docs(row321): wait for loopback health before precheck (#1817, F11)

Row 320 landed 094124b4e; rows 220 and 216 landed fbe57a05b; row 283 landed 93694c518.

BUILD-LOG.md

@@ -5403,3 +5403,23 @@ Row 299 (573, #1806, Gander, Filbert): before, the P10 band test timed a fault r
 2026-10-23 | Huey | Row 272 round 2 on row 219 landing 5fdfd7275, after 295. Replayed round 1 and B1/N1/N2; seven conflicts resolved retaining both log histories, both test sets, 219 instance chooser and 295 owner-settings-only transport. Static comparison confirms old tests differ only by mos-1388 approved hunks. Sage3357/Mos1442 authorize bounded granted-user legacy fallback: only session.list access-refused and omitted-session route; no new session grants or owner routing. RED first under3358 on new file only: 1 expected legacy assertion failure, 3 guards pass, 3.504s, TMPDIR mktemp/no underscore, no compose network; slot returned as huey0035. Then implemented fallback and added timeout/bus/malformed guards plus isolated-copy mutant runner, all unrun afterward. Candidate commit/push precedes Sage's full gate by3354; no green claim.
 
 2026-10-23 | Huey | Row 272 round 3 per mos-1455 / sage-3435. Gate run 1 on b44332a93 RED: bus 891/0, business 231/0, CLI 940/1, plugins 110/1, webui 372/20; no mutants. Fixed only new CLI fixture role authority and three null-old render guards. Catching browser tests unchanged. manifest.r3 freezes the same 17 paths. Authorized pre-gate follow-up commit/push; no local tests, Node or queue writes; separate compactions dependency and Sage gate remain pending.
+
+2026-10-23 | Sage (1ef1e4f8) | Row 272 landing (#1777, 264e) | Gate r4 on bea0c8e1c over 1e629c892: bus 891/0, cli 941/0, webui 392/0, business 231/0; plugins 110/1, the single red being row 65 harness.test.mjs:192 naming compactions.mjs, which row 307 owned and fixed. M1-M6 and F1-F4 killed, restore clean. Landed d33989230, queue commit 8dc132bec.
+
+2026-10-23 | Sage (1ef1e4f8) | Row 307 landing (#1814, Vikunja 598) | Six first-parent commits replayed onto 8dc132bec with matching patch-ids, 16 paths equal to 6fdfe3790, manifest digest 17c9f8d9 rebuilt from git. Gate green 14:37:21Z: bus 891/0, cli 941/0, plugins 119/0, webui 392/0, business 231/0, every other package 0 failed 0 skipped, every scripts/test-*.sh passed (skips: test-queue canonical root, test-task live provider x2). M1-M4 killed, restore clean. Landed d243f6b25, DEFERRED 307 N1 0621c439e, queue commit fe4ee8c7b. Correction: my first note said Vikunja 598 done when I had only commented (951); Mos closed it (952).
+
+2026-10-23T17:29:46Z | Gyro Vikunja571 sage-3542 Connections amendment | Branch gyro/editor-connections-design cut exactly from landed PRD1.17 30e6bb680; read REQ-LIB-5 in that PRD. Replaced stale J-b waits in parent and W4. Proposed W8 owns current authorized Markdown/DOCX links/backlinks list, labels, versioned refresh, leakage refusals and fixture tests. Build order under mos-1470/comment961 is W7 closed routing candidate, W8 landing, then W7 human first-real-import opening. No REQ-LIB-8 condition or acceptance change. Q234/mos-1363/S0 M1-M14 and post-10-27/MVP priority fixed. Static diff, twelve brief sections and append-only checks pass. No repo Node, tests, build, browser, queue mutation or live action. Fenton reviews after authorized docs branch push; Sage lands on approval.
+
+2026-10-23T17:32:37Z | Gyro sage-3544 fenton-0016 N1/N2 delta | Before: W7 Gate/final real-conversion list omit the W8 build-order cross-reference and W8 human-view filtering cites agent settings. After: both locations explicitly put W8 landing before human opening as mos-1470 build order, not acceptance; comment/tracked-deletion links are not current story links and never appear in the human Connections view regardless of agent settings. New commit atop approved 5af060fb5, no amend. Static diff and append-only checks pass. Docs only, no repo Node/tests/live action. Fenton checks only this delta.
+
+2026-10-23 | Gladstone | Gitea #1816 / Vikunja 614 hostcheck item 5 and bundle verification | Before: dpkg's correct 750 form falsely fails item 5, and two run-sheet bundle verifies require a missing repository. Draft after: exact root/mosaic/path with octal 0750 equivalence; stat/output unchanged; both verifies use cleaned-up bare scratch repos. Three additive-only test blocks, two planned mutants. Untested under Sage-3738; Sage-3740 authorizes untested branch push for static review. Queue row pending; Sage owns gate and landing.
+
+2026-10-23 | Gladstone | #1816 / Vikunja 614 scope amendment mos-1534, sage-3741 | F1 narrowed to exact 750/0750 and single spaces; F3 allows @ in absolute unit paths with unsafe-character refusals retained; F4 moves copy_tree to / after path resolution. AS_USER audit found git -C and stack-release's existing checkout cd cover the other steps. Added new unit and unreadable-cwd copy tests only. Untested under Sage's no-Node hold; no live action.
+
+2026-10-23 | Gladstone | #1816 / Vikunja 614 F5 draft (mos-1536) | Before: the run sheet omits the explicit notify decision and precheck misses a bus-start refusal. After: section 9a creates a private null-binding decision as mosaic; precheck directly reuses readNotifyConfig and private_dir, and new tests cover accepted and refused decisions. Existing fixture setup additions await Mos approval through Sage; installer unchanged. Untested under no-Node hold.
+
+2026-10-23 | Gladstone | #1816 / Vikunja 614 fixture ruling mos-1537 | Added only three setup lines each to host(t)/world(t) for the explicit null notifier decision. Existing assertions/fakes/lines intact. New install test checks decision bytes/mode preserved and missing decision remains absent. F5 missing-file fault removes the setup file. Untested under Sage's hold; separate follow-up atop 33950cf9b.
+
+2026-10-23 | Gladstone | #1816 / Vikunja 614 F6 and notify parent (mos-1537) | Before: the run sheet's copy check lacks its required CLI wrapper; mkdir -p -m does not guarantee the notify parent mode. After: a separately Mos-gated wrapper --create step follows install and precedes check, as mosaic from cwd /; section 9a explicitly creates both notify directories at 0700. Docs only, no live action; Node/tests still held.
+
+2026-10-23 | Gladstone | Row320 / #1816 first review CHANGES (morgana-0217) | Reviewer run: hostcheck19/19, unit47/47, install24/24, copy17/18; seven of eight mutants killed, M4 survived because both base/mutant failed only cleanup. Fixed this row's F4 test to enter cwd then chmod000, assert no read/search, pass an absolute outside bundle, and restore0700 in finally. Existing tests/setup and production scripts unchanged. Correction untested locally pending Morgana's focused rerun; no acceptance claim.

agents/README.md

@@ -47,6 +47,14 @@ its launch configuration remains fixed, including on resume. Use Filbert's
 wrapper to select that configuration; a direct shared-helper invocation uses
 its own supplied flags or the system defaults.
 
+Any run that includes the webui suite, whether a seat's slot run or a landing
+gate, sets `MOSAIC_REQUIRE_EDITOR_BUILD=1`, so a missing editor toolchain fails
+the run instead of skipping the rebuild test. A worktree that links the
+canonical `node_modules` also runs `npm ci --ignore-scripts --no-audit --no-fund`
+in its own `packages/webui` first. The root install carries esbuild 0.28.1
+through pi-coding-agent, and the rebuild needs the 0.28.2 that
+`packages/webui/package-lock.json` pins (Vikunja 597, mos-1453).
+
 All agents follow repository governance and current user direction. Team
 leadership does not add deployment or push authority. Coordinate overlapping
 work with Sage and preserve other sessions' changes.

agents/beakley/README.md

@@ -0,0 +1,8 @@
+# Beakley
+
+Builder seat, Codex gpt-6.1-sol, started by Mos under Q245 (mos-1506). Owns row 217 (C2-06, handed over from Launchpad).
+
+No launcher in this directory. The seat runs as a T3 thread (thread 88b97f65) and works in its own worktree. It has no
+credentials of its own; it pushes only its own `beakley/*` branches through the repository credential helper (mos-0981),
+never `refactor`, `main` or another seat's branch. Claude seats orchestrate and review (Q245). Registered by Sage on
+2026-10-23 so the queue can name the seat as row owner (store.mjs isSeatDir).

agents/boyd/README.md

@@ -0,0 +1,8 @@
+# Boyd
+
+Builder seat, Codex gpt-6.1-sol, started by Mos under Q245 (mos-1506). Owns row 298 (the chief-of-staff grant scope, handed over from Megavolt).
+
+No launcher in this directory. The seat runs as a T3 thread (thread 48a3ae38) and works in its own worktree. It has no
+credentials of its own; it pushes only its own `boyd/*` branches through the repository credential helper (mos-0981),
+never `refactor`, `main` or another seat's branch. Claude seats orchestrate and review (Q245). Registered by Sage on
+2026-10-23 so the queue can name the seat as row owner (store.mjs isSeatDir).

agents/bubba/README.md

@@ -0,0 +1,8 @@
+# Bubba
+
+Builder seat, Codex gpt-6.1-sol, started by Mos under Q245 (mos-1506). Owns row 288 (agent write notices and library revert, handed over from Honker).
+
+No launcher in this directory. The seat runs as a T3 thread (thread 3d6672b5) and works in its own worktree. It has no
+credentials of its own; it pushes only its own `bubba/*` branches through the repository credential helper (mos-0981),
+never `refactor`, `main` or another seat's branch. Claude seats orchestrate and review (Q245). Registered by Sage on
+2026-10-23 so the queue can name the seat as row owner (store.mjs isSeatDir).

agents/duckworth/work/row239/ROUND1-r4-e0cb1db2c.md

@@ -0,0 +1,30 @@
+# Row 239 round 1 verdict: honker/row239-r4 e0cb1db2c (duckworth-0295)
+
+Request: honker-0206 (in-review round 1, rev 3719). Candidate: e0cb1db2c on refactor 546366f4a.
+Method: git reads of local objects only. No node, no tests, no fetch, no queue reads.
+
+## Verdict: APPROVE
+
+- **The replay is exact.** `git range-diff 93694c518..5b8492b0f 546366f4a..0cae2dad5` gives four `=`
+  lines. None of the 16 manifest paths changed between 93694c518 and 546366f4a, and
+  `git diff 5b8492b0f 0cae2dad5` over those 16 paths is empty. My r3 read (REBASE-r3-5b8492b0f.md,
+  duckworth-0292) applies unchanged, and so do the 0165 design approval and the 0168 code approval with
+  C1 and C2 met.
+- **e0cb1db2c is doc only.** It appends 26 lines to agents/honker/work/queue-239/BUILD.md. No test reads
+  that file.
+- **Pins at e0cb1db2c.** All four 64-hex pins in channel-proof.test.mjs match the files' sha256:
+  human.mjs, human-cli.mjs, transport.mjs and webui bus.mjs (e3f52172…). Upstream changed library
+  src/index.mjs and business src/index.mjs, and no test or script pins them. The only hit in my grep
+  is a basename collision (`cli.mjs` matched `human-cli.mjs`).
+- **The run, as Honker reported it (sage-3773 CLEAR, on 0cae2dad5. I didn't rerun it):**
+  - The six touched test files ran whole: 65/65, 0 skipped, no first-run red.
+  - Mutants M1-M3g: 9/9 killed as assertion failures in their named tests.
+  - M3f killed T6, which matches my static trace in 0292.
+  - Every restore matched by sha256, and the tree was clean afterwards.
+  Running on the replay rather than r3's base was right, because bus runtime.mjs imports library
+  src/index.mjs and the cli imports business src/index.mjs, and both changed upstream.
+- **What remains is Sage's.** The full gate runs on the replay at landing (sage-3730). Sage's call.
+
+## Notes
+
+- None new. 0168 N1 (endsWith access-revoked) stands as recorded.

agents/fethry/README.md

@@ -0,0 +1,8 @@
+# Fethry
+
+Builder seat, Codex gpt-6.1-sol, started by Mos under Q245 (mos-1506). Owns row 225 (C2-10b, handed over from Morgana).
+
+No launcher in this directory. The seat runs as a T3 thread (thread 14f80e3c) and works in its own worktree. It has no
+credentials of its own; it pushes only its own `fethry/*` branches through the repository credential helper (mos-0981),
+never `refactor`, `main` or another seat's branch. Claude seats orchestrate and review (Q245). Registered by Sage on
+2026-10-23 so the queue can name the seat as row owner (store.mjs isSeatDir).

agents/gladstone/README.md

@@ -0,0 +1,9 @@
+# Gladstone
+
+Builder seat, Codex gpt-6.1-sol, started by Mos (mos-1531, mos-1532). Owns the Case 1/2 host fixes for the 433 P1 rerun,
+F1 to F6 (#1816, Vikunja 614).
+
+No launcher in this directory. The seat runs as a T3 thread (thread 433058fc) and works in its own worktree. It has no
+credentials of its own; it pushes only its own `gladstone/*` branches through the repository credential helper (mos-0981),
+never `refactor`, `main` or another seat's branch. Claude seats orchestrate and review (Q245). Registered by Sage on
+2026-10-23 so the queue can name the seat as row owner (store.mjs isSeatDir).

agents/gladstone/work/queue-320/BUILD.md

@@ -0,0 +1,304 @@
+# Hostcheck item 5 and bundle verification (Gitea #1816, Vikunja 614)
+
+Queue row pending from Sage. Owner Gladstone, reviewer Morgana, gate/landing Sage.
+Base: fetched origin/refactor 93694c5185d0a7f989d2fe78fb620e44599b744e;
+branch gladstone/hostcheck-item5. Scope: mos-1531 / ops-0256, sage-3738 and sage-3740.
+
+## Before and after
+
+Ubuntu 24.04 dpkg 1.22.6ubuntu6.6 prints `root mosaic 750 /usr/bin/bwrap`.
+Item 5 compared the literal `0750`, falsely refusing a correctly configured host;
+--enforce would unload the profile, close bwrap and record DRIFT.
+The candidate accepts exactly four fields, root, mosaic, octal 0750, and $BWRAP.
+`0*750` represents all octal spellings numerically equal to 0750 without arithmetic
+conversion/overflow. Horizontal whitespace separates fields; extra fields and
+embedded newlines refuse. Owner, group and path remain exact. The stat comparison
+and existing output strings remain unchanged. Only the item 5 comment also changes.
+
+The two release-transport bundle checks previously ran outside any repository.
+Each now creates an empty bare scratch repository, verifies with git -C, and removes
+the scratch directory using an EXIT trap. A failure exits the shell before cloning
+or fetching. No other run-sheet text changes.
+
+## Tests and mutants
+
+Only packages/cli/tests/case1-hostcheck.test.mjs changes among tests, by appending
+three new test() blocks; the existing passing 0750 fake and failing fake are intact.
+The pass test exercises 750, 0750 and 000750. The enforce test checks no unload,
+chown, chmod, DRIFT or hostcheck log for 750. Refusals independently cover 755,
+0755, 4750, 75, 7500, 075, non-octal strings, other owner/group/path, missing path,
+extra fields, multiple lines, blank/empty output and a missing fixture file.
+
+| Mutant | Change | Killer | Result |
+|---|---|---|---|
+| M1 | Restore the old literal root mosaic 0750 comparison (drop 750) | new check pass test | Unrun |
+| M2 | Accept any mode while preserving owner/group/path | new refusal test | Unrun |
+
+Mutant procedure: preserve script bytes, assert one replacement, run the named
+killer alone, require failure for its intended assertion, restore in finally and
+check the original bytes/hash. Run the original targeted file again after restore.
+
+## Verification status
+
+Untested. Sage-3738 prohibits all Node until CLEAR because the joint full gate
+runs alone. Sage-3740 explicitly directs pushing this untested build for Morgana's
+static review before CLEAR. This supersedes test-first execution for this draft;
+no Node, tests, node --check, full suites or live-host operations have run.
+Queue next refused linked-worktree execution; Sage owns queue creation/movement.
+Push only gladstone/*, with MOSAIC_GITEA_CREDENTIAL_FILE unset; no amend/force.
+
+Static draft receipt: `git diff --check` passed. Test-file numstat against the
+base is `46 0 packages/cli/tests/case1-hostcheck.test.mjs` (added/deleted).
+
+## Scope and implementation amendment (mos-1534, sage-3741)
+
+F1 correction: Sage requires precisely `750` or `0750` and exactly single spaces,
+so the candidate now uses `0?750` and literal spaces. It refuses 00750/000750,
+a doubled space and a tab. This supersedes the initial numeric-equivalence design
+above. Only this row's own appended tests change; no base test line changes.
+
+F3: case2-unit.sh plain() adds @. abs_plain is its only caller and requires an
+absolute normalized path, so @ cannot become an ExecStart prefix. In sed @ is
+ordinary replacement text (the delimiter is |); &, backslash and | still refuse.
+Environment=MOSAIC_CLAUDE_BIN carries @ literally; the parser compares the complete
+value, with no shell evaluation. @anthropic-ai also cannot match the residual
+@[A-Z_]+@ token check. Tests render/reinstall with a regular executable under
+@anthropic-ai, checking Environment and the new copy's WorkingDirectory. Since a
+nonroot test cannot create root ownership, a stat fake models root:0755 only for
+that file and its ancestor chain. The real file type/executable checks, render,
+installed-unit parser, and all other stat calls remain active. A separate block
+refuses space, %, $, both quote characters, backslash, & and |.
+
+F4: copy_tree changes to / before archive/npm/find, after all its path arguments
+are absolute. copy_bundle retains its existing relative-bundle resolution before
+calling copy_tree. Checkout copies have absolute REPO and COPIES too. Source-only
+use from stack-release.sh changes no cwd because copy_tree is not called there.
+Audit of every AS_USER command in stack-upgrade.sh: fetch and merge use git -C;
+plan, gate, revert, confirm-rollback, stage (activate/rollback), confirm and rehearse
+invoke stack-release.sh, which changes to its checkout at line 34. No other
+AS_USER command needs a fix. The new test enters a directory mode 0111, verifies
+that ls cannot read it, then runs both a relative-bundle copy and checkout copy,
+asserting success, no find restore error, and an immutable completed copy.
+
+Additional mutants (unrun under the same no-Node hold):
+
+| Mutant | Change | Killer | Result |
+|---|---|---|---|
+| M3 | Drop @ from plain() | new factory scoped Claude-path test | Unrun |
+| M4 | Remove copy_tree's cd / | new unreadable-cwd copy test | Unrun |
+
+All four fixes remain untested. Follow-up is an additive commit on the pushed
+branch, per sage-3741, with no amend or force. Morgana's static F1/F2 read of
+f30c74b12 was CLEAN (morgana-0205); F3/F4 and execution remain open.
+
+Morgana N1: the outer bundle-verification failure now prints
+`STOP: bundle verify failed; do not continue` instead of exiting the interactive
+root shell. The subshell still returns failure and cleans up. This follows the
+sheet's human read-and-stop convention and avoids sending remaining pasted lines
+to a parent shell after exiting sudo -i. Inner mktemp failure still exits only the
+subshell. This supersedes the initial outer-shell failure behavior noted above.
+
+## File numstat against 93694c518 (added / deleted)
+
+| File | Added | Deleted |
+|---|---:|---:|
+| `BUILD-LOG.md` | 4 | 0 |
+| `agents/gladstone/work/hostcheck-item5/BUILD.md` | 114 | 0 |
+| `docs/SESSIONS.md` | 1 | 0 |
+| `docs/guides/host-run-sheet.md` | 12 | 2 |
+| `packages/cli/tests/case1-hostcheck.test.mjs` | 48 | 0 |
+| `packages/cli/tests/case2-unit.test.mjs` | 29 | 0 |
+| `packages/cli/tests/stack-copy.test.mjs` | 16 | 0 |
+| `scripts/case1-hostcheck.sh` | 2 | 2 |
+| `scripts/case2-unit.sh` | 1 | 1 |
+| `scripts/stack-copy.sh` | 3 | 0 |
+
+## F5 (mos-1536 / ops-0260): explicit notifier decision
+
+Before: no run-sheet step creates the required notifier decision, and precheck
+accepts a host whose bus will refuse missing notify.json. After: section 9a
+requires the mosaic user to create its business notify directory at 0700 and an
+explicit {"notifyVersion": 1, "binding": null} file at 0600 before section 10.
+The shell runs with cwd / and umask 077; noclobber refuses an existing decision.
+Named binding is explicitly a later per-host choice requiring Mos's go.
+case2-install.sh is unchanged and makes no silent default.
+
+case2-precheck.sh's existing facts helper dynamically imports readNotifyConfig
+from cli.mjs and calls it directly. File type, uid, exact 0600 mode, JSON keys,
+version and binding-name validation therefore stay identical to the bus. The
+shell checks the business notify directory with existing private_dir (same uid,
+not a symlink, exactly 0700) and prints the new notifier config line. No notifier
+is started and no configuration is written. Tests append pass cases for null and
+a valid named binding, and refusal cases for missing file, 0644, 0755 directory,
+extra key, malformed JSON, invalid binding/version and a symlinked file.
+
+M5 (unrun): remove the notifier shell check, including its refusal branch; the
+new notifier refusal test must fail. Also include Morgana's F3 negative mutant
+M3b (allow $ in plain), killed by the new unsafe-character test.
+
+Existing positive precheck tests need an explicit notify fixture. Approval
+requested via Sage in gladstone-0006/-0007 for minimal setup-only additions to
+case2-unit.test.mjs host(t) and case2-install.test.mjs world(t); assertions remain
+unchanged. Those additions are not yet applied. Correction to gladstone-0007:
+case1-accept.test.mjs also names case2-precheck.sh, but uses a stand-in; it does
+not execute the changed script and needs no fixture amendment.
+
+Execution remains held by Sage: no Node/tests run. Morgana-0207 static F1-F4
+verdict on a75532db1 is CLEAN; execution and F5 review are still open.
+
+F5 acceptance from mos-1536 (for review):
+1. Before section 10, as mosaic, explicitly create <dataRoot>/notify/<business>
+   at 0700 and notify.json at 0600 with default binding null; a later named
+   binding needs Mos's go. Do not make case2-install.sh write it.
+2. Precheck must refuse missing file, non-0600 file, directory looser than 0700
+   and a document outside the CLI's exact shape. Reuse/match cli.mjs validation,
+   and name the new line in this run-sheet step's Precheck entry.
+3. Append-only test blocks cover pass, missing, 0644, 0755 dir, extra key; record
+   a skip-check mutant, the touched test file and its numstat.
+4. F3/F4 precede F5, each follow-up commit stays on gladstone/hostcheck-item5;
+   send pushes to Sage/Morgana with Mos cc. No Node until Sage CLEAR.
+
+Static F5 draft receipt: git diff --check passed. Existing fixture approvals
+remain pending; F5's new pass test creates its own explicit decisions. No claim
+that the old positive precheck tests pass without the pending setup changes.
+
+## F5 candidate file numstat against 93694c518 (added / deleted)
+
+| File | Added | Deleted |
+|---|---:|---:|
+| `BUILD-LOG.md` | 6 | 0 |
+| `agents/gladstone/work/hostcheck-item5/BUILD.md` | 179 | 0 |
+| `docs/SESSIONS.md` | 1 | 0 |
+| `docs/guides/host-run-sheet.md` | 34 | 2 |
+| `packages/cli/tests/case1-hostcheck.test.mjs` | 48 | 0 |
+| `packages/cli/tests/case2-unit.test.mjs` | 65 | 0 |
+| `packages/cli/tests/stack-copy.test.mjs` | 16 | 0 |
+| `scripts/case1-hostcheck.sh` | 2 | 2 |
+| `scripts/case2-precheck.sh` | 19 | 0 |
+| `scripts/case2-unit.sh` | 1 | 1 |
+| `scripts/stack-copy.sh` | 3 | 0 |
+
+## Fixture approval and separate follow-up (mos-1537)
+
+Mos approved exactly setup-only additions to case2-unit.test.mjs host(t) and
+case2-install.test.mjs world(t): each gets three added lines for a 0700
+notify/acme directory and 0600 notify.json with {"notifyVersion":1,"binding":null}.
+No existing line, fake or assertion changes or is deleted. F5's missing-file
+negative case removes the file after setup, so the new default cannot mask it.
+The newly appended install test checks preserved bytes and mode after success,
+and separately removes the decision before install and checks it stays absent.
+case1-accept.test.mjs is unchanged. This follow-up is committed separately on
+33950cf9b as directed, with no amend. No Node/tests run; suite claims remain open.
+Morgana-0211 found F5 source/run sheet CLEAN statically; the setup prerequisite B1
+is addressed by this approved fixture patch, pending execution.
+
+Additional planned mutants from Morgana-0211 (unrun): M5b drops private_dir,
+killed by the directory fault; M5c prints NOTIFY ok unconditionally, killed by
+the document faults. Existing test preservation is checked by git diff showing
+only additions (numstat below).
+
+Fixture follow-up numstat: case2-unit.test.mjs +3/-0,
+case2-install.test.mjs +18/-0. Against the original base: case1-hostcheck.test.mjs
++48/-0, case2-unit.test.mjs +68/-0, stack-copy.test.mjs +16/-0,
+case2-install.test.mjs +18/-0. git diff --check passed.
+
+## F6 and notify parent correction (mos-1537 / ops-0261)
+
+Before: install creates a copy but no human CLI wrapper; the sheet's
+stack-copy.sh check --units external therefore fails even with correct units.
+After: the sheet explicitly places a wrapper step after successful install and
+before that check. On Mos's separate live-step go, mosaic changes cwd to /,
+creates $HOME/.npm-global/bin if absent, then invokes its clone's stack-copy.sh
+wrapper <sha> --create. Existing wrappers refuse and require review; install is
+unchanged. This is documentation of a gated host action, not execution of it.
+There are no tests pinning these sheet steps to adjust.
+
+Section 9a now explicitly creates/chmods <dataRoot>/notify and then its business
+leaf, each 0700. This addresses ops-0261's observation that mkdir -p -m only
+controls the leaf. The existing umask 077 remains. All exits are inside the
+unprivileged shell, so no failure exits the operator's interactive root shell.
+
+Static receipt: git diff --check passed. No Node, tests or live action. F6 and
+this parent-directory documentation correction are a separate commit after the
+approved fixture-only 5fd2328b6 follow-up. Reviewer should retain the earlier
+F1-F5 source verdicts and inspect this delta. Queue row still pending from Sage.
+
+## F6 candidate file numstat against 93694c518 (added / deleted)
+
+| File | Added | Deleted |
+|---|---:|---:|
+| `BUILD-LOG.md` | 10 | 0 |
+| `agents/gladstone/work/hostcheck-item5/BUILD.md` | 241 | 0 |
+| `docs/SESSIONS.md` | 1 | 0 |
+| `docs/guides/host-run-sheet.md` | 51 | 2 |
+| `packages/cli/tests/case1-hostcheck.test.mjs` | 48 | 0 |
+| `packages/cli/tests/case2-install.test.mjs` | 18 | 0 |
+| `packages/cli/tests/case2-unit.test.mjs` | 68 | 0 |
+| `packages/cli/tests/stack-copy.test.mjs` | 16 | 0 |
+| `scripts/case1-hostcheck.sh` | 2 | 2 |
+| `scripts/case2-precheck.sh` | 19 | 0 |
+| `scripts/case2-unit.sh` | 1 | 1 |
+| `scripts/stack-copy.sh` | 3 | 0 |
+
+## F6 gate citation (sage-3747)
+
+Added scripts/stack-copy.sh:3 to the F6 wrapper step's explicit Mos-go requirement.
+This is doc-only; commands and tests are unchanged. Sage ruled the delete-after-
+setup missing-file negative meets mos-1537, so no fixture change is needed.
+Morgana-0213 found the fixture/F6 deltas CLEAN statically. No Node/tests run;
+Morgana's eventual run waits for Sage's row and CLEAR after the 220+216 landing.
+Numstat for this follow-up: host-run-sheet.md +1/-1; BUILD.md +9/-0.
+Static receipt: git diff --check passed.
+
+Correction: 0f3d874d4 added 10 BUILD.md lines, not 9; the git numstat is authoritative.
+
+## First review run and F4 test correction (morgana-0217)
+
+Morgana ran af201b4a9 (6fa47e07d only relocates this file) under her authorized
+slot with timeout -k 10 and TMPDIR under /mnt/storage/scratch/tmp. Receipts:
+/mnt/storage/scratch/morgana-g320-out/base-summary.txt and mutants-summary.txt.
+
+| Targeted file | Passed | Failed |
+|---|---:|---:|
+| case1-hostcheck.test.mjs | 19 | 0 |
+| case2-unit.test.mjs | 47 | 0 |
+| case2-install.test.mjs | 24 | 0 |
+| stack-copy.test.mjs | 17 | 1 |
+
+Seven of eight mutants were killed: M1 literal0750, M2 anymode, M3a drop@,
+M3b allow$, M5 drop shell block, M5b drop private_dir, M5c always NOTIFY ok.
+M4 drop cd / SURVIVED: base and mutant both failed only setup's cleanup hook.
+This is a test defect, not a green acceptance result. The 0111 cwd retained
+search permission and did not reproduce the inaccessible inherited cwd. It
+also blocked setup's chmod -R cleanup because the directory remained unreadable.
+
+B1 correction touches only this row's appended F4 test: the child shell enters
+an initially searchable directory, chmods it 000, checks both ! -r and ! -x, then
+execs stack-copy. The parent asserts all read/search bits remain cleared. The
+bundle now lives outside cwd and is passed absolutely, matching the real flow;
+existing row232 coverage still tests relative bundles from an accessible cwd.
+Both bundle and checkout paths remain covered.
+B2 correction: each child run/assertion sequence has a finally that restores the
+cwd to0700 before setup's existing cleanup. No old setup/test lines change.
+Production scripts are unchanged; the cd / fix remains correct by static review.
+
+Correction is untested locally: no builder Node/test CLEAR was given. Morgana
+will rerun stack-copy whole, M4 and residue cleanup on the pushed correction;
+other files need no rerun unless changed. git diff --check passed.
+
+## F4 corrected candidate numstat against 93694c518 (added / deleted)
+
+| File | Added | Deleted |
+|---|---:|---:|
+| `BUILD-LOG.md` | 12 | 0 |
+| `agents/gladstone/work/queue-320/BUILD.md` | 304 | 0 |
+| `docs/SESSIONS.md` | 1 | 0 |
+| `docs/guides/host-run-sheet.md` | 51 | 2 |
+| `packages/cli/tests/case1-hostcheck.test.mjs` | 48 | 0 |
+| `packages/cli/tests/case2-install.test.mjs` | 18 | 0 |
+| `packages/cli/tests/case2-unit.test.mjs` | 68 | 0 |
+| `packages/cli/tests/stack-copy.test.mjs` | 22 | 0 |
+| `scripts/case1-hostcheck.sh` | 2 | 2 |
+| `scripts/case2-precheck.sh` | 19 | 0 |
+| `scripts/case2-unit.sh` | 1 | 1 |
+| `scripts/stack-copy.sh` | 3 | 0 |

agents/gladstone/work/queue-321/BUILD.md

@@ -0,0 +1,171 @@
+# Row 321: F7 wrapper environment and F10 first adoption (#1817)
+
+Owner Gladstone; reviewer Boyd (separate Codex thread); queue/review/landing Sage.
+Authorized by sage-3791. Branch gladstone/row321 starts at fetched origin/refactor
+833ec1cc8d7c11842efb82e57c1a0b256c8d22d7. The row320 branch is unchanged.
+Brief: docs/plans/2026-10-23_host-fixes-1816-brief.md, section
+"Brief: F7, the wrapper step's PATH and umask under sudo", including F10;
+verified blob 7333f94ba9cfd58f87c5a3580d428b84c65845b6 (requested pin 7333f94ba9cf).
+Only the run sheet and this BUILD.md change. No scripts, tests, config, credentials,
+queue state, deployment or live host operation changed. No tests or Node commands run.
+
+## Before and after
+
+F7: sudo secure_path omits the pinned Node directory, so wrapper creation reaches
+instance.sh's bare node and exits127. An inherited umask can leave the bin dir0775.
+The MOSAIC_WRAPPER heredoc now sets umask077 and the sheet's existing pinned Node
+PATH before mkdir. One sentence names secure_path and why the step sets both.
+The existing Mos go remains explicit. No wrapper command is executed here.
+
+F10: first install omits adoption, so the first activate refuses no-pointer.
+The release-transport section now places explicit adoption after both units are
+running (section10) and before any activate/upgrade, run as mosaic on Mos's go by
+Jason or Mos, citing stack-release.sh:14. It uses the configured dev instance and
+external units, with the same pinned Node PATH under sudo.
+Adjacent to the upgrade command, the sheet now says only the first upgrade after
+adopt takes --no-rehearsal: adopt writes no backup; missing flag refuses no-backup;
+later upgrades omit it, because a backup with that flag refuses rehearsal-required.
+Source checks: stack-release.sh pointer_for_business refuses no-pointer and directs
+adopt; stack-upgrade.sh rehearse handles rc3/no-backup and rc0/rehearsal-required.
+This records existing behavior and authority; it adds no requirement or live go.
+
+## Test-reference grep (negative and positive control)
+
+The required negative grep covers both F7 and F10 because neither is read by any
+matched test. The positive control locates the precheck path that the unit/install
+tests actually execute, showing the pathspecs reach their test files.
+
+Negative grep:
+
+```sh
+git grep -n 'host-run-sheet' -- 'packages/*/tests/*' 'scripts/test-*.sh'
+# exit 1
+# no matches
+```
+
+Positive control:
+
+```sh
+git grep -n 'case2-precheck.sh' -- 'packages/*/tests/*' 'scripts/test-*.sh'
+# exit 0
+packages/cli/tests/case1-accept.test.mjs:26:const PRECHECK = `${HOME}/.local/share/mosaic-stack/copies/${COPY}/scripts/case2-precheck.sh`;
+packages/cli/tests/case2-install.test.mjs:2:// scripts/case2-precheck.sh's library checks and --library-status mode. Brief:
+packages/cli/tests/case2-install.test.mjs:23:const PRECHECK = join(REPO, "scripts", "case2-precheck.sh");
+packages/cli/tests/case2-install.test.mjs:271:// ---- case2-precheck.sh, the library profile (D6a) ----
+packages/cli/tests/case2-install.test.mjs:334:// ---- case2-precheck.sh --library-status (D6b) ----
+packages/cli/tests/case2-unit.test.mjs:2:// and scripts/case2-precheck.sh checks the host before they start. Brief: docs/plans/2026-10-20_case2-rows.md
+packages/cli/tests/case2-unit.test.mjs:20:const PRECHECK = join(REPO, "scripts", "case2-precheck.sh");
+packages/cli/tests/case2-unit.test.mjs:588:// ---- case2-precheck.sh ----
+```
+
+## Run-sheet diff against the pinned base (git diff --unified=0)
+
+```diff
+diff --git a/docs/guides/host-run-sheet.md b/docs/guides/host-run-sheet.md
+index d2ba28d7c..96fd4f363 100644
+--- a/docs/guides/host-run-sheet.md
++++ b/docs/guides/host-run-sheet.md
+@@ -209,0 +210,9 @@ sudo -u mosaic -H git clone -q -b refactor /srv/mosaic/incoming/<sha>.bundle /sr
++After a first install, once both units are running (section 10), adopt the installed copy before
++any activate or upgrade. This step runs only on Mos's go, with Jason or Mos running it
++(`scripts/stack-release.sh:14`):
++
++```sh
++sudo -u mosaic -H env PATH=/opt/mosaic-stack/node-<v>/bin:/usr/sbin:/usr/bin:/sbin:/bin \
++  /srv/mosaic/src/mosaic-stack/scripts/stack-release.sh adopt <business> --instance dev --units external
++```
++
+@@ -211,0 +221,4 @@ Each upgrade, before `stack-upgrade.sh upgrade`:
++Only the first upgrade after adopt takes `--no-rehearsal`: append it to the upgrade command below.
++Adopt writes no backup, so omitting the flag then refuses `no-backup`. Subsequent upgrades omit it;
++when a backup exists, supplying it refuses `rehearsal-required`.
++
+@@ -246,0 +260 @@ step requiring Mos's go (`scripts/stack-copy.sh:3`); the install does not create
++The step runs under sudo's `secure_path`, so it sets its own PATH and umask.
+@@ -250,0 +265,2 @@ cd / || exit 1
++umask 077
++PATH=/opt/mosaic-stack/node-<v>/bin:/usr/sbin:/usr/bin:/sbin:/bin; export PATH
+```
+
+## Verification
+
+No matching test reads the changed lines, so the stop condition did not apply.
+No test run or slot is required under sage-3791. Verification is static: the
+required grep and positive control above, exact brief/base pins, scoped diff,
+and git diff --check. Reviewer Boyd and Sage own review/landing; no approval
+or landing is claimed here.
+
+Receipt correction: the first commit embedded ordinary diff context lines that
+contain a single space. git diff --check flagged those as trailing whitespace.
+This follow-up uses the exact zero-context diff instead. The run sheet is
+unchanged, no tests or Node commands run, and no amend or force-push is used.
+
+## F11 addition (sage-3805, mos-1549, ops-0275)
+
+The brief was extended after F7/F10 drafting and re-pinned at revision3733:
+canonical local commit a9bae9af2, same F7 section anchor, full verified blob
+0e684ef2103447dcc2013b6bf81b1c4ca5bbc0bd (requested pin0e684ef21034).
+Read using git show from the canonical checkout; no fetch, rebase or queue write
+is required. This new pin supersedes the earlier brief pin for this follow-up.
+
+Defect: a precheck one second after unit start found no bus.sqlite yet.
+Section10 now requires loopback healthz success after a unit start before any
+case2-precheck.sh, including section9's --library-status. It uses the same
+127.0.0.1:<port>/healthz curl form as scripts/case1-accept.sh:458. The subshell
+tries at most30 times, each curl capped at2 seconds, with1 second between failed
+attempts (at most89 seconds plus scheduling overhead). Exhaustion prints STOP
+and exits only the subshell. The instruction says to stop before precheck/adopt;
+it does not exit the interactive operator shell. The section9 library-gitea row
+now explicitly requires this bounded wait before --library-status. <port> is the
+installed Console unit's --port, not an assumed port or business name.
+No host action, test, Node command or credential access occurred.
+
+Required grep repeated for the widened scope:
+
+```sh
+git grep -n 'host-run-sheet' -- 'packages/*/tests/*' 'scripts/test-*.sh'
+# exit1, no matches
+git grep -n 'case2-precheck.sh' -- 'packages/*/tests/*' 'scripts/test-*.sh'
+# exit0, positive control; output follows
+packages/cli/tests/case1-accept.test.mjs:26:const PRECHECK = `${HOME}/.local/share/mosaic-stack/copies/${COPY}/scripts/case2-precheck.sh`;
+packages/cli/tests/case2-install.test.mjs:2:// scripts/case2-precheck.sh's library checks and --library-status mode. Brief:
+packages/cli/tests/case2-install.test.mjs:23:const PRECHECK = join(REPO, "scripts", "case2-precheck.sh");
+packages/cli/tests/case2-install.test.mjs:271:// ---- case2-precheck.sh, the library profile (D6a) ----
+packages/cli/tests/case2-install.test.mjs:334:// ---- case2-precheck.sh --library-status (D6b) ----
+packages/cli/tests/case2-unit.test.mjs:2:// and scripts/case2-precheck.sh checks the host before they start. Brief: docs/plans/2026-10-20_case2-rows.md
+packages/cli/tests/case2-unit.test.mjs:20:const PRECHECK = join(REPO, "scripts", "case2-precheck.sh");
+packages/cli/tests/case2-unit.test.mjs:588:// ---- case2-precheck.sh ----
+```
+
+No test reads the changed run-sheet lines; the stop condition does not apply.
+No test run is needed under the docs-only brief. Static verification checks both
+locations, retry limit/timeout, the loopback URL, unchanged F7/F10 and scoped diff.
+
+F11 delta against d9400f0d3 (git diff --unified=0):
+
+```diff
+diff --git a/docs/guides/host-run-sheet.md b/docs/guides/host-run-sheet.md
+index 96fd4f363..e9fa87f24 100644
+--- a/docs/guides/host-run-sheet.md
++++ b/docs/guides/host-run-sheet.md
+@@ -322 +322 @@ file with `stat -c '%U %a %n' PATH`, never `cat`. `<business>` is the host's bus
+-| `/srv/mosaic/.config/mosaic-dev/secrets/<business>/` | `library-gitea` | 0600 | mosaic | library | `case2-precheck.sh --business <business> --library-status`, after the bus is up: `library-last-error library-credential-missing` until it's placed, then `library <project> last fetched ...` |
++| `/srv/mosaic/.config/mosaic-dev/secrets/<business>/` | `library-gitea` | 0600 | mosaic | library | After a unit start, wait for loopback `/healthz` with the bounded retry in section 10 before `case2-precheck.sh --business <business> --library-status`: `library-last-error library-credential-missing` until it's placed, then `library <project> last fetched ...` |
+@@ -357,0 +358,16 @@ None by hand. I2's `case2-unit.sh` enables both units, starts the bus, then the
++After a unit start, wait for the Console's loopback `/healthz` to succeed before running
++`case2-precheck.sh`, including `--library-status` in section 9. Replace `<port>` with the installed
++Console unit's `--port`. This retry is bounded to 30 attempts, each with a 2-second timeout, with
++1 second between failed attempts. If it prints STOP, stop here; do not run the precheck or adopt.
++
++```sh
++(
++  attempts=0
++  until curl -fsS --max-time 2 -o /dev/null 'http://127.0.0.1:<port>/healthz'; do
++    attempts=$((attempts + 1))
++    [ "$attempts" -lt 30 ] || { echo "STOP: loopback healthz did not become ready; do not continue" >&2; exit 1; }
++    sleep 1
++  done
++)
++```
++
+```

agents/goldie/README.md

@@ -0,0 +1,9 @@
+# Goldie
+
+Builder seat, Codex gpt-6.1-sol, started by Sage under mos-1542 and mos-1546. Owns F8 and F9, the library persona
+import in `scripts/case2-install.sh` (#1818), for the 433 Run B rerun.
+
+No launcher in this directory. The seat runs as a T3 thread and works in its own worktree. It has no credentials of its
+own; it pushes only its own `goldie/*` branches through the repository credential helper (mos-0981), never `refactor`,
+`main` or another seat's branch. Claude seats orchestrate and review the install path (mos-1542 rule 4). Registered by
+Sage on 2026-10-23 so the queue can name the seat as row owner (store.mjs isSeatDir).

agents/gosalyn/work/queue-226/BUILD.md

@@ -0,0 +1,331 @@
+# Row 226 build notes, C2-13b install script and library precheck (#1727)
+
+Brief: docs/plans/2026-10-20_case2-rows.md "C2-13b install script and library precheck" (:1073-1134 at
+d37210288). Design: agents/gosalyn/work/case2/DESIGN.md r11 sections 4 and 10, on gosalyn/case2-design
+75fb3e10e. Row 195's needs: agents/darkwing/work/queue-195/DESIGN.md "What row 195 needs from row 226".
+
+This is design round d2. Nothing is built yet. d1 was f46e66883, and Webby's review of it is webby-0085
+(CHANGES, B1 and N1-N6) and webby-0086 (the ordering problem). Sage ruled on both in sage-2189. The
+changes from d1 are listed at the end.
+
+## Base
+
+Branch gosalyn/c2-13b from refactor d37210288. Rows 215, 221, 222 and 230 are done.
+
+## Facts the design rests on
+
+- No CLI writes a business file. `mosaic business validate <id>` checks one and exits 0 ok, 2 invalid
+  (packages/business/src/cli.mjs). A business file needs `human`, `arbiters`, `projects`, `tracker`
+  with a sync bot and a Vikunja credential ref, and `roles`, each role with its tracker bot when its
+  definition uses Vikunja (business.mjs:23, :84-100, :131-149).
+- The library is a project, `projects.<id>.kind === "library"`, checked by `checkMapping`
+  (packages/library/src/mapping.mjs). There is no top-level `library` key.
+- `library.sync` and `library.status` are bus verbs, human only (broker.mjs:92, :2452-2476). The only
+  client is `packages/bus/src/human-cli.mjs` over the bus socket.
+- The bus makes each library mirror at start, `ensureMirror({ business, project, dataRoot })`
+  (packages/bus/src/runtime.mjs:143-145). Before the bus first starts there is no mirror.
+- `sync()` fetches outside `withLibraryLock`. Only a per-process `running` set keeps two syncs apart
+  (packages/library/src/sync.mjs:97-98), so a second process calling `sync()` would race the bus's
+  timer.
+- `libraryStatus(context)` reads the recorded state under the flock and writes nothing
+  (mirror.mjs:232-239). A missing or unsafe mirror fails `library-git` (`ownedRoot`, mirror.mjs:43-49).
+  A mirror that has never synced returns the empty state, `lastFetch: null`, `lastError: null`,
+  `problems: []` (mirror.mjs:27, :205-210). `lastError` is `{ code, at }` with `code` matching
+  `^[a-z-]{1,64}$` (mirror.mjs:225).
+- The bus builds the library context as `{ business, project, dataRoot }` and the slot as
+  `<slotDir>/secrets/<business.id>/library-gitea` (runtime.mjs:146-151, :162-164).
+- `case2-persona-import.mjs install --staging DIR --config-dir DIR --business ID` writes
+  `<configDir>/personas/<business>/<instance>.md` at 0600 in 0700 dirs, never overwriting, and prints
+  `instance bean: persona.name Bean, persona.sha256 <hex>` per persona.
+- A Discord binding is `<dataRoot>/discord/<name>.json` (packages/discord/src/binding.mjs:70-83).
+- `case2-unit.sh --copy ID` needs `<home>/.local/share/mosaic-stack/copies/<ID>`, which
+  `stack-copy.sh copy COMMIT --copies DIR` makes. The copy runs `npm ci` from package-lock.json
+  (stack-copy.sh:70), which installs the pinned pi.
+
+## Design
+
+### D1. The business file is an input
+
+Unchanged from d1. `case2-install.sh` takes `--business-file FILE`, a JSON business document written for
+the host from Jason's go. The script doesn't build one from flags, because bots, botIds and credential
+refs are host values and the brief says every host value is an input. It checks the input, adds what
+only it knows, writes it, and then runs `mosaic business validate`, so business.mjs stays the only
+schema.
+
+What the script checks before it writes anything, beyond `validate`:
+- `id` equals `--business`.
+- `library`: at least one library project, `bus.tester` not true, roles `bean` and `chet` with
+  definition `companion`, and no `persona.*` var in the input, since D3 adds them.
+- `factory`: no library project, and `bus.tester` true. These are the precheck's rules at
+  case2-precheck.sh:127-135, so the install refuses what the precheck would refuse.
+
+### D2. Install steps, in order
+
+1. Refuse to run as root.
+2. `scripts/bootstrap.sh`. It's idempotent and never rewrites an existing config.
+3. `scripts/stack-copy.sh copy <--commit> --copies <home>/.local/share/mosaic-stack/copies`. The copy
+   `case2-unit.sh --copy` names has to exist before root renders the units (row 195 need 3).
+4. `library` only: the persona import's `install` step from `--personas DIR` (D3).
+5. Write `<configDir>/businesses/<id>.json` at 0600 with O_EXCL (D4).
+6. `library` only: make `<configDir>/secrets/<business>/` at 0700, empty. The token is Jason's, design 10
+   step 4.
+7. `mosaic business validate <id>`. If it refuses and step 5 created the file in this run, remove that
+   file, then refuse. A file that already matched on a re-run (D4) is never removed (N4).
+8. Print the copy id and the next steps: root's 2c, Jason's 2d, 3 and 4, then the `--library-status`
+   check (D6b).
+
+d1's step 3, `release.sh package` and `activate`, is gone (Q4a, webby-0085 B1, sage-2189). Package is a
+`docker compose build`, and activate runs a pi Compose health check that mounts `PI_AUTH_FILE`
+(compose.yaml:43). Neither fits 2a, which has no Docker and no pi credential, and the hub doesn't run
+containers. The pinned harness comes from the copy's `npm ci` (Q3). The `CASE2_RELEASE` seam goes with
+it.
+
+It starts no unit, writes no unit file, doesn't write `/etc/mosaic-stack/dev.args` and doesn't run
+`adopt`. These are my answers to row 195's needs 4 and 5 (gosalyn-0087), unchanged. Row 195's W8 now
+passes `--business-file` and has no release step.
+
+### D3. Personas come from the staging dir
+
+Unchanged from d1. `library` requires `--personas DIR`, the staging dir from `case2-persona-import.mjs
+stage`. The install runs `case2-persona-import.mjs install --staging DIR --config-dir <configDir>
+--business <id>` and reads its two `instance` lines into `roles.bean.vars` and `roles.chet.vars`. Only
+those two lines go into the business file. They hold a name and a digest, never text.
+
+This moves the persona import's stage part of design 10 step 6 ahead of 2b: the read of her Hermes
+profiles and Jason's check of the printed pairing. Webby agreed in webby-0085 (Q1).
+
+### D4. Re-runs
+
+Unchanged from d1, plus N4. Each step is safe to run again. bootstrap and the copy are idempotent. An
+existing business file that matches the one the script would write passes, and the script remembers it
+didn't create it. One that differs refuses `business-file-differs`, and the script doesn't touch it.
+The persona import already refuses to overwrite. On a re-run the install compares each existing
+persona file's sha256 with the staging manifest, and refuses on a mismatch.
+
+### D5. Inputs and seams
+
+```
+case2-install.sh --business ID --business-file FILE --commit SHA [--profile factory|library]
+                 [--personas DIR] [--home DIR]
+```
+
+`--home` defaults to `$HOME`, which is `/srv/mosaic` under `sudo -u mosaic -H`. `MOSAIC_CONFIG` is
+honoured as bootstrap.sh honours it. One test seam, in case2-unit.sh's `CASE2_*` pattern:
+`CASE2_STACK_COPY` is the copy script, and the test uses a stub that makes the copy dir.
+
+Exit codes: 0 ok, 1 refused, 4 usage, as case2-unit.sh uses.
+
+### D6. Precheck library checks, split in two (Q4b, sage-2189)
+
+d1 ran `sync()` from the precheck. Webby's N1 and webby-0086 showed two faults. The precheck runs before
+the units start, so there is no mirror yet (runtime.mjs:143-145). And a precheck `sync()` after the bus
+is up would race the bus's timer, since `sync()` fetches outside the lock (sync.mjs:97-98). Sage split
+the check in sage-2189, and the brief's "runs library.sync" becomes "reads the bus's recorded sync
+state".
+
+#### D6a. Before the units start, `--profile library`
+
+These run where the precheck runs today, after 2c's render and before the start. They sync nothing and
+read no mirror. Each is a `refuse` line in the script's style.
+- The business file is owned by the uid, with no group or other bit (`business-file-mode`).
+  `businesses/.history/<id>/` is 0700 and its `changes.jsonl` is 0600, when present (`history-mode`).
+- The persona dirs are 0700. Each creative role's persona file is regular, owned and 0600
+  (`persona-mode`), and its sha256 equals the role's `persona.sha256` (`persona-mismatch`). The output
+  prints names and digests, never text.
+- No `<dataRoot>/discord/*.json` exists (`discord-binding`).
+
+#### D6b. `case2-precheck.sh --business ID --library-status`, after the bus is up and after step 4
+
+A new mode, run as `<user>` once the bus is up and Jason has placed the token. It changes nothing. A
+node block builds the context the bus builds, `{ business, project, dataRoot }` for each library
+project, with `dataRoot` from the config (N3, runtime.mjs:146-151, :162-164). For each one it:
+- refuses `library-mirror-missing` when the mirror path doesn't exist. It checks this itself, so the
+  message says the bus hasn't made it, not `library-git`;
+- calls `libraryStatus(context)` only, and refuses with the thrown code when that fails, for example
+  `library-git` for an unsafe mirror or `library-sync-busy` when the flock wait runs out;
+- refuses `library-never-synced` when `lastFetch` is null;
+- refuses `library-last-error <code>` when `lastError` is not null. The code is the fixed
+  `^[a-z-]{1,64}$` string, so it's safe to print. This also covers Webby's N2;
+- prints each recorded R-problem as `problem   R<n> <path>`, with the path through `JSON.stringify`, then
+  one `problems  <count>` line (N5). Her file names are the only part that prints, never text.
+  R-problems don't refuse (Q2, agreed by Webby).
+
+The bus syncs each library with a `user` every 60 s, so the first run after step 4 may need a minute,
+or Jason's own `library.sync`. The run sheet says so.
+
+### D7. host-run-sheet.md fix
+
+`docs/guides/host-run-sheet.md:240` says "I2's install writes it" about `dev.args`. It becomes: root
+writes it at the unit render, from the values the go names, and the install never writes it, because
+`<user>` can't write `/etc` and root reads nothing `<user>` wrote. Sage asked in sage-1832 for this fix
+to go in this build commit, with its path in the manifest. Section 9's `library-gitea` line (:275) says
+"C2-13b's `library.sync` (not landed)". It becomes the `--library-status` check (D6b). The install
+section also gets a line that the copy's `npm ci` needs the npm registry from the host (Q3, webby-0085).
+
+### D8. Design 10 text
+
+Sage ruled that design 10 gets the same change when 226 lands, with the line in this row's manifest.
+In agents/gosalyn/work/case2/DESIGN.md:
+- step 2b drops `release.sh package` and `activate`;
+- a new step after step 4 runs `case2-precheck.sh --business <business> --library-status`;
+- the precheck's library text says it reads the bus's recorded sync state, not that it runs
+  `library.sync`.
+
+### D9. Tests, `packages/cli/tests/case2-install.test.mjs`
+
+These follow case2-unit.test.mjs: scratch HOME, MOSAIC_CONFIG, stub bin dir and seams, a local bare repo
+cloned `--bare --no-local` as sync.test.mjs does, and the fixture's key never in output.
+- Install `library`:
+  - writes the business file at 0600 with bean's and chet's persona vars;
+  - writes the persona files at 0600 in 0700 dirs and the empty slot dir at 0700;
+  - logs the copy call and no release call;
+  - starts nothing;
+  - passes on a re-run;
+  - refuses `business-file-differs` and leaves the file unchanged.
+- Install `factory`:
+  - writes no library mapping, no persona file and no slot dir, which is the brief's case;
+  - refuses a library project and `bus.tester` off.
+- Install refuses: run as root, a business id mismatch, missing `--personas` under library, and a
+  `validate` refusal, after which no business file is left.
+- N4: a re-run where the matching business file is already there and `validate` refuses leaves that
+  file in place, byte for byte.
+- D6a refusals, one case each: a persona file at 0644, a digest mismatch, a business file at 0644, a
+  `changes.jsonl` at 0644, and a Discord binding. A clean library host passes D6a with no mirror.
+- D6b, with the mirror made by `ensureMirror` and the state written by a real `sync()` against the local
+  bare repo, as the bus would:
+  - no mirror refuses `library-mirror-missing`;
+  - a fresh mirror refuses `library-never-synced`;
+  - a sync against a remote that doesn't resolve refuses `library-last-error` with its code;
+  - a synced bare repo with one R2 path prints its `problem` line and `problems  1`, and passes.
+
+Every new refusal gets a mutant that removes it. The count goes in the slot request.
+
+### D10. Files
+
+Owned by the brief: `scripts/case2-install.sh` (new), `scripts/case2-precheck.sh` (library checks and
+`--library-status` only) and `packages/cli/tests/case2-install.test.mjs` (new). Also
+`docs/guides/host-run-sheet.md` (D7, sage-1832), agents/gosalyn/work/case2/DESIGN.md (D8, sage-2189)
+and this BUILD.md. Before the slot request I'll grep for outside readers of case2-precheck.sh, since
+case2-unit.test.mjs runs it.
+
+## Questions
+
+All three d1 questions are settled:
+- Q1, persona stage before 2b: Webby agreed (webby-0085).
+- Q2, R-problems don't refuse: Webby agreed.
+- Q3, the pinned harness is the copy's `npm ci`: Webby agreed, and asked for the registry note in D7.
+- Q4a and Q4b: Sage, sage-2189.
+
+One choice for Webby to check: D6b's `problem` line carries the path through `JSON.stringify`. N5 asked
+for a prefix and a count. I kept the path because Jason needs it to tell her which file to fix, and the
+names are hers, not text.
+
+## Changes from d1
+
+- B1: release package and activate dropped, with the `CASE2_RELEASE` seam and its test (D2, D5).
+- N1 and webby-0086: the sync is gone from the precheck. D6 splits into D6a before the start and D6b,
+  `--library-status`, after the bus is up and step 4 (sage-2189).
+- N2: covered by D6b's `lastError` refusal.
+- N3: D6b builds the context and slot as the bus does.
+- N4: step 7 removes only a file this run created, with a test.
+- N5: `problem` prefix and a `problems` count.
+- N6: the run sheet lines are :240 and :275.
+- New D8, the design 10 text change, and its path in D10.
+
+## Build
+
+Webby approved d2 in webby-0087 (REVIEW-design-d2.md, webby/reviews 2f488b4ea). Nothing above this
+section changed after approval. This section records the build.
+
+### D8 lands on case2-design
+
+Sage ruled in sage-2195, after Webby's N1, that D8 goes on gosalyn/case2-design, because
+agents/gosalyn/work/case2/DESIGN.md isn't on refactor. The change is commit 624212842 there, pushed:
+step 2b drops `release.sh package` and `activate`, new step 4a runs `--library-status`, and the C2-13b
+row text says the precheck reads the bus's recorded sync state. DESIGN.md is not in this row's manifest.
+
+The brief's lines docs/plans/2026-10-20_case2-rows.md:1093-1096 still name release package, activate and
+a library.sync fetch. Sage owns the brief and will amend those lines to match D8 in a doc-only commit
+after the re-pin window (sage-2205). They are not in this row's manifest.
+
+### Webby's d2 notes
+
+- N2: the `problem` line keeps the path. After `JSON.stringify` the precheck also escapes DEL, the C1
+  controls U+0080-009F, U+200E and U+200F, U+2028 and U+2029, and the bidi controls U+202A-202E and
+  U+2066-2069 as `\uXXXX`. Webby named C1 and bidi. I added the rest because `JSON.stringify` leaves
+  them raw too, and each one can change how a terminal shows the line. The test path holds U+202E and
+  U+0085, and the test checks that neither prints raw.
+- N3: `lastError` is checked before `lastFetch`. A first sync with no token records
+  `library-credential-missing` and leaves `lastFetch` null, so it refuses `library-last-error`, not
+  `library-never-synced`. The fresh-mirror test has `lastError` null and refuses `library-never-synced`.
+
+### Choices made in the build
+
+- The config dir. The persona import refuses a config dir with group or other bits, and bootstrap makes
+  one with the default mode. So the install makes the config dir at 0700 when it's absent, before
+  bootstrap, and refuses `config-dir-mode` when it exists with a group or other bit. It checks
+  `secrets/` and `secrets/<id>/` the same way under library (`secrets-mode`, `slot-mode`).
+- `--home` must equal `$HOME` (`home-mismatch`). Every path comes from `$HOME` and `MOSAIC_CONFIG`, as
+  bootstrap's does, so a different `--home` would only name a second home the script doesn't use.
+- A plan step runs before anything is written. It reads the input and the staging manifest, computes
+  the persona vars from the manifest, and compares the result with what's on disk. It refuses every
+  input rule, `business-file-differs` and `persona-differs` there, so a refused run writes nothing.
+  After the import the script checks that the import's two `instance` lines carry the manifest's
+  digests.
+- A re-run with both persona files present and matching skips the import, which would refuse to
+  overwrite them. One matching file and one missing refuses `persona-differs`.
+- A diverged library prints one line under `--library-status`, naming the tip `library.sync --accept`
+  would take. It doesn't refuse. The design doesn't list it as a refusal, and the bus still serves the
+  old tip.
+- The precheck's library checks print `ok` lines for each check they pass, as the rest of the script
+  does. A business file that's missing prints no extra line, since the existing business-file check
+  already refuses it.
+- The business id must match the persona import's rule, `^[a-z0-9][a-z0-9-]{0,63}$`. That's narrower
+  than the precheck's, which also takes `.` and `_`, because the persona dir uses the id.
+
+### Outside readers
+
+`git grep` over packages/*/tests/*, packages/*/src/* and scripts/test-*.sh finds case2-precheck.sh read
+by case2-unit.test.mjs, which runs it, and case1-accept.test.mjs, which names a copy's path but runs a
+fake. No test reads host-run-sheet.md. No test pins a hash of either script. case2-unit.test.mjs's
+precheck host has a 0600 business file and no persona vars, so the new D6a checks pass there.
+
+### Mutants
+
+24, in /mnt/storage/scratch/gosalyn-r226/mutate.py. Each replaces one exact string once. Line numbers
+are the candidate's. run.sh stops with BASE RED before any mutant unless the base run is rc=0 and
+fail 0.
+
+| Mutant | Line | Check removed |
+|---|---|---|
+| I1 | install :73 | run-as-root |
+| I2 | install :74 | home-mismatch |
+| I3 | install :81 | config-dir-mode |
+| I4 | install :101 | business-id-mismatch |
+| I5 | install :107 | profile-library-business |
+| I6 | install :108 | bus-tester-off |
+| I7 | install :111 | bus-tester-on |
+| I8 | install :115 | persona-var-input |
+| I9 | install :158 | business-file-differs |
+| I10 | install :152 | persona-differs |
+| I11 | install :218 | N4, removes the file even when this run didn't write it |
+| I12 | install :218 | validate's removal of the file this run wrote |
+| P1 | precheck :229 | business-file-mode |
+| P2 | precheck :235 | history-mode for changes.jsonl |
+| P3 | precheck :246 | persona-mode for a persona file |
+| P4 | precheck :251 | persona-mismatch |
+| P5 | precheck :241 | persona-mode for a persona dir |
+| P6 | precheck :258 | discord-binding |
+| P7 | precheck :104 | library-mirror-missing |
+| P8 | precheck :107 | library-last-error |
+| P9 | precheck :107 | N3, the order swapped |
+| P10 | precheck :108 | library-never-synced |
+| P11 | precheck :92 | N2, the escape after stringify |
+| P12 | precheck :65 | --library-status refuses --profile |
+
+`history-mode` for the history dir itself has no mutant and no test. The brief names only the
+`changes.jsonl` case.
+
+### Tests
+
+Not run yet. They wait for a slot.

agents/honker/work/queue-239/BUILD.md

@@ -0,0 +1,177 @@
+# Row 239 (#1745) build notes (append only)
+
+## 2026-10-22 b1 (Honker)
+
+Design d1 5da5f28f6 was approved by Duckworth with C1 and C2 and no blockers (duckworth-0165, note
+agents/duckworth/work/row239/REVIEW-design-d1.md). The code is on honker/row239 from aca16404c. No test
+has run yet: every run waits for Sage's CLEAR.
+
+### Duckworth's conditions and answers
+
+- C1 (option a): `outcome-unknown-revoked` is in the Console's `OPEN` list (webui bus.mjs), so
+  `sendOutcome` answers it as `outcome-unknown` with `sent: 'unknown'` and never "Nothing changed". T6
+  covers it and M3f is its mutant.
+- C2: `write()` sets `revoked = true` after `beforeWrite()` returns, and a catch around the whole
+  `withLock(...)` call marks the error. So a throw from the lock's release in its finally is marked as
+  well. This is structural and has no test, as Duckworth said.
+- Q1: `beforeWrite` runs after both validations. Q2: two codes. Q3: M2 removes the `:188` check (now
+  organization.mjs:195).
+
+### Notes N1-N5
+
+- N1: `beforeWrite` must not write the same business, because it would find its own lock and refuse
+  `organization-busy`. This is said in the comments on `write()` and `commit()`. Today's revokes (the
+  bus's credential revoke) write no business file.
+- N2: the lock is held across the revoke. A fire or a delete now keeps other writers of that business
+  out for as long as the revoke takes. They refuse `organization-busy`, as they do for any held lock.
+- N3: a revoke that fails partway (some tokens revoked, then `credential-revoke-failed`) behaves as
+  today. The error carries no `revoked` mark, because `beforeWrite` didn't return, and nothing is
+  written. This row doesn't change that.
+- N4: a delete closed with `outcome-unknown-revoked` exits 3 in the CLI, as every closed refusal does.
+  Exit 1 (transport EXIT) applies only to a direct verb answer.
+- N5: I grepped for "before the write" and similar comments. The ones left (lifecycle-revoke.test:2,
+  instance-settings:56, cli instances.mjs:53, serve.mjs:365) are still true and are unchanged. T21 in
+  bus lifecycle-revoke.test:173 is unchanged.
+
+### Differences from the design
+
+- The business tests are in lifecycle-settings.test.mjs, not instance-settings.test.mjs. The fire tests
+  and their fixture already live there. The fixture now returns `dir` and `rolesDir` too.
+- T3 covers T3b (the delete) in the same test, looping over fire and delete. It also checks that a
+  revoke throwing `credential-revoke-failed` carries no mark and writes nothing.
+- T4b is the plain-code check. The design's "T4b, outcome-unknown-revoked for an fs-style error" is in
+  T4, which checks EIO with and without the mark for both a fire and a delete.
+- The bus test's fake org gets `deleteError`, thrown from its `instances.set` branch, so T4 can drive a
+  delete.
+- transport.test gets one assertion, `busExit("outcome-unknown-revoked") === 1`, for M3g.
+- A latent Console text: a direct (not closed-request) `revision-conflict-revoked` answer in the
+  Console would still get " Nothing changed." appended, because only `OPEN` codes skip it. That sentence
+  is true there: the file is unchanged. No direct human path gives this code today, since a delete
+  reaches the Console as a closed request's refusal.
+- The Console's STATUS entry for `outcome-unknown-revoked` (503) can't be reached while the code is in
+  `OPEN`. It stays for symmetry with the CLI and is harmless.
+
+### What changed
+
+- packages/business/src/organization.mjs: `write()` takes `beforeWrite`, runs it under the lock after
+  the revision check and both validations, and marks any later error `revoked`. The body is reindented
+  inside the try.
+- packages/business/src/instance-settings.mjs: `instanceSettings` takes an optional `writer`. `commit()`
+  passes `beforeWrite` to `writer.write` instead of calling it. The early check stays, and its comment
+  is rewritten.
+- packages/bus/src/broker.mjs: `#organizationFail` maps a marked error to `revision-conflict-revoked` or
+  `outcome-unknown-revoked` before the existing mappings. `#fireJob`'s notice adds "Its credential
+  tokens may already be revoked." for a `-revoked` code.
+- packages/bus/src/runtime.mjs: comment only.
+- packages/cli/src/instances.mjs: two REASONS entries. packages/cli/src/transport.mjs: EXIT
+  `outcome-unknown-revoked` 1.
+- packages/webui/src/serve.mjs: two AGENT_REASONS entries. packages/webui/src/bus.mjs: `OPEN` entry and
+  two STATUS entries.
+- Tests:
+  - business lifecycle-settings.test: "row 239 T1", "row 239 T2", "row 239 T3".
+  - bus fire-revokes-grants.test: "row 239 T4", "row 239 T4b".
+  - cli instances.test: "row 239 T5 CLI". cli transport.test: one assertion in "busExit and
+    refuseInsideAgent".
+  - webui agents.test: "row 239 T6".
+  - bus channel-proof.test re-pins packages/cli/src/transport.mjs (662642a8...) and
+    packages/webui/src/bus.mjs (1eba9774...), with a comment on each. Neither changes a proof or the
+    transport. The design's file list missed this. The pin grep found it before the first run.
+### Mutants for the gate (exact-once replacements)
+
+- M1 (instance-settings.mjs, beforeWrite before the lock): replace
+  `    const receipt = writer.write(business, next, { revision, actor, context, beforeWrite });` with
+  `    if (beforeWrite) beforeWrite();\n    const receipt = writer.write(business, next, { revision, actor, context });`.
+  The kill is lifecycle-settings "row 239 T1" (the revoke spy has a call).
+- M2 (organization.mjs, the fire refusal dropped): delete the line
+  `        if (revision !== before) fail("revision-conflict", "organization revision changed; read again");`.
+  The kill is "row 239 T1" (the write lands over the hand edit).
+- M3a (organization.mjs, the mark dropped): `      if (revoked && e instanceof Error) e.revoked = true;`
+  becomes `      void revoked;`. The kills are "row 239 T2" and "row 239 T3" (business). T4 drives the mark
+  through a fake org, so it doesn't see M3a.
+- M3b (broker.mjs): delete the line
+  `    if (e.revoked) fail(e.code === "revision-conflict" ? "revision-conflict-revoked" : "outcome-unknown-revoked");`.
+  The kill is fire-revokes-grants "row 239 T4".
+- M3c (cli instances.mjs): delete the five lines from `  "revision-conflict-revoked": "the business file`
+  through `    "business file again with \`mosaic business instances\` before trying again",`. The kill is
+  instances.test "row 239 T5 CLI".
+- M3d (webui serve.mjs): delete the two lines starting `  'revision-conflict-revoked': 'the business file`
+  and `  'outcome-unknown-revoked': 'the agent\'s tokens`. The kill is agents.test "row 239 T6".
+- M3e (broker.mjs): `      const tokens = code.endsWith('-revoked') ? ' Its credential tokens may already be revoked.' : '';`
+  becomes `      const tokens = '';`. The kill is "row 239 T4".
+- M3f (webui bus.mjs, C1): the `OPEN` line loses `, 'outcome-unknown-revoked'`. The kill is "row 239 T6"
+  (the launch POST answers 503 outcome-unknown, sent unknown).
+- M3g (cli transport.mjs): delete the line `  "outcome-unknown-revoked": 1,`. The kill is transport.test
+  "busExit and refuseInsideAgent".
+
+A kill counts only as a failed assertion in the named test, not a load error or a different test.
+
+### Gate plan (mos-1275 timeouts)
+
+- My row 256 gate (2026-10-22 10:34Z, same machine) took 590s for the cli package, 57s for webui and
+  38s for test-foundation, the longest shell script.
+- Packages: `timeout -k 10 1800` per package (3x the cli run).
+- Each scripts/test-*.sh: `timeout -k 10 300` (more than 3x the 38s longest).
+- Single files and mutants: `timeout -k 10 600` per file run (cli instances.test whole is the longest
+  single file).
+- Order on Sage's CLEAR: the touched test files whole (business lifecycle-settings, bus
+  fire-revokes-grants and channel-proof, cli instances and transport, webui agents), then M1-M3g, then
+  the full gate.
+- Before the in-review move: grep packages/*/tests for the changed comment and error text and for
+  64-hex pins on the changed files, and drift-check BASE..refactor against them.
+
+## 2026-10-22 r2 rebase (Honker)
+
+- Duckworth approved b1 b0c28366f statically, with no blockers (duckworth-0168). On N1 (`endsWith('-revoked')`
+  would also match `access-revoked`, which can't reach a fire job today), the check stays as it is, so the
+  approved candidate doesn't change before the gate (honker-0163).
+- Rows 253 (48e450ce8) and 275 landed. b1 is rebased onto refactor 94c33a43c as honker/row239-r2. The
+  push branch honker/row239 isn't rewritten.
+- Drift between aca16404c and 94c33a43c on the 15 paths: only packages/bus/src/broker.mjs, where row 275
+  changes the viewer verbs. Neither of row 239's two hunks (`#fireJob` and `#organizationFail`) moves in
+  meaning. The rebase applied with no conflict. The two pinned files (cli transport.mjs, webui bus.mjs)
+  and channel-proof.test have no upstream change, so the b1 pins stand.
+- Each M1-M3g replacement string still matches exactly once.
+- The touched test files run whole again on the new base, in the slot (the rebase rule).
+
+## 2026-10-23 r3 rebase (Honker, sage-3730)
+
+- r2 (70c6e3772) is rebased onto refactor 93694c518 as honker/row239-r3. honker/row239-r2 isn't rewritten.
+- Between 94c33a43c and 93694c518, five of the 16 paths changed upstream: bus broker.mjs and runtime.mjs,
+  channel-proof.test, and webui bus.mjs and serve.mjs. Every file merged on its own except channel-proof.test,
+  where row 301 (59f0e44f4, mos-1449) re-pinned webui bus.mjs for the user transport fold. The merged
+  pin keeps row 301's comment and row 239's, and takes sha256 e3f52172…1c2a89 of the merged bus.mjs.
+  The transport.mjs pin (662642a8…6e55b) still matches the file.
+- Row 239's hunks in broker.mjs (`#fireJob`, `#organizationFail`), runtime.mjs (the revoke comment),
+  bus.mjs (OPEN, STATUS) and serve.mjs are unchanged apart from their position. The range-diff shows
+  only the channel-proof pin and the hunk context moved.
+- Each M1-M3g replacement string still matches exactly once. M3f's target is the whole `OPEN` line,
+  since `, 'outcome-unknown-revoked'` also appears in the STATUS line.
+- No 64-hex pin in packages/*/tests or scripts names a changed file except channel-proof.test.
+- On the CLEAR (sage-3730): the touched files whole, then M1-M3g, then the counts here. Sage runs the
+  full gate on the replay at landing.
+
+## 2026-10-23 r4 replay and the slot run (Honker, sage-3773 CLEAR)
+
+- On the CLEAR, refactor was 546366f4a (row 320 landed at 094124b4e). None of the 16 manifest paths changed
+  between 93694c518 and 546366f4a. Upstream did change library src/index.mjs, which bus runtime.mjs imports,
+  and business src/index.mjs, which the cli imports, so the run was on a replay onto 546366f4a rather than
+  on r3's base. That replay is honker/row239-r4 0cae2dad5. The range-diff of r3 against r4 is four `=`
+  lines with equal patch-ids, so duckworth-0292's read of r3 applies to r4. r3 isn't rewritten.
+- The run was on 0cae2dad5 with a clean tree, TMPDIR under /mnt/storage/scratch/tmp, 22:01:27Z-22:01:52Z.
+- The touched files, run whole: business lifecycle-settings 12/12, bus fire-revokes-grants 24/24, bus
+  channel-proof 2/2, cli instances 15/15, cli transport 3/3, webui agents 9/9. That's 65/65 with 0 skipped,
+  and no first-run red.
+- Mutants: 9 of 9 killed. Each was applied exactly once, and each made its named test fail as an assertion:
+  - M1 lifecycle: 3 fail (T1, T2, T3).
+  - M2: T1.
+  - M3a: T2 and T3.
+  - M3b fire-revokes-grants: T4.
+  - M3c instances: T5 CLI.
+  - M3d agents: T6.
+  - M3e: T4.
+  - M3f agents: T6.
+  - M3g transport: "busExit and refuseInsideAgent".
+
+  T4b passed under M3b and M3e. Every restore matched the HEAD blob by sha256, and the tree was clean
+  after the run.
+- No full gate (sage-3730): Sage runs it on the replay at landing.

agents/honker/work/queue-239/DESIGN.md

@@ -0,0 +1,159 @@
+# Row 239 design: the revoke under the writer's lock, and a fire test
+
+Brief: docs/plans/2026-10-20_agent-lifecycle.md, "Brief: row 194 follow-up, the revoke under the writer's
+lock and a fire test" (blob 3b3b3b2b9), from Duckworth's row 194 b3 N1 and mos-1158. Base aca16404c (row
+194 landed as fd6dd327c, row 281 as e479521d3). Builder Honker, reviewer Duckworth, gate owner Sage.
+Draft 1, 2026-10-22.
+
+## Today
+
+- `instance-settings.mjs` `commit()` runs the checks, then compares the caller's revision with a fresh
+  `writer.read` (row 194 b3, sage-1634), then calls `beforeWrite` (the fire's or the delete's credential
+  revoke), then `writer.write`.
+- `writer.write` (`organization.mjs`) takes the lock, runs `recover`, checks the revision again (`:188`),
+  validates, prepares, checks the bytes once more before publication (`:221`), renames and commits.
+- So two windows are left.
+  - A write that lands between `commit()`'s read and the writer's lock still gets a revoke and then a
+    `revision-conflict`.
+  - Any refusal after the revoke ran (the `:221` check, or an I/O failure the bus reports as
+    `outcome-unknown`) uses the same text as one before it, so nothing says the tokens may be gone.
+- Row 281 left this path alone. Its fire job (`broker.mjs` `#fireJob`) runs step G (grants), then step B,
+  which is this same `write('instance.fire')`, and reports a step B failure as `fire.failed` along with a
+  human notice that names the code. Its delete job only does step G. The delete itself still commits
+  through `lifecycleDelete` → `instances.set` op delete → `commit()`.
+
+## What changes
+
+### 1. `beforeWrite` runs inside `writer.write`, under the lock (organization.mjs)
+
+`write(id, document, { revision, actor, detail, context, beforeWrite = null })`. The order under the lock:
+
+1. `recover`, read, then the `:188` revision check. A refusal here revokes nothing.
+2. Projects-protected and both validations. A refusal here revokes nothing either. I put `beforeWrite`
+   after these rather than straight after `:188`, so a document the writer would refuse anyway never
+   costs a revoke. Q1 asks Duckworth to confirm this.
+3. `beforeWrite()`. If it throws (today `credential-revoke-failed`), the error propagates as it is and
+   nothing has been written, as now.
+4. Prepare, the `:221` check, rename and commit, wrapped so that any error thrown after step 3 gets
+   `revoked = true` set on it before it is rethrown. That covers `revision-conflict` from `:221`, an
+   `organization-refused` from `log()`, a barrier throw, and an fs error.
+
+`record()` and the other writers (`launch-settings`, `plugin-settings`, `credentialVerbs`) pass no
+`beforeWrite` and behave as before.
+
+### 2. commit() passes beforeWrite through (instance-settings.mjs)
+
+`commit()` passes `beforeWrite` to `writer.write` and no longer calls it itself. The row 194 b3 early check
+stays. It costs one read, keeps T21's refusal before any validation work, and is no longer what protects
+the revoke. Its comment is rewritten to say so, and the "(BUILD.md follow-up)" sentence goes.
+
+`instanceSettings({ ..., writer = organizationWriter({ dir, rolesDir }) })` takes an optional writer, so a
+test can inject one (the brief's "injected writer"). `runtime.mjs` passes none.
+
+### 3. The bus names a refusal after a revoke (broker.mjs `#organizationFail`)
+
+The bus answers with a code only, and the CLI and Console look the text up by code. So the "may already be
+revoked" signal has to be a code. Two new codes:
+
+- `revision-conflict-revoked`: `e.revoked && e.code === 'revision-conflict'`.
+- `outcome-unknown-revoked`: `e.revoked` with any other code. The write may or may not have landed, since a
+  failure after the rename is recovered as committed.
+
+Both are checked before the existing mappings. An error without `revoked` maps exactly as today, so a
+refusal before any revoke keeps today's code and text. Q2 asks about the names.
+
+### 4. The texts
+
+- CLI `instances.mjs` REASONS:
+  - `revision-conflict-revoked`: "the business file changed before the write, after the agent's tokens
+    were revoked; the tokens may already be revoked and the instance can't use them; read the instances
+    again and run the same command again, which is safe".
+  - `outcome-unknown-revoked`: "the write's outcome is unknown and the agent's tokens may already be
+    revoked; read the instances before trying again".
+- Console `serve.mjs` AGENT_REASONS: the same two, in the Console's wording ("delete again").
+- `#fireJob`'s `fire.failed` notice: when the code ends in `-revoked`, it adds "Its credential tokens may
+  already be revoked." The chief's synchronous fire (no grants) answers with the code, as every chief verb
+  does.
+- `transport.mjs` EXIT: `outcome-unknown-revoked` exits 1, as `outcome-unknown` does. Console
+  `bus.mjs` STATUS: `revision-conflict-revoked` 409, `outcome-unknown-revoked` 503. A delete's code
+  reaches both as a closed request's `refusal`, so these two only matter for a direct verb answer.
+
+## Tests
+
+- **T1, the brief's fire test** (business `instance-settings.test.mjs`). The fire uses an injected writer
+  that wraps the real one. Its `write` makes one hand edit of the business file (a vars change on another
+  instance) and then calls the real `write`, so the edit lands after `commit()`'s early check and before
+  the lock's `:188` check. Expected:
+  - the fire refuses `revision-conflict` without `revoked`;
+  - the revoke spy has no calls;
+  - the business file's bytes are the hand edit's;
+  - changes.jsonl has no new prepared entry.
+- **T2** (same file). A fire on a real writer built with `barrier: stage => stage === 'prepared' && edit()`.
+  The revoke runs, then `:221` refuses. Expected: `revision-conflict` with `revoked === true`, one revoke
+  call, the file's bytes are the edit's, and the last receipt is `aborted`.
+- **T3** (same file). The same, with a `prepared` barrier that throws. Expected: the error has
+  `revoked === true`, one revoke call, and the file unchanged. A delete through the same writer gives the
+  same result (T3b).
+- **T4** (bus `fire-revokes-grants.test.mjs`, its injected `f.org`). `f.org.fireError` is a
+  `revision-conflict` with `revoked: true`. Expected:
+  - the job's `fire.failed` carries `revision-conflict-revoked`, and the inbox message says "may already
+    be revoked";
+  - the same with no `grants` (the synchronous fire) refuses `revision-conflict-revoked`;
+  - a plain `revision-conflict` still maps to `revision-conflict` and the message lacks the sentence.
+  - T4b: `outcome-unknown-revoked` for an fs-style error with `revoked`.
+- **T5** (cli `lifecycle.test.mjs` or `instances.test.mjs`, whichever already reads a closed delete's
+  refusal). A delete closed with `revision-conflict-revoked` prints the new text, and one closed with
+  `revision-conflict` prints today's.
+- **T6** (webui `agents.test.mjs`). The same pair for the Console's reason.
+- T21 (bus `lifecycle-revoke.test.mjs`) stays as it is, for delete.
+
+## Mutants
+
+| Mutant | Change | Killed by |
+| --- | --- | --- |
+| M1 | `beforeWrite` before the lock: `commit()` calls `beforeWrite()` itself and passes none to `write` | T1 (the revoke spy has a call) |
+| M2 | The fire refusal dropped: the `:188` revision check removed | T1 (the write lands over the hand edit) |
+| M3a | The mark dropped: no `revoked = true` in the catch | T2, T3, and T4 through the codes |
+| M3b | `#organizationFail` ignores `revoked` | T4 |
+| M3c | CLI text: the two REASONS entries removed | T5 |
+| M3d | Console text: the two AGENT_REASONS entries removed | T6 |
+| M3e | The notice: the `fire.failed` sentence removed | T4 |
+
+M3a-M3e together are the brief's "drop the may already be revoked text".
+
+## Files
+
+- `packages/business/src/organization.mjs`
+- `packages/business/src/instance-settings.mjs`
+- `packages/business/tests/instance-settings.test.mjs`
+- `packages/bus/src/broker.mjs`
+- `packages/bus/tests/fire-revokes-grants.test.mjs`
+- `packages/cli/src/instances.mjs`
+- `packages/cli/src/transport.mjs`
+- one cli test file
+- `packages/webui/src/serve.mjs`
+- `packages/webui/src/bus.mjs`
+- `packages/webui/tests/agents.test.mjs`
+- This packet.
+
+## Gate
+
+As the brief says:
+
+- Duckworth approves the manifest.
+- The bus, business, cli and webui suites and every `scripts/test-*.sh` are green on Sage's slot, with
+  the touched test files run whole.
+- M1-M3e are killed.
+
+Before the in-review move I grep the tests for the changed comment and error text, and for hash pins on the
+changed files.
+
+## Questions for Duckworth
+
+- **Q1.** Should `beforeWrite` run after the writer's validations (my pick) or straight after `:188` (the
+  brief's literal place)? Running it later means a document the writer would refuse revokes nothing.
+- **Q2.** Are two new codes, `revision-conflict-revoked` and `outcome-unknown-revoked`, the right way to
+  carry the signal? The alternative is to give `BusError` a detail field, which every CLI and Console
+  reader would then have to learn. The codes are additive and no existing code changes meaning.
+- **Q3.** The brief's mutant "drop the fire refusal": I read it as removing the `:188` check (M2). If you
+  meant the fire test's own refusal, say so and I'll redefine it.

agents/honker/work/queue-283/BUILD.md

@@ -0,0 +1,276 @@
+# Row 283 (#1788) C2-01d build notes (Honker)
+
+Append-only. Design: DESIGN.md d2 16e809457, APPROVE webby-0172. Gate owner Sage, reviewer Webby.
+
+## 2026-10-23 build on 45dca69f6 (sage-3577)
+
+Branch honker/row283-build from origin/refactor 45dca69f6e4bce52834587f66f2ff33ba839ab8a. The old branch
+honker/row283 (16e809457) held only the design, so its two commits were cherry-picked as 398314cf4
+(d1) and 4f66dccde (d2). The DESIGN.md blob equals 16e809457's.
+
+Commits:
+- 331653b38: code, README and tests T1-T8.
+- 28918824c: the survey.test:73 re-pin, alone (mos-1330 item 4).
+- this file.
+
+Nothing has run. No node, test or mutant ran during the build: Darkwing held the slot. Every count
+below is a plan until Sage's CLEAR.
+
+### Drift check (sage-3577)
+
+`git diff --stat 94c33a43c 45dca69f6` (design base to build base) over the paths the tests read or
+hash-pin:
+- No change in packages/library, packages/business/src/business.mjs or
+  packages/business/tests/business.test.mjs.
+- No test hash-pins a library file. bus library.test and library-sync.test import index.mjs, and
+  stack-copy.test only checks that index.mjs exists.
+- webui library-cli.test changed one line and doesn't read scope. The `classify` in webui reads.mjs is
+  the business one, not the library's.
+
+I redo the drift check on BASE..refactor before the in-review move.
+
+### N3 (webby-0169): deepEquals of the mapping output outside packages/library
+
+`git grep -n playground -- 'packages/*/tests/*' ':!packages/library/*'` and the files naming
+`universes` give two files:
+- business.test.mjs:20 compares `validateBusinessDocument(...).projects.books` with
+  `checkMapping(mappingEntry())`. That is output against output, so `supporting: []` shows up on both
+  sides. :27 compares only `.playground`.
+- library-projects-protected.test.mjs compares file bytes (:31, :32) and change paths (:58), never the
+  mapping output.
+
+No re-pin is needed outside library. Inside library, only the draft deepEqual at mapping.test:48 gains
+`supporting: []`, as the design says.
+
+### Q1 departure (sage-2923) and the :73 re-pin (mos-1330 item 4)
+
+survey.mjs:65 counts `supporting: 0` and formatSurvey prints it. T8 is the only added test
+(survey.test "C2-01d: with --mapping the survey counts supporting files").
+
+mos-1330 item 4, packages/library/tests/survey.test.mjs:73, commit 28918824c:
+- old: `'scopes canon 5, playground 1, unmapped 3; indexed 6',`
+- new: `'scopes canon 5, playground 1, supporting 0, unmapped 3; indexed 6',`
+
+N2: the pin gains only `supporting 0`. No other text on the line or in that test moved.
+
+### Q2 tradeoff (webby-0169)
+
+A supporting prefix that holds a playground prefix refuses `library-mapping-invalid`. That goes past
+the brief, but it is the fail-closed reading, and it uses an existing code: classify checks supporting
+first, so that playground prefix could never match. The cost is that she can't nest a playground under
+a supporting folder, though she can nest the other way (a playground holding a supporting folder).
+
+### Handoffs
+
+- Q4 (webby-0169, sage-2930): the M12 delete rule ("A delete also needs the path to exist at the tip as
+  a 100644 blob", case2 DESIGN.md :308) is not in supportingPath. It binds row 288 (C2-02) via Gitea
+  #1793 comment 30738, with tests for a missing path and a non-100644 entry.
+- A save with no `editor` refusing is C2-02's (DESIGN.md section 1).
+
+### Choices the design left open
+
+- The book loop is now `againstBooks(owners, list, code)` in mapping.mjs, called once per list. The
+  playground's messages and codes are byte-equal to before.
+- A non-string path refuses `library-write-story-path` ("the path must be a string") as part of
+  check 1. A non-array `tree` is a TypeError (DESIGN.md section 3).
+- Check 8 builds the tree's names as every path and every folder above it, keyed by
+  `normalize('NFC').toLowerCase()`. A name on the way refuses if its key holds any name other than
+  itself, so a tree that already holds case twins refuses a write to either (R7).
+
+### Mutants (exact strings)
+
+Each applies one replacement to the build tip. Run one at a time, and restore with `git checkout --`
+on the one file before the next.
+
+| Mutant | File | Replace | With | Killed by |
+|---|---|---|---|---|
+| M1 | src/scope.mjs | `const prefix = entry.supporting.find(p => inside(p, path));` | `const prefix = entry.supporting.find(p => inside(p, path) && !entry.playground.some(q => inside(q, path)));` | scope.test "supporting comes before playground", supporting.test "passes at book level" (both-lists path) |
+| M2 | src/mapping.mjs | `if ((inside \|\| holding) && owner !== id)` | `if ((inside \|\| holding) && owner !== id && list !== 'supporting')` | mapping.test "each supporting prefix rule", business.test C2-04 |
+| M3 | src/supporting.mjs | `for (const p of own) if (LINKS.has(modes.get(p)))` | `for (const p of own) if (false && LINKS.has(modes.get(p)))` | supporting.test "symlink or gitlink" |
+| M4 | src/supporting.mjs | `const fold = name => name.normalize('NFC').toLowerCase();` | `const fold = name => name.normalize('NFC');` | supporting.test "case or Unicode form" |
+| M4b | src/supporting.mjs | `const fold = name => name.normalize('NFC').toLowerCase();` | `const fold = name => name.toLowerCase();` | supporting.test "case or Unicode form" (NFD case) |
+| M5 | src/supporting.mjs | `Buffer.byteLength(path, 'utf8') > MAX_BYTES` | `path.length > MAX_BYTES` | supporting.test "1025 bytes" |
+| M6 | src/mapping.mjs | `const IDENT_BAD = /[\u0000-\u001f\u007f-\u009f<>]/;` | `const IDENT_BAD = /[<>]/;` | mapping.test "editor is optional" |
+| M6b | src/mapping.mjs | `const IDENT_BAD = /[\u0000-\u001f\u007f-\u009f<>]/;` | `const IDENT_BAD = /[\u0000-\u001f\u007f-\u009f]/;` | mapping.test "editor is optional" |
+| M7 | src/supporting.mjs | `if (place.scope !== 'supporting' \|\| place.universe !== universe)` | `if (place.scope !== 'supporting')` | supporting.test "outside the universe's supporting folders" |
+| M8 | src/mapping.mjs | `if (sid === pid && s !== p && holds(s, p))` | `if (false && sid === pid && s !== p && holds(s, p))` | mapping.test "each supporting prefix rule" (Workshop case) |
+
+(The `\|` in the table is an escaped `|` in the source text.) Each mutant runs the one test file named,
+plus business.test for M2, under `timeout -k 10 600`. A mutant passes the gate only when its run is red
+on the named test and the restored file's sha256 equals the build tip's.
+
+### Gate plan (on Sage's CLEAR)
+
+1. The touched files whole, each under `timeout -k 10 600`: library mapping, scope, supporting and
+   survey tests, and business.test.mjs. Counts go below.
+2. M1-M8 as above.
+3. The full gate, under mos-1275 timeouts: `node --test packages/library/tests/` and
+   `node --test packages/business/tests/` each under `timeout -k 10 1800`, and every scripts/test-*.sh
+   under `timeout -k 10 300`. pipefail and tee, with skips named (test-task Docker groups).
+4. Before in-review: grep packages/*/tests for a 64-hex pin on any changed file and for the changed
+   message text, then the drift check on BASE..refactor.
+
+## 2026-10-23 Webby early look (webby-0227, static, not a verdict)
+
+- E1: business.test.mjs is an existing test file with a 4-line addition after the playground refusal.
+  The in-review request lists it next to survey.test:73.
+- E3 fixed: supportingPath now runs the string check before `JSON.stringify`, so a BigInt (or any
+  non-string) path refuses `library-write-story-path` instead of throwing a TypeError.
+  supporting.test's string case now covers 7, null, undefined, 1n and an array.
+- E2 open: `editor` takes surrounding whitespace, and git trims it at commit, so the saved ident and
+  the commit ident can differ. DESIGN.md section 1 says "non-empty after trim". Refusing
+  `value.trim() !== value` would change that approved rule, so it went to Sage instead of into the
+  build.
+
+## 2026-10-23 E2 departure (sage-3601)
+
+A departure from DESIGN.md section 1 (which stays unedited). The design says each `editor` value is
+"non-empty after trim". Sage ruled that surrounding whitespace refuses too, because git trims an
+ident at commit, so a padded value would save one name and commit another. mapping.mjs now adds
+`if (value.trim() !== value) bad(`editor.${key} must not start or end with whitespace`)` after the
+IDENT_BAD check. `trim()` covers Unicode whitespace, so U+00A0 and U+3000 refuse as well. Inner
+whitespace is kept ("Her  Middle Name" passes).
+
+T3 gains a case per key for leading, trailing and both-ends spaces, U+00A0 and U+3000, plus one inner
+whitespace pass.
+
+M6 grows a third part:
+
+| Mutant | File | Replace | With | Killed by |
+|---|---|---|---|---|
+| M6c | src/mapping.mjs | `if (value.trim() !== value) bad(` | `if (false && value.trim() !== value) bad(` | mapping.test "editor is optional" (padded cases) |
+
+Fixture grep: `git grep -nE "\beditor\b|\bauthor\b" -- 'packages/library/tests/*' 'packages/business/tests/*'`,
+leaving out mapping.test.mjs, finds nothing. packages/business/tests has no fixtures directory. The
+library fixture mapping.json has no `editor`. The positive control (`vaultPrefix` in mapping.json)
+matches once. No fixture maps an editor or author with surrounding whitespace.
+
+## 2026-10-23 E4 (webby-0230, sage-3606), same departure as E2
+
+Claimed: `queue move 283 in-progress`, op honker-283-start, rev 3642, 19:10:49Z (briefed→in-progress).
+
+Git's ident.c `crud()` strips any byte <= 0x20 and `, : ; < > " \ '` from both ends of an ident. I
+checked that with git 2.55.0: `Jane,` `"Jane"` `'Jane'` `Jane;` `Jane:` `Jane\` and `,Jane` all
+commit as `Jane`, while `Jane.` and `Ja,ne` are kept. mapping.mjs now takes the set from crud()
+rather than from that list: `IDENT_CRUD_END = /^[\u0000-\u0020,:;<>"\\']|[\u0000-\u0020,:;<>"\\']$/`.
+The E2 check became `if (value.trim() !== value || IDENT_CRUD_END.test(value))`, which refuses
+library-mapping-invalid with "editor.<key> must not start or end with whitespace or any of , : ; " ' \".
+`trim()` still catches Unicode whitespace (U+00A0, U+3000), which crud() leaves alone.
+
+Inner characters: IDENT_BAD (`/[\u0000-\u001f\u007f-\u009f<>]/`) already refuses `<`, `>`, newline,
+tab and every other control anywhere in the value. T3 now pins that at the start, the end and the
+middle. Inner `, : ; " ' \` are kept, since git keeps them, and T3 pins that too.
+
+Tests:
+- T3 has one case per character in [space, U+00A0, U+3000, `,`, `:`, `;`, `"`, `'`, `\`], at the start
+  and at the end, for each key. `<`, `>`, newline and tab are pinned at the start, end and middle.
+  Four accepted names have inner crud characters.
+- New round-trip test, "an accepted editor round-trips through a real git commit unchanged". It
+  commits in a scratch repo with editor `Doe, Jane Q.` / `[email protected].` as author and
+  committer, with GIT_AUTHOR_* and GIT_COMMITTER_* stripped from the env, and asserts `git log`
+  shows exactly the saved values. I preflighted that commit with git 2.55.0 by hand: both values came
+  back unchanged.
+
+M6c now replaces the whole end check (this supersedes the earlier M6c row):
+
+| Mutant | File | Replace | With | Killed by |
+|---|---|---|---|---|
+| M6c | src/mapping.mjs | `if (value.trim() !== value \|\| IDENT_CRUD_END.test(value))` | `if (false)` | mapping.test "editor is optional" (end cases) |
+| M6d | src/mapping.mjs | `if (value.trim() !== value \|\| IDENT_CRUD_END.test(value))` | `if (value.trim() !== value)` | mapping.test "editor is optional" (`,` `:` `;` `"` `'` `\` cases) |
+
+## 2026-10-23 E5 (webby-0236, not blocking), fixed
+
+The round-trip test stripped only GIT_AUTHOR_* and GIT_COMMITTER_*. With GIT_DIR, GIT_WORK_TREE or
+GIT_INDEX_FILE set (inside a hook, say), GIT_DIR beats `-C root` and the commit would land in the
+outer repo, and the test read global and system config. It now deletes GIT_DIR, GIT_WORK_TREE,
+GIT_COMMON_DIR and GIT_INDEX_FILE (as queue/tests/helpers.mjs gitEnv does) and sets
+GIT_CONFIG_GLOBAL=/dev/null and GIT_CONFIG_NOSYSTEM=1 (as ledger.test.mjs does). The `-c user.*`
+ident still applies. Test only; no mutant changes.
+
+## 2026-10-23 sage-2925: optional editor.user (sage-3649)
+
+sage-2925 (recorded in ludwig/row286-r2 agents/ludwig/work/queue-286/BUILD.md, Q4) ruled that row 283
+adds an optional `editor.user`, her Gitea login for the `library-human` slot, which row 288 (C2-02)
+passes to `humanCredential(context, {user})`. It reached this row after the DESIGN.md d2 approval
+(ludwig-0068, bubba-0009, sage-3649), so it departs from DESIGN.md section 1 ("exactly the keys
+`name` and `email`"). DESIGN.md stays unedited.
+
+- mapping.mjs: `only(entry.editor, ['name', 'email', 'user'], 'editor')`. When present, `user` must be
+  a string matching USER (`/^[A-Za-z0-9_.-]{1,100}$/`, the entry `user` check), else
+  library-mapping-invalid "editor.user must be a plain account name". The output carries `user` only
+  when given. An absent `editor.user` refusing library-human-missing is 288's (bubba-0009).
+- README: the `editor` line names `user` and the end-character rule from E2/E4.
+- Tests: T3 (mapping.test "editor is optional") gains one accepted case (`her.login-1`, kept in the
+  output) and refused cases for '', an inner space, '@', 101 characters, 7 and null. They go in
+  mapping.test with the other editor cases, not in the new supporting.test, which tests write paths.
+- No test outside mapping.test reads `editor` or pins mapping.mjs or README (git grep).
+
+| Mutant | File | Replace | With | Killed by |
+|---|---|---|---|---|
+| M6e | src/mapping.mjs | `if (Object.hasOwn(entry.editor, 'user') && (typeof entry.editor.user !== 'string' \|\| !USER.test(entry.editor.user)))` | `if (false)` | mapping.test "editor is optional" (editor.user refusals) |
+| M6f | src/mapping.mjs | `...(Object.hasOwn(entry.editor, 'user') ? { user: entry.editor.user } : {})` | `...({})` | mapping.test "editor is optional" (`her.login-1` kept) |
+
+## 2026-10-23 T2 run (sage-3695 CLEAR, lane A, library and business only)
+
+Node v26.8.1. refactor was e2b873390 (226 landed); `git diff --stat 45dca69f6 e2b873390 -- packages/library
+packages/business` is empty. TMPDIR was a mktemp -d under /mnt/storage/scratch/tmp, with pipefail.
+Singles and mutants ran under `timeout -k 10 600`, suites under `timeout -k 10 1800`.
+
+First-run red (mos-1272, placed): the first base run on 46bad7ea3 at 20:01:09Z was red in
+supporting.test "malformed paths refuse by class, in order". 5 of 6 passed, with `TypeError: Do not know
+how to serialize a BigInt`. The cause was the test helper, not the product: `refuses()` labelled each
+assertion with `JSON.stringify(path)`, and the 1n case added for E3 can't be stringified. In c18ad3e12
+the label uses `util.inspect(path)`, a 2-line test-only change. The product's 1n refusal was never in
+question: supportingPath type-checks before it stringifies (E3). The whole run below is on c18ad3e12.
+
+Base, the touched files whole (20:01:43Z), all rc=0:
+- library mapping.test 16/16, scope.test 6/6, supporting.test 6/6, survey.test 7/7;
+- business business.test 21/21;
+- 0 skipped, 0 cancelled, 0 todo.
+
+Mutants (20:01:44Z). Each was applied by exact string with count 1, then restored with `git checkout --`.
+Every restored sha256 equals HEAD's blob, and the tree was clean after.
+
+| Mutant | Run | Result | Failing test |
+|---|---|---|---|
+| M1 | scope.test | rc=1, 5/6 | supporting comes before playground; a folder in both lists is supporting… |
+| M1 | supporting.test | rc=1, 5/6 | a path passes at book level, universe level, in a draft and in a folder in both lists |
+| M2 | mapping.test | rc=1, 15/16 | each supporting prefix rule refuses with its code |
+| M2 | business.test | rc=1, 20/21 | C2-04: library mappings load without roots, remain frozen, and retain mapping refusals |
+| M3 | supporting.test | rc=1, 5/6 | a symlink or gitlink on the way, or at the path itself, refuses |
+| M4 | supporting.test | rc=1, 5/6 | a name that differs from a tree name only in case or Unicode form refuses… |
+| M4b | supporting.test | rc=1, 5/6 | the same case/Unicode test |
+| M5 | supporting.test | rc=1, 5/6 | a path of exactly 1024 bytes passes, and 1025 bytes… refuses |
+| M6 | mapping.test | rc=1, 15/16 | editor is optional, kept when given, and refuses anything but a plain name and email |
+| M6b | mapping.test | rc=1, 15/16 | the same editor test |
+| M6c | mapping.test | rc=1, 15/16 | the same editor test |
+| M6d | mapping.test | rc=1, 15/16 | the same editor test |
+| M6e | mapping.test | rc=1, 15/16 | the same editor test |
+| M6f | mapping.test | rc=1, 15/16 | the same editor test |
+| M7 | supporting.test | rc=1, 5/6 | a path outside the universe's supporting folders refuses |
+| M8 | mapping.test | rc=1, 15/16 | each supporting prefix rule refuses with its code |
+
+14 of 14 mutants killed, each on its named test only.
+
+Suites (20:01:47Z):
+- `packages/library`: `node --test tests/*.test.mjs` rc=0, 98/98, 0 skipped.
+- `packages/business`: `node --test tests/` rc=0, 231/231, 0 skipped.
+
+Not run here: every scripts/test-*.sh and the other packages. Those are Sage's 283 gate, after Webby's
+APPROVE.
+
+## 2026-10-23 G1: mos-1528 OK for the mapping.test draft deepEqual (sage-3713)
+
+This entry completes the N3 line above (BUILD.md:42, "only the draft deepEqual at mapping.test:48 gains
+`supporting: []`"). BUILD.md is append-only, so :42 stays as written. Mos OK'd the change of that old
+assertion in mos-1528. It is now at packages/library/tests/mapping.test.mjs:52, and commit 331653b38
+changed it. Everything else in that commit's hunk is new test lines, not changed old ones.
+
+- Old, mapping.test.mjs:48 at 45dca69f6:
+  `assert.deepEqual(m.universes.idea, { kind: 'draft', name: 'New World', books: [], playground: ['Drafts/New World/'] });`
+- New, mapping.test.mjs:52 at b2a1f4092:
+  `assert.deepEqual(m.universes.idea, { kind: 'draft', name: 'New World', books: [], playground: ['Drafts/New World/'], supporting: [] });`
+
+The line gains only `, supporting: []`; nothing else in it moved. The business.test and scope.test hunks
+add tests only (sage-3713: no OK needed). The other old-test change in this row is survey.test:73
+(mos-1330 item 4, 28918824c). Doc only.

agents/honker/work/queue-283/DESIGN.md

@@ -0,0 +1,191 @@
+# Row 283 (#1788) C2-01d design, draft 2 (Honker)
+
+Brief: docs/plans/2026-10-20_case2-rows.md "C2-01d" at refactor 94c33a43c. Sources: the design at
+agents/gosalyn/work/case2/DESIGN.md b68d79663, the ruling after r11 (:207), the M12 paragraph (:300),
+1.1 (:755) and 1.2 (:817). Base 94c33a43c. Reviewer Webby, gate owner Sage. Nothing is built yet. The
+build waits for 282 to land (sage-2906).
+
+## 1. Mapping (packages/library/src/mapping.mjs)
+
+`supporting`:
+- Every universe kind takes an optional `supporting` list: plain `['name','books','playground','supporting']`,
+  hybrid adds it to its seven keys, and a draft gets `['kind','name','playground','supporting']`.
+- Each value is checked as a playground prefix is: a string ending in `/` whose body passes `folder()`.
+- The output carries `supporting` on every universe, `[]` when absent, the way a draft carries
+  `books: []`. classify then needs no `?? []`. The business writer writes the raw document
+  (organization.mjs:195), not this output, so no business file changes shape.
+- The prefix rules, across every entry (ruling after r11):
+  - A supporting prefix holding another supporting prefix, or one listed twice, refuses
+    `library-mapping-invalid`.
+  - A prefix equal to one of its own entry's book folders, or holding one, refuses `library-mapping-invalid`.
+  - A prefix inside or holding another entry's book folder refuses `library-supporting-other-universe`.
+  - Level comes from where the prefix sits, as for the playground: inside one of its own entry's books
+    is book level, and outside every book is universe level. A draft's prefixes are all universe level.
+- Between the two lists (my choice, Q2):
+  - A supporting prefix may equal a playground prefix of the same entry. That folder is writable.
+  - A playground prefix may hold a supporting prefix of the same entry. The inner folder is supporting
+    and the rest stays playground.
+  - A supporting prefix that holds a playground prefix refuses `library-mapping-invalid`. classify
+    checks supporting first, so that playground prefix could never match.
+  - A supporting prefix equal to, holding or inside a playground prefix of another entry refuses
+    `library-mapping-invalid`. Otherwise one path would have two universes.
+- The book loop at mapping.mjs:128-140 becomes a helper that both lists call with their own code and
+  label. The playground's messages and codes stay byte-equal, so no existing test text moves.
+
+`editor`:
+- The entry takes an optional `editor`. When present, it is an object with exactly the keys `name` and
+  `email` (via `only()`). Each value is a string that is non-empty after trim and has no control
+  character (`[\u0000-\u001f\u007f-\u009f]`), `<` or `>` (webby-0169 R1: git drops them from an ident
+  and commits under a different name, so C2-02 would never see a failure). Anything else refuses
+  `library-mapping-invalid`.
+- The output carries `editor: { name, email }` only when present, as `user` and `vaultPrefix` do. A save
+  with no `editor` refusing is C2-02's job.
+
+## 2. Scope (scope.mjs)
+
+- `classify` gets a supporting loop before the playground loop (design 1.2). It returns `place(...)`
+  with `{ scope: 'supporting', universe, book }`. The book is the book folder holding the prefix, or
+  null at universe level and in a draft. The type and folder come from the first folder under the
+  prefix, as for the playground.
+- The `.md` check stays first, so a `.canvas` or `.base` under a supporting prefix stays unmapped.
+- The comment above `classify` names the three prefix scopes and the order.
+
+## 3. supportingPath (new supporting.mjs)
+
+`supportingPath(mapping, universe, path, tree)` returns `path` or throws
+`LibraryError('library-write-story-path', ...)`. It is pure and reads no git.
+
+- `tree` is the array `listTree` returns (reader.mjs:26, `{ mode, type, oid, size, path }`), so the
+  C2-02 broker passes its listing as it is (Q3). A non-array `tree` throws a TypeError, because that is
+  a caller bug, not a path class.
+- The checks run in this order, each with its own message naming the class:
+  1. The path must be a string of at most 1,024 UTF-8 bytes (`Buffer.byteLength`).
+  2. It must have no control character, using the same control class as `editor` (not `<` or `>`).
+  3. It must have no backslash.
+  4. It must not be absolute (a leading `/`).
+  5. It must have no empty, `.` or `..` segment. That also catches `//` and a trailing `/`.
+  6. `classify(mapping, path)` must give scope `supporting` and that same `universe`. This one check
+     covers an unknown universe, an unmapped path, a `.canvas`, `.base` or attachment, a canon or
+     story path, a playground path that isn't also supporting, and another universe's prefix. The scope
+     rule then has one source, and M1 below hits both.
+  7. Every proper prefix of the path (`a`, `a/b`, ...) and the path itself must not be in `tree` with
+     mode `120000` (symlink) or `160000` (gitlink).
+  8. No prefix of the path, and not the path itself, may equal a tree path or a tree directory
+     (derived from the entries' paths) after `normalize('NFC').toLowerCase()` on both sides, unless
+     it equals that tree path exactly. NFC as well as case, because APFS treats NFC and NFD forms of
+     a name as one file (webby-0169 N1).
+     Directories are checked too, because the folders under a supporting prefix are hers to name. A
+     path in a tree that holds both `a.md` and `A.md` refuses, which matches R7.
+- The refusal messages quote the path with JSON, except for the control-character class, whose message
+  leaves the path out.
+- The delete rule ("A delete also needs the path to exist at the tip as a 100644 blob", M12) isn't in
+  the brief's supportingPath list. It stays with C2-02's delete (Q4).
+  The C2-02 brief doesn't name it (only design :308), so BUILD.md carries it to C2-02 under Handoffs
+  (webby-0169 Q4).
+- index.mjs exports `supportingPath`.
+
+## 4. README (packages/library/README.md)
+
+- Mapping: `supporting` and its rules, the cross-list rules, and `editor`.
+- Refusals: a `library-supporting-other-universe` row, and the new cases in the
+  `library-mapping-invalid` row.
+- Scope: supporting first, then playground, then canon.
+- A new section, "Agent write paths", for supportingPath and its classes.
+
+## 5. Callers of classify outside files owned (Q1 for Sage)
+
+- survey.mjs:65 builds `{ canon: 0, playground: 0, unmapped: 0 }` and increments
+  `scopes[classify(...).scope]`. A supporting file adds `supporting: NaN`, and formatSurvey (:92) never
+  prints it. I propose a departure: add `supporting: 0` and print it, so the line becomes
+  `scopes canon 5, playground 1, supporting 0, unmapped 3; indexed 6`. That re-pins survey.test:73 and
+  adds a count test. Without it, the survey reports garbage once she marks a folder. The departure
+  covers two files, packages/library/src/survey.mjs and packages/library/tests/survey.test.mjs.
+- No change in the rest, each for a reason:
+  - reader.mjs:183 skips only unmapped, so supporting files are indexed like playground files.
+  - R5 (:207) flags only canon to playground, as design 1.3 R5 says. A canon link to a supporting file
+    raises nothing.
+  - render.mjs:23 gives supporting a null badge. The supporting badge belongs to C2-10b (design :1415).
+  - mirror.mjs:246 refuses only unmapped. Reading supporting files by scope is C2-05c's.
+  - No bus or webui source filters on scope (git grep at 94c33a43c).
+- M9 already protects the whole `projects` key from agent edits (library-projects-protected.test). No
+  test is added there.
+
+## 6. Tests
+
+- mapping.test:
+  - T1: `supporting` at book level, at universe level, in a hybrid and in a draft. The output carries
+    it, with `[]` when absent. The draft `deepEqual` at :48 gains `supporting: []`.
+  - T2: one test per prefix rule.
+    - These refuse `library-mapping-invalid`: no trailing `/`, a bad folder, one holding another, one
+      listed twice, one equal to its own book, one holding its own book, one holding a playground
+      prefix, and one overlapping another entry's playground.
+    - These refuse `library-supporting-other-universe`: one inside another universe's book, and one
+      holding another universe's book.
+    - An equal same-entry playground passes.
+  - T3: `editor` passes, and absent passes. It refuses `library-mapping-invalid` for a non-object, an
+    array, an extra key, a missing key, an empty or blank value, a non-string, and a control character,
+    `<` or `>` in either value.
+- scope.test, T4:
+  - Supporting at book level, universe level and in a draft each give their universe and book.
+  - A folder in both lists is `supporting`, and a playground-only folder is `playground`.
+  - A supporting `.canvas` or `.base` is unmapped.
+- supporting.test (new):
+  - T5 passes at book level, universe level, in a draft, in a both-lists folder, and at exactly 1,024 bytes.
+  - T6 has one refusal per class against a fixture tree with a symlink, a gitlink and a case variant.
+    The classes are:
+    - unmapped, `.canvas`, `.base`, an attachment, canon, playground-only, another universe's
+      supporting prefix, and an unknown universe;
+    - absolute, `..`, `.`, `//`, a trailing `/`, a backslash, a C0 control and DEL;
+    - a symlink folder, a gitlink folder, and a symlink at the path itself;
+    - a case-variant file, a case-variant folder, and an NFD-form variant of an NFC tree name;
+    - 1,025 bytes made with a multi-byte character, so bytes and characters differ.
+  - Each asserts the code `library-write-story-path`.
+- business.test: T7 adds one assertion that `validateBusinessDocument` refuses
+  `library-supporting-other-universe`.
+- survey.test (only if Q1 is approved): T8 counts one supporting file, and :73 is re-pinned.
+
+## 7. Mutants (exact strings go in BUILD.md)
+
+| Mutant | Change | Killed by |
+|---|---|---|
+| M1 | classify checks playground before supporting (the brief's mutant) | T4 both-lists, T5 both-lists |
+| M2 | the other-universe fail for supporting is dropped | T2 |
+| M3 | the symlink and gitlink check is dropped | T6 |
+| M4 | the case check is dropped | T6 |
+| M4b | check 8 drops `normalize('NFC')` | T6 NFD variant |
+| M5 | the byte length uses `path.length` | T6 1,025 bytes |
+| M6 | the `editor` control-character check is dropped | T3 |
+| M6b | the `editor` `<` and `>` check is dropped | T3 |
+| M7 | supportingPath skips the universe match | T6 other universe |
+| M8 | the supporting-holds-playground check is dropped | T2 |
+
+## 8. Gate
+
+- Webby approves the manifest.
+- The library and business suites and every scripts/test-*.sh are green on Sage's gate.
+- Timeouts (mos-1275): each package `timeout -k 10 1800`, each script `timeout -k 10 300`, each single
+  file and mutant `timeout -k 10 600`. These come from my row 256 gate at 10:34Z.
+- Before in-review, grep packages/*/tests for 64-hex pins on the changed files and for the changed
+  message text, then drift-check BASE..refactor.
+
+## 9. Questions
+
+- Q1 (Sage): approve the survey.mjs and survey.test.mjs departure in section 5?
+- Q2 (Webby): the cross-list rules in section 1?
+- Q3 (Webby): `tree` as the `listTree` array?
+- Q4 (Webby): the delete's 100644 check stays with C2-02?
+- Q5 (Webby): `editor` refuses only blank values and control characters, as the brief says. `<` and `>`
+  would break a git ident. I'd leave them to C2-02's commit step unless you want them refused here.
+
+## 10. Draft 2 (webby-0169)
+
+- R1 folded: `editor` refuses `<` and `>` too, with T3 cases and mutant M6b.
+- Q2 accepted. BUILD.md records the tradeoff: refusing a supporting prefix that holds a playground
+  prefix goes past the brief, but it is the fail-closed reading and uses an existing code. The cost
+  is that she can't nest a playground under a supporting folder, though she can nest the other way.
+- Q3 accepted. Q4: carried to C2-02 under Handoffs in BUILD.md, and Sage was asked to add it to C2-02's brief.
+- N1 folded into check 8 (NFC and case), with an NFD case in T6 and mutant M4b.
+- N2: the survey.test:73 pin gains only `supporting`, and the count test is the only addition
+  (mos-1330, its own commit).
+- N3: before the build, re-grep tests outside packages/library for a `deepEqual` of the mapping output
+  on the build base.

agents/lena/README.md

@@ -0,0 +1,8 @@
+# Lena
+
+Builder seat, Codex gpt-6.1-sol, started by Mos under Q245 (mos-1506). Owns row 296 (FED R7, handed over from Quackerjack).
+
+No launcher in this directory. The seat runs as a T3 thread (thread db27faca) and works in its own worktree. It has no
+credentials of its own; it pushes only its own `lena/*` branches through the repository credential helper (mos-0981),
+never `refactor`, `main` or another seat's branch. Claude seats orchestrate and review (Q245). Registered by Sage on
+2026-10-23 so the queue can name the seat as row owner (store.mjs isSeatDir).

agents/researcher/work/queue-216/BUILD.md

@@ -0,0 +1,237 @@
+# Row 216 build notes (C2-05a, lookup index and queries, #1717)
+
+Phase A only: code, tests and this file. No test, suite or mutant has been run. `node --check` passed on every changed `.mjs`.
+
+- Branch: `researcher/row216`
+- Base: `d372102882d6858fa77af4aee453f866c886ad5c` (origin/refactor)
+- Design: `agents/gosalyn/work/case2/DESIGN.md` on origin/gosalyn/case2-design, section 3 (table at lines 625-631, bullets 633-641), 1.2-1.4, B12, D2
+- Brief: `docs/plans/2026-10-20_case2-rows.md`, C2-05a at lines 320-357
+
+## Files
+
+| Path | Status |
+|---|---|
+| `packages/library/src/index-build.mjs` | new |
+| `packages/library/src/query.mjs` | new |
+| `packages/library/src/index.mjs` | edit: 2 export lines added |
+| `packages/library/tests/query-fixture.mjs` | new, test helper |
+| `packages/library/tests/query.test.mjs` | new |
+| `packages/library/tests/index-build.test.mjs` | new |
+| `agents/researcher/work/queue-216/BUILD.md` | new (this file) |
+
+No existing test or source file changed beyond `index.mjs`.
+
+## Design rows and where each is tested
+
+| Design row | Code | Tests (query.test.mjs unless noted) |
+|---|---|---|
+| `library_find` | `find` | find is bound to its universe; every result carries its scope; long list pages; large items page under the cap |
+| `library_get` | `get` | hybrid gets a source file; get lists visible links both ways; get pages its lines |
+| `library_search` | `search` | search returns scoped line hits; item that cannot fit alone is refused |
+| `library_manuscript` | `manuscript` | one chapter at most 400 lines; refused without chapter; hybrid reads a source chapter |
+| `library_universe` | `universeInfo` | universe info reports a hybrid's sources, constraints, notes; unknown universe refused |
+| Hybrid semantics (1.4) | `sees` | a hybrid sees its sources canon minus exclusions, no playground |
+| Unmapped never appears | index build + `sees` | unmapped files never appear (query.test); index holds mapped files only (index-build.test) |
+| Per-commit cache (3) | `indexFor` | same commit, path, mapping return one index; different path, mapping or commit get their own; eight-entry bound; failed read not kept; unchecked mapping refused (index-build.test) |
+| Rebuild time (3, C2-05a gate) | `indexFor` | 3,000-file rebuild, time reported with `t.diagnostic`, no threshold asserted |
+| REPLY_CAP parity | `QUERY_REPLY_CAP` | equals `REPLY_CAP` from harness tools.mjs |
+
+## Choices where the design table is silent or differs
+
+These are departures or gaps. Each is built as stated, so Sage can rule before Phase B. A ruling that changes one of them is a small edit.
+
+1. **Paging arguments (gap a).** The table has no offset. `find` and `search` take an optional `offset` (a position in the filtered list, default 0). A reply carries `next`: the position of the next item, or `null`.
+2. **`library_get` has no universe (gap b).** Built with a required `universe`. Without it the reply could not be isolated. A missing file and a file the universe cannot see both return `null`, so a caller cannot tell them apart. `get` also takes an optional `from` line.
+3. **`get` over the cap (gap c).** Lines page by `from` with `next`. `links_out` and `links_in` come back whole on every page. If the frontmatter and links alone exceed the cap, the call is refused with `query-item-too-large`. A hub note with many backlinks may be refused. This needs a ruling: link paging, or accept the refusal.
+4. **`manuscript` without a chapter (gap d).** Refused with `query-chapter-required`. The design names no list form. A chapter name that matches two visible files is refused with `query-chapter-ambiguous`.
+5. **`search` excerpt (gap e).** The excerpt is the whole line, not a truncation. A line that alone exceeds the cap is refused. Truncating it would cut an item.
+6. **`exclude` form (gap f).** `checkMapping` accepts only a folder path for `exclude` (`folder()`), so an exclusion is a path prefix. There is no type or source form to build. Confirm.
+7. **Pin constraints.** `pin` does not hide any file. It is reported by `universeInfo` only. Confirm.
+8. **Playground through `get`.** `scope` applies to lists. `get` by an explicit path returns a playground file of the caller's own universe. Confirm.
+9. **Links.** A link into a file the universe cannot see is dropped from `links_out` and `links_in`, in line with N1. Links from a visible file that point into another universe are kept in the index (the reader keeps them under R6), and the query layer drops them for universes that cannot see them.
+10. **`find` matching.** Case-insensitive substring over the front matter `name` and the file name. An empty `query` matches every file in scope.
+11. **Cache key.** `repo`, `commit` and a sha256 of the canonical mapping. Keying by commit alone would return the wrong scopes after a mapping change. The cache holds eight entries, least recently used out. Failed reads are not kept.
+12. **`universeInfo`.** Reads only the checked mapping and the served commit. It builds no index.
+13. **Reply commit.** Every reply carries the index commit, which is the served commit passed in.
+
+## Provisional refusal codes (pending Sage approval)
+
+The brief says new refusal codes need Sage's approval first. These are provisional and must not be treated as settled:
+
+- `query-argument-invalid`
+- `query-universe-unknown`
+- `query-chapter-required`
+- `query-chapter-ambiguous`
+- `query-item-too-large`
+
+Reused, existing codes: `library-mapping-invalid`, plus the reader's `library-git`, `library-commit` through `indexFor`.
+
+## Grep results (grep only, not a test run)
+
+- Test references to the changed paths: `packages/library/tests/*.mjs` import `../src/index.mjs` and `../src/mapping.mjs`. `packages/bus/tests/library.test.mjs` and `library-sync.test.mjs` import the library index as a namespace. Neither enumerates its exports, so the two new export lines break no assertion.
+- `packages/cli/tests/stack-copy.test.mjs:52` checks that `packages/library/src/index.mjs` exists, and it still does.
+- 64-hex pins: none in `packages/library/tests`, none on `index.mjs`, `query.mjs` or `index-build.mjs`.
+- `scripts/test-*.sh`: no reference to the new modules.
+
+## Flag for Sage
+
+- `packages/library/tests/helpers.mjs` `repo()` builds its fixtures under `tmpdir()`, which is `/tmp`. The launcher rules forbid that. The new tests do not use it; they use `tests/query-fixture.mjs`, which builds under `/mnt/storage/scratch/tmp`. The existing helper should be fixed in a separate row, not here.
+
+## Phase B commands (not run)
+
+Run only after Sage sends "slot clear". Set the scratch TMPDIR first, per the launcher rule.
+
+```
+cd /mnt/storage/src/mosaic-stack/.claude/worktrees/agent-aa3cc98787bc5152c/packages/library
+export TMPDIR=/mnt/storage/scratch/tmp
+node --test tests/query.test.mjs tests/index-build.test.mjs
+node --test tests/*.test.mjs
+```
+
+Also run `packages/bus/tests/library.test.mjs` and `library-sync.test.mjs`, since they import the index.
+
+## Status
+
+Not yet verified. Nothing has been tested and nothing is committed. The working tree holds the Phase A changes. AGENTS.md invariant 8 allows a commit only after the applicable suites are green, so the commit waits for Phase B. The dispatch asked for a local commit in Phase A; Sage to confirm that the commit waits for Phase B.
+
+## Round 2 (2026-10-22, sage-2708, sage-2716): rulings applied, rebased onto aca16404c
+
+Added after the text above; nothing above is edited. "Nothing is committed", "Provisional refusal codes",
+`query-chapter-required` and the tmpdir flag above were true when written and are superseded here.
+
+- Branch `researcher/row216-r2`, one local commit on origin/refactor `aca16404c`. Row 268 (C2-01c) is in
+  that base. Row 253 has not landed; the work rebases onto 253's tip before any gate. Not pushed, not run.
+- Rulings: `agents/sage/work/queue-216/RULINGS.md` at da9555ca2, rulings 1-13 and the tmpdir flag.
+- Drift check, d37210288..aca16404c against my paths: the library files that changed are `mapping.mjs`,
+  `scope.mjs`, `README.md` and the mapping and scope tests. None is a file I add or edit. `query.mjs` reads
+  the checked mapping through them, so the whole library package runs in phase B.
+
+### What changed from phase A
+
+| Ruling | Change in `query.mjs` | Test |
+|---|---|---|
+| 3 `get` over the cap | `links_out` and `links_in` page together with `links_from`; every reply carries `links_next`, `next` and the front matter. A page with lines left carries at least one line. Links take at most half the cap while lines remain. `query-item-too-large` is left for front matter alone or one line alone (or one link alone) | hub note with 900 backlinks pages and adds up; front matter alone and a line alone refused; bad `links_from` |
+| 4 `manuscript` no chapter | `chapter` optional: the first visible chapter in path order. Every reply carries `next_chapter`. `query-chapter-required` removed. Ambiguity still refuses | first chapter and `next_chapter`; ambiguous name refused |
+| 5 `search` long line | hit comes back `{path, line, excerpt: null, excerpt_too_long: true, scope}`, other hits still return | marked hit and unmarked hits in one reply |
+| 6 `exclude` | path-prefix reading only. The test names `EXCLUSION` and `EXCLUDED_PATHS` in `query-fixture.mjs`, so C2-15 (row 267) swaps two constants | exclusion hides from the hybrid and not from the source |
+| 8 hybrid `get` | unchanged code; test added | hybrid gets a source's playground file as `null`; the source gets it with `scope: "playground"` |
+| PRD 1.14 (row 268) | `universeInfo` reports `kind` from the mapping (`draft` included) | four tests below |
+
+PRD 1.14 tests, one each: a lookup naming a `book` leaves `book: null` files out (find and search);
+`library_manuscript` never reads a `book: null` file; a draft universe has no canon, so its lookups return
+files only with `scope: "playground"`; `library_universe` on a draft returns kind, name and prefixes.
+The levels fixture is `WITH_LEVELS` in `query.test.mjs`: harbor gets `Notes/Harbor/` as a universe-level
+playground prefix, and `idea` is a draft over `Drafts/New World/`.
+
+`query-fixture.mjs` builds under `tmpdir()`, as `helpers.mjs` does (ruling "tmpdir flag"). The earlier
+flag about `helpers.mjs` building under `/tmp` is closed by that ruling: the gate sets `TMPDIR`.
+
+Refusal codes now: `query-argument-invalid`, `query-universe-unknown`, `query-chapter-ambiguous`,
+`query-item-too-large`. All four approved in the rulings.
+
+### Grep results (grep only, not a test run)
+
+- `git grep` over `packages/*/tests/*` and `scripts/*` for `query.mjs` and `index-build`: no hit outside
+  `packages/library/tests/query*.test.mjs` and `index-build.test.mjs`.
+- 64-hex pins naming a library path: none. Positive control: the same pathspec finds the sha256 lines in
+  `packages/cli/tests/case1-hostcheck.test.mjs` and the `packages/library/src/index.mjs` existence check at
+  `packages/cli/tests/stack-copy.test.mjs:52`.
+- Tests that read `packages/library/src` as a directory: `packages/cli/tests/stack-release-fixture.mjs:309`
+  copies `packages/library/src` whole into a release fixture. It carries no file list, so two new files break
+  no assertion. `stack-release.test.mjs` is not in the gate unless Sage wants it.
+- Tests that import the library index as a namespace: `packages/bus/tests/library.test.mjs` and
+  `library-sync.test.mjs`. Neither enumerates exports, so the two export lines add no break. Both run
+  whole in phase B.
+
+### Run limits (fixed before any run)
+
+Every node file runs as its own `setsid -w timeout -k 10 LIMIT node --test FILE`; nothing runs unbounded.
+
+- Node test files: LIMIT 900 s. The library test files have no recorded time. 900 s is above the longest
+  recorded whole-package run I know of (cli, 591 s, row 281 BUILD.md "Runs" step 3), so it holds the 3x rule
+  for any single file. The first run records each file's time, and a file past 300 s gets a limit re-derived
+  from it before the next run. `query.test.mjs` builds a 900-file repo and a 3,000-file index rebuild is in
+  `index-build.test.mjs`; both are the files most likely to need it.
+- No shell script is in this row's gate, so no script limit applies.
+
+Any timeout goes to Sage, then Mos, unplaced (mos-1275).
+
+### Phase B (not run; Sage's CLEAR first, then a rebase onto 253's tip)
+
+```
+export TMPDIR=/mnt/storage/scratch/tmp
+cd <worktree>/packages/library
+for f in tests/*.test.mjs; do setsid -w timeout -k 10 900 node --test "$f"; done
+cd ../bus
+for f in tests/library.test.mjs tests/library-sync.test.mjs; do setsid -w timeout -k 10 900 node --test "$f"; done
+cd ../cli
+setsid -w timeout -k 10 900 node --test tests/stack-copy.test.mjs
+```
+
+Mutants I propose (my list, not read off the brief; each is meant to be killed by the named test, and none
+has been thrown; the kill claims are unverified until CLEAR):
+
+- M-a: `sees()` returns true for a file of another universe: killed by "find is bound to its universe".
+- M-b: the playground filter dropped: killed by "playground appears only when asked for".
+- M-c: the hybrid reads a source's playground: killed by "a hybrid gets a source playground file as null".
+- M-d: `links_next` always null: killed by the hub paging test.
+- M-e: the book filter lets `book: null` through: killed by the PRD 1.14 book test.
+
+### Status
+
+Built, not run. `node --check` has not been run on this round's files (no node before the CLEAR); the
+phase A pass above covered the earlier text only. The commit is local and waits for no gate under Sage's
+sage-2716 instruction, which allows git and docs work only; push and claim wait for Sage's go.
+
+## Round 3: rebase onto 45dca69f6, drift check, hash-pin grep (2026-10-23T18:53:43Z, sage-3576)
+
+Appended; nothing above is edited. Git only; nothing run, nothing pushed. Branch researcher/row216-r4 holds the
+one row 216 commit on 45dca69f6 (origin/refactor, 10-23). Earlier base: 48e450ce8 (row 253).
+
+- Rebase: clean. `git range-diff 48e450ce8..038089e5f 45dca69f6..researcher/row216-r4` shows the commit as `=`.
+- Landed in 48e450ce8..45dca69f6: 1175 files. Path overlap with this row's 7 paths: none. packages/library: no
+  landed file. packages/harness/src/tools.mjs (imported by query-fixture.mjs or the tests): not landed.
+- Hash-pin grep (the item 216 owed): 64-hex in packages/library: none. Positive control: 364 files in
+  packages/*/tests and scripts match 64-hex. Tests and scripts that name library files by path:
+  bus/tests/library.test.mjs and library-sync.test.mjs and bus/src/runtime.mjs import library/src/index.mjs;
+  business/src/business.mjs and its test import library/src/mapping.mjs (unchanged by this row);
+  cli/tests/stack-copy.test.mjs, stack-release-fixture.mjs:310 and stack-release.test.mjs:1991 copy
+  packages/library/src as a tree; scripts/stack-copy.sh:37 copies it; scripts/mosaic:41 runs survey.mjs. None pins
+  a hash of index.mjs, index-build.mjs or query.mjs.
+- bus/src/runtime.mjs landed changes after 48e450ce8 and uses libraryModule by named members (ensureMirror, SLOT,
+  readLibraryFile, libraryStatus, sync, LibraryError, SYNC_INTERVAL_MS) only; the landed diff touches none of them,
+  and this row's two new index.mjs exports (query and index build) are not iterated by any caller.
+- Gate additions for phase B: run bus library.test.mjs and library-sync.test.mjs whole (they import index.mjs), and
+  the cli stack-copy and stack-release tests that copy packages/library/src.
+
+## Round 4: phase B on 4e5d28ab2, two test fixes for r5 (2026-10-23T20:20:51Z, sage-3702, mos-1528)
+
+Appended; nothing above is edited.
+
+Phase B receipts on 4e5d28ab2 (researcher-r216-kit/out-b1): library whole 114 pass, 2 fail; bus library.test and
+library-sync.test 12 pass; cli 266 pass. The 3,000-file rebuild took 3807 ms (the test, with fixture setup, 4070 ms;
+`t.diagnostic` in index-build.test.mjs). No row 216 mutant was required or thrown in that round.
+
+The 2 library reds are test faults, not product faults. Both are placed as first-run reds in files this row adds
+(mos-1272); Mos ruled both fixes in mos-1528 and Sage relayed it in sage-3712.
+
+- R4: `packages/library/tests/index-build.test.mjs`, test "a different repo path, mapping or commit gets its own
+  index". Old: `writeFileSync(join(repo, 'Book One/Places/New.md'), …)` with no `Book One/Places` folder in FILES, so
+  the write failed with ENOENT. New: one `mkdirSync(join(repo, 'Book One/Places'), { recursive: true })` before the
+  write (import line gains `mkdirSync`). No assertion changes.
+- R5: `packages/library/tests/query.test.mjs`, test "a hybrid sees its sources canon, minus exclusions, and no
+  playground". The assertion sorts the actual paths and compared them to an unsorted literal, so the literal had
+  the wrong order (Characters before Chapters; Second World Characters before Chapters). New: only the expected
+  literal is reordered into sorted order. The `.sort()` on the actual side stays, and the assertion still checks
+  order. The set of seven paths is unchanged.
+- Product code: no edit.
+
+Reruns owed after the r5 commit (run on Sage's CLEAR, after the 283 gate): index-build.test.mjs whole,
+query.test.mjs whole, library whole, and the mutants those two files kill (M-a to M-e above). Results are appended
+below as a new entry.
+
+Run limit note: stack-release.test.mjs ran 644 s in the cli run. A per-file limit of 3 x 644 = 1932 s covers it.
+Sage's gates run cli as one whole-package `node --test` under 2100 s.
+
+Carry notes from Filbert's static check (doc only, no change in r5): N1 and N2 stay recorded as he gave them. The
+`After` list in this file still names row 268; row 268 landed at c27207f6e.

agents/researcher/work/queue-220/BUILD.md

@@ -0,0 +1,100 @@
+# Row 220: C2-10a, no raw session view (M7) and no raw Discord engine (M8)
+
+Phase A. No test, suite or mutant has been run. Sage opens the slot.
+
+- Owner: researcher seat (Haiku 5.5 subagent), dispatched by Sage under lead decision 129.
+- Reviewer: Filbert.
+- Branch: `researcher/row220`, from `origin/refactor` at d37210288.
+- Brief: `docs/plans/2026-10-20_case2-rows.md`, C2-10a (line 495) and "Rules every row keeps".
+- Design: `agents/gosalyn/work/case2/DESIGN.md` on `origin/gosalyn/case2-design`, sections 5.1 (M7, M8), 7.6, 8 (row list).
+
+## Status
+
+| Item | State |
+|---|---|
+| M7 reader side (`conversation-not-listed`) | Built. Tests written, not run. |
+| M7 production wiring (the caller that passes `isCreative`) | Not built. Outside the file list, and it needs a ruling (question 1). |
+| M8 `discord check` and `discord run` refusals | Not built. `packages/discord/src/cli.mjs` is untouched. Blocked on question 1 and question 2. |
+
+Phase A is therefore partial. The row cannot pass its acceptance until Sage rules on the questions below.
+
+## Files
+
+- `packages/conversation/src/reader.mjs`: exports `NOT_LISTED`; `createReader` takes `isCreative` (default `() => false`); `catalogue()`, `open()` and `next()` hide a root for which it returns truthy.
+- `packages/conversation/tests/reader.test.mjs`: three new tests, inserted before the "unknown conversations" test.
+- `agents/researcher/work/queue-220/BUILD.md`: this file.
+
+Nothing else is changed. `node_modules` in the worktree is a symlink to the canonical checkout and is ignored by git.
+
+## Brief and design items mapped to tests
+
+| Item | Test |
+|---|---|
+| M7: a creative session file under the root isn't listed | "M7: a creative seat's session is not listed and won't open by id; an assistant seat still lists" |
+| M7: and won't open by id (`conversation-not-listed`) | same test; second check of the open refusal in "M7: a creative session already open refuses its next page once the root is hidden" |
+| M7: an assistant session still lists | same test (the `sage` seat is listed and opens with its text) |
+| M7: an already-issued cursor stops once the root is hidden (my addition; the design's "won't open" implies it) | "M7: a creative session already open refuses its next page once the root is hidden" |
+| M7: refused rows and the unsupported placeholder of a creative root are hidden too (my addition; the design hides "creative sessions", and a refused row or placeholder names one) | "M7: a creative root's refused files and its unsupported placeholder are hidden as well" |
+| Default behavior without `isCreative` is unchanged | the existing reader suite; the default predicate returns false |
+| M8: `discord check` / `discord run` refuse `discord-engine-not-allowed` on a library business, and a `mosaic-bus` binding with `tools` | none (not built, question 1) |
+| M8: a pi binding on a business without a library still checks clean | none (not built, question 1) |
+
+Every test's fixture text is `CREATIVE-MARKER` or a made-up assistant line. The M7 tests assert the marker is absent from the catalogue and refusal output.
+
+## Choices made in phase A
+
+- `isCreative(root)` is the reader's only input. The reader reads no business file. A truthy answer hides, so a doubtful answer fails closed. The predicate must depend on `root.seat` and `root.project` only, because a cursor is checked against the root object from an earlier listing.
+- Hidden check placed after the cursor's actor/purpose/conversation/branch checks in `next()`, and before the source is read.
+- `open()` checks hidden after the id resolves, so a creative id gets `conversation-not-listed`, and an unknown id still gets `unknown-conversation`.
+- `conversation-not-listed` is `reconcile: false`. The design names no reconcile flag. `unknown-conversation` uses true. Question 3.
+- The default predicate is `() => false`. Until a caller passes one, M7 does nothing. This is the open risk, and question 1 covers it.
+
+## Grep over `packages/*/tests` and `scripts/test-*.sh` (static, phase A)
+
+Changed path `packages/conversation/src/reader.mjs`:
+- `packages/conversation/tests/reader.test.mjs:14` imports `rootsFromSpecs, createReader, conversationId, cwdInProject, UNSUPPORTED_HARNESS`. It is the file under change.
+- `packages/control-board/tests/serve.test.mjs:26` imports `UNSUPPORTED_HARNESS`. That export is unchanged.
+- `packages/library/tests/sync.test.mjs:15` imports `packages/library/src/reader.mjs`, a different file. Not a hit.
+- `scripts/test-*.sh`: no reference to the conversation reader.
+- 64-hex pins naming this path: none. `packages/bus/tests/grant-migration.test.mjs:24` has a 64-hex value, but it is a DDL digest, not a pin on this path. That file matched only the word "reader" in a test title.
+
+Changed path `packages/conversation/tests/reader.test.mjs`:
+- No other test or script names this file. It runs through `packages/conversation`'s `node --test tests/`.
+- No 64-hex value in the file.
+
+Changed path `agents/researcher/work/queue-220/BUILD.md`: no pin.
+
+`node --check` passed on both changed `.mjs` files.
+
+## Phase B plan (not run)
+
+The reader test uses `os.tmpdir()`. Set `TMPDIR` to a scratch dir first, per the rule against `/tmp`.
+
+```
+export TMPDIR="$(mktemp -d /mnt/storage/scratch/tmp/r220XXXXXX)"
+cd packages/conversation && node --test tests/reader.test.mjs
+cd packages/conversation && node --test tests/
+cd packages/discord && node --test tests/
+cd packages/control-board && node --test tests/serve.test.mjs
+```
+
+The first command is the touched file whole. The second and third are the conversation and discord suites whole, as the brief asks. The control-board serve test is not in the brief. It consumes `reader.mjs`, so I recommend it. Sage can drop it.
+
+## Questions for Sage
+
+1. **Business link (blocks M8 and the M7 wiring).** Neither rule can be built from this row's file list, because the inputs don't exist in the code:
+   - A reader root carries `seat` (the spec's `agent`) and `project` (the repo directory name). It has no business id. Roots come from control-board scan specs (`packages/control-board/src/scan.mjs`, `discoverRepoAgents`) and seat registrations. Neither carries a definition.
+   - A Discord binding has `seat` and no business key (`packages/discord/src/binding.mjs`, `TOP_KEYS`).
+   - Creative status lives only in the business file: `roles.<instance>.definition` in `CREATIVE_DEFINITIONS` (`packages/business/src/vocabulary.mjs:176`). A library project is `projects.<id>.kind === "library"` (`packages/business/src/business.mjs:243`).
+   - Creative thread sessions are stored at `<dataRoot>/threads/<business>/<thread>/session` (`packages/seat/src/session.mjs:59-64`), outside the `.pi/state` roots the board scans. M7 may therefore reach only creative seats that have a `.pi/state` session root. Please confirm.
+   - The design does not define the mapping from a seat to a business.
+
+   Recommendation: add a required `business` key to the binding, validated against `businesses/<id>.json`. The board builds `isCreative` from `loadBusiness(id)`: a root is creative when its seat is a `roles` key whose definition is in `CREATIVE_DEFINITIONS`, and the business has a library project. This needs file scope for `packages/discord/src/binding.mjs` and `cli.mjs` (M8), and `packages/control-board/src/serve.mjs` (M7 wiring). None of those is on this row's list. I need that scope amendment and the mapping ruling before I build M8 or the wiring.
+
+2. **M8 refusal code for a `mosaic-bus` binding with `tools`.** The design names `discord-engine-not-allowed` for the engine case and no code for the tools case. A new code goes to you first. My proposal is to reuse `discord-engine-not-allowed` with a message that names the tools key.
+
+3. **`reconcile` on `conversation-not-listed`.** I chose `false`. Confirm or change.
+
+4. **HTTP status for `conversation-not-listed`.** `REFUSAL_STATUS` in `packages/control-board/src/serve.mjs` has no entry, so the route returns 422. My proposal is 404, next to `unknown-conversation`. This needs that file on the scope list too.
+
+Phase A stops here. On your "slot clear" I will run the phase B commands above. I will not build M8 or the wiring until question 1 is answered.

agents/researcher/work/queue-220/r2/BUILD.md

@@ -0,0 +1,481 @@
+# Row 220 r2: phase A round 2 (M7, M8, business helper, REFUSAL_STATUS)
+
+Phase A only. No node, npm, `node --check` or test run has happened in this round, and nothing is
+committed. Phase B (the suites) waits for the coordinator's "slot clear".
+
+- Owner: researcher seat (Haiku 5.5 subagent), dispatched by Sage under lead decision 129.
+- Reviewer: Filbert.
+- Branch: `researcher/row220-r2`, from `origin/refactor` at da9555ca2. The r1 cherry-pick 3fa833715 is
+  staged with `-n`.
+- Rulings: `agents/sage/work/queue-220/RULINGS.md` on origin/refactor (da9555ca2). Import-by-path is
+  followed: no export line in `packages/business/src/index.mjs`, and `packages/discord/src/binding.mjs`
+  is untouched.
+
+## Coordinator rulings, applied
+
+Round 1 answers (earlier packet): applied as before. Absent `businesses/` gives empty sets only on
+ENOENT; other failures throw. stack-copy test joins phase B. Webui fixtures pass `businessDir` (renamed `configDirectory` in round 2b below). Discord
+refusals exit 2.
+
+Round 2 rulings (coordinator message, this round):
+
+1. **Dangling symlink at `businesses/` refuses.** `loadSeatSets` calls `lstatSync(join(dir, "businesses"))`
+   first. Only an lstat ENOENT (nothing at the path) returns empty sets. If something is there and
+   `readdirSync` fails for any reason, including ENOENT through a dangling link, it throws `BusinessError`.
+   Test added: "a businesses symlink to a missing target throws; no empty set". The absent-directory test is kept.
+2. **Sets are read once per public reader call.** `createReader` takes `creativeCheck`, a factory. Each
+   `catalogue()`, `open()` and `next()` calls it once, then applies the returned predicate to every root.
+   A load failure refuses `conversation-business-unreadable` for the whole call. `serve.mjs` exports
+   `creativeCheck(dir = configDir())`, the factory, and `createServer` passes `creativeCheck(businessDir)`.
+   Test added: "one catalogue calls the creative check once, however many roots it lists". It counts factory
+   calls: 1 after `catalogue()`, 2 after one `open()`.
+3. **Phase B adds three test files:** `packages/webui/tests/tester-browser.test.mjs`,
+   `tester-cli.test.mjs` and `proof-cli.test.mjs`, run whole (they reach `fixture.mjs` through
+   `tester-fixture.mjs`). Phase B is 36 files: 33 plus these 3.
+4. **Scope additions approved** (coordinator round 2 ruling 4): `packages/control-board/tests/discord.test.mjs`
+   line 123 and the five webui test files (`fixture.mjs`, `history-fixture.mjs`, `relaunch.test.mjs`,
+   `return-flow.test.mjs`, `discord.test.mjs`). They stop tests reading the real config directory.
+5. **TMPDIR** for phase B is set by the coordinator under `/mnt/storage/scratch/tmp`. No code change.
+
+## Discord exit code
+
+Refusals from the library-seat check exit 2, the code the Discord CLI already uses for configuration and
+binding refusals.
+
+- `packages/discord/src/errors.mjs` line 2: `// exitCode follows docs/TOOLS.md: 1 operation failed, 2 invalid data or configuration, 3 refused by a brake (STOP or a held binding; a supervisor must not retry), 4 usage.`
+- `packages/discord/src/errors.mjs` line 5: `constructor(message, exitCode = 2, details = undefined)`.
+- Config refusal precedent: `packages/discord/src/binding.mjs` line 67, `throw new DiscordError(\`config.dataRoot must be an absolute path: ${path}\`);`. No explicit code, so exit 2.
+- `checkLibraryEngine` in `packages/discord/src/cli.mjs` lines 115 to 122. Each refusal passes `, 2)`:
+  `discord-business-unreadable` (115), `discord-engine-not-allowed` for a non-mosaic-bus engine (119),
+  and `discord-engine-not-allowed` for a mosaic-bus binding that declares `tools` (122).
+- `grep -n ", 3)" packages/discord/src/cli.mjs` finds nothing. `grep -rn "status, 3" packages/discord/tests`
+  finds only existing brake tests in recover.test.mjs and binding.test.mjs. Not changed.
+  `library-seat.test.mjs` asserts 2 on all three refusals.
+
+## Files (round 2, uncommitted)
+
+| File | Change |
+|---|---|
+| `packages/business/src/library-seats.mjs` | new: `loadSeatSets({ dir, rolesDir })` returns `{ librarySeats, creativeSeats }`; lstat-first (ruling 1); read per call |
+| `packages/business/tests/library-seats.test.mjs` | new: 7 tests (6 from r1 plus the dangling symlink) |
+| `packages/conversation/src/reader.mjs` | r1 plus r2: `NOT_LISTED`; `creativeCheck` factory option, called once per `catalogue()`, `open()` and `next()`; `catalogue()` wrapped so a refusal returns `{ ok: false }` |
+| `packages/conversation/tests/reader.test.mjs` | r1: 3 M7 tests, now on `creativeCheck`; r2: 1 spy test (one factory call per catalogue) |
+| `packages/control-board/src/serve.mjs` | `REFUSAL_STATUS`: `conversation-not-listed` 404, `conversation-business-unreadable` 503; `export creativeCheck(dir = configDir())` (factory); `createServer({ businessDir = configDir() })` wires `creativeCheck: creativeCheck(businessDir)` |
+| `packages/control-board/tests/creative-hidden.test.mjs` | new: 4 tests (3 from r1 plus known-and-unknown id both 503), switched to `creativeCheck` |
+| `packages/control-board/tests/serve.test.mjs` | pin test adds `NOT_LISTED` and `conversation-business-unreadable`; conversation fixture passes `businessDir` |
+| `packages/control-board/tests/discord.test.mjs` | line 123 passes `businessDir` (ruling 4) |
+| `packages/discord/src/cli.mjs` | `checkLibraryEngine` called from `prepare()`; exit 2 |
+| `packages/discord/tests/helpers.mjs` | `makeDeployment` creates an empty `businesses/` beside `config.json` |
+| `packages/discord/tests/library-seat.test.mjs` | new: 5 tests, all `--offline`, all asserting exit 2 |
+| `packages/webui/tests/fixture.mjs` | `businessDir` on the board start (ruling 4) |
+| `packages/webui/tests/history-fixture.mjs` | `businessDir` on the board start (ruling 4) |
+| `packages/webui/tests/relaunch.test.mjs` | `businessDir` on the board start (ruling 4) |
+| `packages/webui/tests/return-flow.test.mjs` | `businessDir` on the board start (ruling 4) |
+| `packages/webui/tests/discord.test.mjs` | `businessDir` on the board start (ruling 4) |
+
+Not touched: `packages/business/src/index.mjs`, `packages/discord/src/binding.mjs`, `scripts/stack-copy.sh`.
+
+## Brief item to test map
+
+| Brief item | Test |
+|---|---|
+| Q1 helper: library and creative sets from business files | `business/tests/library-seats.test.mjs` "library seats come from library businesses..." |
+| Q1 a non-library business puts no seat in either set | `library-seats.test.mjs` "a business with no library project..." |
+| Q1 absent businesses directory gives empty sets | `library-seats.test.mjs` "an absent businesses directory gives empty sets" |
+| Q1 any other failure throws, no empty set | `library-seats.test.mjs` "a businesses path that is not a directory throws"; "a businesses symlink to a missing target throws"; "a business file that can't be read throws"; "a business file that is not valid JSON throws" |
+| Round 2 ruling 2: one read per public call | `conversation/tests/reader.test.mjs` "one catalogue calls the creative check once..." |
+| M7 hidden from catalogue, open and next | `control-board/tests/creative-hidden.test.mjs` "the check hides the creative seat..."; r1 reader tests (catalogue, open, next, symlink and placeholder) |
+| M7 second wall: thread store | `creative-hidden.test.mjs` "a thread store is not a root from a spec..." (asserts `rootsFromSpecs` drops it, then a root over it is hidden with 404 `conversation-not-listed`) |
+| M7 unreadable business refuses listing and open | `creative-hidden.test.mjs` "an unreadable business file refuses the listing and open with 503" |
+| Coordinator follow-up: known and unknown id both 503 when unreadable | `creative-hidden.test.mjs` "with an unreadable business file, a known and an unknown id both refuse with 503" |
+| M8 non-mosaic-bus engine on a library seat | `discord/tests/library-seat.test.mjs` "a library seat's binding on a non-mosaic-bus engine is refused" (exit 2, message names the engine) |
+| M8 mosaic-bus binding that declares tools | `library-seat.test.mjs` "...declares tools is refused, and the message names tools" (exit 2) |
+| M8 mosaic-bus, no tools, allowed | `library-seat.test.mjs` "...with no tools passes the engine rule" |
+| M8 unreadable business file | `library-seat.test.mjs` "an unreadable business file refuses check with discord-business-unreadable" (exit 2) |
+| M8 seat in no library business checks clean | `library-seat.test.mjs` "a binding on a seat that is in no library business checks clean" |
+| Q3 reconcile false | r1 reader test asserts `[false, "conversation-not-listed", false]` |
+| Q4 HTTP 404 and 503 | `creative-hidden.test.mjs` (status asserted); `serve.test.mjs` pin test |
+
+## Choices (for Filbert to check)
+
+1. **Absent versus unreadable `businesses/`.** Only nothing at the path reads as empty (lstat ENOENT). A
+   dangling symlink, a file, or an unreadable directory throws. Coordinator ruling 1.
+2. **Sets are read once per public call.** `creativeCheck()` runs once in each of `catalogue()`, `open()` and
+   `next()`. The returned predicate answers every root in that call. A catalogue with zero roots still
+   loads the sets once, so an unreadable business file refuses even an empty list. Coordinator ruling 2.
+3. **Behavior change, kept on coordinator ruling (round 2 follow-up): an unknown id or cursor loads the sets
+   first.** In `open()`, the check runs after `checkCaller` and before `resolveConversation`. In `next()`, it
+   runs at the start of the try. So with an unreadable business file, a known id and an unknown id both give
+   503 `conversation-business-unreadable`, where round 1 gave 404 `unknown-conversation` for the unknown id.
+   Checking the id first would give 503 for a hidden creative id and 404 for an unknown one, which reveals
+   whether the hidden id exists. Loading first answers every id the same way (fail closed). This reverses
+   round 1 choice 3. Test: `creative-hidden.test.mjs` "with an unreadable business file, a known and an unknown id both refuse with 503".
+4. **Discord refusals use the `code: message` form and exit 2.** Exit 3 is for brake refusals (STOP or a held
+   binding). A seat's engine or library membership is not a brake. The business CLI is not used as precedent.
+5. **The thread-store wall exists in part already.** `rootsFromSpecs` (`reader.mjs` line 44) drops any
+   sessions directory that is not `<project>/.pi/state/<seat>/sessions`. The M7 check is the second wall, for
+   roots built another way. The test checks both.
+
+## Static checks (read-only; no node)
+
+- **COPY_PATHS** (`scripts/stack-copy.sh` 29 to 41): `packages/business/src`, `packages/conversation/src`,
+  `packages/discord/src` and `packages/library/src` are present. `packages/control-board/src` is not. COPY_PATHS
+  is not changed.
+- **Stale names.** `grep -rn -E "isCreative|creativeRootPredicate" packages scripts` finds nothing after this round's edits.
+- **Board starts without `businessDir`.** Webui: all five direct starts pass it. Control board:
+  - `serve.test.mjs` has seven single-line starts without it (lines 402, 445, 464, 483, 509, 528, 907) and four
+    multi-line starts without it (114, 149, 229, 258). None of those tests reaches a conversation route.
+    Every conversation route call in the file (lines 1027 to 1171) follows a start that passes `businessDir`
+    (1006, 1075, 1124). Checked by line order.
+  - `creative-hidden.test.mjs` builds `creativeCheck(f.dir)` on its own scratch directory. No default is used.
+  - `discord.test.mjs` passes `businessDir` (line 123).
+- **Consumers of the two fixtures** (exact import strings, `from './fixture.mjs'`, `from './history-fixture.mjs'`):
+  - Direct `fixture.mjs` importers, 31 test files: board-held, browser-edge, browser, bus-browser, bus,
+    chat-browser, chat, discord, docs-browser, editor-browser, editor, instances-browser, limits-browser,
+    limits-route, messages, preview, proof, relaunch, return-flow, routes-browser, send-browser, send, serve,
+    settings-form, shell, sso-browser, sso, tester-listener, usage-browser, usage, views.
+  - `history-fixture.mjs` importers, 2 test files: conversation, history-return-flow.
+  - Total fixture consumers: 33. Plus `tester-browser`, `tester-cli` and `proof-cli` (through
+    `tester-fixture.mjs`, ruling 3): 36 files in phase B.
+
+## Phase B commands (after "slot clear" only)
+
+TMPDIR is set by the coordinator under `/mnt/storage/scratch/tmp`. The commands below assume it. The new
+tests call `tmpdir()`, so an unset TMPDIR would put them under `/tmp`, which bwrap hides.
+
+```sh
+cd /mnt/storage/src/mosaic-stack/.claude/worktrees/agent-a1b36cb7769b3d00e/packages/conversation && node --test tests/
+cd /mnt/storage/src/mosaic-stack/.claude/worktrees/agent-a1b36cb7769b3d00e/packages/discord && node --test tests/
+cd /mnt/storage/src/mosaic-stack/.claude/worktrees/agent-a1b36cb7769b3d00e/packages/business && node --test tests/
+cd /mnt/storage/src/mosaic-stack/.claude/worktrees/agent-a1b36cb7769b3d00e/packages/control-board && node --test tests/
+cd /mnt/storage/src/mosaic-stack/.claude/worktrees/agent-a1b36cb7769b3d00e && scripts/test-discord.sh
+cd /mnt/storage/src/mosaic-stack/.claude/worktrees/agent-a1b36cb7769b3d00e/packages/cli && node --test tests/stack-copy.test.mjs
+cd /mnt/storage/src/mosaic-stack/.claude/worktrees/agent-a1b36cb7769b3d00e/packages/webui && node --test tests/board-held.test.mjs tests/browser-edge.test.mjs tests/browser.test.mjs tests/bus-browser.test.mjs tests/bus.test.mjs tests/chat-browser.test.mjs tests/chat.test.mjs tests/conversation.test.mjs tests/discord.test.mjs tests/docs-browser.test.mjs tests/editor-browser.test.mjs tests/editor.test.mjs tests/history-return-flow.test.mjs tests/instances-browser.test.mjs tests/limits-browser.test.mjs tests/limits-route.test.mjs tests/messages.test.mjs tests/preview.test.mjs tests/proof.test.mjs tests/relaunch.test.mjs tests/return-flow.test.mjs tests/routes-browser.test.mjs tests/send-browser.test.mjs tests/send.test.mjs tests/serve.test.mjs tests/settings-form.test.mjs tests/shell.test.mjs tests/sso-browser.test.mjs tests/sso.test.mjs tests/tester-listener.test.mjs tests/usage-browser.test.mjs tests/usage.test.mjs tests/views.test.mjs tests/tester-browser.test.mjs tests/tester-cli.test.mjs tests/proof-cli.test.mjs
+```
+
+The webui line is 36 files, run whole. `history-fixture.mjs` and `tester-fixture.mjs` run through their
+consumers. No test has been run. The expectations above come from reading the code.
+
+## Open items
+
+a. Phase B checks the dangling-symlink test on this platform (lstat then readdir ENOENT must throw).
+b. Phase B checks the spy count (1 after catalogue, 2 after one open). A failure here means a public call
+   reads the factory more than once.
+c. Choice 3 is settled by the coordinator: keep 503 for unknown ids too. Phase B checks the new known-and-unknown test.
+d. The browser-based webui tests need a browser in this environment. A failure there would be environmental.
+   Phase B will show which.
+e. Nothing here has been executed. Phase B checks every expectation, including the unreadable-file test
+   (EACCES must throw), the root skip (uid 0 skips), and the webui consumers.
+
+## Resolved
+
+- Dangling symlink at `businesses/` (round 1 open item a, and round 1 question 1): refuses, ruling 1.
+- Tester and proof CLI tests (round 1 question 2): join phase B, ruling 3.
+- Per-root reads (round 1 open item b): replaced by one read per public call, ruling 2.
+
+## Rebase onto aca16404c, run limits, index export (2026-10-22, sage-2708)
+
+Added after the text above; nothing above is edited. "Nothing is committed" above was true when written.
+
+- Commit `6f656abac` on `researcher/row220-r2`, one commit, rebased from da9555ca2 onto origin/refactor
+  `aca16404c`. Row 253 has not landed; this rebases again onto 253's tip before any gate.
+- Drift check, da9555ca2..aca16404c against my 18 paths: one overlap, `packages/discord/src/cli.mjs`
+  (the processing-control imports, rows 264 and neighbours). The conflict was the import block only. I
+  kept both sides: the two landed `processing-control` imports and my `loadSeatSets` import. No landed hunk
+  is reverted. `checkLibraryEngine` and its call in `prepare()` merged without a marker.
+- Board starts: no test added since da9555ca2 starts the control board or reads a conversation route
+  without `businessDir`. `packages/webui/tests/shell.test.mjs` fakes the board and does not start it.
+- Two edits since the r2 text: (1) a missing space in `reader.mjs` `next()` (`held =typeof`) fixed;
+  (2) `packages/business/src/index.mjs` gets `export { loadSeatSets } from "./library-seats.mjs";`. The text
+  above says "no export line". RULINGS.md Q1 says the helper is "exported from the package index" and the
+  scope amendment lists "its export line", so the file wins and the export is added. The two callers still
+  import by path, so nothing needs the export today. Filbert: drop the line if you read the ruling otherwise.
+  The export adds no test; `node --check` has not been run on it (no node before the CLEAR).
+
+### Run limits (fixed before any run)
+
+Every node file runs as its own `setsid -w timeout -k 10 LIMIT node --test FILE`; nothing runs unbounded.
+
+- Node test files: LIMIT 900 s. I found no recorded per-file time for the conversation, discord, business,
+  control-board or webui files. 900 s is above the longest recorded whole-package run I know of (cli, 591 s,
+  row 281 BUILD.md "Runs" step 3), so it holds the 3x rule for any single file. The first run records each
+  file's time; if a file passes 300 s, the limit is re-derived from it before the next run.
+- Shell scripts: `timeout -k 10 LIMIT bash scripts/test-X.sh`, LIMIT = 3x the longest recorded run plus
+  120 s, taken from Megavolt's row 281 table (`agents/megavolt/work/queue-281/BUILD.md`, from Gander's
+  `agents/gander/work/queue-278/SHELL-LIMITS.json`). A script with no limit does not run.
+
+| Script | LIMIT | Script | LIMIT |
+|---|---|---|---|
+| test-auth | 126 s | test-land-work | 158 s |
+| test-conductor | 145 s | test-queue | 191 s |
+| test-config | 130 s | test-release | 157 s |
+| test-discord | 147 s | test-task | 231 s |
+| test-extension-package | 130 s | test-foundation | 240 s |
+
+Any timeout goes to Sage, then Mos, unplaced (mos-1275).
+
+## Round 2b: Filbert's early look and sage-2719 (2026-10-22T14:46Z)
+
+Added after the text above; nothing above is edited. Where earlier text says `businessDir`, the parameter is
+now `configDirectory` (below). Second commit on `researcher/row220-r2`, on top of ea6dc9eff. Not pushed, not
+run; `node --check` has not been run on any of these files (no node before the CLEAR).
+
+Rulings applied (sage-2719): Q1 keep the index export. C1, C2 and the fixture scope are changes.
+
+### Fixture scope: the parameter is a config directory
+
+`createServer` took `businessDir`, but `creativeCheck(dir)` reads `<dir>/businesses`, so every fixture that
+passed `join(root, 'businesses')` made the reader look in `<root>/businesses/businesses`. That read nothing
+(ENOENT, empty sets): isolation from the real config held by accident. Now:
+
+- `createServer({ configDirectory = configDir() })` in `serve.mjs`. The parameter is not named `configDir`
+  because the import of that name is the default's source.
+- Every fixture passes the config directory it owns: `configDirectory: root` in the five webui files,
+  `f.root` in `control-board/tests/discord.test.mjs`, and `f.configDirectory` in `serve.test.mjs`.
+  `conversationFixture()` and `replyFixture()` both return `configDirectory: root`. The seven reply starts
+  that passed `f.businessDir` (undefined, falling back to the real `configDir()`) now pass a real value.
+- The dead `mkdirSync(join(root, 'businesses'))` lines in the five webui fixtures and in `serve.test.mjs`
+  are removed. So is the one in `discord/tests/helpers.mjs` `makeDeployment`, whose comment said "a missing
+  one refuses"; that was false (lstat ENOENT gives empty sets). The comment now says nothing there means no
+  library seat. Tests that need a `businesses/` directory create it: `writeJson` does, and the two
+  unreadable-file tests in `library-seat.test.mjs` call `mkdirSync` themselves.
+- Proof that the fixture's own business file is the one read: the new default-reader test (C2) hides `bean`
+  and shows `pm`, and nothing else in that fixture says which is which.
+
+### C1: M8 on `run`
+
+`library-seat.test.mjs` gains three `run` tests: a raw engine, a mosaic-bus binding with `tools`, and an
+unreadable business file. Each asserts exit 2 and the code in stderr, and that `s.d.journalDir` does not
+exist (`ensureJournal` comes after `prepare()` in `run`, so nothing was started). `run()` calls
+`initializeControl(dataRoot)` first, because `run` stops at `assertProcessing` before `prepare()`, as the
+STOP test in `binding.test.mjs:203` does. There is no `run` test for a clean seat: that would go on to the
+network.
+
+### C2: the default reader
+
+`creative-hidden.test.mjs`, "the board's default reader hides a creative seat's session from the listing and
+the detail route". It calls `startServer` with no `conversationReader`, `configDirectory: f.dir`, a `bean`
+session and a `pm` session on disk, and drives HTTP: the listing holds `pm` only; bean's detail is 404
+`conversation-not-listed`; pm's detail is 200; after a broken business file lands the listing is 503
+`conversation-business-unreadable`.
+
+### Mutants to throw (CLEAR only; none thrown; the kill claims are unverified)
+
+| Id | Mutation | Meant to be killed by |
+|---|---|---|
+| M7-w | delete `creativeCheck: creativeCheck(configDirectory),` in `createServer` (`serve.mjs`) | the default-reader test, first assertion (the listing shows `bean`) |
+| M7-c | `hiddenCheck()` in `reader.mjs` open() returns `() => false` | reader.test "hides the creative seat" and the `creative-hidden` 404 asserts |
+| M7-o | `creativeCheck` catch returns an empty set instead of throwing | the 503 asserts in `creative-hidden` |
+| M8-p | delete `checkLibraryEngine(...)` in `prepare()` | the three `check` refusals and the three `run` refusals; one mutant covers both verbs because they share `prepare()` |
+| M8-e | `loadSeatSets` returns empty sets on any lstat error | `library-seats` ENOENT-vs-file tests |
+
+### `refusalResponse` and `catalogue()`'s refusal (past "predicate wiring and REFUSAL_STATUS only")
+
+Why it is needed: the reader's `catalogue()` now returns a refusal when the business check throws (M7: no
+partial list), and `conversationResponse` had no way to turn a catalogue refusal into a status. `open` and
+`next` already built `{ status: REFUSAL_STATUS[code] ?? 422, body: { error, refusal: { code, reconcile } } }`
+inline; that expression moved, character for character, into `refusalResponse(out)` so the listing could
+use it too.
+
+No existing route's status or body changes:
+
+- `open` and `next` refusals: the same expression, now behind a function. `git diff aca16404c..HEAD --
+  packages/control-board/src/serve.mjs` shows the line as a move.
+- `/api/conversations` success: `{ status: 200, body: listing }` where `listing` is what the route returned
+  before. `catalogue()` returned `ok: true` on every path before this row, so the new branch is reached only
+  by the business refusal.
+- The "no parameters are accepted" 400 is untouched.
+
+Phase B runs `serve.test.mjs`, `discord.test.mjs` and the conversation route tests whole, so Filbert can
+check this statement against a green run.
+
+### Smaller changes from the early look
+
+- Spy test: one `next()` call adds a third `creativeCheck` count (`reader.test.mjs`). The catalogue assert
+  also checks `refusedRoots` is empty, in the same test and in the thread-store test in `creative-hidden`.
+- `library-seats.test.mjs` mode-000 test pins `BusinessError` and its message (`must be a regular,
+  non-symbolic-link file`, from `readJsonFile`'s open failure).
+- "passes the engine rule" now asserts exit 0 and `offline check passed`. The expectation is unverified: if
+  a mosaic-bus binding fails some other offline check, that is a first-run red to place (mos-1272).
+
+### Carried, not changed here
+
+- `conversation/src/controller.mjs:176` builds a reader with no `creativeCheck`. No `src` file imports it
+  today; a live wiring must pass the check. Raised for Sage.
+- `discord run` reads the business file once at start. `engine` and `tools` are FIXED_KEYS, so only a
+  business-file change while a connector runs goes unseen until the next start.
+- `creative-hidden` and `library-seats` use the repo `roles/` as the default `rolesDir`.
+
+### Gate additions
+
+Phase B list is unchanged: the same suites run whole, plus the files above are inside them. The drift check
+against `aca16404c..refactor`, including files these tests copy or read, repeats after the rebase onto 253.
+
+## Round 2c: refusalResponse statement corrected from the diff, controller.mjs follow-up (2026-10-22T14:55Z, sage-2729)
+
+Appended after Round 2b; nothing above is edited. This replaces Round 2b's refusalResponse statement, which I
+wrote from memory of the code. Source: `git diff aca16404c HEAD -- packages/control-board/src/serve.mjs` and
+`packages/conversation/src/reader.mjs`, read in full. No test has run.
+
+### What the diff shows in serve.mjs
+
+- `open` and `next` refusal: the object expression `{ status: REFUSAL_STATUS[out.refusal.code] ?? 422, body: {
+  error: out.refusal.message, refusal: { code, reconcile } } }` moved unchanged into `refusalResponse(out)`.
+  The two call sites reach it by `return refusalResponse(out)`. Status and body are identical for every code
+  that reached it before.
+- `REFUSAL_STATUS` gains two keys, `conversation-not-listed` (404) and `conversation-business-unreadable`
+  (503). Before, those codes did not exist, so no earlier response used them or changes. Every other key is
+  untouched.
+- `/api/conversations` with a query string: the 400 `no parameters are accepted` line is untouched.
+- `/api/conversations` success: before, `{ status: 200, body: reader.catalogue() }`; now the same object
+  when `listing.ok` (it is the same `listing`), so the 200 body is unchanged.
+- The one new response shape: `/api/conversations` can return a refusal (503 or the refusal's status) when
+  the business check throws. That is the M7 behaviour, not a change to an existing route's response.
+
+### What the diff shows in reader.mjs, past my Round 2b statement
+
+`catalogue()` is now wrapped in `try { ... } catch (err) { return refuse(err); }`. `refuse` returns a refusal
+object for a `Refusal` and rethrows anything else (`reader.mjs:352-355`). So a non-Refusal error still
+propagates as before. A `Refusal` escaping the loop body would now come back as `{ ok: false }` where it
+used to throw. The loop already catches `Refusal` from `listSessionFiles` and from `summarize`, so the only
+`Refusal` that newly reaches the wrapper is the hidden check's. I have not confirmed that `listRoots()`
+(`rootsFromSpecs`, `loadRegistrations`) never throws a `Refusal`; if it does, that call now returns a
+refusal. Filbert's round check should read `rootsFromSpecs` for `Refusal` throws.
+
+Round 2b said the old `catalogue()` "returned ok: true on every path". True for returns; it could throw.
+
+### Named follow-up for DEFERRED (Sage lands it with 220; it does not block 220)
+
+`packages/conversation/src/controller.mjs:176` builds a reader with no `creativeCheck`. No `src` file imports
+`controller.mjs` today, so no live path leaks. Whoever first wires `controller.mjs` live must pass
+`creativeCheck` (`creativeCheck(configDirectory)` from `control-board/src/serve.mjs`, or the reader's own
+equivalent) and add a test that a creative seat's sessions stay hidden through that path.
+
+## Round 2d: can listRoots() throw a Refusal into catalogue()? No (2026-10-22T14:53Z, sage-2730)
+
+Appended after Round 2c; closes the question Round 2c left open. Static read on 9a9f6dd54; nothing run.
+Filbert reached the same answer independently (filbert-220-r2c-static).
+
+`catalogue()` calls `listRoots()` inside the new `try`. In production that is `serve.mjs:261`,
+`roots: () => rootsFromSpecs(specs, loadRegistrations(seatsDir).registrations)`. The only `Refusal` class
+the reader catches is the one in `conversation/src/safe-fs.mjs:21`.
+
+- `rootsFromSpecs` (`conversation/src/reader.mjs:38-71`) calls `resolve`, `join`, `basename`, `Array.find`,
+  `toTime` and `samePath`, and constructs no `Refusal`.
+  - `toTime` (`conversation/src/pi.mjs:21-26`) returns a value or null and has no throw.
+  - `samePath` (`seat/src/seat.mjs:261-269`) wraps `realpathSync` in try/catch and returns false.
+- `loadRegistrations` (`control-board/src/scan.mjs:272-292`) catches `SeatError` and rethrows anything
+  else. It calls `readRegistration` (`seat/src/seat.mjs:200-216`), which throws `SeatError` only.
+- `grep -n "Refusal\|refuse(" packages/control-board/src/scan.mjs packages/seat/src/seat.mjs` finds
+  nothing, and neither file imports `safe-fs.mjs` (checked with `grep -n "^import"`). A `Refusal` cannot
+  originate in either.
+- Inside the loop, `listSessionFiles` is caught at `reader.mjs` (the `catch (err)` that rethrows
+  non-Refusals) and `summarize` turns an `openSessionFile` Refusal into a `denied` row.
+
+So the only `Refusal` that reaches the new catch is the hidden check's `conversation-business-unreadable`.
+Any other error still throws through `refuse()` (`reader.mjs:352-355`) exactly as before.
+
+Therefore `/api/conversations` has no status change for a path that existed before this row: the old
+throw paths are unreachable by a `Refusal`. The one new response is the business refusal, already pinned by
+the creative-hidden 503 assertion and the reader catalogue-refusal test. No extra test is added.
+
+The exception is an injected `roots` function that throws a `Refusal` itself; only a test could pass one,
+and none does.
+
+Time correction (2026-10-22T14:51:01Z): the heading times of Round 2c (14:55Z) and Round 2d (14:53Z) were written before I read the clock. The commits were made at 14:49:40Z (9a9f6dd54) and 14:50:52Z (176ac262e). The heading of Round 2b (14:46Z) is also an estimate; its commit e4a204836 was made before 14:47:53Z.
+
+## Round 4: rebase onto 45dca69f6, drift check (2026-10-23T18:53:43Z, sage-3576)
+
+Appended; nothing above is edited. Git only; nothing run, nothing pushed. Branch researcher/row220-r4 holds the
+five row 220 commits on 45dca69f6 (origin/refactor, 10-23). Earlier base: 48e450ce8 (row 253).
+
+- Rebase: clean. `git range-diff 48e450ce8..3ef6da90d 45dca69f6..researcher/row220-r4` shows all five commits as `=`,
+  so no patch changed.
+- Landed in 48e450ce8..45dca69f6: 1175 files (47 packages/bus, 32 webui, 29 cli, 10 plugins, 9 seat, 4 harness,
+  2 tasks, 7 scripts, BUILD-LOG.md, the rest agents/ and docs/).
+- Path overlap with this row's 19 paths: none.
+- Landed files in the packages these tests touch: webui (src/serve.mjs, src/cli.mjs, chat and bus files,
+  tests). Row 220's webui test changes are five fixtures that start the control-board server with
+  `configDirectory: root` and start the webui server with only `{ port, board }`; no landed webui file passes or reads
+  configDirectory. The landed webui tests are not in this row's change set, but a whole webui run covers them.
+  No landed file in control-board, conversation, discord or business.
+- Other users of the touched symbols (git grep on the r4 tree for createReader, rootsFromSpecs, creativeCheck,
+  configDirectory, businessDir, loadSeatSets, checkLibraryEngine, conversationReader outside this diff):
+  only conversation/src/controller.mjs:173-176 (the follow-up named in Round 2c) and the conversation README.
+- Hash pins: grep for 64-hex in packages/*/tests and scripts finds 364 files (positive control), and none pins a
+  row 220 source file by hash. Path-string hits for packages/discord/src/cli.mjs (copy-service.test.mjs,
+  scripts/test-discord.sh, discord-service.sh) are paths, not hashes.
+- Added to the gate list: `packages/discord/tests/helpers.mjs` is imported by 19 discord test files, and this row
+  removed its empty `businesses` mkdir. Phase B must run the discord package whole (and `scripts/test-discord.sh`),
+  not only library-seat.test.mjs.
+
+## Round 5: phase B on 2bb146b28, R1 and R2 fixes (mos-1528) (2026-10-23T20:21:39Z, sage-3712)
+
+Appended; nothing above is edited. The tree is 2bb146b28 plus the commits of branch researcher/row220-r5.
+
+Phase B receipts on 2bb146b28 (researcher-r220-kit out-b1, out-b2, out-b3, out-mut, out-npm):
+
+- discord 20 files, 200 pass; conversation 7 files, 187 pass; scripts/test-discord.sh rc=0, 82 passed.
+- control-board 7 files, 128 pass, 1 fail (serve.test.mjs, R2 below); business 26 files, 237 pass, 1 fail
+  (library-seats.test.mjs, R1 below).
+- webui: first run 409 pass, 1 fail (editor-provenance.test.mjs). Cause: the esbuild in the worktree's
+  node_modules resolved to the root copy (0.28.1) and not to packages/webui's own pin. Fix (R3, no repo change):
+  `cd packages/webui && npm ci --ignore-scripts --no-audit --no-fund` in the worktree, output in out-npm/npm-ci.txt;
+  esbuild is then 0.28.2. Rerun of all 65 webui files whole with MOSAIC_REQUIRE_EDITOR_BUILD=1: 65 of 65 rc=0, 410
+  pass, 0 fail.
+
+Fixes (both are test-only; src/ is unchanged from 2bb146b28; Mos ruled both in mos-1528):
+
+- R1, `packages/business/tests/library-seats.test.mjs`, test "M7/M8: a business file that can't be read throws; no
+  empty set". The fixture registers `rmSync(root)` as a `t.after` hook before the test registers its
+  `chmodSync(file, 0o600)` restore, so on the way out the restore found the file already removed and threw ENOENT.
+  Old: `t.after(() => chmodSync(file, 0o600));`. New: the same call inside try/catch that rethrows anything but
+  ENOENT. The assertion is unchanged.
+- R2 (option A, mos-1528), `packages/control-board/tests/serve.test.mjs:1073`, test "conversation routes (F16): a
+  foreign Host, a wrong port and a cross-origin Origin get 403 before the reader runs, with no CORS headers".
+  Failure: the same-origin request at the end reached the route, the spy's `catalogue` returned the number
+  `calls.push(...)` gives (1), and 220's `conversationResponse` reads `listing.ok`, so `refusalResponse(1)` threw on
+  `out.refusal.code` and the route answered 500. Old text:
+  `const spy = { catalogue: () => calls.push("catalogue"), open: () => calls.push("open"), next: () => calls.push("next") };`
+  New text: `catalogue` records the call, then returns `{ ok: true, conversations: [], refusedRoots: [] }`; `open` and
+  `next` are unchanged (the test never reaches them with a passing request). The assertions are unchanged: 200 for the
+  same-origin request and `calls` equal to `["catalogue"]`. serve.mjs stays as 220 has it.
+  Added test, same file before "every refusal code the reader can raise has an HTTP status": a reader whose
+  `catalogue()` returns `{ ok: false, refusal }` gets `conversation-business-unreadable`'s status (503) and the body
+  `{ error, refusal: { code, reconcile } }`. No such route test existed; the earlier claim that no route's status or
+  body changed was wrong for a reader that returns a bare value, which the old spy did.
+
+Mutants thrown on 2bb146b28 (out-mut; the base run for library-seats was red from R1, so a kill by that file is not
+shown there):
+
+| Mutant | Result |
+| --- | --- |
+| M7-w | killed by control-board creative-hidden ("the board's default reader hides a creative seat's session…") |
+| M7-c | killed: creative-hidden 4 fail, conversation reader 3 fail |
+| M7-o | killed: creative-hidden 4 fail |
+| M8-p | killed: discord library-seat 6 fail |
+| M8-e | SURVIVED: no test failed other than the base red in library-seats; handled in the next entry |
+
+Run limit: stack-release.test.mjs took 644 s. The per-file limit is 3 x 644 = 1932 s. Sage's gates run cli whole
+under 2100 s.
+
+Reruns owed after r5 (run on Sage's CLEAR): the touched files whole (library-seats, serve, and the M8-e test),
+control-board whole, business whole, and every 220 mutant, M8-e included. Results are appended as a new entry.
+
+## Round 5b: correction of the M8-e kill claim, and the test that kills it (2026-10-23T20:21:52Z, sage-3715)
+
+Appended; nothing above is edited. This is a correction to the "Mutants to throw" table in this file (the M8-e
+row, around line 270), which says M8-e, "`loadSeatSets` returns empty sets on any lstat error", is killed by the
+`library-seats` ENOENT-vs-file tests. That claim is wrong. M8-e changes the lstat catch to
+`return { librarySeats: new Set(), creativeSeats: new Set() };` for every error code, so only a test that makes lstat
+fail with a code other than ENOENT can kill it. The file-as-businesses test and the dangling-symlink test I named
+make lstat succeed or fail with ENOENT, never another code, so they pass under M8-e. Phase B on 2bb146b28 showed
+the mutant surviving (out-mut, M8-e: no failure besides the base red).
+
+Added in this commit, `packages/business/tests/library-seats.test.mjs`: "M7/M8: a config directory under a regular
+file throws (lstat fails with ENOTDIR); no empty set". The config path is a regular file, so
+`lstat(<file>/businesses)` fails with ENOTDIR; the test expects `BusinessError` matching "cannot list businesses".
+It is a new test in this row's own file, in its own commit, and droppable without touching R1 or R2.
+
+The rerun of M8-e on r5 (the test must fail under it) is owed and runs on CLEAR; the result is appended as a new
+entry.

agents/sage/work/prd-1-17/DRAFT-d9.md

@@ -0,0 +1,652 @@
+# PRD 1.17 draft: Case 2 story files are DOCX (Q235 to Q237, P1 to P6)
+
+Sage, 2026-10-23, for mos-1366 item 1 and Vikunja 570. Draft 9. It is d8 plus Jason's Q41 answer O2 (DECISIONS Q239, mos-1467), which makes J-b yes, Webby's round 5 N15 to N17 (webby-0210) and Webby's round 6 B1, N19 and N20 (webby-0212) (see "d9 changes"). d8 is d7 plus Mos's d8 fix list mos-1443 (see "d8 changes"). d7 is d6 plus Mos's ruling mos-1379 on Fenton's 571 B2 (see "d7 changes"). d6 is d5 with Webby's round 3 (webby-0207) fixed: B1 to B3 and N10 to N13, with N14 left for Mos (see "d6 changes"). d5 folds in:
+- Mos's d4 check ruling mos-1372 (D1 to D14; D15 was dropped).
+- mos-1374, which replaces J-c.
+- The impact map mos-1368 (jason-master-restart d183246, `projects/mosaic-mvp/case2-docx-impact-map.md`: A1 to A16, critic items C1 to C6, items 2 to 7).
+- Mos's F4 measurement.
+
+Review order (mos-1367 B5): Webby, then Mos, then Jason. Base: PRD 1.16, `docs/prd/mosaic-stack.md` blob a6db9b4a at 482e865ac.
+1.16 lands first (row 291), and this text is a new version on top of it. Nothing here is built or queued. The impact map's queue changes (A24, A57 to A59) go through `scripts/mosaic queue` after 1.17 is approved (C9).
+
+Sources, verbatim in Mos's DECISIONS:
+- Q235, Jason's Q36 answer.
+- Q236: chapters are DOCX, Markdown for agent files and docs.
+- Q237: "It is correct for now (subject to future change)".
+- The P1 to P6 reading as restated to Jason in Q38.
+
+## Settled points (mos-1367)
+
+These stand as ruled. d5 changes only what mos-1372 changed.
+
+- **O1. Where a converted chapter lives.** The DOCX lives in the writing store of
+  O2 design D12, and the archived Markdown stays in the user's repository under a
+  human-marked archive folder. Ruled yes in B1, on the condition that the text
+  says plainly that a converted chapter leaves the Gitea-mirrored repository and
+  lives in the stack's writing store. mos-1372 D7 and mos-1375 add a remote for
+  the store, off the stack's host.
+- **O2. The unit of conversion.** One story file per import, refusing a file
+  that is already converted. Ruled yes in B2: each file gets its own fidelity
+  report, human confirmation, manifest and commit.
+- **O3. Whether conversion is a vocabulary action.** A human-only verb outside
+  the agent vocabulary, with no role grant and no agent request path. Ruled yes
+  in B3.
+- **O4. Reading archived Markdown.** A new `archived` scope. Lookups leave it out
+  unless the caller asks, every answer marks it archived, and a canon citation
+  can't name it. Ruled yes in B4.
+
+## d3 choices after mos-1372
+
+- **C1 is replaced by D1, keep-source-scope.** A DOCX keeps its source's scope:
+  universe, book, and canon or playground. A playground DOCX follows the
+  playground rules and is never returned as canon. The import accepts canon and
+  playground story files. Type-folder files and supporting files stay Markdown
+  (P4). This also settles the impact map's Q18, item 4. It leaves one narrowing
+  for Jason, J-i. A playground DOCX can't become canon in 1.17.
+- **C2 stands.** The move keeps the file's path under the archive folder:
+  `book1/ch3.md` goes to `<archive>/book1/ch3.md`. An archived file's universe
+  and book are those of its old path.
+- **C3 is replaced by D3 and D14.** The archive commit is written by a new
+  human-only bus step (Vikunja 571) on the C2-02 write plumbing and pushed through
+  C2-03b. The order is the store commit and the remote's confirmation that it
+  holds that commit, then the archive commit and its push, then publication to the
+  lookups.
+- **N4 stands.** REQ-LIB-8 says "a real user's books". The PRD names no user
+  anywhere in Case 2.
+
+## Text changes
+
+### Status and sources
+
+In the Status bullet's first line, "- Status: approved, version 1.16." becomes
+"- Status: approved, version 1.17." Status gains, after the two 1.16 sentences at
+the end of the bullet: "Version 1.17 records Jason's rulings Q235 to Q237 of
+2026-10-23: Case 2 story files are DOCX, Markdown stays for agent files and
+documentation, and a human-started import converts a Markdown story file one way.
+It also adds REQ-LIB-9, the Console's DOCX editor, from Jason's rulings Q195, Q226
+and Q234. It changes what Case 2 requirements allow, so Mos puts the text to Jason
+as written, and it lands only after his yes (mos-1366, Vikunja 570)."
+
+New source line, above the 1.16 one: "Version 1.17 source: Jason's Q235, answering
+Q36: 'How about we see a markdown file, we convert the markdown file to docx, then
+archive or mark the markdown file as converted. The new standard for files in the
+creating writing use case is to use docx to handle versioning and WYSIWYG. We
+eliminate the potential for confusion based on the files. Agents must understand
+which files are what format and where they live. The system must allow for import
+and conversion. We will not run the systems in parallel. There will be an
+irreversible conversion of the files.' His Q236 says: 'For creative writing
+chapters, we need to utilize docx as the standard. Markdown is acceptable for
+agent files, instructions, PRDs, documentation, etc. The creative writing files
+should be docx for familiarity for the user.' His Q237 says 'Q38: It is correct
+for now (subject to future change)', which confirms Mos's reading P1 to P6.
+REQ-LIB-9 rests on his Q195 request for 'a full WYSIWYG editor within Mosaic
+Stack', his Q226 answer 'F41: We want to move editing into the WYSIWYG in the
+WebUI. All changes are instantly committed and available to the agents.' and his
+Q234 answer 'Q37: yes' to the exact security header for the editor's frame. The
+storage follows the O2 design D10 to D12 as rewritten under Vikunja 571, at
+b99ca86b9 on `refactor`."
+
+### Creative library, section lead
+
+Replace "The library is the user's own writing repository." with "The library is
+the user's own writing repository plus the stack's writing store, which holds the
+DOCX story files (REQ-LIB-8, version 1.17)."
+
+### REQ-LIB-1
+
+Add, before "(Design 1.1": "The mapping also names one archive folder, set by the
+human, where converted Markdown story files go. A book's DOCX story files are in
+the stack's writing store, under the same universe and book (REQ-LIB-8)." Version
+tag, inside the closing parenthesis: "Version 1.15: supporting folders.)" becomes
+"Version 1.15: supporting folders. Version 1.17: the archive folder and the
+writing store.)"
+
+### REQ-LIB-2
+
+Replace "A file's scope comes from its path alone, prefixes first: a Markdown
+file under a supporting prefix is supporting, one under a playground prefix at
+any level is playground, any other Markdown file in a book folder is canon, and
+everything else is unmapped and never returned. A folder in both lists is
+supporting." with:
+
+"A Markdown file's scope comes from its path and from past imports, prefixes
+first: a Markdown file under the archive folder is archived, one under a
+supporting prefix is supporting, a Markdown file at a converted file's old path is
+unmapped under REQ-LIB-8 but flagged in the format map, one under a playground
+prefix at any level is playground, any other Markdown file in a book folder is
+canon, and everything else is unmapped and never returned. A folder in both lists
+is supporting. The archive folder follows the same placement rules and may not
+overlap another prefix or a book folder. An archived file keeps the path it had
+under the archive folder, and its universe and book are those of that old path. A
+DOCX document in the writing store keeps its source's scope: the universe, the
+book if there is one, and canon or playground. Its source is the Markdown file it
+was converted from or, for one the human starts in the editor, the universe and
+book or the playground the human picks (REQ-LIB-8). A playground DOCX follows the
+playground rules and is never returned as canon. It stays playground after its
+draft universe is made real. In version 1.17 no promotion or mapping change makes
+a playground DOCX canon. A later version of this PRD says how one becomes canon."
+
+Replace "Lookups return canon unless the caller asks for playground or
+supporting." with "Lookups return canon unless the caller asks for playground,
+supporting or archived. Every answer marks an archived file as archived and names
+the DOCX that replaced it."
+
+Replace "so an agent can't cite a playground or supporting file as canon" with "so
+an agent can't cite a playground, supporting or archived file as canon".
+
+In REQ-LIB-2 only, replace "The Console shows each cite's scope." with "The Console shows each cite's
+scope and format, and whether a cited Markdown file was converted."
+
+Version tag, inside the closing parenthesis: "Version 1.15: supporting.)" becomes
+"Version 1.15: supporting. Version 1.17: archived scope and DOCX scope.)"
+
+### REQ-LIB-4
+
+Replace "The user commits and pushes with their own tools, today Obsidian with
+obsidian-git." with "The user commits and pushes Markdown with their own tools,
+today Obsidian with obsidian-git. A converted story file's current text is no
+longer in that repository, which keeps only its archived Markdown (REQ-LIB-8)."
+
+Add, after "Bus writes and pushes come in later rows (C2-02, C2-03b).": "A DOCX
+story file is saved in the Console's editor, and each accepted save is one commit
+by the human in the stack's writing store (REQ-LIB-9). Each writing-store commit
+is also pushed to a remote off the stack's host, never by force-push. The remote
+is a setting only a human changes, and it starts unset. A repository on the
+stack's host never counts as that remote. A missing remote or a failed push never
+undoes a save, and the user sees each push that is pending or failed. Only the
+stack's host pushes to that remote, and no agent can reach it with any credential.
+Agents read the local commit."
+
+Replace "Agents read only the mirror's served commit and never hold a copy of
+their own, so they see the user's push within about a minute." with "Agents read
+the user's repository only at the mirror's served commit, except a story file
+during its import under REQ-LIB-8. They read a DOCX story file only at a committed
+version in the writing store, under REQ-LIB-5. They never hold a copy of their
+own, so they see the user's Markdown push within about a minute and a DOCX save at
+their next lookup after the editor reports it as committed."
+
+Version tag: "and the sync items.)" becomes "and the sync items. Version 1.17,
+with Q222 for the remote setting.)"
+
+### REQ-LIB-5
+
+Add, after "Each answer names the commit it read.": "Each answer also names the
+file's format and where it lives: its path, or its document id in the writing
+store. A DOCX story file is read from its latest committed save, never from
+unsaved text. A lookup that starts after the editor reports a save as committed
+returns that save or a later one, even while its push to the remote is pending or
+has failed, and the answer names the version. Get, search and manuscript read a
+DOCX story file as its extracted text with DOCX locators, never as lines. That
+text is the file with its tracked changes accepted. An agent reads a story file's
+comments, or its text with tracked deletions shown, only after a human turns on
+the matching setting. Both settings are off by default, and only a human changes
+them. The reader in this version can't read some things a DOCX story file can
+hold, such as a web link, a text box, a field or hidden text. The editor warns the
+human when an edit adds one, and the human can still save it. Until a later save
+takes it out, lookups give agents none of the text of the part that holds it,
+whether that is the chapter's body, a note or a comment. The manuscript lookup
+follows the book's chapter order across both formats (O2 design D10), and the next
+chapter it names is never an archived file. Links out and in resolve across both
+formats. The universe lookup returns the format map (REQ-LIB-8)."
+
+Replace "The user sees them in Obsidian's graph and backlinks." with "The user sees
+a Markdown file's links in Obsidian's graph and backlinks. A DOCX story file's
+wikilinks stay clickable in the Console's editor (O2 design D11), and no graph
+shows them yet. The Console's Connections view lists the current links and
+backlinks of each story file the user may see, in both formats, with each one's
+scope and format."
+
+Version tag: 'and "Connections are always visible".)' becomes 'and "Connections
+are always visible". Version 1.17, with Q222 for the two settings and Q239 for
+the Connections view.)'
+
+### REQ-LIB-6
+
+Replace "A reply may cite lines of the repository at a commit or pages the agent
+fetched, and the broker checks every citation before it stores the message." with
+"A reply may cite lines of a Markdown file at a commit, a place in a committed
+DOCX story file, or pages the agent fetched, and the broker checks every citation
+before it stores the message. A DOCX citation never calls a paragraph a line. It
+names the document id, the committed version and a DOCX locator. A citation that
+names an archived file as current is refused. The `requireCitation` setting below
+applies to Markdown and DOCX citations alike, and so does the rule for a citation
+marked as canon."
+
+Add, after "the broker refuses such a write before any git call.": "The writing
+store and the archive folder are read-only to a creative agent as well, and the
+broker's path check treats the archive folder as story. No agent creates, edits,
+deletes, converts, archives or restores a story file in any format, and no agent
+writes a DOCX. No creative agent starts or undoes a conversion, and none asks for
+one through a tool or a decision it raises, as REQ-LIB-8 says. An agent may still
+suggest a conversion to the human in chat. Each creative role's contract states
+which files are DOCX and which are Markdown, and cites a DOCX story file by its
+locator, never by line."
+
+Version tag, inside the closing parenthesis: "Version 1.15.)" becomes "Version
+1.15. Version 1.17.)"
+
+### New REQ-LIB-8
+
+This bullet goes after REQ-LIB-7 and before the "### Installer" heading.
+
+"- **REQ-LIB-8.** Story files become DOCX. DOCX is the standard for chapters and
+  the other story text in a Case 2 writing project, canon and playground alike. A
+  story file becomes DOCX through a human's import (below), or when the human
+  starts it in the editor. From then on DOCX is its only working format, edited in
+  the Console's editor (REQ-LIB-9). A Markdown story file stays Markdown until its
+  import. Files in a type folder (REQ-LIB-1), such as character and place notes,
+  stay Markdown. So do supporting files, agent files, instructions, PRDs and
+  documentation, including the character sheets, summaries and cross-links agents
+  keep under REQ-LIB-6.
+  - A converted story file's current text leaves the user's Gitea-mirrored
+    repository. Its DOCX lives in the stack's writing store, on the stack's host,
+    and not in the repository the user pushes or opens in Obsidian. Only its
+    archived Markdown stays there.
+  - An import converts one Markdown story file, canon or playground, outside every
+    type folder (REQ-LIB-1), to a DOCX document in the writing store. It refuses
+    an unmapped, supporting, archived or type-folder file, and a file that is
+    already converted. Each import has its own fidelity report, the human's
+    confirmation of that report, a manifest naming the source file and its commit,
+    and one commit in the store. The DOCX keeps every wiki link of the source as
+    written, and a lost link to another library file fails the fidelity report. A
+    web link becomes plain text that keeps its label and address, and the fidelity
+    report lists it for the human to confirm. A web link that can't be kept safely
+    as plain text refuses the import.
+  - The human can also start a new story file in the editor, in a universe and
+    book or a playground the human picks. It is a DOCX document in the writing
+    store from its first commit, with no Markdown copy, and it opens under the
+    same gate as the import.
+  - The same import marks the Markdown file converted, naming the document, and
+    moves it to the archive folder under its old path (REQ-LIB-1, REQ-LIB-2).
+    The mark and the move are one commit authored by the human in the user's
+    repository. A new human-only bus step (Vikunja 571) on the C2-02 write
+    plumbing writes it, and C2-03b pushes it. The move keeps the bytes and the
+    git history, so it isn't `data.delete`.
+  - The store commit comes first, and the writing store's remote must confirm it
+    holds that commit. Then come the archive commit and its push, then publication
+    to the lookups. Until publication the Markdown at its old path keeps its canon
+    or playground scope. Agents read that file at the commit the import started
+    from, even after the mirror's served commit reaches the archive commit or a
+    later one. No lookup returns the file's archived copy before publication, even
+    one that asks for archived files. A refusal or failure before the archive push
+    leaves the Markdown unmoved and no DOCX that a lookup returns. A failure after
+    the archive push leaves a pending import that the human sees and can resume,
+    never a claim that nothing moved. An archive push whose result is unknown
+    counts as a failure after the archive push until the stack reads the result
+    back from the user's remote.
+  - Each stage of an import writes a logged event. The import's record on the
+    stack's host names the source file's path, commit and blob and the new
+    document id, and each event points to that record.
+  - After a conversion, a Markdown file at the converted file's old path is
+    neither canon nor playground. Lookups leave it out, the format map flags it,
+    and the human is told.
+  - A new Markdown story file in a book folder that holds converted files stays
+    canon until its import, unless it sits at a converted file's old path or under
+    a playground prefix. The Console flags it and offers the import. Nothing
+    converts it on its own.
+  - A hybrid's exclusion that covers a converted file's old path also covers its
+    DOCX document (REQ-LIB-3). An exclusion of a whole book folder also covers
+    every DOCX document in that book, including one started in the editor. An
+    exclusion can also name a DOCX document by its id.
+  - Only a human starts an import or a new story file, from the CLI or a Console
+    session signed in as that human. Both are human verbs outside the agent action
+    vocabulary. Neither is added to `ACTIONS` in the business vocabulary or to the
+    broker's always-gated list, including the import's action, `library.convert`.
+    No role holds them, no agent can request them, and the hard-wait list in
+    REQ-WAIT-1 doesn't change. In an organization with several humans, who may
+    start them is a setting only a human changes, and the default is the owner
+    only.
+  - Conversion is one way, with no parallel run. Neither the Console nor any agent
+    edits a converted story file as Markdown, and no DOCX edit syncs back to
+    Markdown. The Console's Markdown save refuses every file under the archive
+    folder. The user's own tools can still change the archived Markdown, and no
+    such change reaches the DOCX. The old Markdown stays in git history, and
+    nothing rewrites history. A promotion into a book folder (C2-19) runs the
+    import for a Markdown story file or is refused. A promotion of a playground
+    DOCX is refused in version 1.17.
+  - Agents get a format map: for each mapped folder and story file, its format,
+    scope and where it lives, archived files, flagged files and pending imports
+    included.
+  - The import and new story files ship closed. They open only after four things.
+    The editor ships. The human has set the writing store's remote, and the stack
+    has checked that it can push there. Agents can read committed DOCX story files
+    through the lookups and cite them (REQ-LIB-5, REQ-LIB-6). Any earlier agent
+    system that writes the user's files has stopped, which for Case 2 is the
+    Hermes retirement (#423 step 5). So the import itself never cuts agents off
+    from a chapter, the chapter's current text never lives only on the stack's
+    host, and no second system writes the story. The first import of a real user's
+    books waits for Jason's go.
+  (Q235, Q236, Q237: P1 to P6. Q222 for the setting. O2 design D10 to D12.
+  Version 1.17.)"
+
+### New REQ-LIB-9
+
+This bullet goes after REQ-LIB-8.
+
+"- **REQ-LIB-9.** The Console's DOCX editor. The human edits a DOCX story file in
+  the Console's editor, in a split pane with the agent chat alongside it. The
+  human can pin an agent chat to a document. The human can select a word,
+  right-click it, and choose a synonym from a thesaurus. Only a human saves. Saves
+  happen on their own while the human types (Q226), at intervals only a human
+  changes, and each accepted save is one commit with the human as author, pushed
+  as REQ-LIB-4 says. A save made against an older version than the current one is
+  refused. Agents never write a DOCX. Versioning is the editor's tracked changes
+  plus one git commit per save. The editor's code is vendored and pinned, with a
+  hash per file and the licenses that its independent security review accepted. At
+  runtime the editor loads only files that the stack itself serves, and it
+  requests nothing from any other host. The editor's frame sends exactly the
+  content security policy Jason approved in Q234, and the WebUI shell's own header
+  is unchanged. REQ-PROJ-3's project docs editor is unchanged. (Q195, Q226, Q234,
+  Q236. O2 design D3, D4, D6, D8, D10, D13, D14, D16 and D22. Version 1.17.)"
+
+### Version 1.17 notes
+
+Added after the 1.16 notes:
+
+"- Version 1.17:
+  - Jason confirmed the reading 'for now (subject to future change)' (Q237). The
+    rulings stand until he revises them.
+  - The 10-27 Case 2 release ships on Markdown as built (P6). The 1.11 line 'The
+    Case 2 MVP for 10-27 is the Markdown library (#416). The WYSIWYG editor (Q195,
+    Q196) is an add-on that doesn't gate it.' still holds. Conversion opens after
+    10-27, and only once REQ-LIB-8's four conditions are met. The editor ships,
+    the writing store's remote is set and the stack has checked that it can push
+    there, agents can read and cite committed DOCX story files through the
+    lookups, and Hermes is retired, which is #423 step 5.
+  - The 1.12 note says five bus write and Console editor rows, C2-02, C2-03b,
+    C2-11a, C2-11b and C2-19, don't gate 10-27. Jason's Q226 F42 later moved
+    C2-02, C2-03b and C2-11b into the 10-27 slice. The Case 2 design brings C2-11a
+    in with them, because C2-11b needs it. C2-19 stays outside the slice. Mos's
+    reading of F42 is that C2-02 and C2-03b now gate 10-27, because design 9.2
+    puts them in 'the smallest slice that lets her start'. C2-11a and C2-11b are
+    slice rows that still don't gate 10-27, because the editor is the Q195 add-on.
+    The DOCX change in 1.17 leaves this slice as it is, and C2-11b's Markdown
+    editor never edits a converted story file.
+  - Q236 narrows Q176's editor choice to DOCX for story files (REQ-LIB-9). The
+    1.12 note that the Case 2 design keeps Obsidian now holds only for Markdown
+    files, including story files not yet imported. A DOCX story file is edited
+    only in the Console's editor under REQ-LIB-9.
+  - This replaces two parts of the O2 design at 25c09f19f. The superseded-notice
+    proposal from Fenton's F1 in D12 is withdrawn, and the
+    keep-Markdown-at-its-path model of D11 is replaced. Gyro's rewrite of the O2
+    design for Vikunja 571, landed on `refactor` at b99ca86b9, carries the
+    details, and where it differs from this text, this text holds:
+    - the import and archive steps, the mark, and the new bus step;
+    - links from supporting files to a moved chapter;
+    - the DOCX reader;
+    - the user's unpushed or later changes to an archived file or at its old path,
+      and pushing and closing the file in Obsidian before each import;
+    - the writing store's remote in W4 section 7.3, which replaces the no-remote
+      and no-backup rule that W4 section 7.4 held before the rewrite, at
+      062646487;
+    - import events counted by a bus restore, and recovery when a bus restore or a
+      restore of the whole host predates an import;
+    - manifest order for the manuscript lookup and its next chapter;
+    - `library.convert` kept out of `ACTIONS`, out of the hard-wait note and out
+      of the pinned `GATED_ONLY` list in packages/business/src/vocabulary.mjs.
+  - Agents read a converted story file through the Case 2 lookups under the same
+    project and universe access as Markdown canon, in any thread or room. W4's
+    earlier O2-only conversations, per-document grants and per-send sharing don't
+    gate these lookups. The 571 rewrite replaced them in W4 sections 7.1 and 7.2.
+    The creative tool list in REQ-LIB-6 doesn't change.
+  - The six creative role contracts row 213 landed say 'Every item cites the
+    lines of the user's material it is about'. A build row under 571 changes that
+    line for DOCX story files (REQ-LIB-6).
+  - A new Markdown file in a book folder is still canon in 1.17. The 1.17
+    exception is a file at a converted file's old path, which REQ-LIB-2 makes
+    unmapped.
+  - Story files convert whether canon or playground. Type-folder and supporting
+    files stay Markdown.
+  - Measured 2026-10-23 at about 01:21Z: the Case 2 user's library repository
+    tracks 213 files, 203 of them Markdown, and none is a .docx or .doc. It has no
+    untracked files. The user's .doc files (Q196) are outside it. So the landed
+    code has no DOCX there to report as unreadable at 10-27.
+  - Text replaced in 1.17, kept here as in earlier notes:
+    - Creative library lead, the 1.16 sentence: "The library is the user's own
+      writing repository."
+    - REQ-LIB-2, the 1.16 sentences: "A file's scope comes from its path alone,
+      prefixes first: a Markdown file under a supporting prefix is supporting,
+      one under a playground prefix at any level is playground, any other
+      Markdown file in a book folder is canon, and everything else is unmapped
+      and never returned. A folder in both lists is supporting." "Lookups return
+      canon unless the caller asks for playground or supporting." "so an agent
+      can't cite a playground or supporting file as canon" "The Console shows
+      each cite's scope."
+    - REQ-LIB-4, the 1.16 sentences: "The user commits and pushes with their own
+      tools, today Obsidian with obsidian-git." "Agents read only the mirror's
+      served commit and never hold a copy of their own, so they see the user's
+      push within about a minute."
+    - REQ-LIB-5, the 1.16 sentence: "The user sees them in Obsidian's graph and
+      backlinks." A converted chapter's connections show in Obsidian only as they
+      stood at conversion, and the Console's Connections view shows their
+      current links.
+    - REQ-LIB-6, the 1.16 sentence: "A reply may cite lines of the repository at
+      a commit or pages the agent fetched, and the broker checks every citation
+      before it stores the message."
+    - REQ-LIB-1 only gains sentences.
+  - REQ-LIB-3's text and REQ-LIB-7 are unchanged. REQ-LIB-8 adds one form of
+    exclusion REQ-LIB-3 doesn't have: naming a DOCX document by its id. A path
+    exclusion also covers DOCX documents, through a converted file's old path or a
+    whole book folder. An archived file and a DOCX document keep a universe, and a
+    book where their source has one, so every lookup still names one universe.
+    REQ-PROJ-3, the Console editor for a project's spec and docs, is unchanged.
+    C2-11b opens the library's Markdown files in that same editor.
+  - In `packages/tasks/requirements.json` the titles of REQ-LIB-1, REQ-LIB-2 and
+    REQ-LIB-4 change, and those of REQ-LIB-5 and REQ-LIB-6 stay. REQ-LIB-1 becomes
+    'A human-set library maps the user's repository onto universes, books, types,
+    playgrounds, supporting and archive folders'. REQ-LIB-2 becomes 'Scope comes
+    from the path or a DOCX's source, lookups default to canon, and only canon
+    files are ever cited as canon'. REQ-LIB-4 becomes 'Git holds every change. The
+    bus fast-forwards a read-only mirror every 60 seconds, the one place agents
+    read Markdown'. REQ-LIB-8 and REQ-LIB-9 add two ids, so the count goes from 85
+    to 87. REQ-LIB-8 is titled 'Case 2 story files become DOCX by a human-only
+    one-way import or in the editor; Markdown stays for notes and docs', and
+    REQ-LIB-9 'The Console's DOCX editor: only a human saves, each save is one
+    commit, and the editor code is vendored and pinned'.
+  - Open points O1 to O4 of draft 1 were ruled by Mos in mos-1367 B1 to B4.
+  - Sage files the build rows under Vikunja 570 and 571 after the rewrite is
+    approved. This amendment adds the requirements only."
+
+### Risks
+
+The new lines go at the end of "## Risks and open questions", after the bullet
+that begins "Trusted mode lets an agent" and before the "## Milestones" heading.
+- "A DOCX file is a zip archive, so git can't show a line diff of a chapter.
+  Review of a story change goes through the editor and the committed reader,
+  not `git diff`. (Version 1.17.)"
+- "A converted chapter's DOCX is not in Obsidian's graph. Obsidian shows the
+  chapter only through its archived Markdown, and no DOCX edit reaches that file's
+  links. The DOCX's current links show in the Console's editor and its
+  Connections view, and no graph shows them yet. (Version 1.17.)"
+- "Conversion can't be undone in place. Front matter, wiki link forms and
+  unsupported blocks may not survive it, and the mirror can't refuse the user's
+  push to an archived file. The controls are the fidelity report, the human's
+  confirmation, an untouched original on refusal, and the kept archive.
+  (Version 1.17.)"
+- "A restore of the stack's bus alone from a backup taken before an import drops
+  the import's logged events, while the archive commit and the DOCX stay. A
+  restore of the stack's whole host from such a backup also takes the writing
+  store and the host's import records back to before the import. The archive
+  commit stays in the user's Gitea repository and the DOCX stays on the writing
+  store's remote, but the host keeps no record of the import. A bus restore counts
+  import events, and the import's recovery covers both cases (Vikunja 571).
+  (Version 1.17.)"
+
+## d9 changes (Q239 and Webby round 5)
+
+- J-b yes (Q239, mos-1467), in the five edits mos-1443 R3 set for a yes (Webby round 6 B1). R3.1: REQ-LIB-5's replacement gains the Connections view sentence after "no graph shows them yet.". R3.2: the graph Risks line ends with the editor and the Connections view. R3.3: the A6 line moves from "Not taken" under A6. R3.5: the REQ-LIB-5 note ends with the Connections view, which drops "until a Console view of their links exists" and "Q226 records that view as a later option". R3.4 is Gyro's design edit at 767bb62c7 (writing-editor.md:188-190, :240-244 and :1272, docx-citations.md:66), and it follows in his docs round. Beyond these and N21, nothing else in the PRD text changes.
+- N19 and N20 (Webby round 6): J-b's question text is in the past tense, and the line that the import doesn't wait for the view is cited as Mos's R3 default. Mos confirmed it at his J-b check (mos-1470).
+- N21 (Webby round 6, Mos yes in mos-1470): REQ-LIB-5's version tag cites Q239 for the Connections view beside Q222 for the two settings.
+- N15: the D7 landing line gives R8's wording beside the impact map's quote.
+- N16: the d7 changes line notes that R8 replaces "no agent credential reaches it" in d8.
+- N17: the REQ-LIB-2 Replace quote and the REQ-LIB-8 old-path bullet are rewrapped under 82 columns. Their words are unchanged.
+
+## d8 changes (Mos's d8 fix list, check wf_63bba879-180)
+
+- R1: REQ-LIB-4's tail covers DOCX saves, which agents see at their next lookup after the editor reports them as committed. The notes quote the whole 1.16 sentence. Source: nit/jason/F10.
+- R2: REQ-LIB-4's new title says the mirror is "the one place agents read Markdown". Source: decisions.n14.
+- R3: J-b asks whether 1.17 requires the Console Connections view, with Mos's recommendation of yes. Sources: mos1372/F9, jason/F2, anchors/F5.
+- R4: C2-02 and C2-03b gate 10-27, C2-11a and C2-11b are slice rows that don't, and "F42 wins" is gone. New J-k. Sources: anchors/F6, jason/F5.
+- R5: where the landed 571 design differs, this text holds. Sources: anchors/F8, adversarial/F8 item 1, jason/F8, critic/C6, G16's design follow-on.
+- R6: `library.convert` stays out of `ACTIONS`, and REQ-WAIT-1's hard-wait list doesn't change. Sources: gyro571/F1, adversarial/F8 item 3, critic/C6.
+- R7: a repository on the stack's host never counts as the writing store's remote, and Item 2 says so. Sources: mos1372/F2, adversarial/F1, gyro571/F2.
+- R8: "no agent credential reaches it" becomes "no agent can reach it with any credential". Source: Fenton's B1 under mos-1379.
+- R9: no playground DOCX becomes canon in 1.17, and a promotion of one is refused. New J-i. Sources: mos1372/F8, adversarial/F2.
+- R10: REQ-LIB-9 restates Q195's pin and right-click thesaurus, and its cite gains D4 and D22. Source: critic/C4.
+- R11: REQ-LIB-9's license bar is the licenses its independent security review accepted. New J-l. Source: critic/C3.
+- R12: no text for D16's narrow-window tabs. Mos records that reading in STATE. Sources: jason/F1, second verifier vote.
+- R13: no lookup returns a file's archived copy before publication. Source: adversarial/F5 part 3.
+- R14: a restore of the whole host from a backup taken before an import is a fourth recovery case. Source: adversarial/F6.
+- M1: REQ-LIB-4's writing-store sentences follow the later bus rows sentence and add the off-host remote rules and DOCX read timing. The note quotes both 1.16 sentences. Sources: mos1372/F2, adversarial/F1, gyro571/F2, anchors/F4, nit/jason/F10, adversarial/F5 part 1, Fenton B1.
+- M2: REQ-LIB-8's order bullet adds the remote's confirmation, the old-path read rule and "archive push". Sources: mos1372/F2 and the other remote findings, mos1372/F7, adversarial/F5 parts 2 to 4.
+- M3: REQ-LIB-8's gate bullet has four conditions, adding the remote. Sources: the remote findings, critic/C1 and C2 edit 2.
+- M4: the 1.17 note on when conversion opens restates the four conditions and drops W4b. Sources: jason/F5, the remote findings.
+- M5: Item 2 rewritten with the remote rules. Sources: the remote findings.
+- M6: the 1.12 gating note rewritten. Sources: anchors/F6, jason/F5.
+- M7: REQ-LIB-9 gains the split pane, the pin, the thesaurus, the license bar and the runtime load rule, and cites more of the design. Sources: jason/F1, critic/C4, critic/C3, nit/anchors/F12, nit/gyro571/F9.
+- M8: REQ-LIB-2, the one-way bullet and the C1 note keep a playground DOCX out of canon in 1.17. Sources: mos1372/F8, adversarial/F2.
+- M9: REQ-LIB-5 says what the reader can't read, and the import turns web links into plain text. New J-j. Sources: critic/C1, critic/C2.
+- M10: an exclusion of a whole book folder covers that book's DOCX documents. Source: adversarial/F3, with B5.
+- M11: the human-verbs sentence and the 571 list item name `library.convert` and REQ-WAIT-1. Sources: gyro571/F1, adversarial/F8 item 3, critic/C6.
+- M12: J-b rewritten. Sources: mos1372/F9, jason/F2, anchors/F5, gyro571/F3, critic/C6.
+- M13: J-d puts the agent read model to Jason as his call. Source: mos1372/F1.
+- M14: Status moves to version 1.17 and names REQ-LIB-9. Sources: anchors/F2, mos1372/F4, critic/C7.
+- M15: the 1.17 source line quotes Q235 in full (mos-1446) and the REQ-LIB-9 sources, at b99ca86b9. Sources: critic/C5, anchors/F9, jason/F8 pin part, nit/gyro571/F8, critic/C6 pin part.
+- M16: the 571 list lead names the two replaced design parts and the landed design. Sources: anchors/F9, anchors/F8, adversarial/F8 item 1, jason/F8, critic/C6.
+- Landing swap: Gyro's docs round for R5, R6 and R14 landed as b99ca86b9 (Fenton fenton-0015), so M15 and M16 cite b99ca86b9 in place of 767bb62c7, as the d8 fix list's header says. J-b keeps 767bb62c7 for its line numbers.
+- M17: W4 section numbers in the remote item and the lookups note. Sources: gyro571/F5, nit/adversarial/F11.
+- M18: the D7 landing line. Sources: gyro571/F5, the remote findings.
+- M19: a logged event for each import stage, in REQ-LIB-8 and A2. Source: gyro571/F7.
+- M20: the Risks line on restores adds the whole-host case. Sources: adversarial/F6, gyro571/F7.
+- M21: the 571 restore item adds the whole-host case. Source: adversarial/F6.
+- M22: the graph Risks line and the REQ-LIB-5 note name a Console view. Sources: anchors/F5, jason/F2.
+- M23: the d6 B3 line drops "F42 wins". Source: anchors/F6.
+- M24: new Markdown in a converted book, with the old-path and playground exceptions. Source: mos1372/F6.
+- M25: J-c's last sentence is Mos's reading. Source: mos1372/F10.
+- M26: J-h rewritten with the D13 defaults. Source: jason/F3.
+- M27: Item 4 rewritten. Sources: jason/F4, gyro571/F4, decisions.unmarked_folders.
+- M28: the "Not taken" note on unmarked folders. Sources: jason/F4, gyro571/F4, decisions.unmarked_folders.
+- M29: the import refuses an unmapped file. Sources: gyro571/F4, decisions.unmarked_folders.
+- M30: placement notes for REQ-LIB-8, REQ-LIB-9 and the Risks lines. Sources: anchors/F3, nit/anchors/F14.
+- M31: REQ-LIB-4's title and the D11 landing line. Source: decisions.n14.
+- M32: the Q236 note limits the 1.12 Obsidian note to Markdown files. Source: critic/C8.
+- M33: the exclusion note adds path exclusions of DOCX documents. Source: anchors/F7.
+- M34: A9 moves from "Mine" to the impact-map list. Source: decisions.exclusion_by_id.
+- M35: the D5 landing line. Sources: anchors/F10, mos1372/F5, nit/adversarial/F12.
+- M36: the D9 and D14 landing lines. Source: mos1372/F1.
+- M37: the O1 and C3 notes add the off-host remote and its confirmation. Sources: the remote findings.
+- M38: the REQ-PROJ-3 note. Source: nit/anchors/F11.
+- M39: REQ-LIB-5's freshness sentence keys on the editor reporting a save as committed. Source: nit/adversarial/F9.
+- M40: REQ-LIB-6 bars agent requests for a conversion and allows a suggestion in chat. Source: nit/jason/F9.
+- M41: REQ-LIB-2's opening and old-path rule, and the "Mine" note. Source: nit/adversarial/F10.
+- M42: REQ-LIB-8's lead sentence on Markdown story files. Source: nit/mos1372/F12.
+- M43: REQ-LIB-6's citation sentence. Source: nit/anchors/F13.
+- M44: REQ-LIB-5's version tag uses plain quotes. Source: nit/anchors/F15.
+- M45: reference codes B5, D12, D10 and B4 name their source. Source: nit/mos1372/F11.
+- Files the row would own: four files, with the id count going to 87. Sources: anchors/F1, adversarial/F4, decisions.n14 F4.
+
+## d7 changes (mos-1379, Fenton's 571 B2)
+
+- REQ-LIB-5 gains Mos's three sentences after the extracted-text sentence. The text agents read has tracked changes accepted. Comments, and text with tracked deletions shown, each wait for a setting only a human turns on, off by default. Its version tag cites Q222 for the two settings, which is the only text here beyond Mos's.
+- J-d gains Mos's sentence on comments and tracked deletions.
+- Fenton's B1 is design only. d6's "no agent credential reaches it" holds (R8 replaces it in d8), and the shared helper stays #431.
+
+## d6 changes (Webby round 3, webby-0207)
+
+- B1: titles for REQ-LIB-8 and REQ-LIB-9 in the requirements.json note and the file list. REQ-LIB-9 takes Webby's title. REQ-LIB-8 keeps mine, because Webby's ("...one-way import that archives the Markdown under its old path") leaves out D2's story files started in the editor.
+- B2: REQ-LIB-2 makes a Markdown file at a converted file's old path unmapped, ahead of the playground and canon rules, so a playground conversion is covered too. REQ-LIB-8's old-path bullet says "neither canon nor playground".
+- B3: the slice note names Q226 F42's three rows (C2-02, C2-03b, C2-11b). C2-11a joined the slice with C2-11b, because C2-11b needs it. Both are slice rows that don't gate 10-27, as design 9.2, case2-rows.md:1655 and the impact map's A57 say. The 'F42 wins' sentence is gone from the note in d8, so no queue change follows from it.
+- N10: the cite-scope replacement is scoped to REQ-LIB-2. The 1.14 note's copy stays.
+- N11: the notes say REQ-LIB-8 adds the by-id exclusion form REQ-LIB-3 doesn't have.
+- N12: J-h marks the autosave intervals for Jason.
+- N13: J-b names REQ-LIB-5's "Connections are always visible" tag and Q226's "another way to handle the visual brain map".
+- N14, not taken: REQ-LIB-4's title stays internal F3's text, as mos-1372 D11 ruled. Webby's alternative, "...and agents read Markdown from it alone" (120 chars), is Mos's call.
+
+## Where each mos-1372 item landed
+
+- D1: REQ-LIB-2's DOCX sentences, the REQ-LIB-8 lead and import bullet, C1 above, and the notes. "Playground files stay Markdown in 1.17" is gone.
+- D2: REQ-LIB-2's "for one the human starts in the editor" and the REQ-LIB-8 new-story-file bullet. The universe-and-book note is now true.
+- D3: the REQ-LIB-8 order bullet. This also settles N8.
+- D4: REQ-LIB-8's one-way bullet, which carries the archive refusal and consequence F2's text, and the 571 list item.
+- D5: it landed in REQ-LIB-2's "a Markdown file at a converted file's old path is unmapped" in Webby's B2 form, and in the REQ-LIB-8 old-path bullet.
+- D6: REQ-LIB-5's freshness sentences.
+- D7 and mos-1375: REQ-LIB-4's remote sentences, the remote step in REQ-LIB-8's order bullet, the fourth opening condition and the 1.17 note on when conversion opens, plus the 571 list item on W4 section 7.3, which replaces the no-remote rule of the old W4 section 7.4. The impact map's item 2 adds "only the stack's host pushes, and no agent credential reaches it", which R8 words in d8 as "no agent can reach it with any credential".
+- D8: the REQ-LIB-5 replacement, the import bullet's wiki-link sentence, the Risks line, the note quoting the old sentence, and "REQ-LIB-1 only gains sentences".
+- D9: the 1.17 note that agents read a converted story file through the Case 2 lookups, from the d4 check's consistency B2, and J-d, which puts the read model to Jason as his call.
+- D10: the d4 check's B5 sentence, in REQ-LIB-8.
+- D11: internal F3's clause in the REQ-LIB-4 section, and in the notes the title as Mos amended it for N14.
+- D12: the whole 1.16 sentence replaced, and quoted in full in the notes.
+- D13: consequence F1's text, in REQ-LIB-4 and REQ-LIB-8's first bullet.
+- D14: the row text from the d4 check's consistency B1, in the mark-and-move bullet and C3 above.
+
+## What d5 adds beyond mos-1372 (for Webby and Mos to check)
+
+From the impact map, folded as mos-1368 item 1 asked:
+- A1: the Console shows a cite's format and converted state (REQ-LIB-2).
+- A2: the logged events and the several-humans setting, default owner only, under Q222.
+- A3: the import is outside the vocabulary, the hard-wait list is unchanged, and the archive move isn't `data.delete`. The C6 code site is in the 571 list.
+- A4: the section lead and REQ-LIB-1's writing-store sentence.
+- A6: format and location in every answer, extracted text with DOCX locators, links across formats.
+  - A6's named chapter-links view. D8 took B8's "no graph shows them yet", and J-b put the view to Jason. His O2 (Q239) takes it in d9 as REQ-LIB-5's Connections view (mos-1443 R3).
+- A7: read-only extends to the store and the archive, no agent action on a story file in any format, no agent DOCX write, and role contracts state the formats. C1's role contract line is a 571 build item.
+- A8: the DOCX cite shape, and a cite naming an archived file as current is refused.
+- A9: a hybrid sees a source's DOCX canon through REQ-LIB-2's source scope, and REQ-LIB-8 lets an exclusion name a DOCX document by its id. The id form lets the human exclude a single DOCX started in the editor, which has no old path. An archived file isn't canon, so no hybrid sees it.
+- A10: REQ-LIB-9, so the count is 87, not 86.
+- A11: the Hermes gate, from item 3.
+- A12: the C2-19 promotion sentence.
+- A13: the broker's path check treats the archive folder as story.
+- A14 and C5: two Risks lines.
+- A15: the flagged-new-file bullet. It sits beside the note from the d4 check's B4, "a new Markdown file in a book folder is still canon". The file stays canon and is offered for import.
+- A16: three titles change and two stay.
+- C2: manifest order for the manuscript lookup.
+- F3: the C2-02 gating note.
+- F4: Mos's measurement.
+
+Mine, beyond either source:
+- REQ-LIB-2 opens "A Markdown file's scope comes from its path and from past imports". DOCX scope comes from the source, so "a file's" would be false.
+- REQ-LIB-9's autosave sentence. It is Mos's reading of F41's "instantly committed", with human-set intervals. The exact intervals stay in the design.
+
+Not taken:
+- Impact map item 4's "files in unmarked folders are eligible one at a time", for folders outside every book folder and playground only. Their files are unmapped under REQ-LIB-2, so a DOCX made from one would have no universe or book to keep. The human maps such a folder into a book folder or a playground first, under REQ-LIB-1. A file in an unmarked folder inside a book folder or a playground is canon or playground, and the import takes it one file at a time.
+
+## Marked for Jason (additions in the text he sees)
+
+- J-a. Whether "We will not run the systems in parallel" applies per chapter or as one switch per book. His call. As written, it applies per chapter.
+- J-b. A converted chapter's DOCX is not in Obsidian's graph. Obsidian shows the chapter only through its archived Markdown, and no DOCX edit reaches that file's links. REQ-LIB-5 still cites two TARGET lines, "Visualization of data via Obsidian or equivalent is required" and "Connections are always visible". Mos's reading was that 1.17 as d8 wrote it met neither line for converted chapters. Their current links showed to the user only as clickable text inside the editor, and no graph or list showed them. Q226 leaves room for "another way to handle the visual brain map". The O2 design that landed for Vikunja 571 at 767bb62c7 held a Console Connections view and its tests as later work that waited for this answer. His call was whether 1.17 requires that view. As d8 was written, it did not. Mos recommended that it does, because impact map A6 says "Recommended: name the view" and TARGET says "Connections are always visible". Jason answered O2 (Q239): 1.17 requires the view. d9 writes it into REQ-LIB-5, its note and the Risks line, in the text of mos-1443 R3. The view comes with the conversion work after 10-27, and the 10-27 Case 2 release stays on Markdown (Q235 P6, Q237). That the import does not wait for the view is Mos's default in mos-1443 R3. Q239 doesn't address it, and Mos confirmed it at his J-b check (mos-1470).
+- J-c (mos-1374): "The store pushes to a remote (D7), and the Case 2 VM is in the nightly PBS backup. For a fixed restore point before her first real import, a manual backup of VM 1012 with PBS protect runs first. That step is reversible and needs no reboot." Mos's reading is that this sits inside the P5 go step, so it needs no new question.
+- J-d. How agents read a converted chapter, D9. His call. As written, an agent reads it through the ordinary Case 2 lookups in any thread or room, under the same project and universe access as Markdown canon. This is Mos's reading of F41 and REQ-LIB-7. The other choice is the model in the earlier O2 design, W4 sections 7.1 and 7.2. Under it, an agent reads a converted chapter only in a new writing conversation that holds one human and one agent, only after the business owner grants that agent access to that document, and by default only what the human attaches to each message. Comments and tracked deletions stay hidden from agents until a human turns on a setting for each. Markdown has neither, so the default keeps agents at the access Markdown gives them. Those two sentences are Mos's ruling mos-1379. A yes to the text as written settles it.
+- J-e. Versioning means the editor's tracked changes plus one git commit per save.
+- J-f. A converted chapter can be edited only in the Console while the stack is reachable. Obsidian no longer edits it offline.
+- J-g. The import takes Markdown only. Importing .doc files stays a separate task.
+- J-h. Autosave under REQ-LIB-9. Jason's Q226 F41 says "All changes are instantly committed and available to the agents." Mos's reading, recorded with that ruling, is "Each save is a commit at once, and agents read it at their next lookup." At the O2 design's D13 defaults, a save commits at most 2 seconds after a pause in typing or 15 seconds into steady typing, with no human action needed. Mos's reading in mos-1359 counts that delay as "instantly committed". Only a human changes the intervals. The PRD names no values, and the defaults stay in the design. Whether a delay of seconds fits his word "instantly" is his call, so this is marked for him.
+- J-i. In 1.17 a playground story that is DOCX can't become canon. That covers a playground Markdown file the human imports, a story the human starts in a playground in the editor, and the DOCX of a draft universe after it is made real. Today Melanie promotes a playground file by moving it into a book folder in Obsidian, and a DOCX in the writing store can't be moved that way. She can start a new story in the book and paste the text in, but it gets a new document id and the playground copy keeps the history. A later version adds DOCX promotion with C2-19, which comes after the slice.
+- J-j. Web links, text boxes and fields in a converted chapter. Jason's Q226 F41 says "All changes are instantly committed and available to the agents." The reader in this version can't read a web link, a text box, a field or hidden text. As written, the import turns each web link into plain text that keeps its label and address, and the human confirms that in the fidelity report. A web link that can't be kept safely as plain text refuses the import. If a later edit adds one of these, the save keeps it and the editor warns the human. Agents then get none of that part's text until a save takes it out.
+- J-k. The 1.12 note Jason approved says bus writes, C2-02 and C2-03b, don't gate 10-27. His Q226 "F42: ok" moved them into the 10-27 slice, and design 9.2 counts them in the smallest slice that lets Melanie start. Mos reads that as making them gate 10-27. The editor rows C2-11a and C2-11b still don't gate it, per his Q195 words "we need to get it moving as an add-on".
+- J-l. REQ-LIB-9 does not use REQ-PROJ-3's "permissive license" bar. It takes the licenses that the editor's independent security review accepted, because that review cleared fonts under the SIL Open Font License and the Ubuntu Font License, which not every reader counts as permissive. Mos's reading.
+
+Marked as changes beyond P1 to P6, from the impact map (Q17, item 5):
+- A1 (archived scope and canon cites)
+- A2 (the conversion requirement, REQ-LIB-8)
+- A3 (outside the vocabulary, hard-wait list unchanged)
+- A6 (lookups across formats)
+- A7 (agent bounds)
+- A8 (DOCX cites)
+- Item 2 and mos-1375: each writing-store commit is pushed to a remote off the stack's host. Only a human sets it, it starts unset, and a repository on the stack's host doesn't count. Only the stack's host pushes to it, and no agent can reach it with any credential. Import and new story files stay closed until the remote is set and checked, and each import's archive push waits until the remote holds the DOCX commit. This keeps "Git is used for all changes -- local and remote" true for DOCX chapters.
+- Item 3 (the Hermes gate)
+- Item 4. Canon and playground story files convert one file at a time, including files in unmarked folders inside a book folder or a playground. Type-folder and supporting files stay Markdown. A story file outside every book folder and playground has no universe or book, so it converts only after a human maps its folder into a book folder or a playground. The mapping step is Mos's reading of P1 and Q30.
+
+The F4 measurement goes with them.
+
+## Files the row would own
+
+The id count goes from 85 to 87. 1.16 owned three files because its count stayed at 85. Like 1.13, the last version that added ids, the row owns four files:
+- `docs/prd/mosaic-stack.md`
+- `packages/tasks/requirements.json`: the version 1.17, the two new ids REQ-LIB-8 and REQ-LIB-9 with their titles, and the changed titles of REQ-LIB-1, REQ-LIB-2 and REQ-LIB-4. The new ids go after REQ-LIB-7 and before REQ-INST-1, in the same order as the PRD's bullets.
+- `packages/tasks/tests/requirements.test.mjs`: the version pin 1.17, the id count of 87, and the duplicate-id message, which goes from `requirements[85].id: REQ-ROLE-1 twice` to `requirements[87].id: REQ-ROLE-1 twice`.
+- `packages/bus/tests/requirements.test.mjs`: the list length, which goes from 85 to 87.
+
+The gate would match 1.16's:
+1. A reviewer approves the text.
+2. Jason says yes to the exact text through Mos.
+3. Both `requirements.test.mjs` files, in `packages/tasks/tests` and `packages/bus/tests`, and every `scripts/test-*.sh` that reads the PRD or `requirements.json` are green on Sage's gate.
+4. Mos gets the landing commit.

agents/sage/work/prd-1-17/DRAFT.md

@@ -0,0 +1,652 @@
+# PRD 1.17 draft: Case 2 story files are DOCX (Q235 to Q237, P1 to P6)
+
+Sage, 2026-10-23, for mos-1366 item 1 and Vikunja 570. Draft 9. It is d8 plus Jason's Q41 answer O2 (DECISIONS Q239, mos-1467), which makes J-b yes, Webby's round 5 N15 to N17 (webby-0210) and Webby's round 6 B1, N19 and N20 (webby-0212) (see "d9 changes"). d8 is d7 plus Mos's d8 fix list mos-1443 (see "d8 changes"). d7 is d6 plus Mos's ruling mos-1379 on Fenton's 571 B2 (see "d7 changes"). d6 is d5 with Webby's round 3 (webby-0207) fixed: B1 to B3 and N10 to N13, with N14 left for Mos (see "d6 changes"). d5 folds in:
+- Mos's d4 check ruling mos-1372 (D1 to D14; D15 was dropped).
+- mos-1374, which replaces J-c.
+- The impact map mos-1368 (jason-master-restart d183246, `projects/mosaic-mvp/case2-docx-impact-map.md`: A1 to A16, critic items C1 to C6, items 2 to 7).
+- Mos's F4 measurement.
+
+Review order (mos-1367 B5): Webby, then Mos, then Jason. Base: PRD 1.16, `docs/prd/mosaic-stack.md` blob a6db9b4a at 482e865ac.
+1.16 lands first (row 291), and this text is a new version on top of it. Nothing here is built or queued. The impact map's queue changes (A24, A57 to A59) go through `scripts/mosaic queue` after 1.17 is approved (C9).
+
+Sources, verbatim in Mos's DECISIONS:
+- Q235, Jason's Q36 answer.
+- Q236: chapters are DOCX, Markdown for agent files and docs.
+- Q237: "It is correct for now (subject to future change)".
+- The P1 to P6 reading as restated to Jason in Q38.
+
+## Settled points (mos-1367)
+
+These stand as ruled. d5 changes only what mos-1372 changed.
+
+- **O1. Where a converted chapter lives.** The DOCX lives in the writing store of
+  O2 design D12, and the archived Markdown stays in the user's repository under a
+  human-marked archive folder. Ruled yes in B1, on the condition that the text
+  says plainly that a converted chapter leaves the Gitea-mirrored repository and
+  lives in the stack's writing store. mos-1372 D7 and mos-1375 add a remote for
+  the store, off the stack's host.
+- **O2. The unit of conversion.** One story file per import, refusing a file
+  that is already converted. Ruled yes in B2: each file gets its own fidelity
+  report, human confirmation, manifest and commit.
+- **O3. Whether conversion is a vocabulary action.** A human-only verb outside
+  the agent vocabulary, with no role grant and no agent request path. Ruled yes
+  in B3.
+- **O4. Reading archived Markdown.** A new `archived` scope. Lookups leave it out
+  unless the caller asks, every answer marks it archived, and a canon citation
+  can't name it. Ruled yes in B4.
+
+## d3 choices after mos-1372
+
+- **C1 is replaced by D1, keep-source-scope.** A DOCX keeps its source's scope:
+  universe, book, and canon or playground. A playground DOCX follows the
+  playground rules and is never returned as canon. The import accepts canon and
+  playground story files. Type-folder files and supporting files stay Markdown
+  (P4). This also settles the impact map's Q18, item 4. It leaves one narrowing
+  for Jason, J-i. A playground DOCX can't become canon in 1.17.
+- **C2 stands.** The move keeps the file's path under the archive folder:
+  `book1/ch3.md` goes to `<archive>/book1/ch3.md`. An archived file's universe
+  and book are those of its old path.
+- **C3 is replaced by D3 and D14.** The archive commit is written by a new
+  human-only bus step (Vikunja 571) on the C2-02 write plumbing and pushed through
+  C2-03b. The order is the store commit and the remote's confirmation that it
+  holds that commit, then the archive commit and its push, then publication to the
+  lookups.
+- **N4 stands.** REQ-LIB-8 says "a real user's books". The PRD names no user
+  anywhere in Case 2.
+
+## Text changes
+
+### Status and sources
+
+In the Status bullet's first line, "- Status: approved, version 1.16." becomes
+"- Status: approved, version 1.17." Status gains, after the two 1.16 sentences at
+the end of the bullet: "Version 1.17 records Jason's rulings Q235 to Q237 of
+2026-10-23: Case 2 story files are DOCX, Markdown stays for agent files and
+documentation, and a human-started import converts a Markdown story file one way.
+It also adds REQ-LIB-9, the Console's DOCX editor, from Jason's rulings Q195, Q226
+and Q234. It changes what Case 2 requirements allow, so Mos puts the text to Jason
+as written, and it lands only after his yes (mos-1366, Vikunja 570)."
+
+New source line, above the 1.16 one: "Version 1.17 source: Jason's Q235, answering
+Q36: 'How about we see a markdown file, we convert the markdown file to docx, then
+archive or mark the markdown file as converted. The new standard for files in the
+creating writing use case is to use docx to handle versioning and WYSIWYG. We
+eliminate the potential for confusion based on the files. Agents must understand
+which files are what format and where they live. The system must allow for import
+and conversion. We will not run the systems in parallel. There will be an
+irreversible conversion of the files.' His Q236 says: 'For creative writing
+chapters, we need to utilize docx as the standard. Markdown is acceptable for
+agent files, instructions, PRDs, documentation, etc. The creative writing files
+should be docx for familiarity for the user.' His Q237 says 'Q38: It is correct
+for now (subject to future change)', which confirms Mos's reading P1 to P6.
+REQ-LIB-9 rests on his Q195 request for 'a full WYSIWYG editor within Mosaic
+Stack', his Q226 answer 'F41: We want to move editing into the WYSIWYG in the
+WebUI. All changes are instantly committed and available to the agents.' and his
+Q234 answer 'Q37: yes' to the exact security header for the editor's frame. The
+storage follows the O2 design D10 to D12 as rewritten under Vikunja 571, at
+b99ca86b9 on `refactor`."
+
+### Creative library, section lead
+
+Replace "The library is the user's own writing repository." with "The library is
+the user's own writing repository plus the stack's writing store, which holds the
+DOCX story files (REQ-LIB-8, version 1.17)."
+
+### REQ-LIB-1
+
+Add, before "(Design 1.1": "The mapping also names one archive folder, set by the
+human, where converted Markdown story files go. A book's DOCX story files are in
+the stack's writing store, under the same universe and book (REQ-LIB-8)." Version
+tag, inside the closing parenthesis: "Version 1.15: supporting folders.)" becomes
+"Version 1.15: supporting folders. Version 1.17: the archive folder and the
+writing store.)"
+
+### REQ-LIB-2
+
+Replace "A file's scope comes from its path alone, prefixes first: a Markdown
+file under a supporting prefix is supporting, one under a playground prefix at
+any level is playground, any other Markdown file in a book folder is canon, and
+everything else is unmapped and never returned. A folder in both lists is
+supporting." with:
+
+"A Markdown file's scope comes from its path and from past imports, prefixes
+first: a Markdown file under the archive folder is archived, one under a
+supporting prefix is supporting, a Markdown file at a converted file's old path is
+unmapped under REQ-LIB-8 but flagged in the format map, one under a playground
+prefix at any level is playground, any other Markdown file in a book folder is
+canon, and everything else is unmapped and never returned. A folder in both lists
+is supporting. The archive folder follows the same placement rules and may not
+overlap another prefix or a book folder. An archived file keeps the path it had
+under the archive folder, and its universe and book are those of that old path. A
+DOCX document in the writing store keeps its source's scope: the universe, the
+book if there is one, and canon or playground. Its source is the Markdown file it
+was converted from or, for one the human starts in the editor, the universe and
+book or the playground the human picks (REQ-LIB-8). A playground DOCX follows the
+playground rules and is never returned as canon. It stays playground after its
+draft universe is made real. In version 1.17 no promotion or mapping change makes
+a playground DOCX canon. A later version of this PRD says how one becomes canon."
+
+Replace "Lookups return canon unless the caller asks for playground or
+supporting." with "Lookups return canon unless the caller asks for playground,
+supporting or archived. Every answer marks an archived file as archived and names
+the DOCX that replaced it."
+
+Replace "so an agent can't cite a playground or supporting file as canon" with "so
+an agent can't cite a playground, supporting or archived file as canon".
+
+In REQ-LIB-2 only, replace "The Console shows each cite's scope." with "The Console shows each cite's
+scope and format, and whether a cited Markdown file was converted."
+
+Version tag, inside the closing parenthesis: "Version 1.15: supporting.)" becomes
+"Version 1.15: supporting. Version 1.17: archived scope and DOCX scope.)"
+
+### REQ-LIB-4
+
+Replace "The user commits and pushes with their own tools, today Obsidian with
+obsidian-git." with "The user commits and pushes Markdown with their own tools,
+today Obsidian with obsidian-git. A converted story file's current text is no
+longer in that repository, which keeps only its archived Markdown (REQ-LIB-8)."
+
+Add, after "Bus writes and pushes come in later rows (C2-02, C2-03b).": "A DOCX
+story file is saved in the Console's editor, and each accepted save is one commit
+by the human in the stack's writing store (REQ-LIB-9). Each writing-store commit
+is also pushed to a remote off the stack's host, never by force-push. The remote
+is a setting only a human changes, and it starts unset. A repository on the
+stack's host never counts as that remote. A missing remote or a failed push never
+undoes a save, and the user sees each push that is pending or failed. Only the
+stack's host pushes to that remote, and no agent can reach it with any credential.
+Agents read the local commit."
+
+Replace "Agents read only the mirror's served commit and never hold a copy of
+their own, so they see the user's push within about a minute." with "Agents read
+the user's repository only at the mirror's served commit, except a story file
+during its import under REQ-LIB-8. They read a DOCX story file only at a committed
+version in the writing store, under REQ-LIB-5. They never hold a copy of their
+own, so they see the user's Markdown push within about a minute and a DOCX save at
+their next lookup after the editor reports it as committed."
+
+Version tag: "and the sync items.)" becomes "and the sync items. Version 1.17,
+with Q222 for the remote setting.)"
+
+### REQ-LIB-5
+
+Add, after "Each answer names the commit it read.": "Each answer also names the
+file's format and where it lives: its path, or its document id in the writing
+store. A DOCX story file is read from its latest committed save, never from
+unsaved text. A lookup that starts after the editor reports a save as committed
+returns that save or a later one, even while its push to the remote is pending or
+has failed, and the answer names the version. Get, search and manuscript read a
+DOCX story file as its extracted text with DOCX locators, never as lines. That
+text is the file with its tracked changes accepted. An agent reads a story file's
+comments, or its text with tracked deletions shown, only after a human turns on
+the matching setting. Both settings are off by default, and only a human changes
+them. The reader in this version can't read some things a DOCX story file can
+hold, such as a web link, a text box, a field or hidden text. The editor warns the
+human when an edit adds one, and the human can still save it. Until a later save
+takes it out, lookups give agents none of the text of the part that holds it,
+whether that is the chapter's body, a note or a comment. The manuscript lookup
+follows the book's chapter order across both formats (O2 design D10), and the next
+chapter it names is never an archived file. Links out and in resolve across both
+formats. The universe lookup returns the format map (REQ-LIB-8)."
+
+Replace "The user sees them in Obsidian's graph and backlinks." with "The user sees
+a Markdown file's links in Obsidian's graph and backlinks. A DOCX story file's
+wikilinks stay clickable in the Console's editor (O2 design D11), and no graph
+shows them yet. The Console's Connections view lists the current links and
+backlinks of each story file the user may see, in both formats, with each one's
+scope and format."
+
+Version tag: 'and "Connections are always visible".)' becomes 'and "Connections
+are always visible". Version 1.17, with Q222 for the two settings and Q239 for
+the Connections view.)'
+
+### REQ-LIB-6
+
+Replace "A reply may cite lines of the repository at a commit or pages the agent
+fetched, and the broker checks every citation before it stores the message." with
+"A reply may cite lines of a Markdown file at a commit, a place in a committed
+DOCX story file, or pages the agent fetched, and the broker checks every citation
+before it stores the message. A DOCX citation never calls a paragraph a line. It
+names the document id, the committed version and a DOCX locator. A citation that
+names an archived file as current is refused. The `requireCitation` setting below
+applies to Markdown and DOCX citations alike, and so does the rule for a citation
+marked as canon."
+
+Add, after "the broker refuses such a write before any git call.": "The writing
+store and the archive folder are read-only to a creative agent as well, and the
+broker's path check treats the archive folder as story. No agent creates, edits,
+deletes, converts, archives or restores a story file in any format, and no agent
+writes a DOCX. No creative agent starts or undoes a conversion, and none asks for
+one through a tool or a decision it raises, as REQ-LIB-8 says. An agent may still
+suggest a conversion to the human in chat. Each creative role's contract states
+which files are DOCX and which are Markdown, and cites a DOCX story file by its
+locator, never by line."
+
+Version tag, inside the closing parenthesis: "Version 1.15.)" becomes "Version
+1.15. Version 1.17.)"
+
+### New REQ-LIB-8
+
+This bullet goes after REQ-LIB-7 and before the "### Installer" heading.
+
+"- **REQ-LIB-8.** Story files become DOCX. DOCX is the standard for chapters and
+  the other story text in a Case 2 writing project, canon and playground alike. A
+  story file becomes DOCX through a human's import (below), or when the human
+  starts it in the editor. From then on DOCX is its only working format, edited in
+  the Console's editor (REQ-LIB-9). A Markdown story file stays Markdown until its
+  import. Files in a type folder (REQ-LIB-1), such as character and place notes,
+  stay Markdown. So do supporting files, agent files, instructions, PRDs and
+  documentation, including the character sheets, summaries and cross-links agents
+  keep under REQ-LIB-6.
+  - A converted story file's current text leaves the user's Gitea-mirrored
+    repository. Its DOCX lives in the stack's writing store, on the stack's host,
+    and not in the repository the user pushes or opens in Obsidian. Only its
+    archived Markdown stays there.
+  - An import converts one Markdown story file, canon or playground, outside every
+    type folder (REQ-LIB-1), to a DOCX document in the writing store. It refuses
+    an unmapped, supporting, archived or type-folder file, and a file that is
+    already converted. Each import has its own fidelity report, the human's
+    confirmation of that report, a manifest naming the source file and its commit,
+    and one commit in the store. The DOCX keeps every wiki link of the source as
+    written, and a lost link to another library file fails the fidelity report. A
+    web link becomes plain text that keeps its label and address, and the fidelity
+    report lists it for the human to confirm. A web link that can't be kept safely
+    as plain text refuses the import.
+  - The human can also start a new story file in the editor, in a universe and
+    book or a playground the human picks. It is a DOCX document in the writing
+    store from its first commit, with no Markdown copy, and it opens under the
+    same gate as the import.
+  - The same import marks the Markdown file converted, naming the document, and
+    moves it to the archive folder under its old path (REQ-LIB-1, REQ-LIB-2).
+    The mark and the move are one commit authored by the human in the user's
+    repository. A new human-only bus step (Vikunja 571) on the C2-02 write
+    plumbing writes it, and C2-03b pushes it. The move keeps the bytes and the
+    git history, so it isn't `data.delete`.
+  - The store commit comes first, and the writing store's remote must confirm it
+    holds that commit. Then come the archive commit and its push, then publication
+    to the lookups. Until publication the Markdown at its old path keeps its canon
+    or playground scope. Agents read that file at the commit the import started
+    from, even after the mirror's served commit reaches the archive commit or a
+    later one. No lookup returns the file's archived copy before publication, even
+    one that asks for archived files. A refusal or failure before the archive push
+    leaves the Markdown unmoved and no DOCX that a lookup returns. A failure after
+    the archive push leaves a pending import that the human sees and can resume,
+    never a claim that nothing moved. An archive push whose result is unknown
+    counts as a failure after the archive push until the stack reads the result
+    back from the user's remote.
+  - Each stage of an import writes a logged event. The import's record on the
+    stack's host names the source file's path, commit and blob and the new
+    document id, and each event points to that record.
+  - After a conversion, a Markdown file at the converted file's old path is
+    neither canon nor playground. Lookups leave it out, the format map flags it,
+    and the human is told.
+  - A new Markdown story file in a book folder that holds converted files stays
+    canon until its import, unless it sits at a converted file's old path or under
+    a playground prefix. The Console flags it and offers the import. Nothing
+    converts it on its own.
+  - A hybrid's exclusion that covers a converted file's old path also covers its
+    DOCX document (REQ-LIB-3). An exclusion of a whole book folder also covers
+    every DOCX document in that book, including one started in the editor. An
+    exclusion can also name a DOCX document by its id.
+  - Only a human starts an import or a new story file, from the CLI or a Console
+    session signed in as that human. Both are human verbs outside the agent action
+    vocabulary. Neither is added to `ACTIONS` in the business vocabulary or to the
+    broker's always-gated list, including the import's action, `library.convert`.
+    No role holds them, no agent can request them, and the hard-wait list in
+    REQ-WAIT-1 doesn't change. In an organization with several humans, who may
+    start them is a setting only a human changes, and the default is the owner
+    only.
+  - Conversion is one way, with no parallel run. Neither the Console nor any agent
+    edits a converted story file as Markdown, and no DOCX edit syncs back to
+    Markdown. The Console's Markdown save refuses every file under the archive
+    folder. The user's own tools can still change the archived Markdown, and no
+    such change reaches the DOCX. The old Markdown stays in git history, and
+    nothing rewrites history. A promotion into a book folder (C2-19) runs the
+    import for a Markdown story file or is refused. A promotion of a playground
+    DOCX is refused in version 1.17.
+  - Agents get a format map: for each mapped folder and story file, its format,
+    scope and where it lives, archived files, flagged files and pending imports
+    included.
+  - The import and new story files ship closed. They open only after four things.
+    The editor ships. The human has set the writing store's remote, and the stack
+    has checked that it can push there. Agents can read committed DOCX story files
+    through the lookups and cite them (REQ-LIB-5, REQ-LIB-6). Any earlier agent
+    system that writes the user's files has stopped, which for Case 2 is the
+    Hermes retirement (#423 step 5). So the import itself never cuts agents off
+    from a chapter, the chapter's current text never lives only on the stack's
+    host, and no second system writes the story. The first import of a real user's
+    books waits for Jason's go.
+  (Q235, Q236, Q237: P1 to P6. Q222 for the setting. O2 design D10 to D12.
+  Version 1.17.)"
+
+### New REQ-LIB-9
+
+This bullet goes after REQ-LIB-8.
+
+"- **REQ-LIB-9.** The Console's DOCX editor. The human edits a DOCX story file in
+  the Console's editor, in a split pane with the agent chat alongside it. The
+  human can pin an agent chat to a document. The human can select a word,
+  right-click it, and choose a synonym from a thesaurus. Only a human saves. Saves
+  happen on their own while the human types (Q226), at intervals only a human
+  changes, and each accepted save is one commit with the human as author, pushed
+  as REQ-LIB-4 says. A save made against an older version than the current one is
+  refused. Agents never write a DOCX. Versioning is the editor's tracked changes
+  plus one git commit per save. The editor's code is vendored and pinned, with a
+  hash per file and the licenses that its independent security review accepted. At
+  runtime the editor loads only files that the stack itself serves, and it
+  requests nothing from any other host. The editor's frame sends exactly the
+  content security policy Jason approved in Q234, and the WebUI shell's own header
+  is unchanged. REQ-PROJ-3's project docs editor is unchanged. (Q195, Q226, Q234,
+  Q236. O2 design D3, D4, D6, D8, D10, D13, D14, D16 and D22. Version 1.17.)"
+
+### Version 1.17 notes
+
+Added after the 1.16 notes:
+
+"- Version 1.17:
+  - Jason confirmed the reading 'for now (subject to future change)' (Q237). The
+    rulings stand until he revises them.
+  - The 10-27 Case 2 release ships on Markdown as built (P6). The 1.11 line 'The
+    Case 2 MVP for 10-27 is the Markdown library (#416). The WYSIWYG editor (Q195,
+    Q196) is an add-on that doesn't gate it.' still holds. Conversion opens after
+    10-27, and only once REQ-LIB-8's four conditions are met. The editor ships,
+    the writing store's remote is set and the stack has checked that it can push
+    there, agents can read and cite committed DOCX story files through the
+    lookups, and Hermes is retired, which is #423 step 5.
+  - The 1.12 note says five bus write and Console editor rows, C2-02, C2-03b,
+    C2-11a, C2-11b and C2-19, don't gate 10-27. Jason's Q226 F42 later moved
+    C2-02, C2-03b and C2-11b into the 10-27 slice. The Case 2 design brings C2-11a
+    in with them, because C2-11b needs it. C2-19 stays outside the slice. Mos's
+    reading of F42 is that C2-02 and C2-03b now gate 10-27, because design 9.2
+    puts them in 'the smallest slice that lets her start'. C2-11a and C2-11b are
+    slice rows that still don't gate 10-27, because the editor is the Q195 add-on.
+    The DOCX change in 1.17 leaves this slice as it is, and C2-11b's Markdown
+    editor never edits a converted story file.
+  - Q236 narrows Q176's editor choice to DOCX for story files (REQ-LIB-9). The
+    1.12 note that the Case 2 design keeps Obsidian now holds only for Markdown
+    files, including story files not yet imported. A DOCX story file is edited
+    only in the Console's editor under REQ-LIB-9.
+  - This replaces two parts of the O2 design at 25c09f19f. The superseded-notice
+    proposal from Fenton's F1 in D12 is withdrawn, and the
+    keep-Markdown-at-its-path model of D11 is replaced. Gyro's rewrite of the O2
+    design for Vikunja 571, landed on `refactor` at b99ca86b9, carries the
+    details, and where it differs from this text, this text holds:
+    - the import and archive steps, the mark, and the new bus step;
+    - links from supporting files to a moved chapter;
+    - the DOCX reader;
+    - the user's unpushed or later changes to an archived file or at its old path,
+      and pushing and closing the file in Obsidian before each import;
+    - the writing store's remote in W4 section 7.3, which replaces the no-remote
+      and no-backup rule that W4 section 7.4 held before the rewrite, at
+      062646487;
+    - import events counted by a bus restore, and recovery when a bus restore or a
+      restore of the whole host predates an import;
+    - manifest order for the manuscript lookup and its next chapter;
+    - `library.convert` kept out of `ACTIONS`, out of the hard-wait note and out
+      of the pinned `GATED_ONLY` list in packages/business/src/vocabulary.mjs.
+  - Agents read a converted story file through the Case 2 lookups under the same
+    project and universe access as Markdown canon, in any thread or room. W4's
+    earlier O2-only conversations, per-document grants and per-send sharing don't
+    gate these lookups. The 571 rewrite replaced them in W4 sections 7.1 and 7.2.
+    The creative tool list in REQ-LIB-6 doesn't change.
+  - The six creative role contracts row 213 landed say 'Every item cites the
+    lines of the user's material it is about'. A build row under 571 changes that
+    line for DOCX story files (REQ-LIB-6).
+  - A new Markdown file in a book folder is still canon in 1.17. The 1.17
+    exception is a file at a converted file's old path, which REQ-LIB-2 makes
+    unmapped.
+  - Story files convert whether canon or playground. Type-folder and supporting
+    files stay Markdown.
+  - Measured 2026-10-23 at about 01:21Z: the Case 2 user's library repository
+    tracks 213 files, 203 of them Markdown, and none is a .docx or .doc. It has no
+    untracked files. The user's .doc files (Q196) are outside it. So the landed
+    code has no DOCX there to report as unreadable at 10-27.
+  - Text replaced in 1.17, kept here as in earlier notes:
+    - Creative library lead, the 1.16 sentence: "The library is the user's own
+      writing repository."
+    - REQ-LIB-2, the 1.16 sentences: "A file's scope comes from its path alone,
+      prefixes first: a Markdown file under a supporting prefix is supporting,
+      one under a playground prefix at any level is playground, any other
+      Markdown file in a book folder is canon, and everything else is unmapped
+      and never returned. A folder in both lists is supporting." "Lookups return
+      canon unless the caller asks for playground or supporting." "so an agent
+      can't cite a playground or supporting file as canon" "The Console shows
+      each cite's scope."
+    - REQ-LIB-4, the 1.16 sentences: "The user commits and pushes with their own
+      tools, today Obsidian with obsidian-git." "Agents read only the mirror's
+      served commit and never hold a copy of their own, so they see the user's
+      push within about a minute."
+    - REQ-LIB-5, the 1.16 sentence: "The user sees them in Obsidian's graph and
+      backlinks." A converted chapter's connections show in Obsidian only as they
+      stood at conversion, and the Console's Connections view shows their
+      current links.
+    - REQ-LIB-6, the 1.16 sentence: "A reply may cite lines of the repository at
+      a commit or pages the agent fetched, and the broker checks every citation
+      before it stores the message."
+    - REQ-LIB-1 only gains sentences.
+  - REQ-LIB-3's text and REQ-LIB-7 are unchanged. REQ-LIB-8 adds one form of
+    exclusion REQ-LIB-3 doesn't have: naming a DOCX document by its id. A path
+    exclusion also covers DOCX documents, through a converted file's old path or a
+    whole book folder. An archived file and a DOCX document keep a universe, and a
+    book where their source has one, so every lookup still names one universe.
+    REQ-PROJ-3, the Console editor for a project's spec and docs, is unchanged.
+    C2-11b opens the library's Markdown files in that same editor.
+  - In `packages/tasks/requirements.json` the titles of REQ-LIB-1, REQ-LIB-2 and
+    REQ-LIB-4 change, and those of REQ-LIB-5 and REQ-LIB-6 stay. REQ-LIB-1 becomes
+    'A human-set library maps the user's repository onto universes, books, types,
+    playgrounds, supporting and archive folders'. REQ-LIB-2 becomes 'Scope comes
+    from the path or a DOCX's source, lookups default to canon, and only canon
+    files are ever cited as canon'. REQ-LIB-4 becomes 'Git holds every change. The
+    bus fast-forwards a read-only mirror every 60 seconds, the one place agents
+    read Markdown'. REQ-LIB-8 and REQ-LIB-9 add two ids, so the count goes from 85
+    to 87. REQ-LIB-8 is titled 'Case 2 story files become DOCX by a human-only
+    one-way import or in the editor; Markdown stays for notes and docs', and
+    REQ-LIB-9 'The Console's DOCX editor: only a human saves, each save is one
+    commit, and the editor code is vendored and pinned'.
+  - Open points O1 to O4 of draft 1 were ruled by Mos in mos-1367 B1 to B4.
+  - Sage files the build rows under Vikunja 570 and 571 after the rewrite is
+    approved. This amendment adds the requirements only."
+
+### Risks
+
+The new lines go at the end of "## Risks and open questions", after the bullet
+that begins "Trusted mode lets an agent" and before the "## Milestones" heading.
+- "A DOCX file is a zip archive, so git can't show a line diff of a chapter.
+  Review of a story change goes through the editor and the committed reader,
+  not `git diff`. (Version 1.17.)"
+- "A converted chapter's DOCX is not in Obsidian's graph. Obsidian shows the
+  chapter only through its archived Markdown, and no DOCX edit reaches that file's
+  links. The DOCX's current links show in the Console's editor and its
+  Connections view, and no graph shows them yet. (Version 1.17.)"
+- "Conversion can't be undone in place. Front matter, wiki link forms and
+  unsupported blocks may not survive it, and the mirror can't refuse the user's
+  push to an archived file. The controls are the fidelity report, the human's
+  confirmation, an untouched original on refusal, and the kept archive.
+  (Version 1.17.)"
+- "A restore of the stack's bus alone from a backup taken before an import drops
+  the import's logged events, while the archive commit and the DOCX stay. A
+  restore of the stack's whole host from such a backup also takes the writing
+  store and the host's import records back to before the import. The archive
+  commit stays in the user's Gitea repository and the DOCX stays on the writing
+  store's remote, but the host keeps no record of the import. A bus restore counts
+  import events, and the import's recovery covers both cases (Vikunja 571).
+  (Version 1.17.)"
+
+## d9 changes (Q239 and Webby round 5)
+
+- J-b yes (Q239, mos-1467), in the five edits mos-1443 R3 set for a yes (Webby round 6 B1). R3.1: REQ-LIB-5's replacement gains the Connections view sentence after "no graph shows them yet.". R3.2: the graph Risks line ends with the editor and the Connections view. R3.3: the A6 line moves from "Not taken" under A6. R3.5: the REQ-LIB-5 note ends with the Connections view, which drops "until a Console view of their links exists" and "Q226 records that view as a later option". R3.4 is Gyro's design edit at 767bb62c7 (writing-editor.md:188-190, :240-244 and :1272, docx-citations.md:66), and it follows in his docs round. Beyond these and N21, nothing else in the PRD text changes.
+- N19 and N20 (Webby round 6): J-b's question text is in the past tense, and the line that the import doesn't wait for the view is cited as Mos's R3 default. Mos confirmed it at his J-b check (mos-1470).
+- N21 (Webby round 6, Mos yes in mos-1470): REQ-LIB-5's version tag cites Q239 for the Connections view beside Q222 for the two settings.
+- N15: the D7 landing line gives R8's wording beside the impact map's quote.
+- N16: the d7 changes line notes that R8 replaces "no agent credential reaches it" in d8.
+- N17: the REQ-LIB-2 Replace quote and the REQ-LIB-8 old-path bullet are rewrapped under 82 columns. Their words are unchanged.
+
+## d8 changes (Mos's d8 fix list, check wf_63bba879-180)
+
+- R1: REQ-LIB-4's tail covers DOCX saves, which agents see at their next lookup after the editor reports them as committed. The notes quote the whole 1.16 sentence. Source: nit/jason/F10.
+- R2: REQ-LIB-4's new title says the mirror is "the one place agents read Markdown". Source: decisions.n14.
+- R3: J-b asks whether 1.17 requires the Console Connections view, with Mos's recommendation of yes. Sources: mos1372/F9, jason/F2, anchors/F5.
+- R4: C2-02 and C2-03b gate 10-27, C2-11a and C2-11b are slice rows that don't, and "F42 wins" is gone. New J-k. Sources: anchors/F6, jason/F5.
+- R5: where the landed 571 design differs, this text holds. Sources: anchors/F8, adversarial/F8 item 1, jason/F8, critic/C6, G16's design follow-on.
+- R6: `library.convert` stays out of `ACTIONS`, and REQ-WAIT-1's hard-wait list doesn't change. Sources: gyro571/F1, adversarial/F8 item 3, critic/C6.
+- R7: a repository on the stack's host never counts as the writing store's remote, and Item 2 says so. Sources: mos1372/F2, adversarial/F1, gyro571/F2.
+- R8: "no agent credential reaches it" becomes "no agent can reach it with any credential". Source: Fenton's B1 under mos-1379.
+- R9: no playground DOCX becomes canon in 1.17, and a promotion of one is refused. New J-i. Sources: mos1372/F8, adversarial/F2.
+- R10: REQ-LIB-9 restates Q195's pin and right-click thesaurus, and its cite gains D4 and D22. Source: critic/C4.
+- R11: REQ-LIB-9's license bar is the licenses its independent security review accepted. New J-l. Source: critic/C3.
+- R12: no text for D16's narrow-window tabs. Mos records that reading in STATE. Sources: jason/F1, second verifier vote.
+- R13: no lookup returns a file's archived copy before publication. Source: adversarial/F5 part 3.
+- R14: a restore of the whole host from a backup taken before an import is a fourth recovery case. Source: adversarial/F6.
+- M1: REQ-LIB-4's writing-store sentences follow the later bus rows sentence and add the off-host remote rules and DOCX read timing. The note quotes both 1.16 sentences. Sources: mos1372/F2, adversarial/F1, gyro571/F2, anchors/F4, nit/jason/F10, adversarial/F5 part 1, Fenton B1.
+- M2: REQ-LIB-8's order bullet adds the remote's confirmation, the old-path read rule and "archive push". Sources: mos1372/F2 and the other remote findings, mos1372/F7, adversarial/F5 parts 2 to 4.
+- M3: REQ-LIB-8's gate bullet has four conditions, adding the remote. Sources: the remote findings, critic/C1 and C2 edit 2.
+- M4: the 1.17 note on when conversion opens restates the four conditions and drops W4b. Sources: jason/F5, the remote findings.
+- M5: Item 2 rewritten with the remote rules. Sources: the remote findings.
+- M6: the 1.12 gating note rewritten. Sources: anchors/F6, jason/F5.
+- M7: REQ-LIB-9 gains the split pane, the pin, the thesaurus, the license bar and the runtime load rule, and cites more of the design. Sources: jason/F1, critic/C4, critic/C3, nit/anchors/F12, nit/gyro571/F9.
+- M8: REQ-LIB-2, the one-way bullet and the C1 note keep a playground DOCX out of canon in 1.17. Sources: mos1372/F8, adversarial/F2.
+- M9: REQ-LIB-5 says what the reader can't read, and the import turns web links into plain text. New J-j. Sources: critic/C1, critic/C2.
+- M10: an exclusion of a whole book folder covers that book's DOCX documents. Source: adversarial/F3, with B5.
+- M11: the human-verbs sentence and the 571 list item name `library.convert` and REQ-WAIT-1. Sources: gyro571/F1, adversarial/F8 item 3, critic/C6.
+- M12: J-b rewritten. Sources: mos1372/F9, jason/F2, anchors/F5, gyro571/F3, critic/C6.
+- M13: J-d puts the agent read model to Jason as his call. Source: mos1372/F1.
+- M14: Status moves to version 1.17 and names REQ-LIB-9. Sources: anchors/F2, mos1372/F4, critic/C7.
+- M15: the 1.17 source line quotes Q235 in full (mos-1446) and the REQ-LIB-9 sources, at b99ca86b9. Sources: critic/C5, anchors/F9, jason/F8 pin part, nit/gyro571/F8, critic/C6 pin part.
+- M16: the 571 list lead names the two replaced design parts and the landed design. Sources: anchors/F9, anchors/F8, adversarial/F8 item 1, jason/F8, critic/C6.
+- Landing swap: Gyro's docs round for R5, R6 and R14 landed as b99ca86b9 (Fenton fenton-0015), so M15 and M16 cite b99ca86b9 in place of 767bb62c7, as the d8 fix list's header says. J-b keeps 767bb62c7 for its line numbers.
+- M17: W4 section numbers in the remote item and the lookups note. Sources: gyro571/F5, nit/adversarial/F11.
+- M18: the D7 landing line. Sources: gyro571/F5, the remote findings.
+- M19: a logged event for each import stage, in REQ-LIB-8 and A2. Source: gyro571/F7.
+- M20: the Risks line on restores adds the whole-host case. Sources: adversarial/F6, gyro571/F7.
+- M21: the 571 restore item adds the whole-host case. Source: adversarial/F6.
+- M22: the graph Risks line and the REQ-LIB-5 note name a Console view. Sources: anchors/F5, jason/F2.
+- M23: the d6 B3 line drops "F42 wins". Source: anchors/F6.
+- M24: new Markdown in a converted book, with the old-path and playground exceptions. Source: mos1372/F6.
+- M25: J-c's last sentence is Mos's reading. Source: mos1372/F10.
+- M26: J-h rewritten with the D13 defaults. Source: jason/F3.
+- M27: Item 4 rewritten. Sources: jason/F4, gyro571/F4, decisions.unmarked_folders.
+- M28: the "Not taken" note on unmarked folders. Sources: jason/F4, gyro571/F4, decisions.unmarked_folders.
+- M29: the import refuses an unmapped file. Sources: gyro571/F4, decisions.unmarked_folders.
+- M30: placement notes for REQ-LIB-8, REQ-LIB-9 and the Risks lines. Sources: anchors/F3, nit/anchors/F14.
+- M31: REQ-LIB-4's title and the D11 landing line. Source: decisions.n14.
+- M32: the Q236 note limits the 1.12 Obsidian note to Markdown files. Source: critic/C8.
+- M33: the exclusion note adds path exclusions of DOCX documents. Source: anchors/F7.
+- M34: A9 moves from "Mine" to the impact-map list. Source: decisions.exclusion_by_id.
+- M35: the D5 landing line. Sources: anchors/F10, mos1372/F5, nit/adversarial/F12.
+- M36: the D9 and D14 landing lines. Source: mos1372/F1.
+- M37: the O1 and C3 notes add the off-host remote and its confirmation. Sources: the remote findings.
+- M38: the REQ-PROJ-3 note. Source: nit/anchors/F11.
+- M39: REQ-LIB-5's freshness sentence keys on the editor reporting a save as committed. Source: nit/adversarial/F9.
+- M40: REQ-LIB-6 bars agent requests for a conversion and allows a suggestion in chat. Source: nit/jason/F9.
+- M41: REQ-LIB-2's opening and old-path rule, and the "Mine" note. Source: nit/adversarial/F10.
+- M42: REQ-LIB-8's lead sentence on Markdown story files. Source: nit/mos1372/F12.
+- M43: REQ-LIB-6's citation sentence. Source: nit/anchors/F13.
+- M44: REQ-LIB-5's version tag uses plain quotes. Source: nit/anchors/F15.
+- M45: reference codes B5, D12, D10 and B4 name their source. Source: nit/mos1372/F11.
+- Files the row would own: four files, with the id count going to 87. Sources: anchors/F1, adversarial/F4, decisions.n14 F4.
+
+## d7 changes (mos-1379, Fenton's 571 B2)
+
+- REQ-LIB-5 gains Mos's three sentences after the extracted-text sentence. The text agents read has tracked changes accepted. Comments, and text with tracked deletions shown, each wait for a setting only a human turns on, off by default. Its version tag cites Q222 for the two settings, which is the only text here beyond Mos's.
+- J-d gains Mos's sentence on comments and tracked deletions.
+- Fenton's B1 is design only. d6's "no agent credential reaches it" holds (R8 replaces it in d8), and the shared helper stays #431.
+
+## d6 changes (Webby round 3, webby-0207)
+
+- B1: titles for REQ-LIB-8 and REQ-LIB-9 in the requirements.json note and the file list. REQ-LIB-9 takes Webby's title. REQ-LIB-8 keeps mine, because Webby's ("...one-way import that archives the Markdown under its old path") leaves out D2's story files started in the editor.
+- B2: REQ-LIB-2 makes a Markdown file at a converted file's old path unmapped, ahead of the playground and canon rules, so a playground conversion is covered too. REQ-LIB-8's old-path bullet says "neither canon nor playground".
+- B3: the slice note names Q226 F42's three rows (C2-02, C2-03b, C2-11b). C2-11a joined the slice with C2-11b, because C2-11b needs it. Both are slice rows that don't gate 10-27, as design 9.2, case2-rows.md:1655 and the impact map's A57 say. The 'F42 wins' sentence is gone from the note in d8, so no queue change follows from it.
+- N10: the cite-scope replacement is scoped to REQ-LIB-2. The 1.14 note's copy stays.
+- N11: the notes say REQ-LIB-8 adds the by-id exclusion form REQ-LIB-3 doesn't have.
+- N12: J-h marks the autosave intervals for Jason.
+- N13: J-b names REQ-LIB-5's "Connections are always visible" tag and Q226's "another way to handle the visual brain map".
+- N14, not taken: REQ-LIB-4's title stays internal F3's text, as mos-1372 D11 ruled. Webby's alternative, "...and agents read Markdown from it alone" (120 chars), is Mos's call.
+
+## Where each mos-1372 item landed
+
+- D1: REQ-LIB-2's DOCX sentences, the REQ-LIB-8 lead and import bullet, C1 above, and the notes. "Playground files stay Markdown in 1.17" is gone.
+- D2: REQ-LIB-2's "for one the human starts in the editor" and the REQ-LIB-8 new-story-file bullet. The universe-and-book note is now true.
+- D3: the REQ-LIB-8 order bullet. This also settles N8.
+- D4: REQ-LIB-8's one-way bullet, which carries the archive refusal and consequence F2's text, and the 571 list item.
+- D5: it landed in REQ-LIB-2's "a Markdown file at a converted file's old path is unmapped" in Webby's B2 form, and in the REQ-LIB-8 old-path bullet.
+- D6: REQ-LIB-5's freshness sentences.
+- D7 and mos-1375: REQ-LIB-4's remote sentences, the remote step in REQ-LIB-8's order bullet, the fourth opening condition and the 1.17 note on when conversion opens, plus the 571 list item on W4 section 7.3, which replaces the no-remote rule of the old W4 section 7.4. The impact map's item 2 adds "only the stack's host pushes, and no agent credential reaches it", which R8 words in d8 as "no agent can reach it with any credential".
+- D8: the REQ-LIB-5 replacement, the import bullet's wiki-link sentence, the Risks line, the note quoting the old sentence, and "REQ-LIB-1 only gains sentences".
+- D9: the 1.17 note that agents read a converted story file through the Case 2 lookups, from the d4 check's consistency B2, and J-d, which puts the read model to Jason as his call.
+- D10: the d4 check's B5 sentence, in REQ-LIB-8.
+- D11: internal F3's clause in the REQ-LIB-4 section, and in the notes the title as Mos amended it for N14.
+- D12: the whole 1.16 sentence replaced, and quoted in full in the notes.
+- D13: consequence F1's text, in REQ-LIB-4 and REQ-LIB-8's first bullet.
+- D14: the row text from the d4 check's consistency B1, in the mark-and-move bullet and C3 above.
+
+## What d5 adds beyond mos-1372 (for Webby and Mos to check)
+
+From the impact map, folded as mos-1368 item 1 asked:
+- A1: the Console shows a cite's format and converted state (REQ-LIB-2).
+- A2: the logged events and the several-humans setting, default owner only, under Q222.
+- A3: the import is outside the vocabulary, the hard-wait list is unchanged, and the archive move isn't `data.delete`. The C6 code site is in the 571 list.
+- A4: the section lead and REQ-LIB-1's writing-store sentence.
+- A6: format and location in every answer, extracted text with DOCX locators, links across formats.
+  - A6's named chapter-links view. D8 took B8's "no graph shows them yet", and J-b put the view to Jason. His O2 (Q239) takes it in d9 as REQ-LIB-5's Connections view (mos-1443 R3).
+- A7: read-only extends to the store and the archive, no agent action on a story file in any format, no agent DOCX write, and role contracts state the formats. C1's role contract line is a 571 build item.
+- A8: the DOCX cite shape, and a cite naming an archived file as current is refused.
+- A9: a hybrid sees a source's DOCX canon through REQ-LIB-2's source scope, and REQ-LIB-8 lets an exclusion name a DOCX document by its id. The id form lets the human exclude a single DOCX started in the editor, which has no old path. An archived file isn't canon, so no hybrid sees it.
+- A10: REQ-LIB-9, so the count is 87, not 86.
+- A11: the Hermes gate, from item 3.
+- A12: the C2-19 promotion sentence.
+- A13: the broker's path check treats the archive folder as story.
+- A14 and C5: two Risks lines.
+- A15: the flagged-new-file bullet. It sits beside the note from the d4 check's B4, "a new Markdown file in a book folder is still canon". The file stays canon and is offered for import.
+- A16: three titles change and two stay.
+- C2: manifest order for the manuscript lookup.
+- F3: the C2-02 gating note.
+- F4: Mos's measurement.
+
+Mine, beyond either source:
+- REQ-LIB-2 opens "A Markdown file's scope comes from its path and from past imports". DOCX scope comes from the source, so "a file's" would be false.
+- REQ-LIB-9's autosave sentence. It is Mos's reading of F41's "instantly committed", with human-set intervals. The exact intervals stay in the design.
+
+Not taken:
+- Impact map item 4's "files in unmarked folders are eligible one at a time", for folders outside every book folder and playground only. Their files are unmapped under REQ-LIB-2, so a DOCX made from one would have no universe or book to keep. The human maps such a folder into a book folder or a playground first, under REQ-LIB-1. A file in an unmarked folder inside a book folder or a playground is canon or playground, and the import takes it one file at a time.
+
+## Marked for Jason (additions in the text he sees)
+
+- J-a. Whether "We will not run the systems in parallel" applies per chapter or as one switch per book. His call. As written, it applies per chapter.
+- J-b. A converted chapter's DOCX is not in Obsidian's graph. Obsidian shows the chapter only through its archived Markdown, and no DOCX edit reaches that file's links. REQ-LIB-5 still cites two TARGET lines, "Visualization of data via Obsidian or equivalent is required" and "Connections are always visible". Mos's reading was that 1.17 as d8 wrote it met neither line for converted chapters. Their current links showed to the user only as clickable text inside the editor, and no graph or list showed them. Q226 leaves room for "another way to handle the visual brain map". The O2 design that landed for Vikunja 571 at 767bb62c7 held a Console Connections view and its tests as later work that waited for this answer. His call was whether 1.17 requires that view. As d8 was written, it did not. Mos recommended that it does, because impact map A6 says "Recommended: name the view" and TARGET says "Connections are always visible". Jason answered O2 (Q239): 1.17 requires the view. d9 writes it into REQ-LIB-5, its note and the Risks line, in the text of mos-1443 R3. The view comes with the conversion work after 10-27, and the 10-27 Case 2 release stays on Markdown (Q235 P6, Q237). That the import does not wait for the view is Mos's default in mos-1443 R3. Q239 doesn't address it, and Mos confirmed it at his J-b check (mos-1470).
+- J-c (mos-1374): "The store pushes to a remote (D7), and the Case 2 VM is in the nightly PBS backup. For a fixed restore point before her first real import, a manual backup of VM 1012 with PBS protect runs first. That step is reversible and needs no reboot." Mos's reading is that this sits inside the P5 go step, so it needs no new question.
+- J-d. How agents read a converted chapter, D9. His call. As written, an agent reads it through the ordinary Case 2 lookups in any thread or room, under the same project and universe access as Markdown canon. This is Mos's reading of F41 and REQ-LIB-7. The other choice is the model in the earlier O2 design, W4 sections 7.1 and 7.2. Under it, an agent reads a converted chapter only in a new writing conversation that holds one human and one agent, only after the business owner grants that agent access to that document, and by default only what the human attaches to each message. Comments and tracked deletions stay hidden from agents until a human turns on a setting for each. Markdown has neither, so the default keeps agents at the access Markdown gives them. Those two sentences are Mos's ruling mos-1379. A yes to the text as written settles it.
+- J-e. Versioning means the editor's tracked changes plus one git commit per save.
+- J-f. A converted chapter can be edited only in the Console while the stack is reachable. Obsidian no longer edits it offline.
+- J-g. The import takes Markdown only. Importing .doc files stays a separate task.
+- J-h. Autosave under REQ-LIB-9. Jason's Q226 F41 says "All changes are instantly committed and available to the agents." Mos's reading, recorded with that ruling, is "Each save is a commit at once, and agents read it at their next lookup." At the O2 design's D13 defaults, a save commits at most 2 seconds after a pause in typing or 15 seconds into steady typing, with no human action needed. Mos's reading in mos-1359 counts that delay as "instantly committed". Only a human changes the intervals. The PRD names no values, and the defaults stay in the design. Whether a delay of seconds fits his word "instantly" is his call, so this is marked for him.
+- J-i. In 1.17 a playground story that is DOCX can't become canon. That covers a playground Markdown file the human imports, a story the human starts in a playground in the editor, and the DOCX of a draft universe after it is made real. Today Melanie promotes a playground file by moving it into a book folder in Obsidian, and a DOCX in the writing store can't be moved that way. She can start a new story in the book and paste the text in, but it gets a new document id and the playground copy keeps the history. A later version adds DOCX promotion with C2-19, which comes after the slice.
+- J-j. Web links, text boxes and fields in a converted chapter. Jason's Q226 F41 says "All changes are instantly committed and available to the agents." The reader in this version can't read a web link, a text box, a field or hidden text. As written, the import turns each web link into plain text that keeps its label and address, and the human confirms that in the fidelity report. A web link that can't be kept safely as plain text refuses the import. If a later edit adds one of these, the save keeps it and the editor warns the human. Agents then get none of that part's text until a save takes it out.
+- J-k. The 1.12 note Jason approved says bus writes, C2-02 and C2-03b, don't gate 10-27. His Q226 "F42: ok" moved them into the 10-27 slice, and design 9.2 counts them in the smallest slice that lets Melanie start. Mos reads that as making them gate 10-27. The editor rows C2-11a and C2-11b still don't gate it, per his Q195 words "we need to get it moving as an add-on".
+- J-l. REQ-LIB-9 does not use REQ-PROJ-3's "permissive license" bar. It takes the licenses that the editor's independent security review accepted, because that review cleared fonts under the SIL Open Font License and the Ubuntu Font License, which not every reader counts as permissive. Mos's reading.
+
+Marked as changes beyond P1 to P6, from the impact map (Q17, item 5):
+- A1 (archived scope and canon cites)
+- A2 (the conversion requirement, REQ-LIB-8)
+- A3 (outside the vocabulary, hard-wait list unchanged)
+- A6 (lookups across formats)
+- A7 (agent bounds)
+- A8 (DOCX cites)
+- Item 2 and mos-1375: each writing-store commit is pushed to a remote off the stack's host. Only a human sets it, it starts unset, and a repository on the stack's host doesn't count. Only the stack's host pushes to it, and no agent can reach it with any credential. Import and new story files stay closed until the remote is set and checked, and each import's archive push waits until the remote holds the DOCX commit. This keeps "Git is used for all changes -- local and remote" true for DOCX chapters.
+- Item 3 (the Hermes gate)
+- Item 4. Canon and playground story files convert one file at a time, including files in unmarked folders inside a book folder or a playground. Type-folder and supporting files stay Markdown. A story file outside every book folder and playground has no universe or book, so it converts only after a human maps its folder into a book folder or a playground. The mapping step is Mos's reading of P1 and Q30.
+
+The F4 measurement goes with them.
+
+## Files the row would own
+
+The id count goes from 85 to 87. 1.16 owned three files because its count stayed at 85. Like 1.13, the last version that added ids, the row owns four files:
+- `docs/prd/mosaic-stack.md`
+- `packages/tasks/requirements.json`: the version 1.17, the two new ids REQ-LIB-8 and REQ-LIB-9 with their titles, and the changed titles of REQ-LIB-1, REQ-LIB-2 and REQ-LIB-4. The new ids go after REQ-LIB-7 and before REQ-INST-1, in the same order as the PRD's bullets.
+- `packages/tasks/tests/requirements.test.mjs`: the version pin 1.17, the id count of 87, and the duplicate-id message, which goes from `requirements[85].id: REQ-ROLE-1 twice` to `requirements[87].id: REQ-ROLE-1 twice`.
+- `packages/bus/tests/requirements.test.mjs`: the list length, which goes from 85 to 87.
+
+The gate would match 1.16's:
+1. A reviewer approves the text.
+2. Jason says yes to the exact text through Mos.
+3. Both `requirements.test.mjs` files, in `packages/tasks/tests` and `packages/bus/tests`, and every `scripts/test-*.sh` that reads the PRD or `requirements.json` are green on Sage's gate.
+4. Mos gets the landing commit.

agents/sage/work/prd-1-17/d8-to-d9.diff

@@ -0,0 +1,132 @@
+--- DRAFT-d8.md	2026-10-23 06:16:54.374694135 -0500
++++ DRAFT-d9.md	2026-10-23 10:40:54.806553704 -0500
+@@ -1,6 +1,6 @@
+ # PRD 1.17 draft: Case 2 story files are DOCX (Q235 to Q237, P1 to P6)
+ 
+-Sage, 2026-10-23, for mos-1366 item 1 and Vikunja 570. Draft 8. It is d7 plus Mos's d8 fix list mos-1443 (see "d8 changes"). d7 is d6 plus Mos's ruling mos-1379 on Fenton's 571 B2 (see "d7 changes"). d6 is d5 with Webby's round 3 (webby-0207) fixed: B1 to B3 and N10 to N13, with N14 left for Mos (see "d6 changes"). d5 folds in:
++Sage, 2026-10-23, for mos-1366 item 1 and Vikunja 570. Draft 9. It is d8 plus Jason's Q41 answer O2 (DECISIONS Q239, mos-1467), which makes J-b yes, Webby's round 5 N15 to N17 (webby-0210) and Webby's round 6 B1, N19 and N20 (webby-0212) (see "d9 changes"). d8 is d7 plus Mos's d8 fix list mos-1443 (see "d8 changes"). d7 is d6 plus Mos's ruling mos-1379 on Fenton's 571 B2 (see "d7 changes"). d6 is d5 with Webby's round 3 (webby-0207) fixed: B1 to B3 and N10 to N13, with N14 left for Mos (see "d6 changes"). d5 folds in:
+ - Mos's d4 check ruling mos-1372 (D1 to D14; D15 was dropped).
+ - mos-1374, which replaces J-c.
+ - The impact map mos-1368 (jason-master-restart d183246, `projects/mosaic-mvp/case2-docx-impact-map.md`: A1 to A16, critic items C1 to C6, items 2 to 7).
+@@ -103,10 +103,11 @@
+ 
+ ### REQ-LIB-2
+ 
+-Replace "A file's scope comes from its path alone, prefixes first: a Markdown file
+-under a supporting prefix is supporting, one under a playground prefix at any level
+-is playground, any other Markdown file in a book folder is canon, and everything
+-else is unmapped and never returned. A folder in both lists is supporting." with:
++Replace "A file's scope comes from its path alone, prefixes first: a Markdown
++file under a supporting prefix is supporting, one under a playground prefix at
++any level is playground, any other Markdown file in a book folder is canon, and
++everything else is unmapped and never returned. A folder in both lists is
++supporting." with:
+ 
+ "A Markdown file's scope comes from its path and from past imports, prefixes
+ first: a Markdown file under the archive folder is archived, one under a
+@@ -191,10 +192,13 @@
+ Replace "The user sees them in Obsidian's graph and backlinks." with "The user sees
+ a Markdown file's links in Obsidian's graph and backlinks. A DOCX story file's
+ wikilinks stay clickable in the Console's editor (O2 design D11), and no graph
+-shows them yet."
++shows them yet. The Console's Connections view lists the current links and
++backlinks of each story file the user may see, in both formats, with each one's
++scope and format."
+ 
+ Version tag: 'and "Connections are always visible".)' becomes 'and "Connections
+-are always visible". Version 1.17, with Q222 for the two settings.)'
++are always visible". Version 1.17, with Q222 for the two settings and Q239 for
++the Connections view.)'
+ 
+ ### REQ-LIB-6
+ 
+@@ -273,8 +277,9 @@
+   - Each stage of an import writes a logged event. The import's record on the
+     stack's host names the source file's path, commit and blob and the new
+     document id, and each event points to that record.
+-  - After a conversion, a Markdown file at the converted file's old path is neither
+-    canon nor playground. Lookups leave it out, the format map flags it, and the human is told.
++  - After a conversion, a Markdown file at the converted file's old path is
++    neither canon nor playground. Lookups leave it out, the format map flags it,
++    and the human is told.
+   - A new Markdown story file in a book folder that holds converted files stays
+     canon until its import, unless it sits at a converted file's old path or under
+     a playground prefix. The Console flags it and offers the import. Nothing
+@@ -413,8 +418,8 @@
+       push within about a minute."
+     - REQ-LIB-5, the 1.16 sentence: "The user sees them in Obsidian's graph and
+       backlinks." A converted chapter's connections show in Obsidian only as they
+-      stood at conversion, until a Console view of their links exists. Q226
+-      records that view as a later option.
++      stood at conversion, and the Console's Connections view shows their
++      current links.
+     - REQ-LIB-6, the 1.16 sentence: "A reply may cite lines of the repository at
+       a commit or pages the agent fetched, and the broker checks every citation
+       before it stores the message."
+@@ -451,8 +456,8 @@
+   not `git diff`. (Version 1.17.)"
+ - "A converted chapter's DOCX is not in Obsidian's graph. Obsidian shows the
+   chapter only through its archived Markdown, and no DOCX edit reaches that file's
+-  links. The DOCX's current links show only in the Console's editor until a
+-  Console view of them exists. (Version 1.17.)"
++  links. The DOCX's current links show in the Console's editor and its
++  Connections view, and no graph shows them yet. (Version 1.17.)"
+ - "Conversion can't be undone in place. Front matter, wiki link forms and
+   unsupported blocks may not survive it, and the mirror can't refuse the user's
+   push to an archived file. The controls are the fidelity report, the human's
+@@ -467,6 +472,15 @@
+   import events, and the import's recovery covers both cases (Vikunja 571).
+   (Version 1.17.)"
+ 
++## d9 changes (Q239 and Webby round 5)
++
++- J-b yes (Q239, mos-1467), in the five edits mos-1443 R3 set for a yes (Webby round 6 B1). R3.1: REQ-LIB-5's replacement gains the Connections view sentence after "no graph shows them yet.". R3.2: the graph Risks line ends with the editor and the Connections view. R3.3: the A6 line moves from "Not taken" under A6. R3.5: the REQ-LIB-5 note ends with the Connections view, which drops "until a Console view of their links exists" and "Q226 records that view as a later option". R3.4 is Gyro's design edit at 767bb62c7 (writing-editor.md:188-190, :240-244 and :1272, docx-citations.md:66), and it follows in his docs round. Beyond these and N21, nothing else in the PRD text changes.
++- N19 and N20 (Webby round 6): J-b's question text is in the past tense, and the line that the import doesn't wait for the view is cited as Mos's R3 default. Mos confirmed it at his J-b check (mos-1470).
++- N21 (Webby round 6, Mos yes in mos-1470): REQ-LIB-5's version tag cites Q239 for the Connections view beside Q222 for the two settings.
++- N15: the D7 landing line gives R8's wording beside the impact map's quote.
++- N16: the d7 changes line notes that R8 replaces "no agent credential reaches it" in d8.
++- N17: the REQ-LIB-2 Replace quote and the REQ-LIB-8 old-path bullet are rewrapped under 82 columns. Their words are unchanged.
++
+ ## d8 changes (Mos's d8 fix list, check wf_63bba879-180)
+ 
+ - R1: REQ-LIB-4's tail covers DOCX saves, which agents see at their next lookup after the editor reports them as committed. The notes quote the whole 1.16 sentence. Source: nit/jason/F10.
+@@ -535,7 +549,7 @@
+ 
+ - REQ-LIB-5 gains Mos's three sentences after the extracted-text sentence. The text agents read has tracked changes accepted. Comments, and text with tracked deletions shown, each wait for a setting only a human turns on, off by default. Its version tag cites Q222 for the two settings, which is the only text here beyond Mos's.
+ - J-d gains Mos's sentence on comments and tracked deletions.
+-- Fenton's B1 is design only. d6's "no agent credential reaches it" holds, and the shared helper stays #431.
++- Fenton's B1 is design only. d6's "no agent credential reaches it" holds (R8 replaces it in d8), and the shared helper stays #431.
+ 
+ ## d6 changes (Webby round 3, webby-0207)
+ 
+@@ -556,7 +570,7 @@
+ - D4: REQ-LIB-8's one-way bullet, which carries the archive refusal and consequence F2's text, and the 571 list item.
+ - D5: it landed in REQ-LIB-2's "a Markdown file at a converted file's old path is unmapped" in Webby's B2 form, and in the REQ-LIB-8 old-path bullet.
+ - D6: REQ-LIB-5's freshness sentences.
+-- D7 and mos-1375: REQ-LIB-4's remote sentences, the remote step in REQ-LIB-8's order bullet, the fourth opening condition and the 1.17 note on when conversion opens, plus the 571 list item on W4 section 7.3, which replaces the no-remote rule of the old W4 section 7.4. The impact map's item 2 adds "only the stack's host pushes, and no agent credential reaches it".
++- D7 and mos-1375: REQ-LIB-4's remote sentences, the remote step in REQ-LIB-8's order bullet, the fourth opening condition and the 1.17 note on when conversion opens, plus the 571 list item on W4 section 7.3, which replaces the no-remote rule of the old W4 section 7.4. The impact map's item 2 adds "only the stack's host pushes, and no agent credential reaches it", which R8 words in d8 as "no agent can reach it with any credential".
+ - D8: the REQ-LIB-5 replacement, the import bullet's wiki-link sentence, the Risks line, the note quoting the old sentence, and "REQ-LIB-1 only gains sentences".
+ - D9: the 1.17 note that agents read a converted story file through the Case 2 lookups, from the d4 check's consistency B2, and J-d, which puts the read model to Jason as his call.
+ - D10: the d4 check's B5 sentence, in REQ-LIB-8.
+@@ -573,6 +587,7 @@
+ - A3: the import is outside the vocabulary, the hard-wait list is unchanged, and the archive move isn't `data.delete`. The C6 code site is in the 571 list.
+ - A4: the section lead and REQ-LIB-1's writing-store sentence.
+ - A6: format and location in every answer, extracted text with DOCX locators, links across formats.
++  - A6's named chapter-links view. D8 took B8's "no graph shows them yet", and J-b put the view to Jason. His O2 (Q239) takes it in d9 as REQ-LIB-5's Connections view (mos-1443 R3).
+ - A7: read-only extends to the store and the archive, no agent action on a story file in any format, no agent DOCX write, and role contracts state the formats. C1's role contract line is a 571 build item.
+ - A8: the DOCX cite shape, and a cite naming an archived file as current is refused.
+ - A9: a hybrid sees a source's DOCX canon through REQ-LIB-2's source scope, and REQ-LIB-8 lets an exclusion name a DOCX document by its id. The id form lets the human exclude a single DOCX started in the editor, which has no old path. An archived file isn't canon, so no hybrid sees it.
+@@ -593,12 +608,11 @@
+ 
+ Not taken:
+ - Impact map item 4's "files in unmarked folders are eligible one at a time", for folders outside every book folder and playground only. Their files are unmapped under REQ-LIB-2, so a DOCX made from one would have no universe or book to keep. The human maps such a folder into a book folder or a playground first, under REQ-LIB-1. A file in an unmarked folder inside a book folder or a playground is canon or playground, and the import takes it one file at a time.
+-- A6's named chapter-links view. D8 takes B8's "no graph shows them yet", and J-b puts the view to Jason.
+ 
+ ## Marked for Jason (additions in the text he sees)
+ 
+ - J-a. Whether "We will not run the systems in parallel" applies per chapter or as one switch per book. His call. As written, it applies per chapter.
+-- J-b. A converted chapter's DOCX is not in Obsidian's graph. Obsidian shows the chapter only through its archived Markdown, and no DOCX edit reaches that file's links. REQ-LIB-5 still cites two TARGET lines, "Visualization of data via Obsidian or equivalent is required" and "Connections are always visible". Mos's reading is that 1.17 as written meets neither line for converted chapters. Their current links show to the user only as clickable text inside the editor, and no graph or list shows them. Q226 leaves room for "another way to handle the visual brain map". The O2 design that landed for Vikunja 571 at 767bb62c7 holds a Console Connections view and its tests as later work that waits for this answer. His call whether 1.17 requires that view. As written, it does not. Mos recommends that it does, because impact map A6 says "Recommended: name the view" and TARGET says "Connections are always visible".
++- J-b. A converted chapter's DOCX is not in Obsidian's graph. Obsidian shows the chapter only through its archived Markdown, and no DOCX edit reaches that file's links. REQ-LIB-5 still cites two TARGET lines, "Visualization of data via Obsidian or equivalent is required" and "Connections are always visible". Mos's reading was that 1.17 as d8 wrote it met neither line for converted chapters. Their current links showed to the user only as clickable text inside the editor, and no graph or list showed them. Q226 leaves room for "another way to handle the visual brain map". The O2 design that landed for Vikunja 571 at 767bb62c7 held a Console Connections view and its tests as later work that waited for this answer. His call was whether 1.17 requires that view. As d8 was written, it did not. Mos recommended that it does, because impact map A6 says "Recommended: name the view" and TARGET says "Connections are always visible". Jason answered O2 (Q239): 1.17 requires the view. d9 writes it into REQ-LIB-5, its note and the Risks line, in the text of mos-1443 R3. The view comes with the conversion work after 10-27, and the 10-27 Case 2 release stays on Markdown (Q235 P6, Q237). That the import does not wait for the view is Mos's default in mos-1443 R3. Q239 doesn't address it, and Mos confirmed it at his J-b check (mos-1470).
+ - J-c (mos-1374): "The store pushes to a remote (D7), and the Case 2 VM is in the nightly PBS backup. For a fixed restore point before her first real import, a manual backup of VM 1012 with PBS protect runs first. That step is reversible and needs no reboot." Mos's reading is that this sits inside the P5 go step, so it needs no new question.
+ - J-d. How agents read a converted chapter, D9. His call. As written, an agent reads it through the ordinary Case 2 lookups in any thread or room, under the same project and universe access as Markdown canon. This is Mos's reading of F41 and REQ-LIB-7. The other choice is the model in the earlier O2 design, W4 sections 7.1 and 7.2. Under it, an agent reads a converted chapter only in a new writing conversation that holds one human and one agent, only after the business owner grants that agent access to that document, and by default only what the human attaches to each message. Comments and tracked deletions stay hidden from agents until a human turns on a setting for each. Markdown has neither, so the default keeps agents at the access Markdown gives them. Those two sentences are Mos's ruling mos-1379. A yes to the text as written settles it.
+ - J-e. Versioning means the editor's tracked changes plus one git commit per save.

agents/scrooge/work/queue-252/BUILD.md

@@ -0,0 +1,269 @@
+# Row 252 build notes: Console inbox Approve and Deny for grant requests
+
+Seat: Scrooge. Reviewer: Webby. Issue #1753, Vikunja #435 (J2).
+Brief: `docs/plans/2026-10-21_console-inbox-approve.md` (blob b41676d06).
+Design: Gander's DESIGN.md at d218e14bd, approved by Webby at 5d8f0f4b5 (webby-0082) with manifest checks N1-N5.
+Base: aca16404c on branch `scrooge/row252`. Rebase onto the row 253 tip under a new branch name once 253 lands.
+
+## Status
+
+- Code, tests and docs are written. No test has been run yet, because Gander holds the gate slot for row 253 run 5 and Sage ruled no node until a CLEAR.
+- Everything in the Results section is empty until that run. Nothing below claims a pass.
+
+## Q188
+
+No agent creates a grant. Approve and Deny are human-only Console actions.
+
+- Only a console cap reaches `decision.preview.console` and `decision.resolve.console`. A console cap reaches nothing else (console-decide `J1, Q188`).
+- The socket refuses a console proof for any other verb before the proof check (`server.mjs`).
+- A console cap binds only through `authenticateConsole`, which needs the console proof (section 2): the same-tree `console-cli.mjs` wrapper, its own nonce, a direct same-tree `serve` parent, and a configured owner subject from the spawn environment.
+- `recordEvent` keeps `human.input` reserved, so no agent writes the record that lets a console close start the executor (console-decide `recordEvent keeps human.input reserved`).
+- A `via console` close without its matching `human.input` approves nothing (console-decide `J14`).
+
+## Manifest checks N1-N5
+
+- **N1.** Every `console.sso` subject is an owner of the business. Name is display only.
+  - `cli/src/config.mjs` carries `{provider, iss, sub}` per subject into the boot as `consoleOwners`. No sso means no key.
+  - `bus/src/runtime.mjs` validates the list (array, at most 512, exactly three non-empty strings each) and passes it to `verifyPrincipal`.
+  - Tests: cli config.test `Row 252 (Webby N1)` and principal.test.
+- **N2.** `human.input` is written in the same transaction, before `#approvedGrant`. The executor starts once, and a deny starts none.
+  - Tests: console-decide `N2, J13` checks the order by seq and that the grant runs once. `J15` checks that a deny starts nothing.
+- **N3.** The close notice comes from `from_run 'human-console'`, and `public/bus.js` shows "via console". `landing` and `#protectedEnd` stay CLI-only.
+  - Tests: console-decide `N2, J13` checks the notice. decide-browser `J17` checks the close-elsewhere line.
+- **N4.** `decision.resolve` is not a Console verb.
+  - `CONSOLE_VERBS` is exactly the two console verbs. The webui serve `BUS_VERBS` read list has no decision verb, and webui `cli.mjs` has no `decision.` string. `consoleCall` refuses anything outside `CONSOLE_VERBS`.
+  - Tests: console-decide `N4`, and decide-sso `N4`, which hits `/api/bus/decision.*` for 404 and covers the cli.mjs scan and the consoleCall refusals.
+- **N5.** `readProcess` keeps the five `MOSAIC_BUS_CONSOLE_*` keys in the env allowlist (`bus/src/human.mjs`). The human proof and its spawn are unchanged.
+
+## Design choices and tradeoffs
+
+- **Webui imports from the broker.** `webui/src/bus.mjs` imports `CONSOLE_VERBS` from `bus/src/broker.mjs`, which loads the broker module into the Console at import.
+  - I chose one source for the verb list over a second copy that could drift.
+  - If Webby prefers the copy, the alternative is a literal list plus a test pinning it equal to `CONSOLE_VERBS`.
+- **The Console transport shares humanCall's spawn.** `consoleCall` and `humanCall` share it as `transport()`, so `webui/src/bus.mjs` changed. The busCaller `business` default keeps `||` (the old falsy semantics), not `??`.
+- **Confirmations are held in memory in the serve process.** Their lifetime is 2 minutes, they are single use, and they bind the session, decision, choice and digest. The cap is a limit that never drops a live confirmation.
+  - A restart loses all held confirmations. The user clicks again and gets a new preview. Nothing is written until the resolve.
+- **No retry anywhere.** A resolve whose bus reply is lost answers `outcome-unknown`, the confirmation is spent, and the page says "Nothing was sent again."
+
+## Old tests changed (for Mos, per mos-1272)
+
+Mos ruled both changes allowed in mos-1321 (17:12:28Z), each with one condition.
+- **shell.test condition:** reword the comment that opened "No Resolve control", since it is false once the row lands. It now says row 252's Approve and Deny is the one decision control, that its labels come from ACTIONS, and that the doesNotMatch keeps any literal label out of the markup. Webby checks the wording in review.
+- **channel-proof condition:** a header comment is not enough, because human.mjs changes what readProcess keeps. In the review, Webby reads the human.mjs and webui bus.mjs diffs and states two things:
+  - the human proof's checks are unchanged
+  - only the console verifier reads the five MOSAIC_BUS_CONSOLE_* keys, and each case is covered by a named test in console-decide or decide-sso
+- **Second row to land (252 or 239):** it recomputes the webui bus.mjs hash, adds its own header line, and its reviewer re-reads bus.mjs from the base to the combined tip.
+
+- **`webui/tests/shell.test.mjs`**, write-boundary test. Allowed under mos-1321, with the comment reworded.
+  - The `writes` list gains the new `fetch(url, ...)` in `decidePost`. It is first in file order (bus.js:362).
+  - The `method:` count goes from 7 to 8.
+  - A new assertion pins `decidePost`'s callers to `url` plus the two literal `/api/decisions/${enc(a.id)}/...` routes.
+  - No existing entry was loosened.
+- **`bus/tests/channel-proof.test.mjs`**, sha256 re-pins with a header comment:
+  - `bus/src/human.mjs` (N5 env keys) to bb13c146…c885.
+  - `webui/src/bus.mjs` (consoleCall and `transport()`) to 701f009e…5272.
+  - Any later edit to either file needs a re-pin.
+- `bus/tests/principal.test.mjs`, `webui/tests/tester-listener.test.mjs` and `cli/tests/config.test.mjs` have new tests appended only.
+
+## Overlap with row 239 (Honker, b0c28366f, sage-2835)
+
+- Row 239 also re-pins `channel-proof.test.mjs`:
+  - `packages/webui/src/bus.mjs`, to 1eba9774…e5cf. That is the pin both rows change.
+  - `packages/cli/src/transport.mjs`, which is 239 only.
+  - `packages/bus/src/human.mjs` is a 252-only pin.
+- The two rows also share source files: `bus/src/broker.mjs`, `bus/src/runtime.mjs`, `webui/src/bus.mjs` and `webui/src/serve.mjs`.
+- Whichever row lands second rebases onto the first and recomputes the webui `bus.mjs` pin from the merged file. Both header comments are kept. It then reruns every touched test file whole.
+- Mos needs to see that re-pin (re-pins need Mos).
+
+## Mutant plan (design section 6, J1-J17)
+
+Each mutant is one edit to the named source. Run the killing test, then restore and compare the sha256 against the pre-mutant hash with `git status` clean apart from the build. Kill rules are written before the runs.
+
+| J | Mutant | Source | Expected kill |
+|---|---|---|---|
+| J1 | eligibility from the request, `#consoleResolution` returns non-null for any decision | broker.mjs | console-decide `J1, J2` (ineligible) |
+| J2 | hardcode `approve = yes`, `deny = no` | broker.mjs | console-decide `J2` (go/stop, deny listed first) |
+| J3 | owner from name or header, skip the owner match in verifyPrincipal | principal.mjs | principal.test `console requires…` |
+| J4 | skip the serve-parent walk | principal.mjs | principal.test `console requires…` |
+| J5 | accept the human nonce namespace | principal.mjs | principal.test `console requires…` |
+| J6 | reuse the session from the confirmation, skip the live session check at resolve | decision-http.mjs | decision-http `session that ends`, decide-sso `listener gates` (new session) |
+| J7 | keep the console cap bound after the call (skip `release` for kind console) | server.mjs | **open**: no new test pins release for a console proof. Before the run, check whether an existing server test kills it. If not, add one and name it in the report. |
+| J8 | skip the same-origin check | decision-http.mjs | decision-http `gates`, decide-sso `listener gates` |
+| J9 | resolve without a confirmation token | decision-http.mjs | decision-http `a confirmation then a resolve`, `bad body` |
+| J10 | drop the choice, decision or session binding | decision-http.mjs | decision-http `binds the session, decision and choice` |
+| J11 | skip the digest, closed or business check | broker.mjs | console-decide `J11`, `N2, J13` (second answer closed) |
+| J12 | do not spend the confirmation | decision-http.mjs | decision-http `a second resolve refuses`, `confirmations… one use` |
+| J13 | write via cli, or omit the subject in human.input | broker.mjs | console-decide `N2, J13` |
+| J14 | `#approvedGrant` accepts via console without the human.input | broker.mjs | console-decide `J14` |
+| J15 | start the executor on any resolved choice | broker.mjs | console-decide `J15` and `J2` (stop starts nothing) |
+| J16 | `decide` true without sso or send | serve.mjs, public/bus.js | decide-sso `J16`, decide-browser `J16` |
+| J17 | retry on outcome-unknown or auto-submit after preview | public/bus.js | decide-browser `J17` (post count stays at 7) |
+
+## Manifest
+
+Source:
+- packages/bus/src/broker.mjs
+- packages/bus/src/client.mjs
+- packages/bus/src/console-cli.mjs (new)
+- packages/bus/src/human.mjs
+- packages/bus/src/principal.mjs
+- packages/bus/src/runtime.mjs
+- packages/bus/src/server.mjs
+- packages/cli/src/config.mjs
+- packages/webui/src/bus.mjs
+- packages/webui/src/cli.mjs
+- packages/webui/src/decision-http.mjs (new)
+- packages/webui/src/public/bus.js
+- packages/webui/src/serve.mjs
+
+Tests:
+- packages/bus/tests/channel-proof.test.mjs (re-pins)
+- packages/bus/tests/console-decide.test.mjs (new)
+- packages/bus/tests/principal.test.mjs
+- packages/cli/tests/config.test.mjs
+- packages/webui/tests/decide-browser.test.mjs (new)
+- packages/webui/tests/decide-sso.test.mjs (new)
+- packages/webui/tests/decision-http.test.mjs (new)
+- packages/webui/tests/shell.test.mjs (old test changed, see above)
+- packages/webui/tests/tester-listener.test.mjs
+
+Docs:
+- packages/webui/README.md
+- agents/scrooge/work/queue-252/BUILD.md (this file)
+
+## Results
+
+Not run. At the first CLEAR:
+1. Run each touched test file whole, with TMPDIR under /mnt/storage/scratch/tmp.
+2. Run the bus, webui and cli suites.
+3. Run the mutants above, then the drift check against refactor.
+
+## Rebase onto fe4ee8c7b (sage-3482, 2026-10-23)
+
+The old base aca16404c had drifted. Since then refactor changed 8 of the row's 24 paths, across 15 commits. I made a new branch, scrooge/row252-fe4ee8c7b, so scrooge/row252 22cc74645 is untouched and nothing was force-pushed. I rebased with local git, `-c core.hooksPath=/dev/null`, and no stash.
+
+Commit map:
+- 4bd273bce -> 1891d36e4 (product and tests; six files conflicted)
+- ca4537cc9 -> 9e5980acd (BUILD.md; clean)
+- 22cc74645 -> 6fd206e80 (shell.test comment and BUILD.md; clean)
+
+Conflicts, all in 4bd273bce, and how each was resolved:
+1. packages/bus/src/broker.mjs, verb lists. On the base, row 206 added the share verbs to USER_VERBS, and row 275 added VIEWER_VERBS, userLevel and BOARD_VERBS and removed the USER_LEVEL const. I kept the base's lists and dropped USER_LEVEL, because nothing on the base reads it. CONSOLE_VERBS goes in after USER_VERBS with its comment unchanged. The request() gate (`!!s.console !== CONSOLE_VERBS.includes(verb)`) auto-merged after the FED R4 access sweep and the user check. Its order relative to the user gate is the same as on the old base.
+2. packages/bus/src/runtime.mjs, startBroker. FED R4 (#1801) added `access.intervalMs` to the access check. I kept the consoleOwners validation and the frozen owners first, as in the row, and then the base's access check with intervalMs.
+3. packages/cli/src/config.mjs. FED R6 (#1800) added accessFor and `config.access`. I kept both: accessFor and then consoleOwners, and in bootConfig `config.access` and then `config.consoleOwners`. process.mjs passes the boot config to startBroker whole, so both keys reach it.
+4. packages/webui/src/cli.mjs. FED R6 moved the owner's bus options into consoleBus() (console-bus.mjs) and added userCaller and userOptions. I kept the base's form, added consoleCall to the bus.mjs import, and added decisionWrite to the declarations. I kept the row's `if (ssoOn && sendOn) decisionWrite = consoleCall(...)` after the consoleBus() call, and pass decisionWrite to startServer next to userOptions and federation.
+5. packages/webui/src/serve.mjs. FED R6 added granted-user sessions: userRoute gates them, and userOptions rebinds the options per request.
+   - The signature now has both decisionWrite and userOptions/federation.
+   - The session hunk keeps the base's signer and granted-user block. ssoSession is set only for a session with no `user`, which is the owner's. A granted user is refused at userRoute before the decision route anyway, because /api/decisions/* is not on userRoute's list. Under the new base this keeps the design section 2 rule that only the owner answers a decision.
+   - /api/config keeps the base's `user` and `federation` keys. `decide` gains `!granted`, matching how the base gates `edit`, so a granted user's config never offers Approve and Deny.
+   - The decisionWrite startup check and createConfirmations() auto-merged unchanged.
+6. packages/bus/tests/channel-proof.test.mjs, webui bus.mjs pin. Row 301 (#1808, mos-1449) moved the user transport into bus.mjs and re-pinned it to 39fcb27c. The row's consoleCall auto-merged on top. I kept row 301's comment and re-pinned to the merged blob's sha256, 604092cb706b152d458f299ff1071f6cd488774629012f96b672f7e9a16c0b2c. The human.mjs pin (bb13c146) auto-merged and matches the blob at the new tip. The row's existing header comment (Webby N5) still describes why bus.mjs is re-pinned. humanCall and transport() are unchanged.
+
+Auto-merged without conflict: webui bus.mjs (consoleCall next to row 301's userCaller), webui README.md, bus client.mjs, human.mjs, principal.mjs, server.mjs and public/bus.js.
+
+Two new-base reads I checked:
+- granted-user.test.mjs reads `/api/config` key by key and has no deepEqual on the whole object, so the extra `decide` key doesn't break it.
+- No other test pins one of the row's source files by sha256, apart from channel-proof.
+
+Not run: no test, node or syntax check during this step. Sage's next CLEAR covers the push, the whole webui, bus and cli suites, every scripts/test-*.sh, and J1-J17. Plugins must show 0 failures (mos-1456/1462). J7 still needs a killer test. The serve.mjs `!granted` and ssoSession lines are new since the build, so they get mutants too. I'll add them to the J list at the run.
+
+## Runs (sage-3488 CLEAR, 2026-10-23)
+
+Gate tree: detached worktree of 3e6de9807 with the canonical node_modules linked, so
+`MOSAIC_REQUIRE_EDITOR_BUILD=1` is set (mos-1453). TMPDIR comes from mktemp under
+/mnt/storage/scratch/tmp. Each step runs under `timeout -k 10` (mos-1275):
+
+| Step | Limit (s) |
+|---|---|
+| pkg bus, cli, plugins, webui, business (`node --test tests/*.test.mjs`) | 1800 each |
+| test-auth / conductor / config / discord / extension-package | 126 / 145 / 130 / 147 / 130 |
+| test-foundation / land-work / queue / release / task | 269 / 171 / 226 / 157 / 231 |
+| mutant single file | 300, chat-browser 600 |
+
+The script limits are 3x the longest runs recorded in queue-253 (receipt 3b91cfdaf).
+
+### First-run reds placed (mos-1272)
+
+- pkg-bus at 3e6de9807: 902 pass, 1 fail. The failure is `N2, J13` in console-decide.test.mjs:180, a new
+  test (0 human.input rows found, 1 expected). The cause is in the test, not the product. `events()` spread
+  the parsed body after the row's `kind`, so an answer body's own `kind: 'answer'` overwrote
+  `'human.input'` and the filter could never match. Three more filters on the same field had the same
+  defect, :250 and :290 (count of human.input must be 0) and :252 (an action.refused exists). The two
+  zero counts passed vacuously. Fix: the row's kind is also kept as `event`, set after the body, and all
+  four filters read `event`. The deepEqual at :181 now names `event: 'human.input'`. The file then ran
+  whole at 11 pass, 0 fail.
+- J7 (open in the plan): no existing test bound a console proof over the socket. The new test
+  `J7: a console proof over the socket binds a cap for its one call and the reply releases it` in
+  console-decide.test.mjs serves a real socket with authenticateConsole, makes one console call that
+  answers and one that refuses (`decision-not-found`), and checks that both caps are released
+  (`unauthenticated`). J7 is applied as `boundCap = kind === 'console' ? null : transient;` in server.mjs,
+  which skips every release path for a console cap (finish, the finally, and socket close). It ran
+  at 11 pass, 1 fail, failing only the new J7 test. KILLED. The restored server.mjs matched its pre-mutant sha256.
+- decide-sso.test.mjs (new) ran 2 pass, 2 fail before any mutant:
+  - `J16`: its `{ send: null }` case reached `setup`, and startServer refused it, because a decision
+    transport without `--send` never starts (serve.mjs guard). That case now asserts the refusal, and the
+    `{ decisionWrite: null }` case still checks the read-only routes and `decide: false`.
+  - `N4`: a POST to `/api/bus/decision.*` gets row 74's preview refusal (403 `read-only`, for every
+    write without a route of its own) before any verb lookup. POST now asserts that refusal and GET
+    still asserts 404. Either way the transport sees no call.
+  - The file then ran whole at 4 pass, 0 fail.
+- Old-test reds, sent to Sage before any fix (status 2):
+  - cli `access-boot.test.mjs` R6 B1-B3 come from this row. The fixture's SSO provider has no issuer,
+    so `consoleOwners` maps `iss: undefined` and startBroker refuses the owner list
+    (`invalid-host-request`). The file is 4/0 on fe4ee8c7b.
+  - cli `compactions-launch.test.mjs` REQ-THREAD-2 T3, 5 tests, each "timed out waiting". They also fail
+    0/5 on a fe4ee8c7b tree, so they are not this row's.
+  - Correction (sage-3492): the compactions-launch reds were the environment, not a base red. The gate
+    TMPDIR (`<gate>/tmp`) was long enough to break the launcher/bwrap paths. Alone in a short
+    `mktemp -d /mnt/storage/scratch/tmp/scrXXXXXX` TMPDIR the file ran 5 pass, 0 fail, 0 skipped, and
+    Sage's own gate ran it green. The file is unchanged.
+
+### Rulings and further placements (sage-3492 to sage-3496)
+
+- access-boot (Mos GO mos-1464, relayed in sage-3494): `access-boot.test.mjs:17`'s `authentik` provider
+  gains `issuer: "https://idp.test"`, and nothing else changes. numstat against fe4ee8c7b reads 1 1.
+  It is committed alone (b316e0a55). access.test.mjs:273 uses the same fixture but never reaches
+  bootConfig, so it is untouched. The file ran 4 pass, 0 fail.
+- decide-browser.test.mjs (new) ran 0 pass, 3 fail before any mutant, then 1 pass, 2 fail after the
+  first fix:
+  - setup's `UPDATE decisions SET question=?` hit migration 3b's `decisions_no_update` trigger, because
+    decisions is append-only. The test now writes its own open credential.mint grant decision, with the
+    hostile question in the INSERT. It is the same two rows host-fixtures' grantDecision writes, and
+    host-fixtures.mjs is unchanged.
+  - `page()` visiting the URL it was already on was a same-document hash change, not a load. So J17's
+    "closed elsewhere" step never re-read the bus, and the redirect test's second visit never redrew
+    after signing out. `page()` now loads about:blank first, as editor-browser.test.mjs:216 does.
+  - The file then ran whole at 3 pass, 0 fail (9e1601a20).
+- decide-sso J16 (sage-3492): the startServer refusal stays. The one config that starts without send
+  also lacks a decision transport, since startServer refuses a transport without `--send`. That config,
+  `{ decisionWrite: null, send: null }`, is now in the J16 loop and gets `decide: false` and the
+  read-only routes. Webby rules in the manifest round.
+- J19 killer (new test in decide-sso.test.mjs): an access document with one granted user (alice). The
+  listener has `--send`, a decision transport and a user transport. The owner's config says
+  `decide: true`. Alice's says `user: true`, `send: true` and `decide: false`. Her POSTs to both
+  decision steps get 403 `owner-only`, and the transport sees no call.
+- J18 is equivalent alone, because a granted session never reaches decisionHTTP. At serve.mjs:694 a
+  session with `user !== undefined` meets `userRoute` before the decision branch. userRoute admits only
+  `/api/chat*` and GETs of `/api/config` and the user files, never `/api/decisions/*`, so the 403
+  `owner-only` comes before `ssoSession` is read. The `session.user === undefined` guard is a second
+  layer behind that. The J19 test's owner-only POSTs pin the first layer.
+- J11c is equivalent. `s.human !== b.human` at broker.mjs:5604 can't hold for a console cap:
+  - bindConsole (broker.mjs:1459) refuses `record.human !== b.human` with `human-required`.
+  - Its cap carries `human: b.human` for its own business, and #cap freezes the session (:1094).
+  - At resolve, `b` is `this.#business(s.business)` (:5324), the same business.
+  - reloadBusiness refuses a document whose human differs (:517).
+  So for any session with `s.console` set, the two humans are equal. Webby rules on it in the
+  manifest round.
+- Mutants, part 2, on the tip test files (decide-sso 5/0, decide-browser 3/0 as the baseline).
+  Every restore matched its pre-mutant sha256.
+  - J16a: KILLED by decide-sso J16.
+  - J16b: KILLED by decide-browser J16.
+  - J17a: KILLED by decide-browser J17 and the redirect test.
+  - J17b: KILLED by decide-browser J17.
+  - J19: KILLED by decide-sso J19. granted-user stays 19/0 under it.
+  - J18: SURVIVED decide-sso 5/0 and granted-user 19/0. It is equivalent alone, for the reason above.
+- Old webui stubs (Mos GO mos-1465, relayed in sage-3497): library-cli.test.mjs:17 and
+  thread-claims.test.mjs:58 build a loader-hook stub of bus.mjs with no `consoleCall` export, and cli.mjs
+  now imports it. Each busSource gains `export const consoleCall=()=>{throw Error('consoleCall outside --sso')};`
+  in the neighbours' throwing form, and nothing else changes. numstat against fe4ee8c7b is 1 1 for each.
+  Alone they ran 1/0 and 4/0. No mos-1316 item for compactions-launch: the whole cli rerun is the evidence.

agents/violet/README.md

@@ -0,0 +1,8 @@
+# Violet
+
+Builder seat, Codex gpt-6.1-sol, started by Mos under Q245 (mos-1506). Owns row 297 (the GitHub grant method, handed over from Bushroot).
+
+No launcher in this directory. The seat runs as a T3 thread (thread 6229eb89) and works in its own worktree. It has no
+credentials of its own; it pushes only its own `violet/*` branches through the repository credential helper (mos-0981),
+never `refactor`, `main` or another seat's branch. Claude seats orchestrate and review (Q245). Registered by Sage on
+2026-10-23 so the queue can name the seat as row owner (store.mjs isSeatDir).

docs/SESSIONS.md

@@ -1585,3 +1585,15 @@ are never rewritten or removed; corrections are new entries.
 2026-10-23 | Huey (cabd45ca) | Row 272 round 2, sage-3354/3357/3358/3361 | Rebased onto 5fdfd7275 on huey/row272-5fdfd7275, preserving 219/295 and approved old-test hunks; rev3510 in-progress. New fallback test ran RED first in Sage's slot: expected legacy failure, 3 guards pass; slot returned. Bounded fallback and extra guards/mutants prepared for Sage's full gate; no post-implementation run or green claim.
 
 2026-10-23 | Huey (cabd45ca) | Row 272 round 3, mos-1455 / sage-3435 | Added empty role authority arrays to new CLI fixture and guarded null old at all three chat render sites; browser tests byte-identical. Same 17-path manifest.r3, no local execution or queue writes. Follow-up candidate awaits Scrooge delta review and Sage gate; gate run 1 remains RED.
+
+2026-10-23 | Sage (1ef1e4f8) | Rows 272 and 307 landings, row 306 design, row 252 rebase check | 272 landed d33989230 and 307 landed d243f6b25, both on full five-suite gates with mutants killed. Row 306 design r2 approved by Dewey (c31197), build going under mos-1463. Row 252 rebase 3e6de9807 on fe4ee8c7b checked and Scrooge given the slot (sage-3488).
+2026-10-23 | Sage (1ef1e4f8) | Rows 291 and 306 landings, row 308 launch | 291 (PRD 1.16, #1796) landed 4874d1e83 and 306 (#1813) landed 1676ad0de..2d0318a44 by temp-index replay, patch-ids equal, both on all-suite gates (mos-1455, plugins 0 fail, 306 mutants M1-M3 killed). 306 N1/N2 in DEFERRED 9c8877bdf. Row 308 (PRD 1.17, #1815) briefed and launched to Gosalyn; slot passed to them for claim, push and in-review. Scrooge told to rebase 252 on 9c8877bdf. Mos told (sage-3515, sage-3520).
+2026-10-23T17:29:46Z | Gyro (Codex gpt-6.1-sol, sage-3542) | 571 REQ-LIB-5/Q239 Connections design amendment | Proposed W8 plus parent/W4 alignment; Mos build order kept distinct from import acceptance. Static docs checks only, no repo Node/tests/live action. Fenton review, Sage landing.
+2026-10-23T17:32:37Z | Gyro (Codex gpt-6.1-sol, sage-3544) | 571 Connections N1/N2 | W7 opening-order cross-references and human-view comment/deletion exclusion clarified. Static docs checks only; no repo Node/tests/live action. Delta to Fenton, Sage lands.
+2026-10-23T17:48:43Z | Scrooge (629b6cd3) | Row 252 Console inbox Approve and Deny (#1753) | Rebased onto 306 landing as 580037105 (range-diff all =), slot run bus 907/0 webui 410/0 cli 943/0, in-review revs 3608/3609, Webby r1 APPROVE, J1-J19 specs to Sage; Sage landed 45ea3fa0d (done rev 3616). Part 1 mutant results were never in BUILD.md; they went to Sage by T3 (scrooge-0252-mutant-specs).
+2026-10-23 | Sage (1ef1e4f8) | Rows 308 and 252 landings, 571 Connections design amendment, Vikunja 597 | 308 (PRD 1.17, #1815) landed 30e6bb680 and 252 (#1753) landed 45ea3fa0d (replay of 580037105 onto 30e6bb680, range-diff all =), each after a full gate on the landed tree (252 also J1-J19, J11c and J18 equivalent); Gyro's 571 amendment (Fenton APPROVE) landed e8bb13df8; Vikunja 570, 435 and 597 done, canonical webui esbuild 0.28.2; queue revs 3589-3616 committed 59f013247
+2026-10-23 | Sage (1ef1e4f8) | Vikunja 571 W build rows; rows 13, 42, 257 and 289 check | Filed the design's ten W rows as queue rows 309-318 (revs 3617-3626, owners set to unassigned 3627-3636, queue commit 293b42fee pushed); Vikunja 571 done (comment 994). Row 13's candidate fd72d2689 is on refactor, gate is Monday's row 7 ledger run; 42 paused under mos-1184; 257 post-v1; 289 waits on 214 and 288. Slot released 17:56Z.
+2026-10-23T21:08:32Z | Filbert (048f3c63) | Rows 220 and 216 round 2 verdicts, r5 static deltas, replay drift check | 220 APPROVE 739b868b6 (comment 31383 #1721, rev 3696), 216 APPROVE dae76ccc2 (comment 31384 #1717, rev 3697) on Researcher's r5 reruns and mutants and Sage's joint gate GREEN on fbe57a05b (sage-3748); static r5 deltas clean; 216 N3 (get returns a universe's own supporting files on 283's base) binds C2-05c; no tests run by me
+2026-10-23 | Gladstone (433058fc-9cea-46e3-8554-6ddefb312762, Codex gpt-6.1-sol) | #1816 / Vikunja 614, mos-1531 | Built hostcheck octal-mode fix and two bare-scratch bundle verifies on gladstone/hostcheck-item5 from 93694c518. Three append-only test blocks; Node/tests held by Sage-3738, untested push authorized sage-3740. Queue number pending; Morgana static review, Sage gate/landing.
+2026-10-23T21:58:38Z | Sage (1ef1e4f8) | Rows 220, 216, 320 landings and queue-commit (mos-1528, mos-1532/1534/1536/1537) | 220+216 joint gate GREEN 21:05:34Z on fbe57a05b, pushed with Filbert's SESSIONS line 582b86935; #1721 and #1717 closed. Row 320 (#1816, Gladstone F1-F6): faf55618e replayed onto 45e3ca7bd as 094124b4e (code patch-id equal, log appends in one final commit), Morgana APPROVE r2 c31403, full gate GREEN 21:53:00Z 0 fail, pushed 21:53Z, done rev 3717, #1816 closed c31413, Vikunja 614 done. queue-commit 604523b20 holds revs 3678-3717. Mos sent N=094124b4e to ops-01 (mos-1540).
+2026-10-23T22:06Z | Duckworth (Opus 5.5) | row 239 (#1745) round 1 on r4 e0cb1db2c (honker-0206, rev 3719) | APPROVE (static): r4 range-diff all =, 16 paths byte-equal to r3, e0cb1db2c BUILD.md only, 4 channel-proof pins match; record waits for Sage's comment id and gap (duckworth-0295) |

docs/guides/host-run-sheet.md

@@ -40,8 +40,8 @@ install -d -o root -g root -m 0755 /etc/mosaic-stack/node-keys /opt/mosaic-stack
 cd "$(mktemp -d)"
 curl -fsSLO https://nodejs.org/dist/<v>/node-<v>-linux-x64.tar.xz
 curl -fsSLO https://nodejs.org/dist/<v>/SHASUMS256.txt
-curl -fsSLO https://nodejs.org/dist/<v>/SHASUMS256.txt.asc
-gpg --no-default-keyring --keyring /etc/mosaic-stack/node-keys/pubring.kbx --verify SHASUMS256.txt.asc SHASUMS256.txt
+curl -fsSLO https://nodejs.org/dist/<v>/SHASUMS256.txt.sig
+gpg --no-default-keyring --keyring /etc/mosaic-stack/node-keys/pubring.kbx --verify SHASUMS256.txt.sig SHASUMS256.txt
 grep " node-<v>-linux-x64.tar.xz\$" SHASUMS256.txt | sha256sum -c -
 echo "<pinned sha256>  node-<v>-linux-x64.tar.xz" | sha256sum -c -
 tar -xJf node-<v>-linux-x64.tar.xz --no-same-owner
@@ -189,7 +189,12 @@ First install:
 ```sh
 # Copy the bundle in, then check it before anything reads it.
 echo "<bundle sha256>  /root/<sha>.bundle" | sha256sum -c -
-git bundle verify /root/<sha>.bundle
+(
+  bundle_check="$(mktemp -d)" || exit 1
+  trap 'rm -rf "$bundle_check"' EXIT
+  git init -q --bare "$bundle_check" &&
+    git -C "$bundle_check" bundle verify /root/<sha>.bundle
+) || echo "STOP: bundle verify failed; do not continue"
 
 # Root's checkout. stack-upgrade.sh and case2-unit.sh run from here, never from a copy.
 git clone -q -b refactor /root/<sha>.bundle /root/mosaic-stack
@@ -202,11 +207,29 @@ install -o mosaic -g mosaic -m 0600 /root/<sha>.bundle /srv/mosaic/incoming/<sha
 sudo -u mosaic -H git clone -q -b refactor /srv/mosaic/incoming/<sha>.bundle /srv/mosaic/src/mosaic-stack
 ```
 
+After a first install, once both units are running (section 10), adopt the installed copy before
+any activate or upgrade. This step runs only on Mos's go, with Jason or Mos running it
+(`scripts/stack-release.sh:14`):
+
+```sh
+sudo -u mosaic -H env PATH=/opt/mosaic-stack/node-<v>/bin:/usr/sbin:/usr/bin:/sbin:/bin \
+  /srv/mosaic/src/mosaic-stack/scripts/stack-release.sh adopt <business> --instance dev --units external
+```
+
 Each upgrade, before `stack-upgrade.sh upgrade`:
 
+Only the first upgrade after adopt takes `--no-rehearsal`: append it to the upgrade command below.
+Adopt writes no backup, so omitting the flag then refuses `no-backup`. Subsequent upgrades omit it;
+when a backup exists, supplying it refuses `rehearsal-required`.
+
 ```sh
 echo "<bundle sha256>  /root/<sha>.bundle" | sha256sum -c -
-git bundle verify /root/<sha>.bundle
+(
+  bundle_check="$(mktemp -d)" || exit 1
+  trap 'rm -rf "$bundle_check"' EXIT
+  git init -q --bare "$bundle_check" &&
+    git -C "$bundle_check" bundle verify /root/<sha>.bundle
+) || echo "STOP: bundle verify failed; do not continue"
 git -C /root/mosaic-stack fetch -q /root/<sha>.bundle refs/heads/refactor:refs/remotes/origin/refactor
 git -C /root/mosaic-stack checkout -q --detach <sha>
 install -o mosaic -g mosaic -m 0600 /root/<sha>.bundle /srv/mosaic/incoming/<sha>.bundle
@@ -231,13 +254,37 @@ When a run doesn't exit 0, send Mos the exit and the last lines of `/var/log/mos
   the old copy. The next run refuses `args-differ`, and a render from that file would put the old copy back.
   Move the file the result line names into place with `mv -f`. The two differ only in the `--copy` value.
 
+After `case2-install.sh` succeeds, create the human CLI wrapper before running
+`stack-copy.sh check --units external`. Creating this wrapper is a separate live
+step requiring Mos's go (`scripts/stack-copy.sh:3`); the install does not create it. Run only on that go:
+The step runs under sudo's `secure_path`, so it sets its own PATH and umask.
+
+```sh
+sudo -u mosaic -H /bin/sh <<'MOSAIC_WRAPPER'
+cd / || exit 1
+umask 077
+PATH=/opt/mosaic-stack/node-<v>/bin:/usr/sbin:/usr/bin:/sbin:/bin; export PATH
+mkdir -p -- "$HOME/.npm-global/bin" || exit 1
+"$HOME/src/mosaic-stack/scripts/stack-copy.sh" wrapper <sha> --create
+MOSAIC_WRAPPER
+```
+
+`--create` refuses an existing wrapper; stop and review it rather than replacing
+it. The wrapper must name the same `<sha>` copy as the units.
+
 Precheck lines: none. Root's checkout at `<sha>` and the stack's user's clone: precheck line missing.
 After install, `stack-copy.sh check --units external` reads the copy the units run.
 
+The stack's user's `scripts/case2-install.sh` (C2-13b, design 10 step 2b) makes the first copy with
+`stack-copy.sh copy <sha>`. The copy runs `npm ci` from `package-lock.json`, which installs the pinned
+harness, so the host needs to reach the npm registry during the install. The install runs no
+`release.sh package` or `activate`.
+
 ## 7. The args file
 
 `/etc/mosaic-stack/dev.args` holds the `case2-unit.sh` arguments, one per line, with the serve flags after a
-line holding `--`. I2's install writes it; ops-01 doesn't write it by hand. It must be root's, with no group
+line holding `--`. Root writes it at the unit render, from the values the go names. The stack's user's
+install never writes it: that user can't write `/etc`, and root reads nothing that user wrote. It must be root's, with no group
 or other write (`chmod 0644` or tighter). Before `--` it takes only `--user`, `--home`, `--business`,
 `--copy` (exactly once), `--node`, `--profile`, `--claude` and `--pm`. `stack-upgrade.sh` changes only the
 `--copy` line, and only after confirm passes.
@@ -272,16 +319,56 @@ file with `stat -c '%U %a %n' PATH`, never `cat`. `<business>` is the host's bus
 |---|---|---|---|---|---|
 | `/srv/mosaic/.config/mosaic-dev/secrets/` | `claude-session.env`, one line `ZAI_API_KEY=...` | 0600 | mosaic | library | `<path> sets ZAI_API_KEY` |
 | `/srv/mosaic/.config/mosaic-dev/secrets/` | the Console's proof file, the path the args file's `--proof-file` names | 0600 or 0400 | mosaic | library | none. `case2-unit.sh` refuses at render. Precheck line missing. |
-| `/srv/mosaic/.config/mosaic-dev/secrets/<business>/` | `library-gitea` | 0600 | mosaic | library | C2-13b's `library.sync` (not landed) |
+| `/srv/mosaic/.config/mosaic-dev/secrets/<business>/` | `library-gitea` | 0600 | mosaic | library | After a unit start, wait for loopback `/healthz` with the bounded retry in section 10 before `case2-precheck.sh --business <business> --library-status`: `library-last-error library-credential-missing` until it's placed, then `library <project> last fetched ...` |
 | `/srv/mosaic/.config/mosaic-dev/secrets/agents/<business>/<agent>/` | one file per service | 0600, dirs 0700 | mosaic | both | none. Filled only by `mosaic credentials issue`, or Approve after #436. Never by hand. |
 
 The installer key, `<configDir>/secrets/hosts/<business>/<hostId>/installer`, is not a slot anyone places.
 Enrollment (section 8) writes it under the enrolling stack's config directory and deletes it when the host
 leaves.
 
+## 9a. Notifier decision, before starting units
+
+Make the explicit per-host decision before section 10: the default below is
+`binding: null`, so the bus runs without DMs. A named binding is a later per-host
+choice that needs Mos's go. The installer does not make this decision or write
+this file. Replace `<dataRoot>` with the configured data root and `<business>`
+with this host's business id. If the file already exists, stop and review the
+existing decision; this command refuses to overwrite it.
+
+```sh
+sudo -u mosaic -H /bin/sh <<'MOSAIC_NOTIFY'
+cd / || exit 1
+umask 077
+notify_root='<dataRoot>/notify'
+notify_dir="$notify_root/<business>"
+mkdir -p -m 0700 -- "$notify_root" && chmod 0700 -- "$notify_root" || exit 1
+mkdir -p -m 0700 -- "$notify_dir" && chmod 0700 -- "$notify_dir" || exit 1
+(set -C; printf '%s\n' '{"notifyVersion": 1, "binding": null}' > "$notify_dir/notify.json") || exit 1
+chmod 0600 -- "$notify_dir/notify.json"
+MOSAIC_NOTIFY
+```
+
+Precheck line: `ok      notifier config <dataRoot>/notify/<business>/notify.json validates (directory 0700, file 0600)`.
+
 ## 10. Console start
 
 None by hand. I2's `case2-unit.sh` enables both units, starts the bus, then the Console (Q189, mos-1122).
 `stack-upgrade.sh` stops and starts both units itself.
 
+After a unit start, wait for the Console's loopback `/healthz` to succeed before running
+`case2-precheck.sh`, including `--library-status` in section 9. Replace `<port>` with the installed
+Console unit's `--port`. This retry is bounded to 30 attempts, each with a 2-second timeout, with
+1 second between failed attempts. If it prints STOP, stop here; do not run the precheck or adopt.
+
+```sh
+(
+  attempts=0
+  until curl -fsS --max-time 2 -o /dev/null 'http://127.0.0.1:<port>/healthz'; do
+    attempts=$((attempts + 1))
+    [ "$attempts" -lt 30 ] || { echo "STOP: loopback healthz did not become ready; do not continue" >&2; exit 1; }
+    sleep 1
+  done
+)
+```
+
 Precheck line: none. Both units active after the render: precheck line missing.

docs/plans/2026-10-21_q195-writing-editor.md

@@ -187,8 +187,10 @@ canon Markdown chapter takes its position by that rule or a human's committed or
 import preserves its chapter ID and position. Human reordering commits the manifest.
 library_manuscript and next_chapter use this order, never archived paths. Each
 answer/page names format, owned location/ID and captured commit. DOCX wikilinks stay clickable
-in the Console editor; no graph shows their current links yet. A Console Connections view
-and its tests are later work, waiting for Jason's J-b answer in PRD 1.17. Obsidian's archive
+in the Console editor, and no graph shows them yet. Under PRD 1.17 REQ-LIB-5 and Q239,
+the Console's Connections view lists the current links and backlinks of each story file
+the user may see, in both formats, with each one's scope and format. W8 owns that view
+and its tests. Obsidian's archive
 graph is historical, not a live DOCX graph. No graph implementation is in these W rows. New Story chooses universe/book or playground and gets
 its place in that manifest from its first DOCX commit, without an MD copy.
 
@@ -242,8 +244,8 @@ follow stable identities without an agent rewriting story links.
 Obsidian's old Markdown graph is historical after conversion. It does not track later DOCX
 edits, and it is not a parallel writing surface. The format map names current files and
 clickable editor links resolve across formats; it is not a graph view. No graph shows DOCX
-links yet. The later Connections view waits for Jason's J-b answer; it and its tests are
-outside the current W3/W7 scope. No Markdown export or Obsidian graph parity is promised. `.doc`/`.qxd` imports remain separate D23 work.
+links yet. W8 supplies REQ-LIB-5's Console Connections view: current links and backlinks
+of each story file the user may see, in both formats, with each one's scope and format. No Markdown export or Obsidian graph parity is promised. `.doc`/`.qxd` imports remain separate D23 work.
 
 D12. Q235–Q237 withdraw the superseded-notice proposal and its open-Q36 boundary. Current
 Case 2 chapter reads after conversion use W4b's committed DOCX reader/citations. Agent
@@ -579,12 +581,19 @@ runs Jason's layout agent nor automatically grants it access or sends book text
 
 All rows follow BRIEF-TEMPLATE. They are not queue entries. S0 M1–M14 remain binding throughout W2/W6; source/target
 changes return to security review. W7 adds the policy conversion/routing row. S0 and the original W4 design have reviewed verdicts; this policy revision goes to Fenton.
-Their implementation gates remain separate. No code row W1/W2/W6/W3a/W3b/W3/W4b/W5/W7 enters the queue
+Their implementation gates remain separate. No code row W1/W2/W6/W3a/W3b/W3/W4b/W5/W7/W8 enters the queue
 before S0 PASS (recorded for this baseline, with M1–M14 still binding). Each also observes its explicit dependencies, source ownership, the CSP gate
 and the MVP gate-slot priority. Q177 permits chaining reviewed candidates, not overlapping
 owners. Sage assigns model-only seats. Each implementation reviewer is Opus 5.5 and did not
 author the code. Fenton reviews this design and can review code only when not its author.
 
+Build order (mos-1470, Vikunja 571 comment 961): W7 first supplies reviewed conversion/format
+routing code with production import still closed, then W8 lands the Connections view, then
+W7's human opening step may open the first real chapter import. W8 is after W3/W4b and
+W7's closed routing candidate, before that W7 opening step. This is Mos's build-order rule,
+not a new REQ-LIB-8 condition or an addition to import acceptance. No converted real chapter
+exists without the view. O2 code remains after 10-27 and never ahead of MVP rows.
+
 G1. Future code acceptance runs each touched test file independently and affected package
 suites on Sage's slot after MVP priority, plus required repository checks. Source builds need
 pinned tools, reproducible hashes, license/source manifests and independent review. Integration browser
@@ -1258,6 +1267,7 @@ Independent conversion/parser/authorization review, writing/library/bus/harness/
 pinned-copy and sandbox closure tests, plus W4 A19/A20/A33–A35 and G1. Source archive, off-host acknowledged DOCX and
 format-map snapshot must match the new DOCX publication before completion. No real import
 opens before all D12 gates. The October 27 Markdown and supporting-doc fixtures still pass.
+The human opening step follows W8's landing (mos-1470, build order, not an acceptance condition).
 
 ### Handoffs
 
@@ -1265,6 +1275,83 @@ Owner sends commit/blob and fixture publication/crash evidence directly to the r
 Sage through T3. Reviewer sends verdict to owner/Sage. Copy Mos for the later first-real-book
 go or any proposed policy change, never ask an agent to execute that go.
 
+## W8 Console Connections view for Markdown and DOCX story files
+
+### Problem
+
+PRD 1.17 REQ-LIB-5 at 30e6bb680, approved through Q239, requires the Console to list
+current links and backlinks of every story file the user may see, in both formats, with
+scope and format. Clickable editor wikilinks and Obsidian's historical archive graph do
+not supply this view.
+
+### Owner and reviewer
+
+- Owner: Sage assigns the seat, using Codex gpt-6.1-sol for cross-format lookup and authorization.
+- Reviewer: an independent Opus 5.5 seat assigned by Sage, not the author.
+- After: W3, W4b and W7's reviewed closed conversion/format-routing candidate; serial handoff
+  from W7 for shared library/WebUI files and from C2-11a/11b and C2-10b for shared UI paths.
+- Before: W7's human opening step for the first real chapter import, under mos-1470. This
+  orders builds, not REQ-LIB-8 acceptance, and does not change its four opening conditions.
+  Post-10-27 only, with no gate slot ahead of MVP rows.
+
+### Files owned
+
+New: `packages/library/src/connections.mjs`, `packages/library/tests/connections.test.mjs`,
+`packages/webui/src/connections-http.mjs`,
+`packages/webui/src/public/{writing-connections.js,writing-connections.css}`,
+`packages/webui/tests/{writing-connections.test.mjs,writing-connections-browser.test.mjs}`.
+Existing or handed off from W7/W3: `packages/library/src/{index.mjs,links.mjs}`,
+`packages/webui/src/{serve.mjs,bus.mjs}`,
+`packages/webui/src/public/{index.html,writing-pane.js,writing-pane.css}`,
+`packages/webui/README.md`.
+
+### What ships
+
+A Console Connections control beside story navigation opens a keyboard-accessible list
+with Links and Backlinks sections for the selected story. Each item shows its title,
+scope and format, and opens the current authorized story through the existing resolver.
+It works for Markdown, DOCX and a partly converted book. It uses committed link metadata
+and W7's stable identities/format routing, never unsaved editor buffers or archive content.
+The response names the captured versions; after a committed save or conversion publication,
+a refresh uses the current authorized snapshot. An in-flight stale result cannot replace
+that refresh. An empty section says there are no visible links; it does not reveal hidden
+counts or titles. Unresolved links remain visibly unresolved and cannot open guessed paths.
+
+A human-only Console read route uses existing authenticated project/universe/source access
+and exclusions. Authorize both endpoints of every displayed edge before returning titles,
+paths or counts. Backlinks cannot reveal another business, a denied universe, excluded
+story or archived source. Links inside comments or tracked-deletion text are not current
+story links, so the human Connections view never shows them and never depends on an agent
+setting. Final-view story links use the same committed extraction rules as W4b. Archive links are historical
+and excluded from this current-story view. No new agent grant, tool or conversation gate.
+
+`connections.test.mjs` covers forward/backlinks across both formats, mixed-book identity
+preservation through conversion, current committed saves, scope/format labels, exclusions,
+archive/old-path refusal, unresolved targets and denial without metadata leaks. The HTTP/UI
+suite in `writing-connections.test.mjs` covers authentication, access revocation, response
+version binding, stale refresh rejection and refusal rendering. The browser fixture suite
+covers keyboard/focus, Links/Backlinks empty states, labels, cross-format navigation and
+refresh after save/publication. Fixtures only, never Melanie's text or a live stack.
+
+### Out of scope
+
+A node graph, Obsidian graph parity, editing links or story text, agent tools, private-book
+conversion, changes to REQ-LIB-8 acceptance, Q234's header, mos-1363 or S0 M1–M14.
+
+### Gate
+
+Independent Opus 5.5 review of access filtering and the human view, the named fixture suites
+and G1 on Sage's slot. Evidence shows both formats and mixed conversion state without
+archive or denied-source leakage. Sage records W8 landing before W7's first-real-import
+opening step per mos-1470; no import acceptance test or PRD condition is added here.
+
+### Handoffs
+
+Owner sends pushed commit/blob and fixture evidence directly to the reviewer and Sage via
+T3. Reviewer sends verdict to owner and Sage. Sage orders W8 landing before the W7 human
+opening step, and hands the shared files back before further W7 edits. Copy Mos for the
+first-real-book go or any proposed policy change.
+
 ## Engineering choices from mos-1368
 
 This table resolves the map's engineering prompts; these are design decisions, not questions
@@ -1282,7 +1369,7 @@ Later mos-1372/1375 override A32/A33's per-document/dedicated-session assumption
 | Q7 / A32/A33 | mos-1372 D9: ordinary Case 2 access in any thread/room, no per-document grant/share/dedicated session; existing supporting writes continue; marked for PRD 1.17 approval |
 | Q8 / A36 | W4b/W7: preserve Case 2 find/get/search/manuscript/universe tools via host committed-reader adapters, not fewer tools or raw ZIP access |
 | Q9 / A73 / C2 | W7: D10 manifest order, typed next_chapter, paragraph cursors bound to snapshot/access; both W4 byte cap and harness REPLY_CAP apply, never cut paragraphs or invent line equivalents |
-| Q10 / A22 | W3/W7 keep clickable cross-format editor links; no DOCX graph yet. Connections view/tests are later work, waiting on Jason's J-b answer; Obsidian archive graph is historical |
+| Q10 / A22 | W3/W7 keep clickable cross-format editor links; W8 supplies current links/backlinks for visible story files in both formats with scope/format (REQ-LIB-5, Q239); no DOCX graph yet; Obsidian archive graph is historical |
 | Q11 / A37 | W7: Console archive saves refuse; sync flags later archive edits or recreated old paths and excludes them from current canon; no remote-push refusal/protected-pattern guarantee |
 | Q12 / A21 | W7: reviewed markdown-it AST + first-party DOCX adapter; no new runtime converter; input cap 1 MiB default, W4 ZIP/XML validation, construct/token/extractor fidelity before archiving |
 | Q13 | W7 survey: synthetic construct corpus and aggregate-only count capability; no seat reads real text or claims a corpus census happened |
@@ -1317,7 +1404,9 @@ renderer does not enable it. No change is imposed on the October27 release.
 
 Alignment note: sage-3121 checks this revision against PRD 1.17 d6,
 SHA-256 `886b93c571f87bfbb2f27ee3113b6800a32d8f89196d95ace33566031bee380a`.
-Connections graph/tests wait for J-b; new non-old-path Markdown stays canon until import;
+That historical d6 alignment is superseded for Connections by landed PRD 1.17 at 30e6bb680:
+REQ-LIB-5/Q239 require W8's list view, ordered before real import under mos-1470.
+New non-old-path Markdown stays canon until import;
 archive folder is human-set in the library mapping with no default.
 
 ## Current verification and remaining gates
@@ -1332,4 +1421,5 @@ append-only logs. No build, browser run, conversion, queue entry or live change
 Jason's format and CSP choices are settled by Q234–Q237. No question repeats Q1 or Q36.
 Before real conversion: Sage's Case 2 PRD amendment (Vikunja 570) needs Jason's approval;
 W4b/W7, Hermes-retired and post-10-27 gates must pass; Jason must explicitly give the first real Melanie-book
-conversion go. These are later authorization gates, not requests to convert anything now.
+conversion go. W8 lands before the human opening step under mos-1470 as build order, not
+an acceptance condition. These are later authorization gates, not requests to convert anything now.

docs/plans/2026-10-22_q195-docx-citations.md

@@ -66,7 +66,11 @@ A Markdown file recreated at a converted old path is unmapped, neither canon nor
 excluded from lookups and flagged to the human. A new Markdown story at a different path in
 a converted book stays canon until import, flagged and offered for human import; no automatic
 conversion. Existing playground scope rules remain. Clickable DOCX editor links stay; no
-DOCX graph exists yet. A Connections graph and its tests wait for Jason's J-b answer.
+DOCX graph exists yet. PRD 1.17 REQ-LIB-5 and Q239 require the Console's Connections view
+to list the current links and backlinks of each story file the user may see, in both
+formats, with each one's scope and format. Parent design W8 owns the view and its tests.
+Mos-1470 orders its landing before W7's first-real-import opening step as build order,
+not an additional REQ-LIB-8 acceptance condition.
 
 Every conversion runs the pinned extractor before archiving and refuses unsupported output.
 An independently reviewed importer preserves every wiki token and front-matter key.

docs/plans/2026-10-23_github-consumer-brief.md

@@ -0,0 +1,31 @@
+# Brief: a GitHub consumer for row 297's protected token callback
+
+Sage, 2026-10-23, filed for Mos (mos-1525). Post-10-27.
+
+## Brief: a GitHub consumer for Broker.githubWithToken
+
+Row 297 builds the GitHub grant method and stops at the trusted host API
+`Broker.githubWithToken(business, agent, fn)` in `packages/bus/src/broker.mjs`.
+Nothing calls it yet: no git helper, mirror push or publication uses a GitHub
+token (violet BUILD.md, "Consumer gap for Sage's follow-up row").
+
+This row adds the first consumer.
+
+- It gets the token only through `githubWithToken`. It never reads the
+  protected generation files, and never routes GitHub through the generic
+  Gitea Credentials path, which has calendar-day dates and fork-specific
+  identity.
+- It honors the callback's cancellation signal. The signal aborts on revoke and
+  at the token safety deadline, so the consumer stops work and drops the token
+  when it fires. No operation is retried with a token past its expiry.
+- No socket verb returns a token, and no consumer output, log or run record
+  holds one.
+
+Design comes first, with the consumer named (a git helper or mirror push), for
+Dewey's review. Tests cover: a revoke mid-call aborts the consumer; a call
+straddling the safety deadline aborts; an expired grant refuses before any
+network call; and no token text appears in output or the store.
+
+Gate: Dewey approves the design and the manifest. The touched suites and every
+`scripts/test-*.sh` are green on Sage's gate, and mutants that drop the signal
+check or the expiry check are killed. Starts after row 297 is done.

docs/plans/2026-10-23_host-fixes-1816-brief.md

@@ -0,0 +1,134 @@
+# Brief: Case 1/2 host fixes for the 433 P1 rerun
+
+Sage, 2026-10-23, filed for Mos (mos-1532). Issue #1816, Vikunja 614. On the 10-27 path.
+
+## Brief: hostcheck item 5, bundle verify, case2-unit @, stack-copy cwd
+
+ops-01 found two defects in the 433 P1 Run A on VM 1013 (ops-0256). Row 240 (c515273db) introduced the first one.
+
+1. `scripts/case1-hostcheck.sh:117` compares `dpkg-statoverride --list /usr/bin/bwrap` to the literal
+   `root mosaic 0750 /usr/bin/bwrap`. dpkg 1.22.6 on Ubuntu 24.04 prints `750`, so item 5 FAILs on every
+   correctly built host. The apt hook and mosaic-hostcheck.service then close bwrap and write DRIFT. The fake
+   at `packages/cli/tests/case1-hostcheck.test.mjs:73` writes `0750`, so the suite missed it.
+2. `docs/guides/host-run-sheet.md:192` and `:209` run `git bundle verify` outside a repository, which fails on
+   a fresh host.
+
+The fix:
+- Item 5 accepts `750` and `0750` as the same mode for the statoverride line. Owner, group and path stay exact,
+  and every other mode still fails. The stat check at :118 is unchanged.
+- The run sheet verifies the bundle inside an empty bare scratch repo, as `scripts/stack-copy.sh:91-93` does.
+  A failure there prints a FAIL line and does not `exit` the interactive root shell (Morgana N1, sage-3743).
+
+Tests are append-only blocks in case1-hostcheck.test.mjs (mos-1272 pre-approved by Mos: 0 lines deleted, the :73
+fake unchanged). They cover: a `750` statoverride passes; `0750` still passes; `755`, `0755`, `7500`, `075`, `00750`, a tab
+or doubled space, and a wrong owner or group fail. Any other change to an existing test goes to Mos first.
+
+Scope add (mos-1534):
+3. F3: `scripts/case2-unit.sh:62` plain() rejects `@`, so the run sheet's required `--claude` path
+   (host-run-sheet.md:85-89, `@anthropic-ai`) refuses on every host (ops-0258, section 10). plain() accepts `@`.
+   The :61 comment doesn't list it as unsafe, so no requirement changes.
+4. F4: `scripts/stack-copy.sh` fails when run as mosaic from a cwd mosaic can't read: the sheet's `sudo -u mosaic`
+   lines and stack-upgrade.sh AS_USER at :154 and :293. It works from any cwd.
+Specs and test terms are in mos-1534. Mos pre-approved append-only test blocks in case2-unit.test.mjs under mos-1272.
+One new N carries F1 to F4 for the #433 rerun.
+
+Owner Gladstone. Reviewer Morgana. Gate: Morgana approves. Mutants are killed: dropping the `750` form, widening the
+match to any mode, rejecting `@` again in plain(), and the F4 cwd fix reverted. The touched test files run whole, and Sage's full landing gate runs every
+package suite and every `scripts/test-*.sh`. After landing, Mos sends ops-01 the new N for a full 433 P1 rerun.
+No hostcheck install on .53 or .54 until it lands.
+
+Scope add (mos-1536, ops-0260):
+5. F5: on a host that follows the run sheet, `mosaic-bus@<business>` exits 3 because nothing writes
+   `<dataRoot>/notify/<business>/notify.json` (bus cli.mjs:104-122 requires it, README :876-892), and case2-precheck
+   has no line for it, so it passed with the bus down. The run sheet gains a step that writes binding `null` as the
+   default, and case2-precheck gains a notify line with tests. Install does not write the file: the README wants an
+   explicit decision. A named binding for .53 is a later per-host choice that needs Mos's go. Spec in mos-1536.
+Gate adds a mutant: the precheck notify line removed or passing on a missing file. #1816 carries F1 to F5.
+
+Scope add (mos-1537, ops-0261):
+- F5 fixture: Mos OK under mos-1272 for the host(t) notify fixture in case2-unit.test.mjs and the world(t) one in
+  case2-install.test.mjs (a 0700 notify/acme dir and a null notify.json, with no assertion changed or deleted).
+  Conditions: the negative F5 tests build their host without the file; one append-only install test shows
+  notify.json bytes and mode are unchanged after install; the fixture lines are their own follow-up commit.
+- Section 9a creates both `notify/` and `notify/<business>` at 0700 (ops-0261 measured a 755 parent).
+6. F6: sheet :235 runs `stack-copy.sh check`, which requires `$HOME/.npm-global/bin/mosaic` (stack-copy.sh:160-173).
+   Nothing creates it: install runs only `copy` (:178), bootstrap has no .npm-global, and the sheet has no wrapper
+   step. The sheet gains a step after install: as mosaic from cwd `/`, create the bin dir, then run
+   `wrapper <sha> --create`, naming the Mos gate (stack-copy.sh:3). No requirement change. #1816 carries F1 to F6.
+
+
+## Brief: F7, the wrapper step's PATH and umask under sudo
+
+Row: F7 for the 433 P1 rerun (ops-0271, mos-1544). Docs only. Builder: a Codex thread. Reviewer: a separate Codex
+thread (mos-1542). It can land with any row and is not N+1.
+
+Defect, from ops-01 on 094124b4e: the run sheet's wrapper step (`docs/guides/host-run-sheet.md` :249-253) fails
+rc=127 `node: command not found`. `sudo -u mosaic -H /bin/sh` runs under sudo's `secure_path`, which drops
+`/opt/mosaic-stack/node-<v>/bin`, and `scripts/stack-copy.sh wrapper` reaches `scripts/instance.sh:78`, which calls
+bare `node`. The heredoc also sets no umask, so `$HOME/.npm-global/bin` came out 0775.
+
+Change, inside the `MOSAIC_WRAPPER` heredoc only:
+
+1. Before the `mkdir`, add `umask 077`, the same way the notify step does (:325).
+2. Before the `mkdir`, add `PATH=/opt/mosaic-stack/node-<v>/bin:/usr/sbin:/usr/bin:/sbin:/bin; export PATH`, using the
+   sheet's own PATH form (:69).
+3. Add one sentence above the block: the step runs under sudo's `secure_path`, so it sets its own PATH and umask.
+
+Nothing else in the sheet changes, and no script changes. ops-01 is testing this exact form on 1013 (mos-1544).
+
+Acceptance:
+
+- The heredoc has `umask 077` and the PATH line before `mkdir`, with `<v>` written the same as the sheet's other
+  node paths.
+- `git grep -n 'host-run-sheet' -- 'packages/*/tests/*' 'scripts/test-*.sh'` shows no test that reads the changed
+  lines (positive control: a grep for a path a test does read). If a test does read them, stop and report.
+- BUILD.md under `agents/<seat>/work/queue-<row>/` records the diff and the grep.
+
+F10, added to this row (ops-0274, mos-1548). Both are confirmed at 094124b4e.
+
+- After a first install, the sheet has no `stack-release.sh adopt <business> --instance <i> --units external` step,
+  so the first activate refuses `no-pointer` (`scripts/stack-release.sh:1297`, "no $POINTER; run adopt first"). Add
+  that step where the sheet first moves from install to activate or upgrade. It runs on Mos's go, and Jason or Mos runs
+  it (`stack-release.sh:14`).
+- The sheet doesn't say that the first `stack-upgrade.sh upgrade` after adopt needs `--no-rehearsal`. Adopt writes no
+  backup, so without the flag the upgrade refuses `no-backup` (`scripts/stack-upgrade.sh:324-325`), and with the flag
+  on a stack that has a backup it refuses `rehearsal-required`. Say so next to the upgrade command (sheet :210-223):
+  only the first upgrade after adopt takes `--no-rehearsal`.
+
+ops-01 is testing both on 1013 (mos-1548). F10 is also docs only. The grep in the acceptance list covers its lines too,
+and BUILD.md records them.
+
+## Brief: F8 and F9, the library persona import runs without the clone's node_modules
+
+Row: F8 and F9 for the 433 Run B rerun (ops-0273, mos-1546). Builder: a new Codex thread (mos-1542). Reviewer:
+Morgana (Claude), because the row touches the install path (mos-1542 rule 4). When it lands, ops-01 reruns Run B P1
+at that commit.
+
+F8, confirmed at N = 094124b4e: `scripts/case2-install.sh:185` runs
+`node "$REPO/scripts/case2-persona-import.mjs"` from the clone (`REPO`, :38). `case2-persona-import.mjs:32` imports
+`yaml`, and a fresh clone has no `node_modules`, so the import fails `ERR_MODULE_NOT_FOUND`. The copy just made at
+`$COPIES/$COMMIT` (:178) has `node_modules` (mos-1546). ops-01 reproduced `ERR_MODULE_NOT_FOUND` from a checkout
+with no `node_modules`.
+
+Fix F8 one of two ways, and say in BUILD.md which and why: run the importer from the copy
+(`$COPIES/$COMMIT/scripts/case2-persona-import.mjs`), or make node resolve its modules from the copy. The importer's
+relative import of `../packages/harness/src/bundle.mjs` must still resolve to the same commit's file. Whatever you
+pick has to work when the clone has no `node_modules` at all.
+
+F9: :186 keeps only `tail -n 1` of the importer's output. For an uncaught node error that line is the
+node banner (`Node.js v24.22.1` on 1013, mos-1546), so the refusal hides the cause. Make the refusal carry the error line, for example the first line
+matching `Error` or `ERR_`, falling back to the last line. Keep it to one line. Don't put a full stack trace in the
+refusal.
+
+Class check, same row: at N, `grep -n 'node "$REPO/' scripts/case2-install.sh scripts/case2-precheck.sh
+scripts/stack-copy.sh` finds only :185. Rerun that grep. Also list every clone-side `.mjs` those three scripts run
+that imports a package (a bare specifier, not `node:` or a relative path), and record the list in BUILD.md and the
+review request. Fix any other hit in this row only if it is the same defect, and say so.
+
+Test: add a new, append-only test block to `packages/cli/tests/case2-install.test.mjs`. It runs the library persona
+import with no `node_modules` beside the script, and must fail at N. It needs no mos-1272 OK (mos-1546). Add a second
+assertion that the F9 refusal carries the error line, not `Node.js v...`. In BUILD.md, explain why the existing
+case2-install tests missed this. ops-01 thinks the checkout's `node_modules` hid it; check that.
+
+Gate: Morgana approves the manifest. Every package suite (except queue) and every `scripts/test-*.sh` are green on
+Sage's gate, the new test fails on N, and a mutant that puts back `$REPO` at :185 is killed by the new test.

docs/plans/2026-10-23_prd-1-17-brief.md

@@ -0,0 +1,82 @@
+# PRD 1.17 brief: Case 2 story files are DOCX
+
+Sage, 2026-10-23, for mos-1366 item 1, mos-1467 and mos-1470. This follows
+`docs/plans/BRIEF-TEMPLATE.md`. Gitea #1815, Vikunja 570.
+
+## PRD 1.17 Case 2 story files are DOCX (Q235 to Q237, Q239)
+
+### Problem
+
+Jason's Q235 to Q237 make Case 2 story files DOCX, with Markdown kept for notes
+and docs. PRD 1.16 still says every story file is Markdown in the user's
+repository, seen in Obsidian. The 1.17 text is approved: Jason approved d8 at
+435a7458d in Q239 with O2, which adds the Console Connections view (mark J-b).
+d9 carries that view in Mos's mos-1443 R3 text. Webby approved d9 in rounds 7
+and 8 (webby-0214, webby-0217), and Mos passed the J-b check in mos-1470.
+
+The approved text is `agents/sage/work/prd-1-17/DRAFT-d9.md` at 4607e15b8, blob
+sha256 02f28decad7f946f. Its base is PRD 1.16, `docs/prd/mosaic-stack.md` blob
+a6db9b4a at 482e865ac (row 291).
+
+### Owner and reviewer
+
+- Owner: Gosalyn.
+- Reviewer: Webby.
+- After: row 291 (PRD 1.16).
+
+### Files owned
+
+The four files in DRAFT-d9.md's "Files the row would own", as it lists them:
+- `docs/prd/mosaic-stack.md`.
+- `packages/tasks/requirements.json`: version 1.17, the titles of REQ-LIB-1,
+  REQ-LIB-2 and REQ-LIB-4, and the new ids REQ-LIB-8 and REQ-LIB-9 after
+  REQ-LIB-7 and before REQ-INST-1.
+- `packages/tasks/tests/requirements.test.mjs`: the version pin 1.17, the count
+  87 (:21), and the duplicate-id message `requirements[87].id: REQ-ROLE-1 twice`
+  (:77).
+- `packages/bus/tests/requirements.test.mjs`: the list length 87 (:48).
+
+### What ships
+
+- Every "Replace", "Add, after", "becomes" and "New" instruction in DRAFT-d9.md's
+  PRD sections, applied to the 1.16 text word for word. Each quoted old text
+  occurs once in a6db9b4a, except "The Console shows each cite's scope.", which
+  d9 scopes to REQ-LIB-2. Webby checked those counts in round 6.
+- The 1.17 header, Status line, source lines and notes as d9 writes them.
+- requirements.json as d9's requirements.json note says: REQ-LIB-1, REQ-LIB-2 and
+  REQ-LIB-4 take the new titles, REQ-LIB-5 and REQ-LIB-6 keep theirs, and
+  REQ-LIB-8 and REQ-LIB-9 are added with the titles d9 gives, so the count is 87.
+  REQ-LIB-4's title is 117 characters, under the 120 limit in `requirements.mjs`
+  (mos-1443 R2).
+- Nothing from d9's review sections goes into the PRD. That covers "Settled
+  points", the "d2 changes" through "d9 changes" lists, "What d5 adds", "Marked
+  for Jason" and the impact map notes.
+
+### Out of scope
+
+- The build rows for Vikunja 570 and 571, which Sage files after the landing.
+- The queue changes in the impact map (A24, A57 to A59), which go through
+  `scripts/mosaic queue` (C9).
+- Gyro's design edit R3.4 at 767bb62c7.
+- Mos's build-order call (mos-1470): the Connections view lands before the first
+  real chapter import opens. That belongs to Gyro's 571 rows, not the PRD.
+
+### Gate
+
+- Webby checks the candidate's PRD diff against DRAFT-d9.md, one instruction at a
+  time, and checks that nothing else changed.
+- No new Jason question. Q239 approved the text, and a change beyond d9 would
+  need a new version and his approval.
+- On Sage's gate:
+  - tasks, run whole;
+  - bus, run whole, because the broker loads requirements.json;
+  - cli `stack-copy.test.mjs`;
+  - every `scripts/test-*.sh`, under `timeout -k 10`.
+- Mos gets the landing commit (mos-1470).
+
+### Handoffs
+
+Every seat hands off directly (DECISIONS Q210, mos-1221). When the owner pushes a
+round or the reviewer posts a verdict, that seat messages the next seat's T3
+thread and Sage's with `mcp__t3__t3_send_message`. Mos has one step here, which
+is receiving the landing commit.

docs/plans/DEFERRED.md

@@ -664,3 +664,50 @@ collection never checks it again and the count reads as known with 0. The row 30
 behavior as it stands, so the move didn't change it. Bound to a follow-up row on row 270's
 store-unreadable path. The fix keeps the unreadable state until the header reads clean, or re-checks the
 header on every collection. Either way it's an old-test change and goes to Mos.
+
+## Row306 N1: the revoke Set doesn't survive a broker restart
+
+Morgana, row 306 BUILD.md (#1813, landed 2d0318a44; Dewey agrees, dewey-0918). `#accessRevoked` lives in
+memory. After a broker restart, recover() rebinds an earlier host's run, and if that run makes a bus call
+before the launcher's SIGTERM, it answers `not-holder` and the run exits 22, as every revoked run did before
+306. Seeding the Set at a rebind needs a mark only `#revokeLost` writes; `reason` and `by` on the ended
+claim aren't one (design D1's alternative). Bound to the next row that changes the broker's recover() path.
+
+## Row306 N2: a pending limit stop answers before the revoke
+
+Morgana, row 306 BUILD.md (#1813, landed 2d0318a44). A revoked run that also has a pending limit stop gets
+`#limitStop`'s `not-holder` on `message.receive` and `state`, because that check runs before `#agent`. It's
+rare and the run still stops. Bound to the next row that changes `#limitStop` or the order of those checks.
+
+## Row226 N1: the install id regex is narrower than ID_PATTERN
+
+Webby, row 226 round 1 (webby-0225, #1727, landed 661890e90). case2-install.sh:56 refuses a business id
+with `.` or `_`, which ID_PATTERN (vocabulary.mjs:199) and case2-precheck.sh:67 accept. Gosalyn confirmed
+it isn't deliberate (gosalyn-0208). It fails closed, so a real id with either character is refused, not
+mishandled. Bound to the next row that changes case2-install.sh: take the ID_PATTERN set, and add a test.
+
+## Row226 N2: a first-run validate refusal leaves personas and the slot dir
+
+Webby, row 226 round 1 (webby-0225). After a validate refusal on a first run, the staged personas and the
+empty token slot dir stay behind, and a re-run counts them as present. Bound to the same follow-up as N1:
+remove what this run created, as the business file path already does (install.sh:198/:202/:218).
+
+## Row226 N3: the run sheet doesn't pin the clone to the copy's sha
+
+Webby, row 226 round 1 (webby-0225). install.sh:217 validates with the checkout's scripts/mosaic, not the
+copy's, and host-run-sheet.md:237 never says the clone must be at `<sha>`. Bound to the same follow-up:
+a HEAD check in the install or one clause on the run sheet.
+
+## Row226 N4: --library-status refuses after a 5 s lock wait
+
+Webby, row 226 round 1 (webby-0225). If the bus holds the library lock for more than 5 s,
+`case2-precheck.sh --library-status` refuses with `ERROR library-sync-busy`. A re-run clears it. Recorded
+as a known operator step, no fix bound.
+
+## Row283 N1: SURVEY-RUN.md shows the scopes line without supporting
+
+Webby, row 283 round 1 (webby-0267, #1788, review note queue-283/REVIEW-manifest-b2a1f4092.md on
+webby/reviews c6ea27aab). docs/case2/SURVEY-RUN.md:96 documents the `--mapping` line as
+`scopes canon .., playground .., unmapped ..; indexed ..`, which predates the supporting scope 283 adds.
+Nothing reads the file (decision 137). Bound to the next docs commit that touches SURVEY-RUN.md: add the
+supporting count to that line.

docs/plans/QUEUE.md

@@ -33,7 +33,7 @@ Gaps found while working go to `docs/plans/DEFERRED.md`, not here.
 
 <!-- mosaic-queue:begin -->
 
-Generated from `docs/plans/queue.json` revision 3588 by `queue render`. Do not edit between the markers; change the queue with `scripts/mosaic queue`.
+Generated from `docs/plans/queue.json` revision 3732 by `queue render`. Do not edit between the markers; change the queue with `scripts/mosaic queue`.
 
 | # | Piece | Owner | Issues | State | After | Gate | Brief | Note |
 |---|---|---|---|---|---|---|---|---|
@@ -252,18 +252,18 @@ Generated from `docs/plans/queue.json` revision 3588 by `queue render`. Do not e
 | 213 | Case 2 C2-08 creative roles, persona file and block, M1, M2, M6, M10, prompt passed by file | morgana; reviewers webby | #1714 | done | — | Webby approves the manifest. The business, bus and harness suites, `scripts/test-config.sh` and every `scripts/test-*.sh` are green on Sage's gate, and the `models` mutant is killed. (sage) | `docs/plans/2026-10-20_case2-rows.md` § C2-08 creative roles, persona file and block, M1, M2, M6, M10, prompt passed by file | LANDED 361ba2387 (39 paths incl. 4 packet files). Patch-id f313e69b6f7e = c771a36f4..2b3e67e36; verify-commit ok, 35 manifest paths. Same combined gate as 195: business 200/0 bus 542/0 harness 140/0 cli 663/0, test-config 31/0 and all 10 scripts green, models mutant L1 killed. Webby N2 is row 235 acceptance (mos-1163). |
 | 214 | Case 2 C2-11a editor wikilink node, after measuring whether [[ round-trips | herb; reviewers filbert | #1715 | in-progress | — | Filbert approves the manifest. The webui suite is green on Sage's gate, along with every `scripts/test-*.sh`. (sage) | `docs/plans/2026-10-20_case2-rows.md` § C2-11a editor wikilink node, after measuring whether [[ round-trips | — |
 | 215 | Case 2 C2-04 the library entry in the business file, consumer skips, M9, mirror, library.file and library.status | herb; reviewers filbert | #1716 | done | — | Filbert approves the manifest. The business, seat, cli, project, bus and webui suites are green on Sage's gate, along with every `scripts/test-*.sh`. (sage) | `docs/plans/2026-10-20_case2-rows.md` § C2-04 the library entry in the business file, consumer skips, M9, mirror, library.file and library.status | LANDED e54e05463 on 6096b051b (sage-2094). Patch-id 2f68188b6c9d equals a36523713..dde3445ab; 118 paths, blobs and modes equal; tree 5b1613245 equals merge-tree. No path overlap with rows 66/243; no hash pins either way. Gate: Filbert APPROVE rev 2924; herb-0095 grant sage-2071 2634 pass 0 fail, 1 webui skip (editor rebuild needs esbuild 0.28.2, env, not a 215 path), accepted. |
-| 216 | Case 2 C2-05a lookup index and queries | researcher; reviewers filbert | #1717 | briefed | 268 done | Filbert approves the manifest. The library suite is green on Sage's gate, along with every `scripts/test-*.sh`. (sage) | `docs/plans/2026-10-20_case2-rows.md` § C2-05a lookup index and queries | Rulings on phase A: agents/sage/work/queue-216/RULINGS.md (da9555ca2). r2 rebases on row 268's landing and adds the four PRD 1.14 playground tests. |
-| 217 | Case 2 C2-06 the citation guard, the page store, the runner texts and the retry | launchpad; reviewers webby | #1718 | briefed | 268 done | Webby approves the manifest. The library, bus and harness suites are green on Sage's gate, along with every `scripts/test-*.sh`. (sage) | `docs/plans/2026-10-20_case2-rows.md` § C2-06 the citation guard, the page store, the runner texts and the retry | — |
+| 216 | Case 2 C2-05a lookup index and queries | researcher; reviewers filbert | #1717 | done | 268 done | Filbert approves the manifest. The library suite is green on Sage's gate, along with every `scripts/test-*.sh`. (sage) | `docs/plans/2026-10-20_case2-rows.md` § C2-05a lookup index and queries | LANDED fbe57a05b (replay of r5 dae76ccc2 onto 8e2885d26, 3 commits, 0 patch-id mismatches), pushed 21:09Z with 582b86935. Sage joint gate GREEN 21:05:34Z on fbe57a05b, every package suite but queue and every scripts/test-*.sh green. Filbert APPROVE r2 c31384 rev 3697. N3 (get returns a universe own supporting files) binds the C2-05c row; N1 doc, N2 universeInfo echo and BUILD.md pronoun nit go to a later docs commit. |
+| 217 | Case 2 C2-06 the citation guard, the page store, the runner texts and the retry | beakley; reviewers webby | #1718 | briefed | 268 done, 283 done | Webby approves the manifest. The library, bus and harness suites are green on Sage's gate, along with every `scripts/test-*.sh`. (sage) | `docs/plans/2026-10-20_case2-rows.md` § C2-06 the citation guard, the page store, the runner texts and the retry | — |
 | 218 | Case 2 C2-12 the setup sheet for Melanie and the survey run sheet | sage; reviewers webby | #1719 | done | — | Doc only. Webby approves it against C2-01's real flags. Before landing, grep `packages/*/tests` and `scripts/test-*.sh` to confirm no test reads either file. (sage) | `docs/plans/2026-10-20_case2-rows.md` § C2-12 the setup sheet for Melanie and the survey run sheet | LANDED f8276c5eb (pushed, on Darkwing sessions b65f3a0e8). Webby APPROVE r1-r3 (revs 2848, 2856, 2860; r3 candidate 1a38baf5af2a = 89ba79d94). Patch-id 18ba1e40ad29 seat 5c6f73ed7..89ba79d94 equals landed b65f3a0e8..f8276c5eb; three blobs equal 89ba79d94. Gate: doc only, 0 test readers (control 3). Melanie handover waits on C2-06 and Jason (#419). |
 | 219 | Case 2 C2-09a one thread per creative instance | rocko; reviewers dewey | #1720 | done | — | Dewey approves the manifest. The bus, cli and webui suites are green on Sage's gate, along with every `scripts/test-*.sh`. Watch for hash pins on `bus.js` and `broker.mjs` (`packages/bus/tests/channel-proof.test.mjs` pins a webui file). (sage) | `docs/plans/2026-10-20_case2-rows.md` § C2-09a one thread per creative instance | LANDED 5fdfd7275 on refactor 10:40Z 10-23 (8 row commits cherry-picked onto 2efd127ce, range-diff all =, patch-ids match, tree e86a84a85 = gated merge 054da642f; top commit packet-only evidence). Gate manifest 4a2271dd: node 2523/0/2, ten shells 449/0, 24 mutants killed, audit ok (Rocko). Dewey approve rev 3507 c31108. N1 U6 persona label DEFERRED line follows. Slug fix Vikunja 590 and network leak 591 rows next. |
-| 220 | Case 2 C2-10a no raw session view (M7) and no raw Discord engine (M8) | researcher; reviewers filbert | #1721 | briefed | — | Filbert approves the manifest. The conversation and discord suites and `scripts/test-discord.sh` are green on Sage's gate, along with every `scripts/test-*.sh`. No test reaches a Discord server. (sage) | `docs/plans/2026-10-20_case2-rows.md` § C2-10a no raw session view (M7) and no raw Discord engine (M8) | Rulings on phase A: agents/sage/work/queue-220/RULINGS.md (da9555ca2). Scope adds packages/business/src/library-seats.mjs (imported by path, no index export), its test, and control-board serve.mjs. r2 building as a Haiku subagent. |
+| 220 | Case 2 C2-10a no raw session view (M7) and no raw Discord engine (M8) | researcher; reviewers filbert | #1721 | done | — | Filbert approves the manifest. The conversation and discord suites and `scripts/test-discord.sh` are green on Sage's gate, along with every `scripts/test-*.sh`. No test reaches a Discord server. (sage) | `docs/plans/2026-10-20_case2-rows.md` § C2-10a no raw session view (M7) and no raw Discord engine (M8) | LANDED fbe57a05b (replay of r5 739b868b6 onto 93694c518, 9 commits, 0 patch-id mismatches; tip 8e2885d26 for 220), pushed 21:09Z with 582b86935. Sage joint gate GREEN 21:05:34Z on fbe57a05b: every package suite but queue 0 fail 0 skipped, every scripts/test-*.sh rc 0. Filbert APPROVE r2 c31383 rev 3696. Researcher r5 reruns and mutants green. Filbert N1 (route test catalogue only) open, not blocking. |
 | 221 | Case 2 C2-20 Bean and Chet persona import, with a count-only dry run | gosalyn; reviewers webby | #1722 | done | — | Webby approves the manifest. The test file runs green on its own and the cli suite is green on Sage's gate, along with every `scripts/test-*.sh`. (sage) | `docs/plans/2026-10-20_case2-rows.md` § C2-20 Bean and Chet persona import, with a count-only dry run | LANDED 300766450, pushed. Cand 8f403d0d4, manifest 20f05e3a6ad5, 22 paths, verify-commit ok, patch-id dfbb754c6fb4 equals 62ddc96cc..8f403d0d4. Gate 11:07:50-11:19Z on b1fece6f0: test file alone 11/0, harness 140/0, cli 677/0, all scripts green. Brief Gate met: webby-0073 approve, test file alone, cli, scripts. No live run in the Gate; the import itself waits on Jason. N1 N2 N4 go to C2-20b, N3 to DEFERRED. |
 | 222 | Case 2 C2-03a fetch-only sync | megavolt; reviewers dewey | #1723 | done | — | Dewey approves the manifest. The library and bus suites are green on Sage's gate, along with every `scripts/test-*.sh`, and the mutant is killed. A search of the test run's output for the fixture token finds nothing. (sage) | `docs/plans/2026-10-20_case2-rows.md` § C2-03a fetch-only sync | sage-2024 on megavolt-0089: core.createObject=rename in the fetch argv is accepted as a brief departure, since C2-04 inspectMirror refuses nlink 2. Dewey checks it. The askpass env keys, export SAFE in project/src/git.mjs, bus/tests/library-sync.test.mjs and the SURVEY-RUN user line are accepted. The 5 s client timeout residual goes in BUILD.md and Dewey rules fix or defer. Slot after 197 proof 3 and the 249 gate. |
 | 223 | Case 2 C2-07 runner retry on a guard refusal, and the runner's notices | researcher; reviewers filbert | #1724 | blocked (from briefed): Q226: C2-07 folded into C2-06 (row 217). No work here; Jason parks it. | — | Filbert approves the manifest. The harness suite is green on Sage's gate, along with every `scripts/test-*.sh`. (sage) | `docs/plans/2026-10-20_case2-rows.md` § C2-07 folded into C2-06 | — |
 | 224 | Case 2 C2-05b broker lookup verbs and typed tools | della; reviewers dewey | #1725 | in-progress | 216 done | Dewey approves the manifest. The bus and harness suites are green on Sage's gate, along with every `scripts/test-*.sh`. (sage) | `docs/plans/2026-10-20_case2-rows.md` § C2-05b broker lookup verbs and typed tools | — |
-| 225 | Case 2 C2-10b Console chat: replies, citations, write notices and the status line | researcher; reviewers dewey | #1726 | briefed | — | Dewey approves the manifest. The webui suite is green on Sage's gate, along with every `scripts/test-*.sh`. Grep for hash pins on `bus.js` and `serve.mjs` before in-review. (sage) | `docs/plans/2026-10-20_case2-rows.md` § C2-10b Console chat: replies, citations, write notices and the status line | — |
-| 226 | Case 2 C2-13 install script and precheck for the host | gosalyn; reviewers webby | #1727 | in-progress | 215 done, 221 done, 222 done, 230 done | Webby approves the manifest. The test file and the cli suite are green on Sage's gate, along with every `scripts/test-*.sh`. The run on the host is a separate window with Jason's go. (sage) | `docs/plans/2026-10-20_case2-rows.md` § C2-13b install script and library precheck | — |
-| 227 | Case 2 C2-14 end-to-end acceptance on a scratch root | launchpad; reviewers dewey | #1728 | briefed | — | Dewey runs the script and approves. It is green on Sage's gate with every `scripts/test-*.sh`. (sage) | `docs/plans/2026-10-20_case2-rows.md` § C2-14 end-to-end acceptance on a scratch root | — |
+| 225 | Case 2 C2-10b Console chat: replies, citations, write notices and the status line | fethry; reviewers dewey | #1726 | briefed | 217 done | Dewey approves the manifest. The webui suite is green on Sage's gate, along with every `scripts/test-*.sh`. Grep for hash pins on `bus.js` and `serve.mjs` before in-review. (sage) | `docs/plans/2026-10-20_case2-rows.md` § C2-10b Console chat: replies, citations, write notices and the status line | — |
+| 226 | Case 2 C2-13 install script and precheck for the host | gosalyn; reviewers webby | #1727 | done | 215 done, 221 done, 222 done, 230 done | Webby approves the manifest. The test file and the cli suite are green on Sage's gate, along with every `scripts/test-*.sh`. The run on the host is a separate window with Jason's go. (sage) | `docs/plans/2026-10-20_case2-rows.md` § C2-13b install script and library precheck | landed 661890e90 (replay of bfed0aa6c 893b4fd25 f3fabf51b onto 8352da88c, patch-ids equal, four blobs and modes equal to f3fabf51b) and fd3d2a99f (Darkwing 8a6321790 replay, mos-1519), tree 78fc5ad21 equals merge-tree. Webby APPROVE rev 3641. Sage gate GREEN 19:56Z on f3fabf51b: 17 package suites and 10 scripts, 0 fail. Webby N1-N4 DEFERRED e2b873390. #1727 closed. |
+| 227 | Case 2 C2-14 end-to-end acceptance on a scratch root | gizmoduck; reviewers dewey | #1728 | in-progress | — | Dewey runs the script and approves. It is green on Sage's gate with every `scripts/test-*.sh`. (sage) | `docs/plans/2026-10-20_case2-rows.md` § C2-14 end-to-end acceptance on a scratch root | — |
 | 228 | Row A: ZAI_API_KEY passes through ENV_ALLOW to sessions, README line, pass-through test (XS, Haiku high) | researcher; reviewers webby | #1729 | done | — | Webby approves the manifest. The mutant is killed. The seat suite and the cli suite are green on Sage's gate with every scripts/test-*.sh. (sage) | `docs/plans/2026-10-20_case2-rows.md` § Brief: row A, ZAI_API_KEY in the session env allowlist | Landed 86249ac55 (pushed 07:25Z) on 59f817c32: the 3 manifest paths from cf18c42b9. Patch-id b6ffe31feb0d equals the candidate's; modes and blobs match; verify-commit ok (3 paths). Sage's combined 228+238 gate on c515273db plus both rows' 6 paths, 07:11:30Z to 07:23:34Z: seat 165/0, cli 640/0, all ten scripts/test-*.sh 585/0. |
 | 229 | Row B: per-instance pi agent dir for Chet's Codex login, design only, starts after 10-27 (#428) | gosalyn; reviewers webby | #1730 | briefed | — | A live check, with Jason's or Mos's go, that two clients on one ChatGPT login don't revoke each other's refresh tokens. No build row starts before it passes. Held until after 10-27. (sage) | `docs/plans/2026-10-20_case2-rows.md` § Brief: row B, a per-instance pi agent dir for Chet's Codex login (#428) | — |
 | 230 | Case 2 C2-13a unit render and host precheck (case2-unit.sh, case2-precheck.sh) | gosalyn; reviewers webby | #1732 | done | — | Webby approves the manifest. The test file and the cli suite are green on Sage's gate, along with every scripts/test-*.sh. A run on a host is a separate window with Jason's go. (sage) | `docs/plans/2026-10-20_case2-rows.md` § C2-13a unit render and host precheck | Landed c8bc5cf4c on refactor (base 390ea5261), pushed. Patch-id f4b49eb68997 matches git diff 722136772..96768766c on the 5 manifest paths (manifest fbb0d7e42c67, Webby approve r2 rev 2563). packages/cli/README.md 3-way with row 199, hunks apart. Gosalyn gate on 96768766c: cli 541/0, scripts 429/0, mutants 10/10. Merged tree check: case2-unit 30/0, host 42/0. |
@@ -275,7 +275,7 @@ Generated from `docs/plans/queue.json` revision 3588 by `queue render`. Do not e
 | 236 | #436b Gitea grant path build: seat accounts and tokens through an approved grant, schema 3j-3k (design r5 1be535aca, due 10-27 at risk; live waits for Jason's section 8 approval and bootstrap step) | megavolt; reviewers dewey | #1742 | done | 210 done, 234 done | Dewey approves the manifest. The bus, business and cli suites and every scripts/test-*.sh are green on Sage's gate. Section 9's mutants are killed, N9's restart test included. (sage) (sage) | `docs/plans/2026-10-20_agent-credentials.md` § Brief: #436b Gitea grant path, build (schema 3j-3k) | Landed bd5f11ded on refactor, a fast-forward on be2b008cc. It is 08840f3c1 rebased past 194 (commit 1 unions only, 2-7 =) plus 2 stale-pin fixes and a gitea-not-configured raise test (sage-2559). Dewey approve on manifest 0b00269b. Megavolt gate under Sage CLEAR: 2c green, bus 765, business 228, cli 832, ten scripts rc=0, mutants 40/40; skips named, env-only. Overlap 13/257 clean. Schema 3j-3k. #1742 closed. |
 | 237 | Row 199 follow-up N1: one decision publishes once (publish-busy or #spent recheck) | megavolt; reviewers duckworth | #1743 | done | 199 done | Duckworth approves the manifest. The bus suite and every scripts/test-*.sh are green on Sage's gate, and the mutant is killed. (sage) (sage) | `docs/plans/2026-10-20_agent-credentials.md` § Brief: row 199 follow-up N1, one decision publishes once | Landed d7d943199 on refactor (local, push pending), patch-id c5f4beb4 = e42415935, manifest bb777cb0 blobs checked. Sage gate 01:31-01:44Z on 816d48b03+4 paths: M1 killed (bus 1/13, cli 1/8), every package suite and scripts/test-*.sh green (bus 478, cli 564). |
 | 238 | row 200 follow-up N1: the sso-config hint carries --instance NAME (#1744) | launchpad; reviewers webby | #1744 | done | 200 done | Webby approves the manifest; stack-release.test.mjs whole, cli suite and every scripts/test-*.sh green on Sage's gate; the mutant killed (sage) | `docs/plans/2026-10-20_stack-release-sso.md` § Brief: row 200 follow-up N1, the sso-config hint names the instance | Landed d49b1f2bd (pushed 07:25Z) on 86249ac55: the 3 manifest paths from 4c90099ea. Patch-id b9d0bb0ee3c7 equals the candidate's; modes and blobs match; verify-commit ok (3 paths). Sage's combined 228+238 gate on c515273db plus both rows' 6 paths, 07:11:30Z to 07:23:34Z: seat 165/0, cli 640/0, all ten scripts/test-*.sh 585/0. Mutant (sso-config drops --instance) killed, survived none. Round 1 N1 stays on the #1744 carry list. |
-| 239 | Row 194 follow-up: the credential revoke runs under the writer's lock, refusals after a revoke say so, and a stale-revision fire test (duckworth-0074, mos-1158) | honker; reviewers duckworth | #1745 | in-progress | 194 done | Duckworth approves the manifest. The bus, business, cli and webui suites and every scripts/test-*.sh are green on Sage's gate, and the mutants are killed. (sage) (sage) | `docs/plans/2026-10-20_agent-lifecycle.md` § Brief: row 194 follow-up, the revoke under the writer's lock and a fire test | — |
+| 239 | Row 194 follow-up: the credential revoke runs under the writer's lock, refusals after a revoke say so, and a stale-revision fire test (duckworth-0074, mos-1158) | honker; reviewers duckworth | #1745 | done | 194 done | Duckworth approves the manifest. The bus, business, cli and webui suites and every scripts/test-*.sh are green on Sage's gate, and the mutants are killed. (sage) (sage) | `docs/plans/2026-10-20_agent-lifecycle.md` § Brief: row 194 follow-up, the revoke under the writer's lock and a fire test | LANDED e0cb1db2c (ff from 546366f4a) 22:24:58Z 10-23. Duckworth APPROVE c31422 rev 3723. Honker slot: touched files 65/65, mutants 9/9. Sage full gate GREEN 22:24:24Z: all package suites 0 fail (bus 909, cli 976, plugins 119, webui 411) and every scripts/test-*.sh rc 0; skips are queue canonical-root and task live-provider only. Overlap: 298 shares broker.mjs, runtime.mjs, instance-settings.mjs and rebases. N+1 for 433 P2/P3 (mos-1540). |
 | 240 | Installer I4: hostcheck, the bwrap profile check, pins and boot unit, from r6 B2 (MVP, Q187, Vikunja #432; split from I3) | darkwing; reviewers filbert | #1746 | done | 233 done | Filbert approves the manifest. The test file, the cli suite and every scripts/test-*.sh are green on Sage's gate, with the mutants killed. (sage) (sage) | `docs/plans/2026-10-20_installer-rows.md` § I4 hostcheck: the bwrap profile check, pins and boot unit | Landed c515273db (pushed 06:57Z) on da3051ccc: the 9 manifest paths from ad1b23ab2. Patch-id 48e376efe8a4 equals the candidate's; modes and blobs match; verify-commit ok (9 paths). Sage's gate on 060a17b54 plus the 9 paths, 06:45:05Z to 06:56:21Z: cli 639/0, all ten scripts/test-*.sh 585/0. Darkwing's r2: singles 37/0, M1-M8 8/8. Filbert N1 and N2 in DEFERRED (da3051ccc); N3 by design. |
 | 241 | Row 237 follow-up: one decision lands once, a two-ticket broker land test and three mutants on the landing guards (megavolt-0069, sage-1651, P19 441) | megavolt; reviewers duckworth | #1747 | done | 237 done | Duckworth approves the manifest. The bus, seat and cli suites and every scripts/test-*.sh are green on Sage's gate, and the three mutants are killed. (sage) (sage) | `docs/plans/2026-10-20_agent-credentials.md` § Brief: row 237 follow-up, one decision lands once, with tests at the broker | Landed 5d4a61776 on refactor, pushed (base e65a3ab4d). Blobs from 3e3ed303e on 2 paths; patch-id a1649f80 equals git diff f5753c0e8..3e3ed303e on those paths; ls-tree modes equal; manifest e8266864 verifies on the landed files. Sage slot on bbf3b1ee8: M1-M3 killed; gate 15 packages 2797/0, 10 script suites 429/0. Duckworth approve 29870 rev 2628. |
 | 242 | Row 237 follow-up N1: a retry after publish-timeout pushes once; hold the decision or kill and wait for the push, a slow-push retry test and a mutant (duckworth-0069, P19 440) | megavolt; reviewers duckworth | #1748 | done | 237 done | Duckworth approves the manifest. The bus and cli suites and every scripts/test-*.sh are green on Sage's gate, and the mutant is killed. (sage) (sage) | `docs/plans/2026-10-20_agent-credentials.md` § Brief: row 237 follow-up N1, a retry after publish-timeout pushes once | Landed 5fb736b92 on refactor, pushed (base 96bac588f). Blobs from 635c10924 on 3 paths; patch-id ceb741ee equals git diff 8fede5fc6..635c10924 on those paths; ls-tree modes equal; manifest 1fbfab6c verifies on the landed files. Megavolt M1/M2 killed on Sage's slot; Sage gate 15 packages 2826/0, 10 script suites 429/0. Duckworth approve 29889 rev 2639. |
@@ -288,7 +288,7 @@ Generated from `docs/plans/queue.json` revision 3588 by `queue render`. Do not e
 | 249 | row 235 follow-up: the grant undo records hostLineLeft when install never returned, since the remote add can outlive an abort or timeout (mos-1166) | gizmoduck; reviewers duckworth | #1751 | done | — | Duckworth approves the manifest. On Sage's gate the bus suite and the whole touched test files are green, and a mutant that drops the new catch branch is killed. (sage) | `docs/plans/2026-10-20_host-credentials.md` § Machine grant row b follow-up: the undo can't prove the remote add has ended | LANDED 9de5a57ab on refactor, pushed with 7b9737953 (DEFERRED N1). Range-diff: 8a04f4aa4..05595794b vs 8ca064158..9de5a57ab, same 3 paths, patch-id 99551b122e66 on both. Gate sage-2026 14:53Z: grant-executor whole 39/0, bus 598/0, no stub left, C1 (drop :1025) killed by G8 and both G23. Duckworth approve c30070. |
 | 250 | K12 (cohort.test.mjs) reads cgroup.events after cgroup.kill under load: print the shim's reason, then fix the cause at the source (Vikunja #450) | gizmoduck; reviewers filbert | #1755 | done | 197 done | reviewer approves the manifest; conversation and control-board suites whole on Sage's slot (sage) | `docs/plans/2026-10-21_k12-cohort-events.md` § Brief: K12 reads cgroup.events after cgroup.kill under load | LANDED 1b6158ce2 on refactor 19:42Z: candidate c1a858975 on 3b0aef995, manifest eca0b8e2, Filbert APPROVE rev 2957 (#1755 c30130). patch-id 29786caa = candidate; blob diff empty; tree 59f1e4781 = merge-tree. Gate on Sage slot sage-2109 (gizmoduck-0150): P1/P2/M1 as predicted, conversation whole 3x 183/183 plus concurrent pair, control-board 124/124. No drift on paths since base. |
 | 251 | T27 (host-run.test.mjs:453) lists no identities right after ssh-add -t 1: print timing and agent state, then fix the cause at the source (Vikunja #453) | darkwing; reviewers dewey | #1756 | done | 197 done | reviewer approves the manifest; bus suite whole on Sage's slot (sage) | `docs/plans/2026-10-21_t27-ssh-add-lifetime.md` § Brief: T27 lists no identities right after ssh-add -t 1 | LANDED d37210288 on b79ad5f2c: candidate 27f01ef63 manifest f2bdd684, patch-id 440d2442c976 equal, blob diff empty, tree matches merge-tree. Dewey r2 approve rev 2996 (c30168). Gate: bus suite whole in a clean worktree, 627/627 at 21:30:33Z on Sage's slot. Overlap check vs 194/198/244/253/254 branches: none. DEFERRED sleep-orphan entry follows as a doc commit. |
-| 252 | Console inbox Approve and Deny for grant requests (#435, J2) | scrooge; reviewers webby | — | in-progress | — | Webby approves DESIGN.md then manifest; webui, bus, cli suites and every test-*.sh green on Sage's gate; DESIGN mutants killed; REQ-WEB-2 PRD amendment landed first (sage) | `docs/plans/2026-10-21_console-inbox-approve.md` § Gate | mos-1193. Chained on row 196's candidate (Q177): design starts now on Gander's row 196 build; code rebases onto 196's landing. Vikunja #435. |
+| 252 | Console inbox Approve and Deny for grant requests (#435, J2) | scrooge; reviewers webby | #1753 | done | — | Webby approves DESIGN.md then manifest; webui, bus, cli suites and every test-*.sh green on Sage's gate; DESIGN mutants killed; REQ-WEB-2 PRD amendment landed first (sage) | `docs/plans/2026-10-21_console-inbox-approve.md` § Gate | Landed 45ea3fa0d (replay of Scrooge 580037105 onto 30e6bb680, range-diff all =, 10 commits). Webby APPROVE c31229 rev 3612. Sage gate on 45ea3fa0d: every package suite 0 fail 0 skipped (bus 907, cli 943, webui 410), every scripts/test-*.sh rc 0, J1-J19 all killed except J11c and J18 (equivalent per BUILD.md), all restores match. Old-test numstat 1 1 vs fe4ee8c7b held. |
 | 253 | F27: case2-unit.sh and case1-accept.sh move to --tester-socket and refuse --tester-port with stack-release's migration wording; no .53/.54 copy with 196 until this lands (mos-1198 item 4) | gander; reviewers duckworth | #1758 | done | 196 done | reviewer approves DESIGN.md then the manifest; cli and webui suites whole and every scripts/test-*.sh on Sage's slot; mutants per DESIGN.md; static check covers scripts and tests (sage) | `docs/plans/2026-10-21_tester-socket-scripts.md` § Brief: case2-unit.sh and case1-accept.sh move to --tester-socket (F27) | Landed 48e450ce8 on refactor (fast-forward from aca16404c, 22 commits; landed sha = candidate, so range-diff and patch-id are identical by construction). Manifest 591020a1 (7 paths) rechecked against the commit: 0 mismatches. Gate: run 5 whole, cli 55 files, webui 58 files, all 10 scripts/test-*.sh green; M1-M40 killed 40/40. Duckworth APPROVE round 1, Gitea #1758 comment 30696. |
 | 254 | Library sync follow-up: client timeout, STATUS codes, README (222 deferrals, #1759) | megavolt; reviewers dewey | #1759 | done | 196 done | Dewey approves the manifest; bus, library and webui suites whole and every scripts/test-*.sh green on Sage's slot; the timeout and STATUS mutants killed (sage) | `docs/plans/2026-10-21_library-sync-followup.md` § Gate | Landed 331597709 (candidate b31300d79 blobs and modes on 41b0cf755; patch-id 96216216 equal, range-diff differs only in the message) plus doc eb9672c91 (Dewey N1 README sentence closed; N2 four 502 codes to DEFERRED, binding the Console library routes row). Merged-tree rerun on Sage's slot 23:44-23:55Z: library 77/0, bus 628/0, webui 305/0 with 1 skip, cli 749/0. Megavolt's gate megavolt-0102 covers scripts and both mutants. |
 | 255 | Bundled Pocket ID for users with no OIDC provider, design (Q203, #1760) | launchpad; reviewers webby | — | queued | 252 done | Webby approves DESIGN.md; design only, build rows follow after Sage checks it against Q203, O6, REQ-WEB-2 and REQ-INST-1 (sage) | `docs/plans/2026-10-21_bundled-pocket-id.md` § Gate | Vikunja 458, Gitea #1760, mos-1202 item 2. REQ-INST-2 lands in PRD 1.10 as post-v1 (mos-1204). Design only: no install, no download, no .53/.54, dragon-lin keeps Authentik. |
@@ -319,22 +319,22 @@ Generated from `docs/plans/queue.json` revision 3588 by `queue render`. Do not e
 | 280 | Bus tests: the scratch sshd proves it owns its port (194 gate follow-up, MVP, mos-1270) | rocko; reviewers duckworth | #1785 | done | — | Duckworth approves the manifest. Both files run whole, the bus suite is green on Sage's gate, the 30-run repeat has no timeout, and M1 is killed. Row 194 b17's full gate then runs on top. Any red goes to Mos (mos-1270). (sage) | `docs/plans/2026-10-22_sshd-port-race.md` § Brief: the scratch sshd's port is ours before a test uses it | Landed b0fd28b6f 07:57:30Z, ff from da5d3651d: b765f5cb8 (Duckworth approve rev 3153, manifest 27806c05) + slim packet. Sage gate bus 656/0/0, ge 41, hr 26 (c30431). Repeat 2010/2010 under cli 1588/1588, no timeout; M1/M2 killed 4/4. Full evidence d6c924764 on rocko/row280-da5d-20261022. N2-N4 carry in BUILD.md. 194 b17 rebases on b0fd28b6f. |
 | 281 | A fire or a delete revokes the instance's host and Gitea grants (194/236 follow-up, MVP, mos-1271) | megavolt; reviewers dewey | #1786 | done | 236 done | Dewey approves the design, then the manifest. Bus, business, cli and every touched test file run whole, plus the Docker gitea-grant test and every scripts/test-*.sh, green on Sage's gate. M1-M4 killed. Lands before .53 Case 1 hires a granted instance. Red goes to Sage, then Mos. (sage) | `docs/plans/2026-10-22_fire-revokes-grants.md` § Brief: no grant outlives its instance | LANDED e479521d3 ff on 385a7194c (17 commits, manifest b73d4c81). Slot on 7979fb41e green: bus 819, business 231, cli 837, dewey-bus 76 with gitea-grant-docker run, shells green under 3x limits, M1-M22 killed. M1 hang fixed in b4a (mos-1273). Skips: test-task row 244 live-provider pair, test-queue canonical root. DEFERRED: N1 host-unknown hint verb, N2 fire tool text, to the follow-up row. Dewey APPROVE c30614. |
 | 282 | PRD REQ-LIB-6 rewritten to Q223 and Q226 (mos-1320 item 8) | gosalyn; reviewers webby | #1787 | done | — | Webby approves against the ruling. requirements.test.mjs and every scripts/test-*.sh that reads the PRD or requirements.json are green on Sage's gate. Jason gets a report. (sage) | `docs/plans/2026-10-20_case2-rows.md` § PRD REQ-LIB-6 rewritten to Q223 and Q226 (mos-1320 item 8) | Landed 647424442 on 86a665bdf: 1841f7d4e and 6b5b06819 rebased, patch-ids equal (4e50b4b6, 16a7a02f), range-diff =, tree 4f30ed10a = Gosalyn's gated trial tree. Webby APPROVE rev 3308 c30764 on 6b5b06819. Gate 19:06Z on the tip tree: bus+tasks requirements and tasks verbs 37/0/0, 0 skips; no scripts/test-*.sh reads the PRD (control ok). PRD 1.15. 1.16 is row 291, waits for Jason. |
-| 283 | Case 2 C2-01d supporting folders, the supporting scope, the editor field and supportingPath (M12) | honker; reviewers webby | #1788 | briefed | 268 done, 282 done | Webby approves the manifest. The library and business suites are green on Sage's gate, along with every scripts/test-*.sh. (sage) | `docs/plans/2026-10-20_case2-rows.md` § C2-01d supporting folders, the supporting scope, the editor field and supportingPath (M12) | — |
+| 283 | Case 2 C2-01d supporting folders, the supporting scope, the editor field and supportingPath (M12) | honker; reviewers webby | #1788 | done | 268 done, 282 done | Webby approves the manifest. The library and business suites are green on Sage's gate, along with every scripts/test-*.sh. (sage) | `docs/plans/2026-10-20_case2-rows.md` § C2-01d supporting folders, the supporting scope, the editor field and supportingPath (M12) | LANDED 8d2856ee3 (replay of 0bf308dba onto 59226f878, 13 patch-ids equal) plus DEFERRED N1 93694c518. Webby APPROVE r1 c31338 rev 3677, r2 c31342 rev 3683 (mos-1528 G1 mapping.test:52). Sage full gate GREEN 20:37:16Z: all package suites but queue plus every scripts/test-*.sh, 0 fail, library 98/0, webui npm ci, editor build required. supporting.test first-run red placed (mos-1272, 54d9e07bb). #1788 closed c31358. Live unchanged 45dca69f6. |
 | 284 | Case 2 C2-05c the supporting scope and blob in the lookups | della; reviewers dewey | #1789 | briefed | 224 done, 283 done | Dewey approves the manifest. Library, bus and harness suites and every scripts/test-*.sh green on Sage's gate. Grep packages/*/tests for the scope enum pin and ['canon', 'playground'] before in-review; update each. (sage) | `docs/plans/2026-10-20_case2-rows.md` § C2-05c the supporting scope and blob in the lookups (sage-2833) | — |
 | 285 | Case 2 C2-08b role changes for agent writes and the chief's read grant | scrooge; reviewers webby | #1790 | briefed | 213 done, 291 done | Webby approves the manifest. Business suite, test-config.sh and every scripts/test-*.sh green on Sage's gate. Grep for CREATIVE_KINDS and 64-hex pins of changed role files. Sage checks it against mos-1309 item 5. (sage) | `docs/plans/2026-10-20_case2-rows.md` § C2-08b role changes for agent writes and the chief's read grant (mos-1309 item 5) | — |
 | 286 | Case 2 C2-03b push and per-seat credentials for the library mirror (with R4, mos-1323) | ludwig; reviewers dewey | #1791 | briefed | 222 done | Dewey approves the manifest. Library and bus suites and every scripts/test-*.sh green on Sage's gate, mutant killed. A search of the run output for the fixture token finds nothing. (sage) | `docs/plans/2026-10-20_case2-rows.md` § C2-03b push and per-seat credentials for the library mirror | — |
 | 287 | Case 2 C2-21 the grant executor for a library project | megavolt; reviewers dewey | #1792 | briefed | 226 done, 285 done | Dewey approves the manifest. Bus suite, Gitea Docker test, install test and every scripts/test-*.sh green on Sage's gate. A search of the run output for the fixture admin and seat tokens finds nothing. (sage) | `docs/plans/2026-10-20_case2-rows.md` § C2-21 the grant executor for a library project | — |
-| 288 | Case 2 C2-02 agent writes, the notice, revert and her Console saves | honker; reviewers webby | #1793 | briefed | 215 done, 282 done, 283 done, 284 done, 285 done, 286 done | Webby approves the manifest. Library, bus and harness suites and every scripts/test-*.sh green on Sage's gate, mutants killed. A search of the run output for the fixture tokens finds nothing. (sage) | `docs/plans/2026-10-20_case2-rows.md` § C2-02 agent writes, the notice, revert and her Console saves | — |
+| 288 | Case 2 C2-02 agent writes, the notice, revert and her Console saves | bubba; reviewers webby | #1793 | briefed | 215 done, 282 done, 283 done, 284 done, 285 done, 286 done | Webby approves the manifest. Library, bus and harness suites and every scripts/test-*.sh green on Sage's gate, mutants killed. A search of the run output for the fixture tokens finds nothing. (sage) | `docs/plans/2026-10-20_case2-rows.md` § C2-02 agent writes, the notice, revert and her Console saves | A2 revert contract (morgana-0199, sage-3596): library.revert is a human verb. Args {project, commit}, strict keys; project is the business.projects key (the chat repo link), not a UUID. Result {project, path, reverted, commit}. Refusals: 409 stale-base, and 409 library-revert-not-agent for an agent caller. Owner Bubba under Q245 (mos-1506). |
 | 289 | Case 2 C2-11b Console library pages and her saves (Haiku subagent, decision 129) | researcher; reviewers filbert | #1794 | briefed | 214 done, 288 done | Filbert approves the manifest. The webui suite and every scripts/test-*.sh are green on Sage's gate. Grep for hash pins on bus.js and serve.mjs before in-review. (sage) | `docs/plans/2026-10-20_case2-rows.md` § C2-11b Console library pages and her saves | — |
 | 290 | Case 2 C2-12b the setup sheet rewrite for free chat, supporting folders and saves | louie; reviewers webby | #1795 | briefed | 217 done, 218 done, 285 done, 291 done | Doc only. Webby approves it against the ruling. Before landing, grep packages/*/tests and scripts/test-*.sh to confirm no test reads the file. (sage) | `docs/plans/2026-10-20_case2-rows.md` § C2-12b the setup sheet rewrite for free chat, supporting folders and saves | — |
-| 291 | PRD 1.16 library.write routes under REQ-LIB-6 (mos-1328) | gosalyn; reviewers webby | #1796 | in-review, round 1, request posted | 282 done | Webby approves the text. Jason says yes to the exact text (Mos asks him, mos-1328 step 3); no landing before that. requirements.test.mjs and every scripts/test-*.sh that reads the PRD or requirements.json are green on Sage's gate. Mos gets the landing commit. (sage) | `docs/plans/2026-10-22_prd-1-16-brief.md` § PRD 1.16 library.write routes under REQ-LIB-6 (mos-1328) | — |
+| 291 | PRD 1.16 library.write routes under REQ-LIB-6 (mos-1328) | gosalyn; reviewers webby | #1796 | done | 282 done | Webby approves the text. Jason says yes to the exact text (Mos asks him, mos-1328 step 3); no landing before that. requirements.test.mjs and every scripts/test-*.sh that reads the PRD or requirements.json are green on Sage's gate. Mos gets the landing commit. (sage) | `docs/plans/2026-10-22_prd-1-16-brief.md` § PRD 1.16 library.write routes under REQ-LIB-6 (mos-1328) | Landed 4874d1e83 on e909ef51a: 482e865ac replayed, patch-id equal (cef7de74), range-diff =. Webby APPROVE c30848 on 482e865ac; Jason approved the text in Q229. Gate 16:15Z on the tip tree: every package suite but queue, 0 fail 0 skipped (tasks 100, bus 891, cli 941, plugins 119, webui 392, business 231), every scripts/test-*.sh rc 0 (queue-root and row 244 skips only). PRD 1.16. 1.17 is row 308. |
 | 292 | stack-release.sh config_checks runs the target loader on any config (row 270 rollback hazard) | gizmoduck; reviewers duckworth | #1797 | done | 203 done, 270 done, 271 done | Duckworth approves the manifest. The touched test files run whole, the cli suite and every scripts/test-*.sh are green on Sage's gate, and the mutants are killed. (sage) | `docs/plans/2026-10-22_config-checks-any-key-brief.md` § stack-release.sh config_checks runs the target loader on any config (row 270 rollback hazard) | Landed 6aab979e6 (cherry-pick of c902a767d..90be6cccd, range-diff all =, patch-id a45c9ba4 equal). Tested head 0d0021454: stack-release.test 224/224, cli suite r2 red only compactions-launch:229 session-invalid 22 (idle-stop race, Vikunja 588, row 302), r3 rerun 910/910 under mos-1411, ten shells green, M1-M9 killed. Duckworth APPROVE rev 3433 on 2fa7ae17. |
 | 293 | 574: maintenance-free test fixture commits (Vikunja 574) | gander; reviewers filbert | #1805 | done | — | Filbert approves. The four whole files, then the seat and cli suites, are green on Sage's gate. (sage) | `docs/plans/2026-10-23_mvp-readiness-rows.md` § Brief: 574, maintenance-free test fixture commits (Vikunja 574) | LANDED e51d11640 03:55Z 10-23 (cherry-pick of gander b23783f39..a9cae2bd6 onto 464010fbe; range-diff 6/6 equal, range patch-id equal). Filbert APPROVE c30982 cdda41f5; run 2 4 files 153/0, seat 202/0, cli 905/0, 312 flagged/0 maintenance children. N1: lifecycle.test needs TMPDIR of 50 bytes or less. Residual: queue store.mjs, discord git.mjs, harness tools.mjs unflagged. #1805 closed c31013, P19 574 c888. |
 | 294 | FED R6: Console granted-user sign-in, user-cli transport, peer links | launchpad; reviewers duckworth | #1800 | done | — | Duckworth approves the manifest. The webui, cli and bus suites and every scripts/test-*.sh are green on Sage's gate, and the mutants are killed. (sage) | `docs/plans/2026-10-23_mvp-readiness-rows.md` § Brief: FED R6, Console granted-user sign-in | landed d3059c2c3 on refactor 07:04Z: cherry-pick of c902a767d..24b745447 onto 09d0d6faf, range-diff 11 =, patch-id 8371405a equal. Duckworth approve c31053 rev 3469 on a1ff5d67, C1/C2 met. Run 4 on 8616b9a4f from npm ci: webui 365, cli 909, bus 873, 10 scripts, M1-M11 killed. Merged tree: stack-release-external 25, stack-upgrade 21, stack-release 223/224 (R9 transient, row 1810) then 224/224 rerun under mos-1422. Follow-ups rows 300, 301. Closes #1800. |
 | 295 | FED R4: revocation | morgana; reviewers dewey | #1801 | done | — | Dewey approves the manifest. The bus, cli and business suites and every scripts/test-*.sh are green on Sage's gate, and the mutants are killed. (sage) | `docs/plans/2026-10-23_mvp-readiness-rows.md` § Brief: FED R4, revocation | LANDED 2efd127ce on refactor 10:10Z 10-23 (9 commits cherry-picked onto 07802dc57, range-diff all =, patch-ids match, HEAD~1 tree a86592ffc = gated tree, top commit BUILD.md doc-only). Gate d68b4300d manifest e94c9aeb: 13 whole files, bus 886/0, business 231/0, cli 924/0, harness 151/0, all test-*.sh rc 0, M1-M16 killed, M8 per mos-1436. Dewey approve rev 3500 c31102. Re-pin precheck mos-1436 cond 11 binds. |
-| 296 | FED R7: scratch two-instance acceptance | quackerjack; reviewers filbert | #1802 | briefed | 190 done, 294 done, 295 done | Filbert approves the manifest. The script test and every scripts/test-*.sh are green on Sage's gate, and no unit, port or socket of the script's outlives the run. (sage) | `docs/plans/2026-10-23_mvp-readiness-rows.md` § Brief: FED R7, scratch two-instance acceptance | — |
-| 297 | GitHub grant method (Bushroot's half of #436b) | bushroot; reviewers dewey | #1803 | briefed | 198 done | Dewey approves the manifest. The touched suites and every scripts/test-*.sh are green on Sage's gate, and the mutants are killed. (sage) | `docs/plans/2026-10-23_mvp-readiness-rows.md` § Brief: the GitHub grant method (Bushroot's half of #436b) | — |
-| 298 | Q228: chief-of-staff grant scope | megavolt; reviewers dewey | #1804 | briefed | 252 done | Dewey approves the manifest. The touched suites and every scripts/test-*.sh are green on Sage's gate, and the mutants are killed. (sage) | `docs/plans/2026-10-23_mvp-readiness-rows.md` § Brief: the chief-of-staff grant scope (Q228) | — |
+| 296 | FED R7: scratch two-instance acceptance | lena; reviewers filbert | #1802 | briefed | 190 done, 294 done, 295 done | Filbert approves the manifest. The script test and every scripts/test-*.sh are green on Sage's gate, and no unit, port or socket of the script's outlives the run. (sage) | `docs/plans/2026-10-23_mvp-readiness-rows.md` § Brief: FED R7, scratch two-instance acceptance | — |
+| 297 | GitHub grant method (Bushroot's half of #436b) | violet; reviewers dewey | #1803 | briefed | 198 done | Dewey approves the manifest. The touched suites and every scripts/test-*.sh are green on Sage's gate, and the mutants are killed. (sage) | `docs/plans/2026-10-23_mvp-readiness-rows.md` § Brief: the GitHub grant method (Bushroot's half of #436b) | — |
+| 298 | Q228: chief-of-staff grant scope | boyd; reviewers dewey | #1804 | in-review, round 1, request posted | 252 done | Dewey approves the manifest. The touched suites and every scripts/test-*.sh are green on Sage's gate, and the mutants are killed. (sage) | `docs/plans/2026-10-23_mvp-readiness-rows.md` § Brief: the chief-of-staff grant scope (Q228) | — |
 | 299 | 573: the P10 hop band (Vikunja 573) | gander; reviewers filbert | #1806 | done | 293 done | Filbert approves. The whole file under load at least 3 times, then the cli suite, are green on Sage's gate. (sage) | `docs/plans/2026-10-23_mvp-readiness-rows.md` § Brief: 573, the P10 hop band (Vikunja 573) | landed ffb2fedfb 08:03Z on 15e688cc0 via Filbert SESSIONS c1f910b4c; 5 commits = gander/row299-gate-277ace0b 63db96d8b (range-diff 5/5 =, tree differs only BUILD-LOG/SESSIONS); manifest 277ace0b sha256 -c OK. Gate green on ffa93b054: case1 whole 3x 53/0/0, cli whole 917/0/0 (59 files), P10 inner 2.27 outer 4.01, M1-M6 killed (gander-0189). Filbert approve rev 3485 c31084; N1 M1 1.23 s margin. |
 | 300 | R6-N1: HTTP-level test of the user-session option swap (294 N1) | launchpad; reviewers duckworth | #1807 | done | 294 done | Duckworth approves the manifest; new test file whole, webui suite, mutant M12 killed (sage) | `docs/plans/2026-10-23_r6-followup-rows.md` § Brief: R6-N1, an HTTP-level test of the user-session option swap | Landed on refactor as 9d929911c..07315e651 (from launchpad/row300 a00b25b37, range-diff equal), pushed 5b846b048 12:28Z. Duckworth approved r2 (c31158, rev 3559). Sage gate on bcf3c1dac: user-option-swap 1/0, webui 375/0 with pinned esbuild and MOSAIC_REQUIRE_EDITOR_BUILD=1, M12 killed at :151. Run 1 red placed under mos-1272 (headers). N1 deferred: board proxy upstream has no recorder. |
 | 301 | R6-N4: fold user-bus.mjs back into bus.mjs (294 N4) | launchpad; reviewers duckworth | #1808 | done | 294 done | Duckworth approves the manifest; channel-proof.test, webui suite and 294 user-transport tests whole and green; re-pin only with Mos go (sage) | `docs/plans/2026-10-23_r6-followup-rows.md` § Brief: R6-N4, fold user-bus.mjs back into bus.mjs | Landed on refactor as bb031ec84..5b846b048 (from launchpad/row301 acc97fb9c, range-diff equal), pushed 12:28Z. Re-pin of webui bus.mjs to 39fcb27c is its own commit 59f0e44f4 (mos-1449); fixture stubs per mos-1451. Duckworth approved r2 (c31159, rev 3560). Sage gate: channel-proof 2/0, webui 374/0 pinned esbuild, granted-user 19/0. Live unchanged; 301 makes its own re-pin window. |
@@ -342,8 +342,23 @@ Generated from `docs/plans/queue.json` revision 3588 by `queue render`. Do not e
 | 303 | R9 shows its output when rehearse makes no directory (Vikunja 589) | launchpad; reviewers duckworth | #1810 | done | 294 done | Duckworth approves the diff; stack-release.test.mjs whole and green on Sage's gate, in a gap (sage) | `docs/plans/2026-10-23_r9-guard-row.md` § Brief: R9 shows its output when rehearse makes no directory (Vikunja 589) | Landed e551cd846 from launchpad 88ffecaf7, patch-id 559c802b equal, test blob e936808b matches the manifest. Gate: Duckworth approve c31079; Sage gate on c13c337e1 plus the test blob, stack-release.test.mjs whole 224/0 rc 0 in 595 s, alnum mktemp TMPDIR, default networks 6 before and 6 after. No overlap with in-review 272, 304, 305. |
 | 304 | claude-session test builds the memory slug the way the CLI does (Vikunja 590) | rocko; reviewers dewey | #1811 | done | — | Dewey approves the diff; claude-session.test.mjs whole and green 3x (mktemp, underscore, space TMPDIRs) on Sage's gate, in a gap; old-regex mutant red at :298 (sage) | `docs/plans/2026-10-23_gate-env-rows.md` § Brief: claude-session test builds the memory slug the way the CLI does (Vikunja 590) | Landed a863015a5 from rocko 5e8354ebb, range-diff equal, patch-id 808fa765. Gate: Dewey approve c31129 rev 3533; Sage gate on e551cd846 with file 7690a4a9, claude 2.1.309: claude-session.test.mjs whole 10/0 under mktemp, underscore and space TMPDIRs; old-regex mutant under underscore 9/1 at :298. Gates may drop the alnum TMPDIR rule (mos-1432 ends here). |
 | 305 | Shell suites remove the compose network they create (Vikunja 591) | gizmoduck; reviewers filbert | #1812 | done | — | Filbert approves the diff; test-release.sh and test-task.sh whole and green on Sage's gate, in a gap, project network absent after each run; dropped-rm mutant red (sage) | `docs/plans/2026-10-23_gate-env-rows.md` § Brief: shell suites remove the compose network they create (Vikunja 591) | Landed 353d65f57..d52d9f1f2 from gizmoduck 541dee2b7..7e8218a2e, range-diff all equal, on top of filbert 2c289f6f0. Gate: Filbert approve c31127 rev 3534; Sage gate on e551cd846 with task 7d6fbf67, release b29850ce: test-task 92/0, test-release 15/0, network check OK; mutants a and b red in both, c a known survivor; own mutant networks removed, none left. Gates stop the manual network rm (mos-1438 ends here). |
-| 306 | A revoked run's late bus call stops it instead of exiting 22 (295 N1) | morgana; reviewers dewey | #1813 | briefed | 272 done | Dewey approves the design, then the manifest; bus, harness and cli suites and every scripts/test-*.sh green on Sage's gate (sage) | `docs/plans/2026-10-23_gate-env-rows.md` § Brief: a revoked run's late bus call stops it instead of exiting 22 (295 N1) | — |
+| 306 | A revoked run's late bus call stops it instead of exiting 22 (295 N1) | morgana; reviewers dewey | #1813 | done | 272 done | Dewey approves the design, then the manifest; bus, harness and cli suites and every scripts/test-*.sh green on Sage's gate (sage) | `docs/plans/2026-10-23_gate-env-rows.md` § Brief: a revoked run's late bus call stops it instead of exiting 22 (295 N1) | Landed 2d0318a44 on 4874d1e83: 33d3844a0..683833205 replayed, 4 patch-ids equal (a1960f36 55fadbc3 af1a3d88 35cf81a3), range-diff all =. Dewey APPROVE c31206 rev 3596 on 683833205. access-revoke.test numstat 7 7 (mos-1463). Sage gate 16:33Z: every package suite 0 fail 0 skipped (bus 894, cli 942, plugins 119, webui 392, business 231, harness 151), every scripts/test-*.sh rc 0, M1-M3 each killed on every named file, restores equal. N1/N2 to DEFERRED next. |
 | 307 | Row 270's pi compaction reading moves behind the harness kind (REQ-PLUG-2, Vikunja 598) | gizmoduck; reviewers duckworth | #1814 | done | — | Duckworth approves the design, then the manifest; bus, cli, plugins (0 failures), webui and business suites, every scripts/test-*.sh green and the mutants killed on Sage's gate (sage) | `docs/plans/2026-10-23_harness-kind-compactions.md` § Brief: row 270's pi compaction reading moves behind the harness kind (Vikunja 598) | LANDED d243f6b25: 6 row commits replayed onto 8dc132bec, every non-log patch-id equal, candidate paths = 6fdfe3790 (manifest 17c9f8d9). Duckworth APPROVE rev 3586 c31189 round 1, C2 met. Sage gate: bus, cli 0 skipped, plugins fully green incl harness.test.mjs:192, webui, business, seat, every scripts/test-*.sh; M1-M4 killed. P19 598 commented. DEFERRED: 307 N1 store-unreadable not sticky. N3 doc-only BUILD.md red list one short, next BUILD.md change. |
+| 308 | PRD 1.17 Case 2 story files are DOCX (Q235 to Q237, Q239) | gosalyn; reviewers webby | #1815 | done | 291 done | Webby checks the PRD diff against DRAFT-d9.md at 4607e15b8 one instruction at a time and that nothing else changed. No new Jason question (Q239 approved the text). tasks whole, bus whole, cli stack-copy.test and every scripts/test-*.sh green on Sage's gate. Mos gets the landing commit (mos-1470). (sage) | `docs/plans/2026-10-23_prd-1-17-brief.md` § PRD 1.17 Case 2 story files are DOCX (Q235 to Q237, Q239) | Landed 30e6bb680: Gosalyn 45fe7b3ce replayed onto 7defb58e9, patch-id 4658c831 equal, range-diff =, four blobs equal. Webby r1 APPROVE c31224 rev 3606, d9 at 4607e15b8 applied word for word. Sage gate 17:19Z: every package suite 0 fail 0 skipped (tasks 100, bus 894, cli 942, plugins 119, webui 392), every scripts/test-*.sh rc 0. Mos gets the sha (mos-1470). 570/571 build rows next. |
+| 309 | 571 W1: reviewed local thesaurus data (post-10-27) | unassigned | — | queued | — | Independent Opus 5.5 reviewer, not the author, approves the manifest; the brief section's Gate and G1 pass on Sage's slot: touched test files whole, affected package suites green, named mutants killed. Post-10-27; MVP rows keep slot priority (sage) | `docs/plans/2026-10-21_q195-writing-editor.md` § W1 reviewed local thesaurus data | — |
+| 310 | 571 W2: WordCraft source import and reproducible restricted web build (post-10-27) | unassigned | — | queued | — | Independent Opus 5.5 reviewer, not the author, approves the manifest; the brief section's Gate and G1 pass on Sage's slot: touched test files whole, affected package suites green, named mutants killed. Post-10-27; MVP rows keep slot priority (sage) | `docs/plans/2026-10-21_q195-writing-editor.md` § W2 WordCraft source import and reproducible restricted web build | — |
+| 311 | 571 W3a: bus pins and human-only editor settings (post-10-27) | unassigned | — | queued | — | Independent Opus 5.5 reviewer, not the author, approves the manifest; the brief section's Gate and G1 pass on Sage's slot: touched test files whole, affected package suites green, named mutants killed. Post-10-27; MVP rows keep slot priority (sage) | `docs/plans/2026-10-21_q195-writing-editor.md` § W3a bus pins and human-only editor settings | — |
+| 312 | 571 W3b: human DOCX store and instant commits (post-10-27) | unassigned | — | queued | 311 done | Independent Opus 5.5 reviewer, not the author, approves the manifest; the brief section's Gate and G1 pass on Sage's slot: touched test files whole, affected package suites green, named mutants killed. Post-10-27; MVP rows keep slot priority (sage) | `docs/plans/2026-10-21_q195-writing-editor.md` § W3b human DOCX store and instant commits | — |
+| 313 | 571 W6: owned browser bridge and editor-only route (post-10-27) | unassigned | — | queued | 309 done, 310 done, 312 done | Independent Opus 5.5 reviewer, not the author, approves the manifest; the brief section's Gate and G1 pass on Sage's slot: touched test files whole, affected package suites green, named mutants killed. Post-10-27; MVP rows keep slot priority (sage) | `docs/plans/2026-10-21_q195-writing-editor.md` § W6 owned browser bridge and editor-only route | — |
+| 314 | 571 W3: full editor pane, navigation, pins and right-click synonyms (post-10-27) | unassigned | — | queued | 311 done, 312 done, 313 done | Independent Opus 5.5 reviewer, not the author, approves the manifest; the brief section's Gate and G1 pass on Sage's slot: touched test files whole, affected package suites green, named mutants killed. Post-10-27; MVP rows keep slot priority (sage) | `docs/plans/2026-10-21_q195-writing-editor.md` § W3 full editor pane, navigation, pins and right-click synonyms | — |
+| 315 | 571 W4b: committed reader, citation resolver and typed tools (post-10-27) | unassigned | — | queued | 314 done | Independent Opus 5.5 reviewer, not the author, approves the manifest; the brief section's Gate and G1 pass on Sage's slot: touched test files whole, affected package suites green, named mutants killed. Post-10-27; MVP rows keep slot priority (sage) | `docs/plans/2026-10-21_q195-writing-editor.md` § W4b committed reader, citation resolver and typed tools | — |
+| 316 | 571 W5: read-only flags, citations and chat suggestions (post-10-27) | unassigned | — | queued | 315 done | Independent Opus 5.5 reviewer, not the author, approves the manifest; the brief section's Gate and G1 pass on Sage's slot: touched test files whole, affected package suites green, named mutants killed. Post-10-27; MVP rows keep slot priority (sage) | `docs/plans/2026-10-21_q195-writing-editor.md` § W5 read-only flags, citations and chat suggestions | — |
+| 317 | 571 W7: human one-way chapter import and Case 2 format routing, production import closed; the first real import opens only after W8 lands (post-10-27, mos-1470) | unassigned | — | queued | 314 done, 315 done | Independent Opus 5.5 reviewer, not the author, approves the manifest; the brief section's Gate and G1 pass on Sage's slot: touched test files whole, affected package suites green, named mutants killed. Post-10-27; MVP rows keep slot priority (sage) | `docs/plans/2026-10-21_q195-writing-editor.md` § W7 human one-way chapter import and Case 2 format routing | — |
+| 318 | 571 W8: Console Connections view for Markdown and DOCX story files, before W7's first real import (post-10-27, mos-1470) | unassigned | — | queued | 314 done, 315 done, 317 done | Independent Opus 5.5 reviewer, not the author, approves the manifest; the brief section's Gate and G1 pass on Sage's slot: touched test files whole, affected package suites green, named mutants killed. Post-10-27; MVP rows keep slot priority (sage) | `docs/plans/2026-10-21_q195-writing-editor.md` § W8 Console Connections view for Markdown and DOCX story files | fenton-0017 carry: connections.test.mjs must test that links inside comments and tracked deletions are excluded. W8 follows W7's closed routing candidate and lands before W7's first real import opens (mos-1470) |
+| 319 | GitHub consumer for row 297's protected githubWithToken callback, honoring expiry and cancellation (post-10-27) | unassigned; reviewers dewey | — | queued | 297 done | Dewey approves the design and the manifest. The touched suites and every scripts/test-*.sh are green on Sage's gate, and the signal and expiry mutants are killed. (sage) | `docs/plans/2026-10-23_github-consumer-brief.md` § Brief: a GitHub consumer for Broker.githubWithToken | — |
+| 320 | Case 1/2 host fixes for the 433 P1 rerun: hostcheck item 5 mode 750, run sheet bundle verify, case2-unit --claude @, stack-copy unreadable cwd, notify.json step and precheck, mosaic wrapper step (10-27 path) | gladstone; reviewers morgana | #1816 | required; done | — | Morgana approves. Touched test files run whole (case1-hostcheck, case2-unit, case2-install, stack-copy) and the 8 named mutants are killed; Sage's full landing gate runs every package suite and every scripts/test-*.sh. After landing Mos sends ops-01 the new N. (sage) | `docs/plans/2026-10-23_host-fixes-1816-brief.md` § Brief: hostcheck item 5, bundle verify, case2-unit @, stack-copy cwd | LANDED 094124b4e 21:53Z (replay of faf55618e onto 45e3ca7bd, code paths patch-id equal, log appends in one final commit). F1-F6 hostcheck item 5, bundle verify, case2-unit scoped paths and cwd, precheck notify decision, run sheet 9a notify dirs 0700, wrapper step. Morgana APPROVE r2 c31403 rev 3715. Full gate GREEN 21:53:00Z, 0 fail (mos-1453/1455/1456). Vikunja 614 done. 433 P1 reruns on this N (mos-1532). |
+| 321 | F7 and F10: host run sheet wrapper step sets umask 077 and the node PATH under sudo secure_path; adopt step after a first install; --no-rehearsal on the first upgrade after adopt (433, ops-0271/0274); docs only | gladstone; reviewers boyd | #1817 | required; briefed | — | Boyd (Codex) approves. A git grep with a positive control shows no test reads the changed run sheet lines; BUILD.md records the diff and the grep. Doc only, lands with any row (mos-1544). (sage) | `docs/plans/2026-10-23_host-fixes-1816-brief.md` § Brief: F7, the wrapper step's PATH and umask under sudo | — |
+| 322 | F8/F9: case2-install.sh runs the library persona import from the stack copy, and its refusal carries the error line (433 Run B, ops-0273) | goldie; reviewers morgana | #1818 | required; briefed | — | Morgana approves (install path). The new case2-install test fails on 094124b4e and passes on the candidate; a mutant restoring REPO at :185 is killed; Sage's full landing gate runs every package suite and scripts/test-*.sh. Then ops-01 reruns Run B P1. (sage) | `docs/plans/2026-10-23_host-fixes-1816-brief.md` § Brief: F8 and F9, the library persona import runs without the clone's node_modules | — |
 
 <!-- mosaic-queue:end -->
 

docs/prd/mosaic-stack.md

@@ -1,6 +1,6 @@
 # PRD: Mosaic Stack
 
-- Status: approved, version 1.15. Jason approved draft 0.4 unchanged as
+- Status: approved, version 1.17. Jason approved draft 0.4 unchanged as
   1.0 on 2026-10-05 (lead decision 61). They approved version 1.1, the
   Organization requirements, in decision 03130d08-ddce-480d-a601-e59f64744fc3
   on 2026-10-14. They approved version 1.2, the chief of staff, the
@@ -44,7 +44,44 @@
   as 1.11 (mos-1233, mos-1238, mos-1241, vikunja:19/464). Version 1.15
   rewrites REQ-LIB-6 to Jason's Q223 and Q226 rulings and adds supporting
   folders to REQ-LIB-1 and REQ-LIB-2. Mos ordered it in mos-1320 item 8,
-  and Jason gets a report.
+  and Jason gets a report. Version 1.16 routes the new action
+  `library.write` under REQ-LIB-6 (REQ-WAIT-3). A change to the hard waits
+  needs Jason's approval under REQ-WAIT-2, so Mos puts the text to him as
+  written, and it lands only after his yes (mos-1328, mos-1329). Version
+  1.17 records Jason's rulings Q235 to Q237 of 2026-10-23: Case 2 story
+  files are DOCX, Markdown stays for agent files and documentation, and a
+  human-started import converts a Markdown story file one way. It also
+  adds REQ-LIB-9, the Console's DOCX editor, from Jason's rulings Q195,
+  Q226 and Q234. It changes what Case 2 requirements allow, so Mos puts
+  the text to Jason as written, and it lands only after his yes (mos-1366,
+  Vikunja 570).
+- Version 1.17 source: Jason's Q235, answering Q36: 'How about we see a
+  markdown file, we convert the markdown file to docx, then archive or
+  mark the markdown file as converted. The new standard for files in the
+  creating writing use case is to use docx to handle versioning and
+  WYSIWYG. We eliminate the potential for confusion based on the files.
+  Agents must understand which files are what format and where they live.
+  The system must allow for import and conversion. We will not run the
+  systems in parallel. There will be an irreversible conversion of the
+  files.' His Q236 says: 'For creative writing chapters, we need to
+  utilize docx as the standard. Markdown is acceptable for agent files,
+  instructions, PRDs, documentation, etc. The creative writing files
+  should be docx for familiarity for the user.' His Q237 says 'Q38: It is
+  correct for now (subject to future change)', which confirms Mos's
+  reading P1 to P6. REQ-LIB-9 rests on his Q195 request for 'a full
+  WYSIWYG editor within Mosaic Stack', his Q226 answer 'F41: We want to
+  move editing into the WYSIWYG in the WebUI. All changes are instantly
+  committed and available to the agents.' and his Q234 answer 'Q37: yes'
+  to the exact security header for the editor's frame. The storage follows
+  the O2 design D10 to D12 as rewritten under Vikunja 571, at b99ca86b9 on
+  `refactor`.
+- Version 1.16 source: Webby's review webby-0164 B2, from Scrooge's row
+  285. Version 1.15 lets creative agents write in supporting folders, but
+  the write action stayed a hard wait under REQ-WAIT-3, and REQ-WAIT-2
+  refuses every role file that grants one. Mos ruled in mos-1328 and
+  mos-1329 that the routing is its own version. The bounds come from
+  REQ-LIB-6 and the Case 2 design's ruling after r11, f6e3e7f20 on
+  `gosalyn/case2-design`.
 - Version 1.15 source: Jason's Q223, answering Q29: "The agents are not
   allowed to write the prose into the writing projects. Agents are
   allowed to CRUD character sheets, info summaries, cross-link info, and
@@ -706,6 +743,14 @@ Added in version 1.5 (Q167).
   `host.sudo` was added as a hard wait and routes under REQ-CRED-4 since
   version 1.8.
 
+  `library.write` was added as a hard wait and routes under REQ-LIB-6
+  since version 1.16. It is granted within-role to the six creative roles
+  only, and only for Markdown files under the supporting folders a human
+  marks. It never writes a story file. A write also needs the writing
+  agent's own live Gitea grant on the library project. Each write is one
+  commit by that agent's own Gitea account with a trailer naming the
+  agent, and the user sees a notice for it and can revert it.
+
 ### Messages
 
 - **REQ-MSG-1.** Messages are addressed to a role. They are append-only
@@ -1178,7 +1223,8 @@ design `docs/plans/2026-10-21_t1-sessions.md`, 2c843d190 on `huey/t1-sessions-de
 Added in version 1.12 (Q176 Case 2, Q211). Drafted from the Case 2
 design r11, fb20a61b4 on `gosalyn/case2-design`, approved by Webby in
 82f50d127, with the rulings recorded after r11 up to 624212842. The
-library is the user's own writing repository.
+library is the user's own writing repository plus the stack's writing
+store, which holds the DOCX story files (REQ-LIB-8, version 1.17).
 
 - **REQ-LIB-1.** A library project maps the user's writing repository
   onto universes, books, entity types such as character and place, the
@@ -1187,9 +1233,12 @@ library is the user's own writing repository.
   human changes it, and an agent's organization write that changes it
   is refused. So
   `universe.book.{character,place,...}` reads as universe, book folder,
-  type folder. (Design 1.1 and M9. Q176 Case 2 "Data is stored in
-  little-endian organizational scheme". Version 1.15: supporting
-  folders.)
+  type folder. The mapping also names one archive folder, set by the
+  human, where converted Markdown story files go. A book's DOCX story
+  files are in the stack's writing store, under the same universe and book
+  (REQ-LIB-8). (Design 1.1 and M9. Q176 Case 2 "Data is stored in
+  little-endian organizational scheme". Version 1.15: supporting folders.
+  Version 1.17: the archive folder and the writing store.)
 - **REQ-LIB-2.** Playgrounds are never confused with canon. A playground
   has one of three levels, set by where its prefix sits. A book-level
   prefix lies inside one of its universe's book folders, and its files
@@ -1204,18 +1253,34 @@ library is the user's own writing repository.
   its own universe, when two prefixes overlap, when a draft has books or
   no prefix, and when a hybrid names a draft as a source. Supporting
   prefixes, the folders agents may write in (REQ-LIB-6), follow the same
-  placement rules. A file's scope comes from its path alone, prefixes
-  first: a Markdown file under a supporting prefix is supporting, one
-  under a playground prefix at any level is playground, any other
-  Markdown file in a book folder is canon, and everything else is
-  unmapped and never returned. A folder in both lists is supporting.
-  Lookups return canon unless the caller asks for playground or
-  supporting. A citation marked as canon must name a canon file, so an
-  agent can't cite a playground or supporting file as canon. The Console
-  shows each cite's scope. (Design 1.2, 5.2 and 7.4, the playground
-  ruling, 51fdfb7e2, and the ruling after r11. Q176 Case 2, the
-  playground items, TARGET.md:92-94. Version 1.14: the levels and the
-  draft. Version 1.15: supporting.)
+  placement rules. A Markdown file's scope comes from its path and from
+  past imports, prefixes first: a Markdown file under the archive folder
+  is archived, one under a supporting prefix is supporting, a Markdown
+  file at a converted file's old path is unmapped under REQ-LIB-8 but
+  flagged in the format map, one under a playground prefix at any level is
+  playground, any other Markdown file in a book folder is canon, and
+  everything else is unmapped and never returned. A folder in both lists
+  is supporting. The archive folder follows the same placement rules and
+  may not overlap another prefix or a book folder. An archived file keeps
+  the path it had under the archive folder, and its universe and book are
+  those of that old path. A DOCX document in the writing store keeps its
+  source's scope: the universe, the book if there is one, and canon or
+  playground. Its source is the Markdown file it was converted from or,
+  for one the human starts in the editor, the universe and book or the
+  playground the human picks (REQ-LIB-8). A playground DOCX follows the
+  playground rules and is never returned as canon. It stays playground
+  after its draft universe is made real. In version 1.17 no promotion or
+  mapping change makes a playground DOCX canon. A later version of this
+  PRD says how one becomes canon. Lookups return canon unless the caller
+  asks for playground, supporting or archived. Every answer marks an
+  archived file as archived and names the DOCX that replaced it. A
+  citation marked as canon must name a canon file, so an agent can't cite
+  a playground, supporting or archived file as canon. The Console shows
+  each cite's scope and format, and whether a cited Markdown file was
+  converted. (Design 1.2, 5.2 and 7.4, the playground ruling, 51fdfb7e2,
+  and the ruling after r11. Q176 Case 2, the playground items,
+  TARGET.md:92-94. Version 1.14: the levels and the draft. Version 1.15:
+  supporting. Version 1.17: archived scope and DOCX scope.)
 - **REQ-LIB-3.** Universes stay separate. Every lookup names one universe,
   and its results never leave it. A draft universe (REQ-LIB-2) counts as
   a universe here. It has no canon, so a lookup in a draft asks for
@@ -1231,23 +1296,62 @@ library is the user's own writing repository.
   A pin doesn't stop the change. The continuity agent reads the human's other
   constraints and cites them. (Design 1.4 and 3. Q176 Case 2, the
   crossover items.)
-- **REQ-LIB-4.** Git holds every change. The user commits and pushes with
-  their own tools, today Obsidian with obsidian-git. The bus keeps a
+- **REQ-LIB-4.** Git holds every change. The user commits and pushes
+  Markdown with their own tools, today Obsidian with obsidian-git. A
+  converted story file's current text is no longer in that repository,
+  which keeps only its archived Markdown (REQ-LIB-8). The bus keeps a
   mirror of the remote, fetched with a read-only token every 60 seconds
   and before any lookup when the last fetch is older than that. It only
   fast-forwards. A force-push is held as `library-diverged` until a human
-  accepts it. Agents read only the mirror's served commit and never hold
-  a copy of their own, so they see the user's push within about a minute.
-  Bus writes and pushes come in later rows (C2-02, C2-03b). (Design D5,
-  D6, 7.1, 7.2 and 7.5. Q176 Case 2 "Git is used for all changes -- local
-  and remote" and the sync items.)
+  accepts it. Agents read the user's repository only at the mirror's
+  served commit, except a story file during its import under REQ-LIB-8.
+  They read a DOCX story file only at a committed version in the writing
+  store, under REQ-LIB-5. They never hold a copy of their own, so they see
+  the user's Markdown push within about a minute and a DOCX save at their
+  next lookup after the editor reports it as committed. Bus writes and
+  pushes come in later rows (C2-02, C2-03b). A DOCX story file is saved in
+  the Console's editor, and each accepted save is one commit by the human
+  in the stack's writing store (REQ-LIB-9). Each writing-store commit is
+  also pushed to a remote off the stack's host, never by force-push. The
+  remote is a setting only a human changes, and it starts unset. A
+  repository on the stack's host never counts as that remote. A missing
+  remote or a failed push never undoes a save, and the user sees each push
+  that is pending or failed. Only the stack's host pushes to that remote,
+  and no agent can reach it with any credential. Agents read the local
+  commit. (Design D5, D6, 7.1, 7.2 and 7.5. Q176 Case 2 "Git is used for
+  all changes -- local and remote" and the sync items. Version 1.17, with
+  Q222 for the remote setting.)
 - **REQ-LIB-5.** Agents check the library through typed lookup tools:
-  find, get, search, manuscript and universe. Each answer names the
-  commit it read. Get returns a file's links out and links in, so the
-  connections are visible to agents. The user sees them in Obsidian's
-  graph and backlinks. (Design 3 and 7.1. Q176 Case 2 "The agents have
-  tools to check character, place, and other data", the visualization
-  item and "Connections are always visible".)
+  find, get, search, manuscript and universe. Each answer names the commit
+  it read. Each answer also names the file's format and where it lives:
+  its path, or its document id in the writing store. A DOCX story file is
+  read from its latest committed save, never from unsaved text. A lookup
+  that starts after the editor reports a save as committed returns that
+  save or a later one, even while its push to the remote is pending or has
+  failed, and the answer names the version. Get, search and manuscript
+  read a DOCX story file as its extracted text with DOCX locators, never
+  as lines. That text is the file with its tracked changes accepted. An
+  agent reads a story file's comments, or its text with tracked deletions
+  shown, only after a human turns on the matching setting. Both settings
+  are off by default, and only a human changes them. The reader in this
+  version can't read some things a DOCX story file can hold, such as a web
+  link, a text box, a field or hidden text. The editor warns the human
+  when an edit adds one, and the human can still save it. Until a later
+  save takes it out, lookups give agents none of the text of the part that
+  holds it, whether that is the chapter's body, a note or a comment. The
+  manuscript lookup follows the book's chapter order across both formats
+  (O2 design D10), and the next chapter it names is never an archived
+  file. Links out and in resolve across both formats. The universe lookup
+  returns the format map (REQ-LIB-8). Get returns a file's links out and
+  links in, so the connections are visible to agents. The user sees a
+  Markdown file's links in Obsidian's graph and backlinks. A DOCX story
+  file's wikilinks stay clickable in the Console's editor (O2 design D11),
+  and no graph shows them yet. The Console's Connections view lists the
+  current links and backlinks of each story file the user may see, in both
+  formats, with each one's scope and format. (Design 3 and 7.1. Q176 Case
+  2 "The agents have tools to check character, place, and other data", the
+  visualization item and "Connections are always visible". Version 1.17,
+  with Q222 for the two settings and Q239 for the Connections view.)
 - **REQ-LIB-6.** The creative roles are ideas, research, proofreader,
   fact-checker and continuity, plus a companion role that the user's own
   named agents run as. Agents never write the story. A creative agent may
@@ -1255,22 +1359,37 @@ library is the user's own writing repository.
   folders a human marks (REQ-LIB-1), such as character sheets, summaries,
   cross-link notes and research notes. Every other path in the user's
   repository is read-only to it, chapters and unmarked folders included,
-  and the broker refuses such a write before any git call. Each agent
-  write is one commit by that agent's own Gitea account, with a trailer
-  naming the agent. The user sees a notice for it and can revert it. Its
-  tools are the lookups, a message to the human and the two write tools,
-  and research and companion also fetch web pages through the broker.
-  Agents talk with the user in free text. A reply may cite lines of the
-  repository at a commit or pages the agent fetched, and the broker
-  checks every citation before it stores the message. A setting,
-  `requireCitation`, makes every reply carry a citation, except the
-  runner's fixed notices for no answer, a failed turn, no answer passing
-  the citation check and an answer too long to send. Only the human
-  changes it, and it is off by default. The user sees only stored
+  and the broker refuses such a write before any git call. The writing
+  store and the archive folder are read-only to a creative agent as well,
+  and the broker's path check treats the archive folder as story. No agent
+  creates, edits, deletes, converts, archives or restores a story file in
+  any format, and no agent writes a DOCX. No creative agent starts or
+  undoes a conversion, and none asks for one through a tool or a decision
+  it raises, as REQ-LIB-8 says. An agent may still suggest a conversion to
+  the human in chat. Each creative role's contract states which files are
+  DOCX and which are Markdown, and cites a DOCX story file by its locator,
+  never by line. Each agent write is one commit by that agent's own Gitea
+  account, with a trailer naming the agent. The user sees a notice for it
+  and can revert it. Its tools are the lookups, a message to the human and
+  the two write tools, and research and companion also fetch web pages
+  through the broker. The write tools need the action `library.write`,
+  which routes under this requirement within the bounds REQ-WAIT-3 names
+  (version 1.16). Agents talk with the user in free text. A reply may cite
+  lines of a Markdown file at a commit, a place in a committed DOCX story
+  file, or pages the agent fetched, and the broker checks every citation
+  before it stores the message. A DOCX citation never calls a paragraph a
+  line. It names the document id, the committed version and a DOCX
+  locator. A citation that names an archived file as current is refused.
+  The `requireCitation` setting below applies to Markdown and DOCX
+  citations alike, and so does the rule for a citation marked as canon. A
+  setting, `requireCitation`, makes every reply carry a citation, except
+  the runner's fixed notices for no answer, a failed turn, no answer
+  passing the citation check and an answer too long to send. Only the
+  human changes it, and it is off by default. The user sees only stored
   messages, on every channel. (Design 4, 5.2 and the ruling after r11.
   Q223 and Q226. Q180 for Bean and Chet. Q176 Case 2, the agent list,
   "User sets strict guardrails for agent capabilities" and TARGET.md:101
-  "Agents NEVER write prose for the user". Version 1.15.)
+  "Agents NEVER write prose for the user". Version 1.15. Version 1.17.)
 - **REQ-LIB-7.** The user talks to several creative agents in one chat. A
   room holds one thread per creative agent in a project. A message goes
   to every agent in the room, or only to the agents named by @tags at its
@@ -1278,6 +1397,110 @@ library is the user's own writing repository.
   the threads as one timeline, and each agent sees only its own thread.
   (Design D4 and 6, row C2-09b. Q176 Case 2 "converse with N agents in
   one chat session with @tagged messages".)
+- **REQ-LIB-8.** Story files become DOCX. DOCX is the standard for chapters and
+  the other story text in a Case 2 writing project, canon and playground alike. A
+  story file becomes DOCX through a human's import (below), or when the human
+  starts it in the editor. From then on DOCX is its only working format, edited in
+  the Console's editor (REQ-LIB-9). A Markdown story file stays Markdown until its
+  import. Files in a type folder (REQ-LIB-1), such as character and place notes,
+  stay Markdown. So do supporting files, agent files, instructions, PRDs and
+  documentation, including the character sheets, summaries and cross-links agents
+  keep under REQ-LIB-6.
+  - A converted story file's current text leaves the user's Gitea-mirrored
+    repository. Its DOCX lives in the stack's writing store, on the stack's host,
+    and not in the repository the user pushes or opens in Obsidian. Only its
+    archived Markdown stays there.
+  - An import converts one Markdown story file, canon or playground, outside every
+    type folder (REQ-LIB-1), to a DOCX document in the writing store. It refuses
+    an unmapped, supporting, archived or type-folder file, and a file that is
+    already converted. Each import has its own fidelity report, the human's
+    confirmation of that report, a manifest naming the source file and its commit,
+    and one commit in the store. The DOCX keeps every wiki link of the source as
+    written, and a lost link to another library file fails the fidelity report. A
+    web link becomes plain text that keeps its label and address, and the fidelity
+    report lists it for the human to confirm. A web link that can't be kept safely
+    as plain text refuses the import.
+  - The human can also start a new story file in the editor, in a universe and
+    book or a playground the human picks. It is a DOCX document in the writing
+    store from its first commit, with no Markdown copy, and it opens under the
+    same gate as the import.
+  - The same import marks the Markdown file converted, naming the document, and
+    moves it to the archive folder under its old path (REQ-LIB-1, REQ-LIB-2).
+    The mark and the move are one commit authored by the human in the user's
+    repository. A new human-only bus step (Vikunja 571) on the C2-02 write
+    plumbing writes it, and C2-03b pushes it. The move keeps the bytes and the
+    git history, so it isn't `data.delete`.
+  - The store commit comes first, and the writing store's remote must confirm it
+    holds that commit. Then come the archive commit and its push, then publication
+    to the lookups. Until publication the Markdown at its old path keeps its canon
+    or playground scope. Agents read that file at the commit the import started
+    from, even after the mirror's served commit reaches the archive commit or a
+    later one. No lookup returns the file's archived copy before publication, even
+    one that asks for archived files. A refusal or failure before the archive push
+    leaves the Markdown unmoved and no DOCX that a lookup returns. A failure after
+    the archive push leaves a pending import that the human sees and can resume,
+    never a claim that nothing moved. An archive push whose result is unknown
+    counts as a failure after the archive push until the stack reads the result
+    back from the user's remote.
+  - Each stage of an import writes a logged event. The import's record on the
+    stack's host names the source file's path, commit and blob and the new
+    document id, and each event points to that record.
+  - After a conversion, a Markdown file at the converted file's old path is
+    neither canon nor playground. Lookups leave it out, the format map flags it,
+    and the human is told.
+  - A new Markdown story file in a book folder that holds converted files stays
+    canon until its import, unless it sits at a converted file's old path or under
+    a playground prefix. The Console flags it and offers the import. Nothing
+    converts it on its own.
+  - A hybrid's exclusion that covers a converted file's old path also covers its
+    DOCX document (REQ-LIB-3). An exclusion of a whole book folder also covers
+    every DOCX document in that book, including one started in the editor. An
+    exclusion can also name a DOCX document by its id.
+  - Only a human starts an import or a new story file, from the CLI or a Console
+    session signed in as that human. Both are human verbs outside the agent action
+    vocabulary. Neither is added to `ACTIONS` in the business vocabulary or to the
+    broker's always-gated list, including the import's action, `library.convert`.
+    No role holds them, no agent can request them, and the hard-wait list in
+    REQ-WAIT-1 doesn't change. In an organization with several humans, who may
+    start them is a setting only a human changes, and the default is the owner
+    only.
+  - Conversion is one way, with no parallel run. Neither the Console nor any agent
+    edits a converted story file as Markdown, and no DOCX edit syncs back to
+    Markdown. The Console's Markdown save refuses every file under the archive
+    folder. The user's own tools can still change the archived Markdown, and no
+    such change reaches the DOCX. The old Markdown stays in git history, and
+    nothing rewrites history. A promotion into a book folder (C2-19) runs the
+    import for a Markdown story file or is refused. A promotion of a playground
+    DOCX is refused in version 1.17.
+  - Agents get a format map: for each mapped folder and story file, its format,
+    scope and where it lives, archived files, flagged files and pending imports
+    included.
+  - The import and new story files ship closed. They open only after four things.
+    The editor ships. The human has set the writing store's remote, and the stack
+    has checked that it can push there. Agents can read committed DOCX story files
+    through the lookups and cite them (REQ-LIB-5, REQ-LIB-6). Any earlier agent
+    system that writes the user's files has stopped, which for Case 2 is the
+    Hermes retirement (#423 step 5). So the import itself never cuts agents off
+    from a chapter, the chapter's current text never lives only on the stack's
+    host, and no second system writes the story. The first import of a real user's
+    books waits for Jason's go.
+  (Q235, Q236, Q237: P1 to P6. Q222 for the setting. O2 design D10 to D12.
+  Version 1.17.)
+- **REQ-LIB-9.** The Console's DOCX editor. The human edits a DOCX story file in
+  the Console's editor, in a split pane with the agent chat alongside it. The
+  human can pin an agent chat to a document. The human can select a word,
+  right-click it, and choose a synonym from a thesaurus. Only a human saves. Saves
+  happen on their own while the human types (Q226), at intervals only a human
+  changes, and each accepted save is one commit with the human as author, pushed
+  as REQ-LIB-4 says. A save made against an older version than the current one is
+  refused. Agents never write a DOCX. Versioning is the editor's tracked changes
+  plus one git commit per save. The editor's code is vendored and pinned, with a
+  hash per file and the licenses that its independent security review accepted. At
+  runtime the editor loads only files that the stack itself serves, and it
+  requests nothing from any other host. The editor's frame sends exactly the
+  content security policy Jason approved in Q234, and the WebUI shell's own header
+  is unchanged. REQ-PROJ-3's project docs editor is unchanged. (Q195, Q226, Q234,
+  Q236. O2 design D3, D4, D6, D8, D10, D13, D14, D16 and D22. Version 1.17.)
 
 ### Installer
 
@@ -1750,6 +1973,118 @@ latest-by date and a hard target (Q176).
     ruling after r11 and in the Q226 briefs of
     `docs/plans/2026-10-20_case2-rows.md`. Sage files the rows under
     Vikunja 416. This amendment adds the requirements only.
+- Version 1.16:
+  - REQ-WAIT-3 gains one paragraph, the `library.write` routing and its
+    bounds. REQ-LIB-6 gains one sentence naming the action. No other
+    requirement text changes.
+  - `packages/tasks/requirements.json` changes its version to 1.16 and
+    nothing else. The titles stay and the id count stays 85.
+  - The commit that adds `library.write` to `ROUTED` in the business
+    vocabulary and the broker is C2-08b, row 285. It lands only after this
+    version.
+- Version 1.17:
+  - Jason confirmed the reading 'for now (subject to future change)' (Q237). The
+    rulings stand until he revises them.
+  - The 10-27 Case 2 release ships on Markdown as built (P6). The 1.11 line 'The
+    Case 2 MVP for 10-27 is the Markdown library (#416). The WYSIWYG editor (Q195,
+    Q196) is an add-on that doesn't gate it.' still holds. Conversion opens after
+    10-27, and only once REQ-LIB-8's four conditions are met. The editor ships,
+    the writing store's remote is set and the stack has checked that it can push
+    there, agents can read and cite committed DOCX story files through the
+    lookups, and Hermes is retired, which is #423 step 5.
+  - The 1.12 note says five bus write and Console editor rows, C2-02, C2-03b,
+    C2-11a, C2-11b and C2-19, don't gate 10-27. Jason's Q226 F42 later moved
+    C2-02, C2-03b and C2-11b into the 10-27 slice. The Case 2 design brings C2-11a
+    in with them, because C2-11b needs it. C2-19 stays outside the slice. Mos's
+    reading of F42 is that C2-02 and C2-03b now gate 10-27, because design 9.2
+    puts them in 'the smallest slice that lets her start'. C2-11a and C2-11b are
+    slice rows that still don't gate 10-27, because the editor is the Q195 add-on.
+    The DOCX change in 1.17 leaves this slice as it is, and C2-11b's Markdown
+    editor never edits a converted story file.
+  - Q236 narrows Q176's editor choice to DOCX for story files (REQ-LIB-9). The
+    1.12 note that the Case 2 design keeps Obsidian now holds only for Markdown
+    files, including story files not yet imported. A DOCX story file is edited
+    only in the Console's editor under REQ-LIB-9.
+  - This replaces two parts of the O2 design at 25c09f19f. The superseded-notice
+    proposal from Fenton's F1 in D12 is withdrawn, and the
+    keep-Markdown-at-its-path model of D11 is replaced. Gyro's rewrite of the O2
+    design for Vikunja 571, landed on `refactor` at b99ca86b9, carries the
+    details, and where it differs from this text, this text holds:
+    - the import and archive steps, the mark, and the new bus step;
+    - links from supporting files to a moved chapter;
+    - the DOCX reader;
+    - the user's unpushed or later changes to an archived file or at its old path,
+      and pushing and closing the file in Obsidian before each import;
+    - the writing store's remote in W4 section 7.3, which replaces the no-remote
+      and no-backup rule that W4 section 7.4 held before the rewrite, at
+      062646487;
+    - import events counted by a bus restore, and recovery when a bus restore or a
+      restore of the whole host predates an import;
+    - manifest order for the manuscript lookup and its next chapter;
+    - `library.convert` kept out of `ACTIONS`, out of the hard-wait note and out
+      of the pinned `GATED_ONLY` list in packages/business/src/vocabulary.mjs.
+  - Agents read a converted story file through the Case 2 lookups under the same
+    project and universe access as Markdown canon, in any thread or room. W4's
+    earlier O2-only conversations, per-document grants and per-send sharing don't
+    gate these lookups. The 571 rewrite replaced them in W4 sections 7.1 and 7.2.
+    The creative tool list in REQ-LIB-6 doesn't change.
+  - The six creative role contracts row 213 landed say 'Every item cites the
+    lines of the user's material it is about'. A build row under 571 changes that
+    line for DOCX story files (REQ-LIB-6).
+  - A new Markdown file in a book folder is still canon in 1.17. The 1.17
+    exception is a file at a converted file's old path, which REQ-LIB-2 makes
+    unmapped.
+  - Story files convert whether canon or playground. Type-folder and supporting
+    files stay Markdown.
+  - Measured 2026-10-23 at about 01:21Z: the Case 2 user's library repository
+    tracks 213 files, 203 of them Markdown, and none is a .docx or .doc. It has no
+    untracked files. The user's .doc files (Q196) are outside it. So the landed
+    code has no DOCX there to report as unreadable at 10-27.
+  - Text replaced in 1.17, kept here as in earlier notes:
+    - Creative library lead, the 1.16 sentence: "The library is the user's own
+      writing repository."
+    - REQ-LIB-2, the 1.16 sentences: "A file's scope comes from its path alone,
+      prefixes first: a Markdown file under a supporting prefix is supporting,
+      one under a playground prefix at any level is playground, any other
+      Markdown file in a book folder is canon, and everything else is unmapped
+      and never returned. A folder in both lists is supporting." "Lookups return
+      canon unless the caller asks for playground or supporting." "so an agent
+      can't cite a playground or supporting file as canon" "The Console shows
+      each cite's scope."
+    - REQ-LIB-4, the 1.16 sentences: "The user commits and pushes with their own
+      tools, today Obsidian with obsidian-git." "Agents read only the mirror's
+      served commit and never hold a copy of their own, so they see the user's
+      push within about a minute."
+    - REQ-LIB-5, the 1.16 sentence: "The user sees them in Obsidian's graph and
+      backlinks." A converted chapter's connections show in Obsidian only as they
+      stood at conversion, and the Console's Connections view shows their
+      current links.
+    - REQ-LIB-6, the 1.16 sentence: "A reply may cite lines of the repository at
+      a commit or pages the agent fetched, and the broker checks every citation
+      before it stores the message."
+    - REQ-LIB-1 only gains sentences.
+  - REQ-LIB-3's text and REQ-LIB-7 are unchanged. REQ-LIB-8 adds one form of
+    exclusion REQ-LIB-3 doesn't have: naming a DOCX document by its id. A path
+    exclusion also covers DOCX documents, through a converted file's old path or a
+    whole book folder. An archived file and a DOCX document keep a universe, and a
+    book where their source has one, so every lookup still names one universe.
+    REQ-PROJ-3, the Console editor for a project's spec and docs, is unchanged.
+    C2-11b opens the library's Markdown files in that same editor.
+  - In `packages/tasks/requirements.json` the titles of REQ-LIB-1, REQ-LIB-2 and
+    REQ-LIB-4 change, and those of REQ-LIB-5 and REQ-LIB-6 stay. REQ-LIB-1 becomes
+    'A human-set library maps the user's repository onto universes, books, types,
+    playgrounds, supporting and archive folders'. REQ-LIB-2 becomes 'Scope comes
+    from the path or a DOCX's source, lookups default to canon, and only canon
+    files are ever cited as canon'. REQ-LIB-4 becomes 'Git holds every change. The
+    bus fast-forwards a read-only mirror every 60 seconds, the one place agents
+    read Markdown'. REQ-LIB-8 and REQ-LIB-9 add two ids, so the count goes from 85
+    to 87. REQ-LIB-8 is titled 'Case 2 story files become DOCX by a human-only
+    one-way import or in the editor; Markdown stays for notes and docs', and
+    REQ-LIB-9 'The Console's DOCX editor: only a human saves, each save is one
+    commit, and the editor code is vendored and pinned'.
+  - Open points O1 to O4 of draft 1 were ruled by Mos in mos-1367 B1 to B4.
+  - Sage files the build rows under Vikunja 570 and 571 after the rewrite is
+    approved. This amendment adds the requirements only.
 
 ## Risks and open questions
 
@@ -1788,6 +2123,26 @@ latest-by date and a hard target (Q176).
   seat sandbox with its own network namespace closes it. Until then the
   host's own audit log is the check after the fact (row 210 design section
   6).
+- A DOCX file is a zip archive, so git can't show a line diff of a chapter.
+  Review of a story change goes through the editor and the committed reader,
+  not `git diff`. (Version 1.17.)
+- A converted chapter's DOCX is not in Obsidian's graph. Obsidian shows the
+  chapter only through its archived Markdown, and no DOCX edit reaches that file's
+  links. The DOCX's current links show in the Console's editor and its
+  Connections view, and no graph shows them yet. (Version 1.17.)
+- Conversion can't be undone in place. Front matter, wiki link forms and
+  unsupported blocks may not survive it, and the mirror can't refuse the user's
+  push to an archived file. The controls are the fidelity report, the human's
+  confirmation, an untouched original on refusal, and the kept archive.
+  (Version 1.17.)
+- A restore of the stack's bus alone from a backup taken before an import drops
+  the import's logged events, while the archive commit and the DOCX stay. A
+  restore of the stack's whole host from such a backup also takes the writing
+  store and the host's import records back to before the import. The archive
+  commit stays in the user's Gitea repository and the DOCX stays on the writing
+  store's remote, but the host keeps no record of the import. A bus restore counts
+  import events, and the import's recovery covers both cases (Vikunja 571).
+  (Version 1.17.)
 
 ## Milestones
 

packages/bus/src/broker.mjs

@@ -137,6 +137,9 @@ export const TESTER_VERBS = Object.freeze(['message.send', 'message.receive', 'm
 // collaborator grant, so a viewer gets access-refused on each.
 export const USER_VERBS = Object.freeze(['project.list', 'thread.create', 'thread.list', 'thread.open', 'thread.send', 'thread.messages', 'names',
   'thread.share', 'thread.unshare', 'thread.shares']);
+// Row 252 (#1753, design sections 2-3): the only verbs a Console owner cap reaches. Every other verb
+// refuses it human-required before its own checks, and these refuse every other cap.
+export const CONSOLE_VERBS = Object.freeze(['decision.preview.console', 'decision.resolve.console']);
 // Row 275 (193b1b, #1780, row 193 design 4.3 and 9): the user verbs a viewer grant reaches. They
 // read, so a live grant at any level covers them. thread.create, thread.open and thread.send need a
 // collaborator grant on the project and instance, so a viewer gets access-refused on each.
@@ -1456,6 +1459,26 @@ export class Broker {
     if (!this.#userGrants(s).length) fail('access-revoked');
     return this.#cap(s);
   }
+  // Row 252 (#1753, design section 2): the trusted Console transport invokes this only after
+  // verifyPrincipal checked the console-cli wrapper, its webui `serve` parent and the signed-in owner.
+  // The cap is the business human's with via 'console' and the owner subject. request() lets it reach
+  // CONSOLE_VERBS only, and #human refuses it, so no cli verb accepts it.
+  bindConsole(record) {
+    keys(record, ['business', 'human', 'subject'], ['business', 'human', 'subject']);
+    const b = this.#business(record.business);
+    const x = record.subject;
+    if (record.human !== b.human || !object(x) || Object.keys(x).length !== 3 ||
+      !['provider', 'iss', 'sub'].every((k) => typeof x[k] === 'string' && x[k].length > 0 && x[k].length <= 512))
+      fail('human-required');
+    return this.#cap({
+      business: record.business,
+      human: b.human,
+      via: 'console',
+      console: Object.freeze({ provider: x.provider, iss: x.iss, sub: x.sub }),
+      role: null,
+      run: null,
+    });
+  }
   bindReader({ business }) {
     this.#business(business);
     return this.#cap({ business, reader: true, role: null, run: null, human: false });
@@ -1504,10 +1527,61 @@ export class Broker {
     const raise = this.#raised(business, decision);
     if (d?.action !== 'credential.mint' || d.route_to !== 'human' || !raise?.grant) return null;
     const r = this.#closed(decision);
-    if (r?.op !== 'resolved' || r.choice !== raise.approvalChoice || r.via !== 'cli' || r.by !== this.#business(business).human)
-      return null;
+    if (r?.op !== 'resolved' || r.choice !== raise.approvalChoice || r.by !== this.#business(business).human) return null;
+    // Row 252 (#1753, design section 3, J14): a console close counts only with its own human.input,
+    // which only the broker writes (recordEvent reserves the kind).
+    if (!(r.via === 'console' ? this.#consoleInput(business, decision, r) : r.via === 'cli')) return null;
     return raise.grant;
   }
+  // Row 252: the console answer's human.input for close row r. Same decision, same seq, same choice,
+  // no role or run, and a three-string owner subject.
+  #consoleInput(business, decision, r) {
+    const e = this.#store.get(
+      `SELECT body FROM events WHERE business=? AND kind='human.input' AND subject=? AND actor_role IS NULL AND actor_run IS NULL
+       AND json_extract(body,'$.via')='console' AND json_extract(body,'$.decisionSeq')=? ORDER BY seq LIMIT 1`,
+      business,
+      decision,
+      r.seq,
+    );
+    const x = e && JSON.parse(e.body);
+    return (
+      !!x &&
+      x.kind === 'answer' &&
+      x.decision === decision &&
+      x.op === 'resolved' &&
+      x.choice === r.choice &&
+      object(x.subject) &&
+      ['provider', 'iss', 'sub'].every((k) => typeof x.subject[k] === 'string' && x.subject[k].length > 0)
+    );
+  }
+  // Row 252 (design section 1): a Console-eligible grant request, or null. Open is the caller's
+  // check. Eligible is route_to human, action credential.mint, a raise with a validated grant binding
+  // and exactly two distinct option keys, one of them approvalChoice. Approve is that key and deny is
+  // the other. The summary carries only the binding's method, agent, host and target projects. The
+  // digest binds the id, business, options, approval key and binding, so any change reads stale.
+  #consoleResolution(d) {
+    if (d.route_to !== 'human' || d.action !== 'credential.mint') return null;
+    const raise = this.#raised(d.business, d.id);
+    if (!object(raise?.grant) || typeof raise.grant.method !== 'string') return null;
+    const options = JSON.parse(d.options);
+    if (options.length !== 2 || options[0].key === options[1].key) return null;
+    const approve = options.find((o) => o.key === raise.approvalChoice);
+    if (!approve) return null;
+    const deny = options.find((o) => o.key !== raise.approvalChoice);
+    const g = raise.grant;
+    const grant = {
+      method: g.method,
+      ...(typeof g.agent === 'string' ? { agent: g.agent } : {}),
+      ...(typeof g.host === 'string' ? { host: g.host } : {}),
+      ...(Array.isArray(g.target?.projects) ? { projects: g.target.projects.filter((p) => typeof p === 'string') } : {}),
+    };
+    return {
+      approve: { key: approve.key, text: approve.text },
+      deny: { key: deny.key, text: deny.text },
+      grant,
+      digest: sha256(JSON.stringify([d.id, d.business, options, raise.approvalChoice, raise.grant])),
+    };
+  }
   // r6 X1: the executor's own spend. The caller owns the transaction. The consume record is the only
   // guarded body with `decision` (#436b section 7), so #spent counts it.
   #consumeGrant(business, decision, method) {
@@ -2381,11 +2455,13 @@ export class Broker {
     } catch (e) {
       const code = e instanceof BusError ? e.code : 'outcome-unknown';
       const list = out.grants.map((g) => g.grant).join(', ') || 'none';
+      // Row 239 (#1745): a step B refusal after the writer's revoke ran.
+      const tokens = code.endsWith('-revoked') ? ' Its credential tokens may already be revoked.' : '';
       this.#store.transaction(() => {
         this.#event(sc, 'action.allowed', { action: 'fire.failed', job, step, code }, name);
         this.#humanNotice(
           sc.business,
-          `Fire of ${name}: job ${job} revoked its grants (${list}) but stopped at step ${step} (${code}). The instance is still firing. Run the fire again once ${code} is cleared.`,
+          `Fire of ${name}: job ${job} revoked its grants (${list}) but stopped at step ${step} (${code}).${tokens} The instance is still firing. Run the fire again once ${code} is cleared.`,
         );
       });
     }
@@ -4551,6 +4627,9 @@ export class Broker {
         grants = this.#userGrants(s, doc);
         if (!grants.length) fail('access-revoked');
       }
+      // Row 252 (design section 2, N4): a console cap reaches the two console verbs only, and nothing
+      // else reaches them. decision.resolve stays off the list.
+      if (!!s.console !== CONSOLE_VERBS.includes(request.verb)) fail('human-required');
       const args = request.args ?? {};
       if (!object(args)) fail('invalid-request');
       this.#secretCheck(args);
@@ -4852,6 +4931,9 @@ export class Broker {
   // The bus code for an organization writer's refusal. Anything the writer didn't refuse by name is
   // outcome-unknown: the write may have committed.
   #organizationFail(e, verb) {
+    // Row 239 (#1745): the writer marks an error raised after a fire's or a delete's revoke ran, so
+    // the human reads that the tokens may already be revoked. Without the mark, today's code.
+    if (e.revoked) fail(e.code === "revision-conflict" ? "revision-conflict-revoked" : "outcome-unknown-revoked");
     if (e.code === "revision-conflict") fail("revision-conflict");
     if (e.code?.startsWith("organization-")) fail(e.code);
     if (e.code === "invalid-plugins" || e.code === "unknown-plugin") fail(e.code);
@@ -5081,6 +5163,7 @@ export class Broker {
     const s = this.#session(cap);
     try {
       if (s.user) fail('access-refused');
+      if (s.console) fail('human-required');
       this.#processingWork();
       keys(request, ['verb', 'args'], ['verb']);
       if (!TASK_VERBS.includes(request.verb)) fail('unknown-verb');
@@ -5119,6 +5202,7 @@ export class Broker {
     let args;
     try {
       if (s.user) fail('access-refused');
+      if (s.console) fail('human-required');
       keys(request, ['verb', 'args'], ['verb']);
       this.#processingWork();
       if (!verb) fail('unknown-verb');
@@ -5178,6 +5262,7 @@ export class Broker {
     let a, entry, timeout, bound;
     try {
       if (s.user) fail('access-refused');
+      if (s.console) fail('human-required');
       this.#processingWork();
       keys(request, ['verb', 'args'], ['verb']);
       if (!HOST_VERBS.includes(request.verb)) fail('unknown-verb');
@@ -5501,15 +5586,38 @@ export class Broker {
         }
         return this.#decisionView(this.#decision(s, did));
       }
+      // Row 252 (#1753, design section 3): the Console's read of one grant request before its
+      // confirmation. It returns the two answers, a safe grant summary and the digest the answer must
+      // carry. Anything not eligible refuses, so the browser never decides eligibility (J1).
+      case 'decision.preview.console': {
+        keys(a, ['id'], ['id']);
+        identifier(a.id);
+        if (!s.console || s.human !== b.human) fail('human-required');
+        const d = this.#decision(s, a.id);
+        if (this.#closed(d.id)) fail('decision-closed');
+        const c = this.#consoleResolution(d);
+        if (!c) fail('decision-not-eligible');
+        return { id: d.id, business: d.business, question: d.question, ...c };
+      }
+      case 'decision.resolve.console':
       case 'decision.resolve':
       case 'decision.seen':
       case 'decision.withdraw': {
-        keys(a, ['id', 'choice', 'note'], ['id']);
+        const viaConsole = verb === 'decision.resolve.console';
+        if (viaConsole) keys(a, ['id', 'choice', 'digest'], ['id', 'choice', 'digest']);
+        else keys(a, ['id', 'choice', 'note'], ['id']);
         identifier(a.id);
         if (a.note !== undefined) string(a.note);
         const d = this.#decision(s, a.id);
         if (this.#closed(d.id)) fail('decision-closed');
-        if (verb === 'decision.withdraw') {
+        // Row 252 (design section 3): the Console answer rechecks eligibility, the digest and the choice
+        // in this transaction. It answers one of the two keys, never a key the browser names (J2).
+        if (viaConsole) {
+          if (!s.console || s.human !== b.human) fail('human-required');
+          const c = this.#consoleResolution(d);
+          if (!c) fail('decision-not-eligible');
+          if (a.digest !== c.digest || ![c.approve.key, c.deny.key].includes(a.choice)) fail('decision-stale');
+        } else if (verb === 'decision.withdraw') {
           if (s.human) {
             this.#human(s);
           } else {
@@ -5521,32 +5629,39 @@ export class Broker {
           this.#agent(s);
           if (s.role !== d.route_to) fail('not-resolver');
         }
-        const op = verb === 'decision.resolve' ? 'resolved' : verb === 'decision.seen' ? 'seen' : 'withdrawn';
+        const op = verb === 'decision.resolve' || viaConsole ? 'resolved' : verb === 'decision.seen' ? 'seen' : 'withdrawn';
         if (op === 'resolved' && !JSON.parse(d.options).some((o) => o.key === a.choice))
           fail('invalid-choice');
-        this.#store.run(
-          'INSERT INTO decision_events(decision,at,op,by,choice,note,via) VALUES(?,?,?,?,?,?,?)',
-          d.id,
-          this.#now(),
-          op,
-          by,
-          op === 'resolved' ? a.choice : null,
-          a.note ?? null,
-          s.human ? 'cli' : 'broker',
+        const seq = Number(
+          this.#store.run(
+            'INSERT INTO decision_events(decision,at,op,by,choice,note,via) VALUES(?,?,?,?,?,?,?)',
+            d.id,
+            this.#now(),
+            op,
+            by,
+            op === 'resolved' ? a.choice : null,
+            a.note ?? null,
+            s.console ? 'console' : s.human ? 'cli' : 'broker',
+          ).lastInsertRowid,
         );
-        // Row 234 (#1740, r6 X1): the human's cli approve of a grant mint starts the executor once this
-        // transaction commits. It rechecks all of this itself, so a rollback starts nothing.
-        const grant = op === 'resolved' ? this.#approvedGrant(s.business, d.id) : null;
-        if (grant?.method === 'host-enroll') setImmediate(() => this.#runEnrollment(s.business, d.id));
-        if (grant?.method === 'host') setImmediate(() => this.#runHostGrant(s.business, d.id));
-        if (grant?.method === 'gitea') setImmediate(() => this.#startGitea(s.business, d.id));
+        // Row 252 (N2): the human.input comes before #approvedGrant, which needs a console answer's
+        // record to start the executor. Its body names the owner subject and the close's seq.
         if (s.human)
           this.#event(
             s,
             'human.input',
-            { kind: 'answer', decision: d.id, op, choice: a.choice ?? null },
+            s.console
+              ? { kind: 'answer', decision: d.id, op, choice: a.choice, via: 'console', subject: s.console, decisionSeq: seq }
+              : { kind: 'answer', decision: d.id, op, choice: a.choice ?? null },
             d.id,
           );
+        // Row 234 (#1740, r6 X1): the human's cli approve of a grant mint starts the executor once this
+        // transaction commits. It rechecks all of this itself, so a rollback starts nothing. Row 252: a
+        // Console approve does too. A deny closes the decision with the other key and starts nothing.
+        const grant = op === 'resolved' ? this.#approvedGrant(s.business, d.id) : null;
+        if (grant?.method === 'host-enroll') setImmediate(() => this.#runEnrollment(s.business, d.id));
+        if (grant?.method === 'host') setImmediate(() => this.#runHostGrant(s.business, d.id));
+        if (grant?.method === 'gitea') setImmediate(() => this.#startGitea(s.business, d.id));
         // Row 115 (#1609): a close by anyone but the raising run tells the raising role, routed like message.send's.
         // Row 133 (#1627): no messaging check here. decision.raise refused a route that can't message the
         // raiser, definitions change only with a pinned copy and arbiters only through the business
@@ -5573,7 +5688,7 @@ export class Broker {
             this.#now(),
             s.business,
             s.human ? 'human' : s.role,
-            s.human ? 'human-cli' : s.run,
+            s.console ? 'human-console' : s.human ? 'human-cli' : s.run,
             d.raised_by_role,
             'DECISION',
             null,
@@ -5583,7 +5698,8 @@ export class Broker {
           );
           this.#route(s.business, mid, d.raised_by_role, session);
         }
-        return grant ? { id: d.id, op, grant: 'started' } : { id: d.id, op };
+        const answer = viaConsole ? { id: d.id, op, choice: a.choice } : { id: d.id, op };
+        return grant ? { ...answer, grant: 'started' } : answer;
       }
       case 'message.send': {
         keys(a, ['to', 'body', 'class', 'in_reply_to', 'corrects', 'decision'], ['to', 'body']);
@@ -5939,7 +6055,12 @@ export class Broker {
               s.business,
               s.human || s.reader ? 'human' : s.role,
             )
-            .map((d) => this.#decisionView(d));
+            .map((d) => {
+              // Row 252: a grant request the Console can answer carries its two answers. The Console
+              // shows buttons from this, and the answer path rechecks it at the bus.
+              const c = s.human || s.reader ? this.#consoleResolution(d) : null;
+              return c ? { ...this.#decisionView(d), console: c } : this.#decisionView(d);
+            });
         if (verb === 'agents') {
           const claims = this.#store.all(
             "SELECT * FROM role_claims c WHERE business=? AND op='claim' AND seq=(SELECT max(seq) FROM role_claims WHERE business=c.business AND role=c.role) ORDER BY role",

packages/bus/src/client.mjs

@@ -1,18 +1,19 @@
 import { connect } from 'node:net';
 import { BusError, PROJECT_SAVE_VERB, PROJECT_SAVE_REQUEST_MAX } from './broker.mjs';
 export class Client {
-  constructor({ path, cap, human, tester, user, timeout = 5000 }) {
+  constructor({ path, cap, human, tester, user, console: owner, timeout = 5000 }) {
     this.path = path;
     this.cap = cap;
     this.human = human;
     this.tester = tester;
     this.user = user;
+    this.console = owner;
     this.timeout = timeout;
   }
   call(verb, args = {}) {
     const request =
       JSON.stringify({
-        ...(this.human ? { human: this.human } : this.tester ? { tester: this.tester } : this.user ? { user: this.user } : { cap: this.cap }),
+        ...(this.human ? { human: this.human } : this.tester ? { tester: this.tester } : this.user ? { user: this.user } : this.console ? { console: this.console } : { cap: this.cap }),
         verb,
         args,
       }) + '\n';

packages/bus/src/console-cli.mjs

@@ -0,0 +1,41 @@
+// Row 252 (#1753, design section 2): the Console owner's transport shim, spawned only by the webui
+// `cli.mjs serve` process for one preview or one answer. Not a second product CLI. The Console sets
+// the nonce, the business and the signed-in (provider, iss, sub) in the spawn environment, and the
+// bus reads them back from this process's initial environment. Nothing respawns here, so the
+// Console stays the direct parent. Input is a verb and its args only: a body that names a business,
+// a subject or any other key is refused, never merged.
+import { readFileSync } from 'node:fs';
+import { Client } from './client.mjs';
+import { readProcess } from './human.mjs';
+import { CONSOLE_VERBS } from './broker.mjs';
+const env = process.env;
+try {
+  if (!/^[a-f0-9]{64}$/.test(env.MOSAIC_BUS_CONSOLE_NONCE ?? '')) throw Object.assign(Error(), { code: 'human-required' });
+  const request = JSON.parse(readFileSync(0, 'utf8'));
+  if (
+    !request ||
+    typeof request !== 'object' ||
+    Array.isArray(request) ||
+    Object.keys(request).some((k) => !['verb', 'args'].includes(k)) ||
+    !CONSOLE_VERBS.includes(request.verb)
+  )
+    throw Error();
+  const me = readProcess(process.pid);
+  const client = new Client({
+    path: process.argv[2],
+    console: {
+      business: env.MOSAIC_BUS_CONSOLE_BUSINESS,
+      provider: env.MOSAIC_BUS_CONSOLE_PROVIDER,
+      iss: env.MOSAIC_BUS_CONSOLE_ISS,
+      sub: env.MOSAIC_BUS_CONSOLE_SUB,
+      pid: me.pid,
+      startTime: me.startTime,
+      nonce: env.MOSAIC_BUS_CONSOLE_NONCE,
+    },
+  });
+  const result = await client.call(request.verb, request.args ?? {});
+  process.stdout.write(JSON.stringify(result) + '\n');
+} catch (e) {
+  process.stderr.write((/^[a-z-]{1,64}$/.test(e.code ?? '') ? e.code : 'invalid-request') + '\n');
+  process.exitCode = 2;
+}

packages/bus/src/human.mjs

@@ -10,6 +10,10 @@ const MARKERS = [
   'CODEX_THREAD_ID',
   'PI_AGENT_DIR',
 ];
+// Row 252 (#1753, Webby N5): the Console wrapper's nonce and the subject its spawn bound. The
+// verifier reads each from the wrapper's initial environment, never from its proof alone.
+export const CONSOLE_ENV = Object.freeze(['MOSAIC_BUS_CONSOLE_NONCE', 'MOSAIC_BUS_CONSOLE_BUSINESS', 'MOSAIC_BUS_CONSOLE_PROVIDER', 'MOSAIC_BUS_CONSOLE_ISS', 'MOSAIC_BUS_CONSOLE_SUB']);
+const NONCE_KEYS = ['MOSAIC_BUS_CLI_NONCE', 'MOSAIC_BUS_USER_NONCE', ...CONSOLE_ENV];
 const refuse = () => {
   throw new BusError('human-required');
 };
@@ -31,7 +35,7 @@ export function readProcess(pid, { readFile = readFileSync, stat = lstatSync } =
       for (const entry of environment.split('\0')) {
         const i = entry.indexOf('=');
         const key = entry.slice(0, i);
-        if (['MOSAIC_BUS_CLI_NONCE', 'MOSAIC_BUS_USER_NONCE'].includes(key) || MARKERS.includes(key)) env[key] = entry.slice(i + 1);
+        if (NONCE_KEYS.includes(key) || MARKERS.includes(key)) env[key] = entry.slice(i + 1);
       }
     return {
       pid,

packages/bus/src/principal.mjs

@@ -5,8 +5,8 @@ import { verifyTester, testerNonce } from './tester.mjs';
 
 // Trusted transport API. Identity is held only by this connection's transient session.
 // User mapping and live grant authorization belong to R3, not to this verifier.
-export function verifyPrincipal(request, { peer, paths, businesses, launches = [], readProcess = defaultRead, readTesterNonce = testerNonce }) {
-  const kinds = ['human', 'tester', 'user'].filter(k => request?.[k]);
+export function verifyPrincipal(request, { peer, paths, businesses, launches = [], readProcess = defaultRead, readTesterNonce = testerNonce, consoleOwners = [] }) {
+  const kinds = ['human', 'tester', 'user', 'console'].filter(k => request?.[k]);
   if (kinds.length !== 1 || request.cap) throw new BusError('invalid-envelope');
   const kind = kinds[0], proof = request[kind];
   const error = kind === 'tester' ? 'tester-required' : 'human-required';
@@ -16,6 +16,7 @@ export function verifyPrincipal(request, { peer, paths, businesses, launches = [
     const { business } = verifyTester(proof, { cliPath: paths.tester, launches, readProcess, readNonce: readTesterNonce });
     return { kind: 'tester', business, id: 'tester' };
   }
+  if (kind === 'console') return verifyConsole(proof, { peer, paths, businesses, launches, readProcess, consoleOwners });
   let checked = proof, parent;
   if (kind === 'user') {
     if (!proof || typeof proof.user !== 'string' || !proof.user ||
@@ -42,3 +43,38 @@ export function verifyPrincipal(request, { peer, paths, businesses, launches = [
   if (!id) throw new BusError('unknown-business');
   return { kind: 'owner', business, id };
 }
+
+// Row 252 (#1753, design section 2): the Console owner. The same-tree console-cli.mjs wrapper, its own
+// nonce namespace and the human walk, with the exact same-tree webui `cli.mjs serve` as its direct
+// parent, read again after the walk as the user kind does. Business and (provider, iss, sub) must be
+// the wrapper's initial spawn environment and one of the checked console.sso subjects the runtime
+// was started with (Webby N1: every configured subject is an owner). The Console's mapping is trusted
+// as row 196 permits; the bus does not exchange an ID token itself.
+const SUBJECT_KEYS = ['provider', 'iss', 'sub'];
+const SUBJECT_ENV = { business: 'MOSAIC_BUS_CONSOLE_BUSINESS', provider: 'MOSAIC_BUS_CONSOLE_PROVIDER', iss: 'MOSAIC_BUS_CONSOLE_ISS', sub: 'MOSAIC_BUS_CONSOLE_SUB' };
+function verifyConsole(proof, { peer, paths, businesses, launches, readProcess, consoleOwners }) {
+  const refuse = () => { throw new BusError('human-required'); };
+  if (!proof || typeof proof !== 'object' ||
+    Object.keys(proof).some(k => !['pid', 'startTime', 'nonce', 'business', ...SUBJECT_KEYS].includes(k)) ||
+    SUBJECT_KEYS.some(k => typeof proof[k] !== 'string' || !proof[k] || proof[k].length > 512)) refuse();
+  if (typeof paths.consoleCli !== 'string' || typeof paths.console !== 'string') refuse();
+  const { provider, iss, sub, ...checked } = proof;
+  let child, parent;
+  try {
+    child = readProcess(proof.pid);
+    parent = readProcess(child.ppid);
+    if (parent.uid !== peer.uid || parent.argv[1] !== resolve(paths.console) || parent.argv[2] !== 'serve') refuse();
+    for (const [key, name] of Object.entries(SUBJECT_ENV)) if (child.env?.[name] !== proof[key]) refuse();
+  } catch { refuse(); }
+  const { business } = verifyHuman(checked, { cliPath: paths.consoleCli, launches, readProcess, nonceKey: 'MOSAIC_BUS_CONSOLE_NONCE' });
+  try {
+    const again = readProcess(proof.pid), up = readProcess(parent.pid);
+    if (again.ppid !== parent.pid || again.startTime !== child.startTime || up.startTime !== parent.startTime ||
+      up.ppid !== parent.ppid || up.uid !== parent.uid || up.argv[1] !== parent.argv[1] || up.argv[2] !== 'serve') refuse();
+    for (const [key, name] of Object.entries(SUBJECT_ENV)) if (again.env?.[name] !== proof[key]) refuse();
+  } catch { refuse(); }
+  if (!Array.isArray(consoleOwners) || !consoleOwners.some(o => o && o.provider === provider && o.iss === iss && o.sub === sub)) refuse();
+  const id = businesses[business]?.human;
+  if (!id) throw new BusError('unknown-business');
+  return { kind: 'console', business, id, via: 'console', subject: { provider, iss, sub } };
+}

packages/bus/src/runtime.mjs

@@ -106,7 +106,15 @@ export async function startBroker({
   // Without it no user binds. R6 and R8 pass it; the live boot config doesn't yet. FED R4 (#1801):
   // intervalMs, the revocation timer's period (design 3.7, 30 s), in-process only like librarySync's.
   access = null,
+  // Row 252 (#1753, design section 2): the checked console.sso subjects, [{provider, iss, sub}], each an
+  // owner of the business (Webby N1). The boot config carries them; no socket verb sets them. Empty, no
+  // Console owner binds and the terminal owner is unchanged.
+  consoleOwners = [],
 }) {
+  if (!Array.isArray(consoleOwners) || consoleOwners.length > 512 || consoleOwners.some((o) => o === null || typeof o !== 'object' || Array.isArray(o) ||
+      Object.keys(o).length !== 3 || ['provider', 'iss', 'sub'].some((k) => typeof o[k] !== 'string' || !o[k] || o[k].length > 512)))
+    throw new BusError('invalid-host-request');
+  const owners = Object.freeze(consoleOwners.map((o) => Object.freeze({ provider: o.provider, iss: o.iss, sub: o.sub })));
   if (access !== null && (typeof access?.file !== 'string' || access.context === null || typeof access.context !== 'object'
       || (Object.hasOwn(access, 'intervalMs') && !(Number.isSafeInteger(access.intervalMs) && access.intervalMs > 0))))
     throw new BusError('invalid-host-request');
@@ -153,11 +161,11 @@ export async function startBroker({
     const levels=organization?await harnessLevels():()=>null;
     const settings=organization?launchSettings({...organization,sessions:()=>readSessions(dataRoot),levels}):null;
     // Row 194 (#1692, brief item 8, row 199 D13): a fire or a delete revokes the agent's credentials
-    // after the writer's checks and before its write. Fire revokes each service of the entry and keeps
-    // the store directory, delete calls remove (sage-1593). A service the running bus doesn't know (an
-    // agent created since the start) has nothing in memory, so it goes on, and then no token or tmp
-    // file may remain in the agent's store directory (sage-1592). Any failure stops the verb with the
-    // file unchanged.
+    // after the writer's checks and before its write, under the writer's lock (row 239). Fire revokes
+    // each service of the entry and keeps the store directory, delete calls remove (sage-1593). A
+    // service the running bus doesn't know (an agent created since the start) has nothing in memory,
+    // so it goes on, and then no token or tmp file may remain in the agent's store directory
+    // (sage-1592). Any failure stops the verb with the file unchanged.
     const revokeFailed = (message) => new OrganizationError('credential-revoke-failed', message);
     function revoke(business, agent, how, services) {
       const instance = business + '/' + agent;
@@ -408,6 +416,7 @@ export async function startBroker({
       tester: fileURLToPath(new URL('./tester-cli.mjs', import.meta.url)),
       user: fileURLToPath(new URL('./user-cli.mjs', import.meta.url)),
       console: fileURLToPath(new URL('../../webui/src/cli.mjs', import.meta.url)),
+      consoleCli: fileURLToPath(new URL('./console-cli.mjs', import.meta.url)),
     };
     const path = join(store.directory, 'broker.sock');
     // The existing host executor owns SSH and its key lifecycle. Combine its revocation
@@ -439,6 +448,11 @@ export async function startBroker({
         const p = verifyPrincipal({ user: proof }, { peer, paths: principalPaths, businesses, launches: launchRecords });
         return broker.bindUser({ business: p.business, user: p.id });
       },
+      // Row 252 (#1753): a fresh proof per connection, a cap for the Console verbs only.
+      authenticateConsole: (proof, peer) => {
+        const p = verifyPrincipal({ console: proof }, { peer, paths: principalPaths, businesses, launches: launchRecords, consoleOwners: owners });
+        return broker.bindConsole({ business: p.business, human: p.id, subject: p.subject });
+      },
     });
     // Row 235 (r6 X3): the remote undo of interrupted host grants, once the bus is up, so a start doesn't
     // wait on the network.

packages/bus/src/server.mjs

@@ -1,6 +1,6 @@
 import { createServer } from 'node:net';
 import { lstatSync, chmodSync, unlinkSync } from 'node:fs';
-import { BusError, TASK_VERBS, WEB_VERBS, HOST_VERBS, HOSTS_VERBS, GRANTS_VERBS, PROJECT_FILE_VERBS, LIBRARY_VERBS, PROJECT_SAVE_VERB, PROJECT_SAVE_REQUEST_MAX } from './broker.mjs';
+import { BusError, TASK_VERBS, WEB_VERBS, HOST_VERBS, HOSTS_VERBS, GRANTS_VERBS, PROJECT_FILE_VERBS, LIBRARY_VERBS, PROJECT_SAVE_VERB, PROJECT_SAVE_REQUEST_MAX, CONSOLE_VERBS } from './broker.mjs';
 import { inspectInterpreter } from './interpreter.mjs';
 import { createPeerReader } from './peercred.mjs';
 const LIMIT = 65536;
@@ -13,8 +13,9 @@ const SAVE_VERB_AT_START = new RegExp(`"verb":"${PROJECT_SAVE_VERB.replaceAll('.
 // the web verbs reach it, and without one they refuse web-not-configured (or web-not-granted).
 // `host` (row 210) is the trusted host.run executor (host-run.mjs), or null: host.run then refuses
 // host-not-configured.
-// A request carries exactly one of cap, human (row S4) and tester (row 110) proof.
-export async function serve({ broker, path, authenticateHuman = null, authenticateTester = null, authenticateUser = null, peerReader = null, timeout = 5000, tasks = null, web = null, host = null }) {
+// A request carries exactly one of cap, human (row S4), tester (row 110), user (FED R3) and console
+// (row 252) proof.
+export async function serve({ broker, path, authenticateHuman = null, authenticateTester = null, authenticateUser = null, authenticateConsole = null, peerReader = null, timeout = 5000, tasks = null, web = null, host = null }) {
   try {
     lstatSync(path);
     throw new BusError('socket-exists');
@@ -64,15 +65,17 @@ export async function serve({ broker, path, authenticateHuman = null, authentica
           !r ||
           Array.isArray(r) ||
           typeof r !== 'object' ||
-          Object.keys(r).some((k) => !['cap', 'human', 'tester', 'user', 'verb', 'args'].includes(k)) ||
+          Object.keys(r).some((k) => !['cap', 'human', 'tester', 'user', 'console', 'verb', 'args'].includes(k)) ||
           typeof r.verb !== 'string' ||
-          [r.cap, r.human, r.tester, r.user].filter(Boolean).length !== 1
+          [r.cap, r.human, r.tester, r.user, r.console].filter(Boolean).length !== 1
         )
           throw new BusError('invalid-envelope');
         let cap = r.cap;
-        const kind = r.human ? 'human' : r.tester ? 'tester' : r.user ? 'user' : null;
+        const kind = r.human ? 'human' : r.tester ? 'tester' : r.user ? 'user' : r.console ? 'console' : null;
+        // Row 252 (#1753): a Console owner proof reaches its two verbs only, refused before any proof check.
+        if (kind === 'console' && !CONSOLE_VERBS.includes(r.verb)) throw new BusError('human-required');
         if (kind) {
-          const authenticate = kind === 'human' ? authenticateHuman : kind === 'tester' ? authenticateTester : authenticateUser;
+          const authenticate = kind === 'human' ? authenticateHuman : kind === 'tester' ? authenticateTester : kind === 'user' ? authenticateUser : authenticateConsole;
           if (!authenticate) throw new BusError(kind === 'tester' ? 'tester-required' : 'human-required');
           socket.pause();
           let peer;

packages/bus/tests/channel-proof.test.mjs

@@ -6,6 +6,9 @@
 // bus.mjs for six library-* STATUS entries; no proof or transport change.
 // Row 236 (#1742) re-pins human-cli.mjs for the same 130 s wait on the grants verbs; no proof or
 // transport change.
+// Row 252 (#1753, Webby N5) re-pins human.mjs, whose readProcess also keeps the five
+// MOSAIC_BUS_CONSOLE_* keys for the Console wrapper's proof, and webui bus.mjs for consoleCall,
+// which shares humanCall's spawn as transport(). The human proof and its spawn are unchanged.
 import test from "node:test";
 import assert from "node:assert/strict";
 import { createHash } from "node:crypto";
@@ -15,9 +18,10 @@ import { provedRuntime } from "../../cli/tests/channel-fixture.mjs";
 import { Client } from "../src/client.mjs";
 
 const baselines = {
- "packages/bus/src/human.mjs": "0c6d96abe4607cba0b02b0638a2fc217ff8135bac9a47761a0ef015fbe9d3079",
+ "packages/bus/src/human.mjs": "bb13c146717cdc46d75d157177e400edac4d3e10f14fe511027a25fd44cec885",
  "packages/bus/src/human-cli.mjs": "271b9781d73cf31cc562a56180e3ebcd725b5fde148a83347a201fdef2fc28af",
- "packages/cli/src/transport.mjs": "5129c44b4d9f642e825344df65c9bfb4bac4fc8d6b25343b42d39853dbd40774",
+ // Row 239 (#1745): EXIT outcome-unknown-revoked 1; no proof or transport change.
+ "packages/cli/src/transport.mjs": "662642a8ce739fcb6c188ad07125a94e008c8a305eced127c8041d472c56e55b",
  // Row 165 (#1662): seven STATUS entries for the role instance routes (organization-instance-exists,
  // organization-unknown-instance, organization-credentials-out-of-scope, organization-launch-not-configured,
  // organization-no-change, organization-project-mismatch, organization-unresolvable-instance), no proof or
@@ -26,7 +30,9 @@ const baselines = {
  // Row 194 (#1692, brief item 7, sage-1610 a): organization-tracker-required 400 and
  // organization-tracker-bot-taken 409; no proof or transport change.
  // Row 301 (#1808, mos-1449): the user transport moved from user-bus.mjs into bus.mjs; humanCall unchanged.
- "packages/webui/src/bus.mjs": "39fcb27c82e917ef05e1a7a650d522c9f3c656bf8dbade87b8ddb3661b67ad6c",
+ // Row 239 (#1745): outcome-unknown-revoked joins OPEN (duckworth-0165 C1), and STATUS gets
+ // revision-conflict-revoked 409 and outcome-unknown-revoked 503; no proof or transport change.
+ "packages/webui/src/bus.mjs": "e3f52172054676b7982eda420ce051854d404c3f0f81834c3f81138bd91c2a89",
 };
 const repoFile = path => new URL("../../../" + path, import.meta.url);
 

packages/bus/tests/console-decide.test.mjs

@@ -0,0 +1,318 @@
+// Row 252 (#1753, Gander's design approved by Webby at 5d8f0f4b5, N1-N5): the broker side of the
+// Console's Approve and Deny for a grant request. A console cap, made by bindConsole after the
+// transport checked the wrapper and the signed-in owner, reaches only decision.preview.console and
+// decision.resolve.console, and no other cap reaches those. The answer records via 'console' and a
+// human.input that names the owner, written before the grant check (N2), and only that record lets
+// an approve start the executor (J13, J14). Q188: no agent caller answers. The grant uses row 234's
+// host-enroll raise with a fake keyscan and fake enroll and check steps, so nothing connects anywhere.
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { execFileSync } from 'node:child_process';
+import { mkdtempSync, readFileSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { Broker, CONSOLE_VERBS } from '../src/broker.mjs';
+import { Client } from '../src/client.mjs';
+import { serve } from '../src/server.mjs';
+import { Store } from '../src/store.mjs';
+import { hostGrant, fingerprint } from '../src/host-grant.mjs';
+import { grantDecision } from './host-fixtures.mjs';
+
+const options = [{ key: 'yes', text: 'Yes, enroll it' }, { key: 'no', text: 'No' }];
+const SUBJECT = { provider: 'fake-oidc', iss: 'https://idp.test', sub: 'owner-1' };
+const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
+const keyLine = (dir, name) => {
+  execFileSync('ssh-keygen', ['-q', '-t', 'ed25519', '-N', '', '-C', 'x', '-f', join(dir, name)]);
+  return readFileSync(join(dir, name + '.pub'), 'utf8').trim().split(' ').slice(0, 2).join(' ');
+};
+const refusesSync = (fn, code) => assert.throws(fn, (e) => (assert.equal(e.code, code), true));
+
+function setup(t) {
+  const root = mkdtempSync(join(tmpdir(), 'c252-'));
+  const store = new Store(root);
+  t.after(() => {
+    store.close();
+    rmSync(root, { recursive: true, force: true });
+  });
+  const hostKeys = [keyLine(root, 'hk1'), keyLine(root, 'hk2')];
+  const configDir = join(root, 'config');
+  const real = hostGrant({ configDir, runRoot: join(configDir, 'secrets', 'run'), scan: async () => hostKeys });
+  const enrolls = [];
+  const hg = {
+    ...real,
+    enroll: async (...args) => (enrolls.push(args), real.enroll(...args)),
+    check: async (...args) => ({ installerFingerprint: args[2].installer_fingerprint, exit: 0 }),
+  };
+  const business = {
+    id: 'demo',
+    human: 'jason',
+    arbiters: { technical: 'pm', delivery: 'pm' },
+    roles: {
+      chief: { definition: 'chief-of-staff', authority: { withinRole: ['message.send'], crossRole: [] } },
+      pm: { definition: 'pm', authority: { withinRole: ['message.send'], crossRole: [] } },
+    },
+    vars: { 'bus.tester': true },
+  };
+  const make = () => new Broker({ store, businesses: { demo: business }, hostGrant: hg });
+  const broker = make();
+  const caps = {};
+  for (const role of ['chief', 'pm']) {
+    caps[role] = broker.bindLaunch({ business: 'demo', role, run: role + '-run', harness: 'pi', address: role });
+    broker.request(caps[role], { verb: 'role.claim' });
+  }
+  caps.human = broker.bindHuman({ business: 'demo', human: 'jason', via: 'cli', outsideAgent: true });
+  caps.tester = broker.bindTester({ business: 'demo' });
+  caps.reader = broker.bindReader({ business: 'demo' });
+  caps.console = broker.bindConsole({ business: 'demo', human: 'jason', subject: SUBJECT });
+  const grant = { method: 'host-enroll', host: 'web1', address: '192.0.2.10', port: 22, user: 'jarvis', sudo: true, fingerprints: hostKeys.map(fingerprint) };
+  const call = (who, verb, args = {}) => broker.request(caps[who], { verb, args });
+  const raise = (extra = {}) =>
+    call('chief', 'decision.raise', { action: 'credential.mint', question: 'Enroll web1?', options, recommendation: 'yes', blocking: false, grant, ...extra });
+  const events = () =>
+    store
+      .all("SELECT seq, kind, actor_role, actor_run, subject, body FROM events WHERE business='demo' ORDER BY seq")
+      // The row's subject is `about`, since a console answer's body has its own `subject`. The row's kind
+      // is `event`, set after the body, since an answer's body has its own `kind`.
+      .map((e) => ({ seq: e.seq, kind: e.kind, actor_role: e.actor_role, actor_run: e.actor_run, about: e.subject, ...JSON.parse(e.body), event: e.kind }));
+  const grantEvents = (decision) => events().filter((e) => e.actor_run === 'grant' && (e.decision === decision || e.grantDecision === decision));
+  const settle = async (decision) => {
+    for (let i = 0; i < 250; i++) {
+      if (grantEvents(decision).some((e) => ['grant.host.enrolled', 'grant.failed'].includes(e.action))) return;
+      await sleep(20);
+    }
+    throw new Error('enrollment did not end');
+  };
+  const closes = (decision) => store.all('SELECT seq, op, by, choice, via FROM decision_events WHERE decision=? ORDER BY seq', decision);
+  return { store, broker, make, caps, call, raise, events, grantEvents, settle, closes, enrolls, grant };
+}
+
+test('N4: the console verbs are exactly the preview and the console resolve, and decision.resolve is not one', () => {
+  assert.deepEqual([...CONSOLE_VERBS], ['decision.preview.console', 'decision.resolve.console']);
+  assert.equal(CONSOLE_VERBS.includes('decision.resolve'), false);
+  assert.ok(Object.isFrozen(CONSOLE_VERBS));
+});
+
+test('bindConsole takes only the business human and a three-string owner subject', (t) => {
+  const f = setup(t);
+  const bind = (record) => () => f.broker.bindConsole(record);
+  refusesSync(bind({ business: 'demo', human: 'someone', subject: SUBJECT }), 'human-required');
+  refusesSync(bind({ business: 'demo', human: 'jason', subject: { ...SUBJECT, name: 'Jason' } }), 'human-required');
+  refusesSync(bind({ business: 'demo', human: 'jason', subject: { provider: 'p', iss: 'i' } }), 'human-required');
+  refusesSync(bind({ business: 'demo', human: 'jason', subject: { ...SUBJECT, sub: '' } }), 'human-required');
+  refusesSync(bind({ business: 'demo', human: 'jason', subject: { ...SUBJECT, sub: 'x'.repeat(513) } }), 'human-required');
+  refusesSync(bind({ business: 'demo', human: 'jason', subject: { ...SUBJECT, sub: 7 } }), 'human-required');
+  refusesSync(bind({ business: 'demo', human: 'jason', subject: 'owner-1' }), 'human-required');
+  assert.throws(bind({ business: 'demo', human: 'jason', subject: SUBJECT, via: 'cli' }));
+  assert.throws(bind({ business: 'demo', human: 'jason' }));
+  assert.throws(bind({ business: 'other', human: 'jason', subject: SUBJECT }));
+  assert.deepEqual(f.broker.identity(f.caps.console), { business: 'demo', role: null, run: null, human: 'jason' });
+});
+
+test('J1, Q188: only a console cap reaches the console verbs, and a console cap reaches nothing else', async (t) => {
+  const f = setup(t);
+  const d = await f.raise();
+  const preview = f.call('console', 'decision.preview.console', { id: d.id });
+  const args = { id: d.id, choice: 'yes', digest: preview.digest };
+  // Agents, the cli human, the tester and the reader are refused before the verb runs.
+  for (const who of ['chief', 'pm', 'human', 'tester', 'reader']) {
+    refusesSync(() => f.call(who, 'decision.preview.console', { id: d.id }), 'human-required');
+    refusesSync(() => f.call(who, 'decision.resolve.console', args), 'human-required');
+  }
+  // N4: the console cap answers nothing through decision.resolve, and reaches no other verb.
+  for (const [verb, a] of [
+    ['decision.resolve', { id: d.id, choice: 'yes' }],
+    ['decision.seen', { id: d.id }],
+    ['decision.withdraw', { id: d.id }],
+    ['decision.raise', { action: 'credential.mint', question: 'q', options, recommendation: 'yes', blocking: false, grant: f.grant }],
+    ['inbox', {}],
+    ['message.send', { to: 'chief', body: 'hi' }],
+    ['role.claim', {}],
+  ])
+    refusesSync(() => f.call('console', verb, a), 'human-required');
+  assert.deepEqual(f.closes(d.id), []);
+  assert.equal(f.enrolls.length, 0);
+});
+
+test('preview: the two real answers, a grant summary and the digest, for an open grant request only', async (t) => {
+  const f = setup(t);
+  const d = await f.raise();
+  const p = f.call('console', 'decision.preview.console', { id: d.id });
+  assert.equal(p.id, d.id);
+  assert.equal(p.business, 'demo');
+  assert.match(p.question, /^Enroll web1\?/);
+  assert.deepEqual(p.approve, { key: 'yes', text: 'Yes, enroll it' });
+  assert.deepEqual(p.deny, { key: 'no', text: 'No' });
+  assert.deepEqual(p.grant, { method: 'host-enroll', host: 'web1' });
+  assert.match(p.digest, /^[a-f0-9]{64}$/);
+  // Read twice, the digest is the same; a preview writes nothing.
+  assert.equal(f.call('console', 'decision.preview.console', { id: d.id }).digest, p.digest);
+  assert.deepEqual(f.closes(d.id), []);
+  refusesSync(() => f.call('console', 'decision.preview.console', { id: d.id, choice: 'yes' }), 'invalid-request');
+  refusesSync(() => f.call('console', 'decision.preview.console', { id: 'no-such-decision' }), 'decision-not-found');
+  // The inbox row says the same, for the human and the reader. The agent-facing views do not.
+  for (const who of ['human', 'reader']) {
+    const row = f.call(who, 'inbox').find((r) => r.id === d.id);
+    assert.deepEqual(row.console, { approve: p.approve, deny: p.deny, grant: p.grant, digest: p.digest });
+  }
+});
+
+test('J1, J2: a decision that is not an eligible grant request refuses both console verbs', async (t) => {
+  const f = setup(t);
+  const grant = { method: 'host', agent: 'pm', host: 'web1', commands: ['uptime'], rotateBy: '2099-01-01' };
+  const ineligible = [
+    grantDecision(f.store, { action: 'deploy', grant, close: null }),
+    grantDecision(f.store, { route: 'pm', grant, close: null }),
+    grantDecision(f.store, { grant: undefined, close: null }),
+  ];
+  for (const id of ineligible) {
+    refusesSync(() => f.call('console', 'decision.preview.console', { id }), 'decision-not-eligible');
+    refusesSync(() => f.call('console', 'decision.resolve.console', { id, choice: 'yes', digest: '0'.repeat(64) }), 'decision-not-eligible');
+    assert.equal(f.call('human', 'inbox').find((r) => r.id === id)?.console, undefined);
+  }
+});
+
+test('N2, J13: a Console approve records via console and the owner, before the executor starts, and the grant runs once', async (t) => {
+  const f = setup(t);
+  const d = await f.raise();
+  const { digest } = f.call('console', 'decision.preview.console', { id: d.id });
+  const r = f.call('console', 'decision.resolve.console', { id: d.id, choice: 'yes', digest });
+  assert.deepEqual(r, { id: d.id, op: 'resolved', choice: 'yes', grant: 'started' });
+  const [close] = f.closes(d.id);
+  assert.deepEqual({ ...close, seq: undefined }, { seq: undefined, op: 'resolved', by: 'jason', choice: 'yes', via: 'console' });
+  const input = f.events().filter((e) => e.event === 'human.input' && e.about === d.id);
+  assert.equal(input.length, 1);
+  assert.deepEqual(
+    { ...input[0], seq: undefined },
+    { seq: undefined, kind: 'answer', actor_role: null, actor_run: null, about: d.id, decision: d.id, op: 'resolved', choice: 'yes', via: 'console', subject: SUBJECT, decisionSeq: close.seq, event: 'human.input' },
+  );
+  await f.settle(d.id);
+  assert.equal(f.enrolls.length, 1);
+  const spend = f.grantEvents(d.id).find((e) => e.operation === 'grant.host-enroll');
+  assert.ok(spend && input[0].seq < spend.seq, 'the human.input precedes the executor spend');
+  assert.ok(f.grantEvents(d.id).some((e) => e.action === 'grant.host.enrolled'));
+  // N3: the close notice to the raiser comes from the human through the Console.
+  const notices = f.store.all("SELECT from_run, body FROM messages WHERE business='demo' AND decision=? AND class='DECISION' AND from_role='human'", d.id);
+  assert.equal(notices.length, 1);
+  const [notice] = notices;
+  assert.equal(notice.from_run, 'human-console');
+  assert.match(notice.body, /resolved by jason: yes \(Yes, enroll it\)/);
+  // A second answer of either kind finds it closed, and nothing starts again.
+  refusesSync(() => f.call('console', 'decision.resolve.console', { id: d.id, choice: 'yes', digest }), 'decision-closed');
+  refusesSync(() => f.call('console', 'decision.preview.console', { id: d.id }), 'decision-closed');
+  refusesSync(() => f.call('human', 'decision.resolve', { id: d.id, choice: 'yes' }), 'decision-closed');
+  await sleep(50);
+  assert.equal(f.enrolls.length, 1);
+  assert.equal(f.closes(d.id).length, 1);
+});
+
+test('J15: a Console deny closes with the other key and starts nothing', async (t) => {
+  const f = setup(t);
+  const d = await f.raise();
+  const { digest } = f.call('console', 'decision.preview.console', { id: d.id });
+  const r = f.call('console', 'decision.resolve.console', { id: d.id, choice: 'no', digest });
+  assert.deepEqual(r, { id: d.id, op: 'resolved', choice: 'no' });
+  assert.deepEqual(f.closes(d.id).map((c) => [c.op, c.choice, c.via]), [['resolved', 'no', 'console']]);
+  await sleep(100);
+  assert.equal(f.enrolls.length, 0);
+  assert.deepEqual(f.grantEvents(d.id), []);
+  assert.deepEqual(f.make().reconcileGrants(), []);
+});
+
+test('J2: approve and deny come from approvalChoice and the options, not a fixed yes and no', async (t) => {
+  const f = setup(t);
+  // Deny listed first, so a build that takes options[0] as approve fails too.
+  const keyed = { options: [{ key: 'stop', text: 'Stop' }, { key: 'go', text: 'Go ahead' }], approvalChoice: 'go', recommendation: 'go' };
+  const denied = await f.raise({ ...keyed, question: 'Enroll web1? (deny)' });
+  const p = f.call('console', 'decision.preview.console', { id: denied.id });
+  assert.deepEqual([p.approve, p.deny], [{ key: 'go', text: 'Go ahead' }, { key: 'stop', text: 'Stop' }]);
+  for (const choice of ['yes', 'no']) refusesSync(() => f.call('console', 'decision.resolve.console', { id: denied.id, choice, digest: p.digest }), 'decision-stale');
+  assert.deepEqual(f.call('console', 'decision.resolve.console', { id: denied.id, choice: 'stop', digest: p.digest }), { id: denied.id, op: 'resolved', choice: 'stop' });
+  await sleep(100);
+  assert.equal(f.enrolls.length, 0);
+  const approved = await f.raise({ ...keyed, question: 'Enroll web1? (approve)' });
+  const { digest } = f.call('console', 'decision.preview.console', { id: approved.id });
+  assert.deepEqual(f.call('console', 'decision.resolve.console', { id: approved.id, choice: 'go', digest }), { id: approved.id, op: 'resolved', choice: 'go', grant: 'started' });
+  await f.settle(approved.id);
+  assert.equal(f.enrolls.length, 1);
+});
+
+test('J11: a stale digest or a key outside the two refuses decision-stale and writes nothing', async (t) => {
+  const f = setup(t);
+  const d = await f.raise();
+  const { digest } = f.call('console', 'decision.preview.console', { id: d.id });
+  refusesSync(() => f.call('console', 'decision.resolve.console', { id: d.id, choice: 'yes', digest: 'f'.repeat(64) }), 'decision-stale');
+  refusesSync(() => f.call('console', 'decision.resolve.console', { id: d.id, choice: 'maybe', digest }), 'decision-stale');
+  refusesSync(() => f.call('console', 'decision.resolve.console', { id: d.id, choice: 'yes' }), 'invalid-request');
+  refusesSync(() => f.call('console', 'decision.resolve.console', { id: d.id, choice: 'yes', digest, note: 'x' }), 'invalid-request');
+  // Another decision's digest does not answer this one.
+  const other = await f.raise({ question: 'Enroll web1 again?' });
+  const od = f.call('console', 'decision.preview.console', { id: other.id }).digest;
+  assert.notEqual(od, digest);
+  refusesSync(() => f.call('console', 'decision.resolve.console', { id: d.id, choice: 'yes', digest: od }), 'decision-stale');
+  assert.deepEqual(f.closes(d.id), []);
+  assert.equal(f.events().filter((e) => e.event === 'human.input').length, 0);
+  // A refusal is recorded, as for every verb.
+  assert.ok(f.events().some((e) => e.event === 'action.refused' && e.code === 'decision-stale'));
+  // The decision closed by the cli meanwhile: the console answer finds it closed.
+  f.call('human', 'decision.resolve', { id: d.id, choice: 'no' });
+  refusesSync(() => f.call('console', 'decision.resolve.console', { id: d.id, choice: 'yes', digest }), 'decision-closed');
+});
+
+test('J14: a via console close with no matching human.input approves nothing', (t) => {
+  const f = setup(t);
+  const grant = { method: 'host-enroll', host: 'web2', address: '192.0.2.11', port: 22, user: 'jarvis', sudo: true, fingerprints: [] };
+  const cli = grantDecision(f.store, { grant });
+  const bare = grantDecision(f.store, { grant: { ...grant, host: 'web3' }, close: { op: 'resolved', by: 'jason', choice: 'yes', via: 'console' } });
+  const wrong = grantDecision(f.store, { grant: { ...grant, host: 'web4' }, close: { op: 'resolved', by: 'jason', choice: 'yes', via: 'console' } });
+  const good = grantDecision(f.store, { grant: { ...grant, host: 'web5' }, close: { op: 'resolved', by: 'jason', choice: 'yes', via: 'console' } });
+  const seqOf = (id) => f.store.get('SELECT seq FROM decision_events WHERE decision=?', id).seq;
+  const input = (id, body, role = null) =>
+    f.store.run(
+      "INSERT INTO events(id,at,business,kind,actor_role,actor_run,subject,body) VALUES(?,?,?,'human.input',?,?,?,?)",
+      'e-' + id + '-' + Math.random(), '2026-10-22T00:00:00.000Z', 'demo', role, role && role + '-run', id, JSON.stringify(body),
+    );
+  const answer = (id) => ({ kind: 'answer', decision: id, op: 'resolved', choice: 'yes', via: 'console', subject: SUBJECT, decisionSeq: seqOf(id) });
+  // `bare` has no human.input at all. `wrong` has records that each break one part: another seq, choice, empty subject, an agent actor.
+  input(wrong, { ...answer(wrong), decisionSeq: seqOf(wrong) + 1000 });
+  input(wrong, { ...answer(wrong), choice: 'no' });
+  input(wrong, { ...answer(wrong), subject: { ...SUBJECT, sub: '' } });
+  input(wrong, answer(wrong), 'chief');
+  input(good, answer(good));
+  // reconcileGrants ends every approved, unspent host-enroll: exactly the cli one and the good console one.
+  assert.deepEqual(f.make().reconcileGrants().sort(), [cli, good].sort());
+  assert.equal(f.enrolls.length, 0);
+  assert.equal(f.store.get("SELECT count(*) AS n FROM events WHERE business='demo' AND actor_run='grant' AND json_extract(body,'$.decision') IN (?,?)", bare, wrong).n, 0);
+});
+
+test('recordEvent keeps human.input reserved, so no agent forges a console answer', async (t) => {
+  const f = setup(t);
+  const d = await f.raise();
+  const forged = { kind: 'human.input', subject: d.id, body: { kind: 'answer', decision: d.id, op: 'resolved', choice: 'yes', via: 'console', subject: SUBJECT, decisionSeq: 1 } };
+  for (const who of ['chief', 'pm']) refusesSync(() => f.broker.recordEvent(f.caps[who], forged), 'reserved-event');
+  refusesSync(() => f.broker.recordEvent(f.caps.console, forged), 'agent-required');
+  assert.equal(f.events().filter((e) => e.event === 'human.input').length, 0);
+});
+
+// J7: the socket transport binds a console proof's cap for its one call only. The reply and a refusal
+// both release it, so the owner cap can't outlive the request that proved it.
+test('J7: a console proof over the socket binds a cap for its one call and the reply releases it', async (t) => {
+  const f = setup(t);
+  const d = await f.raise();
+  const dir = mkdtempSync(join(tmpdir(), 'c252s-'));
+  const bound = [];
+  const server = await serve({
+    broker: f.broker,
+    path: join(dir, 'bus.sock'),
+    authenticateConsole: () => (bound.push(f.broker.bindConsole({ business: 'demo', human: 'jason', subject: SUBJECT })), bound.at(-1)),
+  });
+  t.after(async () => {
+    await server.close();
+    rmSync(dir, { recursive: true, force: true });
+  });
+  const client = new Client({ path: join(dir, 'bus.sock'), console: { fixture: true } });
+  const preview = await client.call('decision.preview.console', { id: d.id });
+  assert.equal(preview.id, d.id);
+  await assert.rejects(client.call('decision.preview.console', { id: 'nope' }), { code: 'decision-not-found' });
+  assert.equal(bound.length, 2);
+  for (const cap of bound) refusesSync(() => f.broker.identity(cap), 'unauthenticated');
+});

packages/bus/tests/fire-revokes-grants.test.mjs

@@ -133,8 +133,9 @@ async function setup(t) {
     },
   };
   // The fake organization writer. A fire delists the name and a delete drops the role, each with a
-  // reload, as the runtime reloads after a commit. `fireError` makes the fire's write refuse.
-  const org = { log: [], fireError: null };
+  // reload, as the runtime reloads after a commit. `fireError` makes the fire's write refuse, and
+  // `deleteError` the delete's (row 239).
+  const org = { log: [], fireError: null, deleteError: null };
   const sw = { state: { version: 1, halted: false, generation: GENERATION } };
   let broker;
   const organization = (business, op, args) => {
@@ -146,6 +147,7 @@ async function setup(t) {
       return { revision: REV, transaction: 't-' + org.log.length };
     }
     if (op === 'instances.set') {
+      if (org.deleteError) throw org.deleteError;
       delete doc.roles[args.instance];
       doc.launch.instances = doc.launch.instances.filter((n) => n !== args.instance);
       broker.reloadBusiness('demo', doc);
@@ -952,3 +954,44 @@ test("row 281 T14 (N1, sage-2653): a host removed under an undecided decision st
   assert.ok(!f.doc.launch.instances.includes('coder'));
   assert.equal(f.grantEvents().filter((e) => e.action === 'grant.revoke.refused').length, 1);
 });
+
+// Row 239 (#1745): the writer marks an error raised after its own revoke ran (revoked: true), and the
+// bus names it, so the human reads that the tokens may already be revoked. Unmarked, today's code.
+test("row 239 T4: a refusal after the writer's revoke is named -revoked, in the job's fire.failed and notice, a synchronous fire and a delete", async (t) => {
+  const f = await setup(t);
+  await f.approveHost('coder', 'web1');
+  f.org.fireError = Object.assign(new Error('refused'), { code: 'revision-conflict', revoked: true });
+  const out = f.fire('coder');
+  await f.broker.grantsIdle();
+  const [failed] = f.allowed('fire.failed');
+  assert.deepEqual([failed.body.job, failed.body.step, failed.body.code], [out.job, 'B', 'revision-conflict-revoked']);
+  const [message] = f.inbox();
+  assert.ok(message.includes('(revision-conflict-revoked). Its credential tokens may already be revoked. The instance is still firing.'), message);
+  // helper has no grant, so its fire writes synchronously and answers with the code.
+  await rejects(() => f.fire('helper'), 'revision-conflict-revoked');
+  // Any other marked error: the write may have landed.
+  f.org.fireError = Object.assign(new Error('EIO: i/o error'), { code: 'EIO', revoked: true });
+  await rejects(() => f.fire('helper'), 'outcome-unknown-revoked');
+  f.org.fireError = Object.assign(new Error('refused'), { code: 'revision-conflict' });
+  await rejects(() => f.fire('helper'), 'revision-conflict');
+  f.org.fireError = null;
+  f.org.deleteError = Object.assign(new Error('refused'), { code: 'revision-conflict', revoked: true });
+  assert.equal(f.remove('helper').code, 'revision-conflict-revoked');
+  f.org.deleteError = Object.assign(new Error('EIO: i/o error'), { code: 'EIO', revoked: true });
+  assert.equal(f.remove('helper').code, 'outcome-unknown-revoked');
+  f.org.deleteError = Object.assign(new Error('refused'), { code: 'revision-conflict' });
+  assert.equal(f.remove('helper').code, 'revision-conflict');
+});
+
+test("row 239 T4b: an unmarked step B refusal keeps its code, and the notice says nothing of the tokens", async (t) => {
+  const f = await setup(t);
+  await f.approveHost('coder', 'web1');
+  f.org.fireError = Object.assign(new Error('refused'), { code: 'revision-conflict' });
+  const out = f.fire('coder');
+  await f.broker.grantsIdle();
+  const [failed] = f.allowed('fire.failed');
+  assert.deepEqual([failed.body.job, failed.body.code], [out.job, 'revision-conflict']);
+  const [message] = f.inbox();
+  assert.ok(message.includes('(revision-conflict). The instance is still firing.'), message);
+  assert.ok(!message.includes('may already be revoked'), message);
+});

packages/bus/tests/principal.test.mjs

@@ -46,3 +46,52 @@ test('human leaf identity is reread after walking the parents',()=>{
  c.readProcess=pid=>{const p=read(pid);if(pid===50&&n++>0)p.startTime='101';return p;};
  assert.throws(()=>verifyPrincipal({human:proof},c),/human-required/);
 });
+
+// Row 252 (#1753, design section 2, J3-J5): the Console owner. The same-tree console-cli wrapper with
+// its own nonce, a direct same-tree `serve` parent, the subject from the wrapper's spawn environment,
+// and that subject one of the configured owners (N1).
+const owner={provider:'fake-oidc',iss:'https://idp.test',sub:'owner-1'};
+function consoleContext() {
+ const c=context('user');c.paths={...paths,consoleCli:'/tree/console-cli.mjs'};c.consoleOwners=[{provider:'other',iss:'https://idp.test',sub:'owner-2'},owner];
+ Object.assign(c.table.get(50),{argv:['node','/tree/console-cli.mjs'],env:{MOSAIC_BUS_CONSOLE_NONCE:nonce,MOSAIC_BUS_CONSOLE_BUSINESS:'demo',MOSAIC_BUS_CONSOLE_PROVIDER:owner.provider,MOSAIC_BUS_CONSOLE_ISS:owner.iss,MOSAIC_BUS_CONSOLE_SUB:owner.sub}});
+ return c;
+}
+const consoleProof={...proof,...owner};
+test('console requires its own wrapper, nonce and serve parent, and a configured owner from the spawn env',()=>{
+ assert.deepEqual(verifyPrincipal({console:consoleProof},consoleContext()),{kind:'console',business:'demo',id:'owner',via:'console',subject:owner});
+ // J3: the subject is the spawn's, never the body's alone, and must be a configured owner.
+ for(const change of [{sub:'owner-2'},{iss:'https://evil.test'},{provider:'other'}])
+  assert.throws(()=>verifyPrincipal({console:{...consoleProof,...change}},consoleContext()),/human-required/);
+ const unlisted=consoleContext();unlisted.consoleOwners=[];
+ assert.throws(()=>verifyPrincipal({console:consoleProof},unlisted),/human-required/);
+ for(const extra of [{name:'Jason'},{human:'owner'},{user:'owner'},{sub:''},{sub:'x'.repeat(513)}])
+  assert.throws(()=>verifyPrincipal({console:{...consoleProof,...extra}},consoleContext()),/human-required/);
+ // J4: the parent is the same-tree serve, direct, and not an agent.
+ for(const change of [{argv:['bash']},{argv:['node','/other/console.mjs','serve']},{argv:['node',paths.console,'other']},{env:{CODEX_THREAD_ID:'agent'}},{uid:uid+1}]) {
+  const c=consoleContext();Object.assign(c.table.get(40),change);
+  assert.throws(()=>verifyPrincipal({console:consoleProof},c),/human-required/);
+ }
+ const launched=consoleContext();launched.launches=[{pid:40,startTime:'90'}];
+ assert.throws(()=>verifyPrincipal({console:consoleProof},launched),/human-required/);
+ // J5: another nonce namespace, or the wrapper path of another kind, refuses.
+ for(const env of [{MOSAIC_BUS_CLI_NONCE:nonce},{MOSAIC_BUS_USER_NONCE:nonce}]) {
+  const c=consoleContext();const t=c.table.get(50);t.env={...t.env,...env};delete t.env.MOSAIC_BUS_CONSOLE_NONCE;
+  assert.throws(()=>verifyPrincipal({console:consoleProof},c),/human-required/);
+ }
+ for(const argv of [['node',paths.human],['node',paths.user],['node','/other/console-cli.mjs']]) {
+  const c=consoleContext();c.table.get(50).argv=argv;
+  assert.throws(()=>verifyPrincipal({console:consoleProof},c),/human-required/);
+ }
+ // The Console's own nonce does not answer as the cli human or the user.
+ assert.throws(()=>verifyPrincipal({human:proof},consoleContext()),/human-required/);
+ assert.throws(()=>verifyPrincipal({user:{...proof,user:'owner'}},consoleContext()),/human-required/);
+ // Each piece is read again after the walk: a parent or a spawn subject that changed refuses.
+ for(const [pid,mutate] of [[40,p=>{p.startTime='91';}],[50,p=>{p.env={...p.env,MOSAIC_BUS_CONSOLE_SUB:'owner-2'};}],[50,p=>{p.ppid=41;}]]) {
+  const c=consoleContext(),read=c.readProcess;let n=0;
+  // The last read of each pid is verifyConsole's own reread: 40 is read 3 times, 50 is read 4 times.
+  c.readProcess=x=>{const p=read(x);if(x===pid&&n++===(pid===40?2:3))mutate(p);return p;};
+  assert.throws(()=>verifyPrincipal({console:consoleProof},c),/human-required/);
+ }
+ for(const peer of [{pid:51,uid,gid:uid},{pid:50,uid:uid+1,gid:uid}])assert.throws(()=>verifyPrincipal({console:consoleProof},{...consoleContext(),peer}),/human-required/);
+ assert.throws(()=>verifyPrincipal({console:consoleProof,human:proof},consoleContext()),/invalid-envelope/);
+});

packages/bus/tests/requirements.test.mjs

@@ -45,7 +45,7 @@ test('requirements returns the committed list to a holding role session, and no
   const pm = agent('pm');
   const list = call(b, pm, 'requirements');
   assert.deepEqual(list, loadRequirements());
-  assert.equal(list.requirements.length, 85);
+  assert.equal(list.requirements.length, 87);
   assert.deepEqual(call(b, agent('coder'), 'requirements'), list);
   assert.throws(() => call(b, human, 'requirements'), /agent-required/);
   assert.throws(() => call(b, reader, 'requirements'), /read-only/);

packages/business/src/index.mjs

@@ -13,3 +13,4 @@ export { configDir, businessFilePath, validateBusinessDocument, loadBusiness } f
 export { LEVELS, accessFilePath, checkAccess, loadAccess, covers } from "./access.mjs";
 export { projectFilePath, validateProjectDocument, loadProject } from "./project.mjs";
 export { systemVars, resolveInstance, classify } from "./resolve.mjs";
+export { loadSeatSets } from "./library-seats.mjs";

packages/business/src/instance-settings.mjs

@@ -144,9 +144,8 @@ function createdCredentials(old, instance, definition, args) {
 // checkRoutes, row 65). Row 194 (brief item 8, row 199 D13): revoke(business, instance, how,
 // services) revokes the instance's credentials for a fire or a delete and throws
 // credential-revoke-failed when it can't. Null in a writer with no bus (the CLI's), which revokes
-// nothing.
-export function instanceSettings({ dir, rolesDir, system, levels = () => null, revoke = null }) {
-  const writer = organizationWriter({ dir, rolesDir });
+// nothing. Row 239 (#1745): writer is the organization writer, injected only by tests.
+export function instanceSettings({ dir, rolesDir, system, levels = () => null, revoke = null, writer = organizationWriter({ dir, rolesDir }) }) {
 
   // The definitions in rolesDir and whether add and set accept each one.
   function definitions() {
@@ -379,8 +378,9 @@ export function instanceSettings({ dir, rolesDir, system, levels = () => null, r
     }
   }
 
-  // The checks every write runs, then beforeWrite (a fire's or a delete's revoke), then the write. A
-  // check that refuses revokes nothing, and a revoke that throws writes nothing.
+  // The checks every write runs, then the write, which runs beforeWrite (a fire's or a delete's
+  // revoke) under its lock (row 239). A check that refuses revokes nothing, and a revoke that throws
+  // writes nothing. beforeWrite must not write this business: the writer holds its lock.
   function commit(business, old, next, { revision, actor, context, beforeWrite = null }) {
     if (canonicalJson(next) === canonicalJson(old)) throw new OrganizationError("organization-no-change");
 
@@ -410,12 +410,11 @@ export function instanceSettings({ dir, rolesDir, system, levels = () => null, r
       }
     }
     // Row 194 N1 (sage-1634): a delete writes on the revision its request read when it was raised,
-    // so a write since then makes it stale. The revision is checked here, before the revoke, because
-    // the writer's own check comes after it. A write between this read and the writer's lock still
-    // revokes and then refuses (BUILD.md follow-up).
+    // so a write since then makes it stale. This early check refuses it without taking the lock. The
+    // writer checks again under its lock, before the revoke (row 239), and that check is what keeps
+    // a stale fire or delete from revoking.
     if (writer.read(business).revision !== revision) throw new OrganizationError("revision-conflict", "organization revision changed; read again");
-    if (beforeWrite) beforeWrite();
-    const receipt = writer.write(business, next, { revision, actor, context });
+    const receipt = writer.write(business, next, { revision, actor, context, beforeWrite });
     return { ...read(business, actor), transaction: receipt.transaction, restart: false };
   }
 

packages/business/src/library-seats.mjs

@@ -0,0 +1,51 @@
+// Case 2 design 5.1 (M7, M8, row 220): which seats work in a library business,
+// and which of those hold a creative definition. Read from the business files on
+// every call, so an edit takes effect without a restart. Fail closed: a business
+// file that can't be read or validated throws. So does anything at the businesses
+// path that can't be listed: a file, a dangling symlink, or a directory that can't
+// be read. Only a path with nothing at it (lstat ENOENT) holds no library business,
+// so both sets are empty. No caller turns a throw into an empty set.
+import { lstatSync, readdirSync } from "node:fs";
+import { dirname, join, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+import { BusinessError } from "./errors.mjs";
+import { configDir, loadBusiness } from "./business.mjs";
+import { CREATIVE_DEFINITIONS } from "./vocabulary.mjs";
+
+const REPO = resolve(dirname(fileURLToPath(import.meta.url)), "..", "..", "..");
+
+export function defaultRolesDir(env = process.env) {
+  return resolve(env.MOSAIC_ROLES_DIR || join(REPO, "roles"));
+}
+
+// Returns { librarySeats, creativeSeats }: Sets of seat names (the role keys of
+// each business). A seat in two businesses counts when either one puts it in a
+// set. creativeSeats is a subset of librarySeats.
+export function loadSeatSets({ dir = configDir(), rolesDir = defaultRolesDir() } = {}) {
+  // lstat first: only nothing at the path is an absent directory. Anything else
+  // there (a file, a dangling symlink, a directory) must list, or it throws.
+  const businesses = join(dir, "businesses");
+  try {
+    lstatSync(businesses);
+  } catch (err) {
+    if (err.code === "ENOENT") return { librarySeats: new Set(), creativeSeats: new Set() };
+    throw new BusinessError(`cannot list businesses in ${dir}: ${err.message}`);
+  }
+  let names;
+  try {
+    names = readdirSync(businesses).filter((name) => name.endsWith(".json"));
+  } catch (err) {
+    throw new BusinessError(`cannot list businesses in ${dir}: ${err.message}`);
+  }
+  const librarySeats = new Set();
+  const creativeSeats = new Set();
+  for (const name of names.sort()) {
+    const business = loadBusiness(name.slice(0, -".json".length), { dir, rolesDir });
+    if (!Object.values(business.projects).some((project) => project.kind === "library")) continue;
+    for (const [seat, role] of Object.entries(business.roles)) {
+      librarySeats.add(seat);
+      if (CREATIVE_DEFINITIONS.includes(role.definition)) creativeSeats.add(seat);
+    }
+  }
+  return { librarySeats, creativeSeats };
+}

packages/business/src/organization.mjs

@@ -177,55 +177,70 @@ export function organizationWriter({ dir, rolesDir, barrier = () => {} }) {
   // Row 199 (#1697, design section 6): `detail` says what a credential verb did (verb, agent, kind,
   // date, reason), never a value; the other setters pass none. context, when given, is logged with
   // the change: row 194's hire and fire carry the chief's run and the decision there (D2.2).
-  function write(id, document, { revision, actor, detail, context }) {
+  // Row 239 (#1745): beforeWrite (a fire's or a delete's credential revoke) runs under the lock,
+  // after the revision check and the validations, so a refusal there revokes nothing. An error
+  // after it returns carries revoked: true, the lock's release included (duckworth-0165 C2), and the
+  // bus names it so the human reads that the tokens may already be revoked. beforeWrite must not
+  // write this business itself: it would find its own lock and refuse organization-busy.
+  function write(id, document, { revision, actor, detail, context, beforeWrite = null }) {
     requireId(actor, "authenticated actor");
     requireId(id, "organization id");
-    return withLock(id, ({ home, parent }) => {
-      recover(id);
-      const file = businessFilePath(id, dir);
-      const oldBytes = regular(file);
-      const before = sha256(oldBytes);
-      if (revision !== before) fail("revision-conflict", "organization revision changed; read again");
-      const old = JSON.parse(oldBytes);
-      // C2-04 M9: every organization setter preserves the whole project
-      // mapping, including library playgrounds and hybrid universes.
-      if (canonicalJson(document?.projects) !== canonicalJson(old.projects))
-        fail('organization-projects-protected');
-      validateBusinessDocument(document, file, { rolesDir });
-      const bytes = JSON.stringify(document, null, 2) + "\n";
-      // Check and log exactly what lands on disk, for every setter: a value JSON
-      // can't carry (a Date, a Map) serializes as something else (row 131, sage-0314).
-      const written = JSON.parse(bytes);
-      if (canonicalJson(written.projects) !== canonicalJson(old.projects))
-        fail('organization-projects-protected');
-      validateBusinessDocument(written, file, { rolesDir });
-      const after = sha256(bytes);
-      const transaction = randomUUID();
-      const tx = join(home, transaction);
-      directory(tx);
-      const previous = join(tx, "previous.json");
-      durable(previous, oldBytes);
-      const candidate = join(parent, "." + id + "." + transaction + ".tmp");
-      durable(candidate, bytes);
-      syncDir(tx);
-      const event = {
-        transaction, actor, ...(context === undefined ? {} : { context }), business: id, before, after,
-        changes: changes(old, written), ...(detail === undefined ? {} : { detail }), at: new Date().toISOString(),
-      };
-      log(id, { ...event, state: "prepared" });
-      syncDir(home);
-      barrier("prepared");
-      if (sha256(regular(file)) !== before) {
-        log(id, { ...event, state: "aborted" });
-        rmSync(candidate);
-        fail("revision-conflict", "organization revision changed before publication");
-      }
-      renameSync(candidate, file);
-      syncDir(parent);
-      barrier("renamed");
-      log(id, { ...event, state: "committed" });
-      return { revision: after, transaction, previous };
-    });
+    let revoked = false;
+    try {
+      return withLock(id, ({ home, parent }) => {
+        recover(id);
+        const file = businessFilePath(id, dir);
+        const oldBytes = regular(file);
+        const before = sha256(oldBytes);
+        if (revision !== before) fail("revision-conflict", "organization revision changed; read again");
+        const old = JSON.parse(oldBytes);
+        // C2-04 M9: every organization setter preserves the whole project
+        // mapping, including library playgrounds and hybrid universes.
+        if (canonicalJson(document?.projects) !== canonicalJson(old.projects))
+          fail('organization-projects-protected');
+        validateBusinessDocument(document, file, { rolesDir });
+        const bytes = JSON.stringify(document, null, 2) + "\n";
+        // Check and log exactly what lands on disk, for every setter: a value JSON
+        // can't carry (a Date, a Map) serializes as something else (row 131, sage-0314).
+        const written = JSON.parse(bytes);
+        if (canonicalJson(written.projects) !== canonicalJson(old.projects))
+          fail('organization-projects-protected');
+        validateBusinessDocument(written, file, { rolesDir });
+        if (beforeWrite) {
+          beforeWrite();
+          revoked = true;
+        }
+        const after = sha256(bytes);
+        const transaction = randomUUID();
+        const tx = join(home, transaction);
+        directory(tx);
+        const previous = join(tx, "previous.json");
+        durable(previous, oldBytes);
+        const candidate = join(parent, "." + id + "." + transaction + ".tmp");
+        durable(candidate, bytes);
+        syncDir(tx);
+        const event = {
+          transaction, actor, ...(context === undefined ? {} : { context }), business: id, before, after,
+          changes: changes(old, written), ...(detail === undefined ? {} : { detail }), at: new Date().toISOString(),
+        };
+        log(id, { ...event, state: "prepared" });
+        syncDir(home);
+        barrier("prepared");
+        if (sha256(regular(file)) !== before) {
+          log(id, { ...event, state: "aborted" });
+          rmSync(candidate);
+          fail("revision-conflict", "organization revision changed before publication");
+        }
+        renameSync(candidate, file);
+        syncDir(parent);
+        barrier("renamed");
+        log(id, { ...event, state: "committed" });
+        return { revision: after, transaction, previous };
+      });
+    } catch (e) {
+      if (revoked && e instanceof Error) e.revoked = true;
+      throw e;
+    }
   }
 
   // Row 199: a receipt with no document change, for a credential verb that changes only the agents'

packages/business/tests/business.test.mjs

@@ -27,6 +27,10 @@ test('C2-04: library mappings load without roots, remain frozen, and retain mapp
   assert.deepEqual(validateBusinessDocument(doc, file, { rolesDir: REPO_ROLES }).projects.books.universes.harbor.playground, ['Elsewhere/Playground/']);
   doc.projects.books.universes.harbor.playground = ['Second World/Playground/'];
   refuses(() => validateBusinessDocument(doc, file, { rolesDir: REPO_ROLES }), /library-playground-other-universe/);
+  // C2-01d: a supporting prefix inside another universe's book refuses with its own code.
+  doc.projects.books = mappingEntry();
+  doc.projects.books.universes.harbor.supporting = ['Second World/Notes/'];
+  refuses(() => validateBusinessDocument(doc, file, { rolesDir: REPO_ROLES }), /library-supporting-other-universe/);
   doc.projects.books = { ...mappingEntry(), root: '/forbidden' };
   refuses(() => validateBusinessDocument(doc, file, { rolesDir: REPO_ROLES }), /library-mapping-invalid/);
 });

packages/business/tests/library-seats.test.mjs

@@ -0,0 +1,107 @@
+// Case 2 M7/M8 (design 5.1, row 220): loadSeatSets reads every business file in
+// the config directory. A seat is a library seat when a business with a library
+// project names it; a creative seat is a library seat whose definition is creative.
+// Any file it can't read or validate throws, and so does a businesses path that is
+// not a directory. An absent businesses directory gives empty sets.
+import { test } from "node:test";
+import assert from "node:assert/strict";
+import { mkdirSync, mkdtempSync, rmSync, symlinkSync, writeFileSync, chmodSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { loadSeatSets } from "../src/library-seats.mjs";
+import { BusinessError } from "../src/index.mjs";
+import { businessDoc, writeJson, REPO_ROLES } from "./helpers.mjs";
+import { mappingEntry } from "../../library/tests/helpers.mjs";
+
+function fixture(t) {
+  const root = mkdtempSync(join(tmpdir(), "row220-seats-"));
+  t.after(() => rmSync(root, { recursive: true, force: true }));
+  const dir = join(root, "config");
+  mkdirSync(join(dir, "businesses"), { recursive: true });
+  return { root, dir };
+}
+
+const sets = (dir) => loadSeatSets({ dir, rolesDir: REPO_ROLES });
+
+test("M7/M8: library seats come from library businesses, creative seats from their creative definitions", (t) => {
+  const { root, dir } = fixture(t);
+  const doc = businessDoc(root, "acme");
+  doc.projects = { books: mappingEntry(), ...doc.projects };
+  doc.roles.bean = { definition: "companion" };
+  writeJson(join(dir, "businesses", "acme.json"), doc);
+  const found = sets(dir);
+  assert.deepEqual([...found.librarySeats].sort(), ["bean", "chief", "coder", "cto", "pm", "reviewer"]);
+  assert.deepEqual([...found.creativeSeats], ["bean"]);
+  assert.ok([...found.creativeSeats].every((seat) => found.librarySeats.has(seat)));
+});
+
+test("M8: a business with no library project puts no seat in either set", (t) => {
+  const { root, dir } = fixture(t);
+  const doc = businessDoc(root, "other");
+  doc.roles.bean = { definition: "companion" };
+  writeJson(join(dir, "businesses", "other.json"), doc);
+  const found = sets(dir);
+  assert.equal(found.librarySeats.size, 0);
+  assert.equal(found.creativeSeats.size, 0);
+});
+
+test("M7/M8: a business file that is not valid JSON throws; no empty set", (t) => {
+  const { root, dir } = fixture(t);
+  writeJson(join(dir, "businesses", "acme.json"), businessDoc(root, "acme"));
+  const broken = join(dir, "businesses", "broken.json");
+  writeFileSync(broken, "{");
+  chmodSync(broken, 0o600);
+  assert.throws(() => sets(dir), BusinessError);
+});
+
+test("M7/M8: an absent businesses directory gives empty sets", (t) => {
+  const root = mkdtempSync(join(tmpdir(), "row220-seats-none-"));
+  t.after(() => rmSync(root, { recursive: true, force: true }));
+  const found = sets(join(root, "config"));
+  assert.equal(found.librarySeats.size, 0);
+  assert.equal(found.creativeSeats.size, 0);
+});
+
+test("M7/M8: a businesses path that is not a directory throws; no empty set", (t) => {
+  const root = mkdtempSync(join(tmpdir(), "row220-seats-file-"));
+  t.after(() => rmSync(root, { recursive: true, force: true }));
+  const dir = join(root, "config");
+  mkdirSync(dir);
+  writeFileSync(join(dir, "businesses"), "not a directory");
+  assert.throws(() => sets(dir), (err) => err instanceof BusinessError && /cannot list businesses/.test(err.message));
+});
+
+test("M7/M8: a businesses symlink to a missing target throws; no empty set", (t) => {
+  const root = mkdtempSync(join(tmpdir(), "row220-seats-dangling-"));
+  t.after(() => rmSync(root, { recursive: true, force: true }));
+  const dir = join(root, "config");
+  mkdirSync(dir);
+  symlinkSync(join(root, "missing"), join(dir, "businesses"));
+  assert.throws(() => sets(dir), (err) => err instanceof BusinessError && /cannot list businesses/.test(err.message));
+});
+
+test("M7/M8: a config directory under a regular file throws (lstat fails with ENOTDIR); no empty set", (t) => {
+  const root = mkdtempSync(join(tmpdir(), "row220-seats-notdir-"));
+  t.after(() => rmSync(root, { recursive: true, force: true }));
+  const dir = join(root, "config");
+  writeFileSync(dir, "not a directory");
+  assert.throws(() => sets(dir), (err) => err instanceof BusinessError && /cannot list businesses/.test(err.message));
+});
+
+test("M7/M8: a business file that can't be read throws; no empty set", (t) => {
+  const { root, dir } = fixture(t);
+  writeJson(join(dir, "businesses", "acme.json"), businessDoc(root, "acme"));
+  const file = join(dir, "businesses", "acme.json");
+  chmodSync(file, 0o000);
+  t.after(() => {
+    // The fixture's rmSync hook can run first, so the file may already be gone.
+    try {
+      chmodSync(file, 0o600);
+    } catch (err) {
+      if (err.code !== "ENOENT") throw err;
+    }
+  });
+  // Root reads a mode 000 file, so the check cannot hold there.
+  if (process.getuid?.() === 0) return t.skip("running as root: mode 000 files stay readable");
+  assert.throws(() => sets(dir), (err) => err instanceof BusinessError && /must be a regular, non-symbolic-link file/.test(err.message));
+});

packages/business/tests/lifecycle-settings.test.mjs

@@ -4,9 +4,10 @@
 import test, { after } from "node:test";
 import assert from "node:assert/strict";
 import { spawnSync } from "node:child_process";
-import { readFileSync, rmSync } from "node:fs";
+import { existsSync, readFileSync, rmSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
 import { instanceSettings } from "../src/instance-settings.mjs";
+import { OrganizationError, organizationWriter } from "../src/organization.mjs";
 import { CREATIVE_DEFINITIONS } from "../src/vocabulary.mjs";
 import { businessDoc, REPO, rolesCopy, systemConfig, systemFor, tmp, writeJson } from "./helpers.mjs";
 
@@ -36,7 +37,7 @@ function fixture(mutate) {
   const log = () => readFileSync(settings.writer.logFile("acme"), "utf8").trim().split("\n").map(line => JSON.parse(line));
   const onDisk = () => JSON.parse(readFileSync(file, "utf8"));
   const revision = () => settings.read("acme").revision;
-  return { root, file, settings, validate, log, onDisk, revision };
+  return { root, dir, rolesDir, file, settings, validate, log, onDisk, revision };
 }
 
 // Each refusal: its code (or the validator's BusinessError), and the file's bytes unchanged.
@@ -244,3 +245,73 @@ test("row 256 checkDelete passes the human's creative delete and refuses another
   assert.throws(() => f.settings.checkFire("acme", "bean"), e => e.code === "organization-definition-refused");
   assert.equal(readFileSync(f.file, "utf8"), bytes);
 });
+
+// Row 239 (#1745): a fire's or a delete's revoke runs inside the writer, under its lock, after the
+// revision check. revoking(f, writer, fail) builds settings on f's files with a spy revoke and that writer.
+function revoking(f, writer, fail = null) {
+  const calls = [];
+  const revoke = (business, agent, how, services) => {
+    calls.push([business, agent, how, services]);
+    if (fail) throw fail;
+  };
+  const settings = instanceSettings({ dir: f.dir, rolesDir: f.rolesDir, system: systemFor(f.root), revoke, ...(writer ? { writer } : {}) });
+  return { settings, calls };
+}
+const receipts = f => (existsSync(f.settings.writer.logFile("acme")) ? f.log() : []);
+// A hand edit: the same document in other bytes, so the revision changes and the file still validates.
+const handEdit = f => {
+  const bytes = JSON.stringify(f.onDisk()) + "\n";
+  writeFileSync(f.file, bytes);
+  return bytes;
+};
+
+test("row 239 T1 a fire on a revision that goes stale before the writer's lock refuses there and revokes nothing", () => {
+  const f = fixture();
+  const real = organizationWriter({ dir: f.dir, rolesDir: f.rolesDir });
+  let edited = null;
+  // The edit lands after commit()'s early check and before the writer takes its lock.
+  const writer = { ...real, write: (id, document, options) => { edited = handEdit(f); return real.write(id, document, options); } };
+  const { settings, calls } = revoking(f, writer);
+  const before = receipts(f).length;
+  assert.throws(() => settings.fire("acme", { name: "sec-1" }, { actor: "chief", context: CONTEXT }),
+    e => e.code === "revision-conflict" && e.revoked === undefined);
+  assert.deepEqual(calls, []);
+  assert.equal(readFileSync(f.file, "utf8"), edited);
+  assert.equal(receipts(f).length, before);
+});
+
+test("row 239 T2 a write after the revoke refused before publication carries revoked, and the file keeps the edit", () => {
+  const f = fixture();
+  let edited = null;
+  const writer = organizationWriter({ dir: f.dir, rolesDir: f.rolesDir, barrier: stage => { if (stage === "prepared") edited = handEdit(f); } });
+  const { settings, calls } = revoking(f, writer);
+  assert.throws(() => settings.fire("acme", { name: "sec-1" }, { actor: "chief", context: CONTEXT }),
+    e => e.code === "revision-conflict" && e.revoked === true);
+  assert.deepEqual(calls, [["acme", "sec-1", "fire", []]]);
+  assert.equal(readFileSync(f.file, "utf8"), edited);
+  assert.equal(receipts(f).at(-1).state, "aborted");
+});
+
+test("row 239 T3 any error after the revoke carries revoked, for a fire and a delete; a revoke that throws carries nothing", () => {
+  for (const [how, act] of [
+    ["fire", settings => settings.fire("acme", { name: "sec-1" }, { actor: "chief", context: CONTEXT })],
+    ["delete", (settings, f) => settings.set("acme", { revision: f.revision(), instance: "sec-1", op: "delete" }, "jason")],
+  ]) {
+    const f = fixture();
+    const bytes = readFileSync(f.file, "utf8");
+    const writer = organizationWriter({ dir: f.dir, rolesDir: f.rolesDir, barrier: stage => { if (stage === "prepared") throw new Error("stopped at prepared"); } });
+    const { settings, calls } = revoking(f, writer);
+    assert.throws(() => act(settings, f), e => e.message === "stopped at prepared" && e.revoked === true, how);
+    assert.equal(calls.length, 1, how);
+    assert.equal(calls[0][2], how);
+    assert.equal(readFileSync(f.file, "utf8"), bytes, how);
+
+    const g = fixture();
+    const gBytes = readFileSync(g.file, "utf8");
+    const failing = revoking(g, null, new OrganizationError("credential-revoke-failed"));
+    assert.throws(() => act(failing.settings, g), e => e.code === "credential-revoke-failed" && e.revoked === undefined, how);
+    assert.equal(failing.calls.length, 1, how);
+    assert.equal(readFileSync(g.file, "utf8"), gBytes, how);
+    assert.deepEqual(receipts(g), [], how);
+  }
+});

packages/cli/src/config.mjs

@@ -115,6 +115,9 @@ function accessFor(system, env, warn) {
   return { file, context };
 }
 
+export const consoleOwners = (sso) =>
+  sso.providers.flatMap((p) => p.subjects.map((s) => ({ provider: p.id, iss: p.issuer, sub: s.sub })));
+
 // The `{op: 'boot'}` config for packages/bus/src/process.mjs, for one
 // business. The host holds a reader capability for the notifier and binds
 // launches later through bindLaunch, so `launches` starts empty.
@@ -135,6 +138,9 @@ export function bootConfig({ system, businessId, env = process.env, warn = () =>
     if (tracker) config.trackers = { [b.id]: tracker };
     const access = accessFor(system, env, warn);
     if (access) config.access = access;
+    // Row 252 (#1753, Webby N1): every console.sso subject is an owner, by provider id, issuer and sub.
+    // The loader checked console.sso; no new config field names owners.
+    if (system.console?.sso) config.consoleOwners = consoleOwners(system.console.sso);
     return config;
   });
 }

packages/cli/src/instances.mjs

@@ -55,6 +55,12 @@ export const REASONS = {
   "credential-revoke-failed": "a credential couldn't be revoked, so the business file is unchanged; tokens already revoked " +
     "stay revoked and the instance can't use them; clear what else the agent's store directory holds and run the same " +
     "command again, which is safe",
+  // Row 239 (#1745): a fire's or a delete's revoke runs under the writer's lock; these follow one that ran.
+  "revision-conflict-revoked": "the business file changed after the agent's tokens were revoked and before the write, so " +
+    "the file is unchanged; the tokens may already be revoked and the instance can't use them; read it again with " +
+    "`mosaic business instances` and run the same command again, which is safe",
+  "outcome-unknown-revoked": "the agent's tokens may already be revoked and the write's outcome is unknown; read the " +
+    "business file again with `mosaic business instances` before trying again",
   "capacity-full": "a launch limit is reached; `mosaic limits --business BUSINESS` shows them",
   "limit-reached": "a launch limit is reached; `mosaic limits --business BUSINESS` shows them",
   "unknown-role": "the business has no such instance",

packages/cli/src/transport.mjs

@@ -42,6 +42,7 @@ const EXIT = {
   "tester-off": 3,
   "tester-refused": 3,
   "outcome-unknown": 1,
+  "outcome-unknown-revoked": 1,
   "response-too-large": 1,
   "invalid-response": 1,
 };

packages/cli/tests/access-boot.test.mjs

@@ -14,7 +14,7 @@ import { accessContextFor } from "../src/access.mjs";
 import { bootConfig, loadSystem } from "../src/config.mjs";
 import { fixture, tmp } from "./helpers.mjs";
 
-const SSO = { sso: { providers: [{ id: "authentik", subjects: [{ sub: "jason-sub" }] }] } };
+const SSO = { sso: { providers: [{ id: "authentik", issuer: "https://idp.test", subjects: [{ sub: "jason-sub" }] }] } };
 const FEDERATION = { self: "hub", peers: [{ id: "factory", origin: "https://factory.example.test", label: "Software factory" }] };
 const DOC = {
   accessVersion: 1,

packages/cli/tests/case1-hostcheck.test.mjs

@@ -333,3 +333,51 @@ test("row 240 pins and usage: the shipped pins are r6's, the script reads the pi
     assert.deepEqual([u.status, u.stderr], [2, "hostcheck: refusing: run it as root\n"]);
   }
 });
+
+test("Vikunja 614 check: item 5 accepts dpkg's bare octal mode and leading-zero equivalents", (t) => {
+  for (const mode of ["750", "0750"]) {
+    const h = host(t);
+    put(join(h.hc, "statoverride"), `root mosaic ${mode} /usr/bin/bwrap\n`);
+    const r = run(h, "--check");
+    assert.equal(r.status, 0, r.out + r.err);
+    assert.deepEqual(fails(r), []);
+    assert.ok(r.lines.some((line) => line.startsWith("ok 5 ")), r.out);
+  }
+});
+
+test("Vikunja 614 enforce: dpkg's bare 750 leaves bwrap open and writes no DRIFT", (t) => {
+  const h = host(t);
+  put(join(h.hc, "statoverride"), "root mosaic 750 /usr/bin/bwrap\n");
+  const r = run(h, "--enforce");
+  assert.equal(r.status, 0, r.out + r.err);
+  assert.deepEqual(fails(r), []);
+  assert.equal(r.lines.at(-1), "hostcheck: all seven hold");
+  assert.deepEqual([calls(h, "apparmor_parser"), calls(h, "chown"), calls(h, "chmod")], [[], [], []]);
+  assert.equal(existsSync(drift(h)), false);
+  assert.equal(existsSync(hlog(h)), false);
+});
+
+test("Vikunja 614 check: item 5 refuses other modes, owners, groups, paths and malformed overrides", (t) => {
+  const overrides = [
+    ...["755", "0755", "4750", "75", "7500", "075", "00750", "000750", "0780", "8", "0o750", "+750", "-750", "7x0", "750+0", ""].map((mode) => `root mosaic ${mode} /usr/bin/bwrap\n`),
+    "root  mosaic 750 /usr/bin/bwrap\n",
+    "root\tmosaic 750 /usr/bin/bwrap\n",
+    "mosaic mosaic 750 /usr/bin/bwrap\n",
+    "root root 750 /usr/bin/bwrap\n",
+    "root mosaic 750 /usr/bin/other\n",
+    "root mosaic 750 /usr/bin/bwrap extra\n",
+    "root mosaic 750\n",
+    "root mosaic 750 /usr/bin/bwrap\nroot mosaic 750 /usr/bin/bwrap\n",
+    "\n",
+    "",
+    null,
+  ];
+  for (const override of overrides) {
+    const h = host(t);
+    if (override === null) rmSync(join(h.hc, "statoverride"));
+    else put(join(h.hc, "statoverride"), override);
+    const r = run(h, "--check");
+    assert.equal(r.status, 1, `${JSON.stringify(override)}: ${r.out}${r.err}`);
+    assert.deepEqual(fails(r).map((line) => line.split(" ")[1]), ["5"], r.out);
+  }
+});

packages/cli/tests/case2-install.test.mjs

@@ -0,0 +1,419 @@
+// Case 2 row C2-13b (#1727): scripts/case2-install.sh installs a hub as <user>, and
+// scripts/case2-precheck.sh's library checks and --library-status mode. Brief:
+// docs/plans/2026-10-20_case2-rows.md "C2-13b". Every case runs in a scratch home with its own
+// MOSAIC_CONFIG, a stub stack-copy and fake getent, sudo, id, node, bwrap and systemctl. The library
+// sync runs in-process against a local bare repo, as the bus would. Nothing here reads or writes
+// ~/.mosaic-dev, ~/.config/mosaic-dev, /etc or a network host, and no fixture value is a credential.
+import { test } from "node:test";
+import assert from "node:assert/strict";
+import { spawnSync } from "node:child_process";
+import { createHash } from "node:crypto";
+import { chmodSync, existsSync, mkdirSync, readdirSync, readFileSync, rmSync, statSync, unlinkSync, writeFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+import { businessDoc, writeJson } from "../../business/tests/helpers.mjs";
+import { BASE, MARKER, git, mappingEntry, repo } from "../../library/tests/helpers.mjs";
+import { ensureMirror, mirrorPath, sync } from "../../library/src/index.mjs";
+import { gitEnv } from "../../seat/src/checkout.mjs";
+import { SAFE } from "../../project/src/git.mjs";
+import { tmp } from "./helpers.mjs";
+
+const REPO = fileURLToPath(new URL("../../../", import.meta.url));
+const INSTALL = join(REPO, "scripts", "case2-install.sh");
+const PRECHECK = join(REPO, "scripts", "case2-precheck.sh");
+const COMMIT = "c".repeat(40);
+const UID = process.getuid();
+const GID = process.getgid();
+// Made-up values; no output may hold them.
+const FIXTURE_KEY = "fixture-zai-key-8d41a7";
+const PERSONA_TEXT = { bean: "Bean is warm and brief. PERSONA-TEXT-bean-61f0\n", chet: "Chet is dry and exact. PERSONA-TEXT-chet-2b9e\n" };
+const sha256 = (data) => createHash("sha256").update(data).digest("hex");
+const mode = (p) => statSync(p).mode & 0o777;
+
+function script(file, text) {
+  mkdirSync(dirname(file), { recursive: true });
+  writeFileSync(file, `#!/usr/bin/env bash\n${text}\n`);
+  chmodSync(file, 0o755);
+  return file;
+}
+
+// A scratch <user>: a home, an input business file, a persona staging dir and fakes.
+function world(t, { profile = "library" } = {}) {
+  const root = tmp(t, "case2-install-");
+  const home = join(root, "home");
+  const configDir = join(home, ".config", "mosaic-dev");
+  // claude-session.env is in place before the install, as 2d would leave it on a re-run.
+  const secrets = join(configDir, "secrets");
+  mkdirSync(secrets, { recursive: true, mode: 0o700 });
+  chmodSync(configDir, 0o700);
+  writeFileSync(join(secrets, "claude-session.env"), `ZAI_API_KEY=${FIXTURE_KEY}\n`, { mode: 0o600 });
+  const doc = businessDoc(root);
+  for (const r of Object.values(doc.roles)) r.vars = { ...r.vars, harness: "pi" };
+  if (profile === "library") {
+    doc.projects.books = { ...mappingEntry(), user: "writer" };
+    doc.roles.bean = { definition: "companion", vars: { harness: "pi" } };
+    doc.roles.chet = { definition: "companion", vars: { harness: "pi" } };
+  } else doc.vars["bus.tester"] = true;
+  const input = writeJson(join(root, "input", "acme.json"), doc);
+  const staging = join(root, "staging");
+  mkdirSync(staging, { mode: 0o700 });
+  const personas = [];
+  for (const [instance, name] of [["bean", "Bean"], ["chet", "Chet"]]) {
+    writeFileSync(join(staging, `${instance}.md`), PERSONA_TEXT[instance], { mode: 0o600 });
+    personas.push({ instance, name, bytes: Buffer.byteLength(PERSONA_TEXT[instance]), sha256: sha256(PERSONA_TEXT[instance]) });
+  }
+  writeFileSync(join(staging, "manifest.json"), `${JSON.stringify({ version: 1, personas }, null, 2)}\n`, { mode: 0o600 });
+  const bin = join(root, "bin");
+  const log = join(root, "calls.log");
+  script(join(bin, "stack-copy"), `echo "stack-copy $*" >>'${log}'
+[ "$1" = copy ] && [ "$3" = --copies ] || exit 4
+mkdir -p "$4/$2/scripts" && : >"$4/$2/scripts/mosaic" && echo "copied: $4/$2"`);
+  script(join(bin, "systemctl"), `echo "systemctl $*" >>'${log}'`);
+  const me = spawnSync("id", ["-un"], { encoding: "utf8" }).stdout.trim();
+  script(join(bin, "getent"), `[ "$1" = passwd ] && [ "$2" = '${me}' ] && echo '${me}:x:${UID}:${GID}::${home}:/bin/bash'`);
+  script(join(bin, "sudo"), "exit 1");
+  script(join(bin, "id"), `if [ "$1" = -G ]; then echo '${GID}'; elif [ "$1" = -u ] && [ -n "\${CASE2_TEST_UID:-}" ]; then echo "$CASE2_TEST_UID"; else exec /usr/bin/id "$@"; fi`);
+  script(join(bin, "node"), `if [ "$1" = --version ]; then echo v24.3.0; exit 0; fi\nexec '${process.execPath}' "$@"`);
+  script(join(bin, "bwrap"), "exit 0");
+  const units = join(root, "units");
+  mkdirSync(units);
+  writeFileSync(join(units, "mosaic-webui.service"), "[Service]\nExecStart=/usr/bin/node /x/cli.mjs serve --port 443 --business acme\n");
+  writeFileSync(join(units, "[email protected]"), "[Service]\nEnvironment=PATH=/usr/bin\n");
+  const sys = join(root, "sys");
+  mkdirSync(join(sys, "net", "ipv4"), { recursive: true });
+  mkdirSync(join(sys, "kernel"), { recursive: true });
+  writeFileSync(join(sys, "net", "ipv4", "ip_unprivileged_port_start"), "1024\n");
+  writeFileSync(join(sys, "kernel", "apparmor_restrict_unprivileged_userns"), "1\n");
+  const notify = join(home, ".mosaic-dev", "notify", "acme");
+  mkdirSync(notify, { recursive: true, mode: 0o700 });
+  writeFileSync(join(notify, "notify.json"), '{"notifyVersion":1,"binding":null}\n', { mode: 0o600 });
+  return {
+    root, home, configDir, secrets, input, staging, bin, log, units, sys, doc,
+    config: join(configDir, "config.json"),
+    business: join(configDir, "businesses", "acme.json"),
+    personaDir: join(configDir, "personas", "acme"),
+    slot: join(secrets, "acme"),
+    dataRoot: join(home, ".mosaic-dev"),
+  };
+}
+
+function env(x, extra = {}) {
+  return { PATH: `${x.bin}:/usr/bin:/bin`, HOME: x.home, MOSAIC_CONFIG: x.config, CASE2_STACK_COPY: join(x.bin, "stack-copy"), ...extra };
+}
+
+function clean(out) {
+  assert.doesNotMatch(out, new RegExp(FIXTURE_KEY), "the output holds the fixture key");
+  assert.doesNotMatch(out, /PERSONA-TEXT/, "the output holds persona text");
+  assert.doesNotMatch(out, new RegExp(MARKER), "the output holds her text");
+}
+
+function install(x, { profile = "library", args = null, extra = {} } = {}) {
+  const argv = args ?? ["--business", "acme", "--business-file", x.input, "--commit", COMMIT, "--profile", profile,
+    ...(profile === "library" ? ["--personas", x.staging] : [])];
+  const r = spawnSync(INSTALL, argv, { encoding: "utf8", timeout: 120000, env: env(x, extra) });
+  const out = r.stdout + r.stderr;
+  clean(out);
+  return { code: r.status, out };
+}
+
+function precheck(x, { args = ["--business", "acme", "--profile", "library"] } = {}) {
+  const r = spawnSync(PRECHECK, args, {
+    encoding: "utf8",
+    timeout: 60000,
+    env: env(x, { CASE2_UNIT_DIR: x.units, CASE2_PROC_SYS: x.sys, CASE2_GETENT: join(x.bin, "getent") }),
+  });
+  const out = r.stdout + r.stderr;
+  clean(out);
+  return { code: r.status, out };
+}
+const status = (x) => precheck(x, { args: ["--business", "acme", "--library-status"] });
+
+function refused(r, pattern) {
+  assert.equal(r.code, 1, r.out);
+  assert.match(r.out, pattern);
+}
+
+const calls = (x) => (existsSync(x.log) ? readFileSync(x.log, "utf8") : "");
+
+// ---- case2-install.sh ----
+
+test("the library install writes the business file, personas and slot dir, makes the copy and starts nothing", (t) => {
+  const x = world(t);
+  const r = install(x);
+  assert.equal(r.code, 0, r.out);
+  assert.equal(mode(x.business), 0o600);
+  const doc = JSON.parse(readFileSync(x.business, "utf8"));
+  for (const [instance, name] of [["bean", "Bean"], ["chet", "Chet"]]) {
+    assert.equal(doc.roles[instance].vars["persona.name"], name);
+    assert.equal(doc.roles[instance].vars["persona.sha256"], sha256(PERSONA_TEXT[instance]));
+    assert.equal(doc.roles[instance].vars.harness, "pi");
+    const file = join(x.personaDir, `${instance}.md`);
+    assert.equal(readFileSync(file, "utf8"), PERSONA_TEXT[instance]);
+    assert.equal(mode(file), 0o600);
+  }
+  assert.equal(mode(join(x.configDir, "personas")), 0o700);
+  assert.equal(mode(x.personaDir), 0o700);
+  assert.equal(mode(x.slot), 0o700);
+  assert.deepEqual(readdirSync(x.slot), []);
+  assert.equal(calls(x), `stack-copy copy ${COMMIT} --copies ${join(x.home, ".local", "share", "mosaic-stack", "copies")}\n`);
+  assert.doesNotMatch(r.out, /release/);
+  assert.match(r.out, /business acme validates/);
+  assert.match(r.out, /--library-status/);
+  assert.ok(existsSync(x.config));
+});
+
+test("a library re-run passes and leaves every file as it was", (t) => {
+  const x = world(t);
+  assert.equal(install(x).code, 0);
+  const before = readFileSync(x.business);
+  const r = install(x);
+  assert.equal(r.code, 0, r.out);
+  assert.match(r.out, /already matches/);
+  assert.match(r.out, /personas already installed/);
+  assert.deepEqual(readFileSync(x.business), before);
+});
+
+test("a re-run refuses business-file-differs and leaves the file unchanged", (t) => {
+  const x = world(t);
+  assert.equal(install(x).code, 0);
+  const doc = JSON.parse(readFileSync(x.business, "utf8"));
+  doc.vars["tracker.pollSeconds"] = 120;
+  writeJson(x.business, doc);
+  const before = readFileSync(x.business);
+  refused(install(x), /business-file-differs/);
+  assert.deepEqual(readFileSync(x.business), before);
+});
+
+test("a re-run refuses persona-differs when an installed persona isn't the staged one, and writes nothing", (t) => {
+  const x = world(t);
+  assert.equal(install(x).code, 0);
+  rmSync(x.business);
+  writeFileSync(join(x.personaDir, "bean.md"), "Someone else. PERSONA-TEXT-other\n");
+  refused(install(x), /persona-differs/);
+  assert.equal(existsSync(x.business), false);
+});
+
+test("the factory install writes no library mapping, persona or slot dir", (t) => {
+  const x = world(t, { profile: "factory" });
+  const r = install(x, { profile: "factory" });
+  assert.equal(r.code, 0, r.out);
+  const doc = JSON.parse(readFileSync(x.business, "utf8"));
+  assert.equal(Object.values(doc.projects).some((p) => p.kind === "library"), false);
+  assert.equal(existsSync(join(x.configDir, "personas")), false);
+  assert.equal(existsSync(x.slot), false);
+  assert.doesNotMatch(r.out, /--library-status/);
+});
+
+test("the factory install refuses a library project and bus.tester off, before anything is written", (t) => {
+  const x = world(t, { profile: "factory" });
+  const doc = JSON.parse(readFileSync(x.input, "utf8"));
+  doc.projects.books = { ...mappingEntry(), user: "writer" };
+  writeJson(x.input, doc);
+  refused(install(x, { profile: "factory" }), /profile-library-business/);
+  delete doc.projects.books;
+  doc.vars["bus.tester"] = false;
+  writeJson(x.input, doc);
+  refused(install(x, { profile: "factory" }), /bus-tester-off/);
+  assert.equal(calls(x), "");
+  assert.equal(existsSync(x.business), false);
+});
+
+test("the library install refuses bus.tester on and a persona var in the input", (t) => {
+  const x = world(t);
+  const doc = JSON.parse(readFileSync(x.input, "utf8"));
+  doc.vars["bus.tester"] = true;
+  writeJson(x.input, doc);
+  refused(install(x), /bus-tester-on/);
+  doc.vars["bus.tester"] = false;
+  doc.roles.bean.vars["persona.name"] = "Bean";
+  writeJson(x.input, doc);
+  refused(install(x), /persona-var-input/);
+  assert.equal(calls(x), "");
+});
+
+test("the install refuses root, a business id mismatch, another --home and a config dir with group bits", (t) => {
+  const x = world(t);
+  refused(install(x, { extra: { CASE2_TEST_UID: "0" } }), /run-as-root/);
+  refused(install(x, { args: ["--business", "other", "--business-file", x.input, "--commit", COMMIT, "--personas", x.staging] }), /business-id-mismatch/);
+  refused(install(x, { args: ["--business", "acme", "--business-file", x.input, "--commit", COMMIT, "--personas", x.staging, "--home", x.root] }), /home-mismatch/);
+  chmodSync(x.configDir, 0o750);
+  refused(install(x), /config-dir-mode/);
+  assert.equal(calls(x), "");
+  assert.equal(existsSync(x.business), false);
+});
+
+test("the library install needs --personas", (t) => {
+  const x = world(t);
+  const r = install(x, { args: ["--business", "acme", "--business-file", x.input, "--commit", COMMIT] });
+  assert.equal(r.code, 4, r.out);
+  assert.match(r.out, /needs --personas/);
+});
+
+test("a validate refusal removes the business file this run wrote", (t) => {
+  const x = world(t);
+  unlinkSync(x.doc.roles.pm.credentials.gitea.file);
+  const r = install(x);
+  refused(r, /validate: .*the business file this run wrote is removed/);
+  assert.equal(existsSync(x.business), false);
+});
+
+test("N4: a validate refusal on a re-run leaves the matching business file in place, byte for byte", (t) => {
+  const x = world(t);
+  assert.equal(install(x).code, 0);
+  const before = readFileSync(x.business);
+  unlinkSync(x.doc.roles.pm.credentials.gitea.file);
+  const r = install(x);
+  refused(r, /validate: /);
+  assert.doesNotMatch(r.out, /is removed/);
+  assert.deepEqual(readFileSync(x.business), before);
+});
+
+// ---- case2-precheck.sh, the library profile (D6a) ----
+
+test("a clean library host passes the precheck with no mirror yet", (t) => {
+  const x = world(t);
+  assert.equal(install(x).code, 0);
+  const r = precheck(x);
+  assert.equal(r.code, 0, r.out);
+  assert.match(r.out, /ok {6}business file .* with no group or other bit/);
+  assert.match(r.out, /ok {6}no history for acme yet/);
+  assert.match(r.out, new RegExp(`ok {6}persona bean sha256 ${sha256(PERSONA_TEXT.bean)}`));
+  assert.match(r.out, new RegExp(`ok {6}persona chet sha256 ${sha256(PERSONA_TEXT.chet)}`));
+  assert.match(r.out, /ok {6}no Discord binding/);
+  assert.equal(existsSync(mirrorPath({ business: { id: "acme", projects: { books: x.doc.projects.books } }, project: "books", dataRoot: x.dataRoot })), false);
+});
+
+test("the library precheck refuses a persona file at 0644", (t) => {
+  const x = world(t);
+  assert.equal(install(x).code, 0);
+  chmodSync(join(x.personaDir, "bean.md"), 0o644);
+  refused(precheck(x), /REFUSED persona-mode: .*bean\.md must be .* 0600 file \(mode 644\)/);
+});
+
+test("the library precheck refuses a persona whose digest isn't persona.sha256", (t) => {
+  const x = world(t);
+  assert.equal(install(x).code, 0);
+  writeFileSync(join(x.personaDir, "chet.md"), "Not Chet. PERSONA-TEXT-other\n");
+  refused(precheck(x), /REFUSED persona-mismatch: persona chet has sha256 [0-9a-f]{64}, and persona.sha256 is /);
+});
+
+test("the library precheck refuses a persona dir with group bits", (t) => {
+  const x = world(t);
+  assert.equal(install(x).code, 0);
+  chmodSync(x.personaDir, 0o750);
+  refused(precheck(x), /REFUSED persona-mode: .*personas\/acme must be .* 0700 directory/);
+});
+
+test("the library precheck refuses a business file at 0644", (t) => {
+  const x = world(t);
+  assert.equal(install(x).code, 0);
+  chmodSync(x.business, 0o644);
+  refused(precheck(x), /REFUSED business-file-mode: .*acme\.json .*\(mode 644\)/);
+});
+
+test("the library precheck refuses a changes.jsonl at 0644", (t) => {
+  const x = world(t);
+  assert.equal(install(x).code, 0);
+  const history = join(x.configDir, "businesses", ".history", "acme");
+  mkdirSync(history, { recursive: true, mode: 0o700 });
+  writeFileSync(join(history, "changes.jsonl"), "", { mode: 0o644 });
+  chmodSync(join(history, "changes.jsonl"), 0o644);
+  refused(precheck(x), /REFUSED history-mode: .*changes\.jsonl must be .* 0600 file \(mode 644\)/);
+  chmodSync(join(history, "changes.jsonl"), 0o600);
+  assert.equal(precheck(x).code, 0);
+});
+
+test("the library precheck refuses a Discord binding", (t) => {
+  const x = world(t);
+  assert.equal(install(x).code, 0);
+  mkdirSync(join(x.dataRoot, "discord"), { recursive: true });
+  writeFileSync(join(x.dataRoot, "discord", "her.json"), "{}\n", { mode: 0o600 });
+  refused(precheck(x), /REFUSED discord-binding: .*her\.json exists/);
+});
+
+// ---- case2-precheck.sh --library-status (D6b) ----
+
+// The context the bus builds for books (runtime.mjs:161-164), and a sync the way the bus's timer
+// runs it, against a local bare clone through the command parameter.
+function library(x) {
+  const context = { business: { id: "acme", projects: { books: x.doc.projects.books } }, project: "books", dataRoot: x.dataRoot };
+  mkdirSync(x.dataRoot, { recursive: true, mode: 0o700 });
+  chmodSync(x.dataRoot, 0o700);
+  const run = (bare, slot) => sync(context, {
+    slot,
+    command: (kind, url, { mirror, branch }) => ({
+      argv: [...SAFE, "-c", "protocol.file.allow=always", "-c", "core.createObject=rename", "-C", mirror, "fetch", "--no-tags",
+        "--no-write-fetch-head", "--end-of-options", bare, `+refs/heads/${branch}:refs/remotes/library/${branch}`],
+      env: { ...gitEnv(), LC_ALL: "C", GIT_CEILING_DIRECTORIES: dirname(mirror) },
+    }),
+  });
+  return { context, run };
+}
+
+test("--library-status refuses library-mirror-missing before the bus has made the mirror", (t) => {
+  const x = world(t);
+  assert.equal(install(x).code, 0);
+  refused(status(x), /REFUSED library-mirror-missing: library books has no mirror at .*the bus makes it when it starts/);
+});
+
+test("--library-status refuses library-never-synced on a fresh mirror", async (t) => {
+  const x = world(t);
+  assert.equal(install(x).code, 0);
+  await ensureMirror(library(x).context);
+  const r = status(x);
+  refused(r, /REFUSED library-never-synced: library books has no fetch yet/);
+  assert.doesNotMatch(r.out, /library-last-error/);
+});
+
+test("--library-status names a recorded lastError before the null lastFetch it leaves (N3)", async (t) => {
+  const x = world(t);
+  assert.equal(install(x).code, 0);
+  const lib = library(x);
+  await lib.run("/nonexistent", join(x.slot, "library-gitea"));
+  const r = status(x);
+  refused(r, /REFUSED library-last-error: library books: library-credential-missing at \d{4}-\d\d-\d\dT/);
+  assert.doesNotMatch(r.out, /library-never-synced/);
+});
+
+test("--library-status prints each R-problem's path as an escaped JSON string, then the count, and passes", async (t) => {
+  const x = world(t);
+  assert.equal(install(x).code, 0);
+  const odd = "Odd‮Name\u0085.md";
+  const f = repo(t, { ...BASE, [odd]: `${MARKER}\n` });
+  const bare = join(f.root, "remote.git");
+  git(f.root, "clone", "-q", "--bare", "--no-local", f.repo, bare);
+  writeFileSync(join(x.slot, "library-gitea"), "placeholder-not-a-token\n", { mode: 0o600 });
+  const { state } = await library(x).run(bare, join(x.slot, "library-gitea"));
+  assert.equal(state.lastError, null);
+  const r = status(x);
+  assert.equal(r.code, 0, r.out);
+  assert.match(r.out, new RegExp(`ok {6}library books last fetched \\S+, serving ${f.commit}`));
+  assert.match(r.out, /^problem {3}R2 "Inbox Note\.md"$/m);
+  assert.match(r.out, /^problem {3}R\d+ "Odd\\u202eName\\u0085\.md"$/m);
+  assert.doesNotMatch(r.out, /[\u0085‮]/);
+  const lines = r.out.split("\n").filter((l) => l.startsWith("problem   "));
+  assert.equal(lines.length, state.problems.length);
+  assert.match(r.out, new RegExp(`^problems  ${state.problems.length}$`, "m"));
+  assert.match(r.out, /case2-precheck: library status passed/);
+});
+
+test("--library-status takes no --profile", (t) => {
+  const x = world(t);
+  const r = precheck(x, { args: ["--business", "acme", "--library-status", "--profile", "library"] });
+  assert.equal(r.code, 4, r.out);
+});
+
+test("Vikunja 614: install preserves the explicit notifier decision bytes and mode and creates none when absent", (t) => {
+  const x = world(t);
+  const file = join(x.dataRoot, "notify", "acme", "notify.json");
+  const before = readFileSync(file), beforeMode = mode(file);
+  const r = install(x);
+  assert.equal(r.code, 0, r.out);
+  assert.deepEqual(readFileSync(file), before);
+  assert.equal(mode(file), beforeMode);
+  const absent = world(t), missing = join(absent.dataRoot, "notify", "acme", "notify.json");
+  rmSync(missing);
+  const fresh = install(absent);
+  assert.equal(fresh.code, 0, fresh.out);
+  assert.equal(existsSync(missing), false);
+});

packages/cli/tests/case2-unit.test.mjs

@@ -626,6 +626,9 @@ function host(t, { roles = {}, vars = {}, keyFile = `ZAI_API_KEY=${FIXTURE_KEY}\
   script(join(bin, "id"), `if [ "$1" = -G ]; then echo "\${CASE2_TEST_GROUPS:-${GID}}"; else exec /usr/bin/id "$@"; fi`);
   script(join(bin, "node"), `if [ "$1" = --version ]; then echo "\${CASE2_TEST_NODE:-v24.3.0}"; exit 0; fi\nexec '${process.execPath}' "$@"`);
   script(join(bin, "bwrap"), `exit "\${CASE2_TEST_BWRAP:-0}"`);
+  const notify = join(home, ".mosaic-dev", "notify", "acme");
+  mkdirSync(notify, { recursive: true, mode: 0o700 });
+  writeFileSync(join(notify, "notify.json"), '{"notifyVersion":1,"binding":null}\n', { mode: 0o600 });
   return { root, home, configDir, config, secrets, units, sys, bin, dataRoot: join(home, ".mosaic-dev") };
 }
 
@@ -872,3 +875,68 @@ test("inside a session's sandbox a bind below 1024 fails with EACCES, and a bind
   assert.equal(bindIn(LOW_PORT), "EACCES");
   assert.equal(bindIn(high), "bound");
 });
+
+test("Vikunja 614 factory: scoped @anthropic-ai Claude path renders and passes installed read-back", (t) => {
+  const h = hub(t);
+  const claude = script(join(h.root, "opt", "claude-pin", "node_modules", "@anthropic-ai", "claude-code", "bin", "claude.exe"), "exit 0");
+  // The suite runs unprivileged. Model root ownership for this regular executable
+  // and its ancestors only; file type/executable checks and both unit readers are real.
+  const ancestors = [];
+  for (let p = claude; p !== "/"; p = dirname(p)) ancestors.push(p);
+  script(join(h.bin, "stat"), `if [ "$1" = -c ] && [ "$3" = -- ]; then
+  case "$4" in ${ancestors.map((p) => JSON.stringify(p)).join("|")})
+    case "$2" in %u) echo 0; exit ;; %a) echo 755; exit ;; esac ;;
+  esac
+fi
+exec /usr/bin/stat "$@"`);
+  const first = unit(h, { profile: "factory", extra: ["--claude", claude] });
+  assert.equal(first.code, 0, first.out + first.err);
+  assert.ok(lines(read(busFile(h)), "Environment").includes(`MOSAIC_CLAUDE_BIN=${claude}`));
+  const again = unit(h, { profile: "factory", copy: COPY_B, extra: ["--claude", claude] });
+  assert.equal(again.code, 0, again.out + again.err);
+  assert.ok(lines(read(busFile(h)), "Environment").includes(`MOSAIC_CLAUDE_BIN=${claude}`));
+  assert.deepEqual(lines(read(busFile(h)), "WorkingDirectory"), [copyDir(h, COPY_B)]);
+});
+
+test("Vikunja 614 factory: plain paths still refuse every named unsafe character", (t) => {
+  const h = hub(t);
+  for (const char of [" ", "%", "$", "\"", "'", "\\", "&", "|"]) {
+    refuses(unit(h, { profile: "factory", extra: ["--claude", `/opt/claude${char}bin`] }), /--claude contains a character the unit cannot carry/);
+  }
+});
+
+test("Vikunja 614 precheck: explicit null and named notifier decisions pass", (t) => {
+  for (const binding of [null, "host-notify"]) {
+    const x = host(t);
+    const dir = join(x.dataRoot, "notify", "acme");
+    mkdirSync(dir, { recursive: true, mode: 0o700 });
+    writeFileSync(join(dir, "notify.json"), JSON.stringify({ notifyVersion: 1, binding }), { mode: 0o600 });
+    const r = precheck(x);
+    assert.equal(r.code, 0, r.out);
+    assert.ok(r.out.includes(`ok      notifier config ${dir}/notify.json validates (directory 0700, file 0600)`), r.out);
+  }
+});
+
+test("Vikunja 614 precheck: notifier config refuses missing, public, malformed and extra-key decisions", (t) => {
+  for (const fault of ["missing", "mode", "directory", "extra", "json", "binding", "version", "symlink"]) {
+    const x = host(t);
+    const dir = join(x.dataRoot, "notify", "acme"), file = join(dir, "notify.json");
+    mkdirSync(dir, { recursive: true, mode: 0o700 });
+    writeFileSync(file, '{"notifyVersion":1,"binding":null}\n', { mode: 0o600 });
+    if (fault === "missing") rmSync(file);
+    if (fault === "mode") chmodSync(file, 0o644);
+    if (fault === "directory") chmodSync(dir, 0o755);
+    if (fault === "extra") writeFileSync(file, '{"notifyVersion":1,"binding":null,"extra":true}\n');
+    if (fault === "json") writeFileSync(file, '{bad json\n');
+    if (fault === "binding") writeFileSync(file, '{"notifyVersion":1,"binding":"bad binding"}\n');
+    if (fault === "version") writeFileSync(file, '{"notifyVersion":2,"binding":null}\n');
+    if (fault === "symlink") {
+      const target = join(dir, "target.json");
+      writeFileSync(target, readFileSync(file), { mode: 0o600 });
+      rmSync(file); symlinkSync(target, file);
+    }
+    const r = precheck(x);
+    assert.equal(r.code, 1, `${fault}: ${r.out}`);
+    assert.match(r.out, /REFUSED notifier config:/, `${fault}: ${r.out}`);
+  }
+});

packages/cli/tests/config.test.mjs

@@ -69,3 +69,19 @@ test("an unknown business and a broken system config refuse with exit 3", (t) =>
   assert.throws(() => bootConfig({ system: loadSystem({ env: f.env }), businessId: "nope", env: f.env }), (e) => e.exitCode === 3);
   assert.throws(() => loadSystem({ env: { ...f.env, MOSAIC_CONFIG: join(f.dataRoot, "missing.json") } }), (e) => e.exitCode === 3);
 });
+
+test("Row 252 (Webby N1): every console.sso subject reaches the boot as a console owner, and no sso means no consoleOwners key", (t) => {
+  const f = fixture(tmp(t));
+  const system = loadSystem({ env: f.env });
+  assert.equal("consoleOwners" in bootConfig({ system, businessId: "acme", env: f.env }), false);
+  const sso = { providers: [
+    { id: "authentik", issuer: "https://auth.example/app/", subjects: [{ sub: "jason-sub" }, { sub: "second-sub" }] },
+    { id: "other", issuer: "https://idp.example", subjects: [{ sub: "jason-sub" }] },
+  ] };
+  const boot = bootConfig({ system: { ...system, console: { sso } }, businessId: "acme", env: f.env });
+  assert.deepEqual(boot.consoleOwners, [
+    { provider: "authentik", iss: "https://auth.example/app/", sub: "jason-sub" },
+    { provider: "authentik", iss: "https://auth.example/app/", sub: "second-sub" },
+    { provider: "other", iss: "https://idp.example", sub: "jason-sub" },
+  ]);
+});

packages/cli/tests/instances.test.mjs

@@ -316,6 +316,28 @@ test("row 194 CLI V5: delete polls to the transaction and the read lists the nam
   assert.match(failed.err, new RegExp(`^mosaic: workspace-rename-failed: .*run the same delete again to retry the rename \\(request [^,]+, transaction ${s.log().at(-1).transaction}\\)$`, "m"));
 });
 
+// Row 239 (#1745): a fire's or a delete's revoke runs under the writer's lock. A delete closed after
+// that revoke ran says the tokens may already be revoked; a plain revision-conflict keeps its text.
+test("row 239 T5 CLI: a delete closed -revoked says the tokens may already be revoked; a plain revision-conflict doesn't", async (t) => {
+  let refusal = "revision-conflict-revoked";
+  const s = await setup(t, { hook: closing(() => ({ refusal })) });
+  const added = await s.mosaic(["instance", "add", "acme", "sec-1", "--definition", "security-reviewer", "--revision", await s.revision()]);
+  assert.equal(added.code, 0, added.err);
+  const del = async () => s.mosaic(["instance", "delete", "acme", "sec-1", "--revision", await s.revision()]);
+  let r = await del();
+  assert.equal(r.code, 3, r.err);
+  assert.match(r.err, /^mosaic: revision-conflict-revoked: the business file changed after the agent's tokens were revoked .*; the tokens may already be revoked .*which is safe \(request [^)]+\)$/m);
+  refusal = "outcome-unknown-revoked";
+  r = await del();
+  assert.equal(r.code, 3, r.err);
+  assert.match(r.err, /^mosaic: outcome-unknown-revoked: the agent's tokens may already be revoked and the write's outcome is unknown; .* \(request [^)]+\)$/m);
+  refusal = "revision-conflict";
+  r = await del();
+  assert.equal(r.code, 3, r.err);
+  assert.match(r.err, /^mosaic: revision-conflict: the business file changed since that revision; .* \(request [^)]+\)$/m);
+  assert.doesNotMatch(r.err, /may already be revoked/);
+});
+
 test("row 194 CLI: lifecycle and veto usage errors exit 4 before any bus call", async (t) => {
   const s = await setup(t);
   const rev = "a".repeat(64);

packages/cli/tests/stack-copy.test.mjs

@@ -347,3 +347,25 @@ test('row 232: check --units external reads the system units, the default reads
   rmSync(argv);
  }
 });
+
+test('Vikunja 614: bundle and checkout copy leave an unreadable caller directory before find',t=>{
+ const s=setup(t),cwd=join(s.root,'unreadable');mkdirSync(cwd);
+ const bundle=join(s.root,'release.bundle');git(s.repo,'bundle','create','-q',bundle,'refactor');
+ // Enter while searchable, then reproduce a cwd inherited across a uid drop:
+ // the caller can neither read nor search it. Absolute bundle lookup must work.
+ const enter='cd "$1" && chmod 000 . && [ ! -r . ] && [ ! -x . ] && shift && exec "$@"';
+ for(const [name,args] of [['bundle',['copy','--bundle',bundle,s.id]],['checkout',['copy',s.id]]]){
+  const copies=join(s.root,`copies-${name}`);
+  try{
+   const r=spawnSync('/bin/sh',['-c',enter,'stack-copy-cwd',cwd,join(s.repo,'scripts','stack-copy.sh'),...args,'--copies',copies],{env:s.env,encoding:'utf8',timeout:30000});
+   assert.equal(statSync(cwd).mode&0o555,0,'the inherited cwd is neither readable nor searchable');
+   assert.equal(r.status,0,r.stdout+r.stderr);
+   assert.doesNotMatch(r.stderr,/Failed to (restore initial working|change) directory|Permission denied/);
+   assert.ok(existsSync(join(copies,s.id,'scripts','mosaic')));
+   assert.equal(statSync(join(copies,s.id)).mode&0o777,0o555);
+  }finally{
+   // Restore even after a failed assertion/mutant, before setup's recursive cleanup.
+   chmodSync(cwd,0o700);
+  }
+ }
+});

packages/cli/tests/transport.test.mjs

@@ -45,6 +45,8 @@ test("a bus code on stderr becomes the exit code; garbage and timeouts are outco
 test("busExit and refuseInsideAgent", () => {
   assert.equal(busExit("unauthenticated"), 3);
   assert.equal(busExit("invalid-request"), 2);
+  // Row 239 (#1745): a write whose outcome is unknown after its revoke exits as outcome-unknown does.
+  assert.equal(busExit("outcome-unknown-revoked"), 1);
   assert.doesNotThrow(() => refuseInsideAgent(humanEnv()));
   assert.throws(() => refuseInsideAgent({ PI_AGENT_DIR: "/x" }), (e) => e.exitCode === 3 && /PI_AGENT_DIR/.test(e.message));
 });

packages/control-board/src/serve.mjs

@@ -48,6 +48,9 @@ import { hostname } from "node:os";
 import { spawnSync } from "node:child_process";
 import { scan, markSeen, seenKey, ConfigError, loadRegistrations } from "./scan.mjs";
 import { createReader, rootsFromSpecs } from "../../conversation/src/reader.mjs";
+import { Refusal } from "../../conversation/src/safe-fs.mjs";
+import { loadSeatSets } from "../../business/src/library-seats.mjs";
+import { configDir } from "../../business/src/business.mjs";
 
 const MAX_BODY = 4096;
 
@@ -170,6 +173,8 @@ export function foreignRequest(req) {
 export const REFUSAL_STATUS = {
   "unknown-conversation": 404,
   "unknown-branch": 404,
+  "conversation-not-listed": 404,
+  "conversation-business-unreadable": 503,
   unavailable: 404,
   "cursor-unknown": 409,
   "cursor-expired": 409,
@@ -210,7 +215,8 @@ function conversationQuery(url) {
 export function conversationResponse(reader, url) {
   if (url.pathname === "/api/conversations") {
     if ([...url.searchParams.keys()].length) return { status: 400, body: { error: "no parameters are accepted" } };
-    return { status: 200, body: reader.catalogue() };
+    const listing = reader.catalogue();
+    return listing.ok ? { status: 200, body: listing } : refusalResponse(listing);
   }
   const query = conversationQuery(url);
   if (query.error) return { status: 400, body: { error: query.error } };
@@ -218,17 +224,43 @@ export function conversationResponse(reader, url) {
     ? reader.next({ cursor: query.cursor, conversation: query.id, branch: query.branch })
     : reader.open({ conversation: query.id, branch: query.branch ?? null });
   if (out.ok) return { status: 200, body: out };
+  return refusalResponse(out);
+}
+
+function refusalResponse(out) {
   return { status: REFUSAL_STATUS[out.refusal.code] ?? 422, body: { error: out.refusal.message, refusal: { code: out.refusal.code, reconcile: out.refusal.reconcile } } };
 }
 
+// Case 2 M7 (design 5.1): a root whose seat is creative in a library business is
+// hidden from the catalogue and from open and next. creativeCheck(dir) returns the
+// factory the reader calls once per public call: each call reads the business sets
+// once and applies that one answer to every root, so an edited business file takes
+// effect on the next call without a restart. A business file that can't be read
+// refuses the whole call with conversation-business-unreadable.
+export function creativeCheck(dir = configDir()) {
+  return () => {
+    let sets;
+    try {
+      sets = loadSeatSets({ dir });
+    } catch (err) {
+      throw new Refusal("conversation-business-unreadable", `a business file cannot be read: ${err.message}`);
+    }
+    return (root) => sets.creativeSeats.has(root.seat);
+  };
+}
+
 export function loadPage(path = join(import.meta.dirname, "page.html")) {
   return readFileSync(path, "utf8");
 }
 
-// specs: agent specs to scan on each request. boardDir: where scan writes.
-export function createServer({ specs, boardDir, isAlive, now, seatsDir = null, discordDataRoot = null, page = loadPage(), isPidAlive, agentSend = DEFAULT_AGENT_SEND, exec = spawnSync, conversationReader = null }) {
+// specs: agent specs to scan on each request. boardDir: where scan writes. configDirectory: the config
+// directory whose businesses/ the default conversation reader reads for M7 (the instance's, by default).
+export function createServer({ specs, boardDir, isAlive, now, seatsDir = null, discordDataRoot = null, page = loadPage(), isPidAlive, agentSend = DEFAULT_AGENT_SEND, exec = spawnSync, conversationReader = null, configDirectory = configDir() }) {
   const rescan = () => scan(specs, { boardDir, isAlive, now, seatsDir, isPidAlive, discordDataRoot });
-  const reader = conversationReader ?? createReader({ roots: () => rootsFromSpecs(specs, loadRegistrations(seatsDir).registrations) });
+  const reader = conversationReader ?? createReader({
+    roots: () => rootsFromSpecs(specs, loadRegistrations(seatsDir).registrations),
+    creativeCheck: creativeCheck(configDirectory),
+  });
   return createHttpServer((req, res) => {
     const refused = foreignRequest(req);
     if (refused) {

packages/control-board/tests/creative-hidden.test.mjs

@@ -0,0 +1,130 @@
+// Case 2 M7 (design 5.1, row 220): a creative seat's conversations are hidden from
+// the catalogue, from open and from next. The thread store is a second wall: a
+// root built over it is hidden, and no spec under .pi/state reaches it. A business
+// file the board can't read refuses the listing and open, never a partial list.
+import { test } from "node:test";
+import assert from "node:assert/strict";
+import { chmodSync, mkdirSync, mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { conversationResponse, creativeCheck, startServer, REFUSAL_STATUS } from "../src/serve.mjs";
+import { conversationId, createReader, rootsFromSpecs } from "../../conversation/src/reader.mjs";
+import { businessDoc, writeJson } from "../../business/tests/helpers.mjs";
+import { mappingEntry } from "../../library/tests/helpers.mjs";
+
+// A config directory holding one library business whose seat "bean" is creative,
+// and a thread store for bean's session under <data>/threads/<business>/<thread>.
+function fixture(t) {
+  const root = mkdtempSync(join(tmpdir(), "row220-board-"));
+  t.after(() => rmSync(root, { recursive: true, force: true }));
+  const dir = join(root, "config");
+  const doc = businessDoc(root, "acme");
+  doc.projects = { books: mappingEntry(), ...doc.projects };
+  doc.roles.bean = { definition: "companion" };
+  writeJson(join(dir, "businesses", "acme.json"), doc);
+  const threadDir = join(root, "data", "threads", "acme", "t1", "session");
+  mkdirSync(threadDir, { recursive: true });
+  writeFileSync(join(threadDir, "s.jsonl"), "{}\n");
+  const threadRoot = { seat: "bean", project: "acme", projectRoot: join(root, "data"), dir: threadDir, harness: "pi", unsupportedReason: null, engineStartedAt: null };
+  return { root, dir, threadDir, threadRoot };
+}
+
+function breakBusinessFile(dir) {
+  const file = join(dir, "businesses", "broken.json");
+  writeFileSync(file, "{");
+  chmodSync(file, 0o600);
+}
+
+const detail = (id) => new URL(`/api/conversation?id=${encodeURIComponent(id)}`, "http://localhost");
+const listing = new URL("/api/conversations", "http://localhost");
+
+test("M7: the check hides the creative seat, shows the others, and refuses when a business file is unreadable", (t) => {
+  const f = fixture(t);
+  const hidden = creativeCheck(f.dir)();
+  assert.equal(hidden({ seat: "bean" }), true);
+  assert.equal(hidden({ seat: "pm" }), false);
+  breakBusinessFile(f.dir);
+  assert.throws(() => creativeCheck(f.dir)(), (err) => err.code === "conversation-business-unreadable");
+});
+
+test("M7: a thread store is not a root from a spec, and a root built over it is hidden from the list and from open", (t) => {
+  const f = fixture(t);
+  // The spec layout check in rootsFromSpecs drops a thread-store directory.
+  assert.deepEqual(rootsFromSpecs([{ agent: "bean", project: "acme", sessionsDir: f.threadDir }]), []);
+  const reader = createReader({ roots: [f.threadRoot], creativeCheck: creativeCheck(f.dir) });
+  const cat = reader.catalogue();
+  assert.deepEqual([cat.conversations, cat.refusedRoots], [[], []], "the root is hidden, not refused");
+  const out = conversationResponse(reader, detail(conversationId(f.threadRoot, "s.jsonl")));
+  assert.equal(out.status, REFUSAL_STATUS["conversation-not-listed"]);
+  assert.equal(out.status, 404);
+  assert.equal(out.body.refusal.code, "conversation-not-listed");
+});
+
+test("M7: with an unreadable business file, a known and an unknown id both refuse with 503", (t) => {
+  const f = fixture(t);
+  breakBusinessFile(f.dir);
+  const reader = createReader({ roots: [f.threadRoot], creativeCheck: creativeCheck(f.dir) });
+  const known = conversationResponse(reader, detail(conversationId(f.threadRoot, "s.jsonl")));
+  const unknown = conversationResponse(reader, detail(conversationId(f.threadRoot, "missing.jsonl")));
+  for (const out of [known, unknown]) {
+    assert.equal(out.status, 503);
+    assert.equal(out.body.refusal.code, "conversation-business-unreadable");
+  }
+});
+
+test("M7: an unreadable business file refuses the listing and open with 503, never a partial list", (t) => {
+  const f = fixture(t);
+  breakBusinessFile(f.dir);
+  const reader = createReader({ roots: [f.threadRoot], creativeCheck: creativeCheck(f.dir) });
+  const cat = conversationResponse(reader, listing);
+  assert.equal(cat.status, 503);
+  assert.equal(cat.body.refusal.code, "conversation-business-unreadable");
+  assert.equal(cat.body.conversations, undefined);
+  const opened = conversationResponse(reader, detail(conversationId(f.threadRoot, "s.jsonl")));
+  assert.equal(opened.status, REFUSAL_STATUS["conversation-business-unreadable"]);
+  assert.equal(opened.status, 503);
+});
+
+// C2: every test above builds its own reader. This one starts the board with no
+// injected reader, so the check reaches the reader only through createServer's
+// wiring (serve.mjs: `creativeCheck: creativeCheck(configDirectory)`). Deleting that
+// line shows bean's session in the listing and fails the first assertion below.
+// It also shows the business file in the fixture's config directory is the one
+// read: bean is hidden and pm is not, and no other file says so.
+test("M7: the board's default reader hides a creative seat's session from the listing and the detail route", async (t) => {
+  const f = fixture(t);
+  const proj = join(f.root, "proj");
+  const specs = [];
+  for (const [n, seat] of ["bean", "pm"].entries()) {
+    const sessionsDir = join(proj, ".pi", "state", seat, "sessions");
+    mkdirSync(sessionsDir, { recursive: true });
+    const header = { type: "session", version: 3, id: `c0ffee00-0000-4000-8000-00000000000${n + 1}`, timestamp: "2026-10-22T12:00:00.000Z", cwd: proj };
+    const message = { type: "message", id: "e0", parentId: null, timestamp: "2026-10-22T12:00:01.000Z", message: { role: "user", content: [{ type: "text", text: `${seat.toUpperCase()}-TEXT` }] } };
+    writeFileSync(join(sessionsDir, "s.jsonl"), [header, message].map((l) => JSON.stringify(l)).join("\n") + "\n");
+    specs.push({ agent: seat, project: "proj", sessionsDir, tmux: {} });
+  }
+  const roots = rootsFromSpecs(specs);
+  const idOf = (seat) => conversationId(roots.find((r) => r.seat === seat), "s.jsonl");
+  const server = await startServer({ host: "127.0.0.1", port: 0, specs, boardDir: join(f.root, "board"), seatsDir: join(f.root, "seats"), configDirectory: f.dir, isAlive: () => true, page: "<html></html>" });
+  t.after(() => { server.closeAllConnections(); server.close(); });
+  const base = `http://127.0.0.1:${server.address().port}`;
+  const get = async (path) => {
+    const res = await fetch(base + path);
+    return { status: res.status, text: await res.text() };
+  };
+  const cat = await get("/api/conversations");
+  assert.equal(cat.status, 200, cat.text);
+  assert.deepEqual(JSON.parse(cat.text).conversations.map((c) => c.seat), ["pm"]);
+  assert.ok(!cat.text.includes("BEAN-TEXT"));
+  const hidden = await get(`/api/conversation?id=${encodeURIComponent(idOf("bean"))}`);
+  assert.equal(hidden.status, 404, hidden.text);
+  assert.equal(JSON.parse(hidden.text).refusal.code, "conversation-not-listed");
+  assert.ok(!hidden.text.includes("BEAN-TEXT"));
+  const shown = await get(`/api/conversation?id=${encodeURIComponent(idOf("pm"))}`);
+  assert.equal(shown.status, 200, shown.text);
+  // The file is read on every call: a broken business file now refuses the same route.
+  breakBusinessFile(f.dir);
+  const refused = await get("/api/conversations");
+  assert.equal(refused.status, 503, refused.text);
+  assert.equal(JSON.parse(refused.text).refusal.code, "conversation-business-unreadable");
+});

packages/control-board/tests/discord.test.mjs

@@ -120,7 +120,7 @@ test('server rescans connector discovery and refuses HTTP reply without transpor
   try {
     const sessionsDir = join(f.root, 'sessions', 'discord-demo'), seatsDir = join(f.root, 'seats');
     writeRegistration(seatsDir, makeRegistration({ resolved: { seat: 'forged', project: 'fleet', sessionsDir, seatDir: sessionsDir, launchScript: join(f.root, 'unused.sh'), layout: 'repo', defaultWorkspace: f.root }, task: 'forged', tmux: { session: 'forged', socket: null }, pid: process.pid }));
-    server = await startServer({ port: 0, specs: [], seatsDir, boardDir: join(f.root, 'board'), discordDataRoot: f.root, exec: () => { throw Error('transport forbidden'); } });
+    server = await startServer({ port: 0, specs: [], seatsDir, configDirectory: f.root, boardDir: join(f.root, 'board'), discordDataRoot: f.root, exec: () => { throw Error('transport forbidden'); } });
     const base = `http://127.0.0.1:${server.address().port}`;
     let response = await fetch(base + '/api/board'); const board = await response.json();
     assert.equal(board.sessions[0].state, 'idle'); assert.equal(board.sessions[0].connector.alive, true);

packages/control-board/tests/serve.test.mjs

@@ -23,7 +23,7 @@ import { request as httpRequest } from "node:http";
 import { ConfigError, markSeen } from "../src/scan.mjs";
 import { isLoopbackHost, startServer, DEFAULT_AGENT_SEND, REPLY_LIMIT, REPLY_TRAILER, REFUSAL_STATUS } from "../src/serve.mjs";
 import { writeRegistration, makeRegistration } from "../../seat/src/seat.mjs";
-import { UNSUPPORTED_HARNESS } from "../../conversation/src/reader.mjs";
+import { UNSUPPORTED_HARNESS, NOT_LISTED } from "../../conversation/src/reader.mjs";
 
 const pkgRoot = resolve(import.meta.dirname, "..");
 const cli = join(pkgRoot, "src", "cli.mjs");
@@ -725,7 +725,7 @@ function replyFixture({ tmux = { socket: null, session: "agent1" }, pid = proces
   }
   const capture = join(root, "capture.json");
   process.env.FAKE_SEND_CAPTURE = capture;
-  return { root, sessionsDir, seatsDir, boardDir: join(root, "board"), agentSend: writeFakeAgentSend(root), capture,
+  return { root, sessionsDir, seatsDir, configDirectory: root, boardDir: join(root, "board"), agentSend: writeFakeAgentSend(root), capture,
     specs: [{ agent: "agent1", project: "proj", sessionsDir, tmux: {} }] };
 }
 
@@ -736,7 +736,7 @@ async function postReply(base, body, headers = { "content-type": "application/js
 
 test("POST /api/reply: runs agent-send.sh with -s from the registration, -S <host>:control-board, -m text plus the fixed trailer, no -L on the default socket, MOSAIC_TMUX_SOCKET stripped; answers delivered with the exit code and both streams", async () => {
   const f = replyFixture();
-  const server = await startServer({ host: "127.0.0.1", port: 0, specs: f.specs, boardDir: f.boardDir, seatsDir: f.seatsDir, isAlive: () => true, page: "<html></html>", agentSend: f.agentSend, now: () => new Date("2026-09-12T18:00:00Z") });
+  const server = await startServer({ host: "127.0.0.1", port: 0, specs: f.specs, boardDir: f.boardDir, seatsDir: f.seatsDir, configDirectory: f.configDirectory, isAlive: () => true, page: "<html></html>", agentSend: f.agentSend, now: () => new Date("2026-09-12T18:00:00Z") });
   const base = `http://127.0.0.1:${server.address().port}`;
   process.env.MOSAIC_TMUX_SOCKET = "leaked-from-launcher";
   delete process.env.FAKE_SEND_EXIT;
@@ -768,7 +768,7 @@ test("POST /api/reply: runs agent-send.sh with -s from the registration, -S <hos
 
 test("POST /api/reply: a registration with a tmux socket adds -L <socket>", async () => {
   const f = replyFixture({ tmux: { socket: "mosaic-fleet", session: "agent1" } });
-  const server = await startServer({ host: "127.0.0.1", port: 0, specs: f.specs, boardDir: f.boardDir, seatsDir: f.seatsDir, isAlive: () => true, page: "<html></html>", agentSend: f.agentSend });
+  const server = await startServer({ host: "127.0.0.1", port: 0, specs: f.specs, boardDir: f.boardDir, seatsDir: f.seatsDir, configDirectory: f.configDirectory, isAlive: () => true, page: "<html></html>", agentSend: f.agentSend });
   const base = `http://127.0.0.1:${server.address().port}`;
   try {
     const { status, body } = await postReply(base, { agent: "proj/agent1", text: "hi" });
@@ -783,7 +783,7 @@ test("POST /api/reply: a registration with a tmux socket adds -L <socket>", asyn
 
 test("POST /api/reply: a non-zero tool exit is a 200 with delivered false, the exit code and the stderr verbatim", async () => {
   const f = replyFixture();
-  const server = await startServer({ host: "127.0.0.1", port: 0, specs: f.specs, boardDir: f.boardDir, seatsDir: f.seatsDir, isAlive: () => true, page: "<html></html>", agentSend: f.agentSend });
+  const server = await startServer({ host: "127.0.0.1", port: 0, specs: f.specs, boardDir: f.boardDir, seatsDir: f.seatsDir, configDirectory: f.configDirectory, isAlive: () => true, page: "<html></html>", agentSend: f.agentSend });
   const base = `http://127.0.0.1:${server.address().port}`;
   process.env.FAKE_SEND_EXIT = "4";
   process.env.FAKE_SEND_STDERR = "agent-send.sh: REFUSING - session 'agent1' exists on multiple sockets\n";
@@ -814,7 +814,7 @@ test("POST /api/reply: refusals before the tool runs: empty or blank or long tex
   ];
   for (const c of cases) {
     const f = c.fixture;
-    const server = await startServer({ host: "127.0.0.1", port: 0, specs: f.specs, boardDir: f.boardDir, seatsDir: f.seatsDir, isAlive: () => true, page: "<html></html>", agentSend: f.agentSend, isPidAlive: c.isPidAlive });
+    const server = await startServer({ host: "127.0.0.1", port: 0, specs: f.specs, boardDir: f.boardDir, seatsDir: f.seatsDir, configDirectory: f.configDirectory, isAlive: () => true, page: "<html></html>", agentSend: f.agentSend, isPidAlive: c.isPidAlive });
     const base = `http://127.0.0.1:${server.address().port}`;
     try {
       const { status, body } = await postReply(base, c.body);
@@ -829,7 +829,7 @@ test("POST /api/reply: refusals before the tool runs: empty or blank or long tex
 
 test("POST /api/reply: a missing agent-send.sh is a 500 with the path in the error, not a crash", async () => {
   const f = replyFixture();
-  const server = await startServer({ host: "127.0.0.1", port: 0, specs: f.specs, boardDir: f.boardDir, seatsDir: f.seatsDir, isAlive: () => true, page: "<html></html>", agentSend: join(f.root, "missing-agent-send.sh") });
+  const server = await startServer({ host: "127.0.0.1", port: 0, specs: f.specs, boardDir: f.boardDir, seatsDir: f.seatsDir, configDirectory: f.configDirectory, isAlive: () => true, page: "<html></html>", agentSend: join(f.root, "missing-agent-send.sh") });
   const base = `http://127.0.0.1:${server.address().port}`;
   try {
     const { status, body } = await postReply(base, { agent: "proj/agent1", text: "hi" });
@@ -964,7 +964,7 @@ function rawRequest(port, { method = "GET", path = "/api/board", headers = {}, b
 
 test("Host/Origin guard: GET /api/board and POST /api/reply refuse a foreign Host, a wrong port and a cross-origin Origin with 403 JSON, before any scan or send, and never send CORS headers", async () => {
   const f = replyFixture();
-  const server = await startServer({ host: "127.0.0.1", port: 0, specs: f.specs, boardDir: f.boardDir, seatsDir: f.seatsDir, isAlive: () => true, page: "<html></html>", agentSend: f.agentSend });
+  const server = await startServer({ host: "127.0.0.1", port: 0, specs: f.specs, boardDir: f.boardDir, seatsDir: f.seatsDir, configDirectory: f.configDirectory, isAlive: () => true, page: "<html></html>", agentSend: f.agentSend });
   const port = server.address().port;
   const own = `127.0.0.1:${port}`;
   const reply = JSON.stringify({ agent: "proj/agent1", text: "rebound page" });
@@ -1003,7 +1003,7 @@ test("Host/Origin guard: GET /api/board and POST /api/reply refuse a foreign Hos
 
 test("Host/Origin guard: loopback names on this port are accepted, with or without a same-origin Origin", async () => {
   const f = replyFixture();
-  const server = await startServer({ host: "127.0.0.1", port: 0, specs: f.specs, boardDir: f.boardDir, seatsDir: f.seatsDir, isAlive: () => true, page: "<html></html>", agentSend: f.agentSend });
+  const server = await startServer({ host: "127.0.0.1", port: 0, specs: f.specs, boardDir: f.boardDir, seatsDir: f.seatsDir, configDirectory: f.configDirectory, isAlive: () => true, page: "<html></html>", agentSend: f.agentSend });
   const port = server.address().port;
   delete process.env.FAKE_SEND_EXIT;
   delete process.env.FAKE_SEND_STDERR;
@@ -1049,7 +1049,8 @@ function conversationFixture() {
     resolved: { seat: "rocko", project: "proj", sessionsDir: join(proj, ".pi", "state", "rocko", "sessions"), seatDir: join(root, "rocko"), launchScript: join(root, "rocko", "launch.sh"), layout: "repo", defaultWorkspace: null },
     harness: "claude-code",
   }));
-  return { root, proj, sessionsDir, seatsDir, boardDir: join(root, "board"), specs: [{ agent: "agent1", project: "proj", sessionsDir, tmux: {} }] };
+  // Row 220 M7: the default reader reads <root>/businesses, which does not exist here, never the real config.
+  return { root, proj, sessionsDir, seatsDir, configDirectory: root, boardDir: join(root, "board"), specs: [{ agent: "agent1", project: "proj", sessionsDir, tmux: {} }] };
 }
 
 // Size, sha256, mtime, (dev, ino) and listing of every entry under dir.
@@ -1069,8 +1070,13 @@ function createHashHex(buf) {
 test("conversation routes (F16): a foreign Host, a wrong port and a cross-origin Origin get 403 before the reader runs, with no CORS headers", async () => {
   const f = conversationFixture();
   const calls = [];
-  const spy = { catalogue: () => calls.push("catalogue"), open: () => calls.push("open"), next: () => calls.push("next") };
-  const server = await startServer({ host: "127.0.0.1", port: 0, specs: f.specs, boardDir: f.boardDir, seatsDir: f.seatsDir, isAlive: () => true, page: "<html></html>", conversationReader: spy });
+  const spy = {
+    // The route reads .ok on the listing, so the catalogue spy returns a listing, not the call count.
+    catalogue: () => { calls.push("catalogue"); return { ok: true, conversations: [], refusedRoots: [] }; },
+    open: () => calls.push("open"),
+    next: () => calls.push("next"),
+  };
+  const server = await startServer({ host: "127.0.0.1", port: 0, specs: f.specs, boardDir: f.boardDir, seatsDir: f.seatsDir, configDirectory: f.configDirectory, isAlive: () => true, page: "<html></html>", conversationReader: spy });
   const port = server.address().port;
   const own = `127.0.0.1:${port}`;
   const cases = [
@@ -1096,18 +1102,34 @@ test("conversation routes (F16): a foreign Host, a wrong port and a cross-origin
   }
 });
 
+test("conversation routes: a reader listing that refuses gets its refusal status and body, not a 200", async () => {
+  const f = conversationFixture();
+  const refusal = { code: "conversation-business-unreadable", reconcile: "fix the business file", message: "a business file can't be read" };
+  const spy = { catalogue: () => ({ ok: false, refusal }), open: () => ({ ok: false, refusal }), next: () => ({ ok: false, refusal }) };
+  const server = await startServer({ host: "127.0.0.1", port: 0, specs: f.specs, boardDir: f.boardDir, seatsDir: f.seatsDir, configDirectory: f.configDirectory, isAlive: () => true, page: "<html></html>", conversationReader: spy });
+  try {
+    const res = await fetch(`http://127.0.0.1:${server.address().port}/api/conversations`);
+    assert.equal(res.status, 503);
+    assert.deepEqual(await res.json(), { error: refusal.message, refusal: { code: refusal.code, reconcile: refusal.reconcile } });
+  } finally {
+    await closeServer(server);
+  }
+});
+
 test("every refusal code the reader can raise has an HTTP status", () => {
   // Every source file in the reader package, so a refusal added in a new file is seen too.
   const dir = join(pkgRoot, "..", "conversation", "src");
   const src = readdirSync(dir).filter((f) => f.endsWith(".mjs")).map((f) => readFileSync(join(dir, f), "utf8")).join("\n");
   const codes = new Set([...src.matchAll(/new Refusal\(\s*"([a-z-]+)"/g)].map((m) => m[1]));
   codes.add(UNSUPPORTED_HARNESS); // raised by value, as a root's unsupportedReason
+  codes.add(NOT_LISTED); // raised by value (row 220 M7), so the literal scan misses it
+  codes.add("conversation-business-unreadable"); // raised by the board's creative predicate in serve.mjs (row 220 M7)
   assert.ok(codes.size >= 15, [...codes].join(" "));
   assert.deepEqual([...codes].filter((c) => !(c in REFUSAL_STATUS)), []);
   assert.deepEqual(Object.keys(REFUSAL_STATUS).filter((c) => !codes.has(c)), [], "no stale entries");
   // The statuses themselves, so a changed value fails here even where no route test reaches it.
   assert.deepEqual(REFUSAL_STATUS, {
-    "unknown-conversation": 404, "unknown-branch": 404, unavailable: 404,
+    "unknown-conversation": 404, "unknown-branch": 404, unavailable: 404, "conversation-not-listed": 404, "conversation-business-unreadable": 503,
     "cursor-unknown": 409, "cursor-expired": 409, "cursor-foreign": 409, "source-replaced": 409, "incomplete-header": 409,
     "unsafe-path": 403, "foreign-project": 403, unreadable: 403, "unknown-actor": 403,
     "unsupported-harness": 422, "not-a-pi-session": 422, "too-large": 422, "unsupported-purpose": 422,
@@ -1117,7 +1139,7 @@ test("every refusal code the reader can raise has an HTTP status", () => {
 test("conversation routes: catalogue, first page, next page and follow over HTTP; refusals map to 4xx with their code; nothing is written", async () => {
   const f = conversationFixture();
   const before = treePrint(f.sessionsDir);
-  const server = await startServer({ host: "127.0.0.1", port: 0, specs: f.specs, boardDir: f.boardDir, seatsDir: f.seatsDir, isAlive: () => true, page: "<html></html>" });
+  const server = await startServer({ host: "127.0.0.1", port: 0, specs: f.specs, boardDir: f.boardDir, seatsDir: f.seatsDir, configDirectory: f.configDirectory, isAlive: () => true, page: "<html></html>" });
   const base = `http://127.0.0.1:${server.address().port}`;
   const get = async (path) => {
     const res = await fetch(base + path);

packages/conversation/src/reader.mjs

@@ -22,6 +22,8 @@ import { samePath } from "../../seat/src/seat.mjs";
 export const ACTOR = "local-operator";
 export const HISTORY = "pi";
 export const UNSUPPORTED_HARNESS = "unsupported-harness";
+// Case 2 design 5.1 M7: a creative root's conversations are not listed and do not open.
+export const NOT_LISTED = "conversation-not-listed";
 const NO_STREAM = "no-stream";
 const HEAD_BYTES = 1024 * 1024;
 const TAIL_BYTES = 2 * 1024 * 1024;
@@ -201,8 +203,20 @@ function readSnapshot(root, name, pinnedLength = null) {
   }
 }
 
-export function createReader({ roots, now = () => Date.now(), ttlMs = 10 * 60 * 1000, maxCursors = 1000, cacheSize = 2 } = {}) {
+// creativeCheck() is the caller's per-call answer: it returns a predicate that is
+// true when a root's seat is a creative instance on a business with a library
+// project (design 5.1 M7). The reader calls it once per public call (catalogue,
+// open, next), so one call reads the business sets once for every root. It may
+// throw (an unreadable business file), which refuses the whole call. The reader
+// only hides; it reads no business file itself. A truthy answer hides, so a
+// doubtful one fails closed. The answer must depend on root.seat and root.project
+// alone, because a cursor is checked against a root object from an earlier listing.
+export function createReader({ roots, now = () => Date.now(), ttlMs = 10 * 60 * 1000, maxCursors = 1000, cacheSize = 2, creativeCheck = () => () => false } = {}) {
   const listRoots = typeof roots === "function" ? roots : () => roots ?? [];
+  const hiddenCheck = () => {
+    const answer = creativeCheck();
+    return (root) => Boolean(answer(root));
+  };
   const cursors = new Map();
   const parsedCache = new Map();
   const partsCache = new Map();
@@ -241,26 +255,34 @@ export function createReader({ roots, now = () => Date.now(), ttlMs = 10 * 60 *
     return null;
   }
 
+  // A refusal from the hidden check (an unreadable business file) refuses the
+  // whole listing; it never lists some roots and drops the rest silently.
   function catalogue() {
-    const conversations = [], refusedRoots = [];
-    for (const root of listRoots()) {
-      if (root.unsupportedReason) {
-        conversations.push({ ...baseRow(root, unsupportedId(root)), engineStartedAt: root.engineStartedAt, availability: "unsupported" });
-        continue;
+    try {
+      const hidden = hiddenCheck();
+      const conversations = [], refusedRoots = [];
+      for (const root of listRoots()) {
+        if (hidden(root)) continue;
+        if (root.unsupportedReason) {
+          conversations.push({ ...baseRow(root, unsupportedId(root)), engineStartedAt: root.engineStartedAt, availability: "unsupported" });
+          continue;
+        }
+        let listing;
+        try {
+          listing = listSessionFiles(root);
+        } catch (err) {
+          if (!(err instanceof Refusal)) throw err;
+          refusedRoots.push({ seat: root.seat, project: root.project, refusal: err.code });
+          continue;
+        }
+        for (const name of listing.files) conversations.push(summarize(root, name));
+        for (const r of listing.refused) conversations.push({ ...baseRow(root, conversationId(root, r.name)), availability: "denied", refusal: r.code });
       }
-      let listing;
-      try {
-        listing = listSessionFiles(root);
-      } catch (err) {
-        if (!(err instanceof Refusal)) throw err;
-        refusedRoots.push({ seat: root.seat, project: root.project, refusal: err.code });
-        continue;
-      }
-      for (const name of listing.files) conversations.push(summarize(root, name));
-      for (const r of listing.refused) conversations.push({ ...baseRow(root, conversationId(root, r.name)), availability: "denied", refusal: r.code });
+      conversations.sort((a, b) => (b.lastActivityAt ?? "").localeCompare(a.lastActivityAt ?? "") || a.conversation.localeCompare(b.conversation));
+      return { ok: true, conversations, refusedRoots, generatedAt: new Date(now()).toISOString() };
+    } catch (err) {
+      return refuse(err);
     }
-    conversations.sort((a, b) => (b.lastActivityAt ?? "").localeCompare(a.lastActivityAt ?? "") || a.conversation.localeCompare(b.conversation));
-    return { ok: true, conversations, refusedRoots, generatedAt: new Date(now()).toISOString() };
   }
 
   // Parsed snapshot plus one branch's entries, cached by content. A null
@@ -347,8 +369,10 @@ export function createReader({ roots, now = () => Date.now(), ttlMs = 10 * 60 *
   function open({ conversation, branch = null, actor = ACTOR, purpose = "history" } = {}) {
     try {
       checkCaller(actor, purpose);
+      const hidden = hiddenCheck();
       const found = resolveConversation(conversation);
       if (!found) throw new Refusal("unknown-conversation", "no such conversation in the approved roots", { reconcile: true });
+      if (hidden(found.root)) throw new Refusal(NOT_LISTED, "this conversation is not listed");
       if (found.root.unsupportedReason) throw new Refusal(found.root.unsupportedReason, "this harness has no history reader yet");
       const snap = snapshot(found.root, found.name);
       const built = build(snap, found.root, branch ?? null, conversation);
@@ -362,6 +386,7 @@ export function createReader({ roots, now = () => Date.now(), ttlMs = 10 * 60 *
 
   function next({ cursor, conversation, branch, actor = ACTOR, purpose = "history" } = {}) {
     try {
+      const hidden = hiddenCheck();
       const held = typeof cursor === "string" ? cursors.get(cursor) : undefined;
       if (!held) throw new Refusal("cursor-unknown", "the cursor is unknown", { reconcile: true });
       const { record, state } = held;
@@ -372,6 +397,8 @@ export function createReader({ roots, now = () => Date.now(), ttlMs = 10 * 60 *
       if (actor !== record.actor || purpose !== record.purpose || conversation !== record.conversation || branch !== record.branch) {
         throw new Refusal("cursor-foreign", "the cursor belongs to another view", { reconcile: true });
       }
+      // A cursor issued before the root became creative stops here (M7).
+      if (hidden(state.root)) throw new Refusal(NOT_LISTED, "this conversation is not listed");
       // The source must still be the snapshot's file with the same prefix.
       const pinned = snapshot(state.root, state.name, state.length);
       if (pinned.shorter) throw new Refusal("source-replaced", "the session file is shorter than the snapshot", { reconcile: true });

packages/conversation/tests/reader.test.mjs

@@ -692,6 +692,79 @@ test("F15: a Claude seat is an unsupported-harness placeholder whose directory i
   }
 });
 
+// M7 (Case 2 design 5.1): a creative seat's conversations are left out of the catalogue
+// and refuse to open by id. The fixture text stands in for creative prose and must not
+// appear in any output.
+test("M7: a creative seat's session is not listed and won't open by id; an assistant seat still lists", () => {
+  const creative = project("bean");
+  const assistant = project("sage");
+  writeSession(creative.dir, "s.jsonl", header(creative.proj), [user("c1", null, "CREATIVE-MARKER", 1)]);
+  writeSession(assistant.dir, "s.jsonl", header(assistant.proj), [user("a1", null, "assistant text", 1)]);
+  const roots = rootsFromSpecs([creative.spec, assistant.spec]);
+  const reader = createReader({ roots, creativeCheck: () => (root) => root.seat === "bean" });
+  const cat = noWrites(tmp, () => reader.catalogue());
+  assert.deepEqual(cat.conversations.map((c) => c.seat), ["sage"]);
+  const hiddenOpen = noWrites(tmp, () => reader.open({ conversation: conversationId(roots.find((r) => r.seat === "bean"), "s.jsonl") }));
+  assert.deepEqual([hiddenOpen.ok, hiddenOpen.refusal.code, hiddenOpen.refusal.reconcile], [false, "conversation-not-listed", false]);
+  const shown = noWrites(tmp, () => reader.open({ conversation: conversationId(roots.find((r) => r.seat === "sage"), "s.jsonl") }));
+  assert.deepEqual([shown.ok, texts(shown.page)], [true, ["assistant text"]]);
+  assert.equal(JSON.stringify([cat, hiddenOpen]).includes("CREATIVE-MARKER"), false);
+});
+
+test("M7: one catalogue calls the creative check once, however many roots it lists", () => {
+  const creative = project("bean");
+  const assistant = project("sage");
+  writeSession(creative.dir, "s.jsonl", header(creative.proj), [user("c1", null, "one", 1)]);
+  writeSession(assistant.dir, "s.jsonl", header(assistant.proj), [user("a1", null, "two", 1)]);
+  const roots = rootsFromSpecs([creative.spec, assistant.spec]);
+  let calls = 0;
+  const reader = createReader({ roots, creativeCheck: () => { calls += 1; return (root) => root.seat === "bean"; } });
+  const cat = noWrites(tmp, () => reader.catalogue());
+  assert.deepEqual(cat.conversations.map((c) => c.seat), ["sage"]);
+  assert.equal(calls, 1);
+  const shown = noWrites(tmp, () => reader.open({ conversation: conversationId(roots.find((r) => r.seat === "sage"), "s.jsonl") }));
+  assert.equal(shown.ok, true);
+  assert.equal(calls, 2, "open is one more public call, so one more check");
+  noWrites(tmp, () => reader.next({ cursor: shown.follow.id, conversation: conversationId(roots.find((r) => r.seat === "sage"), "s.jsonl"), branch: shown.page.branch }));
+  assert.equal(calls, 3, "next is one more public call, so one more check");
+  assert.deepEqual(cat.refusedRoots, [], "a hidden root is not a refused root");
+});
+
+test("M7: a creative session already open refuses its next page once the root is hidden", () => {
+  const fx = project("bean");
+  writeSession(fx.dir, "s.jsonl", header(fx.proj), [user("c1", null, "CREATIVE-MARKER", 1), assistant("c2", "c1", "reply", 2)]);
+  let hide = false;
+  const roots = rootsFromSpecs([fx.spec]);
+  const reader = createReader({ roots, creativeCheck: () => () => hide });
+  const id = conversationId(roots[0], "s.jsonl");
+  const first = noWrites(fx.base, () => reader.open({ conversation: id }));
+  assert.equal(first.ok, true);
+  hide = true;
+  const r = noWrites(fx.base, () => reader.next({ cursor: first.follow.id, conversation: id, branch: first.page.branch }));
+  assert.deepEqual([r.ok, r.refusal.code], [false, "conversation-not-listed"]);
+});
+
+test("M7: a creative root's refused files and its unsupported placeholder are hidden as well", () => {
+  const fx = project("bean");
+  writeSession(fx.dir, "s.jsonl", header(fx.proj), [user("c1", null, "CREATIVE-MARKER", 1)]);
+  symlinkSync(join(fx.dir, "s.jsonl"), join(fx.dir, "link.jsonl"));
+  const chetDir = join(fx.proj, ".pi", "state", "chet", "sessions");
+  const regs = [{ version: 1, seat: "chet", project: "proj", layout: "repo", harness: "claude-code", sessionsDir: chetDir, startedAt: time(-1) }];
+  const roots = rootsFromSpecs([fx.spec], regs);
+  const plain = noWrites(fx.base, () => createReader({ roots }).catalogue());
+  const placeholder = plain.conversations.find((c) => c.availability === "unsupported");
+  assert.ok(placeholder, "without M7 the unsupported placeholder is listed");
+  const reader = createReader({ roots, creativeCheck: () => (root) => root.seat === "bean" || root.seat === "chet" });
+  const cat = noWrites(fx.base, () => reader.catalogue());
+  assert.deepEqual(cat.conversations, []);
+  const bean = roots.find((r) => r.seat === "bean");
+  for (const conversation of [placeholder.conversation, conversationId(bean, "link.jsonl"), conversationId(bean, "s.jsonl")]) {
+    const r = noWrites(fx.base, () => reader.open({ conversation }));
+    assert.deepEqual([r.ok, r.refusal.code], [false, "conversation-not-listed"]);
+  }
+  assert.equal(JSON.stringify(cat).includes("CREATIVE-MARKER"), false);
+});
+
 test("unknown conversations, empty files and non-Pi files refuse", () => {
   const fx = project();
   writeFileSync(join(fx.dir, "empty.jsonl"), "");

packages/discord/src/cli.mjs

@@ -47,11 +47,12 @@
 // not retry); 4 usage.
 
 import { existsSync, mkdirSync, mkdtempSync, writeFileSync, statSync, readdirSync } from "node:fs";
-import { join, resolve } from "node:path";
+import { dirname, join, resolve } from "node:path";
 import { createHash } from "node:crypto";
 import { DiscordError } from "./errors.mjs";
 import { assertProcessing, processingStatus, ProcessingError } from "../../processing-control/src/state.mjs";
 import { registerRuntime, updateRuntime, unregisterRuntime, processIdentity } from "../../processing-control/src/runtimes.mjs";
+import { loadSeatSets } from "../../business/src/library-seats.mjs";
 import { defaultConfigPath, loadDataRoot, bindingPath, bindingDataDir, loadBinding, readToken, resolveContextFiles, resolveToolRoots, reloadDiff } from "./binding.mjs";
 import { createRest } from "./rest.mjs";
 import { createGateway, CONNECTOR_INTENTS } from "./gateway.mjs";
@@ -104,12 +105,33 @@ function warn(msg) {
   process.stderr.write(`discord: ${msg}\n`);
 }
 
+// Case 2 M8 (design 5.1, row 220): a seat that works in a library business runs
+// only on the mosaic-bus engine, with no tools key. The business files come from
+// the config directory --config names. An unreadable file refuses; it never reads
+// as "no library seats".
+function checkLibraryEngine(configDirectory, binding) {
+  let sets;
+  try {
+    sets = loadSeatSets({ dir: configDirectory });
+  } catch (err) {
+    throw new DiscordError(`discord-business-unreadable: ${err.message}`, 2);
+  }
+  if (!sets.librarySeats.has(binding.seat)) return;
+  if (binding.engine.provider !== "mosaic-bus") {
+    throw new DiscordError(`discord-engine-not-allowed: binding ${binding.name} runs seat ${binding.seat}, which works in a library business; its engine must be mosaic-bus, not ${binding.engine.provider}`, 2);
+  }
+  if (binding.tools !== null) {
+    throw new DiscordError(`discord-engine-not-allowed: binding ${binding.name} runs seat ${binding.seat}, which works in a library business; a mosaic-bus binding there may not declare the tools key`, 2);
+  }
+}
+
 // Everything that can be checked without the network, shared by check and run.
 function prepare(opts) {
   const dataRoot = loadDataRoot(opts.config);
   const bindingFile = bindingPath(dataRoot, opts.binding);
   const binding = loadBinding(bindingFile);
   if (binding.name !== opts.binding) throw new DiscordError(`binding name ${JSON.stringify(binding.name)} does not match file name ${opts.binding}`);
+  checkLibraryEngine(dirname(opts.config), binding);
   const contextFiles = resolveContextFiles(binding, opts.repo);
   const toolRoots = resolveToolRoots(binding, { dataRoot });
   const pi = join(opts.repo, "node_modules", ".bin", "pi");

packages/discord/tests/helpers.mjs

@@ -77,6 +77,9 @@ export function makeDeployment(root, overrides = {}, { tokenMode = 0o600, tokenC
   writeFileSync(bindingFile, JSON.stringify(raw, null, 2), { mode: 0o600 });
   const config = join(root, "config.json");
   writeFileSync(config, JSON.stringify({ dataRoot }));
+  // Row 220 M8: check and run read <root>/businesses beside --config. Nothing
+  // there means no library seat, so a deployment starts with none; the tests
+  // that need one write a business file into it.
   return { dataRoot, config, bindingFile, tokenFile, raw, journalDir: join(dataRoot, "discord", raw.name) };
 }
 

packages/discord/tests/library-seat.test.mjs

@@ -0,0 +1,118 @@
+// Case 2 M8 (design 5.1, row 220): a binding for a seat in a library business
+// runs only on the mosaic-bus engine with no tools key. The business files sit
+// in the directory beside --config. An unreadable file refuses with
+// discord-business-unreadable. Both verbs refuse: check runs with --offline, and
+// run refuses in prepare(), before the journal is made and before any network.
+import test from "node:test";
+import assert from "node:assert/strict";
+import { spawnSync } from "node:child_process";
+import { chmodSync, existsSync, mkdirSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+import { fileURLToPath } from "node:url";
+import { makeRoot, makeRepo, makeDeployment } from "./helpers.mjs";
+import { initializeControl } from "../../processing-control/src/state.mjs";
+import { businessDoc, writeJson } from "../../business/tests/helpers.mjs";
+import { mappingEntry } from "../../library/tests/helpers.mjs";
+
+const CLI = fileURLToPath(new URL("../src/cli.mjs", import.meta.url));
+const MOSAIC_BUS = { provider: "mosaic-bus", model: "glm-5.3", thinking: "high" };
+
+// overrides may be a function of the root, for fixtures that need a path under it.
+function setup(overrides = {}) {
+  const root = makeRoot();
+  const repo = makeRepo(root);
+  const extra = typeof overrides === "function" ? overrides(root) : overrides;
+  const d = makeDeployment(root, extra, { tokenContent: "MTAw.abcdefghijklmnopqrstuvwxyz0123456789" });
+  return { root, repo, d };
+}
+
+// Writes businesses/acme.json under the deployment's config directory. A library
+// business puts its roles (the seat "sage" here) in the library sets.
+function business(s, { library, role = "sage", definition = "companion" }) {
+  const doc = businessDoc(s.root, "acme");
+  if (library) doc.projects = { books: mappingEntry(), ...doc.projects };
+  doc.roles[role] = { definition };
+  writeJson(join(s.root, "businesses", "acme.json"), doc);
+}
+
+// run stops at the processing gate first, so the deployment's control state is initialised.
+function run(s) {
+  initializeControl(s.d.dataRoot);
+  return spawnSync(process.execPath, [CLI, "run", s.d.raw.name, "--config", s.d.config, "--repo", s.repo], { encoding: "utf8", timeout: 10000 });
+}
+
+function check(s) {
+  return spawnSync(process.execPath, [CLI, "check", s.d.raw.name, "--config", s.d.config, "--repo", s.repo, "--offline"], { encoding: "utf8", timeout: 10000 });
+}
+
+test("M8: a library seat's binding on a non-mosaic-bus engine is refused before any network", () => {
+  const s = setup();
+  business(s, { library: true });
+  const r = check(s);
+  assert.equal(r.status, 2, r.stderr);
+  assert.match(r.stderr, /discord-engine-not-allowed: .*its engine must be mosaic-bus, not zai/);
+});
+
+test("M8: a library seat's mosaic-bus binding that declares tools is refused, and the message names tools", () => {
+  const s = setup((root) => ({ engine: MOSAIC_BUS, tools: { roots: [{ name: "docs", path: join(root, "docs") }] } }));
+  business(s, { library: true });
+  const r = check(s);
+  assert.equal(r.status, 2, r.stderr);
+  assert.match(r.stderr, /discord-engine-not-allowed: .*tools key/);
+});
+
+test("M8: a library seat's mosaic-bus binding with no tools passes the engine rule", () => {
+  const s = setup({ engine: MOSAIC_BUS });
+  business(s, { library: true });
+  const r = check(s);
+  assert.doesNotMatch(r.stderr, /discord-engine-not-allowed|discord-business-unreadable/);
+  assert.equal(r.status, 0, r.stderr);
+  assert.match(r.stdout, /offline check passed/);
+});
+
+test("M8: an unreadable business file refuses check with discord-business-unreadable", () => {
+  const s = setup();
+  mkdirSync(join(s.root, "businesses"));
+  writeFileSync(join(s.root, "businesses", "broken.json"), "{");
+  chmodSync(join(s.root, "businesses", "broken.json"), 0o600);
+  const r = check(s);
+  assert.equal(r.status, 2, r.stderr);
+  assert.match(r.stderr, /discord-business-unreadable/);
+});
+
+test("M8: a binding on a seat that is in no library business checks clean, whatever its engine", () => {
+  const s = setup();
+  business(s, { library: false });
+  const r = check(s);
+  assert.equal(r.status, 0, r.stderr);
+  assert.match(r.stdout, /offline check passed/);
+});
+
+test("M8: run refuses a library seat's raw engine with exit 2, before the journal is made and before any network", () => {
+  const s = setup();
+  business(s, { library: true });
+  const r = run(s);
+  assert.equal(r.status, 2, r.stderr);
+  assert.match(r.stderr, /discord-engine-not-allowed: .*its engine must be mosaic-bus, not zai/);
+  assert.equal(existsSync(s.d.journalDir), false, "nothing was started");
+});
+
+test("M8: run refuses a library seat's mosaic-bus binding that declares tools", () => {
+  const s = setup((root) => ({ engine: MOSAIC_BUS, tools: { roots: [{ name: "docs", path: join(root, "docs") }] } }));
+  business(s, { library: true });
+  const r = run(s);
+  assert.equal(r.status, 2, r.stderr);
+  assert.match(r.stderr, /discord-engine-not-allowed: .*tools key/);
+  assert.equal(existsSync(s.d.journalDir), false);
+});
+
+test("M8: an unreadable business file refuses run with discord-business-unreadable, before the journal is made", () => {
+  const s = setup();
+  mkdirSync(join(s.root, "businesses"));
+  writeFileSync(join(s.root, "businesses", "broken.json"), "{");
+  chmodSync(join(s.root, "businesses", "broken.json"), 0o600);
+  const r = run(s);
+  assert.equal(r.status, 2, r.stderr);
+  assert.match(r.stderr, /discord-business-unreadable/);
+  assert.equal(existsSync(s.d.journalDir), false);
+});

packages/library/README.md

@@ -31,33 +31,72 @@ deep-frozen copy. `where` names the entry in messages. `fail(code, message)` def
 - `user` is the bot account name from design step 3, required for sync. It is optional in the
   mapping and checked with row 199's account name pattern, `[A-Za-z0-9_.-]`, 1 to 100 characters.
 - `vaultPrefix` is optional, one folder name.
+- `editor` is optional, `{ "name", "email" }` plus an optional `"user"`: the ident her Console saves commit under
+  (C2-01d). Each value is text that is non-empty after trim, with no control character
+  (`U+0000`-`U+001F`, `U+007F`-`U+009F`), `<` or `>`, and no whitespace or git-stripped character at
+  either end. `user` is her Gitea login for the `library-human` slot (sage-2925), checked as the
+  entry's `user` is. `editor` and its `user` come back only when given; a save without them refuses
+  in C2-02.
 - `types` maps a folder name to `character`, `place`, `research`, `tracker` or `summary`.
   `manuscript` lists folder names and shares none with `types`.
 - A universe has `name`, `books` and `playground`. A hybrid adds `kind: "hybrid"`, two or more
   plain-universe `sources`, `constraints` (each one `{ "exclude": ... }` or
   `{ "pin": { "entity", "field", "value" } }`) and `notes`, and may have `books: []`. A draft
   universe has only `kind: "draft"`, `name` and one or more `playground` prefixes, and comes back as
-  `{ kind: "draft", name, books: [], playground }`. `kind` is absent, `"hybrid"` or `"draft"`.
+  `{ kind: "draft", name, books: [], playground, supporting }`. `kind` is absent, `"hybrid"` or `"draft"`.
 - A playground prefix ends in `/` and has one of three levels (C2-01c). Book level lies inside one of
   its own entry's book folders. Universe level, in a plain universe or a hybrid, lies outside every
   book folder. A draft's prefixes all lie outside every book folder. No prefix holds another or is
   listed twice, across every entry.
+- Every universe kind may also have `supporting`, a list of prefixes where agents may write (C2-01d,
+  M12). It comes back on every universe, `[]` when absent. A supporting prefix follows the playground's
+  rules: it ends in `/`, has the same three levels, holds no other supporting prefix and is listed
+  once, across every entry.
+- Between the two lists: a supporting prefix may equal a playground prefix of its own entry, and a
+  playground prefix may hold one of its own entry's supporting prefixes. A supporting prefix may not
+  hold a playground prefix, which scope would then never reach, and may not equal, hold or lie inside
+  another entry's playground prefix.
 
 Refusals:
 
 | Code | When |
 |---|---|
 | `library-playground-other-universe` | a playground prefix lies inside, or holds, a book folder of another entry |
-| `library-mapping-invalid` | any other shape fault: unknown key, bad remote or branch, an unknown `kind`, a book folder in two universes, a book folder that holds another, a playground prefix that holds another or is listed twice, a prefix equal to a book folder or holding its own entry's book, a draft with `books` or with no prefix, a hybrid source that is unknown, a hybrid or a draft |
+| `library-supporting-other-universe` | a supporting prefix lies inside, or holds, a book folder of another entry |
+| `library-mapping-invalid` | any other shape fault: unknown key, bad remote or branch, an unknown `kind`, a book folder in two universes, a book folder that holds another, a playground or supporting prefix that holds another of its list or is listed twice, a prefix equal to a book folder or holding its own entry's book, a supporting prefix that holds a playground prefix or overlaps another entry's, a bad `editor`, a draft with `books` or with no prefix, a hybrid source that is unknown, a hybrid or a draft |
 
 ## Scope
 
 `classify(mapping, path)` decides scope from the path alone. Only paths ending in lowercase `.md` are
-mapped. It checks prefixes first. A path under any entry's playground prefix is `playground`, with that
-entry as `universe` and the book folder holding the prefix as `book`, or `null` at universe level and
+mapped. It checks prefixes first, supporting before playground. A path under any entry's supporting
+prefix is `supporting`, and otherwise one under a playground prefix is `playground`. Either way that
+entry is `universe` and the book folder holding the prefix is `book`, or `null` at universe level and
 in a draft. Any other path under a book folder is `canon`. Everything else is `unmapped`. The type is
-the first folder after the playground prefix, or after the book: a `types` name, `manuscript`, or
-`null`.
+the first folder after the prefix, or after the book: a `types` name, `manuscript`, or `null`.
+
+## Agent write paths
+
+`supportingPath(mapping, universe, path, tree)` returns `path` when an agent may write it in that
+universe, else it refuses `library-write-story-path` (C2-01d, M12). `tree` is the array `listTree`
+returns for the commit the write lands on; anything else is a TypeError. It reads no git. The checks
+run in this order, so a path with two faults always names the same one:
+
+1. a string of at most 1,024 UTF-8 bytes;
+2. no control character (the `editor` class), and the message leaves the path out;
+3. no backslash;
+4. not absolute;
+5. no empty, `.` or `..` segment, which also refuses `//` and a trailing `/`;
+6. `classify` gives `supporting` in that same universe, which refuses unmapped, `.canvas`, `.base`
+   and attachment paths, canon, a playground-only folder and another universe's prefix;
+7. no folder on the way, and not the path itself, is a symlink (`120000`) or gitlink (`160000`) in
+   `tree`;
+8. no folder on the way, and not the path itself, matches a tree path or tree folder after
+   `normalize('NFC').toLowerCase()` unless it is that exact name. APFS folds case and Unicode form,
+   so her checkout would put the file somewhere else. A tree that already holds case twins refuses a
+   write to either (R7).
+
+A delete's further rule, that the path exists at the tip as a `100644` blob, belongs to the C2-02
+broker.
 
 ## Reader
 

packages/library/src/index-build.mjs

@@ -0,0 +1,75 @@
+// The lookup index of design 3 (C2-05a): types, names, links and backlinks for one commit of her repo.
+// It is built from the reader's output, so it holds only mapped, readable files: R1, R2 and R7 leave a
+// file out, and an unresolved link is not in it. It is cached in memory by commit id. The key also
+// carries the repo path and a digest of the mapping, because one commit reads differently under another
+// mapping. The index is not universe-aware; query.mjs decides what a universe may see.
+import { createHash } from 'node:crypto';
+import { readLibrary } from './reader.mjs';
+import { raise } from './problems.mjs';
+
+const CACHE_LIMIT = 8;
+const cache = new Map();
+
+const push = (map, key, value) => {
+  if (!map.has(key)) map.set(key, []);
+  map.get(key).push(value);
+};
+// A file's name for lookups: its front matter `name` when it is text, else its file name.
+const displayName = file => {
+  const name = file.frontmatter?.name;
+  return typeof name === 'string' && name.trim() ? name.trim() : file.name;
+};
+// A link as the index keeps it: the file at the other end, its line, and the field when front matter holds it.
+const linkAt = (path, link) => ({ path, line: link.line, ...(link.field === undefined ? {} : { field: link.field }) });
+
+// Builds the index from readLibrary's output. Pure: no git, no clock.
+export function buildIndex(library, mapping) {
+  const files = new Map(), types = new Map(), names = new Map(), linksOut = new Map(), linksIn = new Map();
+  for (const file of library.files) {
+    const name = displayName(file);
+    files.set(file.path, {
+      path: file.path, scope: file.scope, universe: file.universe, book: file.book, type: file.type,
+      folder: file.folder, stem: file.name, name, frontmatter: file.frontmatter, lines: file.lines,
+    });
+    if (file.type !== null) push(types, file.type, file.path);
+    push(names, name.toLowerCase(), file.path);
+    linksOut.set(file.path, file.links.map(link => linkAt(link.path, link)));
+    for (const link of file.links) push(linksIn, link.path, linkAt(file.path, link));
+  }
+  return Object.freeze({
+    commit: library.commit, mapping, files, paths: [...files.keys()], types, names, linksOut, linksIn,
+    problems: library.problems,
+  });
+}
+
+const digest = mapping => createHash('sha256').update(JSON.stringify(mapping)).digest('hex');
+
+// The index for one commit under one mapping, read once and kept in memory. A repeat call returns the same
+// object. Past CACHE_LIMIT entries the oldest goes. A failed read is not kept.
+export async function indexFor({ repo, commit, mapping }) {
+  if (!mapping || mapping.kind !== 'library') raise('library-mapping-invalid', 'expected a checked library mapping');
+  const key = JSON.stringify([repo, commit, digest(mapping)]);
+  if (cache.has(key)) {
+    const hit = cache.get(key);
+    cache.delete(key);
+    cache.set(key, hit);
+    return hit;
+  }
+  const pending = readLibrary({ repo, commit, mapping }).then(library => buildIndex(library, mapping));
+  cache.set(key, pending);
+  while (cache.size > CACHE_LIMIT) cache.delete(cache.keys().next().value);
+  try {
+    return await pending;
+  } catch (error) {
+    if (cache.get(key) === pending) cache.delete(key);
+    throw error;
+  }
+}
+
+export function clearIndexCache() {
+  cache.clear();
+}
+
+export function indexCacheSize() {
+  return cache.size;
+}

packages/library/src/index.mjs

@@ -2,9 +2,12 @@
 export { LibraryError, RULES, problem, sortProblems } from './problems.mjs';
 export { checkMapping, TYPES } from './mapping.mjs';
 export { classify } from './scope.mjs';
+export { supportingPath } from './supporting.mjs';
 export { extractLinks, parseWikilink, resolver, formOf, isAttachment } from './links.mjs';
 export { readLibrary, listTree, readTexts, parseFile, parseFrontMatter, headCommit, MAX_BLOB, LINK_FIELDS } from './reader.mjs';
 export { renderItems, KINDS, NOTICES, UNREADABLE } from './render.mjs';
 export { survey, formatSurvey, surveyMain } from './survey.mjs';
 export { SYNC_STATE_FILE, mirrorPath, ensureMirror, withLibraryLock, servedCommit, readSyncState, libraryStatus, readLibraryFile } from './mirror.mjs';
 export { syncCommand, sync, ASKPASS, SLOT, SYNC_INTERVAL_MS } from './sync.mjs';
+export { buildIndex, indexFor, clearIndexCache, indexCacheSize } from './index-build.mjs';
+export { sees, find, get, search, manuscript, universeInfo, QUERY_REPLY_CAP, LOOKUP_LIMIT, MANUSCRIPT_LINES } from './query.mjs';

packages/library/src/mapping.mjs

@@ -1,8 +1,9 @@
 // The library project entry of a business file (design 1.1): her folders mapped onto universes,
 // books, type folders, manuscript folders and playground prefixes at three levels (ruling after r11,
-// C2-01c): inside one of the entry's books, outside every book, or in a draft universe. A pure validator. Business file
-// loading wires it in C2-04, which passes its own `fail` so the refusal reads as a business file
-// problem. Agents can't write this entry (M9, C2-04).
+// C2-01c): inside one of the entry's books, outside every book, or in a draft universe. Supporting
+// prefixes (C2-01d) follow the same rules and are where agents may write (M12). A pure validator.
+// Business file loading wires it in C2-04, which passes its own `fail` so the refusal reads as a
+// business file problem. Agents can't write this entry (M9, C2-04).
 import { raise } from './problems.mjs';
 
 export const TYPES = Object.freeze(['character', 'place', 'research', 'tracker', 'summary']);
@@ -12,6 +13,12 @@ const BRANCH = /^[A-Za-z0-9][A-Za-z0-9._/-]{0,127}$/;
 const USER = /^[A-Za-z0-9_.-]{1,100}$/;
 const CONSTRAINT_KEYS = ['exclude', 'pin'];
 const KINDS = ['hybrid', 'draft'];
+// C2-01d (F41): the editor ident her Console saves commit under. Git drops `<` and `>` from an ident
+// and commits under a different name, so they refuse here (webby-0169 R1).
+const IDENT_BAD = /[\u0000-\u001f\u007f-\u009f<>]/;
+// Git's ident.c crud() strips any byte <= 0x20 and , : ; < > " \ ' from both ends of an ident, so a
+// value that starts or ends with one would save one name and commit another (sage-3601, sage-3606).
+const IDENT_CRUD_END = /^[\u0000-\u0020,:;<>"\\']|[\u0000-\u0020,:;<>"\\']$/;
 
 // A folder segment from her vault: spaces and capitals are fine, separators, control characters
 // and dot names are not.
@@ -40,7 +47,7 @@ export function checkMapping(entry, where = 'library', { fail = raise } = {}) {
   };
 
   object(entry, '');
-  only(entry, ['kind', 'remote', 'branch', 'user', 'vaultPrefix', 'universes', 'types', 'manuscript'], 'entry');
+  only(entry, ['kind', 'remote', 'branch', 'user', 'vaultPrefix', 'editor', 'universes', 'types', 'manuscript'], 'entry');
   if (entry.kind !== 'library') bad('kind must be "library"');
   let url;
   try { url = new URL(entry.remote); } catch { bad('remote must be an https:// URL'); }
@@ -52,6 +59,20 @@ export function checkMapping(entry, where = 'library', { fail = raise } = {}) {
   if (Object.hasOwn(entry, 'user') && (typeof entry.user !== 'string' || !USER.test(entry.user)))
     bad('user must be a plain account name');
   if (Object.hasOwn(entry, 'vaultPrefix') && !segment(entry.vaultPrefix)) bad('vaultPrefix must be one folder name');
+  if (Object.hasOwn(entry, 'editor')) {
+    object(entry.editor, 'editor');
+    only(entry.editor, ['name', 'email', 'user'], 'editor');
+    // Her Gitea login for the library-human slot, which C2-02 passes in (sage-2925). Optional here.
+    if (Object.hasOwn(entry.editor, 'user') && (typeof entry.editor.user !== 'string' || !USER.test(entry.editor.user)))
+      bad('editor.user must be a plain account name');
+    for (const key of ['name', 'email']) {
+      const value = entry.editor[key];
+      if (typeof value !== 'string' || !value.trim() || IDENT_BAD.test(value))
+        bad(`editor.${key} must be non-empty text with no control character, < or >`);
+      if (value.trim() !== value || IDENT_CRUD_END.test(value))
+        bad(`editor.${key} must not start or end with whitespace or any of , : ; " ' \\`);
+    }
+  }
 
   object(entry.types, 'types');
   for (const [name, type] of Object.entries(entry.types)) {
@@ -64,6 +85,7 @@ export function checkMapping(entry, where = 'library', { fail = raise } = {}) {
   object(entry.universes, 'universes');
   if (!Object.keys(entry.universes).length) bad('universes must name at least one universe');
   const universes = {}, bookOwner = new Map(), prefixes = [], prefixOwner = new Map();
+  const supports = [], supportOwner = new Map();
   for (const [id, universe] of Object.entries(entry.universes)) {
     const name = `universes.${id}`;
     if (!ID.test(id)) bad(`universe id ${JSON.stringify(id)} is not a plain id`);
@@ -71,8 +93,8 @@ export function checkMapping(entry, where = 'library', { fail = raise } = {}) {
     if (Object.hasOwn(universe, 'kind') && !KINDS.includes(universe.kind)) bad(`${name}.kind must be "hybrid" or "draft"`);
     const hybrid = universe.kind === 'hybrid', draft = universe.kind === 'draft';
     if (draft && Object.hasOwn(universe, 'books')) bad(`${name} is a draft and takes no books`);
-    only(universe, hybrid ? ['kind', 'name', 'sources', 'books', 'playground', 'constraints', 'notes']
-      : draft ? ['kind', 'name', 'playground'] : ['name', 'books', 'playground'], name);
+    only(universe, hybrid ? ['kind', 'name', 'sources', 'books', 'playground', 'supporting', 'constraints', 'notes']
+      : draft ? ['kind', 'name', 'playground', 'supporting'] : ['name', 'books', 'playground', 'supporting'], name);
     if (typeof universe.name !== 'string' || !universe.name.trim() || universe.name.length > 128 || /[\u0000-\u001f]/.test(universe.name))
       bad(`${name}.name must be a short display name`);
     const books = draft ? [] : list(universe.books, `${name}.books`, folder, 'a folder path');
@@ -81,12 +103,14 @@ export function checkMapping(entry, where = 'library', { fail = raise } = {}) {
       if (bookOwner.has(book)) bad(`book folder ${JSON.stringify(book)} is in two universes`);
       bookOwner.set(book, id);
     }
-    const playground = list(universe.playground ?? [], `${name}.playground`,
-      value => typeof value === 'string' && value.endsWith('/') && folder(value.slice(0, -1)), 'a folder path ending in /');
+    const prefix = value => typeof value === 'string' && value.endsWith('/') && folder(value.slice(0, -1));
+    const playground = list(universe.playground ?? [], `${name}.playground`, prefix, 'a folder path ending in /');
     if (draft && !playground.length) bad(`${name}.playground must name at least one prefix`);
-    for (const prefix of playground) { prefixes.push(prefix); prefixOwner.set(prefix, id); }
-    if (draft) { universes[id] = { kind: 'draft', name: universe.name, books, playground }; continue; }
-    const out = { name: universe.name, books, playground };
+    for (const p of playground) { prefixes.push(p); prefixOwner.set(p, id); }
+    const supporting = list(universe.supporting ?? [], `${name}.supporting`, prefix, 'a folder path ending in /');
+    for (const p of supporting) { supports.push(p); supportOwner.set(p, id); }
+    if (draft) { universes[id] = { kind: 'draft', name: universe.name, books, playground, supporting }; continue; }
+    const out = { name: universe.name, books, playground, supporting };
     if (hybrid) {
       out.kind = 'hybrid';
       out.sources = list(universe.sources, `${name}.sources`, value => typeof value === 'string' && ID.test(value), 'a universe id');
@@ -124,18 +148,36 @@ export function checkMapping(entry, where = 'library', { fail = raise } = {}) {
   for (const a of books) for (const b of books) if (a !== b && holds(a, b)) bad(`book folder ${JSON.stringify(a)} holds book folder ${JSON.stringify(b)}`);
   for (const a of prefixes) for (const b of prefixes) if (a !== b && holds(a, b)) bad(`playground ${JSON.stringify(a)} holds playground ${JSON.stringify(b)}`);
   if (new Set(prefixes).size !== prefixes.length) bad('a playground prefix is listed twice');
+  for (const a of supports) for (const b of supports) if (a !== b && holds(a, b)) bad(`supporting ${JSON.stringify(a)} holds supporting ${JSON.stringify(b)}`);
+  if (new Set(supports).size !== supports.length) bad('a supporting prefix is listed twice');
   // A prefix's level comes from where it sits (ruling after r11). Inside one of its own entry's books
   // is book level, outside every book is universe level, and a draft's prefixes are all outside. Scope
   // checks prefixes first (scope.mjs), so a prefix equal to or holding a book would turn that book
-  // into playground.
-  for (const [prefix, id] of prefixOwner) {
-    for (const [book, owner] of bookOwner) {
-      const at = `universes.${id}.playground ${JSON.stringify(prefix)}`;
-      if (prefix === `${book}/`) bad(`${at} is the whole book folder ${JSON.stringify(book)}`);
-      const inside = holds(book, prefix), holding = holds(prefix, book);
-      if ((inside || holding) && owner !== id)
-        fail('library-playground-other-universe', `${where} ${at} ${inside ? 'lies inside' : 'holds'} book folder ${JSON.stringify(book)} of universes.${owner}`);
-      if (holding) bad(`${at} holds its own book folder ${JSON.stringify(book)}`);
+  // into playground or supporting.
+  const againstBooks = (owners, list, code) => {
+    for (const [prefix, id] of owners) {
+      for (const [book, owner] of bookOwner) {
+        const at = `universes.${id}.${list} ${JSON.stringify(prefix)}`;
+        if (prefix === `${book}/`) bad(`${at} is the whole book folder ${JSON.stringify(book)}`);
+        const inside = holds(book, prefix), holding = holds(prefix, book);
+        if ((inside || holding) && owner !== id)
+          fail(code, `${where} ${at} ${inside ? 'lies inside' : 'holds'} book folder ${JSON.stringify(book)} of universes.${owner}`);
+        if (holding) bad(`${at} holds its own book folder ${JSON.stringify(book)}`);
+      }
+    }
+  };
+  againstBooks(prefixOwner, 'playground', 'library-playground-other-universe');
+  againstBooks(supportOwner, 'supporting', 'library-supporting-other-universe');
+  // C2-01d, between the lists. A supporting prefix may equal a playground prefix of its own entry, and
+  // a playground may hold one of its own entry's supporting prefixes. A supporting prefix that holds a
+  // playground would hide it, since scope checks supporting first. Any overlap across entries would
+  // give one path two universes.
+  for (const [s, sid] of supportOwner) {
+    for (const [p, pid] of prefixOwner) {
+      const at = `universes.${sid}.supporting ${JSON.stringify(s)}`;
+      if (sid !== pid && (s === p || holds(s, p) || holds(p, s)))
+        bad(`${at} overlaps playground ${JSON.stringify(p)} of universes.${pid}`);
+      if (sid === pid && s !== p && holds(s, p)) bad(`${at} holds playground ${JSON.stringify(p)}`);
     }
   }
 
@@ -143,6 +185,8 @@ export function checkMapping(entry, where = 'library', { fail = raise } = {}) {
     kind: 'library', remote: entry.remote, branch: entry.branch,
     ...(Object.hasOwn(entry, 'user') ? { user: entry.user } : {}),
     ...(Object.hasOwn(entry, 'vaultPrefix') ? { vaultPrefix: entry.vaultPrefix } : {}),
+    ...(Object.hasOwn(entry, 'editor') ? { editor: { name: entry.editor.name, email: entry.editor.email,
+      ...(Object.hasOwn(entry.editor, 'user') ? { user: entry.editor.user } : {}) } } : {}),
     universes, types: { ...entry.types }, manuscript,
   });
 }

packages/library/src/query.mjs

@@ -0,0 +1,240 @@
+// The lookup queries of design 3 (C2-05a): find, get, search, manuscript and universeInfo. Each takes a
+// source {repo, commit, mapping} and an argument object, and returns a reply that fits QUERY_REPLY_CAP.
+// Universe isolation is here, in sees(): a file reaches a reply only when sees() allows it. Scope comes
+// from the path (D2). Unmapped files are not in the index, so they never appear. Lists page by position
+// and never cut an item. A search line too long to fit alone comes back as a marked hit with no excerpt;
+// a find item, a file's front matter or one of its lines that cannot fit alone is refused.
+import { raise } from './problems.mjs';
+import { TYPES } from './mapping.mjs';
+import { indexFor } from './index-build.mjs';
+
+// The same cap as packages/harness/src/tools.mjs REPLY_CAP. The query tests assert the two stay equal.
+export const QUERY_REPLY_CAP = 40_000;
+export const LOOKUP_LIMIT = 50;
+export const MANUSCRIPT_LINES = 400;
+const SCOPES = Object.freeze(['canon', 'playground']);
+
+const bytes = value => JSON.stringify(value).length;
+const invalid = message => raise('query-argument-invalid', message);
+const inside = (folder, path) => path.startsWith(folder.endsWith('/') ? folder : `${folder}/`);
+
+function textArg(value, name) {
+  if (typeof value !== 'string') invalid(`${name} must be text`);
+  return value;
+}
+function scopeArg(value) {
+  if (value === undefined) return 'canon';
+  if (!SCOPES.includes(value)) invalid('scope must be "canon" or "playground"');
+  return value;
+}
+function positionArg(value, name, fallback) {
+  if (value === undefined) return fallback;
+  if (!Number.isSafeInteger(value) || value < 1) invalid(`${name} must be a line number of 1 or more`);
+  return value;
+}
+function offsetArg(value) {
+  if (value === undefined) return 0;
+  if (!Number.isSafeInteger(value) || value < 0) invalid('offset must be a whole number of 0 or more');
+  return value;
+}
+function universeArg(mapping, value) {
+  if (typeof value !== 'string' || !value) invalid('universe is required');
+  if (!Object.hasOwn(mapping.universes, value)) raise('query-universe-unknown', `this library has no universe ${JSON.stringify(value)}`);
+  return value;
+}
+
+// Whether universe U may see a file. Its own files, in either scope. A hybrid also sees the canon of
+// its declared sources, minus the folders its exclude constraints name. A hybrid never sees a source's
+// playground. Pin constraints do not hide anything; they are reported by universeInfo only.
+export function sees(mapping, universe, file) {
+  if (file.universe === universe) return true;
+  const entry = mapping.universes[universe];
+  if (entry.kind !== 'hybrid' || !entry.sources.includes(file.universe) || file.scope !== 'canon') return false;
+  return !entry.constraints.some(c => c.exclude !== undefined && inside(c.exclude, file.path));
+}
+
+// The files one universe may see in one scope, with optional book and type filters, in path order.
+async function visible(source, universe, { scope, book, type }) {
+  const index = await indexFor(source);
+  const files = index.paths
+    .map(path => index.files.get(path))
+    .filter(file => file.scope === scope && sees(index.mapping, universe, file)
+      && (book === undefined || file.book === book) && (type === undefined || file.type === type));
+  return { index, files };
+}
+
+// A reply whose size is over the cap is refused, never cut.
+function checked(reply) {
+  if (bytes(reply) > QUERY_REPLY_CAP) raise('query-item-too-large', `the reply is over the ${QUERY_REPLY_CAP}-character cap`);
+  return reply;
+}
+
+// Picks items from `offset`, at most `limit`, while the reply still fits. build(picked, next) returns
+// the reply; `next` is the position of the first item not picked, or null when none is left. An item
+// that cannot fit even alone is refused: skipping it would hide it, and cutting it would break it.
+function fitPage(items, { offset = 0, limit = LOOKUP_LIMIT, build }) {
+  const picked = [];
+  let at = offset;
+  while (at < items.length && picked.length < limit) {
+    // The size check uses items.length for `next`, the widest number a cursor can take, so a page never runs over.
+    if (bytes(build([...picked, items[at]], items.length)) > QUERY_REPLY_CAP) {
+      if (!picked.length) raise('query-item-too-large', `the item at position ${at} alone is over the ${QUERY_REPLY_CAP}-character cap`);
+      break;
+    }
+    picked.push(items[at]);
+    at += 1;
+  }
+  return checked(build(picked, at < items.length ? at : null));
+}
+
+// find: the files whose name or file name holds `query`, case-insensitive. Up to 50 per page.
+export async function find(source, { universe: name, query, type, book, scope, offset } = {}) {
+  const universe = universeArg(source.mapping, name);
+  const needle = textArg(query, 'query').toLowerCase();
+  if (type !== undefined && !TYPES.includes(type)) invalid(`type must be one of ${TYPES.join(', ')}`);
+  const { index, files } = await visible(source, universe, {
+    scope: scopeArg(scope), book: book === undefined ? undefined : textArg(book, 'book'), type,
+  });
+  const hits = files.filter(file => file.name.toLowerCase().includes(needle) || file.stem.toLowerCase().includes(needle));
+  return fitPage(hits, {
+    offset: offsetArg(offset),
+    build: (picked, next) => ({
+      commit: index.commit,
+      results: picked.map(file => ({
+        path: file.path, type: file.type, name: file.name, appears_in: file.frontmatter?.appears_in ?? null,
+        scope: file.scope, universe: file.universe, book: file.book,
+      })),
+      next,
+    }),
+  });
+}
+
+// get: one visible file, its front matter, its lines from `from`, and its visible links both ways.
+// Returns null when the file is missing or not visible, so a caller cannot tell the two apart. Lines page
+// by `from` (reply `next`), links page together by `links_from` (reply `links_next`); `links_out` come
+// before `links_in`. Every page carries the front matter. Links take at most half the cap, so a hub note
+// with many backlinks stays readable and still leaves room for lines. A page with lines left carries at
+// least one line, so links shrink when a line needs the room; read on with `from: next` and
+// `links_from: links_next`. A `from` past the last line returns links alone. Only front matter, or a
+// line that cannot fit with no links beside it, is refused.
+export async function get(source, { universe: name, path, from, links_from: linksFrom } = {}) {
+  const universe = universeArg(source.mapping, name);
+  const startLine = positionArg(from, 'from', 1);
+  const linkStart = offsetArg(linksFrom);
+  if (typeof path !== 'string') invalid('path must be text');
+  const index = await indexFor(source);
+  const file = index.files.get(path);
+  if (!file || !sees(index.mapping, universe, file)) return null;
+  const reachable = links => links.filter(link => {
+    const other = index.files.get(link.path);
+    return other !== undefined && sees(index.mapping, universe, other);
+  });
+  const outs = reachable(index.linksOut.get(file.path) ?? []);
+  const ins = reachable(index.linksIn.get(file.path) ?? []);
+  const links = [...outs.map(link => ({ out: true, link })), ...ins.map(link => ({ out: false, link }))];
+  const lines = file.lines.slice(startLine - 1);
+  const linkRest = Math.max(0, links.length - linkStart);
+  const page = (nLines, nLinks) => {
+    const taken = links.slice(linkStart, linkStart + nLinks);
+    return {
+      path: file.path, commit: index.commit, scope: file.scope, frontmatter: file.frontmatter,
+      lines: lines.slice(0, nLines),
+      links_out: taken.filter(item => item.out).map(item => item.link),
+      links_in: taken.filter(item => !item.out).map(item => item.link),
+      next: nLines < lines.length ? startLine + nLines : null,
+      links_next: nLinks < linkRest ? linkStart + nLinks : null,
+    };
+  };
+  // How many leading items fit in `room`, by each item's own size.
+  const count = (items, room) => {
+    let used = 0, n = 0;
+    while (n < items.length && used + bytes(items[n]) + 1 <= room) used += bytes(items[n++]) + 1;
+    return n;
+  };
+  const base = bytes(page(0, 0));
+  if (base > QUERY_REPLY_CAP) raise('query-item-too-large', `the front matter of ${file.path} alone is over the ${QUERY_REPLY_CAP}-character cap`);
+  if (lines.length && bytes(page(1, 0)) > QUERY_REPLY_CAP) {
+    raise('query-item-too-large', `line ${lines[0][0]} of ${file.path} alone is over the ${QUERY_REPLY_CAP}-character cap`);
+  }
+  const rest = links.slice(linkStart);
+  let nLinks = count(rest, (lines.length ? Math.floor(QUERY_REPLY_CAP / 2) : QUERY_REPLY_CAP) - base);
+  if (!nLinks && rest.length) nLinks = count(rest, QUERY_REPLY_CAP - base);
+  if (!nLinks && rest.length) raise('query-item-too-large', `a link of ${file.path} alone is over the ${QUERY_REPLY_CAP}-character cap`);
+  while (lines.length && nLinks > 0 && bytes(page(1, nLinks)) > QUERY_REPLY_CAP) nLinks = Math.floor(nLinks / 2);
+  let nLines = Math.max(lines.length ? 1 : 0, count(lines, QUERY_REPLY_CAP - bytes(page(0, nLinks))));
+  while (nLines > 1 && bytes(page(nLines, nLinks)) > QUERY_REPLY_CAP) nLines -= 1;
+  return checked(page(nLines, nLinks));
+}
+
+// search: lines whose text holds `text`, case-insensitive. The excerpt is the whole line. Up to 50 per page.
+export async function search(source, { universe: name, text, book, scope, offset } = {}) {
+  const universe = universeArg(source.mapping, name);
+  const needle = textArg(text, 'text').toLowerCase();
+  if (!needle) invalid('text must not be empty');
+  const { index, files } = await visible(source, universe, {
+    scope: scopeArg(scope), book: book === undefined ? undefined : textArg(book, 'book'),
+  });
+  const hits = [];
+  for (const file of files) {
+    for (const [line, body] of file.lines) {
+      if (!body.toLowerCase().includes(needle)) continue;
+      const hit = { path: file.path, line, excerpt: body, scope: file.scope };
+      // The excerpt is the whole line. A line too long to fit alone is marked, not cut and not refused.
+      hits.push(bytes({ commit: index.commit, results: [hit], next: Number.MAX_SAFE_INTEGER }) > QUERY_REPLY_CAP
+        ? { path: file.path, line, excerpt: null, excerpt_too_long: true, scope: file.scope } : hit);
+    }
+  }
+  return fitPage(hits, {
+    offset: offsetArg(offset),
+    build: (picked, next) => ({ commit: index.commit, results: picked, next }),
+  });
+}
+
+// manuscript: one chapter file of a book, by its file name, up to 400 lines per call from `from` to `to`.
+// Without a chapter it returns the book's first chapter file in path order. Every reply carries
+// `next_chapter`, the next chapter file's name in path order or null. A name that matches two visible
+// files is refused. Files outside every book (book null) are never chapters of a book.
+export async function manuscript(source, { universe: name, book, scope, chapter, from, to } = {}) {
+  const universe = universeArg(source.mapping, name);
+  const bookName = textArg(book, 'book');
+  const chapterName = chapter === undefined ? undefined : textArg(chapter, 'chapter');
+  const start = positionArg(from, 'from', 1);
+  const end = positionArg(to, 'to', Infinity);
+  if (end < start) invalid('to must not be before from');
+  const { index, files } = await visible(source, universe, { scope: scopeArg(scope), book: bookName, type: 'manuscript' });
+  let at = 0;
+  if (chapterName !== undefined) {
+    const matches = files.filter(file => file.stem === chapterName);
+    if (matches.length > 1) raise('query-chapter-ambiguous', `${matches.length} visible files are named ${JSON.stringify(chapterName)}`);
+    if (!matches.length) return null;
+    at = files.indexOf(matches[0]);
+  }
+  const file = files[at];
+  if (!file) return null;
+  const nextChapter = files[at + 1]?.stem ?? null;
+  return fitPage(file.lines.slice(start - 1, end), {
+    limit: MANUSCRIPT_LINES,
+    build: (picked, next) => ({
+      path: file.path, commit: index.commit, scope: file.scope, lines: picked,
+      next: next === null ? null : start + next, next_chapter: nextChapter,
+    }),
+  });
+}
+
+// universeInfo: a universe's kind, name, books, playground prefixes, type folders and manuscript folders.
+// A hybrid adds its sources, constraints and notes. A draft has no books and no canon: its kind, name
+// and prefixes are the whole answer beside the mapping's types. It reads only the checked mapping and the
+// served commit.
+export async function universeInfo(source, { universe: name } = {}) {
+  const universe = universeArg(source.mapping, name);
+  const entry = source.mapping.universes[universe];
+  const hybrid = entry.kind === 'hybrid';
+  return checked({
+    commit: source.commit, universe, name: entry.name, kind: entry.kind ?? 'universe',
+    books: entry.books, playground: entry.playground, types: source.mapping.types, manuscript: source.mapping.manuscript,
+    ...(hybrid ? {
+      sources: entry.sources, constraints: entry.constraints,
+      ...(entry.notes === undefined ? {} : { notes: entry.notes }),
+    } : {}),
+  });
+}

packages/library/src/scope.mjs

@@ -2,16 +2,22 @@
 // Paths are repo-relative and compared exactly, case included (R7 handles case-only twins).
 const inside = (folder, path) => path.startsWith(folder.endsWith('/') ? folder : `${folder}/`);
 
-// { scope: 'playground' | 'canon', universe, book, type, folder } or { scope: 'unmapped' }.
-// Prefixes come first (ruling after r11, C2-01c): a `.md` file under any entry's playground prefix is
-// playground, with that entry as `universe` and the book folder that holds the prefix as `book`, or
-// null at universe level and in a draft. Otherwise a `.md` file in a book folder is canon. `type` is
-// the mapped type of the first folder under the prefix (playground) or under the book (canon),
+// { scope: 'supporting' | 'playground' | 'canon', universe, book, type, folder } or { scope: 'unmapped' }.
+// Prefixes come first (ruling after r11, C2-01c), supporting before playground (C2-01d, design 1.2):
+// a `.md` file under any entry's supporting prefix is supporting, and otherwise one under a playground
+// prefix is playground. Either way `universe` is that entry and `book` is the book folder that holds
+// the prefix, or null at universe level and in a draft. Otherwise a `.md` file in a book folder is
+// canon. `type` is the mapped type of the first folder under the prefix or under the book (canon),
 // 'manuscript' for a manuscript folder, else null. `folder` is that folder name. checkMapping keeps
-// prefixes from overlapping, so at most one matches.
+// prefixes of one list from overlapping, and keeps a supporting prefix from holding a playground
+// prefix, so the first match is the only one that counts.
 export function classify(mapping, path) {
   if (typeof path !== 'string' || !path.endsWith('.md')) return { scope: 'unmapped' };
   const entries = Object.entries(mapping.universes);
+  for (const [universe, entry] of entries) {
+    const prefix = entry.supporting.find(p => inside(p, path));
+    if (prefix) return place(mapping, path, prefix, { scope: 'supporting', universe, book: entry.books.find(b => inside(b, prefix)) ?? null });
+  }
   for (const [universe, entry] of entries) {
     const prefix = entry.playground.find(p => inside(p, path));
     if (prefix) return place(mapping, path, prefix, { scope: 'playground', universe, book: entry.books.find(b => inside(b, prefix)) ?? null });

packages/library/src/supporting.mjs

@@ -0,0 +1,49 @@
+// C2-01d (M12): the paths an agent may write. A path passes only under a supporting prefix of the
+// named universe, and only if nothing in the tree could turn the write into something else: a
+// symlink or gitlink on the way, or a name that differs from a tree name only in case or Unicode
+// form (APFS folds both, so her checkout would put the file somewhere else). Pure; reads no git.
+import { LibraryError } from './problems.mjs';
+import { classify } from './scope.mjs';
+
+const CONTROL = /[\u0000-\u001f\u007f-\u009f]/;
+const MAX_BYTES = 1024;
+const LINKS = new Set(['120000', '160000']);
+const fold = name => name.normalize('NFC').toLowerCase();
+
+// `tree` is the array listTree returns ({ mode, type, oid, size, path }). Returns `path` or throws
+// library-write-story-path naming the class. Checks run in a fixed order, so a path with two faults
+// always names the same one.
+export function supportingPath(mapping, universe, path, tree) {
+  if (!Array.isArray(tree)) throw new TypeError('supportingPath needs the listTree array');
+  const refuse = message => { throw new LibraryError('library-write-story-path', message); };
+  if (typeof path !== 'string') refuse('the path must be a string');
+  const at = JSON.stringify(path);
+  if (Buffer.byteLength(path, 'utf8') > MAX_BYTES) refuse(`${at} is longer than ${MAX_BYTES} bytes`);
+  if (CONTROL.test(path)) refuse('the path holds a control character');
+  if (path.includes('\\')) refuse(`${at} holds a backslash`);
+  if (path.startsWith('/')) refuse(`${at} is absolute`);
+  const parts = path.split('/');
+  if (parts.some(part => part === '' || part === '.' || part === '..')) refuse(`${at} has an empty, . or .. segment`);
+  const place = classify(mapping, path);
+  if (place.scope !== 'supporting' || place.universe !== universe)
+    refuse(`${at} is not under a supporting folder of universe ${JSON.stringify(universe)}`);
+  const own = parts.map((_, i) => parts.slice(0, i + 1).join('/'));
+  const modes = new Map(tree.map(entry => [entry.path, entry.mode]));
+  for (const p of own) if (LINKS.has(modes.get(p))) refuse(`${at} goes through the symlink or gitlink ${JSON.stringify(p)}`);
+  const names = new Map();
+  for (const entry of tree) {
+    const segs = entry.path.split('/');
+    for (let i = 1; i <= segs.length; i++) {
+      const name = segs.slice(0, i).join('/');
+      const key = fold(name);
+      if (!names.has(key)) names.set(key, new Set());
+      names.get(key).add(name);
+    }
+  }
+  for (const p of own) {
+    const seen = names.get(fold(p));
+    if (seen && [...seen].some(name => name !== p))
+      refuse(`${at} differs only in case or Unicode form from ${JSON.stringify([...seen].find(name => name !== p))}`);
+  }
+  return path;
+}

packages/library/src/survey.mjs

@@ -62,7 +62,7 @@ export async function survey({ repo, commit, mapping }) {
     forms, attachments, fields,
   };
   if (mapping) {
-    const scopes = { canon: 0, playground: 0, unmapped: 0 };
+    const scopes = { canon: 0, playground: 0, supporting: 0, unmapped: 0 };
     for (const entry of entries) scopes[classify(mapping, entry.path).scope]++;
     const library = await readLibrary({ repo, commit: head, mapping });
     const steps = Object.fromEntries(STEPS.map(s => [s, 0]));
@@ -89,7 +89,7 @@ export function formatSurvey(s) {
   out.push(`body links ${FORMS.map(f => `${f} ${s.forms[f]}`).join(', ')}; attachment ${s.attachments}`);
   for (const [field, c] of Object.entries(s.fields)) out.push(`field ${field} wikilink ${c.wikilink}, name ${c.name}`);
   if (s.scopes) {
-    out.push(`scopes canon ${s.scopes.canon}, playground ${s.scopes.playground}, unmapped ${s.scopes.unmapped}; indexed ${s.indexed}`);
+    out.push(`scopes canon ${s.scopes.canon}, playground ${s.scopes.playground}, supporting ${s.scopes.supporting}, unmapped ${s.scopes.unmapped}; indexed ${s.indexed}`);
     out.push(`resolved ${STEPS.map(st => `${st} ${s.steps[st]}`).join(', ')}, unresolved ${s.steps.unresolved}`);
     out.push(`problems ${Object.entries(s.problems).map(([code, n]) => `${code} ${n}`).join(', ')}`);
   }

packages/library/tests/index-build.test.mjs

@@ -0,0 +1,92 @@
+// Index tests (C2-05a): the cache key and its bound, failed reads, mapped-only contents, and the rebuild
+// time on a 3,000-file fixture. Fixtures are made up and built under the scratch area.
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import { mkdirSync, symlinkSync, writeFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { performance } from 'node:perf_hooks';
+import { clearIndexCache, indexCacheSize, indexFor } from '../src/index-build.mjs';
+import { git, mapping, MARKER } from './helpers.mjs';
+import { note, scratchRepo } from './query-fixture.mjs';
+
+const FILES = {
+  'Book One/Characters/Mara Vell.md': note('character', 'Mara Vell', MARKER),
+  'Book One/Chapters/Chapter 01.md': '# One\n[[Mara Vell]]\n',
+  'Inbox Note.md': `${MARKER}\n`,
+};
+
+// A mapping whose harbor universe has the given display name. Each name gives a new cache key.
+const named = name => mapping(e => ({ ...e, universes: { ...e.universes, harbor: { ...e.universes.harbor, name } } }));
+
+test('the same commit, repo path and mapping return the same index, and only mapped files are in it', async t => {
+  clearIndexCache();
+  const { repo, commit } = scratchRepo(t, FILES);
+  const a = await indexFor({ repo, commit, mapping: mapping() });
+  const b = await indexFor({ repo, commit, mapping: mapping() });
+  assert.equal(a, b);
+  assert.equal(indexCacheSize(), 1);
+  assert.equal(a.commit, commit);
+  assert.ok(a.files.has('Book One/Characters/Mara Vell.md'));
+  assert.ok(!a.files.has('Inbox Note.md'));
+  assert.deepEqual(a.names.get('mara vell'), ['Book One/Characters/Mara Vell.md']);
+  assert.deepEqual(a.linksIn.get('Book One/Characters/Mara Vell.md').map(l => l.path), ['Book One/Chapters/Chapter 01.md']);
+});
+
+test('a different repo path, mapping or commit gets its own index', async t => {
+  clearIndexCache();
+  const { root, repo, commit } = scratchRepo(t, FILES);
+  const base = await indexFor({ repo, commit, mapping: mapping() });
+  const alias = join(root, 'alias');
+  symlinkSync(repo, alias);
+  assert.notEqual(await indexFor({ repo: alias, commit, mapping: mapping() }), base);
+  assert.notEqual(await indexFor({ repo, commit, mapping: named('Renamed Harbor') }), base);
+  mkdirSync(join(repo, 'Book One/Places'), { recursive: true });
+  writeFileSync(join(repo, 'Book One/Places/New.md'), note('place', 'New'));
+  git(repo, 'add', '-A');
+  git(repo, 'commit', '-qm', 'second');
+  const next = git(repo, 'rev-parse', 'HEAD');
+  const later = await indexFor({ repo, commit: next, mapping: mapping() });
+  assert.notEqual(later, base);
+  assert.equal(later.commit, next);
+  assert.ok(later.files.has('Book One/Places/New.md'));
+});
+
+test('the cache holds at most eight indexes and evicts the least recently used', async t => {
+  clearIndexCache();
+  const { repo, commit } = scratchRepo(t, FILES);
+  const maps = Array.from({ length: 9 }, (_, i) => named(`Harbor ${i}`));
+  const first = await indexFor({ repo, commit, mapping: maps[0] });
+  for (const m of maps.slice(1)) await indexFor({ repo, commit, mapping: m });
+  assert.equal(indexCacheSize(), 8);
+  assert.notEqual(await indexFor({ repo, commit, mapping: maps[0] }), first);
+  assert.equal(indexCacheSize(), 8);
+});
+
+test('a failed read is not kept in the cache', async t => {
+  clearIndexCache();
+  const { repo } = scratchRepo(t, FILES);
+  await assert.rejects(indexFor({ repo, commit: '0'.repeat(40), mapping: mapping() }));
+  assert.equal(indexCacheSize(), 0);
+});
+
+test('a missing or unchecked mapping is refused before any read', async t => {
+  clearIndexCache();
+  const { repo, commit } = scratchRepo(t, FILES);
+  await assert.rejects(indexFor({ repo, commit, mapping: undefined }), { code: 'library-mapping-invalid' });
+  await assert.rejects(indexFor({ repo, commit, mapping: { kind: 'hybrid' } }), { code: 'library-mapping-invalid' });
+});
+
+test('a 3,000-file rebuild completes and its time is reported', { timeout: 300_000 }, async t => {
+  clearIndexCache();
+  const folders = ['Characters', 'Places', 'Research'];
+  const files = {};
+  for (let i = 0; i < 3000; i++) {
+    files[`Book One/${folders[i % 3]}/Note ${i}.md`] = note('character', `Note ${i}`, `Body ${i} [[Note ${(i + 1) % 3000}]]`);
+  }
+  const { repo, commit } = scratchRepo(t, files);
+  const started = performance.now();
+  const index = await indexFor({ repo, commit, mapping: mapping() });
+  const ms = performance.now() - started;
+  t.diagnostic(`3,000-file index rebuild: ${ms.toFixed(0)} ms`);
+  assert.equal(index.paths.length, 3000);
+});

packages/library/tests/mapping.test.mjs

@@ -1,5 +1,9 @@
 import test from 'node:test';
 import assert from 'node:assert/strict';
+import { execFileSync } from 'node:child_process';
+import { mkdtempSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
 import { checkMapping, classify, LibraryError } from '../src/index.mjs';
 import { mapping, mappingEntry } from './helpers.mjs';
 
@@ -45,7 +49,7 @@ test('C2-01c: universe-level prefixes lie outside every book, in a plain univers
 
 test('C2-01c: a draft takes kind, name and playground only, and comes back frozen with books []', () => {
   const m = mapping(e => { e.universes.idea = draft(); return e; });
-  assert.deepEqual(m.universes.idea, { kind: 'draft', name: 'New World', books: [], playground: ['Drafts/New World/'] });
+  assert.deepEqual(m.universes.idea, { kind: 'draft', name: 'New World', books: [], playground: ['Drafts/New World/'], supporting: [] });
   assert.ok(Object.isFrozen(m.universes.idea) && Object.isFrozen(m.universes.idea.books) && Object.isFrozen(m.universes.idea.playground));
   refuses(e => { e.universes.idea = { ...draft(), books: ['New World'] }; return e; }, 'library-mapping-invalid', /universes.idea is a draft and takes no books/);
   refuses(e => { e.universes.idea = { ...draft(), books: [] }; return e; }, 'library-mapping-invalid', /takes no books/);
@@ -56,6 +60,107 @@ test('C2-01c: a draft takes kind, name and playground only, and comes back froze
     refuses(e => { e.universes.harbor.kind = kind; return e; }, 'library-mapping-invalid', /universes.harbor.kind must be "hybrid" or "draft"/);
 });
 
+test('C2-01d: supporting prefixes at book level, universe level, in a hybrid and in a draft, [] when absent', () => {
+  const m = mapping(e => {
+    e.universes.harbor.supporting = ['Book One/Notes/', 'Harbor Notes/'];
+    e.universes.cross = { kind: 'hybrid', name: 'Cross', sources: ['harbor', 'second'], books: [], supporting: ['Crossover Notes/'] };
+    e.universes.idea = { ...draft(), supporting: ['Drafts/New World Notes/'] };
+    return e;
+  });
+  assert.deepEqual(m.universes.harbor.supporting, ['Book One/Notes/', 'Harbor Notes/']);
+  assert.deepEqual(m.universes.cross.supporting, ['Crossover Notes/']);
+  assert.deepEqual(m.universes.idea.supporting, ['Drafts/New World Notes/']);
+  assert.deepEqual(m.universes.second.supporting, []);
+  assert.ok(Object.isFrozen(m.universes.harbor.supporting) && Object.isFrozen(m.universes.second.supporting));
+  assert.deepEqual(mapping().universes.harbor.supporting, []);
+});
+
+test('C2-01d: each supporting prefix rule refuses with its code', () => {
+  const invalid = (change, pattern) => refuses(change, 'library-mapping-invalid', pattern);
+  invalid(e => { e.universes.harbor.supporting = ['Book One/Notes']; return e; }, /universes.harbor.supporting holds "Book One\/Notes", which is not a folder path ending in \//);
+  invalid(e => { e.universes.harbor.supporting = ['Book One/../Notes/']; return e; }, /which is not a folder path ending in \//);
+  invalid(e => { e.universes.harbor.supporting = 'Book One/Notes/'; return e; }, /universes.harbor.supporting must be a list/);
+  invalid(e => { e.universes.harbor.supporting = ['Book One/Notes/', 'Book One/Notes/Deep/']; return e; },
+    /supporting "Book One\/Notes\/" holds supporting "Book One\/Notes\/Deep\/"/);
+  invalid(e => { e.universes.harbor.supporting = ['Ideas/']; e.universes.idea = { ...draft(), supporting: ['Ideas/'] }; return e; },
+    /a supporting prefix is listed twice/);
+  invalid(e => { e.universes.harbor.supporting = ['Book One/']; return e; }, /universes.harbor.supporting "Book One\/" is the whole book folder "Book One"/);
+  invalid(e => { e.universes.harbor.books = ['Shelf/Book One']; e.universes.harbor.playground = []; e.universes.harbor.supporting = ['Shelf/']; return e; },
+    /universes.harbor.supporting "Shelf\/" holds its own book folder "Shelf\/Book One"/);
+  // Supporting is checked first in scope, so a supporting prefix holding a playground would hide it.
+  invalid(e => { e.universes.harbor.supporting = ['Book One/Workshop/']; e.universes.harbor.playground = ['Book One/Workshop/Playground/']; return e; },
+    /universes.harbor.supporting "Book One\/Workshop\/" holds playground "Book One\/Workshop\/Playground\/"/);
+  // Across entries any overlap would give one path two universes.
+  for (const [supporting, playground] of [['Ideas/', 'Ideas/'], ['Ideas/Deep/', 'Ideas/'], ['Ideas/', 'Ideas/Deep/']])
+    invalid(e => { e.universes.harbor.supporting = [supporting]; e.universes.idea = draft([playground]); return e; },
+      new RegExp(`universes.harbor.supporting "${supporting}" overlaps playground "${playground}" of universes.idea`));
+  refuses(e => { e.universes.harbor.supporting = ['Second World/Notes/']; return e; },
+    'library-supporting-other-universe', /universes.harbor.supporting "Second World\/Notes\/" lies inside book folder "Second World" of universes.second/);
+  refuses(e => { e.universes.second.books = ['Worlds/Second']; e.universes.harbor.supporting = ['Worlds/']; return e; },
+    'library-supporting-other-universe', /universes.harbor.supporting "Worlds\/" holds book folder "Worlds\/Second" of universes.second/);
+  refuses(e => { e.universes.idea = { ...draft(), supporting: ['Book One/Idea Notes/'] }; return e; },
+    'library-supporting-other-universe', /universes.idea.supporting "Book One\/Idea Notes\/" lies inside book folder "Book One" of universes.harbor/);
+});
+
+test('C2-01d: between the lists, a supporting prefix may equal its own playground, and a playground may hold its own supporting', () => {
+  const same = mapping(e => { e.universes.harbor.supporting = ['Book One/Playground/']; return e; });
+  assert.deepEqual([same.universes.harbor.playground, same.universes.harbor.supporting], [['Book One/Playground/'], ['Book One/Playground/']]);
+  const nested = mapping(e => { e.universes.harbor.supporting = ['Book One/Playground/Notes/']; return e; });
+  assert.deepEqual(nested.universes.harbor.supporting, ['Book One/Playground/Notes/']);
+});
+
+test('C2-01d: editor is optional, kept when given, and refuses anything but a plain name and email', () => {
+  assert.equal(Object.hasOwn(mapping(), 'editor'), false);
+  const editor = { name: 'Her Name', email: '[email protected]' };
+  const m = mapping(e => ({ ...e, editor }));
+  assert.deepEqual(m.editor, editor);
+  assert.notEqual(m.editor, editor);
+  assert.ok(Object.isFrozen(m.editor));
+  const invalid = (value, pattern) => refuses(e => ({ ...e, editor: value }), 'library-mapping-invalid', pattern);
+  for (const value of [null, 'Her Name', 7, ['Her Name', '[email protected]']]) invalid(value, /editor must be an object/);
+  invalid({ ...editor, signingKey: 'x' }, /editor has unknown key "signingKey"/);
+  // sage-2925: an optional Gitea login for her save, checked as the entry's user is.
+  assert.deepEqual(mapping(e => ({ ...e, editor: { ...editor, user: 'her.login-1' } })).editor, { ...editor, user: 'her.login-1' });
+  for (const user of ['', 'her login', 'her@host', 'a'.repeat(101), 7, null])
+    invalid({ ...editor, user }, /editor.user must be a plain account name/);
+  invalid({ name: 'Her Name' }, /editor.email must be non-empty text with no control character, < or >/);
+  invalid({ email: '[email protected]' }, /editor.name must be non-empty text/);
+  for (const bad of ['', '   ', 7, null, 'a\u0000b', 'a\nb', 'a\u001fb', 'a\u007fb', 'a\u0085b', 'a\u009fb', '<her>', 'a<b', 'a>b']) {
+    invalid({ ...editor, name: bad }, /editor.name must be non-empty text with no control character, < or >/);
+    invalid({ ...editor, email: bad }, /editor.email must be non-empty text with no control character, < or >/);
+  }
+  // sage-3601, sage-3606: git's crud() strips whitespace and , : ; < > " \ ' from both ends of an
+  // ident, so a value starting or ending with one refuses. Inner < > and controls refuse above.
+  const ends = [' ', '\u00a0', '\u3000', ',', ':', ';', '"', "'", '\\'];
+  for (const c of ends) for (const padded of [`${c}Her Name`, `Her Name${c}`]) {
+    invalid({ ...editor, name: padded }, /editor.name must not start or end with whitespace or any of , : ; " ' \\/);
+    invalid({ ...editor, email: padded }, /editor.email must not start or end with whitespace or any of , : ; " ' \\/);
+  }
+  for (const c of ['<', '>', '\n', '\t']) for (const padded of [`${c}Her Name`, `Her Name${c}`, `Her${c}Name`])
+    invalid({ ...editor, name: padded }, /editor.name must be non-empty text with no control character, < or >/);
+  assert.equal(mapping(e => ({ ...e, editor: { name: 'Her  Middle Name', email: '[email protected]' } })).editor.name, 'Her  Middle Name');
+  for (const name of ['Doe, Jane Q.', 'Jane: "Q" Doe', "O'Neil", 'Back\\slash Name'])
+    assert.equal(mapping(e => ({ ...e, editor: { name, email: '[email protected]' } })).editor.name, name);
+});
+
+// sage-3606: an accepted editor commits under exactly the saved ident, as author and committer. A
+// future git that strips more from an ident fails here.
+test('C2-01d: an accepted editor round-trips through a real git commit unchanged', t => {
+  const editor = mapping(e => ({ ...e, editor: { name: 'Doe, Jane Q.', email: '[email protected].' } })).editor;
+  const root = mkdtempSync(join(tmpdir(), 'library-ident-'));
+  t.after(() => rmSync(root, { recursive: true, force: true }));
+  // An ident in the environment would win over -c, so the commit runs without one. GIT_DIR and its
+  // family would beat -C (inside a hook, say), and git reads no global or system config (webby-0236 E5).
+  const env = Object.fromEntries(Object.entries(process.env).filter(([k]) => !/^GIT_(AUTHOR|COMMITTER)_/.test(k)));
+  for (const k of ['GIT_DIR', 'GIT_WORK_TREE', 'GIT_COMMON_DIR', 'GIT_INDEX_FILE']) delete env[k];
+  Object.assign(env, { GIT_CONFIG_GLOBAL: '/dev/null', GIT_CONFIG_NOSYSTEM: '1' });
+  const git = (...args) => execFileSync('git', ['-c', `user.name=${editor.name}`, '-c', `user.email=${editor.email}`,
+    '-c', 'commit.gpgsign=false', '-c', 'core.hooksPath=/dev/null', '-C', root, ...args], { encoding: 'utf8', env });
+  git('init', '-q');
+  git('commit', '-q', '--allow-empty', '-m', 'ident');
+  assert.equal(git('log', '-1', '--format=%an%n%ae%n%cn%n%ce'), `${editor.name}\n${editor.email}\n${editor.name}\n${editor.email}\n`);
+});
+
 test('no playground prefix holds another, and no book folder holds another', () => {
   refuses(e => { e.universes.harbor.playground = ['Book One/Playground/', 'Book One/Playground/Deep/']; return e; },
     'library-mapping-invalid', /holds playground/);

packages/library/tests/query-fixture.mjs

@@ -0,0 +1,31 @@
+// Scratch repos for the query and index tests (C2-05a). They are built under tmpdir(), as helpers.mjs
+// repo() does; the gate sets TMPDIR under /mnt/storage/scratch/tmp, never /tmp (RULINGS "tmpdir flag").
+// Bodies are made up.
+import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { dirname, join } from 'node:path';
+import { git } from './helpers.mjs';
+
+// A repo with one commit holding `files` (path -> text). Removed when the test ends.
+export function scratchRepo(t, files) {
+  const root = mkdtempSync(join(tmpdir(), 'r216-'));
+  t.after(() => rmSync(root, { recursive: true, force: true }));
+  const repo = join(root, 'books');
+  mkdirSync(repo);
+  git(repo, 'init', '-q', '-b', 'main');
+  for (const [path, text] of Object.entries(files)) {
+    mkdirSync(dirname(join(repo, path)), { recursive: true });
+    writeFileSync(join(repo, path), text);
+  }
+  git(repo, 'add', '-A');
+  git(repo, 'commit', '-qm', 'fixture');
+  return { root, repo, commit: git(repo, 'rev-parse', 'HEAD') };
+}
+
+// A note: front matter with a type and a name, optional extra front matter lines, then a body.
+export const note = (type, name, body = '', extra = []) => ['---', `type: ${type}`, `name: ${name}`, ...extra, '---', body, ''].join('\n');
+
+// The one exclusion the hybrid tests use, and the paths it hides. C2-15 (row 267) replaces the reading of
+// `exclude` (a path prefix today); swapping these two constants is the whole change to the tests.
+export const EXCLUSION = { exclude: 'Book One/Research' };
+export const EXCLUDED_PATHS = ['Book One/Research/Ferry Logs.md'];

packages/library/tests/query.test.mjs

@@ -0,0 +1,369 @@
+// Query tests for design 3 (C2-05a): universe isolation, scope labels, unmapped files, hybrids, paging
+// under the reply cap, refusals and manuscript paging. Fixtures are made up and built under the scratch area.
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import { REPLY_CAP } from '../../harness/src/tools.mjs';
+import { find, get, search, manuscript, universeInfo, QUERY_REPLY_CAP, LOOKUP_LIMIT, MANUSCRIPT_LINES } from '../src/query.mjs';
+import { mapping, MARKER } from './helpers.mjs';
+import { scratchRepo, note, EXCLUSION, EXCLUDED_PATHS } from './query-fixture.mjs';
+
+// A hybrid over harbor and second. Its one constraint is EXCLUSION (query-fixture.mjs) and it declares no
+// books or playground.
+const WITH_BLEND = e => ({
+  ...e,
+  universes: {
+    ...e.universes,
+    blend: {
+      kind: 'hybrid', name: 'Blend', sources: ['harbor', 'second'], books: [], playground: [],
+      constraints: [EXCLUSION], notes: 'made-up hybrid',
+    },
+  },
+});
+
+// PRD 1.14 levels (C2-01c): harbor gets a universe-level playground prefix outside every book, and a draft
+// universe has only playground prefixes. Files there have book null.
+const WITH_LEVELS = e => ({
+  ...WITH_BLEND(e),
+  universes: {
+    ...WITH_BLEND(e).universes,
+    harbor: { ...e.universes.harbor, playground: ['Book One/Playground/', 'Notes/Harbor/'] },
+    idea: { kind: 'draft', name: 'New World', playground: ['Drafts/New World/'] },
+  },
+});
+const LEVEL_FILES = {
+  'Notes/Harbor/Scraps.md': note('summary', 'Scraps', `${MARKER} loose`),
+  'Notes/Harbor/Chapters/Idea Chapter.md': `# Idea\n${MARKER} unbooked chapter\n`,
+  'Drafts/New World/Characters/Rin.md': note('character', 'Rin', `${MARKER} draft`),
+  'Drafts/New World/Summary.md': note('summary', 'Summary', `${MARKER} draft`),
+};
+
+const FILES = {
+  'Book One/Characters/Mara Vell.md': note('character', 'Mara Vell', `Grey eyes. ${MARKER}`,
+    ['appears_in: "[[Book One/Chapters/Chapter 01]]"', 'relationships:', '  - "[[Tomas]]"']),
+  'Book One/Characters/Tomas.md': note('character', 'Tomas', MARKER),
+  'Book One/Chapters/Chapter 01.md': `# One\n${MARKER} [[Mara Vell]] met [[Book One/Places/Harbor Town|the harbor]].\n`,
+  'Book One/Chapters/Chapter 02.md': 'Quiet. [[Ferry Logs]] [[Ilse]]\n',
+  'Book One/Places/Harbor Town.md': note('place', 'Harbor Town', `Salt. ${MARKER}`),
+  'Book One/Research/Ferry Logs.md': note('research', 'Ferry Logs', `Timetable. ${MARKER}`),
+  'Book One/Playground/What If.md': note('summary', 'What If', `${MARKER} [[Mara Vell]]`),
+  'Second World/Characters/Ilse.md': note('character', 'Ilse', `${MARKER} Ilse.`),
+  'Second World/Chapters/01.md': '# Elsewhere\n[[Ilse]] waits.\n',
+  'Inbox Note.md': `${MARKER}\n`,
+  'Book One/Board.canvas': '{"nodes":[]}\n',
+};
+
+const src = (ref, map = mapping()) => ({ repo: ref.repo, commit: ref.commit, mapping: map });
+const paths = reply => reply.results.map(r => r.path);
+
+test('the query reply cap equals the harness reply cap', () => {
+  assert.equal(QUERY_REPLY_CAP, REPLY_CAP);
+});
+
+test('find is bound to its universe and refuses a call without one', async t => {
+  const s = src(scratchRepo(t, FILES));
+  const names = paths(await find(s, { universe: 'harbor', query: '' }));
+  assert.ok(names.length > 0);
+  assert.ok(names.every(p => p.startsWith('Book One/')));
+  assert.ok(!names.includes('Second World/Characters/Ilse.md'));
+  await assert.rejects(find(s, { query: '' }), { code: 'query-argument-invalid' });
+  await assert.rejects(find(s, { universe: 'nowhere', query: '' }), { code: 'query-universe-unknown' });
+});
+
+test('every result carries its scope, and playground appears only when asked for', async t => {
+  const s = src(scratchRepo(t, FILES));
+  const canon = (await find(s, { universe: 'harbor', query: '' })).results;
+  assert.ok(canon.every(r => r.scope === 'canon'));
+  assert.ok(!canon.some(r => r.path.includes('/Playground/')));
+  const play = (await find(s, { universe: 'harbor', query: '', scope: 'playground' })).results;
+  assert.deepEqual(play.map(r => r.path), ['Book One/Playground/What If.md']);
+  assert.ok(play.every(r => r.scope === 'playground'));
+});
+
+test('unmapped files never appear in any reply', async t => {
+  const s = src(scratchRepo(t, FILES));
+  assert.deepEqual((await find(s, { universe: 'harbor', query: 'Inbox' })).results, []);
+  assert.deepEqual((await find(s, { universe: 'harbor', query: 'Board' })).results, []);
+  const hits = (await search(s, { universe: 'harbor', text: MARKER })).results;
+  assert.ok(hits.length > 0);
+  assert.ok(hits.every(r => r.path !== 'Inbox Note.md' && r.path !== 'Book One/Board.canvas'));
+});
+
+test('a hybrid sees its sources canon, minus exclusions, and no playground', async t => {
+  const s = src(scratchRepo(t, FILES), mapping(WITH_BLEND));
+  const reply = await find(s, { universe: 'blend', query: '' });
+  assert.deepEqual(paths(reply).sort(), [
+    'Book One/Chapters/Chapter 01.md', 'Book One/Chapters/Chapter 02.md',
+    'Book One/Characters/Mara Vell.md', 'Book One/Characters/Tomas.md', 'Book One/Places/Harbor Town.md',
+    'Second World/Chapters/01.md', 'Second World/Characters/Ilse.md',
+  ]);
+  assert.ok(reply.results.every(r => r.scope === 'canon' && ['harbor', 'second'].includes(r.universe)));
+  assert.deepEqual((await find(s, { universe: 'blend', query: '', scope: 'playground' })).results, []);
+  assert.deepEqual((await find(s, { universe: 'blend', query: 'Ferry' })).results, []);
+});
+
+test('a hybrid gets a source file it can see, and not an excluded or foreign one', async t => {
+  const ref = scratchRepo(t, FILES);
+  const hybrid = src(ref, mapping(WITH_BLEND));
+  const ilse = await get(hybrid, { universe: 'blend', path: 'Second World/Characters/Ilse.md' });
+  assert.equal(ilse.scope, 'canon');
+  assert.ok(ilse.links_in.some(l => l.path === 'Second World/Chapters/01.md'));
+  assert.equal(await get(hybrid, { universe: 'blend', path: 'Book One/Research/Ferry Logs.md' }), null);
+  assert.equal(await get(src(ref), { universe: 'harbor', path: 'Second World/Characters/Ilse.md' }), null);
+});
+
+test('get lists visible links both ways and drops a target another universe cannot see', async t => {
+  const ref = scratchRepo(t, FILES);
+  const harbor = src(ref);
+  const ch1 = await get(harbor, { universe: 'harbor', path: 'Book One/Chapters/Chapter 01.md' });
+  assert.ok(ch1.links_out.some(l => l.path === 'Book One/Characters/Mara Vell.md' && l.line === 2));
+  assert.ok(ch1.links_out.some(l => l.path === 'Book One/Places/Harbor Town.md'));
+  const ch2 = await get(harbor, { universe: 'harbor', path: 'Book One/Chapters/Chapter 02.md' });
+  assert.ok(ch2.links_out.some(l => l.path === 'Book One/Research/Ferry Logs.md'));
+  assert.ok(!ch2.links_out.some(l => l.path === 'Second World/Characters/Ilse.md'));
+  const mara = await get(harbor, { universe: 'harbor', path: 'Book One/Characters/Mara Vell.md' });
+  assert.ok(mara.links_in.some(l => l.path === 'Book One/Chapters/Chapter 01.md'));
+  assert.ok(mara.links_in.some(l => l.path === 'Book One/Playground/What If.md'));
+  assert.ok(mara.links_out.some(l => l.path === 'Book One/Characters/Tomas.md' && l.field === 'relationships'));
+  assert.ok(mara.links_out.some(l => l.path === 'Book One/Chapters/Chapter 01.md' && l.field === 'appears_in'));
+  const blendCh2 = await get(src(ref, mapping(WITH_BLEND)), { universe: 'blend', path: 'Book One/Chapters/Chapter 02.md' });
+  assert.ok(blendCh2.links_out.some(l => l.path === 'Second World/Characters/Ilse.md'));
+});
+
+test('a long list pages by position, never cuts an item, and returns 50 per page', async t => {
+  const files = { ...FILES };
+  for (let i = 1; i <= 120; i++) files[`Book One/Places/Note ${i}.md`] = note('place', `Note ${i}`);
+  const s = src(scratchRepo(t, files));
+  const seen = [];
+  let offset = 0;
+  for (let pages = 0; pages < 10; pages++) {
+    const reply = await find(s, { universe: 'harbor', query: 'Note', offset });
+    assert.ok(JSON.stringify(reply).length <= QUERY_REPLY_CAP);
+    assert.ok(reply.results.length <= LOOKUP_LIMIT);
+    if (pages === 0) assert.equal(reply.results.length, LOOKUP_LIMIT);
+    seen.push(...paths(reply));
+    if (reply.next === null) break;
+    offset = reply.next;
+  }
+  assert.equal(seen.length, 120);
+  assert.equal(new Set(seen).size, 120);
+});
+
+test('a page stays under the reply cap when items are large', async t => {
+  const big = 'x'.repeat(2000);
+  const files = { ...FILES };
+  for (let i = 1; i <= 40; i++) files[`Book One/Places/Big ${i}.md`] = note('place', `Big ${i}`, '', [`appears_in: "${big}"`]);
+  const s = src(scratchRepo(t, files));
+  const first = await find(s, { universe: 'harbor', query: 'Big' });
+  assert.ok(JSON.stringify(first).length <= QUERY_REPLY_CAP);
+  assert.ok(first.results.length > 0 && first.results.length < 40);
+  assert.notEqual(first.next, null);
+  const seen = [];
+  let offset = 0;
+  for (let pages = 0; pages < 10; pages++) {
+    const reply = await find(s, { universe: 'harbor', query: 'Big', offset });
+    assert.ok(JSON.stringify(reply).length <= QUERY_REPLY_CAP);
+    seen.push(...paths(reply));
+    if (reply.next === null) break;
+    offset = reply.next;
+  }
+  assert.equal(new Set(seen).size, 40);
+});
+
+test('a search line too long to fit alone comes back marked, with no excerpt, and the other hits still return', async t => {
+  const huge = 'y'.repeat(QUERY_REPLY_CAP + 1000);
+  const s = src(scratchRepo(t, { ...FILES, 'Book One/Places/Wall.md': note('place', 'Wall', `${huge} ${MARKER}`) }));
+  const reply = await search(s, { universe: 'harbor', text: 'yyyyyyyy' });
+  assert.deepEqual(reply.results, [{ path: 'Book One/Places/Wall.md', line: 5, excerpt: null, excerpt_too_long: true, scope: 'canon' }]);
+  const mixed = await search(s, { universe: 'harbor', text: MARKER.toLowerCase() });
+  assert.ok(mixed.results.some(r => r.excerpt_too_long === true));
+  assert.ok(mixed.results.some(r => typeof r.excerpt === 'string' && !('excerpt_too_long' in r)));
+  assert.ok(JSON.stringify(mixed).length <= QUERY_REPLY_CAP);
+});
+
+test('a find item that cannot fit alone is refused, not cut', async t => {
+  const huge = 'y'.repeat(QUERY_REPLY_CAP + 1000);
+  const s = src(scratchRepo(t, { ...FILES, 'Book One/Places/Wall.md': note('place', 'Wall', '', [`appears_in: "${huge}"`]) }));
+  await assert.rejects(find(s, { universe: 'harbor', query: 'Wall' }), { code: 'query-item-too-large' });
+});
+
+test('get pages its lines, and the next line picks up where the page stopped', async t => {
+  const body = `${Array.from({ length: 500 }, (_, i) => `Line ${i + 1} ${'z'.repeat(120)}`).join('\n')}\n`;
+  const s = src(scratchRepo(t, { ...FILES, 'Book One/Chapters/Long.md': body }));
+  const first = await get(s, { universe: 'harbor', path: 'Book One/Chapters/Long.md' });
+  assert.equal(first.lines[0][0], 1);
+  assert.ok(first.lines.length < 501);
+  assert.notEqual(first.next, null);
+  let from = 1, count = 0;
+  for (let pages = 0; pages < 10; pages++) {
+    const page = await get(s, { universe: 'harbor', path: 'Book One/Chapters/Long.md', from });
+    count += page.lines.length;
+    if (page.next === null) break;
+    from = page.next;
+  }
+  assert.equal(count, 501);
+});
+
+test('get refuses a file whose front matter alone is over the cap, and a line alone is over the cap', async t => {
+  const huge = 'q'.repeat(QUERY_REPLY_CAP + 1000);
+  const s = src(scratchRepo(t, {
+    ...FILES,
+    'Book One/Places/Heavy.md': note('place', 'Heavy', '', [`appears_in: "${huge}"`]),
+    'Book One/Chapters/Wide.md': `${huge}\n`,
+  }));
+  await assert.rejects(get(s, { universe: 'harbor', path: 'Book One/Places/Heavy.md' }), { code: 'query-item-too-large' });
+  await assert.rejects(get(s, { universe: 'harbor', path: 'Book One/Chapters/Wide.md' }), { code: 'query-item-too-large' });
+});
+
+test('get pages the links of a hub note, every page carries the front matter, and the pages add up', async t => {
+  const files = { ...FILES };
+  for (let i = 1; i <= 900; i++) files[`Book One/Chapters/Mention ${i}.md`] = `[[Tomas]] ${'w'.repeat(60)}\n`;
+  const s = src(scratchRepo(t, files));
+  const seen = [];
+  const PAST_END = 1000;
+  let linksFrom = 0, pages = 0, lines = 0, from = 1;
+  for (; pages < 40; pages++) {
+    const page = await get(s, { universe: 'harbor', path: 'Book One/Characters/Tomas.md', from, links_from: linksFrom });
+    assert.ok(JSON.stringify(page).length <= QUERY_REPLY_CAP);
+    assert.equal(page.frontmatter.name, 'Tomas');
+    seen.push(...page.links_in.map(l => l.path));
+    if (from !== PAST_END) lines += page.lines.length;
+    // Once the lines are read, ask past the last one: the page then carries links alone.
+    from = page.next ?? PAST_END;
+    if (page.links_next === null && page.next === null) break;
+    if (page.links_next !== null) linksFrom = page.links_next;
+  }
+  assert.ok(pages > 1, 'the hub needed more than one page');
+  assert.ok(pages < 40);
+  assert.equal(seen.filter(p => p.startsWith('Book One/Chapters/Mention ')).length, 900);
+  assert.equal(new Set(seen).size, seen.length, 'no link comes back twice');
+  assert.equal(lines, 6, 'the five lines of the note and the empty one after its last newline');
+  const tail = await get(s, { universe: 'harbor', path: 'Book One/Characters/Tomas.md', from: PAST_END });
+  assert.deepEqual(tail.lines, []);
+  assert.equal(tail.next, null);
+});
+
+test('get rejects a bad links_from', async t => {
+  const s = src(scratchRepo(t, FILES));
+  await assert.rejects(get(s, { universe: 'harbor', path: 'Book One/Characters/Tomas.md', links_from: -1 }), { code: 'query-argument-invalid' });
+  const past = await get(s, { universe: 'harbor', path: 'Book One/Characters/Tomas.md', links_from: 99 });
+  assert.deepEqual([past.links_out, past.links_in, past.links_next], [[], [], null]);
+});
+
+test('search returns scoped line hits, case-insensitively, and refuses empty text', async t => {
+  const s = src(scratchRepo(t, FILES));
+  const reply = await search(s, { universe: 'harbor', text: 'marker' });
+  assert.ok(reply.results.length > 0);
+  assert.ok(reply.results.every(r => r.scope === 'canon' && r.path.startsWith('Book One/') && Number.isInteger(r.line)));
+  assert.ok(reply.results.some(r => r.path === 'Book One/Chapters/Chapter 01.md' && r.line === 2));
+  await assert.rejects(search(s, { universe: 'harbor', text: '' }), { code: 'query-argument-invalid' });
+});
+
+test('a manuscript call returns one chapter, at most 400 lines, and names its next line', async t => {
+  const long = `${Array.from({ length: 900 }, (_, i) => `Scene ${i + 1}`).join('\n')}\n`;
+  const s = src(scratchRepo(t, { ...FILES, 'Book One/Chapters/Long Chapter.md': long }));
+  const first = await manuscript(s, { universe: 'harbor', book: 'Book One', chapter: 'Long Chapter' });
+  assert.equal(first.lines.length, MANUSCRIPT_LINES);
+  assert.equal(first.next, MANUSCRIPT_LINES + 1);
+  const second = await manuscript(s, { universe: 'harbor', book: 'Book One', chapter: 'Long Chapter', from: first.next });
+  assert.equal(second.lines[0][0], MANUSCRIPT_LINES + 1);
+});
+
+test('a manuscript call without a chapter returns the first chapter in path order and names the next', async t => {
+  const s = src(scratchRepo(t, FILES));
+  const first = await manuscript(s, { universe: 'harbor', book: 'Book One' });
+  assert.equal(first.path, 'Book One/Chapters/Chapter 01.md');
+  assert.equal(first.next_chapter, 'Chapter 02');
+  const last = await manuscript(s, { universe: 'harbor', book: 'Book One', chapter: 'Chapter 02' });
+  assert.equal(last.path, 'Book One/Chapters/Chapter 02.md');
+  assert.equal(last.next_chapter, null);
+  assert.equal(await manuscript(s, { universe: 'harbor', book: 'Book One', chapter: 'Nope' }), null);
+});
+
+test('a chapter name that matches two visible files is refused', async t => {
+  const s = src(scratchRepo(t, { ...FILES, 'Book One/Chapters/Part/Chapter 01.md': 'Again.\n' }));
+  await assert.rejects(manuscript(s, { universe: 'harbor', book: 'Book One', chapter: 'Chapter 01' }), { code: 'query-chapter-ambiguous' });
+});
+
+test('a hybrid reads a source chapter through its declared sources only', async t => {
+  const ref = scratchRepo(t, FILES);
+  const hybrid = await manuscript(src(ref, mapping(WITH_BLEND)), { universe: 'blend', book: 'Second World', chapter: '01' });
+  assert.equal(hybrid.path, 'Second World/Chapters/01.md');
+  assert.equal(hybrid.scope, 'canon');
+  assert.equal(await manuscript(src(ref), { universe: 'harbor', book: 'Second World', chapter: '01' }), null);
+});
+
+test('universe info reports a hybrid sources, constraints and notes, and refuses an unknown universe', async t => {
+  const s = src(scratchRepo(t, FILES), mapping(WITH_BLEND));
+  const blend = await universeInfo(s, { universe: 'blend' });
+  assert.equal(blend.kind, 'hybrid');
+  assert.deepEqual(blend.sources, ['harbor', 'second']);
+  assert.deepEqual(blend.constraints, [EXCLUSION]);
+  assert.equal(blend.notes, 'made-up hybrid');
+  const harbor = await universeInfo(s, { universe: 'harbor' });
+  assert.equal(harbor.kind, 'universe');
+  assert.equal(harbor.sources, undefined);
+  await assert.rejects(universeInfo(s, { universe: 'ghost' }), { code: 'query-universe-unknown' });
+});
+
+test('an exclusion hides what it names from a hybrid and from nothing else', async t => {
+  const ref = scratchRepo(t, FILES);
+  const hybrid = src(ref, mapping(WITH_BLEND));
+  const seen = paths(await find(hybrid, { universe: 'blend', query: '' }));
+  for (const path of EXCLUDED_PATHS) assert.ok(!seen.includes(path), `${path} stays hidden`);
+  const own = paths(await find(src(ref), { universe: 'harbor', query: '' }));
+  for (const path of EXCLUDED_PATHS) assert.ok(own.includes(path), `${path} stays visible to its own universe`);
+});
+
+test('PRD 1.14: a lookup that names a book leaves book-null files out', async t => {
+  const s = src(scratchRepo(t, { ...FILES, ...LEVEL_FILES }), mapping(WITH_LEVELS));
+  const all = paths(await find(s, { universe: 'harbor', query: '', scope: 'playground' }));
+  assert.deepEqual(all.sort(), ['Book One/Playground/What If.md', 'Notes/Harbor/Chapters/Idea Chapter.md', 'Notes/Harbor/Scraps.md']);
+  const booked = await find(s, { universe: 'harbor', query: '', scope: 'playground', book: 'Book One' });
+  assert.deepEqual(paths(booked), ['Book One/Playground/What If.md']);
+  assert.ok(booked.results.every(r => r.book === 'Book One'));
+  const hits = (await search(s, { universe: 'harbor', text: 'unbooked', scope: 'playground' })).results;
+  assert.deepEqual(hits.map(r => r.path), ['Notes/Harbor/Chapters/Idea Chapter.md']);
+  assert.deepEqual((await search(s, { universe: 'harbor', text: 'unbooked', scope: 'playground', book: 'Book One' })).results, []);
+});
+
+test('PRD 1.14: library_manuscript never reads a book-null file', async t => {
+  const s = src(scratchRepo(t, { ...FILES, ...LEVEL_FILES }), mapping(WITH_LEVELS));
+  // The unbooked file sits under a manuscript folder, so it has type manuscript and book null.
+  const listed = await find(s, { universe: 'harbor', query: 'Idea', scope: 'playground' });
+  assert.deepEqual(listed.results.map(r => [r.path, r.type, r.book]), [['Notes/Harbor/Chapters/Idea Chapter.md', 'manuscript', null]]);
+  assert.equal(await manuscript(s, { universe: 'harbor', book: 'Book One', scope: 'playground', chapter: 'Idea Chapter' }), null);
+  assert.equal(await manuscript(s, { universe: 'harbor', book: 'Book One', scope: 'playground' }), null);
+  assert.equal(await manuscript(s, { universe: 'harbor', book: 'Notes', scope: 'playground', chapter: 'Idea Chapter' }), null);
+});
+
+test('PRD 1.14: a draft universe has no canon, so its lookups return files only with scope playground', async t => {
+  const s = src(scratchRepo(t, { ...FILES, ...LEVEL_FILES }), mapping(WITH_LEVELS));
+  assert.deepEqual((await find(s, { universe: 'idea', query: '' })).results, []);
+  assert.deepEqual((await search(s, { universe: 'idea', text: MARKER })).results, []);
+  const found = await find(s, { universe: 'idea', query: '', scope: 'playground' });
+  assert.deepEqual(paths(found).sort(), ['Drafts/New World/Characters/Rin.md', 'Drafts/New World/Summary.md']);
+  assert.ok(found.results.every(r => r.scope === 'playground' && r.universe === 'idea' && r.book === null));
+  const hits = (await search(s, { universe: 'idea', text: 'draft', scope: 'playground' })).results;
+  assert.equal(hits.length, 2);
+  const rin = await get(s, { universe: 'idea', path: 'Drafts/New World/Characters/Rin.md' });
+  assert.equal(rin.scope, 'playground');
+  assert.equal(await get(s, { universe: 'harbor', path: 'Drafts/New World/Characters/Rin.md' }), null);
+});
+
+test('PRD 1.14: library_universe on a draft returns its kind, name and prefixes', async t => {
+  const s = src(scratchRepo(t, { ...FILES, ...LEVEL_FILES }), mapping(WITH_LEVELS));
+  const draft = await universeInfo(s, { universe: 'idea' });
+  assert.equal(draft.kind, 'draft');
+  assert.equal(draft.name, 'New World');
+  assert.deepEqual(draft.playground, ['Drafts/New World/']);
+  assert.deepEqual(draft.books, []);
+  assert.equal(draft.sources, undefined);
+});
+
+test('a hybrid gets a source playground file as null, while the source gets it with scope playground', async t => {
+  const ref = scratchRepo(t, FILES);
+  const path = 'Book One/Playground/What If.md';
+  assert.equal(await get(src(ref, mapping(WITH_BLEND)), { universe: 'blend', path }), null);
+  const own = await get(src(ref), { universe: 'harbor', path });
+  assert.equal(own.scope, 'playground');
+});

packages/library/tests/scope.test.mjs

@@ -53,3 +53,44 @@ test('C2-01c: a canon file linking into a draft gives R6, and into its own unive
     assert.deepEqual(codes(path), [], path);
   }
 });
+
+// Supporting prefixes at three levels (C2-01d). Harbor's book-level prefix sits in both lists, and a
+// second book-level prefix is supporting only.
+const supporting = () => mapping(e => {
+  e.universes.harbor.playground = ['Book One/Playground/', 'Book One/Sketches/'];
+  e.universes.harbor.supporting = ['Book One/Playground/', 'Book One/Notes/', 'Harbor Notes/'];
+  e.universes.idea = { kind: 'draft', name: 'New World', playground: ['Drafts/New World/'], supporting: ['Drafts/New World Notes/'] };
+  return e;
+});
+
+test('C2-01d: each supporting level gives its universe, and its book or null', () => {
+  const m = supporting();
+  assert.deepEqual(classify(m, 'Book One/Notes/Characters/Mara.md'),
+    { scope: 'supporting', universe: 'harbor', book: 'Book One', type: 'character', folder: 'Characters' });
+  assert.deepEqual(classify(m, 'Harbor Notes/Places/Island.md'),
+    { scope: 'supporting', universe: 'harbor', book: null, type: 'place', folder: 'Places' });
+  assert.deepEqual(classify(m, 'Harbor Notes/Loose.md'), { scope: 'supporting', universe: 'harbor', book: null, type: null, folder: null });
+  assert.deepEqual(classify(m, 'Drafts/New World Notes/Chapters/Open.md'),
+    { scope: 'supporting', universe: 'idea', book: null, type: 'manuscript', folder: 'Chapters' });
+  assert.deepEqual(classify(m, 'Drafts/New World/Ana.md'), { scope: 'playground', universe: 'idea', book: null, type: null, folder: null });
+  assert.deepEqual(classify(m, 'Book One/Places/Dock.md'), { scope: 'canon', universe: 'harbor', book: 'Book One', type: 'place', folder: 'Places' });
+});
+
+test('C2-01d: supporting comes before playground; a folder in both lists is supporting, one in the playground only stays playground', () => {
+  const m = supporting();
+  assert.deepEqual(classify(m, 'Book One/Playground/What If.md'),
+    { scope: 'supporting', universe: 'harbor', book: 'Book One', type: null, folder: null });
+  assert.deepEqual(classify(m, 'Book One/Sketches/Research/Tides.md'),
+    { scope: 'playground', universe: 'harbor', book: 'Book One', type: 'research', folder: 'Research' });
+  // A playground may hold a supporting prefix of its own entry: the inner folder is supporting.
+  const nested = mapping(e => { e.universes.harbor.supporting = ['Book One/Playground/Notes/']; return e; });
+  assert.equal(classify(nested, 'Book One/Playground/Notes/A.md').scope, 'supporting');
+  assert.equal(classify(nested, 'Book One/Playground/A.md').scope, 'playground');
+});
+
+test('C2-01d: only .md files are supporting; a .canvas or .base under a supporting prefix is unmapped', () => {
+  const m = supporting();
+  for (const path of ['Book One/Notes/Board.canvas', 'Harbor Notes/Table.base', 'Drafts/New World Notes/Map.canvas',
+    'Harbor Notes/cover.png', 'Harbor Notesx/a.md'])
+    assert.deepEqual(classify(m, path), { scope: 'unmapped' }, path);
+});

packages/library/tests/supporting.test.mjs

@@ -0,0 +1,92 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { inspect } from 'node:util';
+import { LibraryError, supportingPath } from '../src/index.mjs';
+import { mapping } from './helpers.mjs';
+
+// C2-01d (M12): the path checks an agent write passes. The tree is a listTree array built by hand,
+// with a symlink, a gitlink, case twins and an NFC name, so no git is needed.
+const m = mapping(e => {
+  e.universes.harbor.playground = ['Book One/Playground/', 'Book One/Sketches/'];
+  e.universes.harbor.supporting = ['Book One/Playground/', 'Book One/Notes/', 'Harbor Notes/'];
+  e.universes.second.supporting = ['Second Notes/'];
+  e.universes.idea = { kind: 'draft', name: 'New World', playground: ['Drafts/New World/'], supporting: ['Drafts/New World Notes/'] };
+  return e;
+});
+const blob = (path, mode = '100644') => ({ mode, type: mode === '160000' ? 'commit' : 'blob', oid: '0'.repeat(40), size: 1, path });
+const tree = [
+  blob('Book One/Characters/Mara Vell.md'),
+  blob('Book One/Notes/Existing.md'),
+  blob('Book One/Notes/Linked', '120000'),
+  blob('Book One/Notes/Vendor', '160000'),
+  blob('Book One/Notes/Pointer.md', '120000'),
+  blob('Book One/Notes/Case/Twin.md'),
+  blob('Book One/Notes/Café.md'),
+  blob('Harbor Notes/Places/Island.md'),
+];
+const refuses = (universe, path, pattern) => assert.throws(() => supportingPath(m, universe, path, tree),
+  e => e instanceof LibraryError && e.code === 'library-write-story-path' && pattern.test(e.message), inspect(path));
+
+test('C2-01d: a path passes at book level, universe level, in a draft and in a folder in both lists', () => {
+  for (const [universe, path] of [['harbor', 'Book One/Notes/Characters/New.md'], ['harbor', 'Book One/Notes/Existing.md'],
+    ['harbor', 'Harbor Notes/Places/Island.md'], ['harbor', 'Harbor Notes/Loose.md'], ['idea', 'Drafts/New World Notes/Ana.md'],
+    ['harbor', 'Book One/Playground/What If.md'], ['second', 'Second Notes/A.md'], ['harbor', 'Book One/Notes/Café.md']])
+    assert.equal(supportingPath(m, universe, path, tree), path);
+  assert.equal(supportingPath(m, 'harbor', 'Book One/Notes/x.md', []), 'Book One/Notes/x.md');
+});
+
+test('C2-01d: a path of exactly 1024 bytes passes, and 1025 bytes made of multi-byte characters refuses', () => {
+  const prefix = 'Harbor Notes/';
+  const exact = `${prefix}${'a'.repeat(1024 - prefix.length - 3)}.md`;
+  assert.equal(Buffer.byteLength(exact), 1024);
+  assert.equal(supportingPath(m, 'harbor', exact, tree), exact);
+  // é is two bytes: 1025 bytes but far fewer characters.
+  const name = 'é'.repeat((1025 - prefix.length - 3 - 1) / 2);
+  const long = `${prefix}${name}a.md`;
+  assert.equal(Buffer.byteLength(long), 1025);
+  assert.ok(long.length < 1024);
+  refuses('harbor', long, /is longer than 1024 bytes/);
+});
+
+test('C2-01d: a path outside the universe\'s supporting folders refuses', () => {
+  const outside = /is not under a supporting folder of universe/;
+  for (const path of ['Inbox Note.md', 'Book One/Notes/Board.canvas', 'Book One/Notes/Table.base', 'Book One/Notes/cover.png',
+    'Book One/Characters/Mara Vell.md', 'Book One/Sketches/Idea.md', 'Drafts/New World/Ana.md', 'Second Notes/A.md', 'Book One/Notes.md'])
+    refuses('harbor', path, outside);
+  refuses('idea', 'Book One/Notes/A.md', /universe "idea"/);
+  refuses('nowhere', 'Book One/Notes/A.md', /universe "nowhere"/);
+});
+
+test('C2-01d: malformed paths refuse by class, in order', () => {
+  refuses('harbor', '/Book One/Notes/A.md', /"\/Book One\/Notes\/A.md" is absolute/);
+  for (const path of ['Book One/Notes/../Notes/A.md', 'Book One/Notes/./A.md', 'Book One//Notes/A.md', 'Book One/Notes/A/', 'Book One/Notes/..'])
+    refuses('harbor', path, /has an empty, \. or \.\. segment/);
+  refuses('harbor', 'Book One/Notes/A\\B.md', /holds a backslash/);
+  for (const c of ['\u0000', '\u0001', '\n', '\u001f', '\u007f', '\u0085', '\u009f'])
+    assert.throws(() => supportingPath(m, 'harbor', `Book One/Notes/A${c}.md`, tree),
+      e => e.code === 'library-write-story-path' && e.message === 'library-write-story-path: the path holds a control character');
+  for (const path of [7, null, undefined, 1n, ['Book One/Notes/A.md']]) refuses('harbor', path, /the path must be a string/);
+  // A backslash in a path that is also absolute names the backslash: the order is fixed.
+  refuses('harbor', '/a\\b.md', /holds a backslash/);
+  assert.throws(() => supportingPath(m, 'harbor', 'Book One/Notes/A.md', { 'Book One/Notes/A.md': '100644' }), TypeError);
+  assert.throws(() => supportingPath(m, 'harbor', 'Book One/Notes/A.md'), TypeError);
+});
+
+test('C2-01d: a symlink or gitlink on the way, or at the path itself, refuses', () => {
+  refuses('harbor', 'Book One/Notes/Linked/A.md', /goes through the symlink or gitlink "Book One\/Notes\/Linked"/);
+  refuses('harbor', 'Book One/Notes/Vendor/Deep/A.md', /goes through the symlink or gitlink "Book One\/Notes\/Vendor"/);
+  refuses('harbor', 'Book One/Notes/Pointer.md', /goes through the symlink or gitlink "Book One\/Notes\/Pointer.md"/);
+});
+
+test('C2-01d: a name that differs from a tree name only in case or Unicode form refuses, at the file or any folder', () => {
+  refuses('harbor', 'Book One/Notes/existing.md', /differs only in case or Unicode form from "Book One\/Notes\/Existing.md"/);
+  refuses('harbor', 'Book One/Notes/case/New.md', /differs only in case or Unicode form from "Book One\/Notes\/Case"/);
+  refuses('harbor', 'Book One/Notes/CASE/Twin.md', /from "Book One\/Notes\/Case"/);
+  refuses('harbor', 'Harbor notes/A.md', /is not under a supporting folder/);
+  // NFD e + combining acute against the NFC name in the tree: one file on APFS.
+  refuses('harbor', 'Book One/Notes/Café.md', /differs only in case or Unicode form from "Book One\/Notes\/Café.md"/);
+  // A tree that already holds case twins refuses a write to either (R7).
+  const twins = [...tree, blob('Book One/Notes/existing.md')];
+  for (const path of ['Book One/Notes/Existing.md', 'Book One/Notes/existing.md'])
+    assert.throws(() => supportingPath(m, 'harbor', path, twins), e => e.code === 'library-write-story-path' && /differs only in case/.test(e.message));
+});

packages/library/tests/survey.test.mjs

@@ -1,6 +1,6 @@
 import test from 'node:test';
 import assert from 'node:assert/strict';
-import { writeFileSync } from 'node:fs';
+import { readFileSync, writeFileSync } from 'node:fs';
 import { join } from 'node:path';
 import { spawnSync } from 'node:child_process';
 import { fileURLToPath } from 'node:url';
@@ -70,12 +70,23 @@ test('with --mapping the survey adds scope, resolver step and problem counts', a
   assert.equal(out.code, 0, out.stderr);
   const tail = out.stdout.trimEnd().split('\n').slice(-3);
   assert.deepEqual(tail, [
-    'scopes canon 5, playground 1, unmapped 3; indexed 6',
+    'scopes canon 5, playground 1, supporting 0, unmapped 3; indexed 6',
     'resolved root 2, vault-prefix 1, relative 2, shortest 3, unresolved 0',
     'problems R1 0, R2 3, R3 0, R4 0, R5 0, R6 0, R7 0']);
   for (const s of NEVER) assert.ok(!out.stdout.includes(s), s);
 });
 
+test('C2-01d: with --mapping the survey counts supporting files', async t => {
+  const r = repo(t);
+  const entry = JSON.parse(readFileSync(join(FIXTURES, 'mapping.json'), 'utf8'));
+  entry.universes.harbor.supporting = ['Book One/Places/'];
+  const file = join(r.root, 'supporting.json');
+  writeFileSync(file, JSON.stringify(entry));
+  const out = await run(['survey', r.repo, '--mapping', file]);
+  assert.equal(out.code, 0, out.stderr);
+  assert.match(out.stdout, /^scopes canon 4, playground 1, supporting 1, unmapped 3; indexed 6$/m);
+});
+
 test('survey exit codes: usage 4, bad mapping 3, unreadable repo 2', async t => {
   const r = repo(t);
   for (const args of [[], ['scan', r.repo], ['survey'], ['survey', r.repo, '--mapping'], ['survey', r.repo, '--other'], ['survey', r.repo, r.repo]])

packages/tasks/requirements.json

@@ -1,6 +1,6 @@
 {
   "prd": "docs/prd/mosaic-stack.md",
-  "version": "1.15",
+  "version": "1.17",
   "requirements": [
     { "id": "REQ-ROLE-1", "title": "Each role is a reviewed roles/<name>.json: contract, authority map, credentials" },
     { "id": "REQ-ROLE-2", "title": "One holder per role instance, one per assistant session; the chief of staff may end a run, others need a decision" },
@@ -77,13 +77,15 @@
     { "id": "REQ-SESS-1", "title": "Each session shows its lifetime count of completed compactions on pi and Claude Code; an unproven count shows unknown" },
     { "id": "REQ-SESS-2", "title": "Clear context retires a session after a safe stop and starts a fresh successor with none of the old context" },
     { "id": "REQ-SESS-3", "title": "Every session start passes the launch checks: authority, route, revocation, kill switch, limits and admission" },
-    { "id": "REQ-LIB-1", "title": "A library maps the user's repository onto universes, books, types, playgrounds and supporting folders, set by a human" },
-    { "id": "REQ-LIB-2", "title": "Scope comes from the path, lookups default to canon, and a playground or supporting file is never cited as canon" },
+    { "id": "REQ-LIB-1", "title": "A human-set library maps the user's repository onto universes, books, types, playgrounds, supporting and archive folders" },
+    { "id": "REQ-LIB-2", "title": "Scope comes from the path or a DOCX's source, lookups default to canon, and only canon files are ever cited as canon" },
     { "id": "REQ-LIB-3", "title": "Universes stay separate; a crossover is a hybrid universe only a human creates, reading its sources' canon" },
-    { "id": "REQ-LIB-4", "title": "Git holds every change; the bus fast-forwards a read-only mirror every 60 seconds and agents read only that" },
+    { "id": "REQ-LIB-4", "title": "Git holds every change. The bus fast-forwards a read-only mirror every 60 seconds, the one place agents read Markdown" },
     { "id": "REQ-LIB-5", "title": "Agents check the library through typed lookup tools that name the commit and show links out and in" },
     { "id": "REQ-LIB-6", "title": "Agents never write story, only docs in supporting folders a human marks. Chat is free text, and any citation is checked" },
     { "id": "REQ-LIB-7", "title": "One chat room with several creative agents, addressed by leading @tags; an unknown tag sends nothing" },
+    { "id": "REQ-LIB-8", "title": "Case 2 story files become DOCX by a human-only one-way import or in the editor; Markdown stays for notes and docs" },
+    { "id": "REQ-LIB-9", "title": "The Console's DOCX editor: only a human saves, each save is one commit, and the editor code is vendored and pinned" },
     { "id": "REQ-INST-1", "title": "The installer offers optional components: pinned, health-checked, removable, switched on in config; first is SearXNG" },
     { "id": "REQ-INST-2", "title": "With no OIDC provider to configure, the installer deploys a bundled Pocket ID, Q203 (post-v1)" },
     { "id": "REQ-INST-3", "title": "One-command install of a named instance from a profile, and one-command upgrade with backup and rollback" }

packages/tasks/tests/requirements.test.mjs

@@ -18,10 +18,10 @@ test("the list holds the PRD's requirement ids, in its order, at its version", (
   const ids = [...prd.matchAll(/^- \*\*(REQ-[A-Z]+-[0-9]+)\.\*\*/gm)].map((m) => m[1]);
   // Any other mention of a bold id would be a bullet this pattern missed.
   assert.equal(ids.length, [...prd.matchAll(/\*\*REQ-/g)].length);
-  assert.equal(ids.length, 85);
+  assert.equal(ids.length, 87);
   assert.deepEqual(list.requirements.map((r) => r.id), ids);
   assert.match(prd, new RegExp(`^- Status: approved, version ${list.version.replace('.', '\\.')}\\.`, 'm'));
-  assert.deepEqual([list.prd, list.version], ['docs/prd/mosaic-stack.md', '1.15']);
+  assert.deepEqual([list.prd, list.version], ['docs/prd/mosaic-stack.md', '1.17']);
 });
 
 test('the committed list loads frozen', () => {
@@ -74,7 +74,7 @@ test('the schema refuses any other shape', () => {
     const twice = raw();
     twice.requirements.push(structuredClone(twice.requirements[0]));
     writeFileSync(join(dir, 'twice.json'), JSON.stringify(twice));
-    assert.throws(() => loadRequirements(join(dir, 'twice.json')), listError('requirements[85].id: REQ-ROLE-1 twice'));
+    assert.throws(() => loadRequirements(join(dir, 'twice.json')), listError('requirements[87].id: REQ-ROLE-1 twice'));
   } finally {
     rmSync(dir, { recursive: true, force: true });
   }

packages/webui/README.md

@@ -335,13 +335,28 @@ note is `agents/dewey/work/wui/SLICE1-VIEWS.md`.
   same functions, so both show the same broker data.
 - Nothing writes but the "Message a role" box, the Settings update, the Assistant
   section's three buttons and the spec and docs editor's Save, all under `--send` (above,
-  "Assistant settings" and "Spec and docs editor"). A decision shows `mosaic decide <id> <key>` for each choice,
+  "Assistant settings" and "Spec and docs editor"), and the decision Approve and Deny below.
+  A decision shows `mosaic decide <id> <key>` for each choice,
   with Copy, which only puts the command on the clipboard. It is answered in a
   terminal (REQ-DEC-3, Q4). Seen is not set from the browser either. The
   command has no `--business`, so `mosaic decide` uses the running bus host's
   business, as the Console does by default. From a Console started with
   `--business` for another business the copied command refuses (no bus host,
   or no such decision) rather than answering elsewhere.
+- Row 252 (#1753, PRD 1.9 REQ-WEB-2): a grant request (`credential.mint` routed
+  to the human, raised with a grant and two options) can also be approved or
+  denied on its decision page, only when the Console runs with both `--sso` and
+  `--send` and the page is signed in as a `console.sso` subject. The first click
+  POSTs `/api/decisions/<id>/confirmation` and shows what the answer does; only
+  Confirm POSTs `/resolve` with that one-use confirmation (two minutes, bound to
+  the session, decision and choice). Each step spawns
+  `packages/bus/src/console-cli.mjs`, which the bus verifies as the Console's
+  child holding the signed-in subject, and the bus records the answer `via
+  console` with a `human.input` naming that subject. Nothing retries; an unknown
+  outcome says to refresh. Without `--sso` the page has no buttons and says why;
+  under `--sso` without `--send` it says the Console is read-only for decisions.
+  The tester listener has no decision routes. Every other decision stays
+  terminal-only.
 - What no Q1 verb returns is labelled where it would show, for example
   "Bot names: not in the Q1 module" (lead decision 63). Nothing is guessed.
 - A task's list row can only say its current state came from a Vikunja read,

packages/webui/src/bus.mjs

@@ -14,6 +14,7 @@ import { fileURLToPath } from 'node:url';
 import { HUMAN_CLI } from '../../cli/src/transport.mjs';
 import { readHostState } from '../../cli/src/host.mjs';
 import { views } from '../../bus/src/views.mjs';
+import { CONSOLE_VERBS } from '../../bus/src/broker.mjs';
 
 export class BusReadError extends Error {
   constructor(code, message = code) { super(message); this.code = code; }
@@ -27,10 +28,13 @@ export const subjectOk = s => typeof s === 'string' && s.length > 0 && s.length
 // request on stdin, JSON on stdout, or a bus error code as the last
 // `^[a-z-]{1,64}$` line of stderr.
 export function humanCall({ socket, business, env = process.env, cli = HUMAN_CLI, timeoutMs = 30000, maxBytes = 8 * 1024 * 1024 }) {
-  return (verb, args = {}) => new Promise((resolve, reject) => {
+  return (verb, args = {}) => transport({ cli, socket, env: cli === HUMAN_CLI ? { ...env, MOSAIC_BUS_CLI_NONCE: randomBytes(32).toString('hex') } : env, input: { business, verb, args }, timeoutMs, maxBytes });
+}
+function transport({ cli, socket, env, input, timeoutMs, maxBytes }) {
+  return new Promise((resolve, reject) => {
     let child;
     try {
-      child = spawn(process.execPath, [cli, socket], { env: cli === HUMAN_CLI ? { ...env, MOSAIC_BUS_CLI_NONCE: randomBytes(32).toString('hex') } : env, stdio: ['pipe', 'pipe', 'pipe'] });
+      child = spawn(process.execPath, [cli, socket], { env, stdio: ['pipe', 'pipe', 'pipe'] });
     } catch { return reject(new BusReadError('outcome-unknown', 'the bus transport did not start')); }
     const out = [], err = [];
     let size = 0, settled = false;
@@ -53,24 +57,42 @@ export function humanCall({ socket, business, env = process.env, cli = HUMAN_CLI
       catch { done(reject, new BusReadError('invalid-response')); }
     });
     child.stdin.on('error', () => {}); // A child that exits early reports through 'close'.
-    child.stdin.end(`${JSON.stringify({ business, verb, args })}\n`);
+    child.stdin.end(`${JSON.stringify(input)}\n`);
   });
 }
 
+// Row 252 (#1753, design section 2): the Console owner's answer to a grant request. Each call spawns
+// a fresh console-cli with a fresh nonce, and the business and the signed-in (provider, iss, sub) go
+// in its spawn environment, where the bus reads them back. Inherited console keys are dropped first,
+// so only this call's values reach the wrapper. Only the two console verbs pass (N4). A resolve pins
+// the business its confirmation was issued for.
+export const CONSOLE_CLI = fileURLToPath(new URL('../../bus/src/console-cli.mjs', import.meta.url));
+export function consoleCall({ dataRoot, socket, business = null, env = process.env, cli = CONSOLE_CLI, timeoutMs = 30000 }) {
+  return async (verb, args, { subject, business: pinned = null }) => {
+    if (!CONSOLE_VERBS.includes(verb)) throw new Error(`the Console does not call ${verb}`);
+    const id = pinned ?? (business || hostBusiness(dataRoot));
+    const own = Object.fromEntries(Object.entries(env).filter(([k]) => !k.startsWith('MOSAIC_BUS_CONSOLE_')));
+    return transport({
+      cli, socket, timeoutMs, maxBytes: 1024 * 1024, input: { verb, args },
+      env: { ...own, MOSAIC_BUS_CONSOLE_NONCE: randomBytes(32).toString('hex'), MOSAIC_BUS_CONSOLE_BUSINESS: id,
+        MOSAIC_BUS_CONSOLE_PROVIDER: subject.provider, MOSAIC_BUS_CONSOLE_ISS: subject.iss, MOSAIC_BUS_CONSOLE_SUB: subject.sub },
+    });
+  };
+}
+
 // The business is the --business flag, or else the live bus host's, read
 // on every request so a host started after the Console is picked up.
 export function busCaller({ dataRoot, socket, business = null, env = process.env, cli = HUMAN_CLI, timeoutMs = 30000 }) {
   return async (verb, args) => {
-    let id = business;
-    if (!id) {
-      let state;
-      try { state = readHostState(dataRoot); } catch { throw new BusReadError('no-bus-host', 'the bus host state file is unreadable'); }
-      if (!state?.live) throw new BusReadError('no-bus-host', 'no bus host is running and no --business was given');
-      id = state.business;
-    }
-    return humanCall({ socket, business: id, env, cli, timeoutMs })(verb, args);
+    return humanCall({ socket, business: business || hostBusiness(dataRoot), env, cli, timeoutMs })(verb, args);
   };
 }
+function hostBusiness(dataRoot) {
+  let state;
+  try { state = readHostState(dataRoot); } catch { throw new BusReadError('no-bus-host', 'the bus host state file is unreadable'); }
+  if (!state?.live) throw new BusReadError('no-bus-host', 'no bus host is running and no --business was given');
+  return state.business;
+}
 export const busReader = options => views({ call: busCaller(options) });
 
 // FED R6 (#1800): a granted user's bus transport, R3's user-cli.mjs (#414, design 3.6). Same
@@ -133,7 +155,8 @@ export function userCaller({ dataRoot, socket, business = null, user, env = proc
 // A send's error, sorted. The broker writes in one transaction, so any code it
 // returns means nothing was written. A transport that lost the answer, or an
 // answer that can't be read, leaves the outcome open: the message may exist.
-const OPEN = ['outcome-unknown', 'invalid-response', 'response-too-large'];
+// Row 239 (duckworth-0165 C1): so does a write that failed after its revoke.
+const OPEN = ['outcome-unknown', 'invalid-response', 'response-too-large', 'outcome-unknown-revoked'];
 export function sendOutcome(err) {
   const code = err instanceof BusReadError ? err.code : 'outcome-unknown';
   return OPEN.includes(code) ? { code: 'outcome-unknown', sent: 'unknown' } : { code, sent: false };
@@ -145,6 +168,8 @@ const STATUS = {
   'human-required': 403, 'peercred-required': 403, unauthenticated: 403, 'unknown-business': 403, 'read-only': 403,
   'outcome-unknown': 503, 'no-bus-host': 503, 'not-configured': 503,
   'revision-conflict':409,'organization-busy':409,'organization-uncertain':503,
+  // Row 239 (#1745): a fire's or a delete's write refused after its revoke ran.
+  'revision-conflict-revoked': 409, 'outcome-unknown-revoked': 503,
   'invalid-request': 400, 'unknown-role': 400, 'message-not-found': 400, 'request-too-large': 400,
   // Row 148: the spec and docs editor. A stale base, a busy or dirty repository and an unchanged
   // file are the user's to resolve by reloading; a path or content the project refuses is a 400.

packages/webui/src/cli.mjs

@@ -2,7 +2,7 @@
 // MOSAIC_TESTER_SOCKET_V1: private tester ingress, no tester TCP.
 import { createChat } from './chat.mjs';
 import { startServer, previewOptions, proofOptions, DEFAULT_BOARD } from './serve.mjs';
-import { busCaller, busBusiness, userCaller } from './bus.mjs';
+import { busCaller, busBusiness, userCaller, consoleCall } from './bus.mjs';
 import { consoleBus, userOptionsFor, agentCaller, TESTER_AGENT_VERBS } from './console-bus.mjs';
 import { consoleAccess } from './access.mjs';
 import { accessContextFor } from '../../cli/src/access.mjs';
@@ -68,7 +68,7 @@ try {
   // the system config, Business can't resolve authority and Settings has
   // no notifier. A refusal printed here names no path (redactor).
   // --send without a bus refuses to start rather than serve a composer that can't send.
-  let bus = null, send = null, settingsWrite = null, projectFiles = null, projectFile = null, libraryFile = null, libraryStatus = null, librarySync = null, projectSave = null, chat = null, nameWrite = null, assistantStop = null, instancesWrite = null, routesWrite = null, agentWrite = null, busLine, system = null;
+  let bus = null, send = null, settingsWrite = null, projectFiles = null, projectFile = null, libraryFile = null, libraryStatus = null, librarySync = null, projectSave = null, chat = null, nameWrite = null, assistantStop = null, instancesWrite = null, routesWrite = null, agentWrite = null, decisionWrite = null, busLine, system = null;
   let processing = null, ownerCall = null;
   try {
     system = loadSystem();
@@ -76,6 +76,9 @@ try {
     const call = ownerCall = busCaller({ dataRoot, socket: socketPath(dataRoot), business: options.business ?? null });
     // FED R6 (#1800): the bus-backed options, shared with each granted user's session (console-bus.mjs).
     ({ processing, chat, bus, projectFiles, projectFile, libraryFile, libraryStatus, send, librarySync, settingsWrite, projectSave, nameWrite, assistantStop, instancesWrite, routesWrite, agentWrite } = consoleBus(call, { send: sendOn }));
+    // Row 252 (#1753): Approve and Deny on grant requests, through the console wrapper, only with
+    // --sso and --send.
+    if (ssoOn && sendOn) decisionWrite = consoleCall({ dataRoot, socket: socketPath(dataRoot), business: options.business ?? null });
     busLine = `Bus: ${options.business ?? 'the running bus host\'s business'}`;
   } catch (err) {
     const why = redactor({ configDir: configDir() })(err.message);
@@ -104,7 +107,7 @@ try {
   }
   let server;
   try {
-    server = await startServer({ board: options.board, port: options.port, bus, reads, preview: options.preview, sso, proof, send, settingsWrite, projectFiles, projectFile, libraryFile, libraryStatus, librarySync, projectSave, chat, nameWrite, assistantStop, instancesWrite, routesWrite, agentWrite, processing, userOptions, federation: system?.federation ?? null });
+    server = await startServer({ board: options.board, port: options.port, bus, reads, preview: options.preview, sso, proof, send, settingsWrite, projectFiles, projectFile, libraryFile, libraryStatus, librarySync, projectSave, chat, nameWrite, assistantStop, instancesWrite, routesWrite, agentWrite, processing, decisionWrite, userOptions, federation: system?.federation ?? null });
   } catch (err) { sso?.close(); throw err; }
   let testerServer = null;
   if (testerSocket) {
@@ -128,7 +131,7 @@ try {
   const proofLine = `\nProxy: proxy proof ${proof ? 'on' : 'off'}`;
   // One line per provider: id, issuer, subject count and state. No client id, secret or sub.
   const health = sso?.health() ?? {};
-  const ssoLines = sso ? `\nSign-in: ${sso.publicOrigin}/ (--sso), ${send ? 'reads and human writes (--send)' : 'read-only'}` + sso.summary().map(p => `\nSign-in provider: ${p.id} issuer ${p.issuer} subjects ${p.subjects} (${health[p.id]})`).join('') : '';
+  const ssoLines = sso ? `\nSign-in: ${sso.publicOrigin}/ (--sso), ${send ? 'reads and human writes (--send), grant Approve and Deny' : 'read-only'}` + sso.summary().map(p => `\nSign-in provider: ${p.id} issuer ${p.issuer} subjects ${p.subjects} (${health[p.id]})`).join('') : '';
   const queueLine = options.checkout ? '\nQueue: read from the --checkout directory' : '';
   console.log(`Mosaic Console: http://127.0.0.1:${server.address().port}/\nBoard: ${options.board}\n${busLine}${queueLine}${previewLine}${ssoLines}${proofLine}${testerServer ? `\nTester Console: unix:${testerServer.address()} (binds the tester)` : ''}\nCtrl-C stops this server.`);
   for (const signal of ['SIGINT', 'SIGTERM']) process.once(signal, () => { sso?.close(); server.close(); testerServer?.close(); });

packages/webui/src/decision-http.mjs

@@ -0,0 +1,148 @@
+// Row 252 (#1753, Gander's design approved by Webby at 5d8f0f4b5): Approve and Deny for a grant
+// request, from the signed-in Console only. Two POSTs. /confirmation asks the bus for the decision's
+// two answers and digest and returns a one-use confirmation bound to this session, business,
+// decision, choice and digest. /resolve takes only that choice and confirmation, consumes the
+// confirmation before it awaits the bus, and asks the bus to resolve with the digest. The bus
+// rechecks everything in the resolve transaction. Nothing here retries.
+import { createHash, randomBytes } from 'node:crypto';
+import { BusReadError, subjectOk } from './bus.mjs';
+
+export const DECISION_ROUTE = /^\/api\/decisions\/([^/]*)\/(confirmation|resolve)$/;
+// The endpoint contract, design section 4. Each refusal is one of these, never a 200.
+export const DECISION_REFUSALS = Object.freeze({
+  'sign-in-required': [401, 'Sign in again before answering.'],
+  'read-only': [403, 'Console decision answers are not enabled. Use mosaic decide.'],
+  'cross-origin': [403, 'Answer from the signed-in Console page.'],
+  'not-found': [404, 'Not found.'],
+  'human-required': [403, 'The bus refused this human identity.'],
+  'peercred-required': [403, 'The bus could not verify this connection.'],
+  'method-not-allowed': [405, 'Use POST.'],
+  'invalid-request': [400, 'Invalid decision answer.'],
+  'request-too-large': [413, 'Decision answer is too large.'],
+  'decision-not-found': [404, 'This decision is unavailable.'],
+  'decision-not-eligible': [403, 'Answer this decision with mosaic decide.'],
+  'decision-closed': [409, 'This decision is no longer open. Refresh the inbox.'],
+  'decision-stale': [409, 'The choices changed. Review the decision again.'],
+  'confirmation-required': [409, 'Review and confirm this answer again.'],
+  'confirmation-unavailable': [503, 'Confirmation is unavailable. Try again later.'],
+  'outcome-unknown': [503, 'The answer may have reached the bus. Refresh before trying again.'],
+});
+// Bus codes by name. A bus that refuses this caller is human-required, whatever its code. Any
+// other code, or no answer, is confirmation-unavailable at the preview and outcome-unknown at the
+// resolve, which the page reads as "refresh first".
+const BUS_CODES = {
+  'human-required': 'human-required', unauthenticated: 'human-required', 'unknown-business': 'human-required',
+  'access-refused': 'human-required', 'access-revoked': 'human-required', 'agent-required': 'human-required',
+  'peercred-required': 'peercred-required',
+  'decision-not-found': 'decision-not-found', 'decision-not-eligible': 'decision-not-eligible',
+  'decision-closed': 'decision-closed', 'decision-stale': 'decision-stale', 'invalid-choice': 'decision-stale',
+  'invalid-request': 'invalid-request',
+};
+const BODY_MAX = 4096;
+const TOKEN = /^[a-f0-9]{64}$/;
+const DIGEST = /^[a-f0-9]{64}$/;
+const one = (req, name) => (req.headersDistinct[name]?.length === 1 ? req.headersDistinct[name][0] : null);
+const hash = (token) => createHash('sha256').update(token).digest('hex');
+export function decisionRefuse(res, code) {
+  const [status, message] = DECISION_REFUSALS[code];
+  res.writeHead(status, { 'content-type': 'application/json', 'cache-control': 'no-store' });
+  res.end(JSON.stringify({ error: code, message }));
+}
+
+// The confirmations, in this process's memory only and stored by hash. 120 seconds, at most 1024
+// live. A full store refuses a new one rather than drop a live one. An expired one is swept.
+export function createConfirmations({ ttlMs = 120000, max = 1024, now = Date.now } = {}) {
+  const live = new Map();
+  const sweep = () => { const t = now(); for (const [k, v] of live) if (v.expires <= t) live.delete(k); };
+  return {
+    issue(binding) {
+      sweep();
+      if (live.size >= max) return null;
+      const token = randomBytes(32).toString('hex');
+      live.set(hash(token), { ...binding, expires: now() + ttlMs });
+      return token;
+    },
+    // One use: a token found is gone, whether or not it matches.
+    consume(token, { session, decision, choice }) {
+      sweep();
+      if (typeof token !== 'string' || !TOKEN.test(token)) return null;
+      const k = hash(token), v = live.get(k);
+      if (!v) return null;
+      live.delete(k);
+      return v.session === session && v.decision === decision && v.choice === choice ? v : null;
+    },
+    get size() { sweep(); return live.size; },
+  };
+}
+
+async function readBody(req) {
+  if (one(req, 'content-type')?.split(';')[0].trim().toLowerCase() !== 'application/json') return { code: 'invalid-request' };
+  const chunks = [];
+  let size = 0;
+  for await (const chunk of req) {
+    size += chunk.length;
+    if (size > BODY_MAX) return { code: 'request-too-large' };
+    chunks.push(chunk);
+  }
+  try {
+    const value = JSON.parse(Buffer.concat(chunks).toString('utf8'));
+    return value && typeof value === 'object' && !Array.isArray(value) ? { value } : { code: 'invalid-request' };
+  } catch { return { code: 'invalid-request' }; }
+}
+const preview = (v, id) =>
+  v && typeof v === 'object' && v.id === id && typeof v.business === 'string' && DIGEST.test(v.digest ?? '') &&
+  ['approve', 'deny'].every((k) => typeof v[k]?.key === 'string' && typeof v[k]?.text === 'string') &&
+  v.approve.key !== v.deny.key && v.grant && typeof v.grant.method === 'string';
+
+// `session` is the live sign-in session object this request passed, and `live()` reads it again
+// right before each spawn. `call(verb, args, { subject, business })` is the console transport.
+export async function decisionHTTP(req, res, { path, decide, session, live, confirmations, log }) {
+  const [, raw, step] = DECISION_ROUTE.exec(path);
+  let id = null;
+  try { id = decodeURIComponent(raw); } catch { /* refused below */ }
+  if (req.method !== 'POST') return decisionRefuse(res, 'method-not-allowed');
+  if (!decide) return decisionRefuse(res, 'read-only');
+  if (!session) return decisionRefuse(res, 'sign-in-required');
+  if (one(req, 'origin') !== decide.origin || one(req, 'sec-fetch-site') !== 'same-origin') return decisionRefuse(res, 'cross-origin');
+  const line = (outcome) => log(`${new Date().toISOString()} decide user=${JSON.stringify(String(session.name ?? '').slice(0, 64))} decision=${JSON.stringify(String(id ?? '').slice(0, 64))} step=${step} ${outcome}`);
+  const refuse = (code) => { line(`error=${code}`); return decisionRefuse(res, code); };
+  const { value, code } = await readBody(req);
+  if (code) return refuse(code);
+  if (!subjectOk(id)) return refuse('decision-not-found');
+  const subject = { provider: session.provider, iss: session.iss, sub: session.sub };
+  const busCode = (err, open) => {
+    const c = err instanceof BusReadError ? BUS_CODES[err.code] : undefined;
+    return c ?? open;
+  };
+  if (step === 'confirmation') {
+    if (Object.keys(value).length !== 1 || typeof value.choice !== 'string') return refuse('invalid-request');
+    if (live() !== session) return refuse('sign-in-required');
+    let v;
+    try { v = await decide.call('decision.preview.console', { id }, { subject }); } catch (err) { return refuse(busCode(err, 'confirmation-unavailable')); }
+    if (!preview(v, id)) return refuse('confirmation-unavailable');
+    const action = value.choice === v.approve.key ? 'approve' : value.choice === v.deny.key ? 'deny' : null;
+    if (!action) return refuse('decision-stale');
+    if (live() !== session) return refuse('sign-in-required');
+    const confirmation = confirmations.issue({ session, business: v.business, decision: id, choice: value.choice, digest: v.digest });
+    if (!confirmation) return refuse('confirmation-unavailable');
+    line(`action=${action}`);
+    return json(res, 200, { id, question: typeof v.question === 'string' ? v.question : '', action, choice: value.choice, text: v[action].text, grant: v.grant, confirmation });
+  }
+  const keys = Object.keys(value);
+  if (keys.length !== 2 || !keys.includes('choice') || !keys.includes('confirmation') || typeof value.choice !== 'string') return refuse('invalid-request');
+  // Consumed before any await on the bus, so a second click finds nothing (J12).
+  const held = confirmations.consume(value.confirmation, { session, decision: id, choice: value.choice });
+  if (!held) return refuse('confirmation-required');
+  if (live() !== session) return refuse('sign-in-required');
+  let r;
+  try {
+    r = await decide.call('decision.resolve.console', { id, choice: held.choice, digest: held.digest }, { subject, business: held.business });
+  } catch (err) { return refuse(busCode(err, 'outcome-unknown')); }
+  if (r?.id !== id || r.op !== 'resolved' || r.choice !== held.choice) return refuse('outcome-unknown');
+  line(`choice=${JSON.stringify(held.choice.slice(0, 64))}${r.grant ? ` grant=${r.grant}` : ''}`);
+  return json(res, 200, { id, op: 'resolved', choice: r.choice, ...(r.grant === 'started' ? { grant: 'started' } : {}) });
+}
+function json(res, status, body) {
+  res.writeHead(status, { 'content-type': 'application/json', 'cache-control': 'no-store' });
+  res.end(JSON.stringify(body));
+}

packages/webui/src/public/bus.js

@@ -190,8 +190,9 @@
       out.kind = 'decision.raised'; out.decision = r.id; out.actor = { role: r.raised_by_role, run: r.raised_by_run };
       out.text = `Raised a ${r.class} decision for ${r.route_to}: ${String(r.question).split('\n')[0]}`;
     } else if (r.table === 'decision_events') {
-      // The human answers from the CLI (via cli); every other row is the broker's.
-      out.kind = `decision.${r.op}`; out.decision = r.decision; out.by = r.via === 'cli' ? 'human' : 'broker';
+      // The human answers from the CLI (via cli) or, since row 252 (#1753), a grant request from the
+      // signed-in Console (via console); every other row is the broker's.
+      out.kind = `decision.${r.op}`; out.decision = r.decision; out.by = r.via === 'cli' ? 'human' : r.via === 'console' ? 'human-console' : 'broker';
       out.text = r.op === 'resolved' ? `${r.by} chose “${r.choice}” via ${r.via}` : r.op === 'seen' ? `${r.by} saw it${r.via ? ` via ${r.via}` : ''}` : `${r.op[0].toUpperCase()}${r.op.slice(1)} by ${r.by}${r.note ? `: ${r.note}` : ''}`;
     } else if (r.table === 'task_snapshots') {
       out.kind = `snapshot.${r.source}`;
@@ -227,8 +228,9 @@
   // An empty state says what would appear and where it comes from.
   const empty = (what, from) => `<div class="empty"><b>${what}</b>${from ? `<p>${from}</p>` : ''}</div>`;
   const taskLink = ref => ref ? `<a href="#/tasks/${enc(ref)}">#${esc(String(ref).split('/')[1])}</a>` : '';
-  // Rows without an actor role come from the human (CLI, outside any run) or from the broker itself.
-  const actor = (a, by) => `<span class="source">${a ? `${txt(a.role)} · ${txt(a.run)}` : by === 'human' ? 'human, CLI outside any run' : 'broker'}</span>`;
+  // Rows without an actor role come from the human (CLI outside any run, or the signed-in Console)
+  // or from the broker itself.
+  const actor = (a, by) => `<span class="source">${a ? `${txt(a.role)} · ${txt(a.run)}` : by === 'human' ? 'human, CLI outside any run' : by === 'human-console' ? 'human, signed-in Console' : 'broker'}</span>`;
   const PRIORITY = ['unset', 'low', 'medium', 'high', 'urgent', 'do now'];
   const head = (title, sub) => `<div class="page-head"><div><h1 tabindex="-1">${title}</h1>${sub ? `<p class="small muted" id="bus-status">${sub}</p>` : ''}</div></div>`;
   let readAt = null;
@@ -256,7 +258,7 @@
   // Inbox
   function decisionCard(d) {
     return `<li class="wait-item s1-dec${d.blocking ? ' is-attn' : ''}"><div class="wait-head"><a href="#/inbox/${enc(d.id)}" class="s1-dec-open">${txt(first(d.question))}</a></div>
-      <p class="s1-badges">${d.blocking ? blockChip('blocking') : ''}${chip(d.class, d.action)}</p>
+      <p class="s1-badges">${d.blocking ? blockChip('blocking') : ''}${chip(d.class, d.action)}${canDecide && d.console ? ` ${badge('Approve or Deny here', 'ok')}` : ''}</p>
       <p class="small s1-auth">${approves(d.authorization)}</p>
       <p class="small muted">Raised by ${txt(d.raised_by_role)} ${when(d.at)}${d.task_ref ? ` · task ${taskLink(d.task_ref)}` : ''}${d.requirement_ref ? ` · ${txt(d.requirement_ref)}` : ''}</p></li>`;
   }
@@ -314,12 +316,101 @@
     el.outerHTML = composerHtml();
     restore(k);
   }
+  // Row 252 (#1753, design section 5): Approve and Deny for an open grant request, drawn only when
+  // the server says this Console answers decisions (`decide` in /api/config: signed in through SSO
+  // and started with --send) and the bus marked the inbox row eligible (its `console` field). The
+  // first click asks the Console for a one-use confirmation that names what the answer does. Only
+  // the second click answers. Nothing here retries: a refusal drops the confirmation, and an
+  // unknown outcome says to refresh first. The state lives in `answer`, not the DOM, so the 10 s
+  // refresh redraws it. The server and the bus check everything again; this is presentation only.
+  let canDecide = false, ssoOn = false, answer = null;
+  const ACTIONS = { approve: 'Approve', deny: 'Deny' };
+  const grantText = g => [`method ${g.method}`, g.agent && `agent ${g.agent}`, g.host && `host ${g.host}`, Array.isArray(g.projects) && g.projects.length && `projects ${g.projects.join(', ')}`].filter(Boolean).map(s => txt(String(s))).join(' · ');
+  function decideHtml() {
+    const a = answer;
+    if (!a) return '';
+    const off = a.pending ? ' disabled' : '';
+    let body;
+    if (a.result) {
+      const r = a.result;
+      body = `<p class="receipt" id="decide-status" tabindex="-1">${r.action === 'approve' ? 'Approved' : 'Denied'}: you chose “${txt(r.choice)}”, ${txt(r.text)}. ${r.grant === 'started' ? 'The grant executor started.' : r.action === 'approve' ? 'The bus started no grant for it.' : 'Nothing starts for a denial.'} History below shows it once the bus is read again.</p>`;
+    } else if (a.confirm) {
+      const c = a.confirm, label = `Confirm ${c.action}`;
+      body = `<div class="s1-confirm" role="group" aria-labelledby="b-confirm"><h3 id="b-confirm" class="small">${label}</h3>
+        <dl class="kv"><dt>Id</dt><dd><code>${txt(c.id)}</code></dd><dt>Question</dt><dd class="s1-q">${txt(c.question)}</dd><dt>Answer</dt><dd><b class="s1-key">${txt(c.choice)}</b> ${txt(c.text)}</dd><dt>Grant</dt><dd>${grantText(c.grant)}</dd></dl>
+        <p class="small muted">${c.action === 'approve' ? 'Approving starts this grant.' : 'Denying starts nothing.'} This confirmation works once and lasts two minutes.</p>
+        <div class="s1-cmd"><button type="button" class="btn primary" data-decide="confirm"${off}>${a.pending ? 'Answering…' : label}</button><button type="button" class="btn" data-decide="cancel"${off}>Cancel</button></div></div>`;
+    } else {
+      body = `<ul class="s1-plain">${Object.entries(ACTIONS).map(([k, l]) => `<li><b>${l}</b> chooses <b class="s1-key">${txt(a.console[k].key)}</b> ${txt(a.console[k].text)}</li>`).join('')}</ul>
+        <p class="small muted">Grant: ${grantText(a.console.grant)}. Either button opens a confirmation first. Nothing is answered until you confirm.</p>
+        <div class="s1-cmd">${Object.entries(ACTIONS).map(([k, l]) => `<button type="button" class="btn${k === 'approve' ? ' primary' : ''}" data-decide="${k}"${off}>${a.pending === k ? 'Checking…' : l}</button>`).join('')}</div>`;
+    }
+    const e = a.error;
+    const said = e ? `<p class="receipt failed" id="decide-status" tabindex="-1">Not answered here: ${txt(e.message)} (<code>${txt(e.code)}</code>).${e.code === 'outcome-unknown' ? ' Nothing was sent again.' : ''}</p>` : '';
+    return `<section class="panel s1-decide" id="decide-section" aria-labelledby="b-decide"><h2 id="b-decide">Answer in Console</h2>${body}${said}</section>`;
+  }
+  // Redraw only the answer panel. `focus` names what takes focus after it.
+  function paintDecide(focus) {
+    const el = $('decide-section');
+    if (!el) return;
+    el.outerHTML = decideHtml();
+    (focus ? $('decide-section')?.querySelector(focus) : null)?.focus();
+  }
+  async function decidePost(url, body) {
+    let res = null, json = null;
+    try {
+      res = await fetch(url, { method: 'POST', headers: { 'content-type': 'application/json' }, body: JSON.stringify(body), cache: 'no-store', redirect: 'manual' });
+      try { json = await res.json(); } catch { json = null; }
+    } catch { res = null; }
+    return { res, json };
+  }
+  // A refusal the Console wrote carries its code and message (design section 4). Anything else, a
+  // 408 or no answer included, gets the fallback: at the resolve step that is outcome-unknown.
+  const DECIDE_FALLBACK = {
+    'confirmation-unavailable': 'Confirmation is unavailable. Try again later.',
+    'outcome-unknown': 'The answer may have reached the bus. Refresh before trying again.',
+  };
+  const decideRefusal = (res, json, fallback) => res && !res.ok && res.status !== 408 && typeof json?.error === 'string' && typeof json?.message === 'string'
+    ? { code: json.error, message: json.message } : { code: fallback, message: DECIDE_FALLBACK[fallback] };
+  async function decide(step) {
+    const a = answer;
+    if (!a || a.pending || a.result) return;
+    if (step === 'cancel') { a.confirm = null; a.error = null; paintDecide('[data-decide="approve"]'); announce('Cancelled. Nothing was answered.'); return; }
+    if (out()) { a.confirm = null; a.error = { code: 'sign-in-required', message: 'Sign in again before answering.' }; paintDecide('#decide-status'); return; }
+    if (step === 'approve' || step === 'deny') {
+      const choice = a.console[step].key;
+      a.pending = step; a.error = null; a.confirm = null; paintDecide();
+      const { res, json } = await decidePost(`/api/decisions/${enc(a.id)}/confirmation`, { choice });
+      a.pending = null;
+      // The page moved to another decision meanwhile: its confirmation is dropped, never shown.
+      if (answer !== a) { if (res?.type === 'opaqueredirect') signOut(); return; }
+      if (res?.type === 'opaqueredirect') { a.error = { code: 'sign-in-required', message: 'Sign in again before answering.' }; paintDecide('#decide-status'); signOut(); return; }
+      if (res?.ok && json?.id === a.id && json.action === step && json.choice === choice && typeof json.confirmation === 'string' && json.grant && typeof json.grant.method === 'string') {
+        a.confirm = json; paintDecide('[data-decide="confirm"]'); announce(`Confirm ${step}: ${json.text}`);
+      } else { a.error = decideRefusal(res, json, 'confirmation-unavailable'); paintDecide('#decide-status'); announce(`Not answered: ${a.error.message}`); }
+      return;
+    }
+    if (step !== 'confirm' || !a.confirm) return;
+    const c = a.confirm;
+    a.pending = 'confirm'; a.error = null; paintDecide();
+    const { res, json } = await decidePost(`/api/decisions/${enc(a.id)}/resolve`, { choice: c.choice, confirmation: c.confirmation });
+    // One use, whatever came back.
+    a.pending = null; a.confirm = null;
+    if (answer !== a) { if (res?.type === 'opaqueredirect') signOut(); else render(false); return; }
+    if (res?.type === 'opaqueredirect') { a.error = { code: 'sign-in-required', message: 'Sign in again before answering. The sign-in proxy redirected the answer, so it never reached the Console.' }; paintDecide('#decide-status'); signOut(); return; }
+    if (res?.ok && json?.id === a.id && json.op === 'resolved' && json.choice === c.choice) {
+      a.result = { action: c.action, choice: c.choice, text: c.text, grant: json.grant ?? null };
+      paintDecide('#decide-status'); announce(c.action === 'approve' ? 'Approved' : 'Denied'); render(false);
+    } else { a.error = decideRefusal(res, json, 'outcome-unknown'); paintDecide('#decide-status'); announce(`Not answered: ${a.error.message}`); }
+  }
   async function inboxView(get) {
     // The broker orders gated first, then oldest; lift blocking ones to the top.
     const rows = (await get('inbox')).slice().sort((a, b) => (b.blocking - a.blocking) || String(a.at).localeCompare(String(b.at)));
     countInbox(rows);
     const body = rows.length ? `<ul class="waiting s1-decs">${rows.map(decisionCard).join('')}</ul>` : empty('Nothing is waiting on you.', 'A decision shows here when an agent raises one routed to you through the bus.');
-    return `${head('Inbox', `${readNote()} Decisions are answered in a terminal with <code>mosaic decide</code>; Console only shows them.`)}
+    const answered = canDecide ? 'A grant request can be approved or denied here, after a confirmation. Every other decision is answered in a terminal with <code>mosaic decide</code>.'
+      : 'Decisions are answered in a terminal with <code>mosaic decide</code>; Console only shows them.';
+    return `${head('Inbox', `${readNote()} ${answered}`)}
       ${await composer(get)}
       <h2 id="b-for-you">For you <span class="count">${rows.length}</span></h2>${body}
       <p class="small muted">Not shown here yet: ${gap('Decisions routed to roles')} ${gap('Closed decisions')} ${gap('Seen and DM state per row')} Open a decision for its seen, DM and closing history.</p>`;
@@ -343,6 +434,13 @@
     // A command is offered only for an open decision routed to the human, and only when
     // the id and key pass the broker's identifier rule, so the copied text is safe to paste.
     const answerable = !c && d.routeTo === 'human';
+    // Row 252: the answer panel follows this decision. A refresh keeps a confirmation open; a
+    // decision no longer eligible (closed elsewhere, say) drops it, unless an answer is in flight
+    // or this page just answered it.
+    const eligible = canDecide && answerable && open?.console ? open.console : null;
+    if (answer?.id !== d.id) answer = eligible ? { id: d.id, console: eligible, pending: null, confirm: null, error: null, result: null } : null;
+    else if (eligible && !answer.pending && !answer.confirm) answer.console = eligible;
+    else if (!eligible && !answer.pending && !answer.result) answer = null;
     const options = `<ol class="s1-opts">${d.options.map(o => {
       const cmd = `mosaic decide ${d.id} ${o.key}`, chosen = c?.choice === o.key, approving = d.authorization?.approvalChoice === o.key;
       const copy = !answerable ? '' : SAFE.test(String(d.id)) && SAFE.test(String(o.key))
@@ -352,11 +450,18 @@
     }).join('')}</ol>`;
     const earlier = await chain(get, d);
     const history = [...d.seen.map(s => `<li>Seen by ${txt(s.by)}${s.via ? ` via ${txt(s.via)}` : ''} ${when(s.at)}</li>`), ...(c ? [`<li>${esc(c.op)} by ${txt(c.by)}${c.via ? ` via ${txt(c.via)}` : ''} ${when(c.at)}</li>`] : [])];
-    const help = answerable ? '<p class="small muted">To answer, run one of these in a terminal. Copy only puts the command on your clipboard. Console sends nothing.</p>'
+    // Without SSO, or under SSO without --send, the Console says why it has no buttons and never
+    // draws a disabled one (design section 5).
+    const why = !answerable || isTester || canDecide ? ''
+      : ssoOn ? ' This Console is read-only for decisions: it was started without writes enabled (--send), so answers go through a terminal.'
+        : ' Answering a grant request from the Console needs sign-in (--sso) and writes enabled (--send).';
+    const help = eligible ? '<p class="small muted">Approve or Deny in the panel above, or run one of these in a terminal. Copy only puts the command on your clipboard.</p>'
+      : answerable ? `<p class="small muted">To answer, run one of these in a terminal. Copy only puts the command on your clipboard. Console sends nothing.${why}</p>`
       : !c ? `<p class="small muted">This decision is routed to ${txt(d.routeTo)}, not to you, so Console offers no command for it.</p>` : '';
     return `${head(`Decision ${txt(short(d.id))}`, status)}
       <section aria-labelledby="b-q" class="panel"><h2 id="b-q">Question</h2><p class="s1-q">${txt(d.question)}</p>
       <dl class="kv"><dt>Class</dt><dd>${chip(d.class, d.action)}${d.blocking ? ` ${blockChip('blocking')}` : ''}</dd><dt>Approval</dt><dd class="s1-auth">${approves(d.authorization)}</dd><dt>Routed to</dt><dd>${txt(d.routeTo)}</dd><dt>Raised by</dt><dd>${txt(d.raisedBy.role)} <span class="source">${txt(d.raisedBy.run)}</span></dd><dt>Raised</dt><dd>${when(d.at)}</dd>${d.taskRef ? `<dt>Task</dt><dd>${taskLink(d.taskRef)} <span class="source">${txt(d.taskRef)}</span></dd>` : ''}${d.requirementRef ? `<dt>Requirement</dt><dd>${txt(d.requirementRef)}</dd>` : ''}<dt>DM</dt><dd>${d.dm ? `sent ${when(d.dm.at)}` : d.blocking ? 'not sent' : 'not needed (not blocking)'}</dd><dt>Id</dt><dd><code>${txt(d.id)}</code></dd></dl></section>
+      ${answer?.id === d.id ? decideHtml() : ''}
       <section aria-labelledby="b-o"><h2 id="b-o">Options</h2>${help}${options}<p class="small muted" id="copy-status"></p></section>
       <section aria-labelledby="b-c"><h2 id="b-c">Earlier versions</h2>${earlier.length ? `<ul class="s1-plain">${earlier.map(x => `<li><a href="#/inbox/${enc(x.id)}">${txt(short(x.id))}</a> ${badge(x.closed ? x.closed.op : 'open')} ${txt(first(x.question))}${x.closed?.note ? `<span class="source">${txt(x.closed.note)}</span>` : ''}</li>`).join('')}</ul>` : '<p class="muted">None.</p>'}<p class="small muted">${gap('A later version that replaces this one')}</p></section>
       <section aria-labelledby="b-h"><h2 id="b-h">History</h2>${history.length ? `<ul class="s1-plain">${history.join('')}</ul>` : '<p class="muted">Not seen yet.</p>'}<p><a href="#/trail/decision/${enc(d.id)}">Full trail for this decision</a></p></section>`;
@@ -1098,6 +1203,7 @@
     return {
       href: view.contains(a) ? a.getAttribute('href') : null, copy: view.contains(a) ? a.dataset?.copy : null, retry: view.contains(a) && a.hasAttribute?.('data-retry'), mirror: view.contains(a) ? a.dataset?.mirror : null, h1: view.contains(a) && a.tagName === 'H1',
       field: view.contains(a) ? a.dataset?.field : null, caret: view.contains(a) && a.tagName === 'TEXTAREA' ? [a.selectionStart, a.selectionEnd, a.scrollTop] : null, send: view.contains(a) && a.hasAttribute?.('data-send'),
+      decide: view.contains(a) ? a.dataset?.decide ?? (a.id === 'decide-status' ? 'status' : null) : null,
       open: [...view.querySelectorAll('details[id]')].filter(d => d.open).map(d => d.id), status: $('copy-status')?.textContent || '',
     };
   }
@@ -1105,7 +1211,10 @@
     for (const id of k.open) { const d = $(id); if (d) d.open = true; }
     if ($('copy-status')) $('copy-status').textContent = k.status;
     const el = [...$('bus-view').querySelectorAll('a[href],[data-copy],[data-retry],[data-mirror],[data-field],[data-send]')].find(e => k.href ? e.getAttribute('href') === k.href : k.copy ? e.dataset.copy === k.copy : k.mirror ? e.dataset.mirror === k.mirror : k.field ? e.dataset.field === k.field : k.send ? e.hasAttribute('data-send') : k.retry && e.hasAttribute('data-retry'));
-    if (el && (k.href || k.copy || k.retry || k.mirror || k.field || k.send)) {
+    // Row 252: the answer panel's buttons and its status line.
+    const dec = k.decide ? $('bus-view').querySelector(k.decide === 'status' ? '#decide-status' : `[data-decide="${k.decide}"]`) : null;
+    if (dec) dec.focus({ preventScroll: true });
+    else if (el && (k.href || k.copy || k.retry || k.mirror || k.field || k.send)) {
       el.focus({ preventScroll: true });
       if (k.caret && el.tagName === 'TEXTAREA') { el.setSelectionRange(k.caret[0], k.caret[1]); el.scrollTop = k.caret[2]; }
     }
@@ -1197,6 +1306,9 @@
       }
       return;
     }
+    // Row 252: Approve, Deny, Confirm and Cancel. One click is one step; none repeats itself.
+    const dec = e.target.closest('#decide-section [data-decide]');
+    if (dec) { if (!dec.disabled) decide(dec.dataset.decide); return; }
     if (e.target.closest('#toast [data-dismiss]')) { toast(null); return; }
     const item = e.target.closest('#cmdk-list [data-href]');
     if (item) { pkGo(item.dataset.href); return; }
@@ -1318,12 +1430,14 @@
     isTester = c?.tester === true;
     canEdit = !isTester && c?.edit === true;
     canSend = !isTester && c?.send === true;
+    ssoOn = c?.sso === true;
+    canDecide = !isTester && c?.decide === true;
     if (isTester) {
       const banner = document.createElement('div'); banner.id = 'tester-banner'; banner.className = 'banner ref';
       banner.setAttribute('role', 'status'); banner.textContent = 'Tester Console. Changes are recorded as tester, never as the human.';
       $('main').prepend(banner);
     }
-    if (!canSend && !isTester) return;
+    if (!canSend && !isTester && !ssoOn) return;
     const path = routeOf().split('?')[0];
     if (path.startsWith('/chat')||path.startsWith('/inbox')||path==='/settings'||path.startsWith('/docs/')) render(false); else if (path === '/' || path === '') paintHeld(heldErr);
   }).catch(() => {});

packages/webui/src/serve.mjs

@@ -11,6 +11,7 @@ import { ReadError, readStatus, fieldTable } from './reads.mjs';
 import { THREAD_DEFINITIONS } from '../../business/src/vocabulary.mjs';
 import { chatHTTP } from './chat-http.mjs';
 import { processingHTTP } from './processing-http.mjs';
+import { DECISION_ROUTE, decisionHTTP, decisionRefuse, createConfirmations } from './decision-http.mjs';
 
 export const DEFAULT_BOARD = 'http://127.0.0.1:7331';
 export function isLoopback(host) {
@@ -385,6 +386,9 @@ const AGENT_REASONS = {
   'workspace-rename-failed': 'the business file is changed and the name retired, but the workspace stayed where it was; delete it again to retry the rename',
   // Brief item 8, deviation 11 (sage-1620): the revoke runs before the write, so a retry is safe.
   'credential-revoke-failed': 'a credential couldn\'t be revoked, so the business file is unchanged. Tokens already revoked stay revoked and the instance can\'t use them. Clear what else the agent\'s store directory holds and delete again, which is safe',
+  // Row 239 (#1745): a fire's or a delete's revoke runs under the writer's lock; these follow one that ran.
+  'revision-conflict-revoked': 'the business file changed after the agent\'s tokens were revoked and before the write, so the file is unchanged. The tokens may already be revoked and the instance can\'t use them. Read the role instances again and delete again, which is safe',
+  'outcome-unknown-revoked': 'the agent\'s tokens may already be revoked and the write\'s outcome is unknown. Read the role instances again before trying',
   'capacity-full': 'a launch limit is reached',
   'limit-reached': 'a launch limit is reached',
   'no-route': 'the instance has no harness, model and thinking yet; set its route first',
@@ -600,7 +604,7 @@ async function projectFileRead(res, read, path, search) {
 // `log` takes one line per send attempt that got past sign-in; never the body. `fieldsFile` is for
 // tests; the field table is otherwise the committed packages/tasks/fields.json.
 // `agentWrite` (row 194, D7) is `(verb, args) => Promise` for the Agents section's verbs and instance.request.
-export async function startServer({ host = '127.0.0.1', port = 7330, board = DEFAULT_BOARD, timeout = 20000, bus = null, reads = null, preview = null, sso = null, tester = false, testerSocket = null, testerAuthHeader = null, proof = null, testerProofHeader = null, send = null, settingsWrite = null, projectFiles = null, projectFile = null, projectSave = null, chat = null, nameWrite = null, assistantStop = null, instancesWrite = null, routesWrite = null, agentWrite = null, processing = null, userOptions = null, federation = null, log = line => console.log(line), fieldsFile = undefined } = {}) {
+export async function startServer({ host = '127.0.0.1', port = 7330, board = DEFAULT_BOARD, timeout = 20000, bus = null, reads = null, preview = null, sso = null, tester = false, testerSocket = null, testerAuthHeader = null, proof = null, testerProofHeader = null, send = null, settingsWrite = null, projectFiles = null, projectFile = null, projectSave = null, chat = null, nameWrite = null, assistantStop = null, instancesWrite = null, routesWrite = null, agentWrite = null, processing = null, decisionWrite = null, userOptions = null, federation = null, log = line => console.log(line), fieldsFile = undefined } = {}) {
   if (!isLoopback(host)) throw new Error('refusing to bind to non-loopback host');
   if (host === 'localhost') host = '127.0.0.1';
   if (tester && preview !== null) throw new Error('tester listener cannot use preview mode');
@@ -611,6 +615,9 @@ export async function startServer({ host = '127.0.0.1', port = 7330, board = DEF
   if (tester && [send, settingsWrite, projectSave, assistantStop].some(value => value !== null)) throw new Error('tester listener permits only instance, route, name and chat writes');
   if (tester && !testerSocket) throw new Error('tester listener requires private socket');
   if (!tester && testerSocket) throw new Error('tester socket requires tester listener');
+  // Row 252 (#1753, design section 4): Console decision answers need --sso and --send, never the tester.
+  if (decisionWrite !== null && (tester || sso === null || send === null || typeof decisionWrite !== 'function')) throw new Error('Console decision answers need --sso and --send on the main listener');
+  const confirmations = createConfirmations();
   const upstream = boardURL(board);
   // `userOptions` (FED R6, #1800) is `session => options`, the bus-backed options over that session
   // user's own transport (console-bus.mjs). Only a signed-in listener has user sessions.
@@ -669,18 +676,23 @@ export async function startServer({ host = '127.0.0.1', port = 7330, board = DEF
     // alone stays open on a loopback Host for the status and release gates (Q-C).
     if (sso !== null && !named && !(path === '/healthz' && req.method === 'GET')) return json(res, 403, { error: 'public Host required' });
     // No CORS. JSON content type and same-origin checks keep browser forms out.
-    if (req.headers.origin && req.headers.origin !== (named ? (sso ? sso.publicOrigin : `https://${preview.host}`) : `http://${req.headers.host}`)) return json(res, 403, { error: 'cross-origin request refused' });
-    let signer = preview;
+    const decisionPath = DECISION_ROUTE.test(path);
+    if (req.headers.origin && req.headers.origin !== (named ? (sso ? sso.publicOrigin : `https://${preview.host}`) : `http://${req.headers.host}`))
+      return decisionPath ? decisionRefuse(res, 'cross-origin') : json(res, 403, { error: 'cross-origin request refused' });
+    let signer = preview, ssoSession = null;
     if (sso !== null && named) {
       if (path.startsWith('/auth/')) return sso.handle(req, res, path, search);
       // Only a page load or a write keeps a session alive; the page's background reads don't (Q-D).
       const session = path === '/healthz' ? null : sso.session(req, { touch: req.method === 'POST' || (req.method === 'GET' && !path.startsWith('/api/')) });
       if (!session && path !== '/healthz') {
+        if (decisionPath) return decisionRefuse(res, 'sign-in-required');
         if (path.startsWith('/api/') || req.method !== 'GET') return json(res, 401, { error: 'sign-in required' });
         res.writeHead(303, { location: `/auth/login?return=${encodeURIComponent(path + search)}`, 'cache-control': 'no-store' });
         return res.end();
       }
       if (session) signer = { sso: true, user: session.name, host: sso.publicHost, origin: sso.publicOrigin };
+      // Row 252: only the owner's session answers a decision. A granted user stops at userRoute below.
+      if (session && session.user === undefined) ssoSession = session;
       // FED R6 (#1800): a granted user. The Console's gate first; behind it no human-transport
       // object is left, so a route past the gate reaches the broker only as this user.
       if (session?.user !== undefined) {
@@ -696,6 +708,13 @@ export async function startServer({ host = '127.0.0.1', port = 7330, board = DEF
       if (!values || values.length !== 1 || values[0] !== preview.user) return json(res, 401, { error: 'sign-in required' });
     }
     const writer = tester ? { tester: true, user: 'tester', origin: TESTER_ORIGIN } : signer;
+    // Row 252: Approve and Deny. The tester listener never offers them. Anywhere else without a signed-in
+    // session on the public name under --sso and --send, they are read-only.
+    if (decisionPath) {
+      if (tester) return decisionRefuse(res, 'not-found');
+      const decide = decisionWrite && send && named && sso ? { call: decisionWrite, origin: sso.publicOrigin } : null;
+      return decisionHTTP(req, res, { path, decide, session: ssoSession, live: () => sso.session(req), confirmations, log });
+    }
     // Row 194 (#1692, D4.1): the tester also launches and terminates.
     if (tester && !['GET', 'HEAD'].includes(req.method) && !['/api/instances', '/api/routes', '/api/name', '/api/agent/launch', '/api/agent/terminate'].includes(path) && !TESTER_CHAT_WRITE.test(path))
       return json(res, 403, { error: 'read-only', sent: false });
@@ -820,7 +839,7 @@ export async function startServer({ host = '127.0.0.1', port = 7330, board = DEF
     // `send`: the page shows the composer only where a send can pass (the public name, --send on).
     // `edit`: the editor shows Save only where a save can pass, the same test as the route's.
     // `user` and `federation` (FED R6) only when there is one, so the owner's config is unchanged.
-    if (path === '/api/config') return json(res, 200, { board: upstream, ...(tester ? { tester: true } : {}), ...(sso ? { sso: true } : {}), ...(granted ? { user: true } : {}), ...(hub ? { federation: hub } : {}), send: !tester && Boolean(send) && named, edit: !tester && !granted && Boolean(send) && Boolean(projectSave) && named });
+    if (path === '/api/config') return json(res, 200, { board: upstream, ...(tester ? { tester: true } : {}), ...(sso ? { sso: true } : {}), ...(granted ? { user: true } : {}), ...(hub ? { federation: hub } : {}), send: !tester && Boolean(send) && named, decide: !tester && !granted && Boolean(send) && Boolean(decisionWrite) && named && sso !== null, edit: !tester && !granted && Boolean(send) && Boolean(projectSave) && named });
     if (path === '/healthz') return json(res, 200, { ok: true, ...(sso ? { sso: sso.health() } : {}) });
     if (path === '/favicon.ico') { res.writeHead(204); return res.end(); }
     const file = files.get(path);

packages/webui/tests/agents.test.mjs

@@ -220,3 +220,21 @@ test('row 194 N5: agents.js is served as JavaScript and index.html loads it once
   const html = await get(s, '/', { host: 'console.example', 'x-user': 'jason' });
   assert.equal(html.text.match(/<script src="\/agents\.js" defer><\/script>/g)?.length, 1);
 });
+
+// Row 239 (#1745): a fire's or a delete's revoke runs under the writer's lock. A delete closed after
+// that revoke ran says the tokens may already be revoked; a plain revision-conflict keeps its text.
+// duckworth-0165 C1: a direct answer of outcome-unknown-revoked is an open outcome, never "Nothing changed".
+test('row 239 T6: a delete closed -revoked says the tokens may already be revoked, and outcome-unknown-revoked is an open outcome', async t => {
+  let refusal = 'revision-conflict-revoked';
+  const s = await setup(t, { agent: async (verb, args) => { if (verb !== 'instance.request') throw new BusReadError('outcome-unknown-revoked'); return { ...ANSWERS['instance.request'](args), done: { run: null, transaction: null, refusal } }; } });
+  const reason = async () => (await get(s, `/api/agent/request?id=${ID}`)).body.reason;
+  assert.match(await reason(), /business file changed after the agent's tokens were revoked .*\. The tokens may already be revoked .* delete again, which is safe$/);
+  refusal = 'outcome-unknown-revoked';
+  assert.match(await reason(), /tokens may already be revoked and the write's outcome is unknown\. Read the role instances again before trying$/);
+  refusal = 'revision-conflict';
+  assert.match(await reason(), /the business file changed since you read it/);
+  assert.doesNotMatch(await reason(), /may already be revoked/);
+  const unknown = await send(s, '/api/agent/launch', { instance: 'coder' });
+  assert.deepEqual([unknown.status, unknown.body.error, unknown.body.sent], [503, 'outcome-unknown', 'unknown']);
+  assert.doesNotMatch(unknown.body.message, /Nothing changed/);
+});

packages/webui/tests/decide-browser.test.mjs

@@ -0,0 +1,250 @@
+// Row 252 (#1753, design section 5, J16 and J17): Approve and Deny on a decision page, in a browser.
+// A loopback page has no sign-in, so a script added before the page loads sets `sso` and `decide`
+// in /api/config from the page URL, and answers each POST /api/decisions/... from a queue, recording
+// what the page sent. Server-side checks are decision-http.test.mjs's and the bus side is
+// packages/bus/tests/console-decide.test.mjs's. The decisions come from an in-process broker
+// through its reader session. Refresh timers fire after 150 ms.
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import { randomUUID } from 'node:crypto';
+import { mkdtempSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { Store } from '../../bus/src/store.mjs';
+import { Broker } from '../../bus/src/broker.mjs';
+import { views } from '../../bus/src/views.mjs';
+import { grantDecision } from '../../bus/tests/host-fixtures.mjs';
+import { startServer } from '../src/serve.mjs';
+import { browser } from './browser.mjs';
+import { fixture, close } from './fixture.mjs';
+
+const HOSTILE = '<script>window.injected=1</script><img src=x onerror="window.injected=2">';
+const businesses = { demo: { id: 'demo', human: 'jason', arbiters: { technical: 'pm', delivery: 'pm' }, roles: { chief: { authority: { withinRole: ['message.send'], crossRole: [] } }, pm: { authority: { withinRole: ['message.send'], crossRole: [] } } } } };
+
+// Answers in order; `hold` waits for window.__release(), `reject` is a network failure, `redirect`
+// what fetch gives for the sign-in proxy's redirect under redirect: 'manual'.
+const STUB = `(() => {
+  const real = window.fetch.bind(window);
+  window.__posts = []; window.__answers = [];
+  const timeout = window.setTimeout.bind(window);
+  window.setTimeout = (f, ms, ...rest) => timeout(f, ms === 10000 ? 150 : ms, ...rest);
+  const q = new URLSearchParams(location.search);
+  const answer = (status, body) => new Response(JSON.stringify(body), { status, headers: { 'content-type': 'application/json' } });
+  window.fetch = async (url, init = {}) => {
+    const u = String(url);
+    if (u === '/api/config') {
+      const c = await (await real(url, init)).json();
+      return answer(200, { ...c, ...(q.has('sso') ? { sso: true } : {}), ...(q.has('send') ? { send: true } : {}), ...(q.has('decide') ? { send: true, decide: true } : {}), ...(q.has('tester') ? { tester: true } : {}) });
+    }
+    if (!u.startsWith('/api/decisions/')) return real(url, init);
+    window.__posts.push({ url: u, method: init.method, headers: init.headers, body: init.body, cache: init.cache, redirect: init.redirect });
+    const a = window.__answers.shift();
+    if (!a) throw new TypeError('no answer queued');
+    if (a.hold) await new Promise(r => { window.__release = r; });
+    if (a.reject) throw new TypeError('Failed to fetch');
+    if (a.redirect) return { type: 'opaqueredirect', ok: false, status: 0, json: async () => { throw new SyntaxError('no body'); } };
+    return answer(a.status, a.body);
+  };
+})();`;
+
+// The open grant request, as host-fixtures' grantDecision writes it but with the hostile question.
+// decisions is append-only (migration 3b), so the question goes in with the row, not by an UPDATE.
+function hostileGrant(store, grant) {
+  const id = randomUUID(), at = '2026-10-21T00:00:00.000Z';
+  store.run(
+    'INSERT INTO decisions(id,at,business,raised_by_role,raised_by_run,class,action,route_to,question,options,recommendation,blocking) VALUES(?,?,?,?,?,?,?,?,?,?,?,?)',
+    id, at, 'demo', 'chief', 'chief-run', 'gated', 'credential.mint', 'human', `Enroll web1? ${HOSTILE}`,
+    JSON.stringify([{ key: 'yes', text: 'Yes' }, { key: 'no', text: 'No' }]), 'yes', 0,
+  );
+  store.run(
+    "INSERT INTO events(id,at,business,kind,actor_role,actor_run,subject,body) VALUES(?,?,?,'action.allowed',?,?,?,?)",
+    randomUUID(), at, 'demo', 'chief', 'chief-run', id,
+    JSON.stringify({ decision: id, action: 'credential.mint', operation: 'decision.raise', approvalChoice: 'yes', grant }),
+  );
+  return id;
+}
+
+async function setup() {
+  const root = mkdtempSync(join(tmpdir(), 'webui-decide-browser-'));
+  const store = new Store(root), b0 = new Broker({ store, businesses });
+  const grant = { method: 'host-enroll', host: 'web1', address: '192.0.2.10', port: 22, user: 'jarvis', sudo: true, fingerprints: [] };
+  const open = hostileGrant(store, grant);
+  const deploy = grantDecision(store, { action: 'deploy', grant, close: null });
+  const bare = grantDecision(store, { close: null });
+  const reader = b0.bindReader({ business: 'demo' });
+  const bus = views({ call: async (verb, args = {}) => structuredClone(b0.request(reader, { verb, args })) });
+  const f = await fixture(), b = await browser();
+  const web = await startServer({ port: 0, board: f.boardURL, bus }), base = `http://127.0.0.1:${web.address().port}/`;
+  await b.call('Page.addScriptToEvaluateOnNewDocument', { source: STUB });
+  await b.viewport(1280);
+  const wait = expr => b.evaluate(`(async()=>{for(let i=0;i<100;i++){if(${expr})return true;await new Promise(r=>setTimeout(r,50))}throw new Error('Condition timed out: '+${JSON.stringify(expr)})})()`);
+  const text = sel => b.evaluate(`document.querySelector(${JSON.stringify(sel)})?.textContent ?? null`);
+  const has = sel => b.evaluate(`!!document.querySelector(${JSON.stringify(sel)})`);
+  const posts = () => b.evaluate('window.__posts');
+  const queue = a => b.evaluate(`window.__answers.push(${JSON.stringify(a)}), true`);
+  const click = step => b.evaluate(`document.querySelector('#decide-section [data-decide="${step}"]').click(), true`);
+  const page = async (query, id) => {
+    // The same URL again is a same-document hash change, not a load, so load about:blank first (as editor-browser does).
+    await b.navigate('about:blank');
+    await b.navigate(`${base}?${query}#/inbox/${id}`);
+    await wait('document.querySelector("#bus-view h1")?.textContent.startsWith("Decision") && !document.querySelector("#bus-view [aria-busy]")');
+    // The config read redraws once it lands; a refresh tick after it settles the page.
+    await new Promise(r => setTimeout(r, 400));
+  };
+  const settle = () => new Promise(r => setTimeout(r, 600));
+  const done = async () => { await b.close(); await close(web); await f.close(); store.close(); rmSync(root, { recursive: true, force: true }); };
+  return { b, store, base, open, deploy, bare, wait, text, has, posts, queue, click, page, settle, done };
+}
+
+const CONFIRM = (s, action, choice, text) => ({ status: 200, body: { id: s.open, question: `Enroll web1? ${HOSTILE}`, action, choice, text, grant: { method: 'host-enroll', host: 'web1' }, confirmation: 'c'.repeat(64) } });
+
+test('J16: no controls without sso and decide, read-only reasons, terminal lines kept, and only an eligible grant gets the panel', { timeout: 120000 }, async () => {
+  const s = await setup();
+  try {
+    // Without SSO: no panel, no button, and the reason names both flags.
+    await s.page('x', s.open);
+    assert.equal(await s.has('#decide-section'), false);
+    assert.equal(await s.has('[data-decide]'), false);
+    assert.match(await s.text('#bus-view'), /needs sign-in \(--sso\) and writes enabled \(--send\)/);
+    assert.equal(await s.b.evaluate('document.querySelectorAll("#bus-view [data-copy]").length'), 2);
+    // SSO without --send: read-only, still the terminal lines.
+    await s.page('sso', s.open);
+    assert.equal(await s.has('#decide-section'), false);
+    assert.match(await s.text('#bus-view'), /read-only for decisions: it was started without writes enabled \(--send\)/);
+    // send alone, without decide, still draws nothing.
+    await s.page('sso&send', s.open);
+    assert.equal(await s.has('#decide-section'), false);
+    // A tester Console never answers, whatever the config says.
+    await s.page('sso&decide&tester', s.open);
+    assert.equal(await s.has('#decide-section'), false);
+    // Eligible: the panel, both buttons, the escaped question and the terminal lines too.
+    await s.page('sso&decide', s.open);
+    assert.equal(await s.text('#decide-section h2'), 'Answer in Console');
+    assert.deepEqual(await s.b.evaluate('[...document.querySelectorAll("#decide-section [data-decide]")].map(e => [e.dataset.decide, e.textContent, e.disabled])'), [['approve', 'Approve', false], ['deny', 'Deny', false]]);
+    assert.match(await s.text('#decide-section'), /Grant: method host-enroll · host web1\./);
+    assert.equal(await s.b.evaluate('document.querySelectorAll("#bus-view [data-copy]").length'), 2);
+    assert.equal(await s.b.evaluate('window.injected ?? null'), null);
+    assert.ok((await s.text('#bus-view .s1-q')).includes(HOSTILE));
+    // A grant raise with another action, and a credential.mint with no grant, keep the terminal only.
+    for (const id of [s.deploy, s.bare]) {
+      await s.page('sso&decide', id);
+      assert.equal(await s.has('#decide-section'), false);
+      assert.equal(await s.has('[data-decide]'), false);
+    }
+    // The Inbox says so, and marks only the eligible row.
+    await s.b.navigate(`${s.base}?sso&decide#/inbox`);
+    await s.wait('document.querySelector("#bus-view h1")?.textContent.startsWith("Inbox") && document.querySelectorAll("#bus-view .s1-decs > li").length === 3');
+    await s.settle();
+    assert.match(await s.text('#bus-view'), /A grant request can be approved or denied here, after a confirmation\./);
+    assert.equal(await s.b.evaluate('[...document.querySelectorAll("#bus-view .s1-decs > li")].filter(li => li.textContent.includes("Approve or Deny here")).length'), 1);
+    assert.deepEqual(await s.posts(), []);
+  } finally { await s.done(); }
+});
+
+test('J17: one POST per click, confirm then answer, cancel, refusals and an unknown outcome never retry', { timeout: 120000 }, async () => {
+  const s = await setup();
+  const enc = encodeURIComponent;
+  try {
+    await s.page('sso&decide', s.open);
+
+    // Approve asks for a confirmation and answers nothing. The button holds while the request is out.
+    await s.queue({ ...CONFIRM(s, 'approve', 'yes', 'Yes'), hold: true });
+    await s.click('approve');
+    await s.wait('document.querySelector("#decide-section [data-decide=approve]")?.textContent === "Checking…"');
+    assert.equal(await s.b.evaluate('[...document.querySelectorAll("#decide-section [data-decide]")].every(e => e.disabled)'), true);
+    await s.click('approve');
+    await s.b.evaluate('window.__release(), true');
+    await s.wait('document.querySelector("#decide-section [data-decide=confirm]")');
+    let sent = await s.posts();
+    assert.equal(sent.length, 1);
+    assert.deepEqual(sent[0], { url: `/api/decisions/${enc(s.open)}/confirmation`, method: 'POST', headers: { 'content-type': 'application/json' }, body: JSON.stringify({ choice: 'yes' }), cache: 'no-store', redirect: 'manual' });
+    assert.equal(await s.text('#decide-section [data-decide=confirm]'), 'Confirm approve');
+    assert.match(await s.text('#decide-section .s1-confirm'), /Approving starts this grant\./);
+    assert.equal(await s.b.evaluate('document.activeElement?.dataset.decide ?? null'), 'confirm');
+    assert.equal(await s.b.evaluate('window.injected ?? null'), null);
+
+    // A refresh keeps the confirmation open.
+    await s.settle();
+    assert.equal(await s.has('#decide-section [data-decide=confirm]'), true);
+
+    // Cancel drops it without a request.
+    await s.click('cancel');
+    await s.wait('document.querySelector("#decide-section [data-decide=approve]")');
+    assert.equal((await s.posts()).length, 1);
+
+    // A refusal the Console wrote shows its code and message; a 408 or a lost answer is unavailable.
+    await s.queue({ status: 409, body: { error: 'decision-stale', message: 'The choices changed. Review the decision again.' } });
+    await s.click('deny');
+    await s.wait('document.querySelector("#decide-status")');
+    assert.equal(await s.text('#decide-status'), 'Not answered here: The choices changed. Review the decision again. (decision-stale).');
+    await s.queue({ status: 408, body: { error: 'x', message: 'y' } });
+    await s.click('deny');
+    await s.wait('document.querySelector("#decide-status code")?.textContent === "confirmation-unavailable"');
+    await s.queue({ reject: true });
+    await s.click('deny');
+    await s.wait('document.querySelectorAll("#decide-section [data-decide]:not([disabled])").length === 2');
+    assert.equal(await s.b.evaluate('document.querySelector("#decide-status code")?.textContent'), 'confirmation-unavailable');
+    assert.equal((await s.posts()).length, 4);
+
+    // A reply that doesn't match what was asked is not a confirmation.
+    await s.queue({ status: 200, body: { ...CONFIRM(s, 'approve', 'yes', 'Yes').body } });
+    await s.click('deny');
+    await s.wait('document.querySelector("#decide-status code")?.textContent === "confirmation-unavailable" && document.querySelectorAll("#decide-section [data-decide]:not([disabled])").length === 2');
+    assert.equal(await s.has('#decide-section [data-decide=confirm]'), false);
+
+    // An unknown outcome at the answer says to refresh, drops the confirmation and sends nothing again.
+    await s.queue(CONFIRM(s, 'deny', 'no', 'No'));
+    await s.click('deny');
+    await s.wait('document.querySelector("#decide-section [data-decide=confirm]")');
+    assert.match(await s.text('#decide-section .s1-confirm'), /Denying starts nothing\./);
+    await s.queue({ status: 503, body: { error: 'outcome-unknown', message: 'The answer may have reached the bus. Refresh before trying again.' } });
+    await s.click('confirm');
+    await s.wait('document.querySelector("#decide-status code")?.textContent === "outcome-unknown"');
+    assert.match(await s.text('#decide-status'), /Nothing was sent again\.$/);
+    sent = await s.posts();
+    assert.equal(sent.length, 7);
+    assert.deepEqual(sent[6], { url: `/api/decisions/${enc(s.open)}/resolve`, method: 'POST', headers: { 'content-type': 'application/json' }, body: JSON.stringify({ choice: 'no', confirmation: 'c'.repeat(64) }), cache: 'no-store', redirect: 'manual' });
+    assert.equal(await s.has('#decide-section [data-decide=confirm]'), false);
+    await s.settle();
+    await s.settle();
+    assert.equal((await s.posts()).length, 7, 'the page sent again by itself');
+
+    // A confirmed approve: one answer, a receipt, and no buttons after it, across refreshes.
+    await s.queue(CONFIRM(s, 'approve', 'yes', 'Yes'));
+    await s.click('approve');
+    await s.wait('document.querySelector("#decide-section [data-decide=confirm]")');
+    await s.queue({ status: 200, body: { id: s.open, op: 'resolved', choice: 'yes', grant: 'started' } });
+    await s.click('confirm');
+    await s.wait('document.querySelector("#decide-status")?.textContent.startsWith("Approved")');
+    assert.equal(await s.text('#decide-status'), 'Approved: you chose “yes”, Yes. The grant executor started. History below shows it once the bus is read again.');
+    await s.settle();
+    assert.equal(await s.has('[data-decide]'), false);
+    assert.equal((await s.posts()).length, 9);
+
+    // Closed elsewhere: the next read drops the panel and shows the recorded answer with its provenance.
+    s.store.run('INSERT INTO decision_events(decision,at,op,by,choice,via) VALUES(?,?,?,?,?,?)', s.open, '2026-10-22T00:00:00.000Z', 'resolved', 'jason', 'yes', 'console');
+    await s.page('sso&decide', s.open);
+    assert.equal(await s.has('#decide-section'), false);
+    assert.match(await s.text('#bus-view'), /Resolved: jason chose “yes” via console/);
+    assert.equal(await s.b.evaluate('document.querySelectorAll("#bus-view [data-copy]").length'), 0);
+  } finally { await s.done(); }
+});
+
+test('a sign-in redirect at either step signs the page out and answers nothing', { timeout: 120000 }, async () => {
+  const s = await setup();
+  try {
+    await s.page('sso&decide', s.open);
+    await s.queue({ redirect: true });
+    await s.click('approve');
+    await s.wait('document.body.classList.contains("signed-out")');
+    assert.equal((await s.posts()).length, 1);
+    await s.page('sso&decide', s.open);
+    await s.queue(CONFIRM(s, 'approve', 'yes', 'Yes'));
+    await s.click('approve');
+    await s.wait('document.querySelector("#decide-section [data-decide=confirm]")');
+    await s.queue({ redirect: true });
+    await s.click('confirm');
+    await s.wait('document.body.classList.contains("signed-out")');
+    assert.equal((await s.posts()).length, 2);
+  } finally { await s.done(); }
+});