morgana: row 267 r1 notes (filbert-267-static-1): R8 entries dedupe by path and line (N1) with a two-pin case; BUILD.md states the untyped-entity version rule (N2)

agents/morgana/work/queue-267/BUILD.md

@@ -4,7 +4,8 @@ Morgana, 2026-10-25. Brief: `docs/plans/2026-10-20_case2-rows.md` "C2-15 hybrid
 pins and the end-to-end crossover" (blob 85e6fe2e). Reviewer Filbert, gate owner Sage. Claimed at rev 4087.
 Branch `morgana/row267` from refactor 78b69e1e6. Design 1.4 is `agents/gosalyn/work/case2/DESIGN.md`.
 
-Status: draft design. Nothing is built or run. No runs before Sage's CLEAR.
+Status: build committed under sage-4389 and sage-4407. Mos approved the survey.test.mjs:75 change (mos-1667,
+read against 5b2da2203). Nothing is run. No runs before Sage's CLEAR.
 
 ## 1. What the code does today (78b69e1e6)
 
@@ -80,6 +81,11 @@ C2-05a query tests keep their constants.
     without `field` gets nothing, and neither does any other file that only links to the entity.
 - The entity's type and name come from `classify(mapping, entity)` and the entity's parsed file. When the
   entity is missing, its stem stands in for the name.
+- An entity outside any type folder (a book root file, a manuscript file, or a folder that isn't a type)
+  has type null or `manuscript`. Its versions are then the hybrid canon files with that same type and a
+  matching name or stem. The brief doesn't cover this case, and no special rule is added for it (Filbert N2).
+- R8 entries are deduplicated by path and line, so two pins or two hybrids on one missing or changed
+  entity give one entry (Filbert N1). Survey counts and the sync state count each path and line once.
 
 ### 2.4 Guard (`guard.mjs`)
 
@@ -93,7 +99,8 @@ cites only source paths, excluded ones included, has no hybrid among its univers
 `docs/case2/SETUP-SHEET.md` gets one section after "Supporting folders", headed "Making a crossover
 (hybrid) universe". It covers `kind`, `name`, `sources`, `books`, `playground`, `constraints`
 (`exclude` in both forms, `pin`) and `notes`, and says that the continuity role reads and cites the notes.
-It also says that only she edits this entry (C2-04 rule M9).
+It also says that Jason edits this entry by hand and agents can't change it (C2-04 rule M9), as the
+sheet already says for the rest of the entry.
 
 ## 3. Tests and mutants
 
@@ -110,10 +117,10 @@ New files and cases, all on scratch repos under TMPDIR (never /tmp):
   - `universeInfo` returns the sources, constraints and notes.
   - `excluded()` gets unit cases for both forms and for a non-hybrid.
 - **`mapping.test.mjs`:** one case per new refusal: both forms fit, neither fits, the hybrid's own book,
-  an exclude under a source playground, and a pin under a source playground. `second/Characters` at
-  `:203` still checks.
+  an exclude under a source playground, a pin under a source playground, and a `pin.entity` that doesn't
+  end in `.md` (Q5). `second/Characters` at `:203` still checks.
 - **`reader.test.mjs`:**
-  - R8 cases: entity missing, entity changed, a same-name hybrid version with no link, and a list value.
+  - R8 cases: entity missing, two pins on a missing entity give one entry (N1), entity changed, a same-name hybrid version with no link, and a list value.
   - Non-R8 cases: a hybrid place file with `age: 300` that links the entity, and a different hybrid
     character that links it.
   - The excluded-link R6, once for each exclude form.
@@ -121,48 +128,57 @@ New files and cases, all on scratch repos under TMPDIR (never /tmp):
   refuses in both forms. A cite of only an excluded source path passes as that universe's item.
 - **`packages/bus/tests/citation-guard.test.mjs`:** through `citationWorld` with `mapChange` adding the
   hybrid, the excluded-beside-hybrid send refuses and the `messages` count stays the same.
+- **Sync state after an excluded-link R6 (sage-4389 finding a):** one case that syncs a commit holding a
+  hybrid file's excluded link, then reads the sync state back with `readSyncState` and finds the R6 with
+  the default message. This shows `validProblem` (`mirror.mjs:196-201`) still accepts the state.
 - **`packages/bus/tests/library-lookups.test.mjs`:** one broker case, where `library.find` and
   `library.universe` in the hybrid return what the library tests above assert.
 - **C2-04 M9 rule (agents can't write `projects`), not a mutant:** a case in `packages/business/tests/library-projects-protected.test.mjs` where an organization
   write that adds a new hybrid universe refuses `organization-projects-protected`. This is outside the
-  brief's "tests in library and bus" list (§4 Q1).
+  brief's "tests in library and bus" list. Sage ruled it in (Q1), so the business suite is on the run list.
+- **`docs/case2/SURVEY-RUN.md:98`** names the problems line as `R1 .., ..., R8 ..`. No test reads that file.
+- **One existing assertion changes:** `survey.test.mjs:75` gains `, R8 0`. The before and after lines are
+  in `assertion-diff.md`, which goes to Mos before the commit (mos-1272).
 
 Mutants. Each runs only its own named tests, and the tree is restored after each one.
 
 | # | Mutation | Killed by |
 |---|---|---|
-| X1 | `excluded()` ignores the type form | hybrid.test lookups, type form |
-| X2 | `excluded()` ignores the path form | hybrid.test lookups, path form |
-| X3 | `sees()` keeps its old `inside()` reading | hybrid.test type form |
-| X4 | the validator accepts "both forms fit" | mapping.test |
-| X5 | the validator skips the playground check | mapping.test |
-| X6 | R8 compares with plain `String()` (list equals scalar) | reader.test list value |
-| X7 | a version is matched by link instead of name | reader.test non-R8 cases |
-| X8 | the reader drops the excluded-link R6 | reader.test |
+| X1 | `excluded()` ignores the type form | hybrid.test "C2-15 excluded(): ..." and "C2-15 type form: find and search ..." |
+| X2 | `excluded()` ignores the path form | hybrid.test "C2-15 excluded(): ..." and "C2-15 path form: find and search ..." |
+| X3 | `sees()` keeps its old `inside()` reading | hybrid.test "C2-15 type form: find and search ..." |
+| X4 | the validator accepts "both forms fit" | mapping.test "C2-15: each exclude and pin is checked against the hybrid's sources" |
+| X5 | the validator skips the playground check | mapping.test "C2-15: each exclude and pin is checked against the hybrid's sources" |
+| X6 | R8 compares with plain `String()` (list equals scalar) | reader.test "C2-15 R8: the pinned entity reads clean ..." (list case) |
+| X7 | a version is matched by link instead of name | reader.test "C2-15 R8: a hybrid version of the entity ..." |
+| X8 | the reader drops the excluded-link R6 | reader.test "C2-15 R6: a hybrid file that links into an excluded source path ..."; sync.test "C2-15 sage-4389 (a) ..." also fails |
 | X9 | the guard skips the excluded check | guard.test "C2-15 a hybrid cite beside an excluded source path refuses citation-cross-universe, both forms" (the mutant run); bus citation-guard "C2-15 excluded cite beside a hybrid refuses and inserts nothing" also fails |
 
-## 4. Open questions for Sage and Filbert
+## 4. Rulings (sage-4389)
 
-- **Q1 (manifest):** the C2-04 M9 test lives in `packages/business/tests`, which the brief's file list leaves
-  out. I recommend adding it there, beside the existing C2-04 M9 cases, and putting the business suite on the
-  gate. The alternative is a bus-level `organization.set` test, which needs more setup and tests the
-  same writer.
-- **Q2 (supporting):** the brief refuses a path under a source's playground. A source's supporting
-  prefix is never read by the hybrid either (`sees()` passes canon only). I recommend refusing that too,
-  under the same REQ-LIB-3 reason. That widens the brief by one rule, so I need a yes.
-- **Q3 (R8 reaches other readers):** adding `RULES.R8` goes beyond the reader:
-  - `survey.mjs:70` counts problems per `RULES` key, so the survey line gains `R8 0`.
-    `survey.test.mjs:75` pins that line and has to change. It's in the library tests, so it's in scope.
-  - `mirror.mjs` `validProblem` accepts R8 through `RULES`, so a sync state written after this row
-    carries R8 problems.
-  - A copy running older code would refuse such a state. That only matters if a re-pin goes backwards.
-  - I'll grep `docs/case2/SURVEY-RUN.md` and the Console for R-code lists before in-review.
-- **Q4 (version scope):** I count only the hybrid's canon files as versions. Playground is "what if" and
-  is exempt, as it is from R5 and R6. A hybrid with `books: []` therefore never gets a version R8. It
-  still gets the entity R8.
-- **Q5 (`pin.entity` not `.md`):** a non-`.md` entity is never indexed, so R8 would report it missing at
-  every commit. I recommend refusing it in the validator. The brief leaves existence to the reader, but
-  this is a shape check, not an existence check.
+- **Q1 yes.** The C2-04 M9 case is new and goes only in `packages/business/tests/library-projects-protected.test.mjs`.
+  No existing assertion there changes. The business suite is on the run list.
+- **Q2 dropped.** The condition was a file:line showing that the hybrid's index, reader and guard never
+  read a source's supporting prefix. Two of the three do read it:
+  - Index: `query.mjs:55` `sees()` returns false for a source file whose scope isn't `canon`, so the
+    hybrid's lookups never show a source's supporting file. This one holds.
+  - Reader: `reader.mjs:206-209` checks R5 for playground targets only, and R6 skips any target in a
+    source universe. A hybrid canon file that links into a source's supporting file gets no problem and
+    keeps the link (`:211`).
+  - Guard: `guard.mjs:91-97` checks the cited universes and never their scope. A reply that cites a
+    hybrid file beside a source's supporting file passes, and so does one beside a source's playground
+    file (`guard.mjs:87-90` only stops a playground cite marked `as: 'canon'`).
+  Sage's ranges in sage-4399 (`reader.mjs:206-211`, `guard.mjs:87-97`) cover the same lines. Sage files
+  a DEFERRED entry for the guard and reader gap at landing.
+  So the validator does not refuse an exclude under a source's supporting prefix. The guard observation
+  is outside this row's guard scope ("the excluded-path cite only"); I report it to Sage as a possible
+  follow-up and don't change it here.
+- **Q3:** R8 reaches the survey and the sync state as described. `survey.test.mjs:75` goes through
+  `assertion-diff.md`. Finding (a) adds the sync-state readback test in §3. `packages/library/README.md`
+  lists R1-R7 in its problems table, so it gains an R8 row; no test reads that file.
+- **Q4 as written:** versions count only in the hybrid's canon.
+- **Q5 yes:** a `pin.entity` that doesn't end in `.md` refuses `library-mapping-invalid`, with its own test.
+- **Finding (a):** R6 keeps the default message, with the readback test above.
 
 ## 5. Gate
 

agents/morgana/work/queue-267/assertion-diff.md

@@ -0,0 +1,22 @@
+# Row 267: one existing assertion changes (mos-1272)
+
+File: `packages/library/tests/survey.test.mjs:75`, in the test that checks the survey's last three lines
+with `--mapping`.
+
+Before:
+
+```
+    'problems R1 0, R2 3, R3 0, R4 0, R5 0, R6 0, R7 0']);
+```
+
+After:
+
+```
+    'problems R1 0, R2 3, R3 0, R4 0, R5 0, R6 0, R7 0, R8 0']);
+```
+
+Why: R8 ("pinned value changed") is a new rule in `problems.mjs` `RULES`, and the survey line lists a
+count for every `RULES` key (`survey.mjs:70`), so it gains `R8 0`. The fixture has no hybrid and no pin,
+so the count is 0 and no other count moves.
+
+No other existing assertion in the row changes.

docs/case2/SETUP-SHEET.md

@@ -65,6 +65,37 @@ Tell Jason which folders you want to mark. He adds them to the `supporting` list
 entry of your business file. He edits that entry by hand, and you can ask him to add or change a folder
 later.
 
+## Making a crossover (hybrid) universe
+
+A crossover is its own universe, called a hybrid. It reads the canon of the universes it draws on, its
+sources, and has its own books. Agents only cross worlds inside one. Like the rest of the `projects`
+entry, Jason adds it by hand and the agents can't change it. Tell him what you want, and he writes an
+entry with these keys:
+- `kind`: `"hybrid"`.
+- `name`: the name you call it by.
+- `sources`: two or more universes it reads.
+- `books`: its own book folders. It may start with none.
+- `playground` and `supporting`: its own folders, the same as for any universe.
+- `constraints`: the rules below, if you want any.
+- `notes`: text on how the worlds fit together, up to 4000 characters. The continuity agent reads the
+  notes and cites them.
+
+A hybrid never reads a source's playground.
+
+There are two kinds of constraint:
+- `exclude` hides part of a source. It takes two forms. A source and a type folder, for example
+  `second/Characters`, hides that type folder in each of that source's books. A path, for example
+  `Book One/Research`, hides that folder or note, which must sit in a book of one of the sources. Agents
+  in the hybrid don't see what is hidden, can't cite it beside a hybrid note, and a hybrid note that links
+  to it gets a link warning.
+- `pin` holds one fact fixed: a source note (`entity`, a `.md` path), a property (`field`) and its value
+  (`value`). If the note goes missing or the property changes, Mosaic warns. It also warns when a hybrid
+  note of the same type and name sets that property to something else. Linking to the note doesn't count:
+  a hybrid character who links `[[Mara]]` is someone else.
+
+Mosaic refuses an entry whose `exclude` or `pin` points outside the sources' books, or into a source's
+playground.
+
 ## Saves and agent notes
 
 When you save a file in the Console, Mosaic makes a commit under the name and email you give Jason for

docs/case2/SURVEY-RUN.md

@@ -95,7 +95,7 @@ With `--mapping` three lines follow:
 |---|---|
 | `scopes canon .., playground .., unmapped ..; indexed ..` | tree entries per scope, and notes indexed |
 | `resolved root .., vault-prefix .., relative .., shortest .., unresolved ..` | links per resolver step. `unresolved` is the R4 count |
-| `problems R1 .., ..., R7 ..` | problems per rule |
+| `problems R1 .., ..., R8 ..` | problems per rule |
 
 Folder paths and short property names are the only words from her repo in the output. In a folder
 name, tab, newline, carriage return, backspace and form feed print as `\t`, `\n`, `\r`, `\b` and `\f`.

packages/bus/tests/citation-guard.test.mjs

@@ -1,7 +1,7 @@
 import test from 'node:test';
 import assert from 'node:assert/strict';
 import { connect } from 'node:net';
-import { readFileSync, rmSync, writeFileSync } from 'node:fs';
+import { mkdirSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
 import { join } from 'node:path';
 import { Client } from '../src/client.mjs';
 import { serve } from '../src/server.mjs';
@@ -68,6 +68,31 @@ test('C2-06 supporting file stores supporting scope and its real agent trailer',
   assert.deepEqual(JSON.parse(event.body).check, { citations: [{ scope: 'supporting', agent: 'acme/scribe', file }] });
 });
 
+// C2-15: a hybrid over harbor and second that excludes harbor's Places folder (path form).
+const crossMapping = entry => {
+  entry.universes.cross = { kind: 'hybrid', name: 'Cross', sources: ['harbor', 'second'], books: ['Crossover'],
+    constraints: [{ exclude: 'Book One/Places' }] };
+  return entry;
+};
+
+test('C2-15 excluded cite beside a hybrid refuses and inserts nothing', async t => {
+  const f = citationWorld(t, { mapChange: crossMapping }); f.call(f.agent, 'role.claim');
+  mkdirSync(join(f.repo, 'Crossover/Chapters'), { recursive: true });
+  writeFileSync(join(f.repo, 'Crossover/Chapters/01.md'), 'A hybrid fixture.\n');
+  git(f.repo, 'add', '-A'); git(f.repo, 'commit', '-qm', 'hybrid fixture');
+  const commit = git(f.repo, 'rev-parse', 'HEAD'); f.setServed(commit);
+  const hybrid = fixtureCite(commit, { path: 'Crossover/Chapters/01.md', lines: [1, 1], quote: 'hybrid fixture' });
+  const hidden = fixtureCite(commit, { path: 'Book One/Places/Harbor Town.md', lines: [4, 4], quote: 'Salt.' });
+  const count = f.store.get('SELECT count(*) n FROM messages').n;
+  await assert.rejects(f.call(f.agent, 'message.send', { to: 'human', body: citedBody([hybrid, hidden]) }),
+    e => e.code === 'citation-cross-universe' && e.reason === 'citation 2 (Book One/Places/Harbor Town.md) is excluded from hybrid cross');
+  assert.equal(f.store.get('SELECT count(*) n FROM messages').n, count);
+  assert.equal(f.store.all("SELECT * FROM events WHERE json_extract(body,'$.action')='message.checked'").length, 0);
+  // The hybrid beside source canon it can see goes through.
+  await f.call(f.agent, 'message.send', { to: 'human', body: citedBody([hybrid, fixtureCite(commit)]) });
+  assert.equal(f.store.get('SELECT count(*) n FROM messages').n, count + 1);
+});
+
 test('C2-06 check evidence and insert are atomic when storing evidence fails', async t => {
   const f = citationWorld(t); f.call(f.agent, 'role.claim');
   f.store.run(`CREATE TRIGGER fixture_check_refused BEFORE INSERT ON events

packages/bus/tests/library-lookups.test.mjs

@@ -251,3 +251,18 @@ test('C2-05c broker forwards supporting scope and returns the served blob withou
   assert.equal(await f.call('library.get', { universe: 'second', path, scope: 'supporting' }), null);
   await assert.rejects(f.call('library.manuscript', { universe: 'harbor', book: 'Book One', scope: 'supporting' }), { code: 'query-argument-invalid' });
 });
+
+test('C2-15 broker: library.find and library.universe in a hybrid see its own files and source canon, minus the type-form exclude', async t => {
+  const projects = { books: mappingEntry() };
+  projects.books.universes.cross = { kind: 'hybrid', name: 'Cross', sources: ['harbor', 'second'], books: ['Crossover'],
+    constraints: [{ exclude: 'second/Characters' }], notes: 'Fixture crossover.' };
+  const f = await world(t, { projects, files: { ...TEXTS, 'Crossover/Chapters/01.md': '# Both\n[[Tomas]] and [[Elsewhere]].\n' } });
+  const found = await f.call('library.find', { universe: 'cross', query: '' });
+  assert.deepEqual(found.results.map(x => [x.path, x.universe]), [
+    ['Book One/Chapters/01.md', 'harbor'], ['Book One/Characters/Tomas.md', 'harbor'], ['Crossover/Chapters/01.md', 'cross']]);
+  assert.deepEqual((await f.call('library.find', { universe: 'cross', query: '', scope: 'playground' })).results, []);
+  assert.ok(!(await f.call('library.find', { universe: 'harbor', query: '' })).results.some(x => x.path.startsWith('Crossover/')));
+  const universe = await f.call('library.universe', { universe: 'cross' });
+  assert.deepEqual([universe.kind, universe.sources, universe.constraints, universe.notes],
+    ['hybrid', ['harbor', 'second'], [{ exclude: 'second/Characters' }], 'Fixture crossover.']);
+});

packages/business/tests/library-projects-protected.test.mjs

@@ -67,3 +67,12 @@ test('C2-04 M9: a serialization hook cannot change projects after the canonical
     Object.defineProperty(next.projects, 'toJSON', { value: () => changed });
   });
 });
+
+test('C2-15: an organization write that adds a hybrid universe with exclude and pin constraints is protected', t => {
+  const f = fixture(t);
+  protectedWrite(f, next => {
+    next.projects.books.universes.cross = { kind: 'hybrid', name: 'An invented crossover', sources: ['harbor', 'second'],
+      books: ['Crossover'], playground: [], notes: 'Fixture only',
+      constraints: [{ exclude: 'second/Characters' }, { pin: { entity: 'Book One/Characters/Mara Vell.md', field: 'name', value: 'Mara Vell' } }] };
+  });
+});

packages/library/README.md

@@ -119,8 +119,9 @@ Problems carry `{ code, path, line, message }`:
 | R3 | front matter not fully parsed, `line` is where parsing stopped | yes, front matter kept raw |
 | R4 | link resolves to no file or to more than one | yes, link dropped |
 | R5 | canon file links into the playground | yes |
-| R6 | canon file links into another universe, a hybrid's sources excepted | yes |
+| R6 | canon file links into another universe, a hybrid's sources excepted, or a hybrid's file links into a path its `exclude` covers | yes |
 | R7 | two paths differ only in case | no, neither |
+| R8 | pinned value changed: a hybrid's pinned entity is missing or its `field` differs from `value`, or a hybrid version of it sets `field` to another value | yes |
 
 The front matter parser takes scalars, quoted strings, flow lists, block lists and wikilinks. Nested
 maps, anchors, block scalars and duplicate keys stop it with R3.

packages/library/src/guard.mjs

@@ -3,7 +3,7 @@
 // only the citations, never what the text says. Codes are design 5.2's table.
 import { lstatSync } from 'node:fs';
 import { git } from '../../project/src/git.mjs';
-import { classify } from './scope.mjs';
+import { classify, excluded } from './scope.mjs';
 import { listTree, readLibrary, readTexts, splitLines } from './reader.mjs';
 import { LibraryError } from './problems.mjs';
 import { mirrorPath, readSyncState } from './mirror.mjs';
@@ -94,6 +94,11 @@ export async function checkReply(body, { limits, mapping, library, web }) {
     const sources = hybrid ? mapping.universes[hybrid].sources : [];
     if (!hybrid || !universes.every(u => u === hybrid || sources.includes(u)))
       refuse('citation-cross-universe', `the citations span universes ${universes.join(', ')}`);
+    // C2-15: beside a hybrid cite, a source path the hybrid excludes is outside the hybrid's world.
+    citations.forEach((c, i) => {
+      if (found[i] && found[i].universe !== hybrid && excluded(mapping, hybrid, c.path))
+        refuse('citation-cross-universe', `citation ${i + 1} (${c.path}) is excluded from hybrid ${hybrid}`);
+    });
   }
   citations.forEach((c, i) => {
     if (!Object.hasOwn(c, 'url')) return;

packages/library/src/index.mjs

@@ -1,7 +1,7 @@
 // packages/library: her writing repo read by a mapping (Case 2, design 1 and 7.4). See README.md.
 export { LibraryError, RULES, problem, sortProblems } from './problems.mjs';
 export { checkMapping, TYPES } from './mapping.mjs';
-export { classify } from './scope.mjs';
+export { classify, excluded } from './scope.mjs';
 export { supportingPath } from './supporting.mjs';
 export { extractLinks, parseWikilink, resolver, formOf, isAttachment } from './links.mjs';
 export { readLibrary, listTree, readTexts, parseFile, parseFrontMatter, headCommit, MAX_BLOB, LINK_FIELDS } from './reader.mjs';

packages/library/src/mapping.mjs

@@ -5,6 +5,7 @@
 // Business file loading wires it in C2-04, which passes its own `fail` so the refusal reads as a
 // business file problem. Agents can't write this entry (M9, C2-04).
 import { raise } from './problems.mjs';
+import { typeForm } from './scope.mjs';
 
 export const TYPES = Object.freeze(['character', 'place', 'research', 'tracker', 'summary']);
 const ID = /^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/;
@@ -144,6 +145,32 @@ export function checkMapping(entry, where = 'library', { fail = raise } = {}) {
         bad(`universes.${id}.sources names ${JSON.stringify(source)}, which is not a plain universe`);
     }
   }
+  // C2-15 (design 1.4): each constraint against the hybrid's sources, now that every source is read. An
+  // exclude reads as the type form `source/Type` or as a path in a source's book, never both. A path, or
+  // a pinned entity, under a source's playground is one the hybrid never reads (REQ-LIB-3). Whether the
+  // path exists at a commit is the reader's to check.
+  for (const [id, universe] of Object.entries(universes)) {
+    if (universe.kind !== 'hybrid') continue;
+    const sources = universe.sources.map(source => [source, universes[source]]);
+    const inSourceBook = path => sources.some(([, s]) => s.books.some(book => path === book || holds(book, path)));
+    const underPlayground = path => sources.find(([, s]) => s.playground.some(p => path === p.slice(0, -1) || path.startsWith(p)))?.[0];
+    const sourcePath = (path, at) => {
+      if (!inSourceBook(path)) bad(`${at} ${JSON.stringify(path)} lies inside no book of the hybrid's sources`);
+      const owner = underPlayground(path);
+      if (owner) bad(`${at} ${JSON.stringify(path)} lies under a playground of universes.${owner}, which the hybrid never reads`);
+    };
+    universe.constraints.forEach((constraint, i) => {
+      const at = `universes.${id}.constraints[${i}]`;
+      if (constraint.pin) {
+        if (!constraint.pin.entity.endsWith('.md')) bad(`${at}.pin.entity ${JSON.stringify(constraint.pin.entity)} is not a .md file`);
+        return sourcePath(constraint.pin.entity, `${at}.pin.entity`);
+      }
+      const type = typeForm(entry, universe, constraint.exclude);
+      if (type && inSourceBook(constraint.exclude))
+        bad(`${at}.exclude ${JSON.stringify(constraint.exclude)} reads as both a source/type and a source path`);
+      if (!type) sourcePath(constraint.exclude, `${at}.exclude`);
+    });
+  }
   const books = [...bookOwner.keys()];
   for (const a of books) for (const b of books) if (a !== b && holds(a, b)) bad(`book folder ${JSON.stringify(a)} holds book folder ${JSON.stringify(b)}`);
   for (const a of prefixes) for (const b of prefixes) if (a !== b && holds(a, b)) bad(`playground ${JSON.stringify(a)} holds playground ${JSON.stringify(b)}`);

packages/library/src/problems.mjs

@@ -13,6 +13,7 @@ export const RULES = Object.freeze({
   R5: 'canon file refers into the playground',
   R6: 'canon file refers into another universe',
   R7: 'paths differ only in case',
+  R8: 'pinned value changed',
 });
 
 export function problem(code, path, line, message = RULES[code]) {

packages/library/src/query.mjs

@@ -8,6 +8,7 @@ import { raise } from './problems.mjs';
 import { TYPES } from './mapping.mjs';
 import { indexFor } from './index-build.mjs';
 import { listTree } from './reader.mjs';
+import { excluded } from './scope.mjs';
 
 // The same cap as packages/harness/src/tools.mjs REPLY_CAP. The query tests assert the two stay equal.
 export const QUERY_REPLY_CAP = 40_000;
@@ -19,7 +20,6 @@ const SCOPE_RANK = Object.freeze({ supporting: 0, playground: 1, canon: 2 });
 
 const bytes = value => JSON.stringify(value).length;
 const invalid = message => raise('query-argument-invalid', message);
-const inside = (folder, path) => path.startsWith(folder.endsWith('/') ? folder : `${folder}/`);
 
 function textArg(value, name) {
   if (typeof value !== 'string') invalid(`${name} must be text`);
@@ -47,13 +47,13 @@ function universeArg(mapping, value) {
 }
 
 // Whether universe U may see a file. Its own files, in either scope. A hybrid also sees the canon of
-// its declared sources, minus the folders its exclude constraints name. A hybrid never sees a source's
-// playground. Pin constraints do not hide anything; they are reported by universeInfo only.
+// its declared sources, minus what its exclude constraints cover (scope.mjs excluded(), C2-15). A hybrid
+// never sees a source's playground. Pin constraints hide nothing; the reader reports them as R8.
 export function sees(mapping, universe, file) {
   if (file.universe === universe) return true;
   const entry = mapping.universes[universe];
   if (entry.kind !== 'hybrid' || !entry.sources.includes(file.universe) || file.scope !== 'canon') return false;
-  return !entry.constraints.some(c => c.exclude !== undefined && inside(c.exclude, file.path));
+  return !excluded(mapping, universe, file.path);
 }
 
 // The files one universe may see in one scope, with optional book and type filters, in path order.

packages/library/src/reader.mjs

@@ -4,7 +4,7 @@
 // way. Nothing in the repo is checked out or run (D7). Each R-rule is a problem, never a refusal
 // of the commit; the affected file or link is left out of the index.
 import { git, gitBytes } from '../../project/src/git.mjs';
-import { classify } from './scope.mjs';
+import { classify, excluded } from './scope.mjs';
 import { extractLinks, isAttachment, parseWikilink, resolver } from './links.mjs';
 import { LibraryError, problem, raise, sortProblems } from './problems.mjs';
 
@@ -169,7 +169,7 @@ function frontMatterLine(lines, bodyLine, field) {
 }
 
 // Read a commit under a checked mapping (mapping.mjs). Returns the indexed files and every
-// R1-R7 problem: { commit, files: [...], problems: [...] }, frozen, sorted by path.
+// R1-R8 problem: { commit, files: [...], problems: [...] }, frozen, sorted by path.
 export async function readLibrary({ repo, commit, mapping }) {
   if (!mapping || mapping.kind !== 'library') throw new LibraryError('library-mapping-invalid', 'expected a checked library mapping');
   const entries = await listTree(repo, commit);
@@ -206,17 +206,64 @@ export async function readLibrary({ repo, commit, mapping }) {
       if (file.scope === 'canon') {
         if (to.scope === 'playground') problems.push(problem('R5', file.path, link.line));
         const sources = mapping.universes[file.universe].sources ?? [];
-        if (to.universe !== file.universe && !sources.includes(to.universe)) problems.push(problem('R6', file.path, link.line));
+        // A hybrid's link into a path its exclude covers is R6 too (C2-15). An excluded path is always in a
+        // source, so a link gets at most one R6.
+        if ((to.universe !== file.universe && !sources.includes(to.universe)) || excluded(mapping, file.universe, to.path))
+          problems.push(problem('R6', file.path, link.line));
       }
       kept.push({ ...link, path: target.path, step: target.step });
     }
     file.links = kept;
     delete file.stop;
   }
+  problems.push(...pinProblems(mapping, files, byPath));
   files.sort((a, b) => a.path < b.path ? -1 : 1);
   return deepFreeze({ commit, files, problems: sortProblems(problems) });
 }
 
+// R8 (C2-15, design 1.4): each pin of each hybrid. The pinned entity gets R8 when it isn't indexed (absent,
+// R1, R2 or R7) or its front matter doesn't hold `field` as a scalar whose text equals String(value); a
+// list, null, a missing key and R3 front matter all count as changed. A hybrid canon file is a version of
+// the entity when classify gives it the entity's type and its name matches: the trimmed front matter
+// `name` on both sides, or the file names when either has no text name. A version that sets `field` to
+// another value gets R8 on that key's line. A link alone never makes a version.
+function pinProblems(mapping, files, byPath) {
+  const out = [];
+  for (const [hybrid, entry] of Object.entries(mapping.universes)) {
+    if (entry.kind !== 'hybrid') continue;
+    for (const { pin } of entry.constraints.filter(c => c.pin)) {
+      const entity = byPath.get(pin.entity);
+      if (!entity) out.push(problem('R8', pin.entity));
+      else if (!pinned(entity, pin)) out.push(problem('R8', pin.entity, keyLine(entity, pin.field)));
+      const type = classify(mapping, pin.entity).type;
+      const stem = pin.entity.split('/').pop().replace(/\.md$/, '');
+      const name = entity ? textName(entity) : null;
+      for (const file of files) {
+        if (file.universe !== hybrid || file.scope !== 'canon' || file.type !== type) continue;
+        const own = textName(file);
+        if ((name !== null && own !== null ? own !== name : file.name !== stem)) continue;
+        if (file.frontmatter && Object.hasOwn(file.frontmatter, pin.field) && !pinned(file, pin))
+          out.push(problem('R8', file.path, keyLine(file, pin.field)));
+      }
+    }
+  }
+  // Two pins (or two hybrids) on one missing or changed entity give one entry per path and line (Filbert N1).
+  const seen = new Set();
+  return out.filter(p => { const key = `${p.path}\0${p.line ?? ''}`; return !seen.has(key) && seen.add(key); });
+}
+const textName = file => typeof file.frontmatter?.name === 'string' && file.frontmatter.name.trim() ? file.frontmatter.name.trim() : null;
+function pinned(file, { field, value }) {
+  const held = file.frontmatter && Object.hasOwn(file.frontmatter, field) ? file.frontmatter[field] : undefined;
+  return ['string', 'number', 'boolean'].includes(typeof held) && String(held) === String(value);
+}
+// The front matter line of `field` (bare or quoted key), or undefined.
+function keyLine(file, field) {
+  if (file.bodyLine < 3) return undefined;
+  const key = field.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+  const at = file.lines.slice(1, file.bodyLine - 2).find(([, t]) => new RegExp(`^["']?${key}["']?\\s*:`).test(t));
+  return at?.[0];
+}
+
 function deepFreeze(value) {
   if (value && typeof value === 'object' && !Object.isFrozen(value)) { Object.freeze(value); for (const v of Object.values(value)) deepFreeze(v); }
   return value;

packages/library/src/scope.mjs

@@ -36,3 +36,26 @@ function place(mapping, path, under, where) {
     : mapping.manuscript.includes(folder) ? 'manuscript' : null;
   return { ...where, type, folder };
 }
+
+// C2-15 (design 1.4): whether an `exclude` constraint of universe `hybrid` covers `path`. The type form
+// `source/Type` (first segment one of the hybrid's sources, the rest one key of `types`) covers that type
+// folder in each of the source's books. Otherwise the exclude is a path and covers itself and what lies
+// inside it. checkMapping keeps the two readings from both fitting. False for a universe that isn't a
+// hybrid. Reads only the path (D2).
+export function excluded(mapping, hybrid, path) {
+  const entry = mapping.universes[hybrid];
+  if (entry?.kind !== 'hybrid' || typeof path !== 'string') return false;
+  return entry.constraints.some(c => {
+    if (c.exclude === undefined) return false;
+    const type = typeForm(mapping, entry, c.exclude);
+    if (type) return mapping.universes[type.source].books.some(book => path.startsWith(`${book}/${type.folder}/`));
+    return path === c.exclude || path.startsWith(`${c.exclude}/`);
+  });
+}
+
+// { source, folder } when `exclude` reads as the type form for this hybrid entry, else null.
+export function typeForm(mapping, entry, exclude) {
+  const [source, ...rest] = exclude.split('/');
+  const folder = rest.join('/');
+  return entry.sources.includes(source) && rest.length === 1 && Object.hasOwn(mapping.types, folder) ? { source, folder } : null;
+}

packages/library/tests/guard.test.mjs

@@ -73,6 +73,25 @@ test('C2-06 independent universes refuse; a hybrid and only its sources pass', a
   assert.equal((await checkReply(body([hybrid, cite(r.commit), other]), c)).citations.length, 3);
 });
 
+test('C2-15 a hybrid cite beside an excluded source path refuses citation-cross-universe, both forms', async t => {
+  const r = repo(t, { ...BASE, 'Crossover/Chapters/01.md': 'A hybrid fixture.\n', 'Second World/Characters/Ilse.md': 'Ilse fixture.\n',
+    'Book One/Research/Logs.md': 'Logs fixture.\n' }), c = context(r);
+  const at = (path, quote) => cite(r.commit, { path, lines: [1, 1], quote });
+  const hybrid = at('Crossover/Chapters/01.md', 'hybrid fixture');
+  for (const [exclude, hidden, quote] of [['second/Characters', 'Second World/Characters/Ilse.md', 'Ilse fixture'],
+    ['Book One/Research', 'Book One/Research/Logs.md', 'Logs fixture']]) {
+    c.mapping = mapping(e => { e.universes.cross = { kind: 'hybrid', name: 'Cross', sources: ['harbor', 'second'], books: ['Crossover'],
+      constraints: [{ exclude }] }; return e; });
+    c.library = libraryReader(r.repo, r.commit, c.mapping);
+    await assert.rejects(checkReply(body([hybrid, cite(r.commit), at(hidden, quote)]), c),
+      e => refusal('citation-cross-universe')(e) && e.reason === `citation 3 (${hidden}) is excluded from hybrid cross`, exclude);
+    // The hybrid with source canon it can see passes.
+    assert.equal((await checkReply(body([hybrid, cite(r.commit)]), c)).citations.length, 2, exclude);
+    // A cite of only the excluded source path is that source universe's item, as before.
+    assert.deepEqual((await checkReply(body([at(hidden, quote)]), c)).citations.map(x => x.scope), ['canon'], exclude);
+  }
+});
+
 test('C2-06 web cites require allowed definition, this session fetch and kept quote', async t => {
   const c = context(repo(t)), web = { url: 'https://fixture.invalid/page', quote: 'kept text' };
   await assert.rejects(checkReply(body([web]), c), refusal('citation-unfetched'));

packages/library/tests/hybrid.test.mjs

@@ -0,0 +1,97 @@
+// C2-15 (row 267): a hybrid universe end to end. A business-file-shaped mapping (the fixture mapping plus a
+// `cross` hybrid over harbor and second) on a repo in her layout's shape, read through the C2-05a queries,
+// once for each exclude form of design 1.4. Bodies are made up; the repos are built under the scratch area.
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import { excluded } from '../src/scope.mjs';
+import { find, get, search, universeInfo } from '../src/query.mjs';
+import { mapping, MARKER } from './helpers.mjs';
+import { scratchRepo, note } from './query-fixture.mjs';
+
+const FILES = {
+  'Book One/Characters/Mara Vell.md': note('character', 'Mara Vell', `Grey eyes. ${MARKER}`),
+  'Book One/Research/Ferry Logs.md': note('research', 'Ferry Logs', `Timetable. ${MARKER}`),
+  'Book One/Playground/What If.md': note('summary', 'What If', `${MARKER} [[Mara Vell]]`),
+  'Second World/Characters/Ilse.md': note('character', 'Ilse', `${MARKER} Ilse.`),
+  'Second World/Places/Gate.md': note('place', 'Gate', `${MARKER} Gate.`),
+  'Crossover/Chapters/01.md': `# Meeting\n${MARKER} [[Mara Vell]] meets [[Ilse]] at [[Gate]].\nShe reads [[Ferry Logs]].\n`,
+  'Crossover/Places/Bridge.md': note('place', 'Bridge', `${MARKER} Bridge.`),
+};
+
+// The two forms of one rule: the type form hides second's Characters folder; the path form hides harbor's
+// Research folder.
+const FORMS = {
+  type: { exclude: 'second/Characters', hidden: 'Second World/Characters/Ilse.md' },
+  path: { exclude: 'Book One/Research', hidden: 'Book One/Research/Ferry Logs.md' },
+};
+const NOTES = 'Ilse crosses over after book one.';
+const withCross = exclude => mapping(e => {
+  e.universes.cross = { kind: 'hybrid', name: 'Crossover', sources: ['harbor', 'second'], books: ['Crossover'],
+    constraints: [{ exclude }, { pin: { entity: 'Book One/Characters/Mara Vell.md', field: 'name', value: 'Mara Vell' } }],
+    notes: NOTES };
+  return e;
+});
+const src = (ref, map) => ({ repo: ref.repo, commit: ref.commit, mapping: map });
+const ALL_CANON = ['Book One/Characters/Mara Vell.md', 'Book One/Research/Ferry Logs.md', 'Crossover/Chapters/01.md',
+  'Crossover/Places/Bridge.md', 'Second World/Characters/Ilse.md', 'Second World/Places/Gate.md'];
+
+test('C2-15 excluded(): the type form covers the type folder in each source book, the path form its own subtree', () => {
+  const type = withCross('second/Characters'), path = withCross('Book One/Research');
+  assert.equal(excluded(type, 'cross', 'Second World/Characters/Ilse.md'), true);
+  assert.equal(excluded(type, 'cross', 'Second World/Characters/Deep/Ilse.md'), true);
+  assert.equal(excluded(type, 'cross', 'Second World/Places/Gate.md'), false);
+  assert.equal(excluded(type, 'cross', 'Book One/Characters/Mara Vell.md'), false);
+  assert.equal(excluded(type, 'cross', 'second/Characters/Ilse.md'), false);
+  assert.equal(excluded(path, 'cross', 'Book One/Research/Ferry Logs.md'), true);
+  assert.equal(excluded(path, 'cross', 'Book One/Research'), true);
+  assert.equal(excluded(path, 'cross', 'Book One/Research Notes/Other.md'), false);
+  assert.equal(excluded(path, 'cross', 'Second World/Characters/Ilse.md'), false);
+  // Not a hybrid, or no such universe: nothing is excluded.
+  assert.equal(excluded(path, 'harbor', 'Book One/Research/Ferry Logs.md'), false);
+  assert.equal(excluded(path, 'nowhere', 'Book One/Research/Ferry Logs.md'), false);
+});
+
+for (const [form, { exclude, hidden }] of Object.entries(FORMS)) {
+  test(`C2-15 ${form} form: find and search in the hybrid return its own files and the sources' canon, never a source playground or the excluded path`, async t => {
+    const s = src(scratchRepo(t, FILES), withCross(exclude));
+    const found = (await find(s, { universe: 'cross', query: '' })).results;
+    assert.deepEqual(found.map(r => r.path), ALL_CANON.filter(p => p !== hidden));
+    for (const r of found) assert.equal(r.universe, r.path.startsWith('Crossover/') ? 'cross' : r.path.startsWith('Book One/') ? 'harbor' : 'second');
+    assert.deepEqual((await find(s, { universe: 'cross', query: '', scope: 'playground' })).results, []);
+    const hits = (await search(s, { universe: 'cross', text: MARKER })).results.map(r => r.path);
+    assert.ok(!hits.includes(hidden) && !hits.includes('Book One/Playground/What If.md'));
+    assert.ok(hits.includes('Crossover/Places/Bridge.md'));
+    assert.ok(hits.includes(form === 'type' ? 'Book One/Research/Ferry Logs.md' : 'Second World/Characters/Ilse.md'));
+    assert.equal(await get(s, { universe: 'cross', path: hidden }), null);
+  });
+
+  test(`C2-15 ${form} form: get keeps the hybrid's links into its sources and drops the excluded target`, async t => {
+    const s = src(scratchRepo(t, FILES), withCross(exclude));
+    const chapter = await get(s, { universe: 'cross', path: 'Crossover/Chapters/01.md' });
+    const out = chapter.links_out.map(l => l.path);
+    assert.ok(out.includes('Book One/Characters/Mara Vell.md'));
+    assert.ok(out.includes('Second World/Places/Gate.md'));
+    assert.ok(!out.includes(hidden));
+  });
+}
+
+test('C2-15 a source universe never sees a hybrid file', async t => {
+  const s = src(scratchRepo(t, FILES), withCross('Book One/Research'));
+  for (const universe of ['harbor', 'second']) {
+    assert.ok(!(await find(s, { universe, query: '' })).results.some(r => r.path.startsWith('Crossover/')), universe);
+    assert.ok(!(await search(s, { universe, text: MARKER })).results.some(r => r.path.startsWith('Crossover/')), universe);
+    assert.equal(await get(s, { universe, path: 'Crossover/Chapters/01.md' }), null);
+  }
+  const mara = await get(s, { universe: 'harbor', path: 'Book One/Characters/Mara Vell.md' });
+  assert.ok(!mara.links_in.some(l => l.path.startsWith('Crossover/')));
+});
+
+test('C2-15 universeInfo returns the hybrid\'s sources, constraints and notes', async t => {
+  const s = src(scratchRepo(t, FILES), withCross('second/Characters'));
+  const info = await universeInfo(s, { universe: 'cross' });
+  assert.equal(info.kind, 'hybrid');
+  assert.deepEqual(info.sources, ['harbor', 'second']);
+  assert.deepEqual(info.constraints, [{ exclude: 'second/Characters' },
+    { pin: { entity: 'Book One/Characters/Mara Vell.md', field: 'name', value: 'Mara Vell' } }]);
+  assert.equal(info.notes, NOTES);
+});

packages/library/tests/mapping.test.mjs

@@ -212,6 +212,34 @@ test('a hybrid universe is a shape the query code can take (1.4), with sources t
   refuses(e => { hybrid(e); e.universes.cross.constraints = [{ exclude: 'x', pin: {} }]; return e; }, 'library-mapping-invalid', /exactly one/);
 });
 
+test('C2-15: each exclude and pin is checked against the hybrid\'s sources', () => {
+  const cross = (...constraints) => e => {
+    e.universes.cross = { kind: 'hybrid', name: 'Crossover', sources: ['harbor', 'second'], books: ['Crossover'], constraints };
+    return e;
+  };
+  const pin = entity => ({ pin: { entity, field: 'eyes', value: 'grey' } });
+  // Both forms, a whole source book and a pin in a source book check.
+  assert.equal(mapping(cross({ exclude: 'second/Characters' }, { exclude: 'Book One/Research' }, { exclude: 'Second World' },
+    pin('Second World/Characters/Ilse.md'))).universes.cross.constraints.length, 4);
+  // Both readings fit: second's book folder is also named "second".
+  refuses(e => { cross({ exclude: 'second/Characters' })(e); e.universes.second.books = ['second']; return e; },
+    'library-mapping-invalid', /constraints\[0\]\.exclude "second\/Characters" reads as both a source\/type and a source path/);
+  // Neither fits: an unmapped path, the hybrid's own book, a type that isn't a key, a non-source universe.
+  for (const exclude of ['Elsewhere/Characters', 'Crossover/Characters', 'second/Ghosts', 'harbor', 'Book'])
+    refuses(cross({ exclude }), 'library-mapping-invalid', /\.exclude ".*" lies inside no book of the hybrid's sources/);
+  refuses(e => { cross({ exclude: 'third/Characters' })(e); e.universes.third = { name: 'Third', books: ['Third World'] }; return e; },
+    'library-mapping-invalid', /lies inside no book of the hybrid's sources/);
+  // Under a source's playground, as the prefix itself or inside it.
+  for (const exclude of ['Book One/Playground', 'Book One/Playground/Ideas'])
+    refuses(cross({ exclude }), 'library-mapping-invalid', /\.exclude ".*" lies under a playground of universes\.harbor, which the hybrid never reads/);
+  refuses(cross(pin('Book One/Playground/What If.md')), 'library-mapping-invalid',
+    /\.pin\.entity "Book One\/Playground\/What If\.md" lies under a playground of universes\.harbor/);
+  refuses(cross(pin('Crossover/Characters/Mara Vell.md')), 'library-mapping-invalid', /\.pin\.entity .* lies inside no book of the hybrid's sources/);
+  // Q5: a pinned entity is one .md note.
+  for (const entity of ['Book One/Characters/Mara Vell', 'Book One/Characters', 'Book One/Board.canvas'])
+    refuses(cross(pin(entity)), 'library-mapping-invalid', /\.pin\.entity ".*" is not a \.md file/);
+});
+
 test('a caller-supplied fail receives the code, as business file loading will pass it (C2-04)', () => {
   const seen = [];
   const fail = (code, message) => { seen.push(code); throw new Error(message); };

packages/library/tests/reader.test.mjs

@@ -3,7 +3,7 @@ import assert from 'node:assert/strict';
 import { writeFileSync } from 'node:fs';
 import { join } from 'node:path';
 import { readLibrary, parseFrontMatter, LibraryError, MAX_BLOB } from '../src/index.mjs';
-import { BASE, git, mapping, repo } from './helpers.mjs';
+import { BASE, git, MARKER, mapping, repo } from './helpers.mjs';
 
 const codes = (result, path) => result.problems.filter(p => p.path === path).map(p => p.code);
 const file = (result, path) => result.files.find(f => f.path === path);
@@ -150,6 +150,81 @@ test('R6: a canon file that refers into another universe is reported; a hybrid m
   assert.deepEqual(codes(result, 'Crossover/Chapters/A.md'), []);
 });
 
+// C2-15: a hybrid over harbor and second with one exclude and, optionally, a pin on Mara's eyes.
+const crossWith = (...constraints) => mapping(e => {
+  e.universes.cross = { kind: 'hybrid', name: 'Cross', sources: ['harbor', 'second'], books: ['Crossover'], constraints };
+  return e;
+});
+const EYES = { pin: { entity: 'Book One/Characters/Mara Vell.md', field: 'eyes', value: 'grey' } };
+const character = (name, extra = []) => ['---', 'type: character', ...(name ? [`name: ${name}`] : []), ...extra, '---', MARKER, ''].join('\n');
+const MARA_GREY = character('Mara Vell', ['eyes: grey']);
+
+test('C2-15 R6: a hybrid file that links into an excluded source path is reported, in both exclude forms', async t => {
+  const r = repo(t, { ...BASE, 'Second World/Characters/Ilse.md': character('Ilse'), 'Book One/Research/Logs.md': '# Logs\n',
+    'Crossover/Chapters/A.md': 'From [[Mara Vell]] and [[Ilse]].\nThen [[Logs]].\n' });
+  for (const [exclude, line] of [['second/Characters', 1], ['Book One/Research', 2]]) {
+    const result = await readLibrary({ repo: r.repo, commit: r.commit, mapping: crossWith({ exclude }) });
+    assert.deepEqual(result.problems.filter(p => p.path === 'Crossover/Chapters/A.md'),
+      [{ code: 'R6', path: 'Crossover/Chapters/A.md', line, message: 'canon file refers into another universe' }], exclude);
+    // The link stays in the file's links, as for every R-rule; the index's sees() is what hides it.
+    assert.equal(file(result, 'Crossover/Chapters/A.md').links.length, 3);
+    // A source's own link into the same path is not the hybrid's and stays clean.
+    assert.deepEqual(codes(result, 'Book One/Chapters/Chapter 01.md'), []);
+  }
+});
+
+test('C2-15 R8: the pinned entity reads clean when its field holds the value, and is reported when missing or changed', async t => {
+  const at = async files => {
+    const r = repo(t, { ...BASE, ...files });
+    return (await readLibrary({ repo: r.repo, commit: r.commit, mapping: crossWith(EYES) })).problems.filter(p => p.code === 'R8');
+  };
+  assert.deepEqual(await at({ 'Book One/Characters/Mara Vell.md': MARA_GREY }), []);
+  // Missing: no line.
+  const base = { ...BASE }; delete base['Book One/Characters/Mara Vell.md'];
+  const r = repo(t, base);
+  assert.deepEqual((await readLibrary({ repo: r.repo, commit: r.commit, mapping: crossWith(EYES) })).problems.filter(p => p.code === 'R8'),
+    [{ code: 'R8', path: 'Book One/Characters/Mara Vell.md', message: 'pinned value changed' }]);
+  // Two pins on the missing entity give one entry (Filbert N1).
+  const twoPins = crossWith(EYES, { pin: { entity: 'Book One/Characters/Mara Vell.md', field: 'name', value: 'Mara Vell' } });
+  assert.deepEqual((await readLibrary({ repo: r.repo, commit: r.commit, mapping: twoPins })).problems.filter(p => p.code === 'R8'),
+    [{ code: 'R8', path: 'Book One/Characters/Mara Vell.md', message: 'pinned value changed' }]);
+  // Changed, with the key's line; a missing key has no line.
+  assert.deepEqual(await at({ 'Book One/Characters/Mara Vell.md': character('Mara Vell', ['eyes: green']) }),
+    [{ code: 'R8', path: 'Book One/Characters/Mara Vell.md', line: 4, message: 'pinned value changed' }]);
+  assert.deepEqual((await at({})).map(p => [p.path, p.line]), [['Book One/Characters/Mara Vell.md', undefined]]);
+  // A list holding the value, or null, is not the value (String(['grey']) would be 'grey').
+  for (const eyes of ['eyes: [grey]', 'eyes:', 'eyes: ~'])
+    assert.deepEqual((await at({ 'Book One/Characters/Mara Vell.md': character('Mara Vell', [eyes]) })).map(p => p.line), [4], eyes);
+  // Unparsed (R3) front matter counts as changed.
+  assert.equal((await at({ 'Book One/Characters/Mara Vell.md': character('Mara Vell', ['eyes: grey', 'bad: {a: 1}']) })).length, 1);
+  // A number pin compares as text.
+  const r2 = repo(t, { ...BASE, 'Book One/Characters/Mara Vell.md': character('Mara Vell', ['age: 30']) });
+  const age = crossWith({ pin: { entity: 'Book One/Characters/Mara Vell.md', field: 'age', value: 30 } });
+  assert.deepEqual((await readLibrary({ repo: r2.repo, commit: r2.commit, mapping: age })).problems.filter(p => p.code === 'R8'), []);
+});
+
+test('C2-15 R8: a hybrid version of the entity that sets the field to another value is reported on that line; a link alone is not a version', async t => {
+  const read = async files => {
+    const r = repo(t, { ...BASE, 'Book One/Characters/Mara Vell.md': MARA_GREY, ...files });
+    return (await readLibrary({ repo: r.repo, commit: r.commit, mapping: crossWith(EYES) })).problems.filter(p => p.code === 'R8');
+  };
+  // Same type and name, no link to the entity: a version.
+  assert.deepEqual(await read({ 'Crossover/Characters/Older Mara.md': character('Mara Vell', ['eyes: blue']) }),
+    [{ code: 'R8', path: 'Crossover/Characters/Older Mara.md', line: 4, message: 'pinned value changed' }]);
+  // No name on the version: the file names compare.
+  assert.deepEqual((await read({ 'Crossover/Characters/Mara Vell.md': character(null, ['eyes: blue']) })).map(p => [p.path, p.line]),
+    [['Crossover/Characters/Mara Vell.md', 3]]);
+  // A version that keeps the value, or doesn't set the field, is clean.
+  assert.deepEqual(await read({ 'Crossover/Characters/Older Mara.md': character('Mara Vell', ['eyes: grey']),
+    'Crossover/Characters/Young Mara.md': character('Mara Vell') }), []);
+  // Not versions: a place with the field, a different character that links her, a playground copy, a source file.
+  assert.deepEqual(await read({
+    'Crossover/Places/Mara Vell.md': ['---', 'type: place', 'name: Mara Vell', 'eyes: blue', '---', '', ''].join('\n'),
+    'Crossover/Characters/Ilse.md': character('Ilse', ['eyes: blue', 'relationships:', '  - "[[Mara Vell]]"']),
+    'Second World/Characters/Mara Vell.md': character('Mara Vell', ['eyes: blue']),
+  }), []);
+});
+
 test('R7: two paths that differ only in case are both left out', async t => {
   const r = repo(t, BASE);
   writeFileSync(join(r.root, 'twin'), 'twin\n');

packages/library/tests/survey.test.mjs

@@ -72,7 +72,7 @@ test('with --mapping the survey adds scope, resolver step and problem counts', a
   assert.deepEqual(tail, [
     'scopes canon 5, playground 1, supporting 0, unmapped 3; indexed 6',
     'resolved root 2, vault-prefix 1, relative 2, shortest 3, unresolved 0',
-    'problems R1 0, R2 3, R3 0, R4 0, R5 0, R6 0, R7 0']);
+    'problems R1 0, R2 3, R3 0, R4 0, R5 0, R6 0, R7 0, R8 0']);
   for (const s of NEVER) assert.ok(!out.stdout.includes(s), s);
 });
 

packages/library/tests/sync.test.mjs

@@ -527,3 +527,18 @@ test('C2-03b T5 helper: the named seat\'s user and file, never a link, 0644, ano
   assert.ok(statSync(marker).isFile(), 'the swap ran');
   assert.equal(readFileSync(file, 'utf8'), 'fixture-token-other-0047\n', 'the slot path names the other file now');
 });
+
+test('C2-15 sage-4389 (a): an excluded-link R6 is written to the sync state with the default message and reads back', async t => {
+  const w = await world(t);
+  // context.business.projects.books is this same entry, so the run checks the mapping with the hybrid in it.
+  w.entry.universes.cross = { kind: 'hybrid', name: 'Cross', sources: ['harbor', 'second'], books: ['Crossover'],
+    constraints: [{ exclude: 'Book One/Places' }] };
+  const next = w.push({ 'Crossover/Chapters/A.md': 'See [[Harbor Town]].\n' });
+  const { state, code } = await w.run();
+  assert.equal(code, null);
+  assert.equal(state.served, next);
+  const read = await w.state();
+  assert.equal(read.served, next);
+  assert.deepEqual(read.problems.filter(p => p.path === 'Crossover/Chapters/A.md'),
+    [{ code: 'R6', path: 'Crossover/Chapters/A.md', line: 1, message: 'canon file refers into another universe' }]);
+});