docs(row253): pin final aca1 integration and focused file bounds

agents/gander/work/queue-253/BUILD.md

@@ -226,3 +226,11 @@ New gander/row253-264a rebases eleven commits onto84f53540d without conflicts; e
 ## Corrected docs base, sage-2700/2702, no runs
 
 New gander/row253-b789 rebases ontob78918850. Sourcec75c9bbd3339cb2343467715a14455044c2e4aea. Only append conflicts in BUILD-LOG and DEFERRED: current base remains exact byte prefix,253 entries appended. No old entry edited or removed. Manifest573c51cf72f2398532a6ea768536f04e3c1681997cb8b9a6f14a8aef884870ae. Five runnable blobs and README match preceding candidate; only DEFERRED hash changes.27-file whole union unchanged, no result carries. Hold branch local: final Gizmoduck docs tip must land first, then rebase/publish and focused CLEAR. No tests/Node/push. integration-b789/ records the resolution and hashes.
+
+## Final base aca16404c, sage-2705, before execution
+
+New gander/row253-aca1 rebases13 commits ontoaca16404c without conflicts; all13 final-hop pairs equal. Sourceed3bb376cdd5128dc58b3aa193282e1c2bfcf57d. Seven blobs unchanged, manifest573c51cf72f2398532a6ea768536f04e3c1681997cb8b9a6f14a8aef884870ae. Both append paths retain the full base prefix. Final upstream docs/queue changes touch no focused read.27-file union remains unchanged.
+
+Step2 file bounds: every file listed in integration-aca1/FILE-LIMITS.json runs whole as timeout -k10 300 node --test --test-reporter=tap FILE, outer harness330s. Own case1/case2 first, then25 others. Busy check before each start, pipefail and tee, TMPDIR from mktemp-d /mnt/storage/scratch/tmp/gXXXXXX. First unexpected failure or timeout stops to Sage/Mos unplaced; no retry. Print HEAD and manifest digest first. No test has run. Expect10-15min; status at15min. Whole-suite limits are separate and will be written before whole-gate CLEAR.
+
+Whole-shell limits remain as in the earlier table and SHELL-LIMITS.json:auth126,conductor145,config130,discord147,extension130,foundation240,land-work158,queue191,release157,task231. Each is at least3x its longest recorded successful whole run. No script changed.

agents/gander/work/queue-253/MANIFEST.md

@@ -13,3 +13,5 @@ Superseding integration under sage-2659: gander/row253-385a on385a7194c, source1
 Post264a supersedes the385a preview: gander/row253-264a on84f53540d, rebased sourceb9d3d4c75c78aa6b06aefd734da781bef9b7f1da, manifest735fa2d7405d01ace8eb7aab366753fa5b1877cf8044b0151cb2113a0502bc1f. Only DEFERRED differs from the preview. See integration-264a/ for all11 equal pairs, patch-ids and whole-file union. Focused whole-file runs, publication, rebase review and full gate are pending Sage CLEAR.
 
 Corrected interim integration2700/2702: gander/row253-b789 onb78918850, sourcec75c9bbd3339cb2343467715a14455044c2e4aea, digest573c51cf72f2398532a6ea768536f04e3c1681997cb8b9a6f14a8aef884870ae.27-file scope unchanged. Pending final docs tip, rebase and CLEAR; no gate run.
+
+Final base under sage-2705: gander/row253-aca1 onaca16404c, sourceed3bb376cdd5128dc58b3aa193282e1c2bfcf57d, digest573c51cf unchanged. integration-aca1/ is the final-hop packet. No runs yet.

agents/gander/work/queue-253/integration-aca1/FILE-LIMITS.json

@@ -0,0 +1,164 @@
+{
+  "packages/cli/tests/case1-accept.test.mjs": {
+    "timeout_seconds": 300,
+    "kill_after_seconds": 10,
+    "outer_harness_seconds": 330,
+    "reason": "Whole-file bound under sage-2705; no prior repaired-C4 whole-file timing claimed."
+  },
+  "packages/cli/tests/case2-unit.test.mjs": {
+    "timeout_seconds": 300,
+    "kill_after_seconds": 10,
+    "outer_harness_seconds": 330,
+    "reason": "Whole-file bound under sage-2705; no prior repaired-C4 whole-file timing claimed."
+  },
+  "packages/bus/tests/account-migration.test.mjs": {
+    "timeout_seconds": 300,
+    "kill_after_seconds": 10,
+    "outer_harness_seconds": 330,
+    "reason": "Whole-file bound under sage-2705; no prior repaired-C4 whole-file timing claimed."
+  },
+  "packages/bus/tests/chief-of-staff.test.mjs": {
+    "timeout_seconds": 300,
+    "kill_after_seconds": 10,
+    "outer_harness_seconds": 330,
+    "reason": "Whole-file bound under sage-2705; no prior repaired-C4 whole-file timing claimed."
+  },
+  "packages/bus/tests/comment-migration.test.mjs": {
+    "timeout_seconds": 300,
+    "kill_after_seconds": 10,
+    "outer_harness_seconds": 330,
+    "reason": "Whole-file bound under sage-2705; no prior repaired-C4 whole-file timing claimed."
+  },
+  "packages/bus/tests/end-launch.test.mjs": {
+    "timeout_seconds": 300,
+    "kill_after_seconds": 10,
+    "outer_harness_seconds": 330,
+    "reason": "Whole-file bound under sage-2705; no prior repaired-C4 whole-file timing claimed."
+  },
+  "packages/bus/tests/fire-revokes-grants.test.mjs": {
+    "timeout_seconds": 300,
+    "kill_after_seconds": 10,
+    "outer_harness_seconds": 330,
+    "reason": "Whole-file bound under sage-2705; no prior repaired-C4 whole-file timing claimed."
+  },
+  "packages/bus/tests/gitea-grant.test.mjs": {
+    "timeout_seconds": 300,
+    "kill_after_seconds": 10,
+    "outer_harness_seconds": 330,
+    "reason": "Whole-file bound under sage-2705; no prior repaired-C4 whole-file timing claimed."
+  },
+  "packages/bus/tests/gitea-migration.test.mjs": {
+    "timeout_seconds": 300,
+    "kill_after_seconds": 10,
+    "outer_harness_seconds": 330,
+    "reason": "Whole-file bound under sage-2705; no prior repaired-C4 whole-file timing claimed."
+  },
+  "packages/bus/tests/grant-executor.test.mjs": {
+    "timeout_seconds": 300,
+    "kill_after_seconds": 10,
+    "outer_harness_seconds": 330,
+    "reason": "Whole-file bound under sage-2705; no prior repaired-C4 whole-file timing claimed."
+  },
+  "packages/bus/tests/grant-migration.test.mjs": {
+    "timeout_seconds": 300,
+    "kill_after_seconds": 10,
+    "outer_harness_seconds": 330,
+    "reason": "Whole-file bound under sage-2705; no prior repaired-C4 whole-file timing claimed."
+  },
+  "packages/bus/tests/lifecycle-revoke.test.mjs": {
+    "timeout_seconds": 300,
+    "kill_after_seconds": 10,
+    "outer_harness_seconds": 330,
+    "reason": "Whole-file bound under sage-2705; no prior repaired-C4 whole-file timing claimed."
+  },
+  "packages/bus/tests/message-filter.test.mjs": {
+    "timeout_seconds": 300,
+    "kill_after_seconds": 10,
+    "outer_harness_seconds": 330,
+    "reason": "Whole-file bound under sage-2705; no prior repaired-C4 whole-file timing claimed."
+  },
+  "packages/bus/tests/name-migration.test.mjs": {
+    "timeout_seconds": 300,
+    "kill_after_seconds": 10,
+    "outer_harness_seconds": 330,
+    "reason": "Whole-file bound under sage-2705; no prior repaired-C4 whole-file timing claimed."
+  },
+  "packages/bus/tests/schema.test.mjs": {
+    "timeout_seconds": 300,
+    "kill_after_seconds": 10,
+    "outer_harness_seconds": 330,
+    "reason": "Whole-file bound under sage-2705; no prior repaired-C4 whole-file timing claimed."
+  },
+  "packages/bus/tests/sessions.test.mjs": {
+    "timeout_seconds": 300,
+    "kill_after_seconds": 10,
+    "outer_harness_seconds": 330,
+    "reason": "Whole-file bound under sage-2705; no prior repaired-C4 whole-file timing claimed."
+  },
+  "packages/bus/tests/spec-migration.test.mjs": {
+    "timeout_seconds": 300,
+    "kill_after_seconds": 10,
+    "outer_harness_seconds": 330,
+    "reason": "Whole-file bound under sage-2705; no prior repaired-C4 whole-file timing claimed."
+  },
+  "packages/bus/tests/tester-writes.test.mjs": {
+    "timeout_seconds": 300,
+    "kill_after_seconds": 10,
+    "outer_harness_seconds": 330,
+    "reason": "Whole-file bound under sage-2705; no prior repaired-C4 whole-file timing claimed."
+  },
+  "packages/bus/tests/thread-claims.test.mjs": {
+    "timeout_seconds": 300,
+    "kill_after_seconds": 10,
+    "outer_harness_seconds": 330,
+    "reason": "Whole-file bound under sage-2705; no prior repaired-C4 whole-file timing claimed."
+  },
+  "packages/bus/tests/thread-migration.test.mjs": {
+    "timeout_seconds": 300,
+    "kill_after_seconds": 10,
+    "outer_harness_seconds": 330,
+    "reason": "Whole-file bound under sage-2705; no prior repaired-C4 whole-file timing claimed."
+  },
+  "packages/bus/tests/threads.test.mjs": {
+    "timeout_seconds": 300,
+    "kill_after_seconds": 10,
+    "outer_harness_seconds": 330,
+    "reason": "Whole-file bound under sage-2705; no prior repaired-C4 whole-file timing claimed."
+  },
+  "packages/bus/tests/usage-migration.test.mjs": {
+    "timeout_seconds": 300,
+    "kill_after_seconds": 10,
+    "outer_harness_seconds": 330,
+    "reason": "Whole-file bound under sage-2705; no prior repaired-C4 whole-file timing claimed."
+  },
+  "packages/cli/tests/lifecycle.test.mjs": {
+    "timeout_seconds": 300,
+    "kill_after_seconds": 10,
+    "outer_harness_seconds": 330,
+    "reason": "Whole-file bound under sage-2705; no prior repaired-C4 whole-file timing claimed."
+  },
+  "packages/cli/tests/stack-release.test.mjs": {
+    "timeout_seconds": 300,
+    "kill_after_seconds": 10,
+    "outer_harness_seconds": 330,
+    "reason": "Whole-file bound under sage-2705; no prior repaired-C4 whole-file timing claimed."
+  },
+  "packages/cli/tests/thread-cli.test.mjs": {
+    "timeout_seconds": 300,
+    "kill_after_seconds": 10,
+    "outer_harness_seconds": 330,
+    "reason": "Whole-file bound under sage-2705; no prior repaired-C4 whole-file timing claimed."
+  },
+  "packages/cli/tests/thread-launch.test.mjs": {
+    "timeout_seconds": 300,
+    "kill_after_seconds": 10,
+    "outer_harness_seconds": 330,
+    "reason": "Whole-file bound under sage-2705; no prior repaired-C4 whole-file timing claimed."
+  },
+  "packages/webui/tests/chat.test.mjs": {
+    "timeout_seconds": 300,
+    "kill_after_seconds": 10,
+    "outer_harness_seconds": 330,
+    "reason": "Whole-file bound under sage-2705; no prior repaired-C4 whole-file timing claimed."
+  }
+}

agents/gander/work/queue-253/integration-aca1/NOTES.md

@@ -0,0 +1,15 @@
+# Row253 final base and pre-gate scope
+
+Authority sage-2705. New branch gander/row253-aca1 on aca16404cf522b03f39acaf140e4f6185a507b88. Rebased source tip ed3bb376cdd5128dc58b3aa193282e1c2bfcf57d. Thirteen commits replayed from b78918850..288cdecf6; all thirteen final-hop range-diff pairs equal, no conflict. Earlier branches remain. The requested comparison from d213ef651 is range-diff-from-d213.txt; the two extra interim packet commits have no old counterpart, and the original BUILD-LOG context changes are documented in integration-b789/.
+
+Seven manifest blobs are byte-identical to288cdecf6. Digest573c51cf72f2398532a6ea768536f04e3c1681997cb8b9a6f14a8aef884870ae. All seven sha256sum checks pass. Both append-only paths keep the entire final base as exact byte prefix. Final-hop upstream changes only Gizmoduck BUILD and queue JSON/rendering; none is a253 focused read or pinned asset. The earlier264a Store/schema dependency is present on the base and is covered by whole-file scope.
+
+Duckworth's requested prefix-resolution material remains in integration-b789/NOTES.md, manifest-drift.diff and whole-test-union.json. This folder's drift is385a7194c..finalbase on the manifest paths and its whole union was independently recomputed:27 runnable files, unchanged from interim. Fixtures are exercised through importers, not represented as standalone tests. N9 is the exact sandbox bind case in case2; report its runtime skip reason verbatim.
+
+## Bounds written before any run
+
+Step2 runs all27 files whole, own case1/case2 first, then remaining sorted paths. Every call is timeout -k10 300 node --test --test-reporter=tap FILE; Python harness outer wait330s is a fallback. FILE-LIMITS.json records every file. Busy check gates each start, pipefail and tee capture raw logs and structured command JSONs. Any timeout is a stop, never a kill/pass; any unexpected red stops with no retry. Print HEAD and manifest digest first. No run starts before focused CLEAR. Expected duration10-15min; status every15min and immediate stop report.
+
+The later whole gate remains separately gated. Every whole shell uses SHELL-LIMITS.json (ceil3xmax+120), recorded in BUILD.md. Script bytes unchanged; no no-record case, so900 fallback unused. Whole CLI needs a separately stated bound in its whole-gate plan because the historical whole result took597s; a300s file limit is not a claim about full-suite runtime. No carried results. No product/test/assertion changed during final integration.
+
+No tests, Node, syntax commands, browser, probe, queue write or push have run while writing this packet. Publishing is authorized by sage-2705 after this record is committed. The next action is request focused CLEAR, then27 whole files, Duckworth rebase check and later whole-gate CLEAR.

agents/gander/work/queue-253/integration-aca1/STATUS.json

@@ -0,0 +1,18 @@
+{
+  "authority": "sage-2705",
+  "base": "aca16404cf522b03f39acaf140e4f6185a507b88",
+  "source_tip": "ed3bb376cdd5128dc58b3aa193282e1c2bfcf57d",
+  "branch": "gander/row253-aca1",
+  "manifest": "573c51cf72f2398532a6ea768536f04e3c1681997cb8b9a6f14a8aef884870ae",
+  "final_hop_paths": [
+    "agents/gizmoduck/work/queue-264/BUILD.md",
+    "docs/plans/QUEUE.md",
+    "docs/plans/queue.json"
+  ],
+  "final_hop_conflicts": [],
+  "manifest_unchanged": true,
+  "all_7_blobs_equal_b789": true,
+  "append_prefix_checks": true,
+  "test_union_count": 27,
+  "tests_run": false
+}

agents/gander/work/queue-253/integration-aca1/manifest-drift.diff

@@ -0,0 +1,78 @@
+diff --git a/docs/plans/DEFERRED.md b/docs/plans/DEFERRED.md
+index 4c0c736f1..f990eb3a9 100644
+--- a/docs/plans/DEFERRED.md
++++ b/docs/plans/DEFERRED.md
+@@ -431,17 +431,6 @@ at every gate. Started 2026-09-12 during the control board MVP.
+   comes near 64 runs. The follow-up row either raises the cap or splits
+   the done. Its test: a fire's done over the cap refuses, and the runs it
+   left alive still get the alive flag. (2026-10-22)
+-- **A fired or deleted instance keeps its grants.** (Dewey on the row 236
+-  rebase look, dewey-0815; Mos mos-1271; Sage sage-2558.) Row 194's
+-  `instance.fire` and row 256's delete revoke only the roles entry's
+-  credential services through `revoke()` in `runtime.mjs`. The agent's
+-  host grants (row 235) and its Gitea user and token (row 236) stay live
+-  until a human runs `mosaic hosts revoke` or `mosaic grants revoke`. The
+-  Console has no revoke route and doesn't say a grant is left. Row 281
+-  (#1786) closes it: a fire or a delete revokes every host and Gitea grant
+-  the instance holds, fail closed, with a test for each kind. It lands
+-  before the .53 Case 1 install hires an instance with a grant.
+-  (2026-10-22)
+ 
+ - **The runs suite doesn't gate a change to `scripts/mosaic-task.mjs`.**
+   (Dewey N7 on row 191, repeated on the Vikunja 502 review.)
+@@ -460,6 +449,44 @@ at every gate. Started 2026-09-12 during the control board MVP.
+   changes `packages/cli/tests/tester.test.mjs`: add the resolve pin so M8
+   dies on an assertion. (2026-10-22)
+ 
++- **Row 274's user reply check is scoped to the thread, not the session.**
++  (Row 264a r6, sage-2591.) In `packages/bus/src/broker.mjs`, the check that
++  a run answers a user only in reply to that user's message in its thread
++  joins `message_threads` by thread. That holds while a user's thread has
++  only its default session: a user can't call `session.create`, and
++  `#thread` refuses anyone but the owner. Binds row 272 (264e, #1777), or
++  any row that lets a user add sessions: make the check session-scoped and
++  test it with two sessions. (2026-10-22)
++
++- **Row 281's refusal texts point the wrong way.** (Dewey N1 and N2 on
++  the row 281 manifest round, dewey-0842/0843 and dewey-0846; Sage
++  sage-2653.) N1: when a host decision is still open and the host is
++  removed, step G's fire or delete job refuses `host-unknown`, and the
++  inbox hint names a verb that can't help. The way out is to decline or
++  withdraw the decision (`packages/bus/src/broker.mjs`, the closed check
++  near :1684 and `decision.withdraw` near :5015). T14 now pins that path.
++  N2: the chief's fire tool text in `packages/harness/src/tools.mjs`
++  (near :186) doesn't say the fire's job can come back for an answer.
++  Neither changes behaviour. Binds the next row that changes the step G
++  hint text in `broker.mjs` or the fire tool text in `tools.mjs`: fix
++  both wording gaps and pin the hint in a test. (2026-10-22)
++
++- **Row 264a's refusal check in sessions.test doesn't pin the actor.**
++  (Duckworth N1 on the row 264a r12 delta, duckworth-0138; Sage sage-2695.)
++  `refusedOnce` in `packages/bus/tests/sessions.test.mjs` checks that each
++  refused call adds one `action.refused` event with code `not-holder`, but
++  not that the event's `actor_run` is the refused run. Binds row 269 (264b,
++  #1774), or the next row that changes `sessions.test.mjs`: pin `actor_run`
++  in `refusedOnce`. (2026-10-22)
++
++- **editor-provenance skips its rebuild check on esbuild 0.28.1.** (Duckworth
++  N2 on the row 264a manifest round, duckworth-0146.) The webui test
++  "rebuilding from the source gives the same bytes" needs esbuild 0.28.2,
++  the checkout has 0.28.1, and the gate logs a skip (webui.log:99). The file
++  is at base and was not in 264a's manifest. Binds the next gate that
++  touches the webui build: install the pinned esbuild in the gate checkout
++  so the check runs, or record why it can't. (2026-10-22)
++
+ ## Queue
+ 
+ Moved to `docs/plans/QUEUE.md` on 2026-09-13. This file holds only gaps.
+@@ -531,3 +558,10 @@ Moved to `docs/plans/QUEUE.md` on 2026-09-13. This file holds only gaps.
+   `packages/cli/tests/gate-lane-auth.test.mjs` proves no gate step mounts
+   the host default. The real-model cases this moved off the gate are open
+   above.
++- A fired or deleted instance kept its grants (2026-10-22, Dewey on the
++  row 236 rebase look, mos-1271): closed by row 281 (#1786), landing
++  e479521d3. A fire or a delete now runs a step G job that revokes every
++  host and Gitea grant the instance holds, fail closed, and tells the
++  human in the inbox when it can't. Megavolt built it; Dewey approved the
++  design (d6) and the manifest (c30614). The text gaps it left are open
++  above.

agents/gander/work/queue-253/integration-aca1/range-diff-final-hop.txt

@@ -0,0 +1,13 @@
+ 1:  e8b096948 =  1:  730a78aa9 gander: design tester socket migration for host scripts
+ 2:  0d7f9da11 =  2:  643d16528 test: prepare row253 socket fixtures and fix gate collisions
+ 3:  7c1fcbd96 =  3:  6f320b4b0 docs: propose row253 C4 session supervisor and draft hop fake
+ 4:  565302e71 =  4:  62de84882 docs(row253): freeze C4 repair for static review
+ 5:  bcf4e2501 =  5:  c8cca3a68 docs(row253): store repair patch without context whitespace
+ 6:  f2c594d7b =  6:  cca936716 fix(row253): supervise socket queries across sudo sessions
+ 7:  29d5f0d5e =  7:  950cf47f3 fix(row253): bound cleanup retries after initial inventory
+ 8:  e24d7b559 =  8:  3b142c9c6 docs(row253): record static approval and pre-confirmation residual
+ 9:  94c2b76b8 =  9:  ad67d9595 docs(row253): record integration onto refactor 378a76b85
+10:  049088866 = 10:  72b17562d docs(row253): integrate row191 base and refresh manifest
+11:  7916f0ee6 = 11:  e75ef1b19 docs(row253): integrate 385a base and record dependency drift and bounds
+12:  c75c9bbd3 = 12:  cd269e733 docs(row253): record schema3l integration before final base correction
+13:  288cdecf6 = 13:  ed3bb376c docs(row253): preserve doc sweep appends on corrected interim base

agents/gander/work/queue-253/integration-aca1/range-diff-from-d213.txt

@@ -0,0 +1,50 @@
+ 1:  a9c094d06 !  1:  730a78aa9 gander: design tester socket migration for host scripts
+    @@ Commit message
+         gander: design tester socket migration for host scripts
+     
+      ## BUILD-LOG.md ##
+    -@@ BUILD-LOG.md: Before: managed project/thread verbs had no Console conversation area. After: fi
+    - ### 2026-10-22 | Gander | row278 gate run3
+    +@@ BUILD-LOG.md: Fresh gate on3e4c77ac6 under sage-2648: bus793/0, WebUI345/0/1 (esbuild version
+    + 2026-10-22 13:10 UTC | Sage | Rows 278 and 281 LANDED. Before: refactor at 6af85df4b (V502). Row 278 (#1783, Gander, Webby): the Console Agents view shows thread claims in their own section. It landed as 385a7194c at 12:39Z, ff, 9 commits, manifest 8fa859a0. Run 3 was green: bus 793, webui 345/0/1, ten shells 425/0 under the 3x limits (mos-1275), M1-M6 killed. Runs 1 and 2 were void, on fixture fixes 964b6b184 (placed by Sage) and 9696d1fcb (ruled by Mos, mos-1275). Webby approved (c30588, rev 3200). Done rev 3202, #1783 closed c30589. Row 281 (#1786, Megavolt, Dewey): a fire or a delete revokes the instance's host and Gitea grants. It landed as e479521d3 at 13:06Z, ff, 17 commits, manifest b73d4c81. Slot on 7979fb41e: bus 819, business 231, cli 837, dewey-bus 76 with the Docker gitea-grant test, shells green, M1-M22 killed. The M1 hang was fixed at its cause in b4a (mos-1273). Dewey approved (c30614, rev 3207). Done rev 3209, #1786 closed c30621. Skips on both: test-task's row 244 live-provider pair and test-queue's canonical-root check, plus webui's esbuild rebuild test on 278. After: refactor at e479521d3. DEFERRED moves the grant gap to Done and opens Dewey's N1/N2 text gaps. LIVE is still 86f95bb27.
+      
+    - Fresh gate on3e4c77ac6 under sage-2648: bus793/0, WebUI345/0/1 (esbuild version skip), all ten shell files425/0, touched files15/0, M1-M6 killed6/6. No timeout; sweep0 run-created leftovers. Runs1/2 void. Seven-path manifest8fa859a0 goes to Webby for final review. No landing or live change.
+    + 2026-10-22 14:18:23 UTC | Sage | Row 264a LANDED (#1769, Gizmoduck, Duckworth): sessions per thread, schema 3k-3l. Before: refactor at e479521d3 (row 281). It landed as 84f53540d, ff, 21 commits, manifest 257408e9 (Duckworth approve rev 3214, comment 30640). Gate r13 on 2cc34aef8: 20 touched files, bus 827, cli 837, webui 345/1 named skip, ten shells under 3x limits, mutants M1-M4 killed on assertions. Corrections on the way: the kit stopped on first red, so four reds surfaced one at a time. r10 later3l missed a trigger (mos-1276). T2 had failed since r2 because refusals log action.refused (mos-1277, my sage-2257 wording). threads.test:341 kept the old trigger text (mos-1278). M2 was caught by the store trigger before any assertion, so it now drops the trigger too (mos-1279, four files with the SCHEMA_SHA256 pin). Deferred: actor_run pin binds row 269, esbuild skip to a later gate, session-scoped user reply binds row 272. No live change; LIVE is still 86f95bb27.
+     +2026-10-21 21:24:47 UTC | Gander row253 #1758 design r1 | Investigation began21:12Z under sage-2162; recorded now. Before: case2 installer still renders tester TCP and case1 acceptance requires it. After: proposed design covers socket marker migration, actual configured dataRoot within unchanged hardening, target-uid metadata queries, kernel-peer acceptance observation and explicit same-uid residual. Initial inventory saved; no passing final static-check claim, product edit, test, host or live action. Duckworth design review precedes code.
+     
+      ## agents/gander/work/queue-253/BASE-PORT-INVENTORY.json (new) ##
+ 2:  2e81f7872 =  2:  643d16528 test: prepare row253 socket fixtures and fix gate collisions
+ 3:  3c8edc358 =  3:  6f320b4b0 docs: propose row253 C4 session supervisor and draft hop fake
+ 4:  3114087ef =  4:  62de84882 docs(row253): freeze C4 repair for static review
+ 5:  911e470b7 =  5:  c8cca3a68 docs(row253): store repair patch without context whitespace
+ 6:  4a8b5c3ff !  6:  cca936716 fix(row253): supervise socket queries across sudo sessions
+    @@ Commit message
+         fix(row253): supervise socket queries across sudo sessions
+     
+      ## BUILD-LOG.md ##
+    -@@ BUILD-LOG.md: Before: managed project/thread verbs had no Console conversation area. After: fi
+    +@@ BUILD-LOG.md: Fresh gate on3e4c77ac6 under sage-2648: bus793/0, WebUI345/0/1 (esbuild version
+      
+    - Fresh gate on3e4c77ac6 under sage-2648: bus793/0, WebUI345/0/1 (esbuild version skip), all ten shell files425/0, touched files15/0, M1-M6 killed6/6. No timeout; sweep0 run-created leftovers. Runs1/2 void. Seven-path manifest8fa859a0 goes to Webby for final review. No landing or live change.
+    + 2026-10-22 14:18:23 UTC | Sage | Row 264a LANDED (#1769, Gizmoduck, Duckworth): sessions per thread, schema 3k-3l. Before: refactor at e479521d3 (row 281). It landed as 84f53540d, ff, 21 commits, manifest 257408e9 (Duckworth approve rev 3214, comment 30640). Gate r13 on 2cc34aef8: 20 touched files, bus 827, cli 837, webui 345/1 named skip, ten shells under 3x limits, mutants M1-M4 killed on assertions. Corrections on the way: the kit stopped on first red, so four reds surfaced one at a time. r10 later3l missed a trigger (mos-1276). T2 had failed since r2 because refusals log action.refused (mos-1277, my sage-2257 wording). threads.test:341 kept the old trigger text (mos-1278). M2 was caught by the store trigger before any assertion, so it now drops the trigger too (mos-1279, four files with the SCHEMA_SHA256 pin). Deferred: actor_run pin binds row 269, esbuild skip to a later gate, session-scoped user reply binds row 272. No live change; LIVE is still 86f95bb27.
+      2026-10-21 21:24:47 UTC | Gander row253 #1758 design r1 | Investigation began21:12Z under sage-2162; recorded now. Before: case2 installer still renders tester TCP and case1 acceptance requires it. After: proposed design covers socket marker migration, actual configured dataRoot within unchanged hardening, target-uid metadata queries, kernel-peer acceptance observation and explicit same-uid residual. Initial inventory saved; no passing final static-check claim, product edit, test, host or live action. Duckworth design review precedes code.
+     +
+     +### 2026-10-21 row253 implementation prepared, gate pending
+    @@ agents/gander/work/queue-253/MANIFEST.sha256 (new)
+     
+      ## docs/plans/DEFERRED.md ##
+     @@ docs/plans/DEFERRED.md: Moved to `docs/plans/QUEUE.md` on 2026-09-13. This file holds only gaps.
+    -   `packages/cli/tests/gate-lane-auth.test.mjs` proves no gate step mounts
+    -   the host default. The real-model cases this moved off the gate are open
+    +   human in the inbox when it can't. Megavolt built it; Dewey approved the
+    +   design (d6) and the manifest (c30614). The text gaps it left are open
+        above.
+     +
+     +## Row253 F5: legacy Case AS_USER supervision
+ 7:  e18b90e95 =  7:  950cf47f3 fix(row253): bound cleanup retries after initial inventory
+ 8:  677767145 =  8:  3b142c9c6 docs(row253): record static approval and pre-confirmation residual
+ 9:  c733371c5 =  9:  ad67d9595 docs(row253): record integration onto refactor 378a76b85
+10:  141b79c29 = 10:  72b17562d docs(row253): integrate row191 base and refresh manifest
+11:  d213ef651 = 11:  e75ef1b19 docs(row253): integrate 385a base and record dependency drift and bounds
+ -:  --------- > 12:  cd269e733 docs(row253): record schema3l integration before final base correction
+ -:  --------- > 13:  ed3bb376c docs(row253): preserve doc sweep appends on corrected interim base

agents/gander/work/queue-253/integration-aca1/whole-test-union.json

@@ -0,0 +1,29 @@
+[
+  "packages/cli/tests/case1-accept.test.mjs",
+  "packages/cli/tests/case2-unit.test.mjs",
+  "packages/bus/tests/account-migration.test.mjs",
+  "packages/bus/tests/chief-of-staff.test.mjs",
+  "packages/bus/tests/comment-migration.test.mjs",
+  "packages/bus/tests/end-launch.test.mjs",
+  "packages/bus/tests/fire-revokes-grants.test.mjs",
+  "packages/bus/tests/gitea-grant.test.mjs",
+  "packages/bus/tests/gitea-migration.test.mjs",
+  "packages/bus/tests/grant-executor.test.mjs",
+  "packages/bus/tests/grant-migration.test.mjs",
+  "packages/bus/tests/lifecycle-revoke.test.mjs",
+  "packages/bus/tests/message-filter.test.mjs",
+  "packages/bus/tests/name-migration.test.mjs",
+  "packages/bus/tests/schema.test.mjs",
+  "packages/bus/tests/sessions.test.mjs",
+  "packages/bus/tests/spec-migration.test.mjs",
+  "packages/bus/tests/tester-writes.test.mjs",
+  "packages/bus/tests/thread-claims.test.mjs",
+  "packages/bus/tests/thread-migration.test.mjs",
+  "packages/bus/tests/threads.test.mjs",
+  "packages/bus/tests/usage-migration.test.mjs",
+  "packages/cli/tests/lifecycle.test.mjs",
+  "packages/cli/tests/stack-release.test.mjs",
+  "packages/cli/tests/thread-cli.test.mjs",
+  "packages/cli/tests/thread-launch.test.mjs",
+  "packages/webui/tests/chat.test.mjs"
+]

agents/gander/work/queue-253/whole_files.py

@@ -0,0 +1,53 @@
+#!/usr/bin/env python3
+"""Explicit 27-file scope. Execution requires Sage's focused CLEAR."""
+import argparse
+import hashlib
+import importlib.util
+import json
+import os
+from pathlib import Path
+import subprocess
+import sys
+sys.dont_write_bytecode = True
+HERE=Path(__file__).resolve().parent
+spec=importlib.util.spec_from_file_location('row253_driver',HERE/'driver.py')
+driver=importlib.util.module_from_spec(spec)
+spec.loader.exec_module(driver)
+
+def main():
+    ap=argparse.ArgumentParser()
+    ap.add_argument('--grant',required=True)
+    ap.add_argument('--out',type=Path,required=True)
+    args=ap.parse_args()
+    if not os.environ.get('TMPDIR','').startswith('/mnt/storage/scratch/tmp/g'):
+        raise RuntimeError('use the granted scratch TMPDIR')
+    expected=json.loads((HERE/'CANDIDATE-SHAS.json').read_text())
+    def verify():
+        for name,sha in expected.items():
+            assert hashlib.sha256((driver.REPO/name).read_bytes()).hexdigest()==sha,name
+    verify()
+    files=json.loads((HERE/'integration-aca1/whole-test-union.json').read_text())
+    limits=json.loads((HERE/'integration-aca1/FILE-LIMITS.json').read_text())
+    assert len(files)==27 and set(files)==set(limits)
+    args.out.mkdir(parents=True,exist_ok=True)
+    result=dict(grant=args.grant,head=subprocess.check_output(['git','rev-parse','HEAD'],cwd=driver.REPO,text=True).strip(),manifest=hashlib.sha256((HERE/'MANIFEST.sha256').read_bytes()).hexdigest(),steps=[])
+    print(json.dumps({k:result[k] for k in ['grant','head','manifest']}),flush=True)
+    (args.out/'results.json').write_text(json.dumps(result,indent=2)+'\n')
+    for index,name in enumerate(files):
+        limit=limits[name]
+        command=['timeout','-k',str(limit['kill_after_seconds']),str(limit['timeout_seconds']),'node','--test','--test-reporter=tap',name]
+        step=driver.run(command,args.out/(str(index+1).zfill(2)+'.log'),seconds=limit['outer_harness_seconds'])
+        text=Path(step['log']).read_text(errors='replace')
+        counts={}
+        for line in text.splitlines():
+            for key in ['tests','pass','fail','skipped']:
+                prefix='# '+key+' '
+                if line.startswith(prefix) and line[len(prefix):].isdigit():counts[key]=int(line[len(prefix):])
+        step.update(file=name,counts=counts,named_skips=[line for line in text.splitlines() if '# SKIP' in line])
+        result['steps'].append(step)
+        (args.out/'results.json').write_text(json.dumps(result,indent=2)+'\n')
+        verify()
+        if step['timeout']:raise RuntimeError('timeout: stop, report unplaced, do not retry')
+        if step['code']!=0:raise RuntimeError('unexpected failure: stop, report unplaced, do not retry')
+    print(json.dumps(result,indent=2),flush=True)
+if __name__=='__main__':main()