Two jobs, two nouns (2026-08-10). Files browses and works the corpus — libraries, shelves, objects, versions, diffs. Catalog manages the shared vocabulary — tags, labels, object types — and nothing else. The rail's old Shelves/Libraries groups are gone; that navigation lives in the tree to the left, including the Lenses group (the four entries the old rail mislabelled "Shelves").

GitHub gives the shell. A library selector where the branch picker sits, "Go to file" + T as the search spine, a shelf tree that never has to be the path to anything, and a listing whose second column is the last change — a supersession, not a commit.

A shelf is a set, not a folder. The predicate sits under the breadcrumb. Rule-matched is the unmarked default; hand-added carries an added marker; excluded is struck through and only a curator sees it.

Permissions rule the day. Switch View as and the same shelf changes contents. Every count is post-filter — never a total.

Not copied from GitHub: colour never carries type, and there are no lock or shield glyphs — a shelf shows what your grants already reach, it never widens them.

Some shelves are provisioned (◎2 in the tree). A pack-shelf is a shelf composed with an audience — a standing disclosure surface: current on read, per-viewer on provenance, one switch to revoke. Filing an object on one still grants nobody anything; disclosing is a separate, deliberate act. That split is the only reason "filing never grants" and one-switch revocation can both be true.

Try the seam. Open Investor pack → Manage audience, then switch View as to Marta — the browser floor, no Relay account. Open something as her (that is a claim), switch back, revoke her row, and switch to her again: everything goes except the copy she claimed. That is the sentence enterprises will test, made testable.