unconfirmed business. New human-only
+`editor.restore.confirm({expectedEpoch})`, under the business owner's existing
+trusted human proof, acknowledges that business in the independent fence
+and returns `{ok:true,result:{business,epoch,confirmed:true}}`. It restores
+**no old grant/share/policy/conversation**. Fresh current-epoch grants,
+a fresh dedicated conversation/default policy and fresh human chips must
+be created explicitly. Past rows may be inspected by an authorized recovery
+operator as metadata, but never used as current authority or prompt replay.
+Every read/resolve/cursor/share checks matching restore_epoch and, when
+restoreOperation is non-null, that business's explicit confirmation; old object bytes remaining on disk are not capabilities.
+Thus even owner confirmation cannot revive a previously revoked old share.
+Missing/malformed fence state denies O2. This current-epoch file does not
+claim to detect a privileged manual rollback of both fence and database;
+the supported restore protocol never restores the fence from a backup and
+always rotates it first. A same-uid operator bypassing that protocol is not
+a boundary this file can prove. --events N approves a
+store operation only and is never a substitute for this recovery protocol.
+
+Acceptance seeds a secret in a content object and a share, takes a backup,
+revokes access/sharing, then restores the backup with explicit row-loss
+approval: the old share stays refused before and after owner confirmation;
+a new grant/conversation/chip is needed. Sweep bus.sqlite, WAL/SHM, every
+backups/stack and bus.post-attempt-* tree, rehearse output and release logs:
+no secret/title/quote/body marker may appear. Only the explicitly named
+private writing-context content object may contain it. Verify COUNTED/T46
+covers each table and simulate failure before/after each fence/store step.
+
+The XML/ZIP parser safety ceilings and absence-of-remote checks apply to
+human store ingestion too where needed to prevent path escape and remote
+replication; a projection-unsupported rich feature alone does not reject a
+valid human save. Parser refusal codes have a fixed human-readable reason
+category, never raw XML or a misleading empty context. Fields/hyperlinks/
+text boxes may make real chapters agent-unreadable in v1; the UI explicitly
+says this and never claims an empty successful projection.
+
+Every extractor revision referenced by retained publication history or shares
+is retained as a verified immutable host artifact. An activation missing one
+refuses O2 readiness (no silent citation downgrade), including rollback to a
+W4b-era release that drops a revision. A pre-W4b release can run with O2 wholly
+off and cannot read those records. Retiring revisions requires a separately
+reviewed retention/prune operation for all dependent O2 history/shares; not
+an automatic stack-copy cleanup. Artifact caches are not authorization caches.
+
+## 8. Acceptance matrix and release evidence
+
+Each row needs a named fixture/test and a mutant or bypass probe in W4b's
+packet. Independent fixtures construct OOXML directly and recompute Unicode
+slices/digests outside the production extractor. Security checks fail closed;
+no fixture-only readiness flag may exist in production APIs.
+
+| ID | Evidence required | Negative control / bypass |
+| --- | --- | --- |
+| A01 | Exact body quote independently recomputed from commit/blob/revision | change quote, digest, blob, commit or extractor; each refuses |
+| A02 | Two identical paragraphs and notes have different locators | no content-search relocation; swapped ordinal/story refuses |
+| A03 | XML ID absent/duplicate and ordinal behavior | missing/mismatched paraId cannot silently choose another node |
+| A04 | Emoji, combining characters, tabs, breaks and split runs | UTF-16 offsets, normalization and whitespace collapse fail |
+| A05 | Literal split-run wiki forms retained | no path/URL fetch; malformed/cross-paragraph tokens stay text |
+| A06 | Final/original/markup independently verified with moves/deletions | final-only grant cannot read deletion/comment; no document rewrite |
+| A07 | Body/note/endnote/comment exact ownership | orphan/dangling/cross-document references and duplicate IDs refuse |
+| A08 | Package allowlist, aliases, CRC, XML/ZIP limits | external rel, macro, traversal, symlink, entity, ZIP bomb and timeout refuse |
+| A09 | Commit snapshot and publication ordering | next latest after Saved gets new commit; no worktree/draft fallback |
+| A10 | Historical resolve stale label | old quote stays old; removed grant/history refuses without text |
+| A11 | Pagination complete/deterministic and bounded | tampered/foreign/revoked cursor and oversized row refuse |
+| A12 | Cross-user/business/project/universe denial | guessed IDs, same blob elsewhere and copied document grant nothing |
+| A13 | Visible range chip exact boundaries and default off before gate | no selection/title/path metadata before readiness; draft mapping refused |
+| A14 | Every lookup intersects live grant and share | pin, old send, revoked scope and range-to-whole-document escalation fail |
+| A15 | Whole-document latest share explicit; save rechecked | exact share cannot reveal future edits; persistent policy visible |
+| A16 | Generic file/search/git/export/index paths denied | source copy, symlink, hardlink, alternate object root and new O2 copy probes |
+| A17 | Raw session, fork/resume and transcript boundaries | revoked context cannot replay via raw tool or harness history |
+| A18 | Agent tools exactly read/resolve/flag after gates | native MCP, execute, save, replacement and story comment writes refuse |
+| A19 | Existing C2 Markdown reads/line cites unchanged | no DOCX-as-lines conversion or redirect following adoption |
+| A20 | Adoption gate before/after readiness and Q36 disposition | absent/revoked server readiness and required notice readiness refuse |
+| A21 | Human full-feature save remains separate | unsupported projection yields no agent context, never lossy human save |
+| A22 | Scope revocation during extraction | final pre-emission check prevents async stale-authority leak |
+| A23 | Sibling chapter save | currentCommit/stale/cursor for untouched document remain unchanged |
+| A24 | Full page and oversized paragraph | end before overflow; first oversized row refuses without text; no unreachable subrange claim |
+| A25 | No O2 git remote or release copy | seat Gitea list/fork/clone fails; configured remote/object alternate disables O2; copies exclude stores |
+| A26 | Every section 7.4 store/renderer | secret marker absent in each named legacy store, raw session, CLI/Discord/Console view and runs/ |
+| A27 | Pre-W4b rollback reader | new O2 rows never rendered through legacy tables; missing retained extractor disables O2 |
+| A28 | Dedicated mode vs C2 | mixed attachment/resume/fork denied; unchanged C2 supporting writes/replies fixtures pass |
+| A29 | Two humans/viewer/grant revisions | viewer cannot share; second human cannot join or reuse context; all cursor authority fields checked |
+| A30 | Canonical schemas and complete selections | unknown keys, inconsistent ranges, xmlId null mismatch and noncanonical story IDs refuse |
+| A31 | Closed leaf/revision table | every leaf/nested rule; mark-only deletion keeps text in final, mark-only insertion keeps text in original; markup mark spans zero-width; Word -1 separator/0 continuation-separator and older 0/1 reserved layouts validate, references to them refuse |
+| A32 | Initial migration and revocation/restore | initial null-operation fence needs no restore confirmation but no grant is implicit; non-null restore fence needs confirmation and fresh authority; all tables counted/classified; old share stays refused; crash/backup-marker sweeps |
+
+Implementation acceptance includes writing, bus, harness, business, WebUI,
+seat mount/import closure and stack-copy/release fixtures; explicit production
+adoption refusal/lift tests; independent parser/policy/tool review; G1 and
+Sage's allocated schema edge. Evidence must name skips and refuse enablement
+when an acceptance guard was not exercised. W4's review alone lifts nothing.
+
+## 9. Handoff and unresolved decisions
+
+Megavolt reviews this separate document and records a verdict in
+`docs/reviews/2026-10-22_q195-docx-citations.md`. Revisions repeat direct
+commit/blob handoff to Megavolt and Sage. Q36 remains with Jason through Mos;
+no adoption, C2 reader/reply notice change or schema reinterpretation ships
+on this document. W4b's brief must allocate ownership for every surface in
+A16/A17 and section 7.4 before code: an unowned enforcement path is a blocker, not a deferred security
+note. No live files, editor source imports, parser execution or tests were
+used to write this design.
+
+## Round 2 changes against review 08fcb8c1c
+
+B1: exact selection wrapper, canonical paragraph identity, wiki/anchor schema,
+chip/share and refusal records; ordinal-primary D25 refinement explicit.
+B2: closed leaves and nested/paragraph-mark revision rules. B3: per-document
+publication sequence and sibling-save acceptance. B4/B5: concrete append-only
+authority, human proof, exact/latest share policy, revision vector and
+single-human dedicated session lifetime. B6: complete-row paging; oversized
+paragraph unsupported, no circular subrange API. B7: no remotes/backup push,
+seat token and copy probes. B8: named native stores, renderers and immutable
+run evidence, with O2-only storage/adapter readiness. B9: tables/columns,
+rollback separation and extractor retention. M1: dedicated O2 conversations
+only; mixed C2 context refused, no C2 requirement change. N1-N7 addressed in
+canonical manifest, bound-business check, ratio/default wording, UI unavailable
+reason, release-derived readiness and new A23-A31 acceptance rows. These are
+proposed definitions, not passing implementation tests. Q36/adoption unchanged.
+
+## Round 3 changes against review 0d627a2b3
+
+R2-B1: paragraph-mark revisions preserve all run text; markup has a zero-width
+mark span, never a fabricated whole-paragraph deletion. Reserved note leaves
+are allowed only in reserved stories; whole-part structural validation is
+explicit. A31 covers both mark-only cases and reserved notes.
+R2-B2: bodies/quoted share payloads move out of SQLite into private content
+objects; backup/post-attempt metadata paths are named with access/retention
+rules. Every writing_* table is COUNTED/T46-classified. A non-restored deny
+fence changes epoch before any store swap; owner confirmation cannot revive
+old-epoch grants/shares. A32 tests revocation/restore and secret-marker sweeps.
+R2-N1: agent grant subject means agentInstance. R2-N2: structural leaves have
+one table. This remains design only; no code, restore, parser run or test.
+
+## Round 4 changes against review 9fb999abf
+
+R3-B1: reserved-note classification is by type with any canonical signed ID,
+not sign; normal notes require nonnegative IDs, and references to reserved
+notes refuse. A31 covers both actual Word layouts. R3-B2: first migration
+creates the durable initial epoch before schema commit; null restoreOperation
+needs no recovery confirmation, a restored epoch does. Missing established
+fences never reinitialize. A32 covers first enable and post-restore states.
+R3-N1: business/row/private random nonce are part of each content object and
+its path, so no cross-business deduplication or guessed-body digest oracle.
+R3-N2: removed the unsupported claim to detect privileged manual rollback
+of the fence itself. R3-N3: restore_store anchor corrected to :498.
+
+### Public Word fixture confirmation (not an extractor test)
+
+Inspected only public Microsoft-maintained test packages in memory using
+Python ZIP/XML readers, not the O2 parser or a live/user document. No binary
+was imported into this repository. Source:
+[OfficeDev/Open-Xml-PowerTools FootNote.docx](https://github.com/OfficeDev/Open-Xml-PowerTools/blob/a9187c5ec4199106562ec91c5ffd9f355251253b/NewDocxDocuments/FootNote.docx),
+14,214 bytes; DOCX SHA-256
+`40e2de78f0f70d8acf3db734df13f107c92986f1a40865cdf9772a8b55ab5e20`.
+Its app properties identify Microsoft Office Word, version 15.0000.
+footnotes.xml has separator=-1, continuationSeparator=0, normal note=1;
+endnotes.xml has separator=-1 and continuationSeparator=0.
+footnotes.xml SHA-256
+`1da08d9c0a4a1af2706c035dfb176defd179686f81418134b796d49649e850a0`;
+endnotes.xml SHA-256
+`f83e7f1c9f91b44db26b147b22ca615a13488bc6a8084febb392ee00a6ca4f5e`.
+This confirms the reviewer's -1/0 example in a Word-identified fixture.
+
+An older independent Microsoft SDK fixture confirms why IDs cannot define
+the class:
+[Open-XML-SDK ForTestCase/footnote.docx](https://github.com/dotnet/Open-XML-SDK/blob/431ab05cf160248cc3885a4a766026d4f8243792/test/DocumentFormat.OpenXml.Tests.Assets/assets/TestDataStorage/v2FxTestFiles/ForTestCase/footnote.docx),
+69,706 bytes, SHA-256
+`26dc62a5d00e2c3c1df60e0d5bf1cac43b142a090ea595b9ad11ce73e3dab268`.
+It identifies Microsoft Office Word 12.0000 and uses reserved IDs 0/1 in
+both parts, with normal footnotes 2/3. No claim is made that the whole
+packages pass v1's otherwise deliberately restrictive projection rules.
@@ -624,3 +624,13 @@ Open follow-up: scripts/case1-accept.sh:413 (at candidate3c4c463da) uses `tr < "


 Row276 mos-1345 R3 residual remains open: a same-uid process that escapes the session, or a stalled supervisor in that session, can retain descriptors to the private stdout/stderr spool after root unlinks it and keep growing the unlinked file. The outer bound releases the caller because no residual holds its capture pipe. Row276 adds no disk cap and no cross-session kill; this is not a cleanup or closure claim.
+
+
+## Row207 N1: "refuses at any business" has no test
+
+Open follow-up (duckworth-0230 N1, sage-3043). Row 207 (#1705) lands on 9bb406c6c without a test that `mosaic access user remove` refuses while the user holds a grant at any business, not only the named one. A mutant adding `&& g.business === business` survives T4: checkAccess still refuses at exit 3, so nothing is written, but the reason and exit code are wrong. The next row that touches packages/cli/tests/access.test.mjs adds one T4 case with the grant at a second business and a mutant that the case kills. N2 (parse ignores stray flags) is pre-existing in grant and revoke and stays out of scope.
+
+
+## Row270 N6: ledger growth and the whole-file read on session.list
+
+Open follow-up (duckworth-0228 N6), bound to row 272 (264e, #1777). Row 270 caps what the bus reads per compaction collection (compactionReadBytes, default 64 MiB) but an agent can still grow a session's compaction ledger by about 231 KB per collection, and session.list reads the whole file. Row 272 bounds the ledger or the read on session.list, with a test and a mutant, or records why the cap is enough.
@@ -33,7 +33,7 @@ Gaps found while working go to `docs/plans/DEFERRED.md`, not here.

 <!-- mosaic-queue:begin -->

-Generated from `docs/plans/queue.json` revision 3338 by `queue render`. Do not edit between the markers; change the queue with `scripts/mosaic queue`.
+Generated from `docs/plans/queue.json` revision 3368 by `queue render`. Do not edit between the markers; change the queue with `scripts/mosaic queue`.

 | # | Piece | Owner | Issues | State | After | Gate | Brief | Note |
 |---|---|---|---|---|---|---|---|---|
@@ -239,11 +239,11 @@ Generated from `docs/plans/queue.json` revision 3338 by `queue render`. Do not e
 | 200 | stack-release.sh activate --sso for the Q175 phase 2 window (row 192 F3; chained on 192) | launchpad; reviewers webby | #1698 | done | — | Webby approves the manifest; cli suite and every scripts/test-*.sh green on Sage's gate; the mutants killed (sage) | `docs/plans/2026-10-20_stack-release-sso.md` § Brief: stack-release.sh activates a Console with --sso (Q175 phase 2 prerequisite) | Landed 9e1085816 on refactor (base 722136772), pushed. Patch-id 7ebfa6a5 matches git diff 00d4cc1f6..9df40878f on the 3 manifest paths. Manifest b3ead55c, Webby approve r3 29772. Gate on 9df40878f: packages 2675/0, scripts 429/0. Mutants 13/14, M12 ruled equivalent (sage-1446). |
 | 201 | FED R1: access.json loader and validator, and covers (#414) | gizmoduck; reviewers duckworth | #1699 | done | — | Duckworth approves the manifest; business suite and every scripts/test-*.sh green on Sage's gate; the mutants killed (sage) | `docs/plans/2026-10-20_federation-r1-r2-r5.md` § Brief: FED R1, the access.json loader and validator | Landed afad4993f on refactor (squash of gizmoduck ae3c36f24..44e36fc4c, manifest 225597146daf...0c520). patch-id ba604ad5e matches the reviewed diff on all 3 paths. Gate on 44e36fc4c in the slot (gizmoduck-0060): business 173/0, 10 scripts 422/0, mutants 44/44. Duckworth approve 29581. |
 | 202 | FED R5: mosaic access list, grant and revoke (#414) | quackerjack; reviewers duckworth | #1700 | done | — | Duckworth approves the manifest; cli suite and every scripts/test-*.sh green on Sage's gate; the mutants killed (sage) | `docs/plans/2026-10-20_federation-r1-r2-r5.md` § Brief: FED R5, mosaic access list, grant and revoke | Chained on row 201's candidate (Q177), not its done: claimable now, lands after 201 and rebases onto its landing (Sage) |
-| 203 | FED R2: the federation key in the system config (#414) | quackerjack; reviewers webby | #1701 | briefed | — | Webby approves the manifest; cli suite and every scripts/test-*.sh green on Sage's gate; the mutants killed (sage) | `docs/plans/2026-10-20_federation-r1-r2-r5.md` § Brief: FED R2, the federation key in the system config | Chained on row 192's candidate (Q177): starts on 192's candidate, lands after 192 (Sage) |
+| 203 | FED R2: the federation key in the system config (#414) | quackerjack; reviewers webby | #1701 | done | — | Webby approves the manifest; cli suite and every scripts/test-*.sh green on Sage's gate; the mutants killed (sage) | `docs/plans/2026-10-20_federation-r1-r2-r5.md` § Brief: FED R2, the federation key in the system config | Landed a4da4e6df on refactor 23:47Z 10-22, fast-forward from c7b754d7b, 5 commits. Webby APPROVE c30877 rev 3366 on candidate a4da4e6df. Gate on Sage's slot: stack-release.test 219/0, test-config 51/0, M1-M17 killed, cli 895/0, ten scripts green, named skips only. Brief re-pinned 8adfb261f (Webby N2). 270+271 rebase onto this (mosaic-config.mjs conflict) as a new round. |
 | 204 | 193a: access level check widened to viewer (#1691) | morgana; reviewers duckworth | #1702 | done | — | Duckworth approves the manifest; business suite and every scripts/test-*.sh green on Sage's gate; the mutants killed (sage) | `docs/plans/2026-10-20_human-users-build.md` § Brief: 193a, the access level check widened to viewer | Landed d0bbc5c1c on refactor (base c9f374284). Patch-id 92c18aea matches git diff 44e36fc4c..f869fd062 on the 3 manifest paths. Manifest d38de8c9, Duckworth approve 29595. Gate 2789/0 on 4385b9ec1, mutants 7/7. Unpushed. |
 | 205 | 193b1a: the message filter (#1703; FED R3 and 193b1b build on it) | morgana; reviewers duckworth | #1703 | done | 196 done | Duckworth approves the manifest; bus suite and every scripts/test-*.sh green on Sage's gate; the mutants killed (sage) | `docs/plans/2026-10-20_human-users-build.md` § Brief: 193b1a, the message filter | Landed ce6a96ad6 fast-forward on 0fa7bf421 (3 commits, 4 paths, manifest 858463b1). Duckworth APPROVE r1 c30375 (signed :124 test diff, mos-1262). Gate: Morgana slot205 10 files, bus 652/0, M1 M11-M14 killed, 0 skips; Sage test-*.sh 10/10, 3 by-design skips. N1/N3 to 205b or R3, N2 to 193b2 brief, N4 = #1782 before any user thread. Rebase next: 268 r4, 194, 236, 253, 274. |
 | 206 | 193b2: thread shares, schema 3k-3l after the #436b build (#1691; live needs a --migrate window with Jason) | launchpad; reviewers duckworth | #1704 | done | 205 done, 234 done, 236 done, 275 done | Duckworth approves the manifest; bus suite, cli suite and every scripts/test-*.sh green on Sage's gate; the mutants killed (sage) | `docs/plans/2026-10-20_human-users-build.md` § Brief: 193b2, thread shares (schema 3l) | Landed 0cbe2e9b3 fast-forward on 17f415792 (10 commits, 22 paths), pushed 19:47Z. Duckworth APPROVE rev 3322 c30795 on 0cbe2e9b3; request rev 3320/3321 c30793 posted as jarvis. Gate (Launchpad, 9538e0fc8, tip differs in BUILD.md only): bus 850/0, cli 869/0, ten scripts/test-*.sh rc=0, touched files whole green, M2-M4 M7-M9 and Q2 killed. One placed fixture red (mos-1272). Schema 3l to 3m; live --migrate is Mos's go under Q173. |
-| 207 | 193c: mosaic access user verbs and --level viewer (#1691) | megavolt; reviewers duckworth | #1705 | in-progress | 202 done | Duckworth approves the manifest; cli suite and every scripts/test-*.sh green on Sage's gate; the mutants killed (sage) | `docs/plans/2026-10-20_human-users-build.md` § Brief: 193c, mosaic access user verbs and --level viewer | — |
+| 207 | 193c: mosaic access user verbs and --level viewer (#1691) | megavolt; reviewers duckworth | #1705 | done | 202 done | Duckworth approves the manifest; cli suite and every scripts/test-*.sh green on Sage's gate; the mutants killed (sage) | `docs/plans/2026-10-20_human-users-build.md` § Brief: 193c, mosaic access user verbs and --level viewer | LANDED c4f77373f 22:49Z 10-22 (fast-forward from f0e3dcdf4). Rebuild of gated 9bb406c6c: range-diff 4/4 =, patch-ids equal, 4 manifest blobs equal. Duckworth APPROVE c30849 rev 3356. Gate on 712f79c0a under sage-3041: access.test 31/31, M1-M8 killed, cli 894/894, ten scripts green. N1 DEFERRED (next access.test row). No live change. |
 | 208 | 193d: Console shared list, share controls and viewer read-only (#1691; also after FED R6 when filed) | morgana; reviewers duckworth | #1706 | queued | 192 done, 206 done | Duckworth approves the manifest; webui suite and every scripts/test-*.sh green on Sage's gate; the mutants killed (sage) | `docs/plans/2026-10-20_human-users-build.md` § Brief: 193d, the Console's shared list, share controls and viewer read-only | — |
 | 209 | FED R8: the hub window on 10.1.1.54, a recorded acceptance (#414, r4.11 b93f098f0; live window run by Jason and Mos, after the Case 2 install #416, Bean and Chet live and both Hermes gateways stopped) | sage; reviewers duckworth | — | queued | — | Every entry check's output is in the R8 record with who ran it; Jason signs in to the hub and sends one message, Melanie revokes, his next request is refused; Duckworth checks the record (sage) | `docs/plans/2026-10-20_federation-r1-r2-r5.md` § Brief: FED R8, the hub window on 10.1.1.54 | Stays queued until its entry gates near: Case 2 install on .54 (#416, by 2026-10-27), Bean and Chet live, both Hermes gateways on .54 stopped, R7, #412 phase 2, #419 answer. Filed per mos-1073 after duckworth-0034 (Sage) |
 | 210 | Agent host access with sudo through the credential store: grant per agent and host, the stack does ssh and sudo, the agent never sees the key (#1707, Vikunja #424, Q183/Q184, due 10-27; chained on row 199's candidate) | gizmoduck; reviewers duckworth | #1707 | done | — | Duckworth approves DESIGN.md, then the manifest; bus, business, cli suites and every scripts/test-*.sh green on Sage's gate; the mutants killed (sage) | `docs/plans/2026-10-20_host-credentials.md` § Brief: agent host access with sudo through the credential store (#424) | Landed f5753c0e8 on refactor (base 9d165be8c), pushed. Patch-id 723b1c83 matches git diff ad95c888c..0485384e9 on the 23 manifest paths; landed files pass r5 manifest 688d38b9. Duckworth approve r2 rev 2592, r3 29851. Mutants 52/53, M22b equivalent (rev 2584). Gate on ad95c888c+patch: packages 2796/0, scripts 429/0; landed blobs equal the gate tree. |
@@ -306,7 +306,7 @@ Generated from `docs/plans/queue.json` revision 3338 by `queue render`. Do not e
 | 267 | Case 2 C2-15 hybrid universes: exclusions, pins and the end-to-end crossover | morgana; reviewers filbert | #1772 | queued | 216 done, 217 done, 224 done | Filbert approves the manifest. The brief's tests and the end-to-end crossover run whole plus every touched suite on Sage's slot. Grep for hash pins on changed files before in-review. (sage) | `docs/plans/2026-10-20_case2-rows.md` § C2-15 hybrid universes: exclusions, pins and the end-to-end crossover | R8 accepted (sage-2218). Webby's R8 noise note (gosalyn-0127) is for the builder. |
 | 268 | Case 2 C2-01c playground levels: universe-level prefixes and draft universes | gizmoduck; reviewers webby | #1773 | done | — | Webby approves the manifest. The brief's tests run whole plus the library suite and every touched suite on Sage's slot; the brief's gate grep over packages and docs/case2 finds no library-playground-outside-book. Grep for hash pins on changed files before in-review. (sage) | `docs/plans/2026-10-20_case2-rows.md` § C2-01c playground levels: universe-level prefixes and draft universes | Landed c27207f6e fast-forward on ce6a96ad6 (1 commit, 9 paths, digest caa0fa4e). r4 is a carry of r3 aca53c4f0: range-diff =, patch-id 2942acc8 equal, blobs equal. Webby APPROVE round 2 on ecd9b35eb stands; carries webby-0112 (r3) and webby-0113 (r4, notes 34e1ab2bf). Gate: Gizmoduck r4 rerun brief 14/14, library 83/83, business 209/209, 0 skips; gate grep empty. 194 rebases next (business.test.mjs). |
 | 269 | 264b T1 item 7: per-session native store, workspace and single-writer fence | gizmoduck; reviewers duckworth | #1774 | done | 264 done | Duckworth approves this slice's manifest. Its design tests run whole plus every touched suite on Sage's slot, and its mutants are killed (RULINGS Q1). Tests T1 run half, T2 workspace and path mutants; whichever of 191 and 264b lands second wires 191's admission checks (Q5). (sage) | `docs/plans/2026-10-21_t1-sessions.md` § T1 item 7: independent sessions, compaction counts and clear context | Landed efcc9ea8d fast-forward on 94c33a43c (13 commits, 12 paths, manifest 455c12ee). r3 is a carry of r2 aafcc857c, range-diff = (Duckworth 0194, c30756, rev 3307). Gate r3 18:37-18:50Z all green, 0 skips: bus 834, seat 172, cli 869, case2-unit 43, singles 38. M1-M12 kills carry. Re-pin needs the Console restart by Jason or Mos right after the host. A 264a rollback refuses a v2 sessions.json, see BUILD.md Rollback. |
-| 270 | 264c T1 item 7: compaction count, exact for Pi | gizmoduck; reviewers duckworth | #1775 | briefed | 269 done | Duckworth approves this slice's manifest. Its design tests run whole plus every touched suite on Sage's slot, and its mutants are killed (RULINGS Q1). Test T3 Pi half; Claude shows unknown with the Vikunja 466 reason (Q6). (sage) | `docs/plans/2026-10-21_t1-sessions.md` § T1 item 7: independent sessions, compaction counts and clear context | — |
+| 270 | 264c T1 item 7: compaction count, exact for Pi | gizmoduck; reviewers duckworth | #1775 | in-review, round 1, request posted | 269 done | Duckworth approves this slice's manifest. Its design tests run whole plus every touched suite on Sage's slot, and its mutants are killed (RULINGS Q1). Test T3 Pi half; Claude shows unknown with the Vikunja 466 reason (Q6). (sage) | `docs/plans/2026-10-21_t1-sessions.md` § T1 item 7: independent sessions, compaction counts and clear context | — |
 | 271 | 264d T1 item 7: clear context through row 194's lifecycle stop | gizmoduck; reviewers duckworth | #1776 | in-review, round 1, request posted | 194 done, 269 done | Duckworth approves this slice's manifest. Its design tests run whole plus every touched suite on Sage's slot, and its mutants are killed (RULINGS Q1). Tests T4 and T6; rebased onto 194's landing with no 194 code copied (Q4). (sage) | `docs/plans/2026-10-21_t1-sessions.md` § T1 item 7: independent sessions, compaction counts and clear context | — |
 | 272 | 264e T1 item 7: mosaic session CLI and Console chooser | huey; reviewers scrooge | #1777 | briefed | 264 done | Duckworth approves this slice's manifest. Its design tests run whole plus every touched suite on Sage's slot, and its mutants are killed (RULINGS Q1). Tests T5 legacy single human and T7 Console half; controls for unlanded verbs refuse with a reason (Q1, Q7). (sage) | `docs/plans/2026-10-21_t1-sessions.md` § T1 item 7: independent sessions, compaction counts and clear context | — |
 | 273 | Q175 phase 2: stack-release.sh activate --send and --no-sso (F39, mos-1246) | darkwing; reviewers filbert | #1778 | done | — | Filbert approves the manifest. stack-release.test.mjs and stack-release-external.test.mjs run whole plus scripts/test-release.sh on Sage's slot, and the brief's mutants are killed. (sage) | `docs/plans/2026-10-22_activate-send-nosso.md` § Brief: activate --send and --no-sso | landed 0bbf0f6d1 03:35:55Z, FF of 378a76b85; rebase of cac7d0f67, 6 range-diff pairs =, patch-ids equal, manifest e1031023 unchanged. Gate by Darkwing on 0bbf0f6d1: stack-release.test 218/218, external 25/25, test-release.sh rc 0, T58 c0 pass c1 fail, M1-M7 killed. Filbert APPROVE rev 3111 c30308, carry c30319. Docs 5365adaef (TOOLS.md N1 + BUILD-LOG). #1778. |
@@ -327,7 +327,8 @@ Generated from `docs/plans/queue.json` revision 3338 by `queue render`. Do not e
 | 288 | Case 2 C2-02 agent writes, the notice, revert and her Console saves | honker; reviewers webby | #1793 | briefed | 215 done, 282 done, 283 done, 284 done, 285 done, 286 done | Webby approves the manifest. Library, bus and harness suites and every scripts/test-*.sh green on Sage's gate, mutants killed. A search of the run output for the fixture tokens finds nothing. (sage) | `docs/plans/2026-10-20_case2-rows.md` § C2-02 agent writes, the notice, revert and her Console saves | — |
 | 289 | Case 2 C2-11b Console library pages and her saves (Haiku subagent, decision 129) | researcher; reviewers filbert | #1794 | briefed | 214 done, 288 done | Filbert approves the manifest. The webui suite and every scripts/test-*.sh are green on Sage's gate. Grep for hash pins on bus.js and serve.mjs before in-review. (sage) | `docs/plans/2026-10-20_case2-rows.md` § C2-11b Console library pages and her saves | — |
 | 290 | Case 2 C2-12b the setup sheet rewrite for free chat, supporting folders and saves | louie; reviewers webby | #1795 | briefed | 217 done, 218 done, 285 done, 291 done | Doc only. Webby approves it against the ruling. Before landing, grep packages/*/tests and scripts/test-*.sh to confirm no test reads the file. (sage) | `docs/plans/2026-10-20_case2-rows.md` § C2-12b the setup sheet rewrite for free chat, supporting folders and saves | — |
-| 291 | PRD 1.16 library.write routes under REQ-LIB-6 (mos-1328) | gosalyn; reviewers webby | #1796 | briefed | 282 done | Webby approves the text. Jason says yes to the exact text (Mos asks him, mos-1328 step 3); no landing before that. requirements.test.mjs and every scripts/test-*.sh that reads the PRD or requirements.json are green on Sage's gate. Mos gets the landing commit. (sage) | `docs/plans/2026-10-22_prd-1-16-brief.md` § PRD 1.16 library.write routes under REQ-LIB-6 (mos-1328) | — |
+| 291 | PRD 1.16 library.write routes under REQ-LIB-6 (mos-1328) | gosalyn; reviewers webby | #1796 | in-review, round 1, request posted | 282 done | Webby approves the text. Jason says yes to the exact text (Mos asks him, mos-1328 step 3); no landing before that. requirements.test.mjs and every scripts/test-*.sh that reads the PRD or requirements.json are green on Sage's gate. Mos gets the landing commit. (sage) | `docs/plans/2026-10-22_prd-1-16-brief.md` § PRD 1.16 library.write routes under REQ-LIB-6 (mos-1328) | — |
+| 292 | stack-release.sh config_checks runs the target loader on any config (row 270 rollback hazard) | gander; reviewers duckworth | #1797 | briefed | 203 done, 270 done, 271 done | Duckworth approves the manifest. The touched test files run whole, the cli suite and every scripts/test-*.sh are green on Sage's gate, and the mutants are killed. (sage) | `docs/plans/2026-10-22_config-checks-any-key-brief.md` § stack-release.sh config_checks runs the target loader on any config (row 270 rollback hazard) | — |

 <!-- mosaic-queue:end -->

@@ -0,0 +1,528 @@
+# Q195 O2 W4 review: committed DOCX citations and access
+
+Reviewer Megavolt (Opus 5.5), assigned by Sage (sage-3061, mos-1360), Gitea #1799. Owner Rocko.
+Reviewed: `docs/plans/2026-10-22_q195-docx-citations.md`, blob 662abdb7c, commit 15e91538f (one
+docs-only commit on e36bce352). Against: parent blob 322ec50f2 (`docs/plans/2026-10-21_q195-writing-editor.md`)
+D11, D12, D24-D26, W4 and W4b. Static review only: no tests, parser runs or live files.
+
+## Verdict: CHANGES
+
+The W4 Gate asks for "no unresolved locator or permission ambiguity" and for every bypass closed.
+The design gets the core right, but nine items are still open against that bar (B1-B9). One part of
+the design changes Case 2 behaviour and goes to Mos and Jason (M1). None of these needs a new
+architecture. Each one needs a definition, a rule or an acceptance row.
+
+## What holds
+
+- Snapshot: manifest and DOCX come from one reachable commit. There is no worktree, export or
+  engine-memory fallback, and commit/blob is a locator, not an authority token (section 2).
+- Identity: a copy or new import gets a new document ID with no inherited grant, share, pin or cache.
+  The same blob in another document is not selectable.
+- Quote verification: exact part, story and ordinal, a code-point range, literal quote equality,
+  SHA-256 equality, blob and commit membership, and a pinned extractor revision. A stale locator
+  returns old text labelled stale and never relocates.
+- Write paths: none. There is no native MCP, execute, save, replace, tracked-change or comment write,
+  and flags belong to W5 as metadata.
+- Case 2: the line-cite schema, library grants and supporting-doc writer are unchanged, and no DOCX
+  paragraph is called a line. Q36 stays open and adoption stays closed (mos-1358). A19 and A20 test
+  this.
+- Parser: transitional namespace only, closed relationship types, no DTD, entities or external
+  relationships, ZIP bounds before allocation, and refusal rather than a truncated success.
+- Document text is data: comments, deletions and wiki tokens never become instructions.
+- Text kept out of generic stores: the design keeps O2 text out of generic raw stores and logs,
+  allows audit events to carry only IDs and digests, and does not let a shared extraction cache act
+  as an authorization cache.
+
+## Blocking findings
+
+### B1. Several named records have no exact shape
+
+Section 3 says "all objects reject unknown keys", but these objects are never specified:
+
+- **The multi-paragraph citation.** Line 100-101 calls it "an ordered nonempty list of these
+  ranges", but `editor_resolve_citation` takes one `{locator}`. The design needs to give:
+  - the wrapper and its kind;
+  - whether each range carries its own quote and digest;
+  - whether every range must share commit, blob, extractor, view and part;
+  - whether the paragraphs must be contiguous;
+  - the maximum count;
+  - how the resolver and the share chip accept the list.
+- **wikiTokens entries** (line 120 and section 5). The field names, offsets and forms (`link`,
+  `label`, `heading`, `embed`) are not given.
+- **Anchor story.** Anchors are "a canonical decimal signed XML ID string" (line 127), but locator
+  stories are nonnegative (line 88). Use one grammar for both.
+- **`paragraph.xmlId`.** It is "JSON null when absent" (line 89), but also "if provided" (line 97).
+  Two locators for the same range must not both be valid. State that null means "this node has no
+  `w14:paraId`" and that a node with one must carry it, or make it always null.
+- **Departure from D25.** D25 says "resolve paragraph IDs when present, otherwise an ordinal". The
+  design makes the ordinal primary and the paraId only a check. I agree with that on the merits,
+  since paraId is not unique, but the design should name it as a deliberate departure from D25's
+  wording so that Sage's brief carries it. This is O2-only, not a Case 2 item.
+- **The share record, the chip request and the refusal envelope.** Section 7 needs:
+  - the fields the WebUI sends to have a selection mapped;
+  - the fields of the stored share record;
+  - the error object's keys (section 6 gives only the codes).
+
+### B2. Extraction is not closed enough to be deterministic
+
+Section 5 lists containers and a few leaves, then refuses "unknown text-bearing elements". Offsets
+depend on how each run-level leaf counts, so two conforming extractors can disagree. The design
+needs a closed leaf table that gives each leaf's text contribution or refusal. At least these are
+missing:
+
+- `w:annotationRef`. Word starts every comment with it, so whether comments are readable at all
+  depends on an unstated choice.
+- `w:footnoteRef` and `w:endnoteRef`, the number mark inside the note's own story.
+- `w:noBreakHyphen`, `w:softHyphen`, `w:sym` and `w:ptab`.
+- `w:moveFromRangeStart/End` and `w:moveToRangeStart/End`, which always come with the moves the
+  design supports.
+- `w:commentRangeStart/End`, as anchors.
+- `w:permStart/End`.
+- `w:fldChar`, `w:instrText` and `w:fldSimple`, as refusals.
+
+Two revision rules are also unstated:
+
+- **Nested revisions.** A run is in `final` if and only if no ancestor is `del` or `moveFrom`, and in
+  `original` if and only if no ancestor is `ins` or `moveTo`. The design should say so.
+- **Paragraph-mark revisions.** For `w:pPr/w:rPr/w:ins|w:del`, state that views never merge or split
+  paragraphs, so that an inserted paragraph shows as empty in `original`. That follows from "ordinals
+  do not change with view" but should be explicit.
+
+### B3. `currentCommit` and staleness are ambiguous for multi-chapter projects
+
+D10 puts one DOCX per chapter under one book manifest, and the store is per project
+(`<dataRoot>/writing/<business>/<project>/`). `stale` is "exactly commit != currentCommit"
+(line 268). If `currentCommit` is the project's newest commit, then saving chapter 2 marks every
+chapter 1 citation stale and breaks chapter 1's latest cursors, even though chapter 1's blob did not
+change.
+
+Two things need a definition:
+
+- `currentCommit`: for example, the newest published commit that changed this document's DOCX blob
+  or its manifest entry. Alternatively, define `stale` by blob plus manifest entry.
+- The document's "published history" (line 49): which ref, and which commits count.
+
+Add an acceptance row: a save to a sibling document leaves `stale:false`.
+
+### B4. The permission model is prose, not data
+
+Section 7 intersects six inputs, but the grant side has no schema. Before W4b can implement this
+the same way twice, the design must answer:
+
+- Where do document, part, view and comment scopes live: R5's access.json, a new bus table or the
+  role files? Who writes them, through which human-only verb, with what proof, receipt and revision?
+  Rows 207 and R5 already provide that pattern for business grants.
+- Who is "the principal" in an agent turn: the human who sent the chip, the seat, or both?
+- Can a `viewer`-level human share? Can a share ever expose a part or view that the sharing human's
+  own grant does not cover?
+- In a thread with two humans, whose grants does `conversation-current` intersect?
+- "Historical-view scope" (line 290) appears once and is undefined. Is it a separate scope, or the
+  live grant plus an exact share?
+- The cursor binds a "grant revision" (line 282). Which revision counts?
+
+### B5. Share semantics contradict each other
+
+- Line 329-331 says a share "does not widen it or authorize a later version". Line 340 says "latest
+  whole-document reads require a whole-document share", and A15 says "whole-document latest share
+  explicit". The design must say what a whole-document chip binds:
+  - one commit or latest;
+  - whether it includes notes, comments and the `original`/`markup` views.
+- Range shares: rows are whole paragraphs, so `editor_read_committed` must refuse under a range-only
+  share. Only `editor_resolve_citation` works with one. State this.
+- `off` "revokes future reads". Does it also stop resolution of exact shares already sent?
+- `conversation-current` lasts "until human revocation/session end". Which session is that: the bus
+  session, the thread session (row 269) or the Console login?
+
+### B6. Paging rules contradict each other
+
+- Overflow. The design says "response overflow never returns partial data with success", but paging
+  must end a page before a row that would overflow. State that the page ends before the first row
+  that would exceed 64 KiB, and that only a single row too large on its own refuses.
+- Paragraphs over 64 KiB. The design says a caller "may request a checked subrange through a
+  separately bounded citation", but a citation needs the quote and its digest first, so such a
+  paragraph is unreachable. Either define a bounded subrange read (ordinal plus a code-point window,
+  returning text and a server-made locator) or declare these paragraphs unsupported in v1.
+
+### B7. Git grants: the design does not forbid a remote
+
+Case 2's library has a Gitea remote. Agent supporting-doc writes push through each seat's own Gitea
+account (Q226, case2-rows.md:1634-1641), and seat tokens carry `write:repository` and can fork
+(packages/bus/src/gitea-grant.mjs:29 and :297). The design says "no raw O2 git clone/read grant", but
+nothing stops an O2 project repo from getting a remote, mirror or backup push that any seat account
+can then list, fork or clone.
+
+The design must state that O2 store repositories have no remote, and that no mirror, backup or push
+reaches a host an agent account can access. It also needs a stack-copy/release rule: copies never
+carry the store. Add an A16 probe: a seat Gitea token cannot list, fork or clone an O2 project.
+
+### B8. The raw-session surfaces are deferred, not closed
+
+Line 437-438 hands the surface inventory to the W4b brief. The W4 Gate wants raw sessions closed
+by this design. The stores already exist and can be named now, each with a rule (no O2 text,
+opaque reference only, or enforced envelope):
+
+- seat session stores `threads/<business>/<thread>/session/` and `claude-projects/`,
+  `threads/<business>/<thread>/sessions/<session>/` and `session-workspaces/...`
+  (packages/seat/src/session.mjs:23-29);
+- the bus store's event and thread-message tables, and row 264's sessions;
+- the Console thread view;
+- the CLI's `thread`, talk and follow;
+- the Discord connector (packages/discord, including journal.mjs and context.mjs) and the
+  control-board Discord path;
+- `<dataRoot>/runs/` run records.
+
+Run records need a rule of their own. Invariant 5 makes them write-once, so O2 text written there
+can't be withdrawn on revocation, only pruned. State that O2 content never enters a run record.
+
+### B9. The migration and compatibility plan is too thin to review
+
+W4 asks for "a reviewed migration/compatibility plan". Lines 33-35 say only "new O2 records, a schema
+edge from Sage, no reinterpretation". The plan needs:
+
+- **New tables and columns.** Name them, and state whether any existing table (thread messages,
+  events) gains a provenance column.
+- **Rollback.** After `release.sh rollback` to a pre-W4b copy, the old code does not enforce the
+  envelope. Any O2-derived text stored in an existing table becomes readable through the old thread
+  views. Require that O2-derived content is stored only where pre-W4b code can't render it (a new
+  table, or opaque references in existing tables), and add a rollback probe.
+- **Extractor revision retention.** Old locators need their old revision. Say whether activating a
+  release that drops a revision is allowed, which turns those citations into
+  `editor-version-unavailable`, or whether every published revision is retained.
+
+## Mos/Jason item
+
+**M1. O2-context turns narrow Case 2 behaviour.**
+
+Section 7, lines 362-371, does two things in any turn that received O2 context:
+
+- It refuses "generic supporting-doc writes, git writes, exports and arbitrary outgoing tools".
+- It classifies every output of that turn, and of any resumed or forked descendant, with the O2
+  document scopes.
+
+In a Case 2 thread, that means:
+
+- C2-02's supporting-doc write, from the Q226 rows (mos-1309), stops working once the human shares
+  a chip;
+- the agent's C2-06 replies become invisible to thread members without the O2 grant.
+
+That changes a Case 2 requirement. Under the W4 Gate it goes to Jason through Mos before code, not
+as a design choice.
+
+My recommendation: confine O2 context to O2-dedicated threads or sessions. Case 2 semantics then
+stay untouched, and the narrowing applies only where it was opted into. Otherwise Jason has to
+approve the narrowing for mixed threads.
+
+The rest of the design changes no Case 2 requirement. Q36 and D12 stay open with Jason as before,
+and the design builds no notice.
+
+## Non-blocking notes
+
+- N1. Give the canonical serialization of the extractor build manifest that `extractor.revision`
+  digests, so that the digest can be recomputed independently.
+- N2. A locator's `business` field must equal the broker-bound business. Otherwise refuse with
+  `editor-access-refused`, the same response as for a foreign ID.
+- N3. The 100:1 expansion ratio: say whether it is per entry, total, or both.
+- N4. Line 68-69 says "no implicit defaults except the reading view", but `limit` defaults to 20 and
+  `cursor` to null. Reword.
+- N5. Hyperlinks, fields and text boxes refuse the projection. Many real chapters will then be
+  agent-unreadable. That is acceptable for v1, but the W4b brief and the human UI should say why a
+  chapter is unavailable.
+- N6. Readiness should come from the verified release artifact (extractor manifest plus the
+  formatting-property list), not a system-config field, since configs are human-authored
+  (invariant 2).
+- N7. Add acceptance rows for B3 (sibling save), B6 (oversized paragraph), B7 (seat token against an
+  O2 repo), B8 (each named store, including run records) and B9 (rollback).
+
+## Next round
+
+Revise the design for B1-B9 and send the new commit and blob to me and Sage. I re-review only the
+changed sections and the items above. M1 waits on Mos and Jason. If the design takes the
+O2-only-thread recommendation, M1 closes without a ruling.
+
+## Round 2: 019a0ea5b (blob 14dfe92d9)
+
+Reviewed: Rocko's round 2 commit 019a0ea5b, a fast-forward on 15e91538f, design blob 14dfe92d9.
+I read the whole file again, not only the changed lines, because the change was large (+453/-120).
+Static review only.
+
+### Verdict: CHANGES
+
+The design now closes B1-B9 and M1 as they were written. Two problems remain. R2-B1 is a
+projection rule that contradicts D25's "final accepted reading". R2-B2 is an existing backup and
+restore path that section 7 does not cover. Each needs a rule and an acceptance row, not a new
+design.
+
+### Round 1 items
+
+- **B1, closed.**
+  - The `docx-selection` wrapper: 2..32 consecutive ranges, a shared snapshot, empty intermediate
+    paragraphs, one budget for the whole selection, atomic failure and one canonical form.
+  - `xmlId` is null exactly when the node has no paraId.
+  - The wikiToken and anchor grammars now match the locator.
+  - The chip, share and refusal envelopes are exact.
+  - The departure from D25 is named (lines 108-111).
+- **B2, closed except for R2-B1.** The closed leaf table and the ancestor veto for nested revisions
+  are in (lines 268-310).
+- **B3, closed.**
+  - `refs/heads/writing-published` advances first-parent with no force.
+  - Publication commits are defined per document, and `currentCommit` and stale are per document.
+  - A23 covers a sibling save.
+- **B4, closed.**
+  - The principal is a tuple.
+  - Scope lives in `writing_access_events`, written by the business owner's existing human proof
+    only.
+  - Agent `mayShare` is false, and viewers cannot share.
+  - The authority vector names its sources.
+  - Two-human threads are refused (`editor-sharing-unsupported`).
+- **B5, closed.**
+  - A range share allows resolve only.
+  - A document chip binds one exact publication.
+  - A latest share exists only under `conversation-current` with a whole-document chip.
+  - `off` and any policy change invalidate all earlier shares.
+  - The share's session is the new O2 execution session.
+- **B6, closed.** A page ends before the first row that would overflow. A row too large for an
+  empty page is unsupported in v1, and A24 covers it.
+- **B7, closed.**
+  - O2 repositories have no remotes, mirrors or forks, and the store refuses one.
+  - Copies exclude `writing/` and `writing-context/`.
+  - A25 includes a seat-token probe.
+- **B8, closed except for R2-B2.** Section 7.4 names every store and renderer I listed, plus
+  `launches/` and `bus-host/sessions.json`. The run-records rule is explicit, and A26 probes each
+  store.
+- **B9, closed except for R2-B2.**
+  - New tables are named, append-only, with no change to existing columns.
+  - Old renderers never query the new tables.
+  - A rollback probe and an extractor-retention rule are in.
+- **M1, closed. No Mos/Jason item.** O2 context exists only in new, dedicated O2 conversations and
+  execution sessions. Existing C2 threads cannot be converted, attached, resumed or forked into O2
+  mode. C2-02 supporting-doc writes and C2-06 replies keep their meaning (lines 433-441), and A28
+  tests that. This adds new O2 behaviour and changes no Case 2 requirement.
+- **N1-N7, addressed.** N1 is the canonical manifest bytes (lines 155-168). N2 is the business
+  check (lines 378-379). N3 is the ratio rule at line 257. N4 is the defaults wording at line 84.
+  N5 is the UI reason (lines 688-690). N6 is release-derived readiness. N7 is A23-A31.
+
+### R2-B1. Paragraph-mark revisions drop accepted text, and reserved notes would refuse
+
+**What the design says.** Lines 276-281: "an inserted paragraph mark makes that paragraph's
+projected text empty in original; a deleted paragraph mark makes it empty in final."
+
+**What the markup means.** In WordprocessingML, `w:pPr/w:rPr/w:del` marks only the paragraph mark
+as deleted. Accepting the change merges this paragraph's text into the next one. The text is gone
+only if its own runs sit under `w:del`, and the ancestor veto already handles that. `w:ins` on the
+mark works the same way in `original`.
+
+**Why that breaks the projection.** When a human joins two paragraphs with tracking on, the first
+paragraph's live text disappears from `final`. A quote taken from the accepted reading then can't be
+cited. That contradicts D25's "default final accepted reading" and the design's own definition at
+line 267.
+
+**Fix.** Paragraph-mark revisions never change text. Runs follow the ancestor rule alone. Since
+views never merge or split paragraphs, a mark-only revision shows up only as a zero-width
+whole-paragraph-mark span in `markup`. Extend A31 with a mark-only deletion whose text stays in
+`final`, and a mark-only insertion whose text stays in `original`.
+
+**Reserved notes.** The leaf table "is exhaustive; unknown leaves refuse" (line 305). Word writes a
+separator note and a continuation-separator note into every `footnotes.xml` and `endnotes.xml`,
+holding `w:separator` and `w:continuationSeparator` (and sometimes `w:continuationNotice`). Line
+227-229 calls these notes structural, but the table doesn't name those leaves. Read literally, every
+document that has footnotes refuses. Name the three leaves as allowed only inside reserved notes,
+structurally validated and never projected. Say whether leaf validation covers the whole part or
+only the requested story.
+
+### R2-B2. The release backup and restore path keeps O2 text and can revive revoked access
+
+**What the design says.**
+- Section 7.4 forbids "plaintext backup" of O2 material (lines 625-626).
+- Section 7.5 puts O2 message bodies, share selections (which hold quotes) and every grant and
+  policy event into new tables in the bus store (lines 638-663).
+
+**What the release script does.** `scripts/stack-release.sh` copies that store, in plaintext, on
+every activate:
+- `backup_store` writes `$DATA/backups/stack/<ACT>/bus/bus.sqlite` (lines 474-493).
+- It never prunes backups (line 18).
+- `rehearse` reads them (line 22).
+- `restore_store` moves the current `bus/` into a post-attempt directory and deletes nothing
+  (line 496).
+
+So O2 text persists in backups and post-attempt directories that section 7.4 does not name.
+
+**The restore gap.** `rollback --restore` puts back an older store. The guard counts `events` plus
+the fixed `COUNTED` list (lines 16-17 and 418-420). The design keeps O2 writes out of generic
+events (lines 659-661), and the new tables are not in `COUNTED`. A restore over revocations made
+after the backup therefore passes the guard without Jason's `--events N`. It also silently brings
+back the revoked `writing_access_events`, `writing_policy_events` and session-end rows. That
+revives revoked grants and shares, against section 7.3's "a scope decrease/revocation denies even
+historical shares".
+
+**What the design needs to state.**
+1. **Backups.** Either O2 bodies and quotes live outside `bus.sqlite` (for example under
+   `writing-context/`) so that release backups hold opaque rows only, or release backups and
+   post-attempt directories are named O2-classified stores in section 7.4, with mode, access and a
+   prune rule.
+2. **The guard.** Every `writing_*` table joins the restore guard's counted list. The T46 guard
+   already requires every schema table to be classified.
+3. **After a restore.** A restore that drops any `writing_*` row disables O2 readiness until the
+   owner reconfirms access. It never brings back an older grant, share or policy.
+4. **Acceptance.** Add a row: a revocation after the backup, then a restore, must leave the revoked
+   share refused. A secret marker must stay absent from every backup and post-attempt path except
+   the named O2-classified ones.
+
+### Non-blocking
+
+- R2-N1. Define the agent `subject.id` for `editor.access.set` as the bus agent instance ID (the
+  principal tuple's `agentInstance`), so a grant can't name a role or a seat display name.
+- R2-N2. Lines 330-332 restate the structural leaves already in the table. Drop the sentence or
+  point it to the table, so there is one list.
+
+### Next round
+
+Fix R2-B1 and R2-B2 and send the commit and blob to me and Sage. I'll re-check those two items and
+any lines they touch.
+
+## Round 3: 54246cb32 (blob 0c4f55826)
+
+Reviewed: Rocko's round 3 commit 54246cb32, a fast-forward on 019a0ea5b, design blob 0c4f55826.
+I read the whole delta and every definition it touches. I checked its citations against the same
+commit: `COUNTED` is at `scripts/stack-release.sh:420`, T46 is at
+`packages/cli/tests/stack-release.test.mjs:913`, and the guard counts `WHERE at > STAMP`, which
+works with the `at` column every `writing_*` table has. Static review only.
+
+### Verdict: CHANGES
+
+R2-B1's paragraph-mark rule and all of R2-B2 are closed. One gap from R2-B1 is still open, and the
+new fence adds a second. Each needs a sentence or two, not a redesign.
+
+### Round 2 items
+
+- **R2-B1, paragraph marks: closed.**
+  - A mark-only `w:ins`/`w:del` changes no projected text in any view.
+  - Paragraphs are never merged or split.
+  - Markup records a zero-width `paragraph-mark-insert`/`paragraph-mark-delete` span, and
+    `revisionSpans` allows those kinds with start=end.
+  - A31 covers both cases.
+- **R2-B1, reserved-note leaves: open.** The table rows and whole-part validation are in (lines
+  301 and 311-318). How a reserved note is recognized is still wrong; see R3-B1.
+- **R2-B2: closed.**
+  - Message bodies and share payloads leave SQLite for 0600 content objects under
+    `writing-context/objects/`. The bus tables hold only refs and digests.
+  - Backup and post-attempt trees are named O2-classified metadata stores, with modes, link checks,
+    rehearse limits and a receipt-based prune that only a human can run.
+  - All eight `writing_*` tables join `COUNTED` and T46, and row identities are compared.
+  - An independent fence epoch, set before every store swap, stops restored rows from granting
+    access, and owner confirmation can't revive them.
+  - A32 covers the revocation, restore, crash and marker sweep.
+- **R2-N1: closed.** The agent `subject.id` is the agent instance ID.
+- **R2-N2: closed.** The structural-leaf list now points to the table.
+
+### R3-B1. Reserved notes are recognized by negative ID
+
+Line 228 defines reserved notes as "negative IDs and type separator/continuationSeparator". Word
+normally writes the separator as `w:id="-1"` and the continuation separator as `w:id="0"`, so the
+continuation separator is not negative. A `w:type="continuationNotice"` note is a third reserved
+type, and line 228 leaves it out, although the leaf table names it.
+
+Read with lines 315-317 ("A separator leaf in a normal note/body/comment refuses"), the id-0
+continuation separator counts as a normal note. Its `continuationSeparator` leaf then refuses, and
+every footnoted document Word writes is refused again. ECMA-376 identifies these notes by `w:type`;
+the ID is only a number. I'm working from Word's usual output here, so a fixture from real Word
+should confirm it.
+
+Fix:
+- Classify a note as reserved by `w:type` in {separator, continuationSeparator,
+  continuationNotice}, with any integer ID.
+- A normal note has no `w:type` or `w:type="normal"` and a canonical nonnegative ID.
+- A reference to a reserved note refuses.
+- Add Word's -1/0 layout to A31.
+
+### R3-B2. The fence's first state and when confirmation is needed are undefined
+
+Line 791 says a missing fence denies O2. Only release and the owner-proof handler may write it
+(lines 762-763), and only "before any store swap" is a write moment defined (line 767). Nothing says
+who creates the fence when W4b's tables are first created, or with what epoch.
+
+It is also unclear whether `confirmedBusinesses` is consulted on a store that has never been
+restored. Read literally, a fresh fence has no confirmed business, so O2 stays off until an
+`editor.restore.confirm` that nothing calls for. The other reading, confirmation only after a
+restore, needs a rule saying so.
+
+Either way this is a gap in an authorization check: it fails closed, but an implementer has to
+invent the enable path. Fix:
+- State that the compatible controller creates the fence durably with the W4b migration (or at
+  first O2 enable), with a fresh epoch, `restoreOperation` null and the empty dropped-rows digest.
+- State whether `confirmedBusinesses` gates O2 always or only after a fence whose
+  `restoreOperation` is non-null.
+- Add both states to A32.
+
+### Non-blocking
+
+- R3-N1. Content objects are named by the SHA-256 of `{body,provenance}`. Two equal objects in
+  different businesses share one file, so a per-business prune or retention action can delete
+  another business's message. The digest kept in metadata backups also lets anyone confirm a
+  guessed short body ("ok"). Put the row `id` (or a random nonce) in the canonical object so each
+  digest is unique and can't be guessed.
+- R3-N2. Line 791 says rolled-back fence state denies O2, but the fence keeps only its current epoch,
+  so nothing can detect a rollback. Either define the check (for example, a monotonic fence
+  generation that every new row also records, and deny when the bus holds a newer generation than
+  the fence) or drop the claim.
+- R3-N3. `restore_store` begins at `scripts/stack-release.sh:498`; line 727 cites ":496ff", as my
+  round 2 did. Cosmetic.
+
+### Next round
+
+Fix R3-B1 and R3-B2 and send me and Sage the commit and blob. I'll re-check those two items and the
+lines they touch.
+
+## Round 4: 994c3f7fb (blob 2af460ab7)
+
+Reviewed: Rocko's round 4 commit 994c3f7fb, a fast-forward on 54246cb32, design blob 2af460ab7.
+I read the whole delta and the definitions it touches. Static review only. I did not download the
+two public fixtures Rocko cites, so their sizes and hashes are Rocko's; what they report (-1/0 in
+Word 15, 0/1 in Word 12) matches my round 3 claim and also shows that an ID can't identify a
+reserved note.
+
+### Verdict: APPROVE
+
+Every blocker from rounds 1-3 is closed, and M1 closed in round 2 with no Mos/Jason item. The
+design meets the W4 Gate (spec blob 322ec50f2, lines 806-850):
+- no locator or permission ambiguity is left;
+- new O2 copies, generic reads, git grants and raw sessions are closed as bypasses;
+- quotes verify against a committed blob and an extractor revision;
+- there is no unsaved-context or agent write path;
+- Case 2 Markdown authorization is unchanged;
+- a migration and compatibility plan is present.
+
+W4b owns the implementation and the A1-A32 evidence. This approval covers the design, not passing
+tests.
+
+### Round 3 items
+
+- **R3-B1: closed.**
+  - Reserved notes are classified by `w:type` in {separator, continuationSeparator,
+    continuationNotice}, with any canonical signed ID (line 227).
+  - A normal note has no type or type normal, plus a nonnegative ID; unknown types refuse.
+  - Any reference to a reserved note refuses, including an id-0 continuation separator.
+  - Duplicate IDs within a part refuse.
+  - A31 covers both the -1/0 and 0/1 layouts.
+- **R3-B2: closed.**
+  - The first schema migration creates the fence durably before the tables commit, with a fresh
+    epoch, `restoreOperation` null, the `[]` digest and no confirmed businesses (line 781).
+  - Confirmation applies only when `restoreOperation` is non-null (line 819).
+  - A missing or malformed fence over existing `writing_*` tables or history fails closed and
+    never reinitializes (line 790), and a crash resumes on the same epoch.
+  - A32 covers both states.
+- **R3-N1: closed.**
+  - Each object holds business, project, row and a private 32-byte nonce, and lives under
+    `objects/<business>/<row>/`.
+  - There's no cross-row deduplication, and retention is per owning row.
+- **R3-N2: closed.** The rollback-detection claim is replaced by an honest limit: a same-uid
+  operator bypassing the protocol is outside what the file can prove.
+- **R3-N3: closed.** The `:498` citation is fixed.
+
+### Non-blocking, for W4b
+
+- R4-N1. Line 790 allows initialization only with no `writing_*` tables and no fence. One case is
+  unnamed: a compatible-controller restore of a backup taken before W4b, then a re-migration. The
+  tables are then absent while a rotated fence with a non-null `restoreOperation` exists. Neither
+  reading opens a bypass, because the restore dropped every `writing_*` row. W4b should still say
+  that re-migration keeps the existing rotated epoch and its confirmation requirement, rather than
+  refusing forever or writing a new null fence. Add that case to A32.
@@ -30,7 +30,7 @@ import { fixture } from "./helpers.mjs";
 const TASK = "vikunja:1/2";

 function gitIn(cwd, ...args) {
-  const r = spawnSync("git", ["-c", "user.name=test", "-c", "[email protected]", "-C", cwd, ...args], { env: gitEnv(), encoding: "utf8" });
+  const r = spawnSync("git", ["-c", "maintenance.auto=false", "-c", "gc.auto=0", "-c", "user.name=test", "-c", "[email protected]", "-C", cwd, ...args], { env: gitEnv(), encoding: "utf8" });
  assert.equal(r.status, 0, r.stderr);
  return r.stdout.trim();
 }
@@ -45,7 +45,7 @@ async function until(fn, ms = 15000) {
 }

 function gitIn(cwd, ...args) {
-  const r = spawnSync("git", ["-c", "user.name=test", "-c", "[email protected]", "-C", cwd, ...args], { env: gitEnv(), encoding: "utf8" });
+  const r = spawnSync("git", ["-c", "maintenance.auto=false", "-c", "gc.auto=0", "-c", "user.name=test", "-c", "[email protected]", "-C", cwd, ...args], { env: gitEnv(), encoding: "utf8" });
  assert.equal(r.status, 0, r.stderr);
 }

@@ -295,9 +295,10 @@ export const KINDS_OLD=KINDS_NEW.replace('\n  harness: Object.freeze({','\n  "ha
 assert.notEqual(KINDS_OLD,KINDS_NEW);
 // Row 200 (#1698): C1 and C take --sso and have the row 192 loader and checkConsole; C's checker
 // refuses RS256, a stand-in for a target whose rules differ from the repository's. B has the loader
-// from before row 192, which refuses a `console` key. The other copies have no loader.
+// from before row 192, which refuses a `console` key. The other copies have no loader. Row 203: B's
+// loader also refuses a `federation` key, as a pre-203 loader does (its list has no federation).
 const LOADER=readFileSync(join(repo,'scripts','mosaic-config.mjs'),'utf8'),SSO_CONFIG=readFileSync(join(repo,'packages','webui','src','sso-config.mjs'),'utf8');
-const LOADER_OLD=LOADER.replace('["configVersion", "environment", "dataRoot", "execution", "console"]','["configVersion", "environment", "dataRoot", "execution"]');
+const LOADER_OLD=LOADER.replace('["configVersion", "environment", "dataRoot", "execution", "console", "federation"]','["configVersion", "environment", "dataRoot", "execution"]');
 const SSO_CONFIG_C=SSO_CONFIG.replace("'ES256', 'RS256',","'ES256',");
 assert.notEqual(LOADER_OLD,LOADER);assert.notEqual(SSO_CONFIG_C,SSO_CONFIG);
 const ssoFiles=(id)=>id===B?[['scripts/mosaic-config.mjs',LOADER_OLD]]:[C1,C].includes(id)?[['scripts/mosaic-config.mjs',LOADER],['packages/webui/src/sso-config.mjs',id===C?SSO_CONFIG_C:SSO_CONFIG]]:[];
@@ -1468,7 +1468,7 @@ const SHOW=`show-${CON}.txt`;
 const setOf=(e,act)=>join(e.state,'stack-rollback',act);
 const arrivalSet=(e,to)=>setOf(e,logLines(e).findLast((l)=>l.result==='ok'&&l.to===to&&l.from!==to).activation);
 const ROLLBACK_PLAN=(set)=>`sso: dropped; ${B}'s Console does not support --sso, so the rollback takes the Console flags from ${set}/${SHOW}, with --tester-port as the pointer has it`;
-const KEY_MSG=(e,to,op,why)=>`${e.cfg} holds a console key, and ${to}'s loader refuses it (${why}); remove the key first (restore the config.json backup from the window's step 1), then run the ${op} again`;
+const KEY_MSG=(e,to,op,why)=>`${e.cfg} holds a console or federation key, and ${to}'s loader refuses it (${why}); remove the key first (restore the config.json backup from the window's step 1), then run the ${op} again`;
 const RB_MSG=(why)=>`${B}'s Console does not support --sso, and the Console flags it ran with cannot be read: ${why}`;
 // Rewrites a file in a rollback set (0700, files kept by cp -p) and, unless sums is false, its SHA256SUMS line.
 function setEdit(set,name,from,to,sums=true){
@@ -1582,6 +1582,19 @@ test('T57 row 200: activate --sso, its refusals before any stop, and the rollbac
  r=await prun(e,'rollback','acme');assert.equal(r.code,0,r.out+r.err);assert.equal(pointer(e).copy,B);
  await noLeak(e);
 });
+ await t.test('row 203: a config whose federation key the target loader refuses stops an activate or a rollback before any stop, naming the first step',async(t)=>{
+  const e=await mk(t);await seedPreview(e);
+  let r=await prun(e,'activate',C1,'acme');assert.equal(r.code,0,r.out+r.err);
+  // B's loader has no federation key in its list, as a pre-203 loader has none: it refuses the key.
+  const setFed=(fed)=>{const c=JSON.parse(readFileSync(e.cfg,'utf8'));if(fed===undefined)delete c.federation;else c.federation=fed;writeFileSync(e.cfg,JSON.stringify(c))};
+  setFed({self:'hub',peers:[{id:'factory',origin:'https://mosaic.woltje.com',label:'Software factory'}]});
+  const why='mosaic-config: unsupported configuration key: "federation"';
+  await refused(e,['activate',B,'acme'],'config-console-key',KEY_MSG(e,B,'activate',why));
+  await refused(e,['rollback','acme'],'config-console-key',KEY_MSG(e,B,'rollback',why));
+  setFed(undefined);
+  r=await prun(e,'rollback','acme');assert.equal(r.code,0,r.out+r.err);assert.equal(pointer(e).copy,B);
+  await noLeak(e);
+ });
 await t.test('item 3: a rollback from --sso to a Console without it takes the flags from the set of the activation onto the copy, past a same-copy re-pin (sage-1389)',async(t)=>{
  const e=await mk(t),base=await seedPreview(e,undefined,['--send','--tester-port','7333']);await ssoConfig(e);
  let r=await prun(e,'activate',C1,'acme');assert.equal(r.code,0,r.out+r.err);
@@ -32,7 +32,7 @@ function tmp(t) {

 // git for the test's own setup, with no user config.
 function git(cwd, ...args) {
-  const r = spawnSync("git", ["-c", "user.name=t", "-c", "[email protected]", ...args], { cwd, encoding: "utf8", env: gitEnv() });
+  const r = spawnSync("git", ["-c", "maintenance.auto=false", "-c", "gc.auto=0", "-c", "user.name=t", "-c", "[email protected]", ...args], { cwd, encoding: "utf8", env: gitEnv() });
  assert.equal(r.status, 0, `git ${args.join(" ")}: ${r.stderr}`);
  return r.stdout.trim();
 }
@@ -25,7 +25,7 @@ function tmp(t) {
 }

 function git(cwd, ...args) {
-  const r = spawnSync("git", ["-c", "user.name=t", "-c", "[email protected]", ...args], { cwd, encoding: "utf8", env: gitEnv() });
+  const r = spawnSync("git", ["-c", "maintenance.auto=false", "-c", "gc.auto=0", "-c", "user.name=t", "-c", "[email protected]", ...args], { cwd, encoding: "utf8", env: gitEnv() });
  assert.equal(r.status, 0, `git ${args.join(" ")}: ${r.stderr}`);
  return r.stdout.trim();
 }
@@ -237,13 +237,66 @@ async function validateConsole(value) {
  }
 }

+// FED R2 (#1701, DESIGN.md section 3.1 D1): the optional `federation` key names this instance and its
+// peers. Ids and origins are labels, not trust: nothing here grants a peer anything (3.1, W1). The
+// origin must be exactly an https origin, the form `new URL(origin).origin` returns, so a path, a
+// trailing slash, a port that is the default, or userinfo refuses.
+const FEDERATION_ID_PATTERN = /^[a-z][a-z0-9-]{0,31}$/;
+const FEDERATION_LABEL_MAX = 80;
+
+function validateFederationOrigin(value, where) {
+  let url = null;
+  try {
+    url = new URL(value);
+  } catch {
+    url = null;
+  }
+  if (url === null || url.protocol !== "https:" || url.origin !== value) {
+    fail(2, `${where} must be an https origin with no path, query, or userinfo (got ${JSON.stringify(value)})`);
+  }
+}
+
+function validateFederation(value) {
+  if (!isPlainObject(value)) {
+    fail(2, '"federation" must be a JSON object');
+  }
+  rejectUnknownKeys(value, ["self", "peers"], "federation");
+  if (typeof value.self !== "string" || !FEDERATION_ID_PATTERN.test(value.self)) {
+    fail(2, `federation.self must match ${FEDERATION_ID_PATTERN} (got ${JSON.stringify(value.self)})`);
+  }
+  if (!Array.isArray(value.peers)) {
+    fail(2, 'federation.peers must be an array');
+  }
+  const ids = new Set([value.self]);
+  const peers = value.peers.map((peer, index) => {
+    const where = `federation.peers[${index}]`;
+    if (!isPlainObject(peer)) {
+      fail(2, `${where} must be a JSON object`);
+    }
+    rejectUnknownKeys(peer, ["id", "origin", "label"], where);
+    if (typeof peer.id !== "string" || !FEDERATION_ID_PATTERN.test(peer.id)) {
+      fail(2, `${where}.id must match ${FEDERATION_ID_PATTERN} (got ${JSON.stringify(peer.id)})`);
+    }
+    if (ids.has(peer.id)) {
+      fail(2, `${where}.id ${JSON.stringify(peer.id)} is already named (by federation.self or an earlier peer)`);
+    }
+    ids.add(peer.id);
+    validateFederationOrigin(peer.origin, `${where}.origin`);
+    if (typeof peer.label !== "string" || peer.label.trim() === "" || peer.label.length > FEDERATION_LABEL_MAX) {
+      fail(2, `${where}.label must be a non-empty string of at most ${FEDERATION_LABEL_MAX} characters`);
+    }
+    return { id: peer.id, origin: peer.origin, label: peer.label };
+  });
+  return { self: value.self, peers };
+}
+
 async function validate(document, file) {
  if (!isPlainObject(document)) {
    fail(2, "configuration must be a JSON object");
  }
  rejectUnknownKeys(
    document,
-    ["configVersion", "environment", "dataRoot", "execution", "console"],
+    ["configVersion", "environment", "dataRoot", "execution", "console", "federation"],
    "configuration",
  );

@@ -281,6 +334,9 @@ async function validate(document, file) {
  // it, so a config without it prints what it always printed.
  const consoleKey = Object.hasOwn(document, "console") ? await validateConsole(document.console) : undefined;

+  // FED R2: the same rule as `console`. The key appears in the output only when the file has it.
+  const federationKey = Object.hasOwn(document, "federation") ? validateFederation(document.federation) : undefined;
+
  return {
    configVersion: document.configVersion,
    environment: document.environment,
@@ -292,6 +348,7 @@ async function validate(document, file) {
      adapter,
    },
    ...(consoleKey === undefined ? {} : { console: consoleKey }),
+    ...(federationKey === undefined ? {} : { federation: federationKey }),
  };
 }

@@ -1078,12 +1078,12 @@ slot_problem() {
 # target's own scripts/mosaic-config.mjs validate; its output, the resolved config, is not kept.
 config_checks() {
    local cfg="${MOSAIC_CONFIG:-$HOME/.config/mosaic-dev/config.json}" out loader="$COPIES/$TO/scripts/mosaic-config.mjs" first
-    # 0: a console key; 1: no key, or no file; 2: the file doesn't parse, so whether it holds the key
+    # 0: a console or federation key (row 203: a pre-203 loader refuses federation too); 1: neither, or no file; 2: the file doesn't parse, so whether it holds the key
    # is unknown, and the run refuses rather than pass it (webby-0028 N2). load_config already exits on
    # such a file before anything is read or stopped, so this is reached only if the file changes after it.
    local key=0
    node -e 'const fs=require("fs"),f=process.argv[1];if(!fs.existsSync(f))process.exit(1);let d;try{d=JSON.parse(fs.readFileSync(f,"utf8"))}catch{process.exit(2)}
-process.exit(d!==null&&typeof d==="object"&&Object.hasOwn(d,"console")?0:1)' -- "$cfg" 2>/dev/null || key=$?
+process.exit(d!==null&&typeof d==="object"&&(Object.hasOwn(d,"console")||Object.hasOwn(d,"federation"))?0:1)' -- "$cfg" 2>/dev/null || key=$?
    [ "$key" != 1 ] || return 0
    if [ "$key" != 0 ]; then
        check_refuse config-console-key "$cfg cannot be read as JSON, so whether $TO's loader reads it is unknown; fix the config first, then run the $OP again"
@@ -1093,7 +1093,7 @@ process.exit(d!==null&&typeof d==="object"&&Object.hasOwn(d,"console")?0:1)' --
    elif out="$(MOSAIC_CONFIG="$cfg" node "$loader" validate 2>&1 >/dev/null)"; then return 0
    fi
    first="${out%%$'\n'*}"
-    check_refuse config-console-key "$cfg holds a console key, and $TO's loader refuses it ($first); remove the key first (restore the config.json backup from the window's step 1), then run the $OP again"
+    check_refuse config-console-key "$cfg holds a console or federation key, and $TO's loader refuses it ($first); remove the key first (restore the config.json backup from the window's step 1), then run the $OP again"
 }

 # Row 189 (mos-0972): --no-send drops --send from RUN_CONSOLE, so the unit and the pointer both lose
@@ -191,6 +191,72 @@ expect_refusal "console.sso slot name outside the pattern exits 2 naming the pat
 expect_refusal "unknown key under console exits 2 naming the path" \
    "$(sso_body '{"sso":{"publicOrigin":"https://console.test","providers":['"$(provider)"']},"extra":1}')" 'console.extra is not a supported key'

+# --- FED R2 (#1701, DESIGN.md section 3.1): the optional federation key ---
+# fed_body FEDERATION-JSON: a config whose federation key is the argument.
+fed_body() {
+    printf '{"configVersion":1,"environment":"development","dataRoot":"%s","execution":{"backend":"docker","provider":"zai","model":"m"},"federation":%s}' "$DATA_ROOT" "$1"
+}
+FED_VALID='{"self":"hub","peers":[{"id":"factory","origin":"https://mosaic.woltje.com","label":"Software factory"}]}'
+
+cfg fed-valid.json "$(fed_body "$FED_VALID")"
+OUT="$(MOSAIC_CONFIG="$SANDBOX/fed-valid.json" timeout 20 $CONFIG_OP validate)"
+[ $? -eq 0 ] && printf '%s' "$OUT" | grep -q '"self": "hub"' && printf '%s' "$OUT" | grep -q '"origin": "https://mosaic.woltje.com"'
+check "valid federation key loads and is in the output" $?
+
+# expect_fed_refusal NAME PATH-IN-MESSAGE FEDERATION-JSON: exit 2, and the message names the bad key path.
+expect_fed_refusal() {
+    cfg fed-bad.json "$(fed_body "$3")"
+    local err rc
+    err="$(MOSAIC_CONFIG="$SANDBOX/fed-bad.json" timeout 20 $CONFIG_OP validate 2>&1 >/dev/null)"
+    rc=$?
+    [ "$rc" -eq 2 ] && printf '%s' "$err" | grep -qF -- "$2"
+    check "$1 (exit $rc)" $?
+}
+expect_fed_refusal "federation unknown sub-key exits 2 naming the key" 'unsupported federation key: "extra"' \
+    '{"self":"hub","peers":[],"extra":1}'
+expect_fed_refusal "federation peer unknown sub-key exits 2 naming the key" 'unsupported federation.peers[0] key: "trust"' \
+    '{"self":"hub","peers":[{"id":"factory","origin":"https://mosaic.woltje.com","label":"F","trust":"full"}]}'
+expect_fed_refusal "federation peer origin over http exits 2 naming the key" "federation.peers[0].origin" \
+    '{"self":"hub","peers":[{"id":"factory","origin":"http://mosaic.woltje.com","label":"F"}]}'
+expect_fed_refusal "federation peer origin with a path exits 2 naming the key" "federation.peers[0].origin" \
+    '{"self":"hub","peers":[{"id":"factory","origin":"https://mosaic.woltje.com/console","label":"F"}]}'
+expect_fed_refusal "federation peer origin with userinfo exits 2 naming the key" "federation.peers[0].origin" \
+    '{"self":"hub","peers":[{"id":"factory","origin":"https://[email protected]","label":"F"}]}'
+expect_fed_refusal "federation peer id equal to self exits 2 naming the key" "federation.peers[0].id" \
+    '{"self":"hub","peers":[{"id":"hub","origin":"https://mosaic.woltje.com","label":"F"}]}'
+expect_fed_refusal "federation peer label empty exits 2 naming the key" "federation.peers[0].label" \
+    '{"self":"hub","peers":[{"id":"factory","origin":"https://mosaic.woltje.com","label":""}]}'
+expect_fed_refusal "federation not an object exits 2 naming the key" '"federation" must be a JSON object' '"hub"'
+expect_fed_refusal "federation self pattern exits 2 naming the key" "federation.self must match" \
+    '{"self":"Hub","peers":[]}'
+expect_fed_refusal "federation peers not an array exits 2 naming the key" "federation.peers must be an array" \
+    '{"self":"hub","peers":{}}'
+expect_fed_refusal "federation peer not an object exits 2 naming the key" "federation.peers[0] must be a JSON object" \
+    '{"self":"hub","peers":["factory"]}'
+expect_fed_refusal "federation peer id pattern exits 2 naming the key" "federation.peers[0].id must match" \
+    '{"self":"hub","peers":[{"id":"Factory","origin":"https://mosaic.woltje.com","label":"F"}]}'
+FED_LONG_LABEL="$(printf 'x%.0s' $(seq 81))"
+expect_fed_refusal "federation peer label over 80 characters exits 2 naming the key" "federation.peers[0].label" \
+    '{"self":"hub","peers":[{"id":"factory","origin":"https://mosaic.woltje.com","label":"'"$FED_LONG_LABEL"'"}]}'
+expect_fed_refusal "federation duplicate peer id exits 2 naming the key" 'federation.peers[1].id "factory" is already named' \
+    '{"self":"hub","peers":[{"id":"factory","origin":"https://mosaic.woltje.com","label":"F"},{"id":"factory","origin":"https://other.woltje.com","label":"G"}]}'
+expect_fed_refusal "federation peer origin with a trailing slash exits 2 naming the key" "federation.peers[0].origin" \
+    '{"self":"hub","peers":[{"id":"factory","origin":"https://mosaic.woltje.com/","label":"F"}]}'
+# A missing value: the pattern test coerces undefined to "undefined", which matches, so the typeof half is what refuses.
+expect_fed_refusal "federation self missing exits 2 naming the key" "federation.self must match" \
+    '{"peers":[]}'
+expect_fed_refusal "federation peer id missing exits 2 naming the key" "federation.peers[0].id must match" \
+    '{"self":"hub","peers":[{"origin":"https://mosaic.woltje.com","label":"F"}]}'
+expect_fed_refusal "federation peer label missing exits 2 naming the key" "federation.peers[0].label must be" \
+    '{"self":"hub","peers":[{"id":"factory","origin":"https://mosaic.woltje.com"}]}'
+
+# Without the key: no federation in the output, and the config still loads (FED R2 boundary).
+cfg no-federation.json '{"configVersion":1,"environment":"development","dataRoot":"'$DATA_ROOT'","execution":{"backend":"docker","provider":"zai","model":"m"}}'
+NO_FED_OUT="$(MOSAIC_CONFIG="$SANDBOX/no-federation.json" timeout 20 $CONFIG_OP validate)"
+NO_FED_RC=$?
+[ "$NO_FED_RC" -eq 0 ] && ! printf '%s' "$NO_FED_OUT" | grep -q '"federation"'
+check "config without federation loads and has no federation output" $?
+
 # Without the key: the output is exactly what the loader printed before phase 1 (sage-1340, F2).
 cfg no-console.json '{"configVersion":1,"environment":"development","dataRoot":"'$DATA_ROOT'","execution":{"backend":"docker","provider":"zai","model":"m"}}'
 EXPECTED="$(printf '{\n  "configVersion": 1,\n  "environment": "development",\n  "dataRoot": "%s",\n  "execution": {\n    "backend": "docker",\n    "provider": "zai",\n    "model": "m",\n    "adapter": "pi"\n  }\n}' "$DATA_ROOT")"
Author	SHA1	Message	Date
jason.woltje	57862d6144	docs(v574): record static approval and trace evidence requirements	2026-10-22 20:25:05 -05:00
jason.woltje	7da3822443	docs(v574): audit fixture comparisons and plan trace proof	2026-10-22 20:19:24 -05:00
jason.woltje	65e919e5ce	test(git): disable detached fixture maintenance per mos-1369	2026-10-22 20:19:06 -05:00
jason.woltje	0626464874	Q195 O2 W4 (#1799 ): log lines for the W4 design and review landing, row 203 and O2 landing; docs only	2026-10-22 18:55:11 -05:00
jason.woltje	66299eeef7	Q195 O2 W4 (#1799 ): Megavolt's round 4 review of `994c3f7fb` (blob `2af460ab7`): APPROVE, R3-B1 and R3-B2 closed, R4-N1 (re-migration after a pre-W4b restore) non-blocking for W4b; doc only	2026-10-22 18:54:51 -05:00
jason.woltje	569bb6b177	Q195 O2 W4 (#1799 ): Megavolt's round 3 review of `54246cb32` (blob `0c4f55826`): CHANGES, R2-B1 projection and R2-B2 closed, R3-B1 (reserved notes keyed on negative IDs) and R3-B2 (fence initial state and confirmation scope undefined); doc only	2026-10-22 18:54:51 -05:00
jason.woltje	fb404c909d	Q195 O2 W4 (#1799 ): Megavolt's round 2 review of `019a0ea5b` (blob `14dfe92d9`): CHANGES, B1-B9 and M1 closed, R2-B1 (paragraph-mark revisions, reserved-note leaves) and R2-B2 (release backup/restore keeps O2 text and revives revocations); doc only	2026-10-22 18:54:51 -05:00
jason.woltje	4c0a2c4fd4	Q195 O2 W4 (#1799 ): Megavolt's review of the DOCX citation design at `15e91538f` (blob `662abdb7c`): CHANGES, B1-B9 and M1 (Case 2 narrowing in O2-context turns goes to Mos/Jason); doc only	2026-10-22 18:54:51 -05:00
Rocko	2f06aad3f0	docs: define reserved notes and initial O2 restore fence	2026-10-22 18:54:51 -05:00
Rocko	6863d4c852	docs: specify O2 projection marks and restore revocation fence	2026-10-22 18:54:51 -05:00
Rocko	9ef5798acb	docs: close W4 locator and access review gaps	2026-10-22 18:54:51 -05:00
Rocko	4897520c31	docs: define committed DOCX citation and access contract	2026-10-22 18:54:51 -05:00
jason.woltje	4ca2703079	queue: revs 3360-3368. Row 203 (#1701 ): Sage brief re-pin to `8adfb261f` (3360, Webby N2), Quackerjack claim, in-review r2 and outcome (3361-3363), Sage request as jarvis (3364-3365), Webby approve record (3366), Sage landing note and done (3367-3368).	2026-10-22 18:54:10 -05:00
jason.woltje	25c09f19fe	docs: name save-group settings and enforce adoption gates	2026-10-22 18:51:33 -05:00
jason.woltje	a6da8718c4	docs: fix O2 review gates, shipping and save semantics	2026-10-22 18:51:33 -05:00
jason.woltje	ee26cfbada	docs: redesign Q195 for full WordCraft O2 editor	2026-10-22 18:51:33 -05:00
jason.woltje	a4da4e6df4	row 203: gate results on the rebased tip (`c7b754d7b`): stack-release 219/0, test-config 51/0, mutants 17/17, cli 895/0, ten scripts green with named skips; code tree unchanged from `7309260ae`	2026-10-22 18:39:28 -05:00
jason.woltje	7309260aeb	row 203: gate record on the rebased tip (`c7b754d7b`): blob table and timeout table, written before the first run	2026-10-22 18:01:35 -05:00
jason.woltje	7c543fd4a1	row 203 FED R2: cases for missing self, peer id and label (webby-0191 B3) The pattern test coerces an absent value to the string 'undefined', which matches, so the typeof halves are the only refusal for a missing value. Adds a case for each, and M15-M17 in BUILD.md; keeps the config-console-key check name on purpose. Not run yet.	2026-10-22 17:57:25 -05:00
jason.woltje	284d55cf2c	row 203 FED R2: stack-release probe reads federation; a refusal case per federation check stack-release config_checks refuses a target whose loader refuses a key the config holds; it looked only for console, so a federation-only config passed to a pre-203 copy. The probe now reads console or federation. The fixture's B loader replace follows the new rejectUnknownKeys list, which the federation key changed. Adds a test for each federation refusal in test-config.sh (six uncovered, plus trailing slash and duplicate peer id), and one stack-release test for the target-loader refusal. Mutants M7-M14 in BUILD.md. Not run yet.	2026-10-22 17:57:25 -05:00
jason.woltje	93a491d732	row 203 FED R2: federation key in the system config (#1701 ) The loader validates an optional federation block: self and peers[].id labels, peers[].origin as an https origin with no path, query or userinfo, peers[].label non-empty and at most 80 characters, peer ids unique and distinct from self. Unknown sub-keys refuse. Labels and URLs only; the key grants no trust. Absent key: config loads with no federation output. Tests in scripts/test-config.sh cover each refusal and the no-key case. Notes and mutants M1-M6 in agents/quackerjack/work/queue-203/BUILD.md. Not run yet: the gate runs on CLEAR.	2026-10-22 17:57:25 -05:00
jason.woltje	c7b754d7b1	queue: revs 3339-3359. Row 292 (#1797 , Gander) added and briefed (Sage, 3339-3340). Row 291: Gosalyn claim and in-review r1 (3341, 3344-3345), Sage request as jarvis (3353-3354), Webby approve record (3357). Row 207: Megavolt in-review (3342), Sage abandon and request as jarvis, resolved on c30841 (3347, 3349-3350), Duckworth approve record (3356), Sage landing note and done (3358-3359). Row 270: Gizmoduck claim and in-review r3 (3343, 3346), Sage abandon and request as jarvis (3348, 3351-3352), Duckworth approve record (3355).	2026-10-22 17:53:26 -05:00
jason.woltje	a94c95522f	docs: row 207 landing records (SESSIONS, BUILD-LOG, Megavolt's lines), DEFERRED 207 N1 (duckworth-0230) and 270 N6 bound to row 272 (duckworth-0228)	2026-10-22 17:51:32 -05:00