# Deferred list

One line per item, written from evidence, never from inertia. Add a line
when a gap is found and not fixed in the current piece; strike it (move to
Done at the bottom with the commit) when a piece closes it. Nothing here
starts on its own; a line becomes a piece only when Jason calls it. Check it
at every gate. Started 2026-09-12 during the control board MVP.

## Open

- **Inherited Discord engine test intermittency during #1512 review.** Frozen
  serialized run recorded a tool-turn engine assertion failure and then timed
  out at 120s. A later full TAP run with a 15s test deadline passed 351/351.
  Rocko isolated the busy/settled-event test race and missing failure cleanup;
  Darkwing independently reproduced the event-split assertion. Rocko also reported
  a timeout-log test race and a separate engine followUp-after-timeout defect.
  No live incident established. Row21 owner orch-01 notified; no Discord source
  takeover. Not assumed identical to earlier concurrent hangs.
  Integration held pending owner disposition; logs and scope in
  `agents/darkwing/work/relaunch-activity/r1-review.md`. (2026-09-15)
  Outcome 2026-09-26: 1685deb4 fixed the busy/settled race and the engine no
  longer sends a follow-up (held prompts). A re-run of the frozen candidate
  against 21e3e908 passed the serial acceptance command 397/397 three times.
  Two engine failures remain when tests run concurrently, and they reproduce on
  clean HEAD without the #1512 files, so they are #1509's (entry below). Sage
  ruled that #1512 integrates on the serial evidence; it landed in af4203ca.
  Record: `agents/darkwing/work/relaunch-activity/rerun-2026-09-26.md`.



- **Registration has no "set by" field.** `mosaic seat task` records the
  task and `updatedAt` but not who set it, so a human session and the
  orchestrator look the same on the board. One-line record change; rides
  with the orchestrator assignment piece. (2026-09-12, #1504)
- **Usage-limit notice was missed.** Jason reports Rocko exhausted usage without
  Jason seeing the notice, and is now available again. Investigate where the
  notice appeared and what operator notification is missing as part of Claude
  console integration. User-reported, not independently reproduced; no root
  cause established. Keep outside #1512's relaunch-display scope. (2026-09-15)
- **Claude Code seats register but get no board row.** Rocko has no Pi
  session log, and rows come only from Pi logs. Needs a second row source
  or a Claude-side log reader. (2026-09-12, darkwing's #1504 report)
  2026-09-15 #1511 live-test preflight reconfirmed no Rocko row: expected
  `.pi/state/rocko/sessions` discovery directory absent. Its existing repo
  registration names dead PID 185602, while the verified native lock owner is
  3707667. No registration repair, discovery expansion or relaunch performed;
  test write refused before mutation. Evidence:
  `agents/darkwing/work/task-attribution/backend-live-verification.json`.
- **Fleet seats (`~/.mosaic`) stay on the old launchers.** No registration,
  no board reply, no `seat task`. Moving them is the stress test and comes
  after the WebUI and fleet launch work. (Jason, 2026-09-12)
- **Comms skill has no rule for senders without a pane.** The board trailer
  covers it today; if another pane-less sender appears, put the rule in
  `skills/ms-communications` instead of a second trailer. (2026-09-12, #1505)
- **Board: multiple sessions per seat, stopping seats, auth beyond
  loopback.** Out of scope for the MVP by the plan; listed so they are not
  forgotten. (plan page, Boundaries)
- **`MOSAIC-STACK-D-001` is Answered, not Completed.** Mark `--completed` in
  jarvis-brain once Jason says the board answers "who is waiting on me".
  (2026-09-12)
- **Uncommitted working tree.** `AGENTS.md` autonomy section,
  `agents/README.md` Sage row, Dewey's `work/wui` docs and evidence,
  `docs/plans/reviews/2026-09-08..10_*`, `skills/ms-{arena,blast-radius,
  board,executive-update,git-operations,technical-writing}`. Jason's edits
  from before 2026-09-12; they ride along in the next commit that touches
  them unless staged on purpose. (2026-09-12)
- **Fleet debt (orch-01, `~/.mosaic`):** `sweep-commit.sh` deny-list regex
  skips `launch.env`; needs the fix plus a regression test. (2026-09-12)
- **Parked, not cancelled:** Dewey D05 dashboard mockup work beyond design 3,
  registry increment 3 (headless identity-env leak), new seat directories.
  (plan page, 2026-09-12 parking note)

- **Gitea helper response-file hardening.** Predictable `/tmp/gitea-api-response.$$`
  has no explicit 0600 mode; use `mktemp` with cleanup in a separately reviewed
  pass. Credential validation and later reread also have a race window. Other
  non-blocking ledger review notes remain in
  `reviews/2026-09-12_ledger-verdict.md`. No change beyond the reviewed GET
  cleanup fix in this piece. Filbert, LEDGER-1506-R1, 2026-09-12, #1506.

- **One shared checkout for every seat and the coordinator.** Any `git add`
  of a shared file (CURRENT.md, SESSIONS.md, the plan page) commits another
  seat's in-progress edit under the wrong commit; it happened at f80404f5
  (dewey's CURRENT.md status note went in with the piece 5 brief, harmless
  but unowned). Fix candidates: per-seat worktrees, or shared files edited
  only by the seat named in CURRENT.md. (2026-09-12)

- **Console mockup fields absent from the board API.** Controller, generation,
  config fingerprint, turn count, goal/report and activity stream are omitted.
  Workspace paths are shown as board data, not invented registered workspace
  nodes. Launch, observe, stop, full transcript navigation, command palette and
  other screens are absent. Existing palette/appearance switches remain on the
  single page. Revisit only with a new brief. (2026-09-13 UTC, #1507)

- **Board send can turn into a Pi slash command.** `tools/tmux`
  `send-message.sh` pastes onto whatever is already in Pi's composer without
  clearing it. On Jason's 2026-09-26 20:10:57Z send, a leftover "/" landed in
  front of the agent-send header. Pi read it as plain text that time, but the
  same path could run a board reply as a slash command. Belongs to CHAT-03I/B3.
  No tools/tmux change until that piece. Found by Dewey in the CHAT-02 brief
  evidence. (2026-09-26, #1507)

- **Discord wedge restarts have no cumulative stop.** Since 6b R2, a wedged
  pi ends the connector with exit 1, and the unit restarts it. With
  turnTimeoutSeconds 600, one cycle takes at least 645 s, longer than the
  600 s StartLimit window. So a pi that wedges on every prompt restarts once
  per prompt and never hits the limit. It only happens when someone sends a
  message, and that person gets an error reply. Sage accepted it for now. The
  fix is a separate policy (a wedge count kept across restarts). (2026-09-26,
  #1509, Rocko 6b R2 review)
- **Connector does not journal the source it started from.** The unit runs
  from the live checkout, so an automatic restart loads whatever Discord
  source is in the tree, even uncommitted source. Rocko recommends a startup
  journal line with HEAD, the dirty state of `packages/discord` and a digest
  of the runtime files. Until then the rule is that unreviewed Discord source
  stays uncommitted in the tree only as long as a review needs it.
  (2026-09-26, #1509)
- **Index-export suite runs leave Docker networks behind.** Each export
  directory becomes a compose project, and its `<dir>_default` network
  stays after the run. On 2026-09-26 the host ran out of address pools. The
  task and release suites then failed 31 and 3 tests with "all predefined
  address pools have been fully subnetted". Sage removed its own five stale
  networks. The dw-* ones are still there. Fix: the export recipe, or the
  suites, removes the project network on exit. (2026-09-26)
  2026-09-27: it happened again on the Piece D candidate (task 31 and
  release 3 failures). Sage removed 12 leftover export networks from
  other seats, each checked for zero attached containers first, and both
  suites then passed. Still open.

- **Ledger T3 read: snapshot isolation has no test.** `readT3` runs every
  query in one read transaction, but no test proves a write landing during
  the read stays invisible. Filbert's note 4 on the Gate F build (e47ec6da).
  Notes 1 to 3 go to Darkwing's follow-up. (2026-09-26, #1506)
- **A T3 sender role with spaces counts as human.** The SetSpark lead's
  reply to Sage (21:41:24Z) used the role "main content-engine agent". The
  6a rule requires a one-word role, so the ledger counts that message as
  human in Sage's row. Gate F reads only Filbert's row, so it is not
  affected. Filbert found it through the live diagnostic (14 went to 15).
  Sage asked the SetSpark lead to use a one-word role. The rule stays as
  it is. (2026-09-26, #1506)

- **Queue tests: the cold-start failure came back (reopened).** Row 33
  closed this as not reproduced in 20 idle cold runs. On 2026-10-04 Sage's
  index export of the row 33 candidate ran the nine suites, then
  `node --test packages/queue/tests/`, and got 147 passed, 1 failed. Sage's
  recipe threw the output away, so again nobody knows which test failed.
  Ten more runs all passed 148/148: three reruns in the same export, four
  under parallel suite load, and three fresh exports run straight after
  `test-queue.sh`. It needs a first run on a fresh tree after a full
  suite pass, and even then it's rare. Darkwing's n2 on row 33 (the cold
  runs were idle) was right. Next time: Sage's export recipe keeps the
  node test output in a file, so the first failure has a name. Then fix it
  as its own row. (2026-10-04, #1508)
- **Queue: `add --issue N` also sets closes to N.** Follow-up rows under
  an umbrella issue, like rows 31 and 33 under #1508, would close the issue
  when they finish. Sage narrowed both by hand (revs 36 and 43). Either
  `add` takes `--closes` or the lead checks closes on every add. Not
  urgent while Sage adds the rows. (2026-10-04, #1508)

- **Ledger metric call can orphan curl.** The metric call in
  `packages/ledger/src/ledger.mjs` still relies on execFileSync's
  timeout, which kills the helper but can leave curl running. E's queue
  calls already use `timeout -s KILL`; the metric call should match.
  (2026-09-27, #1508)
- **Ledger: a missing `timeout` command reads as a Gitea failure.** With
  no `timeout` on PATH the queue issue calls report "credential or Gitea
  request failure". Optional test and clearer message. Filbert, E r2.
  (2026-09-27, #1508)
- **`review record` doesn't check which issue the verdict comment is on.**
  Row 5 round 1's request (26671) and Filbert's verdict (26683) are on
  #1507. Darkwing's verdict 26681 went to #1508, and `review record`
  accepted it, because only `review resolve` reads the comment back
  (`checkComment` in `packages/queue/src/review.mjs`). The receipt
  points at a real comment on the wrong issue. Sage posted a pointer on
  #1507 (comment 26685). Fix: have `record` check the comment's issue and author the way
  `resolve` does, or refuse a comment id it can't verify. Found by
  Filbert. (2026-10-04, #1508)
- **Host seats launch Pi with `--approve`.** A future `.pi/SYSTEM.md` or
  `.pi/settings.json` in the checkout would load in every host seat. This
  is latent, since neither file exists today. Fix in
  `scripts/agent-host-dev.sh`: pass `--no-approve` and an explicit system
  prompt. Filbert, meta-harness survey section 8.4. (2026-10-04)
- **Workers can read provider keys.** The worker container passes
  `ZAI_API_KEY` and `ANTHROPIC_API_KEY` in the environment, which Pi's
  `bash` inherits, and Pi's `read` can open the mounted `auth.json`.
  Slice 1 role tokens stay in the broker (lead decision 47). The workers'
  own exposure needs a separate piece. Filbert, survey section 8.6.
  (2026-10-04)
- **CHAT-03 I1 round 2 follow-ups, for the I3 brief.** Neither reviewer
  held any of these as blocking (Darkwing comment 26690, Filbert comment
  26694 on #1507). Four of the five are closed by slice 1 S5 (see Done);
  this one stays open.
  - No test proves that the processes are listed only after the cgroup
    is frozen. The code waits for `frozen 1` in `cgroup.events`, and
    both Filbert and Dewey confirmed it by reading it. Mutants r2-B5b and
    C4 survive. Proposed: a test-only hold after `members`, or a FUSE or
    privileged fixture. Filbert F1.
  (2026-10-04, #1507)
- **CHAT-03 `engine.envKeys` accepts founder credential names.**
  `CREDENTIAL_NAME` in `packages/conversation/src/pi-pin.mjs` matches any
  `*_API_KEY` or `*_TOKEN`, including `GITEA_TOKEN` and `GH_TOKEN`, which
  the S6 runner refuses as founder credentials (REQ-CRED-2). Nothing
  builds a Controller outside the tests yet. Whoever wires the entry point
  narrows the pattern to provider names or checks the founder list.
  Filbert N2 on #1522. (2026-10-10)
- **`test-task.sh` makes a live Pi call without the Docker guard.** The
  "user recall" block near line 478 runs `run-task.sh` with no
  availability check, so a run with Docker unavailable fails "user recall
  run succeeds" and "recalled user name" (26 pass, 2 fail). The other
  live groups skip. Rocko hit it during the S2 suites. Wrap the block in
  the same guard as the other live groups, so a seat without provider
  access gets clean skips. (2026-10-04, #1519)
- **`node --test <dir>/` fails on Node 24.** Node 24 reads a directory
  argument as a module, so every package's test command in that form
  fails there, while Node 26 accepts it. The glob form
  (`node --test 'packages/x/tests/*.test.mjs'`) works on both. Package
  READMEs, `docs/TOOLS.md` and Sage's suite recipe should use the glob
  form wherever Node 24 is a target. Darkwing, S1 packet. (2026-10-04,
  #1518)
- **`stack-upgrade.sh` doesn't check `$REPO`.** Nothing confirms the
  source checkout is root-owned or that its tree is clean before the
  upgrade builds from it. Filbert N2 on row 233 (29922, #1735).
  (2026-10-21)
- **`stack-upgrade.sh` has no signal handling between A2 and A5.** A HUP,
  INT or TERM in that stretch leaves the run failed closed, but recovery
  is by hand. A trap that writes the stop point and the recovery step to
  the log would make it a sheet step. Filbert N3 on row 233 (29922,
  #1735). (2026-10-21)
- **`checkCreative` doesn't refuse `credentials`.** Row 213's
  `checkCreative` (packages/business/src/role.mjs:143 at 2d2ad2760)
  limits a creative role's tools, authority and messaging, but a role
  file that gave companion or research a credential would still load.
  The business file could then map a credential to that instance
  (business.mjs:157). Nobody has traced whether a mapped credential
  reaches the run's environment. The decision paths stay closed (M6),
  but a creative role with `web` holding a live token is a wider channel
  than design 4 means. The fix: refuse any `credentials` in
  `checkCreative`, with a role.test.mjs case. It goes after row 213
  lands, as a follow-up row or in the next row that edits role.mjs.
  Webby N1 on row 213 r3 (REVIEW-r3.md, 3ab3c010b), mos-1160.
  (2026-10-21)
- **The boot host check orders only one business's bus.**
  `mosaic-hostcheck.service` (row 240) has
  `Before=mosaic-bus@mosaic-stack.service`. `case2-unit.sh` enables the
  bus as `mosaic-bus@<business>.service`, so on a host whose business id
  isn't `mosaic-stack` nothing orders the two. The bus can start before
  the boot stop runs, and after a boot-time drift role sessions can use
  bwrap until it does. The fix: `After=mosaic-hostcheck.service` in
  `packages/cli/systemd/mosaic-bus.service.in`, which orders every
  instance and does nothing where the unit isn't installed. It goes in
  before the first install whose business id isn't `mosaic-stack`.
  Filbert N1 on row 240 (29945, #1746). (2026-10-21)
- **The run sheet writes the apt hook before the first `--check`.**
  Section 4 installs `80mosaic-hostcheck`, then runs
  `hostcheck.sh --check`. If that check fails, the next package run
  closes bwrap before anyone has read the failure. It fails closed, but
  it surprises an installer. The fix: run `--check` first, or say what a
  failure at that step means. Doc-only, for the next row that edits
  `docs/guides/host-run-sheet.md`. Filbert N2 on row 240 (29945, #1746).
  Filbert's N3, that a closed bwrap appends to `DRIFT` on every later
  apt run and boot, is by design; ops-01's STATE read should expect the
  repeats. (2026-10-21)
- **The sso-config first-step hint has no business.** When the target
  copy has no `console.sso`, `stack-release.sh` (`:938`) refuses with
  "activate $TO without --sso first, then ... activate $TO --sso". The
  usage line is `activate ID BUSINESS` (`:47`), so pasting either command
  as printed gives a usage error, not the first step. It fails safe,
  since the usage error changes nothing. The fix: add `$BUSINESS`
  (set at `:2138`) to both commands, and the business (`acme`)
  to the three expected strings in `stack-release.test.mjs`
  (`:1538`, `:1689`, `:1691`). For a later row that edits
  `stack-release.sh`. Webby N1 on row 238 r1 (REVIEW-r1.md, 433a95292,
  #1744). (2026-10-21)
- **Lane image prep inspects a base that BuildKit never tagged.**
  (N7 of the row 197 proof.) After the Compose build,
  `scripts/testing/lane-image.mjs:41` (`prepareImage`) runs
  `docker image inspect node:24-bookworm-slim` to put the base digest
  in the receipt. BuildKit resolves the base from the registry
  without tagging it in the local store, so on a host without the tag
  the inspect throws "No such image" after a good build. That
  happened in Sage's proof try 1 (2026-10-21 09:03Z, run cf48efccf083).
  The throw fails closed: the run's terminal record is unclean, both
  lanes quarantine, and `gate-lane.sh recover` clears them. Pulling the
  base first fixes it, and the receipt digest then matches what the
  build used (91acba91 both ways). The fix: before the build, inspect
  the base and refuse with a named reason if it's missing, or pull it.
  After the build, refuse if the base digest changed. Add a test with a
  fake Docker that has no base tag. Kept out of row 197 r6 by Sage
  (sage-1883). Mos asked for this record in mos-1162. (2026-10-21)
- **Case 1 acceptance script: root parses with the node it's checking, and the header says less than root does.**
  (Duckworth N1-N3 on the row 195 manifest, REVIEW-m1 6afcee2a5.)
  N1: F9 runs `$ROOT$NODE` as root (`scripts/case1-accept.sh:298`)
  before F10 checks that `--node` is the `/opt/mosaic-stack/node-<pin>`
  path (:303-304). On a host installed as designed, `case2-unit.sh:128-133`
  refused a non-root-owned `--node` and the args file is root's, so no
  escalation path exists today. Run F9's parse through `AS_USER`, or
  apply F10's path check first. N2: the header (:10) and the TOOLS.md
  entry say root only reads, but root also runs `curl` (F2), `sudo -l`
  (P1, P3), the jarvis probe (P9), `hostcheck.sh --check` and
  `systemctl`. Doc-only. N3: F6's prefix match (:261) accepts a
  `--claude` with `..` after `claude-<pin>/`. That claude runs only as
  `mosaic`, and F10 uses equality. Darkwing has a follow-up on
  `darkwing/row195-n1` 1e3c4767c, not yet run; it gets its own row now
  that 195 has landed (b65014647), Duckworth reviews. (2026-10-21)
- **Morgana's row 213 mutation set: the B3 pattern no longer matches `bundle.mjs`.**
  (Webby N3 on row 221 round 1, REVIEW-r1 a0a00630e.) Row 221's
  candidate changes `packages/harness/src/bundle.mjs`, and the B3
  anchor at Morgana's 213 `mutants.py:48` stops matching on that
  base. This matters only if someone reruns that set. Fix the anchor
  in that tooling before any rerun, and check that a stale anchor
  refuses instead of skipping the mutant (sage-1941). (2026-10-21)
- **Grant executor test X5 starts a `sleep 30` that can outlive its test.**
  (Webby N1 on row 248 r1, webby-0080; deferred by Duckworth in the row
  249 review, REVIEW-r1 28174fe08, #1751 comment 30070.) The test at
  `packages/bus/tests/grant-executor.test.mjs:989` (:934 before row
  249) runs `sleep 30` on the sshd side, where an abort doesn't reach it. Fix it with a stub
  that exits once its test dir is gone, as row 248 did for the hold
  stubs, or with a shorter sleep. This binds the next row that touches
  that test file. Until then, a lane cleanup that runs after this file
  waits 30 s before it calls a lone `sleep 30` a leak. The row 197
  lanes scan only at lane end, about 15 minutes after pkg-bus, so they
  can't see it (mos-1169). (2026-10-21)

- **Row 66 live checks: the unslop notice on a live managed session, both harnesses.**
  (mos-1186, Vikunja #454.) Row 66's gate asked for one landing session per
  harness with a prompt that draws a known tell. Mos changed that gate. The
  Claude Code session ran before landing on a scratch root from the
  candidate tree (run r4ab24630d323, landed 2c38325ec). Pi ran launch only there (run r1dd94171bede):
  this host has no credential pi reads until P19 #383 settles. Two live
  checks remain. Claude Code: in the first re-pin whose tree includes row 66,
  backup first (Q173). Pi: one full session with a tell after #383. Each
  attaches the operator note on the RESULT, the next-turn correction and the
  `unslop.jsonl` counts. (2026-10-21)

- **Console tester listener: `testerNoSignIn` is a dead parameter.**
  (Duckworth N2 on the row 196 manifest, REVIEW-m1; carried as C1 in
  REVIEW-m2 cdbf7b64e, #1694 comment 30156.) Row 196 landed 7247d80c7
  with the parameter and its comment still at `serve.mjs:472-475` and
  passed from `webui/src/cli.mjs:109` and `sso.test.mjs:392`. Nothing
  in `serve.mjs` reads it after the destructure. Remove it, or wire it
  with a test. This binds the next row that touches
  `packages/webui/src/serve.mjs`. (2026-10-21)
- **Console library routes: the tester listener and `library.sync`.**
  (Duckworth N5 on row 196 round 2, REVIEW-m2 cdbf7b64e.) At 7247d80c7
  `startServer` (`serve.mjs:475`) takes none of `libraryFile`,
  `libraryStatus` or `librarySync`, so the callbacks `cli.mjs` passes
  do nothing yet. The row that adds the Console library routes decides
  whether the tester listener gets `library.sync`. Duckworth's view is
  that it shouldn't, because sync is a human write. (2026-10-21)
- **Console library routes: four library codes still map to 502.**
  (Dewey N2 on the row 254 manifest, #1759 comment 30173.) Row 254
  gave six library codes a STATUS entry in `packages/webui/src/bus.mjs`.
  `library-mapping-invalid`, `library-remote-invalid`,
  `library-state-invalid` and `library-git` still fall through
  `busStatus` to 502. The row that adds the Console library routes
  decides their statuses and gives its `humanCall` for `library.sync`
  a timeout over 130 seconds. (2026-10-21)
- **T27 sweep test leaves two `sleep 60` children running.**
  (Darkwing row 251 slot, darkwing-0113 and darkwing-0117; Dewey on
  r2, comment 30168.) The sweep test spawns two detached shells,
  `planted` at `host-run.test.mjs:528` and `decoy` at `:536`, each
  running `sleep 60; :` with the run dir as `$0`. `sweepRunDir` kills
  the planted shell by pid (`host-run.mjs:238`), and `t.after` kills
  only the decoy shell. Neither kill reaches the `sleep` child, so each
  one lives for up to 60 s after the test and trips any busy check that
  follows. The fix is to kill the process group in both `t.after`
  hooks: `process.kill(-pid, 'SIGKILL')`. Each shell is spawned
  detached, so it leads its own group. `exec sleep 60` doesn't work.
  The sweep matches the run dir in `/proc/<pid>/cmdline`
  (`host-run.mjs:236`), and exec drops the `$0` that carries it, so the
  planted process would survive and the "planted process killed" assert
  would fail. This binds the next row that touches
  `packages/bus/tests/host-run.test.mjs`. (2026-10-21)
- **Real-model suite cases run outside the gate.** Row 244 moved
  `test-task.sh` fork recall (M11) and user recall (M16) behind
  `MOSAIC_LIVE_PROVIDER=1`, and `test-release.sh` activations to the mock
  adapter. Before any re-pin whose tree changes `packages/harness` or the
  session fork code (`scripts/mosaic-task.mjs` session and
  `sessionForkFrom` handling, the pi adapter), an operator runs
  `MOSAIC_LIVE_PROVIDER=1 bash scripts/test-task.sh` with the real pi
  credential and a real `release.sh activate`, and records both results on
  the re-pin row. Morgana's wording (row 244 BUILD.md), Webby N2 on row 244
  r1 (#1757). (2026-10-21)

## Queue

Moved to `docs/plans/QUEUE.md` on 2026-09-13. This file holds only gaps.

## Done

- Ledger (piece 3, #1506): shipped cd0aa5fb, Gate D written 2026-09-12 (18.9 human messages per closed issue).
- Relaunched seat shows the old last message (darkwing, Step 3 log, 2026-09-12): closed by #1512 relaunch activity, af4203ca. Filbert authored it; Darkwing and Dewey reviewed. The live board restart and Gate F remain separate.
- Sage launcher hook uncommitted (2026-09-12): closed by the agents/sage launch files commit, Dewey review R1 revise, R2 approve (`agents/dewey/work/sage-launch-review-2026-09-26.md`), launcher test now covers sage.
- Ledger counts T3 agent messages as human (2026-09-26, #1506): fixed in ef0020ad (Darkwing 6a, Filbert reviewed). `messageKind` now counts a T3 header as agent and the control-board sender as board. It changes no current count, because no source the ledger reads has a T3 header yet. That waits for the T3 thread source (Gate F).
- Control board checked the bind address but not Host or Origin (2026-09-26, #1507, found by Dewey): closed by the board guard commit. `foreignRequest` refuses a non-loopback Host, a wrong port, userinfo or a path in Host, and any foreign Origin on every route. Dewey authored it, and Rocko approved it (`agents/rocko/work/board-guard-review-2026-09-26.md`, 5a12f08e). Rocko's one low finding: URL normalization accepts a root slash, empty userinfo and an empty query in Host, so the notes' wording overstates what the raw-syntax check refuses. No bypass was found.
- Discord engine: leaked fake pi and the timeout gap in `busy` (2026-09-26, #1509): fixed in 3edb15eb (Darkwing 6b R2, Rocko approved, review ed5510a0). Tests stop the engine in `finally`. A turn pi never started now stops pi with exit 1 instead of guessing, and the unit restarts it. Known limit: see the open entry on wedge restarts.
- Combined concurrent test hangs (2026-09-14, #1509): closed on evidence from 3edb15eb. At default concurrency the union passed 406/406 three times on the R2 snapshot and 408/408 on the commit's index, where clean HEAD had hung four runs out of four. The inherited-intermittency entry from 2026-09-15 stays open until a later run shows it is the same cause.
- A nested `node --test` passes even when its tests fail (2026-09-26, #1508): closed. Queue A1 (34a72af9) clears NODE_TEST_CONTEXT on its own path. N13 fixes `test-foundation.sh` and `test-discord.sh`, each with a check that fails the suite if the clearing is lost. Darkwing wrote it (n13.patch 00868b2f) and Filbert approved it (e464be6c). Sage's grep on 2026-09-27 finds no other nested `node --test`: in scripts, only the two suites, `test-queue.sh` and `queue-commit.sh`, and in JS, only the queue test that covers the fix.
- SetSpark service accepted any string as a decision approver (2026-09-26, #1509): closed. Fixed in shared-signals cc74d92 (Rocko approved R2, lead decision 24). The operations seat (T3 12fe8cda) deployed it to VM 1022 at 00:23Z on 2026-09-27. The running `service.py` hash matches cc74d92, and `/healthz` returns 200 inside the network and through the public tunnel. The read-only README survey found one row breaking the rule (DEC-009, Proposed, version 1), one open request that isn't ready (DEC-009's), and no Accepted decision with more than 16 approvers. No rows changed. DEC-009 stays as stored (lead decisions 21 and 28). The service now refuses approvals on it, so nothing can go wrong silently. Side effect: `up -d` also recreated caddy, about 20 s of edge downtime for all hosts. That is for the shared-signals deploy procedure to fix, not Mosaic.
- Queue suite failed its live checks outside the canonical checkout
  (2026-09-27, #1508): closed by Piece D, f539466f. `test-queue.sh` now
  skips `verify` and `render --check` with a printed reason when the
  toplevel isn't the recorded `canonicalRoot`. An index export passed
  27/0, and the canonical checkout 29/0.
- Queue: an owner listed as a reviewer blocked the row (2026-09-27,
  #1508): closed by row 31, bb2fa970. `add`, `set reviewers` and `assign`
  now refuse the owner as a reviewer with exit 2 and write nothing. Rocko
  built it in the Gate G run, and Filbert approved round 1 (#1508 comment
  26629, 8 of 8 mutants caught).
- Queue follow-ups from rows 12, 13 and 31 (2026-10-04, #1508): closed by
  row 33, 6fb50cc0. Filbert built it, and Darkwing approved round 1
  (#1508 comment 26651).
  - `genesis` refuses a map row whose owner is one of its reviewers (exit
    2, nothing written). The check is on the map, not in replay, so a log
    from before the rule still loads.
  - The `assign` refusal now reads "can't assign row N to SEAT: SEAT is
    one of its reviewers".
  - `queue-commit.sh` compares HEAD with H before each canary and again if
    the clean run fails. A moved HEAD exits 2 with "HEAD moved since H was
    recorded"; the guard message is kept for a real guard failure.
  - Every time and date the validator accepts must format back to itself,
    so month 13, day 32, 2026-02-30, 2027-02-29 and 24:00 are refused.
    The live log at rev 45 still replays.
  - The cold-start failure (2026-09-27): not reproduced in 20 cold runs.
    Each ran `node --test packages/queue/tests/` in a fresh tree, 10
    shared clones and 10 exports, one after another. All 20 passed
    148/148 (2960 of 2960). The 300 ms deadline test is unchanged. Counts:
    `agents/filbert/work/queue-33/cold-runs.txt`.
- CHAT-03 I1 round 2 follow-ups (2026-10-04, #1507): four of five closed
  by slice 1 S5 (row 40, #1522; Dewey authored, Darkwing and Filbert
  reviewing). The commit is named in the row's review record when it
  lands.
  - Engine command and `preArgs`: `engine` takes only `extraArgs`, `cwd`
    and `envKeys`. The controller always launches the pinned Pi and
    checks that at construction and at bind. The fake engine comes in
    through a symbol key that JSON config can't carry (N24b).
  - Engine environment: an explicit list (`ENGINE_ENV` in `pi-pin.mjs`)
    plus `*_API_KEY` and `*_TOKEN` names from `engine.envKeys`. Nothing
    else is inherited. `HOME` passes, so Pi reads `~/.pi/agent` unless
    `PI_CODING_AGENT_DIR` is set (Darkwing F3).
  - `escalating` is cleared when the force-stop fence throws (Darkwing F2,
    races.test.mjs).
  - Takeover then Enter in one chunk: input after Ctrl-T or Ctrl-O waits
    for that action, in the same chunk or a later one, and also while an
    earlier action is still pending, so it is judged as if typed one key
    at a time (Filbert F2; Darkwing and Filbert T1 on #1522;
    flows.test.mjs).
  The frozen-cgroup test (Filbert F1) stays open above.
- Gate runs mount the host's pi auth file (Webby N4 on the row 197 proof
  driver, 059577886): closed by row 244 (#1757), landing e69260a3c. The
  suites and the lane's `cleanEnv` export a 0600 fixture `PI_AUTH_FILE`,
  `guardDocker` refuses a Compose run without one, and
  `packages/cli/tests/gate-lane-auth.test.mjs` proves no gate step mounts
  the host default. The real-model cases this moved off the gate are open
  above.

## Row253 F5: legacy Case AS_USER supervision

Tracked as row 276, Gitea #1781 (sage-2331), owner Gander, reviewer Duckworth, after row253.
Brief: docs/plans/2026-10-22_case-sudo-legacy-followup.md, “Brief: supervised legacy AS_USER calls”.

case1-accept.sh's legacy timeout330 around AS_USER talk and its AS_USER precheck, Claude version, PM launches and Node version diagnostics predate the new socket metadata/probe helpers. sudo's pty monitor can move them to a separate session; the old outer timeout does not prove their descendants are killed. The C4 repair in row253 covers only its new config query and peer probe. These legacy paths need the reviewed supervisor or a header explicitly explaining why each remains unsupervised. The follow-up must preserve the 300-second talk/reply contract, concurrent F5 scan, diagnostics and secret-output refusals, with fake-only session-hop tests and Sage's slot. No host or live unit change is authorized.

Row 276 / #1781 also owns the case1 root-side capture/tools mutant counterparts (duckworth-0112 N1) and documenting the setuid-member cleanup refusal in the headers (N2). A member that changes uid and cannot be killed causes inner-cleanup refusal, never successful observation. N4 is addressed in row253 by allowing SID confirmation until the existing inner watchdog expires, instead of a separate 200 ms scheduling margin.
