test(calibration): replace real-name holder fixture with charlie-example placeholder

Privacy iron rule: no real people's names in checked-in code. The sanctioned
placeholder mapping uses people/charlie-example.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

docs/architecture/KEY_FILES.md

@@ -457,6 +457,7 @@ unresolvable+true|false, pre-v80 NULL/NULL rows survive).
 - `src/core/think/prompt.ts` extension — anti-bias rewrite. `withCalibration` option on `buildThinkSystemPrompt` adds anti-bias rules. `buildCalibrationBlock()` emits the `<calibration>` XML. `buildThinkUserMessage` has TWO shapes: default (question first), and with-calibration (retrieval → calibration → question) when opt-in. Wired into `runThink` via `opts.withCalibration` + `opts.calibrationHolder`.
 - `src/commands/calibration.ts` — CLI: `gbrain calibration` (read + print), `--regenerate`, `--undo-wave <ver>`, `ab-report`. MCP op `get_calibration_profile` (scope: read) backs the same data path. Source-scoped via `sourceScopeOpts(ctx)`.
 - `src/commands/serve-http.ts` extension — three admin routes: `/admin/api/calibration/profile`, `/admin/api/calibration/charts/:type` (image/svg+xml; type in {brier-trend, domain-bars, pattern-statements, abandoned-threads}), `/admin/api/calibration/pattern/:id` (drill-down).
+- `src/core/owner-holder.ts` — single source of truth for "the brain owner" holder string. `DEFAULT_OWNER_HOLDER = 'self'` (matches the consolidate facts→takes writer + `docs/takes-vs-facts.md`); `resolveOwnerHolder({override, configValue})` returns override > `emotional_weight.user_holder` config > `'self'`. Consumed by the calibration_profile cycle phase, `gbrain calibration` CLI, the `get_calibration_profile` op, `think`'s calibration block, `emotional-weight`'s `DEFAULT_USER_HOLDER`, and doctor's `calibration_freshness`. Pure; unit-tested in `test/owner-holder.test.ts`. Does NOT unify owner-identity fragmentation (`self`/`brain`/`people-<owner>`) — tracked separately.
 - `src/commands/takes.ts` extension — `gbrain takes revisit <slug>` opens $EDITOR on the source page with a `<!-- gbrain:revisit -->` cursor marker.
 - `src/commands/doctor.ts` extension — 4 checks: `abandoned_threads`, `calibration_freshness`, `grade_confidence_drift` (mitigation surface; math ships later), `voice_gate_health`.
 - `admin/src/pages/Calibration.tsx` — Calibration tab. Single-column layout. `<TrustedSVG>` wrapper handles `dangerouslySetInnerHTML` for the server-rendered SVG.

docs/takes-vs-facts.md

@@ -91,3 +91,18 @@ First full takes extraction run on a ~100K-page brain:
 4. **Self-reported ≠ verified.** "Reports 7 figures" → holder=person, weight=0.75, NOT world/1.0
 5. **No false precision.** Use 0.05 increments (0.35, 0.55, 0.75), not 0.74 or 0.82
 6. **"So what" test.** Skip Twitter handles, follower counts, obvious metadata
+
+## Owner-holder canonicalization
+
+"The brain owner" is, by convention, the holder string **`self`** — the value the
+dream `consolidate` phase stamps when it promotes the owner's hot facts into cold
+takes. Calibration, `think`, and the `doctor` calibration check resolve the owner
+holder through `resolveOwnerHolder` (`src/core/owner-holder.ts`): explicit override
+> `emotional_weight.user_holder` config > `self`.
+
+Known limitation (tracked in garrytan/gbrain#2465): the owner can also
+appear under `brain` (a take the owner asserts, via `propose_takes`) and
+`people/<owner>` (extraction that names the owner). The resolver selects the
+*default* canonical owner string for reads; it does not merge those other
+strings. Per-take attribution for other people (e.g. `people/george`) is
+unaffected and correct.

src/cli.ts

@@ -808,20 +808,12 @@ async function makeContext(engine: BrainEngine, params: Record<string, unknown>)
   // 'default'. Wrapped in try/catch so a doctor / single-source brain that
   // never set up sources still returns 'default' silently.
   let sourceId: string | undefined;
-  // #2561: when the source resolved via a NON-explicit tier (path-match /
-  // brain default / sole-non-default / seed default), unqualified search-shaped
-  // reads span every `config.federated = true` source. Computed here (the
-  // trusted local boundary) and consumed by federatedSearchScope in
-  // operations.ts, which additionally gates on ctx.remote === false.
-  let localFederated: string[] | undefined;
   try {
-    const { resolveSourceWithTier, localFederatedSourceIds } = await import('./core/source-resolver.ts');
+    const { resolveSourceId } = await import('./core/source-resolver.ts');
     // params.source is set when a CLI flag was parsed for the op (rare; most
     // CLI ops don't take --source). Falls through to env/dotfile/path-match.
     const explicit = (params.source as string | undefined) ?? null;
-    const resolved = await resolveSourceWithTier(engine, explicit);
-    sourceId = resolved.source_id;
-    localFederated = await localFederatedSourceIds(engine, resolved.source_id, resolved.tier);
+    sourceId = await resolveSourceId(engine, explicit);
   } catch {
     // Source resolution failed (e.g. sources table doesn't exist on a fresh
     // pre-init brain). Leave sourceId unset; engine read methods fall through
@@ -842,7 +834,6 @@ async function makeContext(engine: BrainEngine, params: Record<string, unknown>)
     // table). Matches dispatch.ts's auto-fill so the contract holds across
     // every transport.
     sourceId: sourceId ?? 'default',
-    ...(localFederated ? { localFederatedSourceIds: localFederated } : {}),
   };
 }
 

src/commands/calibration.ts

@@ -23,6 +23,7 @@ import { runPhaseCalibrationProfile } from '../core/cycle/calibration-profile.ts
 import { sourceScopeOpts, type OperationContext } from '../core/operations.ts';
 import type { GBrainConfig } from '../core/config.ts';
 import { GBrainError } from '../core/types.ts';
+import { resolveOwnerHolder } from '../core/owner-holder.ts';
 
 export interface CalibrationProfileRow {
   /** BIGSERIAL → string (postgres.js int8 wire shape; never Number() — int8
@@ -167,7 +168,10 @@ export async function runCalibration(
   config: GBrainConfig,
 ): Promise<void> {
   const { opts } = parseArgs(args);
-  const holder = opts.holder ?? 'garry';
+  const holder = resolveOwnerHolder({
+    override: opts.holder,
+    configValue: await engine.getConfig('emotional_weight.user_holder'),
+  });
   // Resolve --source / GBRAIN_SOURCE / .gbrain-source so the (now reachable, #2035)
   // calibration command targets the right source in a multi-source brain instead
   // of always reading `default`. No signal → 'default' (prior behavior).
@@ -253,12 +257,15 @@ export async function getCalibrationProfileOp(
   ctx: OperationContext,
   params: { holder?: string },
 ): Promise<CalibrationProfileRow | null> {
-  const holder = params.holder ?? 'garry';
+  const holder = resolveOwnerHolder({
+    override: params.holder,
+    configValue: await ctx.engine.getConfig('emotional_weight.user_holder'),
+  });
   if (typeof holder !== 'string' || holder.length === 0) {
     throw new GBrainError(
       'INVALID_HOLDER',
       'get_calibration_profile.holder must be a non-empty string',
-      'pass holder="<slug>" or omit to default to "garry"',
+      'pass holder="<slug>" or omit to default to the owner holder (config emotional_weight.user_holder, else "self")',
     );
   }
   const scope = sourceScopeOpts(ctx);

src/commands/doctor.ts

@@ -28,6 +28,7 @@ import type { DbUrlSource } from '../core/config.ts';
 import { gbrainPath, loadConfig } from '../core/config.ts';
 import { reflexEnabled } from '../core/context/reflex.ts';
 import { resolveSocketPath } from '../core/context/resolve-ipc.ts';
+import { resolveOwnerHolder } from '../core/owner-holder.ts';
 import { homedir } from 'os';
 import { dirname, isAbsolute, join, resolve as resolvePath } from 'path';
 import { fileURLToPath } from 'url';
@@ -1287,14 +1288,19 @@ export async function checkAbandonedThreads(engine: BrainEngine): Promise<Check>
 
 /**
  * calibration_freshness: warns when the active calibration profile is
- * older than 7 days (configurable). Default holder 'garry'. Multi-source
+ * older than 7 days (configurable). Default holder resolves via resolveOwnerHolder
+ * (config emotional_weight.user_holder, else 'self'). Multi-source
  * brains see one row per source; this check uses the most recent across
  * all sources.
  */
 export async function checkCalibrationFreshness(engine: BrainEngine): Promise<Check> {
   try {
+    const ownerHolder = resolveOwnerHolder({
+      configValue: await engine.getConfig('emotional_weight.user_holder'),
+    });
     const rows = await engine.executeRaw<{ generated_at: Date | null }>(
-      `SELECT MAX(generated_at) AS generated_at FROM calibration_profiles WHERE holder = 'garry'`,
+      `SELECT MAX(generated_at) AS generated_at FROM calibration_profiles WHERE holder = $1`,
+      [ownerHolder],
     );
     const generated = rows[0]?.generated_at;
     if (!generated) {

src/commands/serve-http.ts

@@ -45,6 +45,7 @@ import {
   type IngestionContentType,
   type IngestionEvent,
 } from '../core/ingestion/types.ts';
+import { resolveOwnerHolder } from '../core/owner-holder.ts';
 
 /**
  * /health endpoint timeout. 3s rather than 5s: Fly.io's default
@@ -1190,7 +1191,7 @@ export async function runServeHttp(engine: BrainEngine, options: ServeHttpOption
   app.get('/admin/api/calibration/pattern/:id', requireAdmin, async (req: Request, res: Response) => {
     try {
       const { getLatestProfile } = await import('./calibration.ts');
-      const holder = (req.query.holder as string) || 'garry';
+      const holder = resolveOwnerHolder({ override: (req.query.holder as string) || undefined, configValue: await engine.getConfig('emotional_weight.user_holder') });
       const profile = await getLatestProfile(engine, { holder });
       if (!profile) {
         res.status(404).json({ error: 'no_profile' });
@@ -1240,7 +1241,7 @@ export async function runServeHttp(engine: BrainEngine, options: ServeHttpOption
   app.get('/admin/api/calibration/profile', requireAdmin, async (req: Request, res: Response) => {
     try {
       const { getLatestProfile } = await import('./calibration.ts');
-      const holder = (req.query.holder as string) || 'garry';
+      const holder = resolveOwnerHolder({ override: (req.query.holder as string) || undefined, configValue: await engine.getConfig('emotional_weight.user_holder') });
       const profile = await getLatestProfile(engine, { holder });
       res.json(profile);
     } catch (err) {
@@ -1257,7 +1258,7 @@ export async function runServeHttp(engine: BrainEngine, options: ServeHttpOption
         renderAbandonedThreadsCard,
         renderPatternStatementsCard,
       } = await import('../core/calibration/svg-renderer.ts');
-      const holder = (req.query.holder as string) || 'garry';
+      const holder = resolveOwnerHolder({ override: (req.query.holder as string) || undefined, configValue: await engine.getConfig('emotional_weight.user_holder') });
       const type = req.params.type;
       const profile = await getLatestProfile(engine, { holder });
 

src/commands/takes.ts

@@ -29,6 +29,7 @@ import {
 } from '../core/takes-fence.ts';
 import { withPageLock } from '../core/page-lock.ts';
 import { resolveSourceId } from '../core/source-resolver.ts';
+import { resolveOwnerHolder } from '../core/owner-holder.ts';
 
 // --- Helpers ---
 
@@ -364,7 +365,7 @@ async function cmdResolve(engine: BrainEngine, args: string[], sourceId?: string
   // --evidence is the v0.30.0 alias for --source on the resolve subcommand
   // (semantic clarity: "what evidence resolved this bet?").
   const source = flagValue(args, '--evidence') ?? flagValue(args, '--source');
-  const resolvedBy = flagValue(args, '--by') ?? 'garry';
+  const resolvedBy = flagValue(args, '--by') ?? resolveOwnerHolder({ configValue: await engine.getConfig('emotional_weight.user_holder') });
   const dirArg = flagValue(args, '--dir');
 
   const pageId = await getPageId(engine, slug, sourceId);

src/core/brainstorm/orchestrator.ts

@@ -68,6 +68,7 @@ import {
   type BrainstormCheckpoint,
   type CheckpointCross,
 } from './checkpoint.ts';
+import { resolveOwnerHolder } from '../owner-holder.ts';
 
 export { BudgetExhausted };
 
@@ -139,7 +140,7 @@ export interface BrainstormOptions {
   modelOverride?: string;
   /** Skip the cost-preview TTY grace window. Required for non-interactive callers. */
   skipCostPreview?: boolean;
-  /** When set, force the user holder for calibration profile lookup. Falls back to config (`emotional_weight.user_holder`) then `'garry'`. */
+  /** When set, force the user holder for calibration profile lookup. Falls back to config (`emotional_weight.user_holder`) then `'self'`. */
   holderOverride?: string;
   /** Source scope. */
   sourceId?: string;
@@ -623,7 +624,7 @@ async function _runBrainstormInner(
   }
 
   // ---- Phase 3: calibration context (cold-start fallback) ----
-  const holder = opts.holderOverride ?? config.emotional_weight?.user_holder ?? 'garry';
+  const holder = resolveOwnerHolder({ override: opts.holderOverride, configValue: config.emotional_weight?.user_holder });
   const calibContext = await loadCalibrationContext(engine, {
     holder,
     sourceId: opts.sourceId,

src/core/calibration/think-ab.ts

@@ -25,7 +25,7 @@ import type { BrainEngine } from '../engine.ts';
 
 export interface ABRunInput {
   question: string;
-  /** Holder context for calibration. Default 'garry'. */
+  /** Holder context for calibration. Resolves via resolveOwnerHolder (config emotional_weight.user_holder, else 'self'). */
   holder?: string;
   /** Engine for DB write. */
   engine: BrainEngine;

src/core/cycle/calibration-profile.ts

@@ -26,6 +26,7 @@
  */
 
 import { BaseCyclePhase, type ScopedReadOpts, type BasePhaseOpts } from './base-phase.ts';
+import { resolveOwnerHolder } from '../owner-holder.ts';
 import { chat as gatewayChat } from '../ai/gateway.ts';
 import { TIER_DEFAULTS } from '../model-config.ts';
 import { gateVoice, type VoiceGateGenerator, type VoiceGateJudge } from '../calibration/voice-gate.ts';
@@ -96,7 +97,7 @@ export type PatternStatementsGenerator = (input: {
 export type BiasTagsGenerator = (patterns: string[]) => Promise<string[]>;
 
 export interface CalibrationProfileOpts extends BasePhaseOpts {
-  /** Holder to generate the profile for. Default 'garry'. */
+  /** Holder to generate the profile for. Default resolves via resolveOwnerHolder (config emotional_weight.user_holder, else 'self'). */
   holder?: string;
   /** Inject the patterns generator (tests). */
   patternsGenerator?: PatternStatementsGenerator;
@@ -227,7 +228,10 @@ class CalibrationProfilePhase extends BaseCyclePhase {
     _ctx: OperationContext,
     opts: CalibrationProfileOpts,
   ): Promise<{ summary: string; details: Record<string, unknown>; status?: PhaseStatus }> {
-    const holder = opts.holder ?? 'garry';
+    const holder = resolveOwnerHolder({
+      override: opts.holder,
+      configValue: await engine.getConfig('emotional_weight.user_holder'),
+    });
     const promptVersion = opts.promptVersion ?? CALIBRATION_PROFILE_PROMPT_VERSION;
     const modelId = opts.model ?? TIER_DEFAULTS.reasoning;
     const gradeCompletion = opts.gradeCompletion ?? 1.0;

src/core/cycle/emotional-weight.ts

@@ -14,6 +14,8 @@
  * See `loadHighEmotionTags` for the resolution path.
  */
 
+import { DEFAULT_OWNER_HOLDER } from '../owner-holder.ts';
+
 /**
  * Default high-emotion tag seed list. Pages with any tag in this set get the
  * tag-emotion boost in the formula below. Override via config key
@@ -43,11 +45,12 @@ export const HIGH_EMOTION_TAGS: ReadonlySet<string> = new Set([
 ]);
 
 /**
- * Holder name treated as "the user" for the Garry-as-holder ratio. Configurable
- * via the `emotional_weight.user_holder` config key (defaults to 'garry' to
- * match the v0.28 schema's takes table convention).
+ * Holder name treated as "the user" for the user-as-holder ratio. Configurable
+ * via the `emotional_weight.user_holder` config key; defaults to the canonical
+ * owner holder ('self', DEFAULT_OWNER_HOLDER) so it matches the consolidate
+ * facts→takes writer instead of a hardcoded name.
  */
-export const DEFAULT_USER_HOLDER = 'garry';
+export const DEFAULT_USER_HOLDER = DEFAULT_OWNER_HOLDER;
 
 export interface EmotionalWeightTake {
   holder: string;

src/core/operations.ts

@@ -424,23 +424,6 @@ export interface OperationContext {
    * satisfied even on single-source brains.
    */
   sourceId: string;
-  /**
-   * #2561 — federated read scope for UNQUALIFIED local CLI reads.
-   *
-   * Set ONLY by the local CLI's context builder (src/cli.ts makeContext), and
-   * only when the source resolved via a non-explicit tier (local_path /
-   * brain_default / sole_non_default / seed_default — NOT --source, NOT
-   * GBRAIN_SOURCE, NOT a .gbrain-source dotfile). Contains the resolved
-   * source first, then every other `config.federated = true` source, so an
-   * unqualified `gbrain search "X"` spans federated sources as
-   * docs/guides/multi-source-brains.md promises.
-   *
-   * Consumed exclusively by `federatedSearchScope` and ONLY when
-   * `ctx.remote === false` — a remote caller's scope stays governed by
-   * `ctx.auth.allowedSources` / scalar `ctx.sourceId` (source-isolation
-   * invariant, fail-closed).
-   */
-  localFederatedSourceIds?: string[];
 }
 
 /**
@@ -556,45 +539,6 @@ export function resolveRequestedScope(
   return sourceScopeOpts(ctx);
 }
 
-/**
- * #2561 — source scope for the search-shaped read ops (`search`, `query`).
- *
- * Delegates to `resolveRequestedScope` (the single trust+grant resolver), then
- * widens an UNQUALIFIED trusted-local scalar scope to the CLI-computed
- * federated set (`ctx.localFederatedSourceIds`, resolved source first). This is
- * what makes `sources add --federated` mean something for local search: a
- * federated source participates in unqualified `gbrain search "X"` results.
- *
- * The expansion NEVER applies when:
- *   - the caller is not strictly trusted-local (`ctx.remote !== false`) —
- *     remote scope stays grant-governed (fail-closed source isolation);
- *   - a per-call `source_id` was passed (explicit wins, including `__all__`);
- *   - the resolver already produced a federated array (OAuth grant);
- *   - the CLI resolved the source from an explicit signal (--source / env /
- *     dotfile) — makeContext leaves `localFederatedSourceIds` unset then.
- *
- * Deliberately NOT inside `sourceScopeOpts`: code-intel ops collapse a
- * multi-element scope to an error (`resolveCodeIntelScope`), and non-search
- * reads (get_page, get_links, …) keep their long-standing scalar behavior.
- */
-export function federatedSearchScope(
-  ctx: OperationContext,
-  sourceIdParam?: string,
-): { sourceId?: string; sourceIds?: string[] } {
-  const scope = resolveRequestedScope(ctx, sourceIdParam);
-  if (
-    ctx.remote === false &&
-    sourceIdParam === undefined &&
-    scope.sourceId !== undefined &&
-    scope.sourceIds === undefined &&
-    ctx.localFederatedSourceIds !== undefined &&
-    ctx.localFederatedSourceIds.length > 1
-  ) {
-    return { sourceIds: ctx.localFederatedSourceIds };
-  }
-  return scope;
-}
-
 /**
  * Code-intel adapter for `resolveRequestedScope`. Graph traversal
  * (code_callers/code_callees/code_blast/code_flow) is single-source by design —
@@ -1504,8 +1448,7 @@ const search: Operation = {
     const queryText = p.query as string;
     const limit = (p.limit as number) || 20;
     const offset = (p.offset as number) || 0;
-    // #2561: unqualified trusted-local search spans federated sources.
-    const scope = federatedSearchScope(ctx);
+    const scope = sourceScopeOpts(ctx);
 
     // T4/D5 — per-call mode honored ONLY for trusted/local callers so a remote
     // OAuth client can't escalate to the costly tokenmax bundle. Local + unknown
@@ -1667,9 +1610,7 @@ const query: Operation = {
     // is spread into BOTH the image-similarity searchVector path and the text
     // hybridSearch path below, so both honor the same grant.
     const sourceIdParam = typeof p.source_id === 'string' ? p.source_id : undefined;
-    // #2561: unqualified trusted-local query spans federated sources (per-call
-    // source_id / remote grants still resolve through resolveRequestedScope).
-    const querySourceScope = federatedSearchScope(ctx, sourceIdParam);
+    const querySourceScope = resolveRequestedScope(ctx, sourceIdParam);
 
     // v0.27.1: image-similarity branch. Bypasses hybridSearch (which is
     // text-only); embeds the image via embedMultimodal and runs a direct
@@ -3348,7 +3289,7 @@ const get_calibration_profile: Operation = {
     holder: {
       type: 'string',
       description:
-        "Holder slug, e.g. 'garry' or 'people/charlie-example'. Defaults to 'garry' when omitted.",
+        "Holder slug, e.g. 'self' or 'people/charlie-example'. Defaults to config emotional_weight.user_holder, else 'self', when omitted.",
     },
   },
   handler: async (ctx, p) => {

src/core/owner-holder.ts

@@ -0,0 +1,24 @@
+/**
+ * Canonical holder string for "the brain owner," resolved in ONE place so the
+ * calibration / think / doctor / emotional-weight defaults stop disagreeing.
+ *
+ * The default matches the consolidate facts→takes writer
+ * (src/core/cycle/phases/consolidate.ts: holder:'self') and docs/takes-vs-facts.md.
+ * Do NOT introduce a fourth literal — three already exist historically
+ * ('garry', 'system', 'self'); this is the source of truth.
+ *
+ * NORMALIZATION NOTE: the brain owner may also appear under other holder
+ * strings — 'brain' (propose_takes when the author asserts a claim) and
+ * people/<owner> (extraction that names the owner). This resolver only selects
+ * the *default* canonical owner string for reads; it does NOT merge those other
+ * strings. Unifying them is owner-identity entity-resolution, tracked separately
+ * (see garrytan/gbrain#2465). Until then, historical owner takes
+ * under 'brain'/people-<owner> are not folded into the default profile.
+ */
+export const DEFAULT_OWNER_HOLDER = 'self';
+
+export function resolveOwnerHolder(
+  opts: { override?: string | null; configValue?: string | null },
+): string {
+  return opts.override ?? opts.configValue ?? DEFAULT_OWNER_HOLDER;
+}

src/core/source-resolver.ts

@@ -353,45 +353,6 @@ export async function resolveSourceWithTier(
   return { source_id: 'default', tier: 'seed_default' };
 }
 
-/**
- * #2561 — compute the federated read scope for an UNQUALIFIED local CLI call.
- *
- * `sources add --federated` promises that a `config.federated = true` source
- * "participates in unqualified `gbrain search` results"
- * (docs/guides/multi-source-brains.md). This helper turns that promise into a
- * scope: given the resolved source and WHICH tier resolved it, return
- * `[resolvedSource, ...other federated source ids]` — or `undefined` when the
- * expansion must not apply:
- *
- *   - explicit tiers (`flag` / `env` / `dotfile`): the user named a source;
- *     scalar scope stands (that IS the qualified case);
- *   - no other federated source exists: keep the scalar fast path unchanged.
- *
- * Archived sources are excluded (same rationale as pickSoleNonDefaultSource);
- * the archived column is v34+, so fall back to the un-archived query on older
- * brains. Callers put the result on `OperationContext.localFederatedSourceIds`
- * — consumed only by `federatedSearchScope` and only when `remote === false`.
- */
-export async function localFederatedSourceIds(
-  engine: BrainEngine,
-  sourceId: string,
-  tier: SourceTier,
-): Promise<string[] | undefined> {
-  if (tier === 'flag' || tier === 'env' || tier === 'dotfile') return undefined;
-  let rows: Array<{ id: string }>;
-  try {
-    rows = await engine.executeRaw<{ id: string }>(
-      `SELECT id FROM sources WHERE config->>'federated' = 'true' AND archived = false ORDER BY id`,
-    );
-  } catch {
-    rows = await engine.executeRaw<{ id: string }>(
-      `SELECT id FROM sources WHERE config->>'federated' = 'true' ORDER BY id`,
-    );
-  }
-  const ids = [sourceId, ...rows.map((r) => r.id).filter((id) => id !== sourceId)];
-  return ids.length > 1 ? ids : undefined;
-}
-
 /** Exposed for tests. */
 export const __testing = {
   readDotfileWalk,

src/core/think/index.ts

@@ -23,6 +23,7 @@ import { runGather, renderPagesBlock, takesHitToTakeForPrompt } from './gather.t
 import { renderTakesBlock } from './sanitize.ts';
 import { buildThinkSystemPrompt, buildThinkUserMessage } from './prompt.ts';
 import { resolveCitations, type ParsedCitation } from './cite-render.ts';
+import { resolveOwnerHolder } from '../owner-holder.ts';
 import { resolveModel } from '../model-config.ts';
 import { chat as gatewayChat, probeChatModel, type ChatResult } from '../ai/gateway.ts';
 import { AIConfigError } from '../ai/errors.ts';
@@ -76,8 +77,8 @@ export interface RunThinkOpts {
    */
   withCalibration?: boolean;
   /**
-   * Holder to retrieve the calibration profile for. Default 'garry'. Only
-   * consulted when withCalibration=true.
+   * Holder to retrieve the calibration profile for. Resolves via resolveOwnerHolder
+   * (config emotional_weight.user_holder, else 'self'). Only consulted when withCalibration=true.
    */
   calibrationHolder?: string;
   /**
@@ -308,7 +309,10 @@ export async function runThink(
     try {
       const { getLatestProfile } = await import('../../commands/calibration.ts');
       const profile = await getLatestProfile(engine, {
-        holder: opts.calibrationHolder ?? 'garry',
+        holder: resolveOwnerHolder({
+          override: opts.calibrationHolder,
+          configValue: await engine.getConfig('emotional_weight.user_holder'),
+        }),
       });
       if (profile) {
         calibrationBlockOpts = {

test/calibration-cli.test.ts

@@ -27,6 +27,12 @@ function buildMockEngine(opts: { rows: CalibrationProfileRow[] }): {
   const capturedParams: unknown[][] = [];
   const engine = {
     kind: 'pglite',
+    // #2464: getCalibrationProfileOp resolves the owner holder via
+    // resolveOwnerHolder(config emotional_weight.user_holder, else 'self'), so the
+    // mock must implement getConfig. null = key unset → resolver falls back to 'self'.
+    async getConfig(): Promise<string | null> {
+      return null;
+    },
     async executeRaw<T>(sql: string, params?: unknown[]): Promise<T[]> {
       capturedSql.push(sql);
       capturedParams.push(params ?? []);
@@ -211,17 +217,17 @@ describe('formatProfileText', () => {
 // ─── getCalibrationProfileOp ────────────────────────────────────────
 
 describe('getCalibrationProfileOp (MCP)', () => {
-  test('defaults holder to "garry" when omitted', async () => {
-    const { engine } = buildMockEngine({ rows: [buildProfile({ holder: 'garry' })] });
+  test('defaults holder to "self" when omitted (config emotional_weight.user_holder unset)', async () => {
+    const { engine } = buildMockEngine({ rows: [buildProfile({ holder: 'self' })] });
     const ctx = buildCtx(engine);
     const result = await getCalibrationProfileOp(ctx, {});
-    expect(result?.holder).toBe('garry');
+    expect(result?.holder).toBe('self');
   });
 
   test('routes through sourceScopeOpts: scalar source-bound client gets source-scoped result', async () => {
     const rows = [
-      buildProfile({ holder: 'garry', source_id: 'default' }),
-      buildProfile({ holder: 'garry', source_id: 'tenant-b' }),
+      buildProfile({ holder: 'self', source_id: 'default' }),
+      buildProfile({ holder: 'self', source_id: 'tenant-b' }),
     ];
     const { engine } = buildMockEngine({ rows });
     const ctx = buildCtx(engine, { sourceId: 'tenant-b' });
@@ -231,8 +237,8 @@ describe('getCalibrationProfileOp (MCP)', () => {
 
   test('federated read scope sees the union of allowed sources', async () => {
     const rows = [
-      buildProfile({ holder: 'garry', source_id: 'tenant-a' }),
-      buildProfile({ holder: 'garry', source_id: 'tenant-z' }),
+      buildProfile({ holder: 'self', source_id: 'tenant-a' }),
+      buildProfile({ holder: 'self', source_id: 'tenant-z' }),
     ];
     const { engine } = buildMockEngine({ rows });
     const ctx = buildCtx(engine, { allowedSources: ['tenant-a', 'tenant-b'] });

test/calibration-profile.test.ts

@@ -32,7 +32,7 @@ interface CapturedSql {
   params: unknown[];
 }
 
-function buildMockEngine(opts: { scorecard: TakesScorecard }): {
+function buildMockEngine(opts: { scorecard: TakesScorecard; userHolder?: string | null }): {
   engine: BrainEngine;
   captured: CapturedSql[];
 } {
@@ -42,6 +42,10 @@ function buildMockEngine(opts: { scorecard: TakesScorecard }): {
     async getScorecard() {
       return opts.scorecard;
     },
+    async getConfig(key: string): Promise<string | null> {
+      if (key === 'emotional_weight.user_holder') return opts.userHolder ?? null;
+      return null;
+    },
     async executeRaw<T>(sql: string, params?: unknown[]): Promise<T[]> {
       captured.push({ sql, params: params ?? [] });
       return [];
@@ -234,7 +238,7 @@ describe('runPhaseCalibrationProfile — phase integration', () => {
     // grade_completion, domain_scorecards_json, patterns[], voice_passed, voice_attempts,
     // bias_tags[], model_id
     expect(insert!.params[0]).toBe('default'); // source_id
-    expect(insert!.params[1]).toBe('garry'); // holder
+    expect(insert!.params[1]).toBe('self'); // holder (resolved via resolveOwnerHolder, no override)
     expect(insert!.params[2]).toBe(12); // total_resolved
     expect(insert!.params[9]).toBe(true); // voice_gate_passed
     expect(insert!.params[10]).toBe(1); // voice_gate_attempts
@@ -330,4 +334,24 @@ describe('runPhaseCalibrationProfile — phase integration', () => {
     const insert = captured.find(c => c.sql.includes('INSERT INTO calibration_profiles'));
     expect(insert!.params[0]).toBe('tenant-b');
   });
+
+  test('cold-brain summary uses resolved owner holder self when user_holder unset', async () => {
+    const { engine } = buildMockEngine({
+      scorecard: { total_bets: 0, resolved: 0, correct: 0, incorrect: 0, partial: 0,
+        accuracy: null, brier: null, partial_rate: null, unresolvable_count: 0, unresolvable_rate: null },
+    });
+    const result = await runPhaseCalibrationProfile(buildCtx(engine), {});
+    expect(result.summary).toContain('holder=self');
+    expect(result.summary).not.toContain('holder=garry');
+  });
+
+  test('configured user_holder overrides the default in the cold-brain summary', async () => {
+    const { engine } = buildMockEngine({
+      scorecard: { total_bets: 0, resolved: 0, correct: 0, incorrect: 0, partial: 0,
+        accuracy: null, brier: null, partial_rate: null, unresolvable_count: 0, unresolvable_rate: null },
+      userHolder: 'people/charlie-example',
+    });
+    const result = await runPhaseCalibrationProfile(buildCtx(engine), {});
+    expect(result.summary).toContain('holder=people/charlie-example');
+  });
 });

test/doctor-calibration-checks.test.ts

@@ -32,6 +32,12 @@ function buildMockEngine(opts: {
 }): BrainEngine {
   return {
     kind: 'pglite',
+    // #2464: checkCalibrationFreshness resolves the owner holder via
+    // resolveOwnerHolder(config emotional_weight.user_holder, else 'self'), so the
+    // mock must implement getConfig. null = key unset → resolver falls back to 'self'.
+    async getConfig(): Promise<string | null> {
+      return null;
+    },
     async executeRaw<T>(sql: string): Promise<T[]> {
       if (opts.throwOn && opts.throwOn.test(sql)) {
         throw new Error('mock engine error: ' + sql.slice(0, 50));

test/emotional-weight.test.ts

@@ -112,3 +112,7 @@ describe('computeEmotionalWeight', () => {
     expect(HIGH_EMOTION_TAGS.has('mental-health')).toBe(true);
   });
 });
+
+test('DEFAULT_USER_HOLDER is the canonical owner holder self', () => {
+  expect(DEFAULT_USER_HOLDER).toBe('self');
+});

test/local-federated-search-scope.test.ts

@@ -1,154 +0,0 @@
-/**
- * #2561 — sources.config.federated participates in UNQUALIFIED local CLI
- * search/query.
- *
- * Pre-fix: the local CLI always emitted a scalar `{sourceId}` scope (required
- * field, auto-filled 'default'), so a source registered with
- * `gbrain sources add --federated` was invisible to an unqualified
- * `gbrain search "X"` — contradicting docs/guides/multi-source-brains.md
- * ("Source participates in unqualified `gbrain search` results").
- *
- * Fix: the CLI context builder computes `ctx.localFederatedSourceIds`
- * (resolved source + every other federated source) whenever the source
- * resolved via a NON-explicit tier; `federatedSearchScope` widens the scalar
- * scope to that set for the `search` / `query` ops — trusted-local only
- * (`ctx.remote === false`), never for remote callers, never when a per-call
- * `source_id` or an explicit --source/env/dotfile was given.
- */
-import { describe, test, expect, beforeAll, afterAll } from 'bun:test';
-import { PGLiteEngine } from '../src/core/pglite-engine.ts';
-import { localFederatedSourceIds } from '../src/core/source-resolver.ts';
-import {
-  federatedSearchScope,
-  operations,
-  type OperationContext,
-} from '../src/core/operations.ts';
-
-let engine: PGLiteEngine;
-const search = operations.find((o) => o.name === 'search')!;
-
-function ctxOf(overrides: Partial<OperationContext> = {}): OperationContext {
-  return {
-    engine: engine as any,
-    config: {} as any,
-    logger: console as any,
-    dryRun: false,
-    remote: false,
-    sourceId: 'default',
-    ...overrides,
-  };
-}
-
-beforeAll(async () => {
-  engine = new PGLiteEngine();
-  await engine.connect({});
-  await engine.initSchema();
-  // Seeded 'default' source is federated=true. Add:
-  //   wiki    — federated (must join unqualified search)
-  //   private — NOT federated (must stay invisible unless explicitly named)
-  //   oldnews — federated but archived (must stay excluded)
-  await engine.executeRaw(
-    `INSERT INTO sources (id, name, local_path, config) VALUES ('wiki', 'wiki', '/tmp/wiki', '{"federated": true}'::jsonb)`,
-  );
-  await engine.executeRaw(
-    `INSERT INTO sources (id, name, local_path, config) VALUES ('private', 'private', '/tmp/private', '{}'::jsonb)`,
-  );
-  await engine.executeRaw(
-    `INSERT INTO sources (id, name, local_path, config, archived) VALUES ('oldnews', 'oldnews', '/tmp/oldnews', '{"federated": true}'::jsonb, true)`,
-  );
-  const pages: Array<[slug: string, sourceId: string, where: string]> = [
-    ['notes/home', 'default', 'default'],
-    ['wiki/topic', 'wiki', 'wiki'],
-    ['private/topic', 'private', 'private'],
-    ['old/topic', 'oldnews', 'oldnews'],
-  ];
-  for (const [slug, sourceId, where] of pages) {
-    await engine.putPage(slug, {
-      type: 'note', title: `Topic in ${where}`, compiled_truth: `the zebra telescope in ${where}`, frontmatter: {},
-    }, { sourceId });
-    await engine.upsertChunks(slug, [
-      { chunk_index: 0, chunk_text: `the zebra telescope in ${where}`, chunk_source: 'compiled_truth' },
-    ], { sourceId });
-  }
-  // Keyword-only search path: no embedding provider needed in tests.
-  await engine.setConfig('search.mcp_keyword_only', 'true');
-}, 60_000);
-
-afterAll(async () => {
-  if (engine) await engine.disconnect();
-}, 60_000);
-
-describe('localFederatedSourceIds — CLI-side scope computation', () => {
-  test('non-explicit tier: resolved source first, then other federated, archived excluded', async () => {
-    expect(await localFederatedSourceIds(engine, 'default', 'seed_default')).toEqual(['default', 'wiki']);
-  });
-
-  test('non-federated resolved source still joins its own scope', async () => {
-    expect(await localFederatedSourceIds(engine, 'private', 'brain_default')).toEqual(['private', 'default', 'wiki']);
-  });
-
-  test('explicit tiers (--source / env / dotfile) never expand', async () => {
-    expect(await localFederatedSourceIds(engine, 'default', 'flag')).toBeUndefined();
-    expect(await localFederatedSourceIds(engine, 'default', 'env')).toBeUndefined();
-    expect(await localFederatedSourceIds(engine, 'default', 'dotfile')).toBeUndefined();
-  });
-
-  test('single federated source (the resolved one) keeps the scalar fast path', async () => {
-    const solo = { executeRaw: async () => [{ id: 'default' }] } as any;
-    expect(await localFederatedSourceIds(solo, 'default', 'seed_default')).toBeUndefined();
-  });
-});
-
-describe('federatedSearchScope — trust + explicitness matrix', () => {
-  test('trusted local + unqualified widens to the federated set', () => {
-    const ctx = ctxOf({ localFederatedSourceIds: ['default', 'wiki'] });
-    expect(federatedSearchScope(ctx)).toEqual({ sourceIds: ['default', 'wiki'] });
-  });
-
-  test('remote caller NEVER widens (fail-closed), even if the field is set', () => {
-    const ctx = ctxOf({ remote: true, localFederatedSourceIds: ['default', 'wiki'] });
-    expect(federatedSearchScope(ctx)).toEqual({ sourceId: 'default' });
-  });
-
-  test('per-call source_id wins over the federated set', () => {
-    const ctx = ctxOf({ localFederatedSourceIds: ['default', 'wiki'] });
-    expect(federatedSearchScope(ctx, 'wiki')).toEqual({ sourceId: 'wiki' });
-  });
-
-  test('per-call __all__ keeps the whole-brain semantics for trusted local', () => {
-    const ctx = ctxOf({ localFederatedSourceIds: ['default', 'wiki'] });
-    expect(federatedSearchScope(ctx, '__all__')).toEqual({});
-  });
-
-  test('a federated OAuth grant wins over the local set', () => {
-    const ctx = ctxOf({
-      localFederatedSourceIds: ['default', 'wiki'],
-      auth: { allowedSources: ['a', 'b'] } as OperationContext['auth'],
-    });
-    expect(federatedSearchScope(ctx)).toEqual({ sourceIds: ['a', 'b'] });
-  });
-
-  test('no local federated set → unchanged scalar scope', () => {
-    expect(federatedSearchScope(ctxOf())).toEqual({ sourceId: 'default' });
-  });
-});
-
-describe('search op — unqualified local search spans federated sources', () => {
-  test('federated source results appear; non-federated + archived stay invisible', async () => {
-    const ctx = ctxOf({
-      localFederatedSourceIds: await localFederatedSourceIds(engine, 'default', 'seed_default'),
-    });
-    const results = (await search.handler(ctx, { query: 'zebra telescope' })) as Array<{ slug: string }>;
-    const slugs = results.map((r) => r.slug);
-    expect(slugs).toContain('notes/home');
-    expect(slugs).toContain('wiki/topic'); // pre-#2561 this was missing
-    expect(slugs).not.toContain('private/topic');
-    expect(slugs).not.toContain('old/topic');
-  });
-
-  test('explicit source resolution (no federated set on ctx) stays single-source', async () => {
-    const results = (await search.handler(ctxOf(), { query: 'zebra telescope' })) as Array<{ slug: string }>;
-    const slugs = results.map((r) => r.slug);
-    expect(slugs).toEqual(['notes/home']);
-  });
-});

test/owner-holder.test.ts

@@ -0,0 +1,27 @@
+import { describe, test, expect } from 'bun:test';
+import { resolveOwnerHolder, DEFAULT_OWNER_HOLDER } from '../src/core/owner-holder.ts';
+
+describe('owner-holder', () => {
+  test('DEFAULT_OWNER_HOLDER is self', () => {
+    expect(DEFAULT_OWNER_HOLDER).toBe('self');
+  });
+
+  test('defaults to self when nothing provided', () => {
+    expect(resolveOwnerHolder({})).toBe('self');
+  });
+
+  test('null/undefined config falls back to self', () => {
+    expect(resolveOwnerHolder({ configValue: null })).toBe('self');
+    expect(resolveOwnerHolder({ configValue: undefined })).toBe('self');
+  });
+
+  test('uses config value when set and no override', () => {
+    expect(resolveOwnerHolder({ configValue: 'people/charlie-example' }))
+      .toBe('people/charlie-example');
+  });
+
+  test('override beats config and default', () => {
+    expect(resolveOwnerHolder({ override: 'world', configValue: 'people/charlie-example' }))
+      .toBe('world');
+  });
+});