Summary

• Leader weekly output no longer collides with reps' rows. A leader's run cannot write into a rep's row: the path text is identical per person and the row belongs to whoever ran the write, so each Tuesday run created a second, leader-owned coaching/{slug}/coaching-overview next to the rep's own. Per-rep rollups now go to the leader's own space (user/agent-{id}/team/{slug}/...), the agent body lists the only paths each run may write, and the playbook/template text that contradicted it (legacy coaching/outputs/reps/{name} layout, second-pass schedule, per-call documents, manager notes) is removed.
• Leaders can browse each rep's folder in the agent Files tab. New agent.getTeamMembers plus read-only, lazy per-teammate sections (extends the "My files" cross-scope sections from #2868). An org admin already passed the scope gate; an agent manager who is not an org admin now can for listings only.
• The manager path is deliberately narrow. It is an explicit second gate used only by listChildren, requires a same-org target who owns a live row under an agent the caller manages, is read-only, and is confined to user/agent-{id} for the agents the caller manages. By-id routes (getDownloadUrl, unseenAgentSessions, applyUpdate, markOpened), search, grep, graph, map and asUserId are refused (tested).

Test plan

• pnpm -w run autofix:local: brand, oxlint, deps:check and paraglide pass; mail jest 5252 pass, 1 fail (chatHistoryList.test.ts, date-dependent, also fails on the primary checkout at baseline, unrelated); the full server vitest run src/ passes (1170 files).
• New/extended scoped tests: agent-template, rubric (new), seed-content; agent-team-members, files-manager-teammate-scope, manager-teammate-scope, manager-opens-rep-document; mail team-sections, cross-scope-sections, useFileTree.crossScopeSections.
• Live eval (claude-sonnet-5, the model prod uses; record-only stubs, no side effects), 10 trials of the new weekly leader run with the real body and the real injected <agent_namespace> block: 0 writes to a forbidden path in all 10 trials; 8/10 wrote all three team/{slug}/coaching-overview rollups plus team-summary at the right paths; 2/10 wrote nothing (ended after reads with empty output, likely the harness's 2500-token output cap, not confirmed). Cost about $2.34. Not covered: a rep (meeting-triggered) run against the conversation-scoped namespace block.
• Three independent thermo reviews. Round 1 found a blocker (the widening also reached by-id routes with no row filter, fixed by making it opt-in); round 2 found that the row filter also admits user/<x>/agent-<id>/... (fixed with a namespace restriction); round 3 had no blockers and two should-fix items, fixed without a fourth review (cap reached).

Verify in prod

• Axiom (cedar-prod) or CloudWatch /aws/ecs/aws-prod-api/api-service:

  ['cedar-prod'] | where _time > ago(1h) and message == "[agent] getTeamMembers"
  | project _time, caller_user_id, agent_id, via, member_count, truncated
  

  and the audit trail for the new access path:

  ['cedar-prod'] | where _time > ago(1h) and message == "[files] manager teammate-scope read"
  | project _time, caller_user_id, target_user_id, org_id, agents_held
  

• Working: a leader opening an org agent's Files tab logs via of org_admin or agent_manager with member_count equal to the reps who own rows; the second line appears only when a non-admin manager expands a rep's section. via: none is not logged.
• Regression: any [files] manager teammate-scope read line whose caller_user_id is an org admin (the fallback should never be what grants them), or any rep (non-leader) with agent_manager.
• Next Tuesday's cron: after the playbooks are re-seeded, each rep's coaching/{slug}/coaching-overview must stop being written, and team/{slug}/coaching-overview plus team-summary should appear in the leader's s