Library Access Is Your Own Seat, Never the Project's

In plain terms: a Library is licensed to a person, like a subscription to a precedent service. Bringing another firm onto a matter lets them work on the matter's documents; it never lets them into your precedent banks. Each firm buys its own, and your private templates stay private.

Decision

Owner ruling, 2026-10-04.

1. Only your own seat opens a Library. A person sees, searches and inserts from a Library only when they hold a seat on it themselves: they own it, were added to it by name, joined it from the Marketplace, or (when built) bought it.
2. Folio access lends no Library. Being given access to a Workspace, Project or Document, at any seat, never lets a person see, search or insert from a Library they hold no seat on. That holds for Goldie acting for them too.
3. A folio's Library list only narrows. A Project's or Workspace's chosen Libraries (librarySearchScopes, or Project assignment when built) pick among each person's own seats. A collaborator without a seat on a listed Library simply does not search it there.
4. Why: commercial (each firm buys its own Library; one purchase cannot be shared onward) and confidential (a firm's personal templates never reach another firm brought onto one matter).

Replaces the 2026-10-03 bullet "Sharing a Project shares only its assigned Libraries … without a seat on the Library itself" (/docs/decisions/share-dialog-by-page, rule 3). Assigning Libraries to a Project now chooses what is searched there, for those who hold seats; it grants nothing.

Status

• Written and tested: search candidates, the chips' list, Keep selection, insert and Goldie's library search all read the caller's own seats (convex/library/searchScope.ts, convex/library/search.ts, convex/library/insertWrites.ts, convex/goldie/libraryEntries.ts; tests in convex/library/searchScope.convex.test.ts).
• Tested for a Project collaborator (2026-10-04, convex/library/seatNotLent.convex.test.ts): Alice names her Library on a Project's and a Document's search lists and seats Bob on both, but not on the Library. It never reaches Bob's candidates, chips or Keep selection; Goldie's search for him never names it; and both insert doors (the search card and Goldie's) refuse it. Each guard was broken on purpose and the test failed.
• Content reads checked (2026-10-04): the canvas, listings, document, version and export reads, and Goldie's reads all need a seat on the Library (convex/folio/containerAccess.ts, callerMayUseRoot in convex/folio/folioUsers.ts). A Project or Document cannot reach into a Library through what it contains: a schedule never points into another folio's children, and insert makes a copy.
• Fixed (2026-10-04), with tests in the same file:
  • A master inside a Library can no longer be shared on its own ("Share the Library instead."), and a share left on one is not listed on the sharee's Workspace (convex/folio/folioMembers.ts, convex/folio/home.ts).
  • A copy's About card and YAML export name its Library source (derived_from) only to someone seated on that Library (convex/folio/aboutCodec.ts).
• Open questions: an Open (public) Library can be browsed by anyone signed in, without a seat (libraryDecidesViewing in convex/library/libraryAccess.ts). A reader seat can browse a Library but not open a master in the canvas.
• Not built: Project assignment's backend, paid Libraries and licences. Each must keep rule 1 when built.