The studio tells a visitor that a person's change was made by "the crew" #245

The red check was not this change: the branch was opened before 6075ea8 (#239) landed on main, and the one failing test — "a green change alice opened herself offers Ship" — was corrected there, along with the sandbox git helpers. I said last time that failure was environmental and pre-existing; that was wrong, I had verified it with a filtered run that skips the setup it depends on. Merging main in and running forge.json's check verbatim now gives 400 pass, 0 fail, and tsc --noEmit is clean. Nothing about the change itself moved.

The change: whose name a studio row carries is one rule in one module, src/web/studio/voice.ts, and the decision it writes down is that an agent's name is not a secret — the change's own page and /changes already name the agent that opened a pull to anyone who can read the repository, so "the crew" is a voice, not a redaction. voiceFor asks what the actor is first: a person is named to every viewer who can already see the row, and only an agent's own work (a run, a change it opened, a tell it holds) reads as the crew's to a viewer who cannot see the roster. The app page's Now rows, a run's own page and its transcript, and the front door's working/landed cards all go through it, replacing three hand-written copies of ownerFacts ? name : "the crew"; the avatar takes the same string, so tc can no longer sit under a person's change. Visibility is untouched, and spend, the ledger and the crew roster stay owner-only.

Worth a look: the rule and its reasoning in voice.ts and the matching paragraph in docs/STUDIO.md; src/web/pages/board.ts was outside the issue's file list but held the third copy of the line and the same defect for a person's merged change, so it shares the rule now. The three tests at the end of test/studio.test.ts walk the issue signed out — one author and one set of initials for one change on the app page and in /changes (this one still fails against current main with exactly the reported tc · the crew), the crew's own change, run and waiting tell still reading as the crew's, and the owner still reading quill by name.

🤖 Generated with Claude Code

Closes #206

Main is merged and the branch is green: bun x tsc --noEmit clean, 403 pass, 0 fail across the 22 files forge.json names.

Two conflicts, both in src/web/studio/app.ts and both resolved by keeping what each side meant. The import line took both imports. The real one was #242's new Now row for a tell a person holds: it signed the row with nameFor, the viewer-permission helper this branch deletes. Since personHeld has already established the holder is a person, that row now goes through voiceFor with isAgent: false, so the holder is named to every viewer who can see the row — which is the same thing #242 wanted on the front door and the same thing #206 asks for. "someone" is kept as the unnamed fallback. A tell ivy took herself now joins the anonymous walk in the #206 tests, so the intersection of the two changes is covered.

Unchanged from before: whose name a studio row carries is one rule in src/web/studio/voice.ts — an agent's name is not a secret, so "the crew" is a voice chosen by what the actor is, and only an agent's own work reads as the crew's to a viewer who cannot see the roster. The app page's Now rows, a run's own page and its transcript, and the front door's working and landed cards all sign through it; the avatar takes the same string, so tc can no longer sit under a person's change.

🤖 Generated with Claude Code