row 283 (#1788): BUILD.md: G1 per sage-3713: mos-1528 OKs the mapping.test.mjs:52 draft deepEqual gaining supporting: [] (old :48 at 45dca69f6, new :52), recorded as an append that completes BUILD.md:42; doc only

agents/honker/work/queue-283/BUILD.md

@@ -0,0 +1,276 @@
+# Row 283 (#1788) C2-01d build notes (Honker)
+
+Append-only. Design: DESIGN.md d2 16e809457, APPROVE webby-0172. Gate owner Sage, reviewer Webby.
+
+## 2026-10-23 build on 45dca69f6 (sage-3577)
+
+Branch honker/row283-build from origin/refactor 45dca69f6e4bce52834587f66f2ff33ba839ab8a. The old branch
+honker/row283 (16e809457) held only the design, so its two commits were cherry-picked as 398314cf4
+(d1) and 4f66dccde (d2). The DESIGN.md blob equals 16e809457's.
+
+Commits:
+- 331653b38: code, README and tests T1-T8.
+- 28918824c: the survey.test:73 re-pin, alone (mos-1330 item 4).
+- this file.
+
+Nothing has run. No node, test or mutant ran during the build: Darkwing held the slot. Every count
+below is a plan until Sage's CLEAR.
+
+### Drift check (sage-3577)
+
+`git diff --stat 94c33a43c 45dca69f6` (design base to build base) over the paths the tests read or
+hash-pin:
+- No change in packages/library, packages/business/src/business.mjs or
+  packages/business/tests/business.test.mjs.
+- No test hash-pins a library file. bus library.test and library-sync.test import index.mjs, and
+  stack-copy.test only checks that index.mjs exists.
+- webui library-cli.test changed one line and doesn't read scope. The `classify` in webui reads.mjs is
+  the business one, not the library's.
+
+I redo the drift check on BASE..refactor before the in-review move.
+
+### N3 (webby-0169): deepEquals of the mapping output outside packages/library
+
+`git grep -n playground -- 'packages/*/tests/*' ':!packages/library/*'` and the files naming
+`universes` give two files:
+- business.test.mjs:20 compares `validateBusinessDocument(...).projects.books` with
+  `checkMapping(mappingEntry())`. That is output against output, so `supporting: []` shows up on both
+  sides. :27 compares only `.playground`.
+- library-projects-protected.test.mjs compares file bytes (:31, :32) and change paths (:58), never the
+  mapping output.
+
+No re-pin is needed outside library. Inside library, only the draft deepEqual at mapping.test:48 gains
+`supporting: []`, as the design says.
+
+### Q1 departure (sage-2923) and the :73 re-pin (mos-1330 item 4)
+
+survey.mjs:65 counts `supporting: 0` and formatSurvey prints it. T8 is the only added test
+(survey.test "C2-01d: with --mapping the survey counts supporting files").
+
+mos-1330 item 4, packages/library/tests/survey.test.mjs:73, commit 28918824c:
+- old: `'scopes canon 5, playground 1, unmapped 3; indexed 6',`
+- new: `'scopes canon 5, playground 1, supporting 0, unmapped 3; indexed 6',`
+
+N2: the pin gains only `supporting 0`. No other text on the line or in that test moved.
+
+### Q2 tradeoff (webby-0169)
+
+A supporting prefix that holds a playground prefix refuses `library-mapping-invalid`. That goes past
+the brief, but it is the fail-closed reading, and it uses an existing code: classify checks supporting
+first, so that playground prefix could never match. The cost is that she can't nest a playground under
+a supporting folder, though she can nest the other way (a playground holding a supporting folder).
+
+### Handoffs
+
+- Q4 (webby-0169, sage-2930): the M12 delete rule ("A delete also needs the path to exist at the tip as
+  a 100644 blob", case2 DESIGN.md :308) is not in supportingPath. It binds row 288 (C2-02) via Gitea
+  #1793 comment 30738, with tests for a missing path and a non-100644 entry.
+- A save with no `editor` refusing is C2-02's (DESIGN.md section 1).
+
+### Choices the design left open
+
+- The book loop is now `againstBooks(owners, list, code)` in mapping.mjs, called once per list. The
+  playground's messages and codes are byte-equal to before.
+- A non-string path refuses `library-write-story-path` ("the path must be a string") as part of
+  check 1. A non-array `tree` is a TypeError (DESIGN.md section 3).
+- Check 8 builds the tree's names as every path and every folder above it, keyed by
+  `normalize('NFC').toLowerCase()`. A name on the way refuses if its key holds any name other than
+  itself, so a tree that already holds case twins refuses a write to either (R7).
+
+### Mutants (exact strings)
+
+Each applies one replacement to the build tip. Run one at a time, and restore with `git checkout --`
+on the one file before the next.
+
+| Mutant | File | Replace | With | Killed by |
+|---|---|---|---|---|
+| M1 | src/scope.mjs | `const prefix = entry.supporting.find(p => inside(p, path));` | `const prefix = entry.supporting.find(p => inside(p, path) && !entry.playground.some(q => inside(q, path)));` | scope.test "supporting comes before playground", supporting.test "passes at book level" (both-lists path) |
+| M2 | src/mapping.mjs | `if ((inside \|\| holding) && owner !== id)` | `if ((inside \|\| holding) && owner !== id && list !== 'supporting')` | mapping.test "each supporting prefix rule", business.test C2-04 |
+| M3 | src/supporting.mjs | `for (const p of own) if (LINKS.has(modes.get(p)))` | `for (const p of own) if (false && LINKS.has(modes.get(p)))` | supporting.test "symlink or gitlink" |
+| M4 | src/supporting.mjs | `const fold = name => name.normalize('NFC').toLowerCase();` | `const fold = name => name.normalize('NFC');` | supporting.test "case or Unicode form" |
+| M4b | src/supporting.mjs | `const fold = name => name.normalize('NFC').toLowerCase();` | `const fold = name => name.toLowerCase();` | supporting.test "case or Unicode form" (NFD case) |
+| M5 | src/supporting.mjs | `Buffer.byteLength(path, 'utf8') > MAX_BYTES` | `path.length > MAX_BYTES` | supporting.test "1025 bytes" |
+| M6 | src/mapping.mjs | `const IDENT_BAD = /[\u0000-\u001f\u007f-\u009f<>]/;` | `const IDENT_BAD = /[<>]/;` | mapping.test "editor is optional" |
+| M6b | src/mapping.mjs | `const IDENT_BAD = /[\u0000-\u001f\u007f-\u009f<>]/;` | `const IDENT_BAD = /[\u0000-\u001f\u007f-\u009f]/;` | mapping.test "editor is optional" |
+| M7 | src/supporting.mjs | `if (place.scope !== 'supporting' \|\| place.universe !== universe)` | `if (place.scope !== 'supporting')` | supporting.test "outside the universe's supporting folders" |
+| M8 | src/mapping.mjs | `if (sid === pid && s !== p && holds(s, p))` | `if (false && sid === pid && s !== p && holds(s, p))` | mapping.test "each supporting prefix rule" (Workshop case) |
+
+(The `\|` in the table is an escaped `|` in the source text.) Each mutant runs the one test file named,
+plus business.test for M2, under `timeout -k 10 600`. A mutant passes the gate only when its run is red
+on the named test and the restored file's sha256 equals the build tip's.
+
+### Gate plan (on Sage's CLEAR)
+
+1. The touched files whole, each under `timeout -k 10 600`: library mapping, scope, supporting and
+   survey tests, and business.test.mjs. Counts go below.
+2. M1-M8 as above.
+3. The full gate, under mos-1275 timeouts: `node --test packages/library/tests/` and
+   `node --test packages/business/tests/` each under `timeout -k 10 1800`, and every scripts/test-*.sh
+   under `timeout -k 10 300`. pipefail and tee, with skips named (test-task Docker groups).
+4. Before in-review: grep packages/*/tests for a 64-hex pin on any changed file and for the changed
+   message text, then the drift check on BASE..refactor.
+
+## 2026-10-23 Webby early look (webby-0227, static, not a verdict)
+
+- E1: business.test.mjs is an existing test file with a 4-line addition after the playground refusal.
+  The in-review request lists it next to survey.test:73.
+- E3 fixed: supportingPath now runs the string check before `JSON.stringify`, so a BigInt (or any
+  non-string) path refuses `library-write-story-path` instead of throwing a TypeError.
+  supporting.test's string case now covers 7, null, undefined, 1n and an array.
+- E2 open: `editor` takes surrounding whitespace, and git trims it at commit, so the saved ident and
+  the commit ident can differ. DESIGN.md section 1 says "non-empty after trim". Refusing
+  `value.trim() !== value` would change that approved rule, so it went to Sage instead of into the
+  build.
+
+## 2026-10-23 E2 departure (sage-3601)
+
+A departure from DESIGN.md section 1 (which stays unedited). The design says each `editor` value is
+"non-empty after trim". Sage ruled that surrounding whitespace refuses too, because git trims an
+ident at commit, so a padded value would save one name and commit another. mapping.mjs now adds
+`if (value.trim() !== value) bad(`editor.${key} must not start or end with whitespace`)` after the
+IDENT_BAD check. `trim()` covers Unicode whitespace, so U+00A0 and U+3000 refuse as well. Inner
+whitespace is kept ("Her  Middle Name" passes).
+
+T3 gains a case per key for leading, trailing and both-ends spaces, U+00A0 and U+3000, plus one inner
+whitespace pass.
+
+M6 grows a third part:
+
+| Mutant | File | Replace | With | Killed by |
+|---|---|---|---|---|
+| M6c | src/mapping.mjs | `if (value.trim() !== value) bad(` | `if (false && value.trim() !== value) bad(` | mapping.test "editor is optional" (padded cases) |
+
+Fixture grep: `git grep -nE "\beditor\b|\bauthor\b" -- 'packages/library/tests/*' 'packages/business/tests/*'`,
+leaving out mapping.test.mjs, finds nothing. packages/business/tests has no fixtures directory. The
+library fixture mapping.json has no `editor`. The positive control (`vaultPrefix` in mapping.json)
+matches once. No fixture maps an editor or author with surrounding whitespace.
+
+## 2026-10-23 E4 (webby-0230, sage-3606), same departure as E2
+
+Claimed: `queue move 283 in-progress`, op honker-283-start, rev 3642, 19:10:49Z (briefed→in-progress).
+
+Git's ident.c `crud()` strips any byte <= 0x20 and `, : ; < > " \ '` from both ends of an ident. I
+checked that with git 2.55.0: `Jane,` `"Jane"` `'Jane'` `Jane;` `Jane:` `Jane\` and `,Jane` all
+commit as `Jane`, while `Jane.` and `Ja,ne` are kept. mapping.mjs now takes the set from crud()
+rather than from that list: `IDENT_CRUD_END = /^[\u0000-\u0020,:;<>"\\']|[\u0000-\u0020,:;<>"\\']$/`.
+The E2 check became `if (value.trim() !== value || IDENT_CRUD_END.test(value))`, which refuses
+library-mapping-invalid with "editor.<key> must not start or end with whitespace or any of , : ; " ' \".
+`trim()` still catches Unicode whitespace (U+00A0, U+3000), which crud() leaves alone.
+
+Inner characters: IDENT_BAD (`/[\u0000-\u001f\u007f-\u009f<>]/`) already refuses `<`, `>`, newline,
+tab and every other control anywhere in the value. T3 now pins that at the start, the end and the
+middle. Inner `, : ; " ' \` are kept, since git keeps them, and T3 pins that too.
+
+Tests:
+- T3 has one case per character in [space, U+00A0, U+3000, `,`, `:`, `;`, `"`, `'`, `\`], at the start
+  and at the end, for each key. `<`, `>`, newline and tab are pinned at the start, end and middle.
+  Four accepted names have inner crud characters.
+- New round-trip test, "an accepted editor round-trips through a real git commit unchanged". It
+  commits in a scratch repo with editor `Doe, Jane Q.` / `[email protected].` as author and
+  committer, with GIT_AUTHOR_* and GIT_COMMITTER_* stripped from the env, and asserts `git log`
+  shows exactly the saved values. I preflighted that commit with git 2.55.0 by hand: both values came
+  back unchanged.
+
+M6c now replaces the whole end check (this supersedes the earlier M6c row):
+
+| Mutant | File | Replace | With | Killed by |
+|---|---|---|---|---|
+| M6c | src/mapping.mjs | `if (value.trim() !== value \|\| IDENT_CRUD_END.test(value))` | `if (false)` | mapping.test "editor is optional" (end cases) |
+| M6d | src/mapping.mjs | `if (value.trim() !== value \|\| IDENT_CRUD_END.test(value))` | `if (value.trim() !== value)` | mapping.test "editor is optional" (`,` `:` `;` `"` `'` `\` cases) |
+
+## 2026-10-23 E5 (webby-0236, not blocking), fixed
+
+The round-trip test stripped only GIT_AUTHOR_* and GIT_COMMITTER_*. With GIT_DIR, GIT_WORK_TREE or
+GIT_INDEX_FILE set (inside a hook, say), GIT_DIR beats `-C root` and the commit would land in the
+outer repo, and the test read global and system config. It now deletes GIT_DIR, GIT_WORK_TREE,
+GIT_COMMON_DIR and GIT_INDEX_FILE (as queue/tests/helpers.mjs gitEnv does) and sets
+GIT_CONFIG_GLOBAL=/dev/null and GIT_CONFIG_NOSYSTEM=1 (as ledger.test.mjs does). The `-c user.*`
+ident still applies. Test only; no mutant changes.
+
+## 2026-10-23 sage-2925: optional editor.user (sage-3649)
+
+sage-2925 (recorded in ludwig/row286-r2 agents/ludwig/work/queue-286/BUILD.md, Q4) ruled that row 283
+adds an optional `editor.user`, her Gitea login for the `library-human` slot, which row 288 (C2-02)
+passes to `humanCredential(context, {user})`. It reached this row after the DESIGN.md d2 approval
+(ludwig-0068, bubba-0009, sage-3649), so it departs from DESIGN.md section 1 ("exactly the keys
+`name` and `email`"). DESIGN.md stays unedited.
+
+- mapping.mjs: `only(entry.editor, ['name', 'email', 'user'], 'editor')`. When present, `user` must be
+  a string matching USER (`/^[A-Za-z0-9_.-]{1,100}$/`, the entry `user` check), else
+  library-mapping-invalid "editor.user must be a plain account name". The output carries `user` only
+  when given. An absent `editor.user` refusing library-human-missing is 288's (bubba-0009).
+- README: the `editor` line names `user` and the end-character rule from E2/E4.
+- Tests: T3 (mapping.test "editor is optional") gains one accepted case (`her.login-1`, kept in the
+  output) and refused cases for '', an inner space, '@', 101 characters, 7 and null. They go in
+  mapping.test with the other editor cases, not in the new supporting.test, which tests write paths.
+- No test outside mapping.test reads `editor` or pins mapping.mjs or README (git grep).
+
+| Mutant | File | Replace | With | Killed by |
+|---|---|---|---|---|
+| M6e | src/mapping.mjs | `if (Object.hasOwn(entry.editor, 'user') && (typeof entry.editor.user !== 'string' \|\| !USER.test(entry.editor.user)))` | `if (false)` | mapping.test "editor is optional" (editor.user refusals) |
+| M6f | src/mapping.mjs | `...(Object.hasOwn(entry.editor, 'user') ? { user: entry.editor.user } : {})` | `...({})` | mapping.test "editor is optional" (`her.login-1` kept) |
+
+## 2026-10-23 T2 run (sage-3695 CLEAR, lane A, library and business only)
+
+Node v26.8.1. refactor was e2b873390 (226 landed); `git diff --stat 45dca69f6 e2b873390 -- packages/library
+packages/business` is empty. TMPDIR was a mktemp -d under /mnt/storage/scratch/tmp, with pipefail.
+Singles and mutants ran under `timeout -k 10 600`, suites under `timeout -k 10 1800`.
+
+First-run red (mos-1272, placed): the first base run on 46bad7ea3 at 20:01:09Z was red in
+supporting.test "malformed paths refuse by class, in order". 5 of 6 passed, with `TypeError: Do not know
+how to serialize a BigInt`. The cause was the test helper, not the product: `refuses()` labelled each
+assertion with `JSON.stringify(path)`, and the 1n case added for E3 can't be stringified. In c18ad3e12
+the label uses `util.inspect(path)`, a 2-line test-only change. The product's 1n refusal was never in
+question: supportingPath type-checks before it stringifies (E3). The whole run below is on c18ad3e12.
+
+Base, the touched files whole (20:01:43Z), all rc=0:
+- library mapping.test 16/16, scope.test 6/6, supporting.test 6/6, survey.test 7/7;
+- business business.test 21/21;
+- 0 skipped, 0 cancelled, 0 todo.
+
+Mutants (20:01:44Z). Each was applied by exact string with count 1, then restored with `git checkout --`.
+Every restored sha256 equals HEAD's blob, and the tree was clean after.
+
+| Mutant | Run | Result | Failing test |
+|---|---|---|---|
+| M1 | scope.test | rc=1, 5/6 | supporting comes before playground; a folder in both lists is supporting… |
+| M1 | supporting.test | rc=1, 5/6 | a path passes at book level, universe level, in a draft and in a folder in both lists |
+| M2 | mapping.test | rc=1, 15/16 | each supporting prefix rule refuses with its code |
+| M2 | business.test | rc=1, 20/21 | C2-04: library mappings load without roots, remain frozen, and retain mapping refusals |
+| M3 | supporting.test | rc=1, 5/6 | a symlink or gitlink on the way, or at the path itself, refuses |
+| M4 | supporting.test | rc=1, 5/6 | a name that differs from a tree name only in case or Unicode form refuses… |
+| M4b | supporting.test | rc=1, 5/6 | the same case/Unicode test |
+| M5 | supporting.test | rc=1, 5/6 | a path of exactly 1024 bytes passes, and 1025 bytes… refuses |
+| M6 | mapping.test | rc=1, 15/16 | editor is optional, kept when given, and refuses anything but a plain name and email |
+| M6b | mapping.test | rc=1, 15/16 | the same editor test |
+| M6c | mapping.test | rc=1, 15/16 | the same editor test |
+| M6d | mapping.test | rc=1, 15/16 | the same editor test |
+| M6e | mapping.test | rc=1, 15/16 | the same editor test |
+| M6f | mapping.test | rc=1, 15/16 | the same editor test |
+| M7 | supporting.test | rc=1, 5/6 | a path outside the universe's supporting folders refuses |
+| M8 | mapping.test | rc=1, 15/16 | each supporting prefix rule refuses with its code |
+
+14 of 14 mutants killed, each on its named test only.
+
+Suites (20:01:47Z):
+- `packages/library`: `node --test tests/*.test.mjs` rc=0, 98/98, 0 skipped.
+- `packages/business`: `node --test tests/` rc=0, 231/231, 0 skipped.
+
+Not run here: every scripts/test-*.sh and the other packages. Those are Sage's 283 gate, after Webby's
+APPROVE.
+
+## 2026-10-23 G1: mos-1528 OK for the mapping.test draft deepEqual (sage-3713)
+
+This entry completes the N3 line above (BUILD.md:42, "only the draft deepEqual at mapping.test:48 gains
+`supporting: []`"). BUILD.md is append-only, so :42 stays as written. Mos OK'd the change of that old
+assertion in mos-1528. It is now at packages/library/tests/mapping.test.mjs:52, and commit 331653b38
+changed it. Everything else in that commit's hunk is new test lines, not changed old ones.
+
+- Old, mapping.test.mjs:48 at 45dca69f6:
+  `assert.deepEqual(m.universes.idea, { kind: 'draft', name: 'New World', books: [], playground: ['Drafts/New World/'] });`
+- New, mapping.test.mjs:52 at b2a1f4092:
+  `assert.deepEqual(m.universes.idea, { kind: 'draft', name: 'New World', books: [], playground: ['Drafts/New World/'], supporting: [] });`
+
+The line gains only `, supporting: []`; nothing else in it moved. The business.test and scope.test hunks
+add tests only (sage-3713: no OK needed). The other old-test change in this row is survey.test:73
+(mos-1330 item 4, 28918824c). Doc only.

agents/honker/work/queue-283/DESIGN.md

@@ -0,0 +1,191 @@
+# Row 283 (#1788) C2-01d design, draft 2 (Honker)
+
+Brief: docs/plans/2026-10-20_case2-rows.md "C2-01d" at refactor 94c33a43c. Sources: the design at
+agents/gosalyn/work/case2/DESIGN.md b68d79663, the ruling after r11 (:207), the M12 paragraph (:300),
+1.1 (:755) and 1.2 (:817). Base 94c33a43c. Reviewer Webby, gate owner Sage. Nothing is built yet. The
+build waits for 282 to land (sage-2906).
+
+## 1. Mapping (packages/library/src/mapping.mjs)
+
+`supporting`:
+- Every universe kind takes an optional `supporting` list: plain `['name','books','playground','supporting']`,
+  hybrid adds it to its seven keys, and a draft gets `['kind','name','playground','supporting']`.
+- Each value is checked as a playground prefix is: a string ending in `/` whose body passes `folder()`.
+- The output carries `supporting` on every universe, `[]` when absent, the way a draft carries
+  `books: []`. classify then needs no `?? []`. The business writer writes the raw document
+  (organization.mjs:195), not this output, so no business file changes shape.
+- The prefix rules, across every entry (ruling after r11):
+  - A supporting prefix holding another supporting prefix, or one listed twice, refuses
+    `library-mapping-invalid`.
+  - A prefix equal to one of its own entry's book folders, or holding one, refuses `library-mapping-invalid`.
+  - A prefix inside or holding another entry's book folder refuses `library-supporting-other-universe`.
+  - Level comes from where the prefix sits, as for the playground: inside one of its own entry's books
+    is book level, and outside every book is universe level. A draft's prefixes are all universe level.
+- Between the two lists (my choice, Q2):
+  - A supporting prefix may equal a playground prefix of the same entry. That folder is writable.
+  - A playground prefix may hold a supporting prefix of the same entry. The inner folder is supporting
+    and the rest stays playground.
+  - A supporting prefix that holds a playground prefix refuses `library-mapping-invalid`. classify
+    checks supporting first, so that playground prefix could never match.
+  - A supporting prefix equal to, holding or inside a playground prefix of another entry refuses
+    `library-mapping-invalid`. Otherwise one path would have two universes.
+- The book loop at mapping.mjs:128-140 becomes a helper that both lists call with their own code and
+  label. The playground's messages and codes stay byte-equal, so no existing test text moves.
+
+`editor`:
+- The entry takes an optional `editor`. When present, it is an object with exactly the keys `name` and
+  `email` (via `only()`). Each value is a string that is non-empty after trim and has no control
+  character (`[\u0000-\u001f\u007f-\u009f]`), `<` or `>` (webby-0169 R1: git drops them from an ident
+  and commits under a different name, so C2-02 would never see a failure). Anything else refuses
+  `library-mapping-invalid`.
+- The output carries `editor: { name, email }` only when present, as `user` and `vaultPrefix` do. A save
+  with no `editor` refusing is C2-02's job.
+
+## 2. Scope (scope.mjs)
+
+- `classify` gets a supporting loop before the playground loop (design 1.2). It returns `place(...)`
+  with `{ scope: 'supporting', universe, book }`. The book is the book folder holding the prefix, or
+  null at universe level and in a draft. The type and folder come from the first folder under the
+  prefix, as for the playground.
+- The `.md` check stays first, so a `.canvas` or `.base` under a supporting prefix stays unmapped.
+- The comment above `classify` names the three prefix scopes and the order.
+
+## 3. supportingPath (new supporting.mjs)
+
+`supportingPath(mapping, universe, path, tree)` returns `path` or throws
+`LibraryError('library-write-story-path', ...)`. It is pure and reads no git.
+
+- `tree` is the array `listTree` returns (reader.mjs:26, `{ mode, type, oid, size, path }`), so the
+  C2-02 broker passes its listing as it is (Q3). A non-array `tree` throws a TypeError, because that is
+  a caller bug, not a path class.
+- The checks run in this order, each with its own message naming the class:
+  1. The path must be a string of at most 1,024 UTF-8 bytes (`Buffer.byteLength`).
+  2. It must have no control character, using the same control class as `editor` (not `<` or `>`).
+  3. It must have no backslash.
+  4. It must not be absolute (a leading `/`).
+  5. It must have no empty, `.` or `..` segment. That also catches `//` and a trailing `/`.
+  6. `classify(mapping, path)` must give scope `supporting` and that same `universe`. This one check
+     covers an unknown universe, an unmapped path, a `.canvas`, `.base` or attachment, a canon or
+     story path, a playground path that isn't also supporting, and another universe's prefix. The scope
+     rule then has one source, and M1 below hits both.
+  7. Every proper prefix of the path (`a`, `a/b`, ...) and the path itself must not be in `tree` with
+     mode `120000` (symlink) or `160000` (gitlink).
+  8. No prefix of the path, and not the path itself, may equal a tree path or a tree directory
+     (derived from the entries' paths) after `normalize('NFC').toLowerCase()` on both sides, unless
+     it equals that tree path exactly. NFC as well as case, because APFS treats NFC and NFD forms of
+     a name as one file (webby-0169 N1).
+     Directories are checked too, because the folders under a supporting prefix are hers to name. A
+     path in a tree that holds both `a.md` and `A.md` refuses, which matches R7.
+- The refusal messages quote the path with JSON, except for the control-character class, whose message
+  leaves the path out.
+- The delete rule ("A delete also needs the path to exist at the tip as a 100644 blob", M12) isn't in
+  the brief's supportingPath list. It stays with C2-02's delete (Q4).
+  The C2-02 brief doesn't name it (only design :308), so BUILD.md carries it to C2-02 under Handoffs
+  (webby-0169 Q4).
+- index.mjs exports `supportingPath`.
+
+## 4. README (packages/library/README.md)
+
+- Mapping: `supporting` and its rules, the cross-list rules, and `editor`.
+- Refusals: a `library-supporting-other-universe` row, and the new cases in the
+  `library-mapping-invalid` row.
+- Scope: supporting first, then playground, then canon.
+- A new section, "Agent write paths", for supportingPath and its classes.
+
+## 5. Callers of classify outside files owned (Q1 for Sage)
+
+- survey.mjs:65 builds `{ canon: 0, playground: 0, unmapped: 0 }` and increments
+  `scopes[classify(...).scope]`. A supporting file adds `supporting: NaN`, and formatSurvey (:92) never
+  prints it. I propose a departure: add `supporting: 0` and print it, so the line becomes
+  `scopes canon 5, playground 1, supporting 0, unmapped 3; indexed 6`. That re-pins survey.test:73 and
+  adds a count test. Without it, the survey reports garbage once she marks a folder. The departure
+  covers two files, packages/library/src/survey.mjs and packages/library/tests/survey.test.mjs.
+- No change in the rest, each for a reason:
+  - reader.mjs:183 skips only unmapped, so supporting files are indexed like playground files.
+  - R5 (:207) flags only canon to playground, as design 1.3 R5 says. A canon link to a supporting file
+    raises nothing.
+  - render.mjs:23 gives supporting a null badge. The supporting badge belongs to C2-10b (design :1415).
+  - mirror.mjs:246 refuses only unmapped. Reading supporting files by scope is C2-05c's.
+  - No bus or webui source filters on scope (git grep at 94c33a43c).
+- M9 already protects the whole `projects` key from agent edits (library-projects-protected.test). No
+  test is added there.
+
+## 6. Tests
+
+- mapping.test:
+  - T1: `supporting` at book level, at universe level, in a hybrid and in a draft. The output carries
+    it, with `[]` when absent. The draft `deepEqual` at :48 gains `supporting: []`.
+  - T2: one test per prefix rule.
+    - These refuse `library-mapping-invalid`: no trailing `/`, a bad folder, one holding another, one
+      listed twice, one equal to its own book, one holding its own book, one holding a playground
+      prefix, and one overlapping another entry's playground.
+    - These refuse `library-supporting-other-universe`: one inside another universe's book, and one
+      holding another universe's book.
+    - An equal same-entry playground passes.
+  - T3: `editor` passes, and absent passes. It refuses `library-mapping-invalid` for a non-object, an
+    array, an extra key, a missing key, an empty or blank value, a non-string, and a control character,
+    `<` or `>` in either value.
+- scope.test, T4:
+  - Supporting at book level, universe level and in a draft each give their universe and book.
+  - A folder in both lists is `supporting`, and a playground-only folder is `playground`.
+  - A supporting `.canvas` or `.base` is unmapped.
+- supporting.test (new):
+  - T5 passes at book level, universe level, in a draft, in a both-lists folder, and at exactly 1,024 bytes.
+  - T6 has one refusal per class against a fixture tree with a symlink, a gitlink and a case variant.
+    The classes are:
+    - unmapped, `.canvas`, `.base`, an attachment, canon, playground-only, another universe's
+      supporting prefix, and an unknown universe;
+    - absolute, `..`, `.`, `//`, a trailing `/`, a backslash, a C0 control and DEL;
+    - a symlink folder, a gitlink folder, and a symlink at the path itself;
+    - a case-variant file, a case-variant folder, and an NFD-form variant of an NFC tree name;
+    - 1,025 bytes made with a multi-byte character, so bytes and characters differ.
+  - Each asserts the code `library-write-story-path`.
+- business.test: T7 adds one assertion that `validateBusinessDocument` refuses
+  `library-supporting-other-universe`.
+- survey.test (only if Q1 is approved): T8 counts one supporting file, and :73 is re-pinned.
+
+## 7. Mutants (exact strings go in BUILD.md)
+
+| Mutant | Change | Killed by |
+|---|---|---|
+| M1 | classify checks playground before supporting (the brief's mutant) | T4 both-lists, T5 both-lists |
+| M2 | the other-universe fail for supporting is dropped | T2 |
+| M3 | the symlink and gitlink check is dropped | T6 |
+| M4 | the case check is dropped | T6 |
+| M4b | check 8 drops `normalize('NFC')` | T6 NFD variant |
+| M5 | the byte length uses `path.length` | T6 1,025 bytes |
+| M6 | the `editor` control-character check is dropped | T3 |
+| M6b | the `editor` `<` and `>` check is dropped | T3 |
+| M7 | supportingPath skips the universe match | T6 other universe |
+| M8 | the supporting-holds-playground check is dropped | T2 |
+
+## 8. Gate
+
+- Webby approves the manifest.
+- The library and business suites and every scripts/test-*.sh are green on Sage's gate.
+- Timeouts (mos-1275): each package `timeout -k 10 1800`, each script `timeout -k 10 300`, each single
+  file and mutant `timeout -k 10 600`. These come from my row 256 gate at 10:34Z.
+- Before in-review, grep packages/*/tests for 64-hex pins on the changed files and for the changed
+  message text, then drift-check BASE..refactor.
+
+## 9. Questions
+
+- Q1 (Sage): approve the survey.mjs and survey.test.mjs departure in section 5?
+- Q2 (Webby): the cross-list rules in section 1?
+- Q3 (Webby): `tree` as the `listTree` array?
+- Q4 (Webby): the delete's 100644 check stays with C2-02?
+- Q5 (Webby): `editor` refuses only blank values and control characters, as the brief says. `<` and `>`
+  would break a git ident. I'd leave them to C2-02's commit step unless you want them refused here.
+
+## 10. Draft 2 (webby-0169)
+
+- R1 folded: `editor` refuses `<` and `>` too, with T3 cases and mutant M6b.
+- Q2 accepted. BUILD.md records the tradeoff: refusing a supporting prefix that holds a playground
+  prefix goes past the brief, but it is the fail-closed reading and uses an existing code. The cost
+  is that she can't nest a playground under a supporting folder, though she can nest the other way.
+- Q3 accepted. Q4: carried to C2-02 under Handoffs in BUILD.md, and Sage was asked to add it to C2-02's brief.
+- N1 folded into check 8 (NFC and case), with an NFD case in T6 and mutant M4b.
+- N2: the survey.test:73 pin gains only `supporting`, and the count test is the only addition
+  (mos-1330, its own commit).
+- N3: before the build, re-grep tests outside packages/library for a `deepEqual` of the mapping output
+  on the build base.

packages/business/tests/business.test.mjs

@@ -27,6 +27,10 @@ test('C2-04: library mappings load without roots, remain frozen, and retain mapp
   assert.deepEqual(validateBusinessDocument(doc, file, { rolesDir: REPO_ROLES }).projects.books.universes.harbor.playground, ['Elsewhere/Playground/']);
   doc.projects.books.universes.harbor.playground = ['Second World/Playground/'];
   refuses(() => validateBusinessDocument(doc, file, { rolesDir: REPO_ROLES }), /library-playground-other-universe/);
+  // C2-01d: a supporting prefix inside another universe's book refuses with its own code.
+  doc.projects.books = mappingEntry();
+  doc.projects.books.universes.harbor.supporting = ['Second World/Notes/'];
+  refuses(() => validateBusinessDocument(doc, file, { rolesDir: REPO_ROLES }), /library-supporting-other-universe/);
   doc.projects.books = { ...mappingEntry(), root: '/forbidden' };
   refuses(() => validateBusinessDocument(doc, file, { rolesDir: REPO_ROLES }), /library-mapping-invalid/);
 });

packages/library/README.md

@@ -31,33 +31,72 @@ deep-frozen copy. `where` names the entry in messages. `fail(code, message)` def
 - `user` is the bot account name from design step 3, required for sync. It is optional in the
   mapping and checked with row 199's account name pattern, `[A-Za-z0-9_.-]`, 1 to 100 characters.
 - `vaultPrefix` is optional, one folder name.
+- `editor` is optional, `{ "name", "email" }` plus an optional `"user"`: the ident her Console saves commit under
+  (C2-01d). Each value is text that is non-empty after trim, with no control character
+  (`U+0000`-`U+001F`, `U+007F`-`U+009F`), `<` or `>`, and no whitespace or git-stripped character at
+  either end. `user` is her Gitea login for the `library-human` slot (sage-2925), checked as the
+  entry's `user` is. `editor` and its `user` come back only when given; a save without them refuses
+  in C2-02.
 - `types` maps a folder name to `character`, `place`, `research`, `tracker` or `summary`.
   `manuscript` lists folder names and shares none with `types`.
 - A universe has `name`, `books` and `playground`. A hybrid adds `kind: "hybrid"`, two or more
   plain-universe `sources`, `constraints` (each one `{ "exclude": ... }` or
   `{ "pin": { "entity", "field", "value" } }`) and `notes`, and may have `books: []`. A draft
   universe has only `kind: "draft"`, `name` and one or more `playground` prefixes, and comes back as
-  `{ kind: "draft", name, books: [], playground }`. `kind` is absent, `"hybrid"` or `"draft"`.
+  `{ kind: "draft", name, books: [], playground, supporting }`. `kind` is absent, `"hybrid"` or `"draft"`.
 - A playground prefix ends in `/` and has one of three levels (C2-01c). Book level lies inside one of
   its own entry's book folders. Universe level, in a plain universe or a hybrid, lies outside every
   book folder. A draft's prefixes all lie outside every book folder. No prefix holds another or is
   listed twice, across every entry.
+- Every universe kind may also have `supporting`, a list of prefixes where agents may write (C2-01d,
+  M12). It comes back on every universe, `[]` when absent. A supporting prefix follows the playground's
+  rules: it ends in `/`, has the same three levels, holds no other supporting prefix and is listed
+  once, across every entry.
+- Between the two lists: a supporting prefix may equal a playground prefix of its own entry, and a
+  playground prefix may hold one of its own entry's supporting prefixes. A supporting prefix may not
+  hold a playground prefix, which scope would then never reach, and may not equal, hold or lie inside
+  another entry's playground prefix.
 
 Refusals:
 
 | Code | When |
 |---|---|
 | `library-playground-other-universe` | a playground prefix lies inside, or holds, a book folder of another entry |
-| `library-mapping-invalid` | any other shape fault: unknown key, bad remote or branch, an unknown `kind`, a book folder in two universes, a book folder that holds another, a playground prefix that holds another or is listed twice, a prefix equal to a book folder or holding its own entry's book, a draft with `books` or with no prefix, a hybrid source that is unknown, a hybrid or a draft |
+| `library-supporting-other-universe` | a supporting prefix lies inside, or holds, a book folder of another entry |
+| `library-mapping-invalid` | any other shape fault: unknown key, bad remote or branch, an unknown `kind`, a book folder in two universes, a book folder that holds another, a playground or supporting prefix that holds another of its list or is listed twice, a prefix equal to a book folder or holding its own entry's book, a supporting prefix that holds a playground prefix or overlaps another entry's, a bad `editor`, a draft with `books` or with no prefix, a hybrid source that is unknown, a hybrid or a draft |
 
 ## Scope
 
 `classify(mapping, path)` decides scope from the path alone. Only paths ending in lowercase `.md` are
-mapped. It checks prefixes first. A path under any entry's playground prefix is `playground`, with that
-entry as `universe` and the book folder holding the prefix as `book`, or `null` at universe level and
+mapped. It checks prefixes first, supporting before playground. A path under any entry's supporting
+prefix is `supporting`, and otherwise one under a playground prefix is `playground`. Either way that
+entry is `universe` and the book folder holding the prefix is `book`, or `null` at universe level and
 in a draft. Any other path under a book folder is `canon`. Everything else is `unmapped`. The type is
-the first folder after the playground prefix, or after the book: a `types` name, `manuscript`, or
-`null`.
+the first folder after the prefix, or after the book: a `types` name, `manuscript`, or `null`.
+
+## Agent write paths
+
+`supportingPath(mapping, universe, path, tree)` returns `path` when an agent may write it in that
+universe, else it refuses `library-write-story-path` (C2-01d, M12). `tree` is the array `listTree`
+returns for the commit the write lands on; anything else is a TypeError. It reads no git. The checks
+run in this order, so a path with two faults always names the same one:
+
+1. a string of at most 1,024 UTF-8 bytes;
+2. no control character (the `editor` class), and the message leaves the path out;
+3. no backslash;
+4. not absolute;
+5. no empty, `.` or `..` segment, which also refuses `//` and a trailing `/`;
+6. `classify` gives `supporting` in that same universe, which refuses unmapped, `.canvas`, `.base`
+   and attachment paths, canon, a playground-only folder and another universe's prefix;
+7. no folder on the way, and not the path itself, is a symlink (`120000`) or gitlink (`160000`) in
+   `tree`;
+8. no folder on the way, and not the path itself, matches a tree path or tree folder after
+   `normalize('NFC').toLowerCase()` unless it is that exact name. APFS folds case and Unicode form,
+   so her checkout would put the file somewhere else. A tree that already holds case twins refuses a
+   write to either (R7).
+
+A delete's further rule, that the path exists at the tip as a `100644` blob, belongs to the C2-02
+broker.
 
 ## Reader
 

packages/library/src/index.mjs

@@ -2,6 +2,7 @@
 export { LibraryError, RULES, problem, sortProblems } from './problems.mjs';
 export { checkMapping, TYPES } from './mapping.mjs';
 export { classify } from './scope.mjs';
+export { supportingPath } from './supporting.mjs';
 export { extractLinks, parseWikilink, resolver, formOf, isAttachment } from './links.mjs';
 export { readLibrary, listTree, readTexts, parseFile, parseFrontMatter, headCommit, MAX_BLOB, LINK_FIELDS } from './reader.mjs';
 export { renderItems, KINDS, NOTICES, UNREADABLE } from './render.mjs';

packages/library/src/mapping.mjs

@@ -1,8 +1,9 @@
 // The library project entry of a business file (design 1.1): her folders mapped onto universes,
 // books, type folders, manuscript folders and playground prefixes at three levels (ruling after r11,
-// C2-01c): inside one of the entry's books, outside every book, or in a draft universe. A pure validator. Business file
-// loading wires it in C2-04, which passes its own `fail` so the refusal reads as a business file
-// problem. Agents can't write this entry (M9, C2-04).
+// C2-01c): inside one of the entry's books, outside every book, or in a draft universe. Supporting
+// prefixes (C2-01d) follow the same rules and are where agents may write (M12). A pure validator.
+// Business file loading wires it in C2-04, which passes its own `fail` so the refusal reads as a
+// business file problem. Agents can't write this entry (M9, C2-04).
 import { raise } from './problems.mjs';
 
 export const TYPES = Object.freeze(['character', 'place', 'research', 'tracker', 'summary']);
@@ -12,6 +13,12 @@ const BRANCH = /^[A-Za-z0-9][A-Za-z0-9._/-]{0,127}$/;
 const USER = /^[A-Za-z0-9_.-]{1,100}$/;
 const CONSTRAINT_KEYS = ['exclude', 'pin'];
 const KINDS = ['hybrid', 'draft'];
+// C2-01d (F41): the editor ident her Console saves commit under. Git drops `<` and `>` from an ident
+// and commits under a different name, so they refuse here (webby-0169 R1).
+const IDENT_BAD = /[\u0000-\u001f\u007f-\u009f<>]/;
+// Git's ident.c crud() strips any byte <= 0x20 and , : ; < > " \ ' from both ends of an ident, so a
+// value that starts or ends with one would save one name and commit another (sage-3601, sage-3606).
+const IDENT_CRUD_END = /^[\u0000-\u0020,:;<>"\\']|[\u0000-\u0020,:;<>"\\']$/;
 
 // A folder segment from her vault: spaces and capitals are fine, separators, control characters
 // and dot names are not.
@@ -40,7 +47,7 @@ export function checkMapping(entry, where = 'library', { fail = raise } = {}) {
   };
 
   object(entry, '');
-  only(entry, ['kind', 'remote', 'branch', 'user', 'vaultPrefix', 'universes', 'types', 'manuscript'], 'entry');
+  only(entry, ['kind', 'remote', 'branch', 'user', 'vaultPrefix', 'editor', 'universes', 'types', 'manuscript'], 'entry');
   if (entry.kind !== 'library') bad('kind must be "library"');
   let url;
   try { url = new URL(entry.remote); } catch { bad('remote must be an https:// URL'); }
@@ -52,6 +59,20 @@ export function checkMapping(entry, where = 'library', { fail = raise } = {}) {
   if (Object.hasOwn(entry, 'user') && (typeof entry.user !== 'string' || !USER.test(entry.user)))
     bad('user must be a plain account name');
   if (Object.hasOwn(entry, 'vaultPrefix') && !segment(entry.vaultPrefix)) bad('vaultPrefix must be one folder name');
+  if (Object.hasOwn(entry, 'editor')) {
+    object(entry.editor, 'editor');
+    only(entry.editor, ['name', 'email', 'user'], 'editor');
+    // Her Gitea login for the library-human slot, which C2-02 passes in (sage-2925). Optional here.
+    if (Object.hasOwn(entry.editor, 'user') && (typeof entry.editor.user !== 'string' || !USER.test(entry.editor.user)))
+      bad('editor.user must be a plain account name');
+    for (const key of ['name', 'email']) {
+      const value = entry.editor[key];
+      if (typeof value !== 'string' || !value.trim() || IDENT_BAD.test(value))
+        bad(`editor.${key} must be non-empty text with no control character, < or >`);
+      if (value.trim() !== value || IDENT_CRUD_END.test(value))
+        bad(`editor.${key} must not start or end with whitespace or any of , : ; " ' \\`);
+    }
+  }
 
   object(entry.types, 'types');
   for (const [name, type] of Object.entries(entry.types)) {
@@ -64,6 +85,7 @@ export function checkMapping(entry, where = 'library', { fail = raise } = {}) {
   object(entry.universes, 'universes');
   if (!Object.keys(entry.universes).length) bad('universes must name at least one universe');
   const universes = {}, bookOwner = new Map(), prefixes = [], prefixOwner = new Map();
+  const supports = [], supportOwner = new Map();
   for (const [id, universe] of Object.entries(entry.universes)) {
     const name = `universes.${id}`;
     if (!ID.test(id)) bad(`universe id ${JSON.stringify(id)} is not a plain id`);
@@ -71,8 +93,8 @@ export function checkMapping(entry, where = 'library', { fail = raise } = {}) {
     if (Object.hasOwn(universe, 'kind') && !KINDS.includes(universe.kind)) bad(`${name}.kind must be "hybrid" or "draft"`);
     const hybrid = universe.kind === 'hybrid', draft = universe.kind === 'draft';
     if (draft && Object.hasOwn(universe, 'books')) bad(`${name} is a draft and takes no books`);
-    only(universe, hybrid ? ['kind', 'name', 'sources', 'books', 'playground', 'constraints', 'notes']
-      : draft ? ['kind', 'name', 'playground'] : ['name', 'books', 'playground'], name);
+    only(universe, hybrid ? ['kind', 'name', 'sources', 'books', 'playground', 'supporting', 'constraints', 'notes']
+      : draft ? ['kind', 'name', 'playground', 'supporting'] : ['name', 'books', 'playground', 'supporting'], name);
     if (typeof universe.name !== 'string' || !universe.name.trim() || universe.name.length > 128 || /[\u0000-\u001f]/.test(universe.name))
       bad(`${name}.name must be a short display name`);
     const books = draft ? [] : list(universe.books, `${name}.books`, folder, 'a folder path');
@@ -81,12 +103,14 @@ export function checkMapping(entry, where = 'library', { fail = raise } = {}) {
       if (bookOwner.has(book)) bad(`book folder ${JSON.stringify(book)} is in two universes`);
       bookOwner.set(book, id);
     }
-    const playground = list(universe.playground ?? [], `${name}.playground`,
-      value => typeof value === 'string' && value.endsWith('/') && folder(value.slice(0, -1)), 'a folder path ending in /');
+    const prefix = value => typeof value === 'string' && value.endsWith('/') && folder(value.slice(0, -1));
+    const playground = list(universe.playground ?? [], `${name}.playground`, prefix, 'a folder path ending in /');
     if (draft && !playground.length) bad(`${name}.playground must name at least one prefix`);
-    for (const prefix of playground) { prefixes.push(prefix); prefixOwner.set(prefix, id); }
-    if (draft) { universes[id] = { kind: 'draft', name: universe.name, books, playground }; continue; }
-    const out = { name: universe.name, books, playground };
+    for (const p of playground) { prefixes.push(p); prefixOwner.set(p, id); }
+    const supporting = list(universe.supporting ?? [], `${name}.supporting`, prefix, 'a folder path ending in /');
+    for (const p of supporting) { supports.push(p); supportOwner.set(p, id); }
+    if (draft) { universes[id] = { kind: 'draft', name: universe.name, books, playground, supporting }; continue; }
+    const out = { name: universe.name, books, playground, supporting };
     if (hybrid) {
       out.kind = 'hybrid';
       out.sources = list(universe.sources, `${name}.sources`, value => typeof value === 'string' && ID.test(value), 'a universe id');
@@ -124,18 +148,36 @@ export function checkMapping(entry, where = 'library', { fail = raise } = {}) {
   for (const a of books) for (const b of books) if (a !== b && holds(a, b)) bad(`book folder ${JSON.stringify(a)} holds book folder ${JSON.stringify(b)}`);
   for (const a of prefixes) for (const b of prefixes) if (a !== b && holds(a, b)) bad(`playground ${JSON.stringify(a)} holds playground ${JSON.stringify(b)}`);
   if (new Set(prefixes).size !== prefixes.length) bad('a playground prefix is listed twice');
+  for (const a of supports) for (const b of supports) if (a !== b && holds(a, b)) bad(`supporting ${JSON.stringify(a)} holds supporting ${JSON.stringify(b)}`);
+  if (new Set(supports).size !== supports.length) bad('a supporting prefix is listed twice');
   // A prefix's level comes from where it sits (ruling after r11). Inside one of its own entry's books
   // is book level, outside every book is universe level, and a draft's prefixes are all outside. Scope
   // checks prefixes first (scope.mjs), so a prefix equal to or holding a book would turn that book
-  // into playground.
-  for (const [prefix, id] of prefixOwner) {
-    for (const [book, owner] of bookOwner) {
-      const at = `universes.${id}.playground ${JSON.stringify(prefix)}`;
-      if (prefix === `${book}/`) bad(`${at} is the whole book folder ${JSON.stringify(book)}`);
-      const inside = holds(book, prefix), holding = holds(prefix, book);
-      if ((inside || holding) && owner !== id)
-        fail('library-playground-other-universe', `${where} ${at} ${inside ? 'lies inside' : 'holds'} book folder ${JSON.stringify(book)} of universes.${owner}`);
-      if (holding) bad(`${at} holds its own book folder ${JSON.stringify(book)}`);
+  // into playground or supporting.
+  const againstBooks = (owners, list, code) => {
+    for (const [prefix, id] of owners) {
+      for (const [book, owner] of bookOwner) {
+        const at = `universes.${id}.${list} ${JSON.stringify(prefix)}`;
+        if (prefix === `${book}/`) bad(`${at} is the whole book folder ${JSON.stringify(book)}`);
+        const inside = holds(book, prefix), holding = holds(prefix, book);
+        if ((inside || holding) && owner !== id)
+          fail(code, `${where} ${at} ${inside ? 'lies inside' : 'holds'} book folder ${JSON.stringify(book)} of universes.${owner}`);
+        if (holding) bad(`${at} holds its own book folder ${JSON.stringify(book)}`);
+      }
+    }
+  };
+  againstBooks(prefixOwner, 'playground', 'library-playground-other-universe');
+  againstBooks(supportOwner, 'supporting', 'library-supporting-other-universe');
+  // C2-01d, between the lists. A supporting prefix may equal a playground prefix of its own entry, and
+  // a playground may hold one of its own entry's supporting prefixes. A supporting prefix that holds a
+  // playground would hide it, since scope checks supporting first. Any overlap across entries would
+  // give one path two universes.
+  for (const [s, sid] of supportOwner) {
+    for (const [p, pid] of prefixOwner) {
+      const at = `universes.${sid}.supporting ${JSON.stringify(s)}`;
+      if (sid !== pid && (s === p || holds(s, p) || holds(p, s)))
+        bad(`${at} overlaps playground ${JSON.stringify(p)} of universes.${pid}`);
+      if (sid === pid && s !== p && holds(s, p)) bad(`${at} holds playground ${JSON.stringify(p)}`);
     }
   }
 
@@ -143,6 +185,8 @@ export function checkMapping(entry, where = 'library', { fail = raise } = {}) {
     kind: 'library', remote: entry.remote, branch: entry.branch,
     ...(Object.hasOwn(entry, 'user') ? { user: entry.user } : {}),
     ...(Object.hasOwn(entry, 'vaultPrefix') ? { vaultPrefix: entry.vaultPrefix } : {}),
+    ...(Object.hasOwn(entry, 'editor') ? { editor: { name: entry.editor.name, email: entry.editor.email,
+      ...(Object.hasOwn(entry.editor, 'user') ? { user: entry.editor.user } : {}) } } : {}),
     universes, types: { ...entry.types }, manuscript,
   });
 }

packages/library/src/scope.mjs

@@ -2,16 +2,22 @@
 // Paths are repo-relative and compared exactly, case included (R7 handles case-only twins).
 const inside = (folder, path) => path.startsWith(folder.endsWith('/') ? folder : `${folder}/`);
 
-// { scope: 'playground' | 'canon', universe, book, type, folder } or { scope: 'unmapped' }.
-// Prefixes come first (ruling after r11, C2-01c): a `.md` file under any entry's playground prefix is
-// playground, with that entry as `universe` and the book folder that holds the prefix as `book`, or
-// null at universe level and in a draft. Otherwise a `.md` file in a book folder is canon. `type` is
-// the mapped type of the first folder under the prefix (playground) or under the book (canon),
+// { scope: 'supporting' | 'playground' | 'canon', universe, book, type, folder } or { scope: 'unmapped' }.
+// Prefixes come first (ruling after r11, C2-01c), supporting before playground (C2-01d, design 1.2):
+// a `.md` file under any entry's supporting prefix is supporting, and otherwise one under a playground
+// prefix is playground. Either way `universe` is that entry and `book` is the book folder that holds
+// the prefix, or null at universe level and in a draft. Otherwise a `.md` file in a book folder is
+// canon. `type` is the mapped type of the first folder under the prefix or under the book (canon),
 // 'manuscript' for a manuscript folder, else null. `folder` is that folder name. checkMapping keeps
-// prefixes from overlapping, so at most one matches.
+// prefixes of one list from overlapping, and keeps a supporting prefix from holding a playground
+// prefix, so the first match is the only one that counts.
 export function classify(mapping, path) {
   if (typeof path !== 'string' || !path.endsWith('.md')) return { scope: 'unmapped' };
   const entries = Object.entries(mapping.universes);
+  for (const [universe, entry] of entries) {
+    const prefix = entry.supporting.find(p => inside(p, path));
+    if (prefix) return place(mapping, path, prefix, { scope: 'supporting', universe, book: entry.books.find(b => inside(b, prefix)) ?? null });
+  }
   for (const [universe, entry] of entries) {
     const prefix = entry.playground.find(p => inside(p, path));
     if (prefix) return place(mapping, path, prefix, { scope: 'playground', universe, book: entry.books.find(b => inside(b, prefix)) ?? null });

packages/library/src/supporting.mjs

@@ -0,0 +1,49 @@
+// C2-01d (M12): the paths an agent may write. A path passes only under a supporting prefix of the
+// named universe, and only if nothing in the tree could turn the write into something else: a
+// symlink or gitlink on the way, or a name that differs from a tree name only in case or Unicode
+// form (APFS folds both, so her checkout would put the file somewhere else). Pure; reads no git.
+import { LibraryError } from './problems.mjs';
+import { classify } from './scope.mjs';
+
+const CONTROL = /[\u0000-\u001f\u007f-\u009f]/;
+const MAX_BYTES = 1024;
+const LINKS = new Set(['120000', '160000']);
+const fold = name => name.normalize('NFC').toLowerCase();
+
+// `tree` is the array listTree returns ({ mode, type, oid, size, path }). Returns `path` or throws
+// library-write-story-path naming the class. Checks run in a fixed order, so a path with two faults
+// always names the same one.
+export function supportingPath(mapping, universe, path, tree) {
+  if (!Array.isArray(tree)) throw new TypeError('supportingPath needs the listTree array');
+  const refuse = message => { throw new LibraryError('library-write-story-path', message); };
+  if (typeof path !== 'string') refuse('the path must be a string');
+  const at = JSON.stringify(path);
+  if (Buffer.byteLength(path, 'utf8') > MAX_BYTES) refuse(`${at} is longer than ${MAX_BYTES} bytes`);
+  if (CONTROL.test(path)) refuse('the path holds a control character');
+  if (path.includes('\\')) refuse(`${at} holds a backslash`);
+  if (path.startsWith('/')) refuse(`${at} is absolute`);
+  const parts = path.split('/');
+  if (parts.some(part => part === '' || part === '.' || part === '..')) refuse(`${at} has an empty, . or .. segment`);
+  const place = classify(mapping, path);
+  if (place.scope !== 'supporting' || place.universe !== universe)
+    refuse(`${at} is not under a supporting folder of universe ${JSON.stringify(universe)}`);
+  const own = parts.map((_, i) => parts.slice(0, i + 1).join('/'));
+  const modes = new Map(tree.map(entry => [entry.path, entry.mode]));
+  for (const p of own) if (LINKS.has(modes.get(p))) refuse(`${at} goes through the symlink or gitlink ${JSON.stringify(p)}`);
+  const names = new Map();
+  for (const entry of tree) {
+    const segs = entry.path.split('/');
+    for (let i = 1; i <= segs.length; i++) {
+      const name = segs.slice(0, i).join('/');
+      const key = fold(name);
+      if (!names.has(key)) names.set(key, new Set());
+      names.get(key).add(name);
+    }
+  }
+  for (const p of own) {
+    const seen = names.get(fold(p));
+    if (seen && [...seen].some(name => name !== p))
+      refuse(`${at} differs only in case or Unicode form from ${JSON.stringify([...seen].find(name => name !== p))}`);
+  }
+  return path;
+}

packages/library/src/survey.mjs

@@ -62,7 +62,7 @@ export async function survey({ repo, commit, mapping }) {
     forms, attachments, fields,
   };
   if (mapping) {
-    const scopes = { canon: 0, playground: 0, unmapped: 0 };
+    const scopes = { canon: 0, playground: 0, supporting: 0, unmapped: 0 };
     for (const entry of entries) scopes[classify(mapping, entry.path).scope]++;
     const library = await readLibrary({ repo, commit: head, mapping });
     const steps = Object.fromEntries(STEPS.map(s => [s, 0]));
@@ -89,7 +89,7 @@ export function formatSurvey(s) {
   out.push(`body links ${FORMS.map(f => `${f} ${s.forms[f]}`).join(', ')}; attachment ${s.attachments}`);
   for (const [field, c] of Object.entries(s.fields)) out.push(`field ${field} wikilink ${c.wikilink}, name ${c.name}`);
   if (s.scopes) {
-    out.push(`scopes canon ${s.scopes.canon}, playground ${s.scopes.playground}, unmapped ${s.scopes.unmapped}; indexed ${s.indexed}`);
+    out.push(`scopes canon ${s.scopes.canon}, playground ${s.scopes.playground}, supporting ${s.scopes.supporting}, unmapped ${s.scopes.unmapped}; indexed ${s.indexed}`);
     out.push(`resolved ${STEPS.map(st => `${st} ${s.steps[st]}`).join(', ')}, unresolved ${s.steps.unresolved}`);
     out.push(`problems ${Object.entries(s.problems).map(([code, n]) => `${code} ${n}`).join(', ')}`);
   }

packages/library/tests/mapping.test.mjs

@@ -1,5 +1,9 @@
 import test from 'node:test';
 import assert from 'node:assert/strict';
+import { execFileSync } from 'node:child_process';
+import { mkdtempSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
 import { checkMapping, classify, LibraryError } from '../src/index.mjs';
 import { mapping, mappingEntry } from './helpers.mjs';
 
@@ -45,7 +49,7 @@ test('C2-01c: universe-level prefixes lie outside every book, in a plain univers
 
 test('C2-01c: a draft takes kind, name and playground only, and comes back frozen with books []', () => {
   const m = mapping(e => { e.universes.idea = draft(); return e; });
-  assert.deepEqual(m.universes.idea, { kind: 'draft', name: 'New World', books: [], playground: ['Drafts/New World/'] });
+  assert.deepEqual(m.universes.idea, { kind: 'draft', name: 'New World', books: [], playground: ['Drafts/New World/'], supporting: [] });
   assert.ok(Object.isFrozen(m.universes.idea) && Object.isFrozen(m.universes.idea.books) && Object.isFrozen(m.universes.idea.playground));
   refuses(e => { e.universes.idea = { ...draft(), books: ['New World'] }; return e; }, 'library-mapping-invalid', /universes.idea is a draft and takes no books/);
   refuses(e => { e.universes.idea = { ...draft(), books: [] }; return e; }, 'library-mapping-invalid', /takes no books/);
@@ -56,6 +60,107 @@ test('C2-01c: a draft takes kind, name and playground only, and comes back froze
     refuses(e => { e.universes.harbor.kind = kind; return e; }, 'library-mapping-invalid', /universes.harbor.kind must be "hybrid" or "draft"/);
 });
 
+test('C2-01d: supporting prefixes at book level, universe level, in a hybrid and in a draft, [] when absent', () => {
+  const m = mapping(e => {
+    e.universes.harbor.supporting = ['Book One/Notes/', 'Harbor Notes/'];
+    e.universes.cross = { kind: 'hybrid', name: 'Cross', sources: ['harbor', 'second'], books: [], supporting: ['Crossover Notes/'] };
+    e.universes.idea = { ...draft(), supporting: ['Drafts/New World Notes/'] };
+    return e;
+  });
+  assert.deepEqual(m.universes.harbor.supporting, ['Book One/Notes/', 'Harbor Notes/']);
+  assert.deepEqual(m.universes.cross.supporting, ['Crossover Notes/']);
+  assert.deepEqual(m.universes.idea.supporting, ['Drafts/New World Notes/']);
+  assert.deepEqual(m.universes.second.supporting, []);
+  assert.ok(Object.isFrozen(m.universes.harbor.supporting) && Object.isFrozen(m.universes.second.supporting));
+  assert.deepEqual(mapping().universes.harbor.supporting, []);
+});
+
+test('C2-01d: each supporting prefix rule refuses with its code', () => {
+  const invalid = (change, pattern) => refuses(change, 'library-mapping-invalid', pattern);
+  invalid(e => { e.universes.harbor.supporting = ['Book One/Notes']; return e; }, /universes.harbor.supporting holds "Book One\/Notes", which is not a folder path ending in \//);
+  invalid(e => { e.universes.harbor.supporting = ['Book One/../Notes/']; return e; }, /which is not a folder path ending in \//);
+  invalid(e => { e.universes.harbor.supporting = 'Book One/Notes/'; return e; }, /universes.harbor.supporting must be a list/);
+  invalid(e => { e.universes.harbor.supporting = ['Book One/Notes/', 'Book One/Notes/Deep/']; return e; },
+    /supporting "Book One\/Notes\/" holds supporting "Book One\/Notes\/Deep\/"/);
+  invalid(e => { e.universes.harbor.supporting = ['Ideas/']; e.universes.idea = { ...draft(), supporting: ['Ideas/'] }; return e; },
+    /a supporting prefix is listed twice/);
+  invalid(e => { e.universes.harbor.supporting = ['Book One/']; return e; }, /universes.harbor.supporting "Book One\/" is the whole book folder "Book One"/);
+  invalid(e => { e.universes.harbor.books = ['Shelf/Book One']; e.universes.harbor.playground = []; e.universes.harbor.supporting = ['Shelf/']; return e; },
+    /universes.harbor.supporting "Shelf\/" holds its own book folder "Shelf\/Book One"/);
+  // Supporting is checked first in scope, so a supporting prefix holding a playground would hide it.
+  invalid(e => { e.universes.harbor.supporting = ['Book One/Workshop/']; e.universes.harbor.playground = ['Book One/Workshop/Playground/']; return e; },
+    /universes.harbor.supporting "Book One\/Workshop\/" holds playground "Book One\/Workshop\/Playground\/"/);
+  // Across entries any overlap would give one path two universes.
+  for (const [supporting, playground] of [['Ideas/', 'Ideas/'], ['Ideas/Deep/', 'Ideas/'], ['Ideas/', 'Ideas/Deep/']])
+    invalid(e => { e.universes.harbor.supporting = [supporting]; e.universes.idea = draft([playground]); return e; },
+      new RegExp(`universes.harbor.supporting "${supporting}" overlaps playground "${playground}" of universes.idea`));
+  refuses(e => { e.universes.harbor.supporting = ['Second World/Notes/']; return e; },
+    'library-supporting-other-universe', /universes.harbor.supporting "Second World\/Notes\/" lies inside book folder "Second World" of universes.second/);
+  refuses(e => { e.universes.second.books = ['Worlds/Second']; e.universes.harbor.supporting = ['Worlds/']; return e; },
+    'library-supporting-other-universe', /universes.harbor.supporting "Worlds\/" holds book folder "Worlds\/Second" of universes.second/);
+  refuses(e => { e.universes.idea = { ...draft(), supporting: ['Book One/Idea Notes/'] }; return e; },
+    'library-supporting-other-universe', /universes.idea.supporting "Book One\/Idea Notes\/" lies inside book folder "Book One" of universes.harbor/);
+});
+
+test('C2-01d: between the lists, a supporting prefix may equal its own playground, and a playground may hold its own supporting', () => {
+  const same = mapping(e => { e.universes.harbor.supporting = ['Book One/Playground/']; return e; });
+  assert.deepEqual([same.universes.harbor.playground, same.universes.harbor.supporting], [['Book One/Playground/'], ['Book One/Playground/']]);
+  const nested = mapping(e => { e.universes.harbor.supporting = ['Book One/Playground/Notes/']; return e; });
+  assert.deepEqual(nested.universes.harbor.supporting, ['Book One/Playground/Notes/']);
+});
+
+test('C2-01d: editor is optional, kept when given, and refuses anything but a plain name and email', () => {
+  assert.equal(Object.hasOwn(mapping(), 'editor'), false);
+  const editor = { name: 'Her Name', email: '[email protected]' };
+  const m = mapping(e => ({ ...e, editor }));
+  assert.deepEqual(m.editor, editor);
+  assert.notEqual(m.editor, editor);
+  assert.ok(Object.isFrozen(m.editor));
+  const invalid = (value, pattern) => refuses(e => ({ ...e, editor: value }), 'library-mapping-invalid', pattern);
+  for (const value of [null, 'Her Name', 7, ['Her Name', '[email protected]']]) invalid(value, /editor must be an object/);
+  invalid({ ...editor, signingKey: 'x' }, /editor has unknown key "signingKey"/);
+  // sage-2925: an optional Gitea login for her save, checked as the entry's user is.
+  assert.deepEqual(mapping(e => ({ ...e, editor: { ...editor, user: 'her.login-1' } })).editor, { ...editor, user: 'her.login-1' });
+  for (const user of ['', 'her login', 'her@host', 'a'.repeat(101), 7, null])
+    invalid({ ...editor, user }, /editor.user must be a plain account name/);
+  invalid({ name: 'Her Name' }, /editor.email must be non-empty text with no control character, < or >/);
+  invalid({ email: '[email protected]' }, /editor.name must be non-empty text/);
+  for (const bad of ['', '   ', 7, null, 'a\u0000b', 'a\nb', 'a\u001fb', 'a\u007fb', 'a\u0085b', 'a\u009fb', '<her>', 'a<b', 'a>b']) {
+    invalid({ ...editor, name: bad }, /editor.name must be non-empty text with no control character, < or >/);
+    invalid({ ...editor, email: bad }, /editor.email must be non-empty text with no control character, < or >/);
+  }
+  // sage-3601, sage-3606: git's crud() strips whitespace and , : ; < > " \ ' from both ends of an
+  // ident, so a value starting or ending with one refuses. Inner < > and controls refuse above.
+  const ends = [' ', '\u00a0', '\u3000', ',', ':', ';', '"', "'", '\\'];
+  for (const c of ends) for (const padded of [`${c}Her Name`, `Her Name${c}`]) {
+    invalid({ ...editor, name: padded }, /editor.name must not start or end with whitespace or any of , : ; " ' \\/);
+    invalid({ ...editor, email: padded }, /editor.email must not start or end with whitespace or any of , : ; " ' \\/);
+  }
+  for (const c of ['<', '>', '\n', '\t']) for (const padded of [`${c}Her Name`, `Her Name${c}`, `Her${c}Name`])
+    invalid({ ...editor, name: padded }, /editor.name must be non-empty text with no control character, < or >/);
+  assert.equal(mapping(e => ({ ...e, editor: { name: 'Her  Middle Name', email: '[email protected]' } })).editor.name, 'Her  Middle Name');
+  for (const name of ['Doe, Jane Q.', 'Jane: "Q" Doe', "O'Neil", 'Back\\slash Name'])
+    assert.equal(mapping(e => ({ ...e, editor: { name, email: '[email protected]' } })).editor.name, name);
+});
+
+// sage-3606: an accepted editor commits under exactly the saved ident, as author and committer. A
+// future git that strips more from an ident fails here.
+test('C2-01d: an accepted editor round-trips through a real git commit unchanged', t => {
+  const editor = mapping(e => ({ ...e, editor: { name: 'Doe, Jane Q.', email: '[email protected].' } })).editor;
+  const root = mkdtempSync(join(tmpdir(), 'library-ident-'));
+  t.after(() => rmSync(root, { recursive: true, force: true }));
+  // An ident in the environment would win over -c, so the commit runs without one. GIT_DIR and its
+  // family would beat -C (inside a hook, say), and git reads no global or system config (webby-0236 E5).
+  const env = Object.fromEntries(Object.entries(process.env).filter(([k]) => !/^GIT_(AUTHOR|COMMITTER)_/.test(k)));
+  for (const k of ['GIT_DIR', 'GIT_WORK_TREE', 'GIT_COMMON_DIR', 'GIT_INDEX_FILE']) delete env[k];
+  Object.assign(env, { GIT_CONFIG_GLOBAL: '/dev/null', GIT_CONFIG_NOSYSTEM: '1' });
+  const git = (...args) => execFileSync('git', ['-c', `user.name=${editor.name}`, '-c', `user.email=${editor.email}`,
+    '-c', 'commit.gpgsign=false', '-c', 'core.hooksPath=/dev/null', '-C', root, ...args], { encoding: 'utf8', env });
+  git('init', '-q');
+  git('commit', '-q', '--allow-empty', '-m', 'ident');
+  assert.equal(git('log', '-1', '--format=%an%n%ae%n%cn%n%ce'), `${editor.name}\n${editor.email}\n${editor.name}\n${editor.email}\n`);
+});
+
 test('no playground prefix holds another, and no book folder holds another', () => {
   refuses(e => { e.universes.harbor.playground = ['Book One/Playground/', 'Book One/Playground/Deep/']; return e; },
     'library-mapping-invalid', /holds playground/);

packages/library/tests/scope.test.mjs

@@ -53,3 +53,44 @@ test('C2-01c: a canon file linking into a draft gives R6, and into its own unive
     assert.deepEqual(codes(path), [], path);
   }
 });
+
+// Supporting prefixes at three levels (C2-01d). Harbor's book-level prefix sits in both lists, and a
+// second book-level prefix is supporting only.
+const supporting = () => mapping(e => {
+  e.universes.harbor.playground = ['Book One/Playground/', 'Book One/Sketches/'];
+  e.universes.harbor.supporting = ['Book One/Playground/', 'Book One/Notes/', 'Harbor Notes/'];
+  e.universes.idea = { kind: 'draft', name: 'New World', playground: ['Drafts/New World/'], supporting: ['Drafts/New World Notes/'] };
+  return e;
+});
+
+test('C2-01d: each supporting level gives its universe, and its book or null', () => {
+  const m = supporting();
+  assert.deepEqual(classify(m, 'Book One/Notes/Characters/Mara.md'),
+    { scope: 'supporting', universe: 'harbor', book: 'Book One', type: 'character', folder: 'Characters' });
+  assert.deepEqual(classify(m, 'Harbor Notes/Places/Island.md'),
+    { scope: 'supporting', universe: 'harbor', book: null, type: 'place', folder: 'Places' });
+  assert.deepEqual(classify(m, 'Harbor Notes/Loose.md'), { scope: 'supporting', universe: 'harbor', book: null, type: null, folder: null });
+  assert.deepEqual(classify(m, 'Drafts/New World Notes/Chapters/Open.md'),
+    { scope: 'supporting', universe: 'idea', book: null, type: 'manuscript', folder: 'Chapters' });
+  assert.deepEqual(classify(m, 'Drafts/New World/Ana.md'), { scope: 'playground', universe: 'idea', book: null, type: null, folder: null });
+  assert.deepEqual(classify(m, 'Book One/Places/Dock.md'), { scope: 'canon', universe: 'harbor', book: 'Book One', type: 'place', folder: 'Places' });
+});
+
+test('C2-01d: supporting comes before playground; a folder in both lists is supporting, one in the playground only stays playground', () => {
+  const m = supporting();
+  assert.deepEqual(classify(m, 'Book One/Playground/What If.md'),
+    { scope: 'supporting', universe: 'harbor', book: 'Book One', type: null, folder: null });
+  assert.deepEqual(classify(m, 'Book One/Sketches/Research/Tides.md'),
+    { scope: 'playground', universe: 'harbor', book: 'Book One', type: 'research', folder: 'Research' });
+  // A playground may hold a supporting prefix of its own entry: the inner folder is supporting.
+  const nested = mapping(e => { e.universes.harbor.supporting = ['Book One/Playground/Notes/']; return e; });
+  assert.equal(classify(nested, 'Book One/Playground/Notes/A.md').scope, 'supporting');
+  assert.equal(classify(nested, 'Book One/Playground/A.md').scope, 'playground');
+});
+
+test('C2-01d: only .md files are supporting; a .canvas or .base under a supporting prefix is unmapped', () => {
+  const m = supporting();
+  for (const path of ['Book One/Notes/Board.canvas', 'Harbor Notes/Table.base', 'Drafts/New World Notes/Map.canvas',
+    'Harbor Notes/cover.png', 'Harbor Notesx/a.md'])
+    assert.deepEqual(classify(m, path), { scope: 'unmapped' }, path);
+});

packages/library/tests/supporting.test.mjs

@@ -0,0 +1,92 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { inspect } from 'node:util';
+import { LibraryError, supportingPath } from '../src/index.mjs';
+import { mapping } from './helpers.mjs';
+
+// C2-01d (M12): the path checks an agent write passes. The tree is a listTree array built by hand,
+// with a symlink, a gitlink, case twins and an NFC name, so no git is needed.
+const m = mapping(e => {
+  e.universes.harbor.playground = ['Book One/Playground/', 'Book One/Sketches/'];
+  e.universes.harbor.supporting = ['Book One/Playground/', 'Book One/Notes/', 'Harbor Notes/'];
+  e.universes.second.supporting = ['Second Notes/'];
+  e.universes.idea = { kind: 'draft', name: 'New World', playground: ['Drafts/New World/'], supporting: ['Drafts/New World Notes/'] };
+  return e;
+});
+const blob = (path, mode = '100644') => ({ mode, type: mode === '160000' ? 'commit' : 'blob', oid: '0'.repeat(40), size: 1, path });
+const tree = [
+  blob('Book One/Characters/Mara Vell.md'),
+  blob('Book One/Notes/Existing.md'),
+  blob('Book One/Notes/Linked', '120000'),
+  blob('Book One/Notes/Vendor', '160000'),
+  blob('Book One/Notes/Pointer.md', '120000'),
+  blob('Book One/Notes/Case/Twin.md'),
+  blob('Book One/Notes/Café.md'),
+  blob('Harbor Notes/Places/Island.md'),
+];
+const refuses = (universe, path, pattern) => assert.throws(() => supportingPath(m, universe, path, tree),
+  e => e instanceof LibraryError && e.code === 'library-write-story-path' && pattern.test(e.message), inspect(path));
+
+test('C2-01d: a path passes at book level, universe level, in a draft and in a folder in both lists', () => {
+  for (const [universe, path] of [['harbor', 'Book One/Notes/Characters/New.md'], ['harbor', 'Book One/Notes/Existing.md'],
+    ['harbor', 'Harbor Notes/Places/Island.md'], ['harbor', 'Harbor Notes/Loose.md'], ['idea', 'Drafts/New World Notes/Ana.md'],
+    ['harbor', 'Book One/Playground/What If.md'], ['second', 'Second Notes/A.md'], ['harbor', 'Book One/Notes/Café.md']])
+    assert.equal(supportingPath(m, universe, path, tree), path);
+  assert.equal(supportingPath(m, 'harbor', 'Book One/Notes/x.md', []), 'Book One/Notes/x.md');
+});
+
+test('C2-01d: a path of exactly 1024 bytes passes, and 1025 bytes made of multi-byte characters refuses', () => {
+  const prefix = 'Harbor Notes/';
+  const exact = `${prefix}${'a'.repeat(1024 - prefix.length - 3)}.md`;
+  assert.equal(Buffer.byteLength(exact), 1024);
+  assert.equal(supportingPath(m, 'harbor', exact, tree), exact);
+  // é is two bytes: 1025 bytes but far fewer characters.
+  const name = 'é'.repeat((1025 - prefix.length - 3 - 1) / 2);
+  const long = `${prefix}${name}a.md`;
+  assert.equal(Buffer.byteLength(long), 1025);
+  assert.ok(long.length < 1024);
+  refuses('harbor', long, /is longer than 1024 bytes/);
+});
+
+test('C2-01d: a path outside the universe\'s supporting folders refuses', () => {
+  const outside = /is not under a supporting folder of universe/;
+  for (const path of ['Inbox Note.md', 'Book One/Notes/Board.canvas', 'Book One/Notes/Table.base', 'Book One/Notes/cover.png',
+    'Book One/Characters/Mara Vell.md', 'Book One/Sketches/Idea.md', 'Drafts/New World/Ana.md', 'Second Notes/A.md', 'Book One/Notes.md'])
+    refuses('harbor', path, outside);
+  refuses('idea', 'Book One/Notes/A.md', /universe "idea"/);
+  refuses('nowhere', 'Book One/Notes/A.md', /universe "nowhere"/);
+});
+
+test('C2-01d: malformed paths refuse by class, in order', () => {
+  refuses('harbor', '/Book One/Notes/A.md', /"\/Book One\/Notes\/A.md" is absolute/);
+  for (const path of ['Book One/Notes/../Notes/A.md', 'Book One/Notes/./A.md', 'Book One//Notes/A.md', 'Book One/Notes/A/', 'Book One/Notes/..'])
+    refuses('harbor', path, /has an empty, \. or \.\. segment/);
+  refuses('harbor', 'Book One/Notes/A\\B.md', /holds a backslash/);
+  for (const c of ['\u0000', '\u0001', '\n', '\u001f', '\u007f', '\u0085', '\u009f'])
+    assert.throws(() => supportingPath(m, 'harbor', `Book One/Notes/A${c}.md`, tree),
+      e => e.code === 'library-write-story-path' && e.message === 'library-write-story-path: the path holds a control character');
+  for (const path of [7, null, undefined, 1n, ['Book One/Notes/A.md']]) refuses('harbor', path, /the path must be a string/);
+  // A backslash in a path that is also absolute names the backslash: the order is fixed.
+  refuses('harbor', '/a\\b.md', /holds a backslash/);
+  assert.throws(() => supportingPath(m, 'harbor', 'Book One/Notes/A.md', { 'Book One/Notes/A.md': '100644' }), TypeError);
+  assert.throws(() => supportingPath(m, 'harbor', 'Book One/Notes/A.md'), TypeError);
+});
+
+test('C2-01d: a symlink or gitlink on the way, or at the path itself, refuses', () => {
+  refuses('harbor', 'Book One/Notes/Linked/A.md', /goes through the symlink or gitlink "Book One\/Notes\/Linked"/);
+  refuses('harbor', 'Book One/Notes/Vendor/Deep/A.md', /goes through the symlink or gitlink "Book One\/Notes\/Vendor"/);
+  refuses('harbor', 'Book One/Notes/Pointer.md', /goes through the symlink or gitlink "Book One\/Notes\/Pointer.md"/);
+});
+
+test('C2-01d: a name that differs from a tree name only in case or Unicode form refuses, at the file or any folder', () => {
+  refuses('harbor', 'Book One/Notes/existing.md', /differs only in case or Unicode form from "Book One\/Notes\/Existing.md"/);
+  refuses('harbor', 'Book One/Notes/case/New.md', /differs only in case or Unicode form from "Book One\/Notes\/Case"/);
+  refuses('harbor', 'Book One/Notes/CASE/Twin.md', /from "Book One\/Notes\/Case"/);
+  refuses('harbor', 'Harbor notes/A.md', /is not under a supporting folder/);
+  // NFD e + combining acute against the NFC name in the tree: one file on APFS.
+  refuses('harbor', 'Book One/Notes/Café.md', /differs only in case or Unicode form from "Book One\/Notes\/Café.md"/);
+  // A tree that already holds case twins refuses a write to either (R7).
+  const twins = [...tree, blob('Book One/Notes/existing.md')];
+  for (const path of ['Book One/Notes/Existing.md', 'Book One/Notes/existing.md'])
+    assert.throws(() => supportingPath(m, 'harbor', path, twins), e => e.code === 'library-write-story-path' && /differs only in case/.test(e.message));
+});

packages/library/tests/survey.test.mjs

@@ -1,6 +1,6 @@
 import test from 'node:test';
 import assert from 'node:assert/strict';
-import { writeFileSync } from 'node:fs';
+import { readFileSync, writeFileSync } from 'node:fs';
 import { join } from 'node:path';
 import { spawnSync } from 'node:child_process';
 import { fileURLToPath } from 'node:url';
@@ -70,12 +70,23 @@ test('with --mapping the survey adds scope, resolver step and problem counts', a
   assert.equal(out.code, 0, out.stderr);
   const tail = out.stdout.trimEnd().split('\n').slice(-3);
   assert.deepEqual(tail, [
-    'scopes canon 5, playground 1, unmapped 3; indexed 6',
+    'scopes canon 5, playground 1, supporting 0, unmapped 3; indexed 6',
     'resolved root 2, vault-prefix 1, relative 2, shortest 3, unresolved 0',
     'problems R1 0, R2 3, R3 0, R4 0, R5 0, R6 0, R7 0']);
   for (const s of NEVER) assert.ok(!out.stdout.includes(s), s);
 });
 
+test('C2-01d: with --mapping the survey counts supporting files', async t => {
+  const r = repo(t);
+  const entry = JSON.parse(readFileSync(join(FIXTURES, 'mapping.json'), 'utf8'));
+  entry.universes.harbor.supporting = ['Book One/Places/'];
+  const file = join(r.root, 'supporting.json');
+  writeFileSync(file, JSON.stringify(entry));
+  const out = await run(['survey', r.repo, '--mapping', file]);
+  assert.equal(out.code, 0, out.stderr);
+  assert.match(out.stdout, /^scopes canon 4, playground 1, supporting 1, unmapped 3; indexed 6$/m);
+});
+
 test('survey exit codes: usage 4, bad mapping 3, unreadable repo 2', async t => {
   const r = repo(t);
   for (const args of [[], ['scan', r.repo], ['survey'], ['survey', r.repo, '--mapping'], ['survey', r.repo, '--other'], ['survey', r.repo, r.repo]])