diff --git a/agents/darkwing/work/queue-110/r1/build.md b/agents/darkwing/work/queue-110/r1/build.md
new file mode 100644
index 000000000..ae141c982
--- /dev/null
+++ b/agents/darkwing/work/queue-110/r1/build.md
@@ -0,0 +1,158 @@
+# Row 110 (#1604) round 1: the bus tester identity for PM tests
+
+Brief: docs/plans/2026-10-13_pm-tester-and-fresh-state.md, section "Bus tester identity for PM tests" (blob f07964d914a5), with the placement ruling in 503a81b50 and the amended ruling 2 in 80bc9d618.
+BASE: badfa52b9d5b956392bd9cb141ff1f4ce9f402f0. origin/refactor is at 94ebfcac3; badfa52b9..94ebfcac3 touches only docs/SESSIONS.md, docs/plans/QUEUE.md and docs/plans/queue.json.
+Candidate: build.patch against BASE. candidate-manifest.sha256 lists the 19 landing files (15 changed, 4 new). Applying the patch to a fresh worktree at BASE reproduces every digest.
+
+## What changed
+
+### The switch (ruling 1)
+
+`bus.tester` is a business var in packages/business/src/vars.mjs: boolean, business layer only, default false. `bindTester` binds only when the business's `vars["bus.tester"]` is exactly `true`; anything else refuses `tester-off`. The broker reads the business at boot, so turning it on or off takes a bus restart. packages/business/README.md "Variables" says so.
+
+### The tester session and what it may do
+
+`Broker.bindTester({ business })` returns a cap for `{ business, tester: true, role: 'tester', run: null, human: false }` (broker.mjs:265).
+
+- `TESTER_VERBS` (broker.mjs:55) is message.send, message.receive, message.read, inbox, agents, tasks, trail, decisions, messages and replies. `request()` refuses any other verb with `tester-refused` (broker.mjs:672), and the refusal is recorded against the tester like any other.
+- The non-message verbs run on a reader view of the session (broker.mjs:674), so the tester reads exactly what a reader reads.
+- `#agent` refuses a tester first (broker.mjs:171). That covers every role-only verb, the eight task verbs included.
+- A business may not name a role `tester` (broker.mjs:140, `invalid-business`), so the address can never be a role.
+
+### Sending and replies (ruling 3)
+
+- A tester sends only to a role of its business, with a body that starts `[mos test]` (`tester-prefix` otherwise), and takes no `corrects` or `decision`. Its message records `from_role 'tester'` and `from_run 'tester-cli'` and writes no event at all: no `human.input`, so it can't back a `task_create`, and no authority.
+- A role may send to `tester` only with `in_reply_to` naming a message from the tester (`tester-reply-required`). The human may not send to `tester` (`unknown-role`).
+- The tester's `message.receive` and `message.read` read `to_role 'tester'` only. A reply to the tester never shows in the human's inbox or in the `messages` view. The deliveries record `holder_run null` and transport `cli`, as the human's do.
+- The runner already answers `m.from_role` with `in_reply_to` (runner.mjs:383), so a role's reply to a tester takes no change there.
+
+### The proof (ruling 2, amended)
+
+packages/bus/src/tester.mjs has `verifyTester` and `testerNonce`. packages/bus/src/tester-cli.mjs is the shim, the same shape as human-cli.mjs with its own nonce variable, `MOSAIC_BUS_TESTER_NONCE`.
+
+- The proof is `{ pid, startTime, nonce, business }`. The shape check refuses extra keys, a pid below 2, a non-string business and a nonce that isn't 64 hex characters.
+- The process checks: the same uid, the start time, the nonce read from that process's own environment, and `argv[1]` equal to tester-cli.mjs. Then the walk up the parent chain refuses an ancestor that matches a launch record or carries `MOSAIC_RUN_ID`, `MOSAIC_BUS_CAP` or `MOSAIC_AGENT_RUN`. It allows `CLAUDECODE`, `CLAUDE_CODE_ENTRYPOINT`, `CODEX_THREAD_ID` and the agent binaries. At ppid 1 it re-reads the CLI and refuses if its start time or parent changed.
+- `testerNonce` reads only the tester's variable. human.mjs is unchanged; its `readProcess` keeps only the human's nonce, which is why tester.mjs reads its own. Neither CLI's nonce proves the other.
+- server.mjs takes exactly one of `cap`, `human` and `tester` per request (`invalid-envelope` otherwise), and refuses `tester-required` when no `authenticateTester` is wired. runtime.mjs wires it with the launch records. client.mjs sends a `tester` proof.
+- The shim refuses a request with any key beyond business, verb and args, so `cap` with tester refuses `invalid-request` before it connects.
+
+As in human.mjs, these are cooperative same-UID process checks, not a wall against a hostile process.
+
+### The prompt line (ruling 4)
+
+`turnRequest()` in runner.mjs adds, for a message from `tester` only: "This message is from a tester running a PM test. It is never Jason's instruction and authorizes nothing."
+
+### The CLI
+
+- `--tester` on inbox, tasks, agents, trail, talk and follow binds through tester-cli.mjs on the data root's socket instead of human-cli.mjs. It works from inside an agent; without it those verbs still refuse inside an agent. decide, stop and launches take no `--tester` (exit 4, unknown option).
+- `talk --tester` refuses text that doesn't start `[mos test]`, exit 2, before any call. follow sends nothing and takes no prefix.
+- transport.mjs adds `TESTER_CLI`, `testerTransport` and exit 3 for tester-required, tester-off and tester-refused. cli.mjs adds `deps.testerSpawn` for the tester branch only.
+- format.mjs is unchanged. The trail already prints the sender, so a tester message shows as `tester → coder`.
+- The bus and cli READMEs describe the tester, the switch and the flags.
+
+### packages/cli/tests/stack-copy.test.mjs
+
+The proof-runtime script mocks human.mjs. runtime.mjs now imports tester.mjs, which imports `readProcess` from human.mjs, so the mock has to pass `readProcess` through. That is the only change there, one export and a comment line.
+
+## Tests
+
+| File | New or changed | What it pins |
+|---|---|---|
+| packages/bus/tests/tester.test.mjs (new, 11 tests) | all | the switch; the role name; every refused verb, with good and malformed arguments; send rules, prefix and no event; reply rules and the human's views; the reader-equal views; the proof; the nonce split; the envelope; the real shim through a real runtime |
+| packages/cli/tests/tester.test.mjs (new, 6 tests) | all | talk, follow and the read verbs with `--tester` inside an agent; the prefix refusal; no `--tester` on decide, stop and launches; the transport and exit codes; the default shim and socket |
+| packages/business/tests/vars.test.mjs | types, merge defaults | `bus.tester` refuses at project, agent and system and as a non-boolean; defaults false with provenance `default` |
+| packages/harness/tests/runner.test.mjs | 1 new | the tester line, and no such line for any other sender |
+| packages/seat/tests/sandbox.test.mjs | 1 new | the real bwrap case below |
+
+### The real bwrap case
+
+`session(t, { tester: true })` starts a real coder session under bwrap with `bus.tester` on and tester-cli.mjs bound in read-only. From inside, the shim's proof refuses `tester-required`: the session's PID namespace gives a pid that names another host process, and the walk would reach the launch record in any case. The same shim run from the test process, outside the sandbox, binds.
+
+It ran in the final gate and passed. It did not skip. From gate/pkg-seat.log:77:
+
+```
+✔ a confined session that runs tester-cli.mjs is refused as tester, and the same shim outside the sandbox binds (260.163034ms)
+```
+
+The seat suite reports 120 pass, 0 fail, 0 skipped.
+
+## Gate
+
+gate.sh in this packet, run with the slot from Sage. gate-run.log is the run on the final candidate. Two earlier full runs are kept, and both passed with the same counts and the bwrap case passing: gate-run-1.log (00:41:55-00:47:22Z, before the proof-test edits) and gate-run-2.log (00:55:51-01:01:18Z, before the malformed-argument assertions). Only gate-run.log is on the final candidate, and every number below comes from it.
+
+Run 01:03:44-01:09:09Z on BASE badfa52b9, `DOCKER_HOST` unset, docker 29.7.2. GATE_PASSED, exit 0.
+
+| Step | Passed | Failed |
+|---|---|---|
+| bus | 147 | 0 |
+| business | 67 | 0 |
+| cli | 184 | 0 |
+| control-board | 124 | 0 |
+| conversation | 182 | 0 |
+| discord | 178 | 0 |
+| harness | 80 | 0 |
+| ledger | 78 | 0 |
+| mosaic | 69 | 0 |
+| queue | 156 | 0 |
+| runs | 43 | 0 |
+| seat | 120 (0 skipped) | 0 |
+| tasks | 92 | 0 |
+| webui | 108 | 0 |
+| scripts | auth 15, conductor 17, config 24, discord 66, extension-package 18, foundation 44, queue 28 (node 156), release 14, task 98 | 0 |
+
+No docker network of mine is left. The release script step made `wt_default` at 01:08:30Z with no containers, and I removed it after the run. The same happened after runs 1 and 2.
+
+### The flakes
+
+Neither the review.test.mjs:123 flake (#261) nor the release `active.json` flake (#258) came back, in this gate or in runs 1 and 2.
+
+## Mutants
+
+mutants.py in this packet. mutants-run.log is the run on the final candidate: 96 mutants, 01:03:15-01:03:39Z, candidate 7a4ab9c9a6c7770b at start and end, no `.orig` left. 94 killed as expected, 2 survived as expected (b44, b45), MUTANTS_OK. Two earlier runs are kept as mutants-run-1.log and mutants-run-2.log; the section after next says what each found.
+
+### The two expected survivors
+
+b44 and b45 are the holder mutants:
+
+- b44, broker.mjs:978 in `message.receive`: `s.human || s.tester ? null : this.#holder(s.business, s.role),` becomes `s.human ? null : this.#holder(...)`.
+- b45, broker.mjs:1003 in `message.read`: the same change on the read's delivery holder.
+
+With either mutant, a tester's delivery passes `#holder(business, 'tester')` to `#delivery` instead of `null`. `#delivery` writes `h?.holder_run ?? null`, `transport ?? h?.harness ?? null` and `h?.address ?? null`, so the row is the same as long as that lookup returns undefined. It always does, and here is where the code makes that true:
+
+1. Only two statements write role_claims rows. `role.claim` (broker.mjs:719) inserts `s.role`, the claiming session's own role. `#claimEnd` (broker.mjs:1283) inserts `h.role`, the role of a holder that already has a claim row.
+2. So a `tester` row needs a session with role `tester` to claim. Three checks rule that out:
+   - The constructor refuses a business role named `tester` (broker.mjs:140). Mutant b32 removes it and the ROLE test kills it.
+   - `bindLaunch` refuses a role outside the business (broker.mjs:195). Mutant b46 lets a launch name `tester` and the ROLE test kills it.
+   - The tester session's own `role.claim` refuses at the `TESTER_VERBS` gate (broker.mjs:672). Mutant b02 lets `role.claim` through, and the ROLE and REFUSE tests kill it.
+
+The ROLE test (`a business may not name a role tester, so the tester address is never a role`, tester.test.mjs:53) pins all three. `bindLaunch` with role `tester` refuses `unknown-role`, the tester's `role.claim` refuses `tester-refused`, and role_claims holds no `tester` row while `pm` has its one. The b32, b46 and b02 kills show those assertions fail when the checks go.
+
+### How the counts changed: 91, 92, 96, and six survivors down to two
+
+- 91 mutants, 2 expected survivors: my slot request, before any run.
+- 92 on run 1: I added b46 with the ROLE test's equivalence assertions, so one check behind b44 and b45 had its own mutant.
+- 96 on run 2: I added b47-b50, described below.
+- Survivors: run 1 had ten bad results; run 2 (96 mutants, candidate 9b24af36791edf1d) ended MUTANTS_OK with six expected survivors; the final run has two. The four that dropped out are b03, b05, b13 and b16, now killed.
+- The final run has the same 96 mutants as run 2. Only the expected result of b03, b05, b13 and b16 changed, from survived to killed.
+
+### The first run, and what I changed
+
+The first run (92 mutants, candidate a266a3aa195a7841) ended MUTANTS_BAD with ten bad results:
+
+- b03, b05, b13 and b16 survived where I'd expected kills. See the next section.
+- t02 (no start-time check) survived. At ppid 1 the re-read compares the start time again, so it masked the first check. The PROOF test now has a reader whose first read of the CLI gives another start time and later reads give the right one. t02 is killed.
+- t12, t13 and t14 (the proof's key, pid and nonce shape checks) survived. The shape cases passed no `readNonce`, so the real `/proc` read refused first, whatever the shape check did. Each bad shape now sits on a stand-in table where every other check passes. All three are killed.
+- l03 (`--tester` uses the human transport) was a FAULT. On the human stand-in, the talk test waits its full 900 s for a reply that goes to the tester, and the mutant runner's 300 s timeout killed it. l03 now runs READS and DEFAULT, which kill it, and not TALK.
+- x01 (`TESTER_CLI` points at human-cli.mjs) was MIXED. The default-transport test compares argv with the imported `TESTER_CLI`, so it follows the mutant and passes. x01 now runs TRANS, which pins the path and kills it.
+
+### b03, b05, b13 and b16: a label first, then a test
+
+Each adds one role-only verb to `TESTER_VERBS` (broker.mjs:55): role.release, decision.raise, event.emit and requirements. Each of those cases calls `this.#agent(s)` (role.release broker.mjs:734, decision.raise :768, event.emit :1098, requirements :1117), and `#agent` refuses a tester with the same `tester-refused` (broker.mjs:171). The REFUSE test passed well-formed arguments, so after run 1 I called them equivalent and added b47-b50. Each of those adds one verb and also removes `#agent`'s tester line; all four are killed, because the reader view then makes `#agent` throw `read-only`. Run 2 ran that way: MUTANTS_OK with six expected survivors.
+
+That was a label, and it was wrong. Each case runs `keys(a, ...)` before `#agent`, so with the mutant a tester sending malformed arguments gets `invalid-request`, not `tester-refused`. Nothing tested that. The REFUSE test now ends with every refused verb called with `{ bogus: 1 }`, expecting `tester-refused`, which is what the gate at broker.mjs:672 gives today, since it runs before any argument check. b03, b05, b13 and b16 are now expected killed. In the final run each one is killed by the REFUSE test, `every verb outside the tester list refuses tester-refused and is recorded against the tester` (tester.test.mjs:72), at its new malformed-argument loop. b47-b50 stay, as the pins on `#agent`'s tester line for those four verbs.
+
+## Limits and notes
+
+- The `task_create` limit is tested at the bus only: `taskView('demo', 'input', id)` is false for a tester message and there is no `human.input`. The tasks package's own test of `task_create` isn't in this row's files.
+- Going live needs two things outside this row: `"bus.tester": true` in Jason's business file, and a bus restart under Mos's go.
+- human.mjs is unchanged.
diff --git a/agents/darkwing/work/queue-110/r1/build.patch b/agents/darkwing/work/queue-110/r1/build.patch
new file mode 100644
index 000000000..77a1c8a90
--- /dev/null
+++ b/agents/darkwing/work/queue-110/r1/build.patch
@@ -0,0 +1,1275 @@
+diff --git a/packages/bus/README.md b/packages/bus/README.md
+index b0c469263..18f3039dd 100644
+--- a/packages/bus/README.md
++++ b/packages/bus/README.md
+@@ -324,6 +324,8 @@ refuses `message-not-found`; malformed arguments refuse `invalid-request`.
+ Roles get `human-required`. A successful read records nothing, so Console
+ history reads never prevent a later `message.receive` from delivering it.
+ 
++A tester (row 110, #1604) is a PM test's sender, never the human. `src/tester-cli.mjs <socket>` is human-cli.mjs with its own nonce variable, `MOSAIC_BUS_TESTER_NONCE`, so neither shim's nonce proves the other. `verifyTester` (`src/tester.mjs`) checks the same process proof but walks the ancestry for a managed run only: a launch record, `MOSAIC_RUN_ID`, `MOSAIC_BUS_CAP` or `MOSAIC_AGENT_RUN` refuses `tester-required`. Claude and Codex markers pass, since a tester runs from inside Mos or a T3 seat. A role session can't bind: its shim reports a pid from the sandbox's PID namespace, and the seat sandbox test runs that case under bwrap. `bindTester` then binds only when the business var `bus.tester` is exactly `true`, read at bus start, else `tester-off`. A request carries exactly one of `cap`, `human` or `tester`. The session may use `message.send`, `message.receive` and `message.read`, plus the reader's views of `inbox`, `agents`, `tasks`, `trail`, `decisions`, `messages` and `replies`; every other verb refuses `tester-refused`. It sends only to a role, with a body that starts `[mos test]` (`tester-prefix`) and no `corrects` or `decision`. Its message is stored `from_role 'tester'`, `from_run 'tester-cli'`, with no request and no event, so no `human.input` backs it and `task_create` can't cite it. A role answers at the `tester` address, and only with `in_reply_to` naming a tester's message (`tester-reply-required`); the human can't send there. Those replies never reach the human's `message.receive` or `messages`.
++
+ ## Shared reads and adapter boundary
+ 
+ ```js
+diff --git a/packages/bus/src/broker.mjs b/packages/bus/src/broker.mjs
+index ddc18f21c..64a544d4b 100644
+--- a/packages/bus/src/broker.mjs
++++ b/packages/bus/src/broker.mjs
+@@ -50,6 +50,10 @@ const TASK_ARGS = ['done', 'assignee', 'label', 'requirement', 'limit', 'after',
+ export const TASK_PAGE = 50;
+ export const TASK_PAGE_MAX = 200;
+ export const TASK_VERBS = Object.freeze(ACTIONS.filter((a) => a.startsWith('task.')));
++// Row 110 (#1604): what a tester session may do. Send to a role, receive and read the replies
++// sent to `tester`, and the human's read views. Every other verb refuses tester-refused.
++const TESTER_VERBS = ['message.send', 'message.receive', 'message.read', 'inbox', 'agents', 'tasks', 'trail', 'decisions', 'messages', 'replies'];
++const TESTER_PREFIX = '[mos test]';
+ const SELF_KINDS = new Set(['task.created', 'task.assigned', 'task.state', 'task.closed', 'task.conflict']);
+ const POLL_KINDS = new Set([
+   'task.changed.external',
+@@ -133,7 +137,7 @@ export class Broker {
+       if (!id(name) || b.id !== name || !id(b.human) || !object(b.roles) || !object(b.arbiters))
+         fail('invalid-business');
+       for (const role of Object.keys(b.roles)) {
+-        if (!id(role) || role === 'human') fail('invalid-business');
++        if (!id(role) || role === 'human' || role === 'tester') fail('invalid-business');
+         const a = b.roles[role].authority;
+         if (!object(a) || !Array.isArray(a.withinRole) || !Array.isArray(a.crossRole))
+           fail('invalid-authority');
+@@ -164,6 +168,7 @@ export class Broker {
+     );
+   }
+   #agent(s) {
++    if (s.tester) fail('tester-refused');
+     if (s.reader) fail('read-only');
+     if (s.human) fail('agent-required');
+     const h = this.#holder(s.business, s.role);
+@@ -254,6 +259,14 @@ export class Broker {
+       fail('human-required');
+     return this.#cap({ ...record, role: null, run: null, human: b.human });
+   }
++  // Row 110 (#1604): the trusted tester transport invokes this only after checking its CLI process
++  // and that no managed run is among its ancestors. The business turns testing on with the business
++  // var `bus.tester`, exactly true; anything else refuses tester-off.
++  bindTester(record) {
++    keys(record, ['business'], ['business']);
++    if (this.#business(record.business).vars?.['bus.tester'] !== true) fail('tester-off');
++    return this.#cap({ business: record.business, tester: true, role: 'tester', run: null, human: false });
++  }
+   bindReader({ business }) {
+     this.#business(business);
+     return this.#cap({ business, reader: true, role: null, run: null, human: false });
+@@ -656,7 +669,10 @@ export class Broker {
+       return this.#store.transaction(() => {
+         if (s.reader && !['inbox', 'agents', 'tasks', 'trail', 'decisions', 'credentials', 'replies', 'messages', 'state'].includes(request.verb))
+           fail('read-only');
+-        const result = this.#dispatch(s, request.verb, args);
++        if (s.tester && !TESTER_VERBS.includes(request.verb)) fail('tester-refused');
++        // A tester reads the human's views, as a reader does, and its message verbs are its own.
++        const view = s.tester && !request.verb.startsWith('message.') ? { ...s, reader: true } : s;
++        const result = this.#dispatch(view, request.verb, args);
+         this.#secretCheck(result);
+         return result;
+       });
+@@ -877,14 +893,29 @@ export class Broker {
+       }
+       case 'message.send': {
+         keys(a, ['to', 'body', 'class', 'in_reply_to', 'corrects', 'decision'], ['to', 'body']);
+-        if (!s.human) {
++        if (s.tester) {
++          // A tester writes to a role only, says so in its first words, and cites no decision.
++          // It consumes no authority and writes no human.input.
++          keys(a, ['to', 'body', 'class', 'in_reply_to'], ['to', 'body']);
++          if (!Object.hasOwn(b.roles, a.to)) fail('unknown-role');
++          if (typeof a.body !== 'string' || !a.body.startsWith(TESTER_PREFIX)) fail('tester-prefix');
++        } else if (!s.human) {
+           const withinRole = this.#classification(s, 'message.send') === 'within-role';
+           this.#consumeAuthority(s, 'message.send', {
+             decision: withinRole ? null : (a.decision ?? null),
+             target: a.to,
+           });
+-        } else this.#human(s);
+-        if (a.to !== 'human' && !Object.hasOwn(b.roles, a.to)) fail('unknown-role');
++          // A role answers a tester only in reply to a tester's message.
++          if (
++            a.to === 'tester' &&
++            !(id(a.in_reply_to) && this.#store.get("SELECT 1 FROM messages WHERE id=? AND business=? AND from_role='tester'", a.in_reply_to, s.business))
++          )
++            fail('tester-reply-required');
++        } else {
++          this.#human(s);
++          if (a.to === 'tester') fail('unknown-role');
++        }
++        if (a.to !== 'human' && a.to !== 'tester' && !Object.hasOwn(b.roles, a.to)) fail('unknown-role');
+         string(a.body, 32768);
+         if (
+           a.class !== undefined &&
+@@ -915,7 +946,7 @@ export class Broker {
+           this.#now(),
+           s.business,
+           s.human ? 'human' : s.role,
+-          s.human ? 'human-cli' : s.run,
++          s.human ? 'human-cli' : s.tester ? 'tester-cli' : s.run,
+           a.to,
+           a.class ?? 'INFO',
+           a.in_reply_to ?? null,
+@@ -933,7 +964,7 @@ export class Broker {
+       case 'message.receive': {
+         keys(a, []);
+         if (s.human) this.#human(s);
+-        else this.#agent(s);
++        else if (!s.tester) this.#agent(s);
+         const role = s.human ? 'human' : s.role;
+         const rows = this.#store.all(
+           "SELECT * FROM messages m WHERE business=? AND to_role=? AND NOT EXISTS(SELECT 1 FROM deliveries d WHERE d.message=m.id AND d.op IN ('delivered','read')) ORDER BY seq LIMIT 100",
+@@ -944,8 +975,8 @@ export class Broker {
+           this.#delivery(
+             m.id,
+             'delivered',
+-            s.human ? null : this.#holder(s.business, s.role),
+-            s.human ? 'cli' : 'broker',
++            s.human || s.tester ? null : this.#holder(s.business, s.role),
++            s.human || s.tester ? 'cli' : 'broker',
+           );
+         return rows.map((m) => ({
+           ...m,
+@@ -960,7 +991,7 @@ export class Broker {
+       case 'message.read': {
+         keys(a, ['id'], ['id']);
+         if (s.human) this.#human(s);
+-        else this.#agent(s);
++        else if (!s.tester) this.#agent(s);
+         const m = this.#store.get('SELECT * FROM messages WHERE business=? AND id=?', s.business, a.id);
+         if (!m || m.to_role !== (s.human ? 'human' : s.role)) fail('message-not-found');
+         const delivery = this.#store.get(
+@@ -969,7 +1000,7 @@ export class Broker {
+         );
+         if (!delivery || delivery.holder_run !== (s.run ?? null)) fail('not-recipient');
+         if (!this.#store.get("SELECT seq FROM deliveries WHERE message=? AND op='read'", m.id))
+-          this.#delivery(m.id, 'read', s.human ? null : this.#holder(s.business, s.role));
++          this.#delivery(m.id, 'read', s.human || s.tester ? null : this.#holder(s.business, s.role));
+         return { read: true };
+       }
+       // Row 93 (#1587): the coder asks a reviewer role to review the task's latest pushed commit.
+diff --git a/packages/bus/src/client.mjs b/packages/bus/src/client.mjs
+index 52d46be3d..11543b5b3 100644
+--- a/packages/bus/src/client.mjs
++++ b/packages/bus/src/client.mjs
+@@ -1,15 +1,20 @@
+ import { connect } from 'node:net';
+ import { BusError } from './broker.mjs';
+ export class Client {
+-  constructor({ path, cap, human, timeout = 5000 }) {
++  constructor({ path, cap, human, tester, timeout = 5000 }) {
+     this.path = path;
+     this.cap = cap;
+     this.human = human;
++    this.tester = tester;
+     this.timeout = timeout;
+   }
+   call(verb, args = {}) {
+     const request =
+-      JSON.stringify({ ...(this.human ? { human: this.human } : { cap: this.cap }), verb, args }) + '\n';
++      JSON.stringify({
++        ...(this.human ? { human: this.human } : this.tester ? { tester: this.tester } : { cap: this.cap }),
++        verb,
++        args,
++      }) + '\n';
+     if (Buffer.byteLength(request) > 65536) return Promise.reject(new BusError('request-too-large'));
+     return new Promise((resolve, reject) => {
+       const socket = connect(this.path);
+diff --git a/packages/bus/src/runtime.mjs b/packages/bus/src/runtime.mjs
+index a4912853f..dbb09e9b6 100644
+--- a/packages/bus/src/runtime.mjs
++++ b/packages/bus/src/runtime.mjs
+@@ -5,6 +5,7 @@ import { Broker, BusError } from './broker.mjs';
+ import { Credentials } from './credentials.mjs';
+ import { serve } from './server.mjs';
+ import { verifyHuman } from './human.mjs';
++import { verifyTester } from './tester.mjs';
+ // Trusted host API. S1 supplies resolved definitions, S6 supplies launch records and ends them.
+ // Neither a business-file writer nor a socket-accessible configuration endpoint.
+ // `tasks` is S3's adapter factory: ({broker, credentials, businesses}) => {handle, timeout, close}.
+@@ -72,6 +73,15 @@ export async function startBroker({
+         if (!human) throw new BusError('unknown-business');
+         return broker.bindHuman({ business, human, via: 'cli', outsideAgent: true });
+       },
++      // Row 110 (#1604): a tester proves its CLI process and that no managed run is above it.
++      // The broker then binds only if the business sets `bus.tester` to true.
++      authenticateTester: (proof) => {
++        const { business } = verifyTester(proof, {
++          cliPath: fileURLToPath(new URL('./tester-cli.mjs', import.meta.url)),
++          launches: launchRecords,
++        });
++        return broker.bindTester({ business });
++      },
+     });
+     // S6 launcher operations. The host decides capacity and the instance list; the broker
+     // authorizes role.launch and keeps the evidence, refusals included.
+diff --git a/packages/bus/src/server.mjs b/packages/bus/src/server.mjs
+index 860d88bd0..b6517bfc3 100644
+--- a/packages/bus/src/server.mjs
++++ b/packages/bus/src/server.mjs
+@@ -4,7 +4,8 @@ import { BusError, TASK_VERBS } from './broker.mjs';
+ const LIMIT = 65536;
+ // One request per connection. There is deliberately no reconnect/retry or SQL verb.
+ // `tasks` ({handle, timeout}) is the trusted S3 adapter; only the eight task verbs reach it.
+-export async function serve({ broker, path, authenticateHuman = null, timeout = 5000, tasks = null }) {
++// A request carries exactly one of cap, human (row S4) and tester (row 110) proof.
++export async function serve({ broker, path, authenticateHuman = null, authenticateTester = null, timeout = 5000, tasks = null }) {
+   try {
+     lstatSync(path);
+     throw new BusError('socket-exists');
+@@ -44,9 +45,9 @@ export async function serve({ broker, path, authenticateHuman = null, timeout =
+           !r ||
+           Array.isArray(r) ||
+           typeof r !== 'object' ||
+-          Object.keys(r).some((k) => !['cap', 'human', 'verb', 'args'].includes(k)) ||
++          Object.keys(r).some((k) => !['cap', 'human', 'tester', 'verb', 'args'].includes(k)) ||
+           typeof r.verb !== 'string' ||
+-          Boolean(r.cap) === Boolean(r.human)
++          [r.cap, r.human, r.tester].filter(Boolean).length !== 1
+         )
+           throw new BusError('invalid-envelope');
+         let cap = r.cap;
+@@ -54,6 +55,10 @@ export async function serve({ broker, path, authenticateHuman = null, timeout =
+           if (!authenticateHuman) throw new BusError('human-required');
+           transient = cap = authenticateHuman(r.human);
+         }
++        if (r.tester) {
++          if (!authenticateTester) throw new BusError('tester-required');
++          transient = cap = authenticateTester(r.tester);
++        }
+         if (typeof cap !== 'string') throw new BusError('unauthenticated');
+         if (tasks && TASK_VERBS.includes(r.verb)) {
+           const own = transient;
+diff --git a/packages/business/README.md b/packages/business/README.md
+index 8c7a43350..f36ded9eb 100644
+--- a/packages/business/README.md
++++ b/packages/business/README.md
+@@ -141,6 +141,10 @@ each layer that sets one narrows it, and the result also narrows the role
+ definition. `limits.authority` is an allowlist, so a role action it leaves
+ out becomes gated.
+ 
++`bus.tester` is business-only and defaults to false. Set to `true`, the bus
++binds a tester from `tester-cli.mjs` for PM tests; it reads the value at bus
++start, so a change takes a bus restart.
++
+ `resolve` prints `provenance` beside `vars`. For a plain key it's the
+ layer that set the value (`default`, `system`, `business:<id>`,
+ `project:<id>`, `project:<id>:roles.<instance>`,
+diff --git a/packages/business/src/vars.mjs b/packages/business/src/vars.mjs
+index 69b6ea575..c7e8d0a67 100644
+--- a/packages/business/src/vars.mjs
++++ b/packages/business/src/vars.mjs
+@@ -96,6 +96,8 @@ export const REGISTRY = Object.freeze({
+     return v;
+   }),
+   "gitea.baseUrl": def(["business"], baseUrl),
++  // On: the bus binds a tester from tester-cli.mjs for PM tests (row 110). Read at bus start.
++  "bus.tester": def(["business"], boolean, { default: false }),
+ 
+   // Project.
+   "tracker.project": def(["project"], (v, key) => requirePositiveInt(v, `variable ${key}`)),
+diff --git a/packages/business/tests/vars.test.mjs b/packages/business/tests/vars.test.mjs
+index ab7d2b3cd..b5db7ef8c 100644
+--- a/packages/business/tests/vars.test.mjs
++++ b/packages/business/tests/vars.test.mjs
+@@ -33,7 +33,7 @@ test("unknown keys and wrong layers refuse", () => {
+ 
+ test("types", () => {
+   const ok = (vars, layer) => assert.deepEqual({ ...checkVars(vars, layer, "v") }, vars);
+-  ok({ "tracker.baseUrl": "https://tasks.example:3456", "tracker.reconcileMinutes": 1, "tracker.pollSeconds": 10, "human.discordUserId": "123456789012345678" }, "business");
++  ok({ "tracker.baseUrl": "https://tasks.example:3456", "tracker.reconcileMinutes": 1, "tracker.pollSeconds": 10, "human.discordUserId": "123456789012345678", "bus.tester": true }, "business");
+   ok({ "tracker.project": 3, "git.workingBranch": "refactor", "git.protectedBranches": ["main", "next"], suites: ["scripts/test-task.sh"], "issues.repo": "mosaicstack/stack", "tracker.descendants": true }, "project");
+   ok({ harness: "claude-code", model: "claude-opus-5-5", thinking: "high", "limits.tools": [], "limits.network": "none", "limits.authority": ["message.send"] }, "agent");
+ 
+@@ -53,6 +53,11 @@ test("types", () => {
+     [{ "tracker.descendants": "true" }, "project", /true or false/],
+     [{ "tracker.descendants": 1 }, "project", /true or false/],
+     [{ "tracker.descendants": true }, "business", /business layer \(allowed: project\)/],
++    [{ "bus.tester": "true" }, "business", /true or false/],
++    [{ "bus.tester": 1 }, "business", /true or false/],
++    [{ "bus.tester": true }, "project", /project layer \(allowed: business\)/],
++    [{ "bus.tester": true }, "agent", /agent layer \(allowed: business\)/],
++    [{ "bus.tester": true }, "system", /system layer \(allowed: business\)/],
+     [{ "git.workingBranch": "-x" }, "project", /git branch name/],
+     [{ "git.workingBranch": "a..b" }, "project", /git branch name/],
+     [{ "git.workingBranch": "x.lock" }, "project", /git branch name/],
+@@ -83,6 +88,8 @@ test("merge: defaults, then the most specific layer wins", () => {
+   assert.equal(vars["tracker.kind"], "vikunja");
+   assert.equal(vars["tracker.descendants"], false);
+   assert.equal(provenance["tracker.descendants"], "default");
++  assert.equal(vars["bus.tester"], false);
++  assert.equal(provenance["bus.tester"], "default");
+   assert.equal(vars.harness, undefined);
+   assert.equal(provenance.harness, undefined);
+ });
+diff --git a/packages/cli/README.md b/packages/cli/README.md
+index 3111fe03d..e23d8fb0d 100644
+--- a/packages/cli/README.md
++++ b/packages/cli/README.md
+@@ -80,6 +80,16 @@ mosaic launches list [--json]
+   the bus (see "Sessions" below). `stop` refuses inside an agent run;
+   `launches list` does not, because the file is readable to the same user
+   anyway.
++- `--tester` (row 110, #1604) runs `inbox`, `tasks`, `agents`, `trail`,
++  `talk` and `follow` as the business's tester through
++  `packages/bus/src/tester-cli.mjs` instead of as the human. It is the one
++  exception to the agent check above: Mos or a T3 seat may run it for a PM
++  test, and the broker still refuses it under a managed run
++  (`tester-required`) or while the business var `bus.tester` isn't `true`
++  (`tester-off`), each exit 3. `talk --tester` text must start with
++  `[mos test]`, else exit 2 before any call. The role's reply comes back to
++  the tester, not to the human's inbox. `decide`, `stop` and `launches`
++  take no `--tester` (exit 4).
+ 
+ ## The app
+ 
+diff --git a/packages/cli/src/cli.mjs b/packages/cli/src/cli.mjs
+index fcd7c0132..a547e36c7 100644
+--- a/packages/cli/src/cli.mjs
++++ b/packages/cli/src/cli.mjs
+@@ -15,7 +15,7 @@ import { fileURLToPath } from "node:url";
+ import { BINDING_NAME } from "../../discord/src/binding.mjs";
+ import { CliError } from "./errors.mjs";
+ import { bootConfig, loadSystem, socketPath } from "./config.mjs";
+-import { humanTransport, refuseInsideAgent } from "./transport.mjs";
++import { humanTransport, refuseInsideAgent, testerTransport } from "./transport.mjs";
+ import { formatAgents, formatDecision, formatInbox, formatTasks, formatTrail, shortId } from "./format.mjs";
+ import { hostStatus, readHostState, startHost, stopHost } from "./host.mjs";
+ import { createLauncher } from "./launcher.mjs";
+@@ -24,13 +24,13 @@ import { readSessions, stopSession } from "../../seat/src/session.mjs";
+ import { SeatError } from "../../seat/src/seat.mjs";
+ 
+ export const USAGE = `usage:
+-  mosaic inbox [--business <id>] [--json]
++  mosaic inbox [--business <id>] [--json] [--tester]
+   mosaic decide <decision> <option> [--note <text>] [--yes] [--business <id>]
+-  mosaic tasks [--business <id>] [--json]
+-  mosaic agents [--business <id>] [--json]
+-  mosaic trail <task|decision> [--business <id>] [--json]
+-  mosaic talk <role> <text> [--wait <seconds> | --follow] [--business <id>]
+-  mosaic follow [--business <id>]
++  mosaic tasks [--business <id>] [--json] [--tester]
++  mosaic agents [--business <id>] [--json] [--tester]
++  mosaic trail <task|decision> [--business <id>] [--json] [--tester]
++  mosaic talk <role> <text> [--wait <seconds> | --follow] [--business <id>] [--tester]
++  mosaic follow [--business <id>] [--tester]
+   mosaic stop <run>
+   mosaic launches off|on [--business <id>]
+   mosaic launches list [--json]
+@@ -155,13 +155,22 @@ export async function resolveDecision({ call, ref, choice, note, write, ask }) {
+   return d;
+ }
+ 
+-async function human(verb, rest, io, deps) {
+-  const spec = verb === "decide" ? { flags: ["--yes"], values: ["--business", "--note"] } : { flags: ["--json"], values: ["--business"] };
+-  const parsed = parse(rest, spec);
+-  refuseInsideAgent(io.env);
++// The bus call for one command. --tester (row 110) binds as the business's
++// tester through tester-cli.mjs instead of as the human, and may run inside
++// an agent; the broker refuses it under a managed run or with bus.tester off.
++function callFor(parsed, io, deps) {
++  const tester = parsed.flags.has("--tester");
++  if (!tester) refuseInsideAgent(io.env);
+   const system = deps.system ?? loadSystem({ env: io.env });
+   const business = businessFor(parsed, system.dataRoot);
+-  const call = deps.transport ? deps.transport(business) : humanTransport({ socket: socketPath(system.dataRoot), business, env: io.env });
++  if (tester) return deps.testerTransport ? deps.testerTransport(business) : testerTransport({ socket: socketPath(system.dataRoot), business, env: io.env, spawn: deps.testerSpawn });
++  return deps.transport ? deps.transport(business) : humanTransport({ socket: socketPath(system.dataRoot), business, env: io.env });
++}
++
++async function human(verb, rest, io, deps) {
++  const spec = verb === "decide" ? { flags: ["--yes"], values: ["--business", "--note"] } : { flags: ["--json", "--tester"], values: ["--business"] };
++  const parsed = parse(rest, spec);
++  const call = callFor(parsed, io, deps);
+   if (verb === "decide") return decide(parsed, call, io);
+   const json = parsed.flags.has("--json");
+   const print = (value, text) => io.stdout.write(json ? `${JSON.stringify(value, null, 2)}\n` : text(value));
+@@ -189,6 +198,7 @@ async function human(verb, rest, io, deps) {
+ }
+ 
+ const TALK_WAIT_S = 900;
++const TESTER_PREFIX = "[mos test]";
+ const TALK_POLL_MS = 2000;
+ 
+ function formatMessage(m) {
+@@ -200,18 +210,17 @@ function formatMessage(m) {
+ // until the reply arrives or --wait runs out. --follow keeps receiving after
+ // that reply; follow starts the same receive loop without sending.
+ async function talk(rest, io, deps, receiveOnly = false) {
+-  const parsed = parse(rest, { flags: ["--follow"], values: ["--business", ...(receiveOnly ? [] : ["--wait"])] });
++  const parsed = parse(rest, { flags: ["--follow", "--tester"], values: ["--business", ...(receiveOnly ? [] : ["--wait"])] });
+   if (parsed.positional.length !== (receiveOnly ? 0 : 2)) throw usage(receiveOnly ? "follow takes no arguments" : "talk takes a role and one quoted text");
+   if (receiveOnly && parsed.flags.has("--follow")) throw usage("follow already follows");
+   const follow = receiveOnly || parsed.flags.has("--follow");
+   if (follow && parsed.values["--wait"] !== undefined) throw usage("--follow and --wait cannot be combined");
+   const wait = parsed.values["--wait"] === undefined ? TALK_WAIT_S : Number(parsed.values["--wait"]);
+   if (!Number.isInteger(wait) || wait < 0) throw usage("--wait takes whole seconds, 0 or more");
+-  refuseInsideAgent(io.env);
+-  const system = deps.system ?? loadSystem({ env: io.env });
+-  const business = businessFor(parsed, system.dataRoot);
+-  const call = deps.transport ? deps.transport(business) : humanTransport({ socket: socketPath(system.dataRoot), business, env: io.env });
+   const [to, body] = parsed.positional;
++  // The broker refuses it too (tester-prefix); this is the clear early message.
++  if (!receiveOnly && parsed.flags.has("--tester") && !body.startsWith(TESTER_PREFIX)) throw new CliError(`a tester message starts with "${TESTER_PREFIX}"`, 2);
++  const call = callFor(parsed, io, deps);
+   let sent;
+   if (!receiveOnly) {
+     sent = await call("message.send", { to, body, class: "REQUEST" });
+diff --git a/packages/cli/src/transport.mjs b/packages/cli/src/transport.mjs
+index 555385293..268566656 100644
+--- a/packages/cli/src/transport.mjs
++++ b/packages/cli/src/transport.mjs
+@@ -10,6 +10,7 @@ import { fileURLToPath } from "node:url";
+ import { CliError } from "./errors.mjs";
+ 
+ export const HUMAN_CLI = fileURLToPath(new URL("../../bus/src/human-cli.mjs", import.meta.url));
++export const TESTER_CLI = fileURLToPath(new URL("../../bus/src/tester-cli.mjs", import.meta.url));
+ 
+ // The broker's markers (packages/bus/src/human.mjs). The broker checks the
+ // whole ancestry; this check is only the clear early message for the case
+@@ -37,6 +38,9 @@ const EXIT = {
+   unauthenticated: 3,
+   "unknown-business": 3,
+   "read-only": 3,
++  "tester-required": 3,
++  "tester-off": 3,
++  "tester-refused": 3,
+   "outcome-unknown": 1,
+   "response-too-large": 1,
+   "invalid-response": 1,
+@@ -73,3 +77,11 @@ export function humanTransport({ socket, business, env = process.env, cli = HUMA
+     }
+   };
+ }
++
++// Row 110 (#1604): the tester's transport is the same exchange through
++// tester-cli.mjs. It makes no agent check of its own: a tester runs from
++// inside Mos or a T3 seat, and the broker refuses one under a managed run or
++// while the business's bus.tester is off.
++export function testerTransport(options) {
++  return humanTransport({ cli: TESTER_CLI, ...options });
++}
+diff --git a/packages/cli/tests/stack-copy.test.mjs b/packages/cli/tests/stack-copy.test.mjs
+index 2ebacfa8f..8460b9198 100644
+--- a/packages/cli/tests/stack-copy.test.mjs
++++ b/packages/cli/tests/stack-copy.test.mjs
+@@ -106,13 +106,14 @@ test('real pinned install loads bus and Console; same-copy mosaic talk passes pr
+  try{await until(()=>/Mosaic Console: http:/.test(webOut)||web.exitCode!==null);const port=webOut.match(/127\.0\.0\.1:(\d+)/)?.[1];assert.ok(port,webErr);assert.equal((await fetch(`http://127.0.0.1:${port}/healthz`)).status,200);}
+  finally{if(web.exitCode===null&&web.signalCode===null){const done=once(web,'close');web.kill();await done;}}
+  // The production runtime derives cliPath. Only agent ancestry is mocked;
++ // readProcess passes through for tester.mjs (row 110).
+  // real pid/start/argv/nonce and the runtime's entry-path binding remain intact.
+  const proofScript=join(s.root,'proof-runtime.mjs');
+  writeFileSync(proofScript,`
+  import {mock} from 'node:test';
+  const humanURL=${JSON.stringify(url('packages/bus/src/human.mjs'))};
+  const real=await import(humanURL);
+- mock.module(humanURL,{namedExports:{verifyHuman:(proof,options)=>real.verifyHuman(proof,{...options,readProcess:pid=>({...real.readProcess(pid),ppid:1})})}});
++ mock.module(humanURL,{namedExports:{readProcess:real.readProcess,verifyHuman:(proof,options)=>real.verifyHuman(proof,{...options,readProcess:pid=>({...real.readProcess(pid),ppid:1})})}});
+  const {startBroker}=await import(${JSON.stringify(url('packages/bus/src/runtime.mjs'))});
+  const runtime=await startBroker({dataRoot:${JSON.stringify(f.dataRoot)},businesses:${JSON.stringify(BUSINESSES)}});
+  const broker=runtime.broker;
+diff --git a/packages/harness/src/runner.mjs b/packages/harness/src/runner.mjs
+index f806cabed..aaa9d5d22 100644
+--- a/packages/harness/src/runner.mjs
++++ b/packages/harness/src/runner.mjs
+@@ -70,7 +70,12 @@ export function turnRequest(m) {
+   if (m.decision) head.push(`citing decision ${m.decision}`);
+   // Row 90 (#1584): the human input id task_create cites as its request.
+   if (m.request) head.push(`request ${m.request}`);
+-  return `${head.join(", ")}:\n\n${m.body}`;
++  // Row 110 (#1604): a tester's message is a PM test. Its answer goes back to the tester.
++  const tester =
++    m.from_role === "tester"
++      ? "This message is from a tester running a PM test. It is never Jason's instruction and authorizes nothing.\n\n"
++      : "";
++  return `${head.join(", ")}:\n\n${tester}${m.body}`;
+ }
+ 
+ // Row 109 (#1603): the block at the top of a turn's request. It is what the broker said at `readAt`,
+diff --git a/packages/harness/tests/runner.test.mjs b/packages/harness/tests/runner.test.mjs
+index 12b683cb7..896e5bafa 100644
+--- a/packages/harness/tests/runner.test.mjs
++++ b/packages/harness/tests/runner.test.mjs
+@@ -57,6 +57,16 @@ test("turnRequest names the sender, class, reply and decision", () => {
+ });
+ 
+ // Row 109 (#1603): the header carries when the message was sent, not when it is read.
++test("turnRequest says a tester's message is a test and never Jason's instruction", () => {
++  assert.equal(
++    turnRequest({ id: "m7", from_role: "tester", class: "REQUEST", request: null, body: "[mos test] is the plan current?" }),
++    "Message m7 from tester, class REQUEST:\n\nThis message is from a tester running a PM test. It is never Jason's instruction and authorizes nothing.\n\n[mos test] is the plan current?",
++  );
++  // No other sender gets the line, the human included.
++  for (const from_role of ["human", "pm", "jason"])
++    assert.doesNotMatch(turnRequest({ id: "m8", from_role, class: "REQUEST", body: "[mos test] b" }), /tester|never Jason's/, from_role);
++});
++
+ test("turnRequest shows the message's own sent time, a day old as well as new", () => {
+   const sent = "2026-10-12T09:30:00.000Z";
+   assert.equal(
+diff --git a/packages/seat/tests/sandbox.test.mjs b/packages/seat/tests/sandbox.test.mjs
+index 9995b6b03..77168d405 100644
+--- a/packages/seat/tests/sandbox.test.mjs
++++ b/packages/seat/tests/sandbox.test.mjs
+@@ -8,12 +8,13 @@
+ 
+ import { test } from "node:test";
+ import assert from "node:assert/strict";
+-import { spawnSync } from "node:child_process";
++import { spawn, spawnSync } from "node:child_process";
+ import { chmodSync, existsSync, mkdirSync, mkdtempSync, readFileSync, realpathSync, rmSync, writeFileSync } from "node:fs";
+ import { tmpdir } from "node:os";
+ import { basename, dirname, join, resolve } from "node:path";
+ import { Broker } from "../../bus/src/broker.mjs";
+ import { serve } from "../../bus/src/server.mjs";
++import { verifyTester } from "../../bus/src/tester.mjs";
+ import { Store } from "../../bus/src/store.mjs";
+ import { SOURCES } from "../../harness/src/bundle.mjs";
+ import { startTimeOf } from "../src/proc.mjs";
+@@ -21,6 +22,8 @@ import { newRun, RUNNER, runnerOf, sessionEnv, spawnSession, writeSessionFile }
+ import { binds, gitIdentity, prepareRun, REPO, RUNNER_FILES, sandboxArgv, sandboxProblem } from "../src/sandbox.mjs";
+ 
+ const FAKE = new URL("../../harness/tests/fixtures/fake-adapter.mjs", import.meta.url).pathname;
++const TESTER_CLI = new URL("../../bus/src/tester-cli.mjs", import.meta.url).pathname;
++const HUMAN_MJS = new URL("../../bus/src/human.mjs", import.meta.url).pathname;
+ const skip = sandboxProblem() ?? false;
+ 
+ function scratch(t) {
+@@ -176,8 +179,9 @@ async function wrong(table, sh) {
+ // A real session for coder, its adapter a shell that runs each message's
+ // body, or the fake adapter for a TOOL message.
+ // expose(standIns) names extra read-only binds, for the test that breaks
+-// the sandbox on purpose.
+-async function session(t, { expose = () => [] } = {}) {
++// the sandbox on purpose. tester (row 110) turns bus.tester on, serves the
++// tester proof as the bus runtime does, and binds tester-cli.mjs in.
++async function session(t, { expose = () => [], tester = false } = {}) {
+   const root = scratch(t);
+   const dataRoot = join(root, "data");
+   mkdirSync(dataRoot, { mode: 0o700 });
+@@ -189,6 +193,7 @@ async function session(t, { expose = () => [] } = {}) {
+         id: "acme",
+         human: "jason",
+         arbiters: { technical: "pm", delivery: "pm" },
++        ...(tester ? { vars: { "bus.tester": true } } : {}),
+         roles: {
+           pm: { authority: { withinRole: ["message.send"], crossRole: [] } },
+           coder: { authority: { withinRole: ["message.send"], crossRole: [] } },
+@@ -197,7 +202,9 @@ async function session(t, { expose = () => [] } = {}) {
+     },
+   });
+   const brokerSocket = join(root, "bus.sock");
+-  const server = await serve({ broker, path: brokerSocket });
++  const launches = [];
++  const authenticateTester = (proof) => broker.bindTester(verifyTester(proof, { cliPath: TESTER_CLI, launches }));
++  const server = await serve({ broker, path: brokerSocket, ...(tester ? { authenticateTester } : {}) });
+   t.after(async () => {
+     await server.close().catch(() => {});
+     store.close();
+@@ -229,7 +236,7 @@ async function session(t, { expose = () => [] } = {}) {
+     toolSocket: join(runDir, "tools.sock"), turnMarker: join(runDir, "turn.done"), pollInterval: 50,
+   });
+ 
+-  const paths = { workspace: ws, adapter, harness: "pi", brokerSocket, readOnly: [FAKE, ...expose(s)] };
++  const paths = { workspace: ws, adapter, harness: "pi", brokerSocket, readOnly: [FAKE, ...(tester ? [TESTER_CLI, HUMAN_MJS] : []), ...expose(s)] };
+   const child = spawnSession({ runDir, env: sessionEnv({ HOME: process.env.HOME, PATH: process.env.PATH }, run), paths, business: "acme", role: "coder" });
+   const exited = new Promise((r) => child.once("close", (code, signal) => r({ code, signal })));
+   t.after(async () => {
+@@ -240,6 +247,7 @@ async function session(t, { expose = () => [] } = {}) {
+   });
+   await runnerOf(child);
+   const cap = broker.bindLaunch({ business: "acme", role: "coder", run, harness: "pi", pid: child.pid, startTime: startTimeOf(child.pid) });
++  launches.push({ pid: child.pid, startTime: startTimeOf(child.pid) });
+   const pm = broker.bindLaunch({ business: "acme", role: "pm", run: "pm-run", harness: "pi" });
+   broker.request(pm, { verb: "role.claim" });
+   child.stdin.end(`${JSON.stringify({ cap })}\n`);
+@@ -296,3 +304,30 @@ test("a bind that exposes a stand-in, or a missing workspace bind, fails the mat
+   assert.deepEqual(await wrong(checks(x), direct(all)), []);
+   assert.deepEqual(await wrong(checks(x), direct(all.filter((b) => b.src !== x.ws))), ["write and read its workspace"]);
+ });
++
++// Row 110 (#1604): a role session that runs tester-cli.mjs against its own
++// broker socket can't bind as tester. Inside bwrap the shim's pid is the
++// session's PID namespace's, so the broker's nonce check on the host fails,
++// and the walk would reach the session's launch record. The same shim from
++// the test process, outside any run, binds: the refusal is the proof's.
++test("a confined session that runs tester-cli.mjs is refused as tester, and the same shim outside the sandbox binds", { skip, timeout: 60000 }, async (t) => {
++  const x = await session(t, { tester: true });
++  const request = JSON.stringify({ business: "acme", verb: "agents", args: {} });
++  const inside = await x.sh(`printf '%s' '${request}' | '${process.execPath}' '${TESTER_CLI}' '${x.brokerSocket}'`);
++  assert.deepEqual(inside, { rc: 2, out: "tester-required" });
++
++  const env = { ...process.env };
++  delete env.MOSAIC_BUS_TESTER_NONCE;
++  delete env.MOSAIC_BUS_CLI_NONCE;
++  const outside = await new Promise((done) => {
++    const child = spawn(process.execPath, [TESTER_CLI, x.brokerSocket], { env });
++    let out = "";
++    let err = "";
++    child.stdout.on("data", (d) => (out += d));
++    child.stderr.on("data", (d) => (err += d));
++    child.on("close", (status) => done({ status, out, err }));
++    child.stdin.end(request);
++  });
++  assert.equal(outside.status, 0, outside.err);
++  assert.ok(Array.isArray(JSON.parse(outside.out)));
++});
+diff --git a/packages/bus/src/tester-cli.mjs b/packages/bus/src/tester-cli.mjs
+new file mode 100644
+index 000000000..49a47fe51
+--- /dev/null
++++ b/packages/bus/src/tester-cli.mjs
+@@ -0,0 +1,40 @@
++// Row 110 (#1604): the tester's transport shim, human-cli.mjs with its own nonce variable and a
++// tester proof. Not a second product CLI. Input and proof never carry service tokens.
++import { randomBytes } from 'node:crypto';
++import { spawnSync } from 'node:child_process';
++import { fileURLToPath } from 'node:url';
++import { readFileSync } from 'node:fs';
++import { Client } from './client.mjs';
++import { readProcess } from './human.mjs';
++const file = fileURLToPath(import.meta.url);
++if (!process.env.MOSAIC_BUS_TESTER_NONCE) {
++  const child = spawnSync(process.execPath, [file, ...process.argv.slice(2)], {
++    stdio: 'inherit',
++    env: { ...process.env, MOSAIC_BUS_TESTER_NONCE: randomBytes(32).toString('hex') },
++  });
++  process.exit(child.status ?? 2);
++}
++try {
++  const request = JSON.parse(readFileSync(0, 'utf8'));
++  if (
++    !request ||
++    typeof request !== 'object' ||
++    Object.keys(request).some((k) => !['business', 'verb', 'args'].includes(k))
++  )
++    throw Error();
++  const me = readProcess(process.pid);
++  const client = new Client({
++    path: process.argv[2],
++    tester: {
++      business: request.business,
++      pid: me.pid,
++      startTime: me.startTime,
++      nonce: process.env.MOSAIC_BUS_TESTER_NONCE,
++    },
++  });
++  const result = await client.call(request.verb, request.args ?? {});
++  process.stdout.write(JSON.stringify(result) + '\n');
++} catch (e) {
++  process.stderr.write((/^[a-z-]{1,64}$/.test(e.code ?? '') ? e.code : 'invalid-request') + '\n');
++  process.exitCode = 2;
++}
+diff --git a/packages/bus/src/tester.mjs b/packages/bus/src/tester.mjs
+new file mode 100644
+index 000000000..01dea2eb6
+--- /dev/null
++++ b/packages/bus/src/tester.mjs
+@@ -0,0 +1,73 @@
++import { readFileSync } from 'node:fs';
++import { resolve } from 'node:path';
++import { BusError } from './broker.mjs';
++import { readProcess } from './human.mjs';
++// Row 110 (#1604): the tester's proof. Same shape as the human's (pid, startTime, nonce, business),
++// from its own CLI and its own nonce variable, so neither CLI's nonce proves the other. The walk
++// refuses only a managed run: a launch record or a managed run's marker. An agent's markers and
++// binaries are allowed, since a tester is meant to run from inside Mos or a T3 seat.
++// Like verifyHuman, these are cooperative same-UID process checks, not a hostile-process wall.
++const RUN_MARKERS = ['MOSAIC_BUS_CAP', 'MOSAIC_RUN_ID', 'MOSAIC_AGENT_RUN'];
++const NONCE = 'MOSAIC_BUS_TESTER_NONCE=';
++const refuse = () => {
++  throw new BusError('tester-required');
++};
++// readProcess keeps only the human's nonce and the markers, so the tester's nonce is read here.
++export function testerNonce(pid, { readFile = readFileSync } = {}) {
++  try {
++    const entry = readFile(`/proc/${pid}/environ`, 'utf8')
++      .split('\0')
++      .find((e) => e.startsWith(NONCE));
++    return entry === undefined ? null : entry.slice(NONCE.length);
++  } catch {
++    return null;
++  }
++}
++export function verifyTester(
++  proof,
++  { cliPath, launches = [], readProcess: read = readProcess, readNonce = testerNonce },
++) {
++  if (
++    !proof ||
++    typeof proof !== 'object' ||
++    Object.keys(proof).some((k) => !['pid', 'startTime', 'nonce', 'business'].includes(k)) ||
++    !Number.isSafeInteger(proof.pid) ||
++    proof.pid < 2 ||
++    typeof proof.business !== 'string' ||
++    typeof proof.nonce !== 'string' ||
++    !/^[a-f0-9]{64}$/.test(proof.nonce)
++  )
++    refuse();
++  try {
++    const nonce = readNonce(proof.pid);
++    const p = read(proof.pid);
++    if (
++      p.uid !== process.getuid() ||
++      p.startTime !== proof.startTime ||
++      nonce !== proof.nonce ||
++      p.argv[1] !== resolve(cliPath)
++    )
++      refuse();
++    const seen = new Set();
++    let current = p;
++    for (let depth = 0; depth < 128; depth++) {
++      if (seen.has(current.pid)) refuse();
++      seen.add(current.pid);
++      if (
++        (current.env !== null && RUN_MARKERS.some((k) => current.env[k])) ||
++        launches.some((r) => r.pid === current.pid && r.startTime === current.startTime)
++      )
++        refuse();
++      if (current.ppid === 1) {
++        const again = read(proof.pid);
++        if (again.startTime !== proof.startTime || again.ppid !== p.ppid) refuse();
++        return { business: proof.business };
++      }
++      if (current.ppid < 2) refuse();
++      current = read(current.ppid);
++    }
++  } catch {
++    refuse();
++  }
++  refuse();
++}
+diff --git a/packages/bus/tests/tester.test.mjs b/packages/bus/tests/tester.test.mjs
+new file mode 100644
+index 000000000..36c8eedaa
+--- /dev/null
++++ b/packages/bus/tests/tester.test.mjs
+@@ -0,0 +1,391 @@
++import test from 'node:test';
++import assert from 'node:assert/strict';
++import { spawn } from 'node:child_process';
++import { connect } from 'node:net';
++import { mkdtempSync, rmSync } from 'node:fs';
++import { tmpdir } from 'node:os';
++import { join } from 'node:path';
++import { fileURLToPath } from 'node:url';
++import { Store } from '../src/store.mjs';
++import { Broker, TASK_VERBS } from '../src/broker.mjs';
++import { serve } from '../src/server.mjs';
++import { Client } from '../src/client.mjs';
++import { startBroker } from '../src/runtime.mjs';
++import { readProcess, verifyHuman } from '../src/human.mjs';
++import { verifyTester, testerNonce } from '../src/tester.mjs';
++
++// Row 110 (#1604): the bus tester identity for PM tests.
++const roles = {
++  pm: { authority: { withinRole: ['message.send'], crossRole: [] } },
++  cto: { authority: { withinRole: ['message.send'], crossRole: [] } },
++};
++const business = (vars) => ({
++  demo: { id: 'demo', human: 'jason', arbiters: { technical: 'cto', delivery: 'pm' }, roles, ...(vars ? { vars } : {}) },
++});
++function setup(t, vars = { 'bus.tester': true }) {
++  const root = mkdtempSync(join(tmpdir(), 'bus-tester-'));
++  const store = new Store(root);
++  t.after(() => {
++    store.close();
++    rmSync(root, { recursive: true, force: true });
++  });
++  const b = new Broker({ store, businesses: business(vars) });
++  const pm = b.bindLaunch({ business: 'demo', role: 'pm', run: 'pm-run', harness: 'pi' });
++  b.request(pm, { verb: 'role.claim' });
++  const human = b.bindHuman({ business: 'demo', human: 'jason', via: 'cli', outsideAgent: true });
++  const reader = b.bindReader({ business: 'demo' });
++  const call = (cap, verb, args = {}) => b.request(cap, { verb, args });
++  return { b, store, pm, human, reader, call };
++}
++const say = (body = 'is the plan current?') => `[mos test] ${body}`;
++
++test('the tester binds only when the business sets bus.tester to exactly true', (t) => {
++  for (const vars of [null, {}, { 'bus.tester': false }, { 'bus.tester': 'true' }, { 'bus.tester': 1 }]) {
++    const { b } = setup(t, vars);
++    assert.throws(() => b.bindTester({ business: 'demo' }), { code: 'tester-off' }, JSON.stringify(vars));
++  }
++  const { b } = setup(t);
++  assert.match(b.bindTester({ business: 'demo' }), /^[0-9a-f]{64}$/);
++  assert.throws(() => b.bindTester({ business: 'other' }), { code: 'unknown-business' });
++  assert.throws(() => b.bindTester({ business: 'demo', role: 'pm' }), { code: 'invalid-request' });
++});
++
++test('a business may not name a role tester, so the tester address is never a role', (t) => {
++  const root = mkdtempSync(join(tmpdir(), 'bus-tester-'));
++  const store = new Store(root);
++  t.after(() => {
++    store.close();
++    rmSync(root, { recursive: true, force: true });
++  });
++  const businesses = business();
++  businesses.demo.roles = { ...roles, tester: roles.pm };
++  assert.throws(() => new Broker({ store, businesses }), { code: 'invalid-business' });
++  // No session can claim role tester: a launch must name a business role, and the tester
++  // session's own role.claim refuses. So #holder(business, 'tester') is always empty.
++  const s = setup(t);
++  assert.throws(() => s.b.bindLaunch({ business: 'demo', role: 'tester', run: 'tester-run', harness: 'pi' }), { code: 'unknown-role' });
++  assert.throws(() => s.call(s.b.bindTester({ business: 'demo' }), 'role.claim'), { code: 'tester-refused' });
++  assert.equal(s.store.get("SELECT count(*) n FROM role_claims WHERE role='tester'").n, 0);
++  assert.equal(s.store.get("SELECT count(*) n FROM role_claims WHERE role='pm'").n, 1);
++});
++
++test('every verb outside the tester list refuses tester-refused and is recorded against the tester', async (t) => {
++  const { b, store, call } = setup(t);
++  const tester = b.bindTester({ business: 'demo' });
++  const refused = [
++    ['role.claim', {}],
++    ['role.release', {}],
++    ['role.revoke', { role: 'pm' }],
++    ['decision.raise', { action: 'message.send', question: 'q', options: [], recommendation: 'no', blocking: false }],
++    ['decision.resolve', { id: 'd-1', choice: 'yes' }],
++    ['decision.seen', { id: 'd-1' }],
++    ['decision.withdraw', { id: 'd-1' }],
++    ['review.request', { task_ref: 'vikunja:1/1', role: 'cto' }],
++    ['review.verdict', { task_ref: 'vikunja:1/1', verdict: 'approve' }],
++    ['launch.revoke', {}],
++    ['launch.restore', {}],
++    ['event.emit', { kind: 'action.allowed', body: { action: 'routine' } }],
++    ['state', {}],
++    ['credentials', {}],
++    ['requirements', {}],
++  ];
++  for (const [verb, args] of refused) assert.throws(() => call(tester, verb, args), { code: 'tester-refused' }, verb);
++  let handled = 0;
++  for (const verb of TASK_VERBS)
++    await assert.rejects(
++      b.requestTask(tester, { verb, args: {} }, async () => handled++),
++      { code: 'tester-refused' },
++      verb,
++    );
++  assert.equal(handled, 0);
++  const rows = store.all("SELECT actor_role, actor_run, body FROM events WHERE kind='action.refused'");
++  assert.equal(rows.length, refused.length + TASK_VERBS.length);
++  assert.ok(rows.every((r) => r.actor_role === 'tester' && r.actor_run === null && JSON.parse(r.body).code === 'tester-refused'));
++  assert.equal(store.get("SELECT count(*) n FROM events WHERE kind IN ('launch.revoked','launch.restored','human.input')").n, 0);
++  // The tester gate runs before any argument check, so malformed arguments refuse tester-refused too.
++  for (const [verb] of refused) assert.throws(() => call(tester, verb, { bogus: 1 }), { code: 'tester-refused' }, `${verb} bogus`);
++});
++
++test('a tester message is from tester, starts [mos test], and writes no human.input or authority', (t) => {
++  const { b, store, pm, call } = setup(t);
++  const tester = b.bindTester({ business: 'demo' });
++  assert.throws(() => call(tester, 'message.send', { to: 'pm', body: 'is the plan current?' }), { code: 'tester-prefix' });
++  assert.throws(() => call(tester, 'message.send', { to: 'pm', body: ' [mos test] late prefix' }), { code: 'tester-prefix' });
++  for (const to of ['human', 'tester', 'nobody'])
++    assert.throws(() => call(tester, 'message.send', { to, body: say() }), { code: 'unknown-role' }, to);
++  for (const extra of [{ corrects: 'm-1' }, { decision: 'd-1' }])
++    assert.throws(() => call(tester, 'message.send', { to: 'pm', body: say(), ...extra }), { code: 'invalid-request' });
++  const events = store.get('SELECT count(*) n FROM events WHERE kind<>?', 'action.refused').n;
++  const sent = call(tester, 'message.send', { to: 'pm', body: say(), class: 'REQUEST' });
++  assert.equal(sent.request, null);
++  const row = store.get('SELECT * FROM messages WHERE id=?', sent.id);
++  assert.equal(row.from_role, 'tester');
++  assert.equal(row.from_run, 'tester-cli');
++  assert.equal(row.to_role, 'pm');
++  assert.equal(store.get('SELECT count(*) n FROM events WHERE kind<>?', 'action.refused').n, events, 'no event at all');
++  const got = call(pm, 'message.receive');
++  assert.equal(got.length, 1);
++  assert.equal(got[0].from_role, 'tester');
++  assert.equal(got[0].request, null);
++  // task.create needs a human.input event as its request (packages/tasks/src/verbs.mjs); a tester
++  // message gives none, so it can't back one.
++  assert.equal(b.taskView('demo', 'input', sent.id), false);
++  assert.equal(store.get("SELECT count(*) n FROM events WHERE kind='human.input'").n, 0);
++});
++
++test('a role answers a tester only in reply to a tester message, and the answer never reaches the human', (t) => {
++  const { b, store, pm, human, reader, call } = setup(t);
++  const tester = b.bindTester({ business: 'demo' });
++  const ask = call(tester, 'message.send', { to: 'pm', body: say() }).id;
++  const jason = call(human, 'message.send', { to: 'pm', body: 'a real instruction' }).id;
++  call(pm, 'message.receive');
++  assert.throws(() => call(pm, 'message.send', { to: 'tester', body: 'answer' }), { code: 'tester-reply-required' });
++  assert.throws(() => call(pm, 'message.send', { to: 'tester', body: 'answer', in_reply_to: jason }), { code: 'tester-reply-required' });
++  assert.throws(() => call(pm, 'message.send', { to: 'tester', body: 'answer', in_reply_to: 'missing' }), { code: 'tester-reply-required' });
++  assert.throws(() => call(human, 'message.send', { to: 'tester', body: 'hi', in_reply_to: ask }), { code: 'unknown-role' });
++  const answer = call(pm, 'message.send', { to: 'tester', body: 'the plan is current', in_reply_to: ask }).id;
++  assert.equal(store.get('SELECT to_role FROM messages WHERE id=?', answer).to_role, 'tester');
++  // Not in the human's inbox or the Console's Messages page.
++  assert.deepEqual(call(human, 'message.receive'), []);
++  for (const cap of [human, reader]) assert.equal(call(cap, 'messages').total, 0);
++  const got = call(tester, 'message.receive');
++  assert.deepEqual(got.map((m) => [m.id, m.from_role, m.in_reply_to]), [[answer, 'pm', ask]]);
++  assert.deepEqual(call(tester, 'message.receive'), []);
++  assert.throws(() => call(tester, 'message.read', { id: jason }), { code: 'message-not-found' });
++  assert.deepEqual(call(tester, 'message.read', { id: answer }), { read: true });
++  const delivered = store.all('SELECT op, holder_run, transport FROM deliveries WHERE message=? ORDER BY seq', answer);
++  assert.deepEqual(delivered.map((d) => [d.op, d.holder_run, d.transport]), [
++    ['routed', null, null],
++    ['delivered', null, 'cli'],
++    ['read', null, null],
++  ]);
++  // A role's own inbox is not the tester's.
++  assert.throws(() => call(pm, 'message.read', { id: answer }), { code: 'message-not-found' });
++});
++
++test('the tester reads the human views a reader reads', (t) => {
++  const { b, pm, reader, call } = setup(t);
++  const tester = b.bindTester({ business: 'demo' });
++  const ask = call(tester, 'message.send', { to: 'pm', body: say() }).id;
++  call(pm, 'message.receive');
++  call(pm, 'message.send', { to: 'tester', body: 'answer', in_reply_to: ask });
++  call(pm, 'message.send', { to: 'human', body: 'for jason' });
++  for (const [verb, args] of [
++    ['inbox', {}],
++    ['agents', {}],
++    ['tasks', {}],
++    ['trail', { subject: ask }],
++    ['decisions', { list: 'roles' }],
++    ['decisions', { list: 'recent' }],
++    ['messages', {}],
++    ['replies', { id: ask }],
++  ])
++    assert.deepEqual(call(tester, verb, args), call(reader, verb, args), verb);
++  assert.equal(call(tester, 'replies', { id: ask }).length, 1);
++  assert.equal(call(tester, 'messages').total, 1);
++});
++
++// The process proof, on a process table like human.test.mjs's.
++const testerCli = '/opt/mosaic/tester-cli.mjs';
++const humanCli = '/opt/mosaic/human-cli.mjs';
++const nonce = 'b'.repeat(64);
++function table(cli = testerCli, env = { MOSAIC_BUS_TESTER_NONCE: nonce }) {
++  return new Map([
++    [50, { pid: 50, ppid: 40, startTime: '100', uid: process.getuid(), argv: ['node', cli], env }],
++    [40, { pid: 40, ppid: 1, startTime: '90', uid: process.getuid(), argv: ['bash'], env: {} }],
++  ]);
++}
++const proof = { pid: 50, startTime: '100', nonce, business: 'demo' };
++const reader = (t) => (pid) => {
++  if (!t.has(pid)) throw Error('gone');
++  return t.get(pid);
++};
++const tester = (t, extra = {}) =>
++  verifyTester(proof, {
++    cliPath: testerCli,
++    readProcess: reader(t),
++    readNonce: (pid) => t.get(pid)?.env?.MOSAIC_BUS_TESTER_NONCE ?? null,
++    ...extra,
++  });
++
++test('tester proof binds its own CLI, start time and nonce, refuses a managed run and allows an agent', () => {
++  assert.equal(tester(table()).business, 'demo');
++  for (const change of [{ startTime: '101' }, { uid: process.getuid() + 1 }, { argv: ['node', 'other.mjs'] }, { env: { MOSAIC_BUS_TESTER_NONCE: 'c'.repeat(64) } }]) {
++    const t = table();
++    Object.assign(t.get(50), change);
++    assert.throws(() => tester(t), { code: 'tester-required' }, JSON.stringify(change));
++  }
++  for (const env of [{ MOSAIC_RUN_ID: 'run-x' }, { MOSAIC_BUS_CAP: 'cap' }, { MOSAIC_AGENT_RUN: '1' }]) {
++    const t = table();
++    t.get(40).env = env;
++    assert.throws(() => tester(t), { code: 'tester-required' }, Object.keys(env)[0]);
++    const self = table();
++    Object.assign(self.get(50).env, env);
++    assert.throws(() => tester(self), { code: 'tester-required' }, `${Object.keys(env)[0]} on the CLI`);
++  }
++  assert.throws(() => tester(table(), { launches: [{ pid: 40, startTime: '90' }] }), { code: 'tester-required' });
++  assert.equal(tester(table(), { launches: [{ pid: 40, startTime: '89' }] }).business, 'demo');
++  // An agent above the tester is the intended case: Mos or a T3 seat.
++  for (const [argv, env] of [
++    [['bash'], { CLAUDECODE: '1', CLAUDE_CODE_ENTRYPOINT: 'sdk-ts' }],
++    [['bash'], { CODEX_THREAD_ID: 'thread', PI_AGENT_DIR: '/x' }],
++    [['claude'], {}],
++    [['node', '/usr/lib/node_modules/codex/bin/codex.js'], {}],
++    [['pi'], {}],
++  ]) {
++    const t = table();
++    Object.assign(t.get(40), { argv, env });
++    assert.equal(tester(t).business, 'demo', argv.join(' '));
++  }
++  const broken = table();
++  broken.delete(40);
++  assert.throws(() => tester(broken), { code: 'tester-required' });
++  // A loop refuses when it comes round, not at the depth bound.
++  const loop = table();
++  loop.get(40).ppid = 50;
++  let reads = 0;
++  assert.throws(() => tester(loop, { readProcess: (pid) => (reads++, reader(loop)(pid)) }), { code: 'tester-required' });
++  assert.ok(reads < 5, `${reads} reads`);
++  // A parent pid under 2 refuses even when /proc would answer for it.
++  const gone = table();
++  gone.get(40).ppid = 0;
++  gone.set(0, { pid: 0, ppid: 1, startTime: '1', uid: process.getuid(), argv: ['init'], env: {} });
++  assert.throws(() => tester(gone), { code: 'tester-required' });
++  // The CLI is read again at the top: a changed start time or parent refuses.
++  for (const change of [{ startTime: '101' }, { ppid: 1 }]) {
++    const t = table();
++    let first = true;
++    const again = (pid) => (pid === 50 && !first ? { ...t.get(50), ...change } : ((first = pid === 50 ? false : first), t.get(pid)));
++    assert.throws(() => tester(t, { readProcess: again }), { code: 'tester-required' }, JSON.stringify(change));
++  }
++  // The first read's start time is checked on its own, not only by the re-read.
++  const once = table();
++  let fresh = true;
++  const first = (pid) => (pid === 50 && fresh ? ((fresh = false), { ...once.get(50), startTime: '101' }) : once.get(pid));
++  assert.throws(() => tester(once, { readProcess: first }), { code: 'tester-required' });
++  // Each bad shape sits on a table where every other check passes, so only the shape check refuses.
++  const pid1 = table();
++  pid1.set(1, { ...pid1.get(50), pid: 1 });
++  const nonHex = table(testerCli, { MOSAIC_BUS_TESTER_NONCE: 'x' });
++  for (const [bad, t] of [
++    [null, table()],
++    [{ ...proof, extra: 1 }, table()],
++    [{ ...proof, pid: 1 }, pid1],
++    [{ ...proof, nonce: 'x' }, nonHex],
++    [{ ...proof, business: 3 }, table()],
++  ])
++    assert.throws(
++      () => verifyTester(bad, { cliPath: testerCli, readProcess: reader(t), readNonce: (pid) => t.get(pid)?.env?.MOSAIC_BUS_TESTER_NONCE ?? null }),
++      { code: 'tester-required' },
++      JSON.stringify(bad),
++    );
++});
++
++test("neither CLI's nonce proves the other: each proof is bound to its own CLI and nonce variable", () => {
++  // A human CLI process, offered as a tester proof.
++  const human = table(humanCli, { MOSAIC_BUS_CLI_NONCE: nonce });
++  assert.throws(() => tester(human), { code: 'tester-required' });
++  assert.throws(() => tester(human, { cliPath: humanCli }), { code: 'tester-required' }, 'right path, wrong variable');
++  // A tester CLI process, offered as a human proof.
++  const t = table();
++  const human_ = (extra = {}) => verifyHuman(proof, { cliPath: humanCli, readProcess: reader(t), ...extra });
++  assert.throws(() => human_(), { code: 'human-required' });
++  assert.throws(() => human_({ cliPath: testerCli }), { code: 'human-required' }, 'right path, wrong variable');
++  // Both variables set: the path still decides.
++  const both = table(testerCli, { MOSAIC_BUS_TESTER_NONCE: nonce, MOSAIC_BUS_CLI_NONCE: nonce });
++  assert.throws(() => verifyHuman(proof, { cliPath: humanCli, readProcess: reader(both) }), { code: 'human-required' });
++  assert.throws(() => tester(both, { cliPath: humanCli }), { code: 'tester-required' });
++});
++
++test("testerNonce reads only the tester's variable and gives null on any read error", () => {
++  const io = (text) => ({ readFile: () => text });
++  assert.equal(testerNonce(5, io(`A=1\0MOSAIC_BUS_TESTER_NONCE=${nonce}\0`)), nonce);
++  assert.equal(testerNonce(5, io(`MOSAIC_BUS_CLI_NONCE=${nonce}\0`)), null);
++  assert.equal(testerNonce(5, { readFile: () => { throw Object.assign(Error(), { code: 'EACCES' }); } }), null);
++  assert.equal(testerNonce(process.pid), null);
++});
++
++test('an envelope carries exactly one of cap, human and tester; no tester authenticator refuses', async (t) => {
++  const root = mkdtempSync(join(tmpdir(), 'bus-tester-'));
++  const store = new Store(root);
++  const b = new Broker({ store, businesses: business({ 'bus.tester': true }) });
++  const path = join(store.directory, 'broker.sock');
++  let calls = 0;
++  let bound = null;
++  const server = await serve({ broker: b, path, authenticateHuman: () => (calls++, 'x'), authenticateTester: () => (calls++, (bound = b.bindTester({ business: 'demo' }))) });
++  const bare = join(store.directory, 'bare.sock');
++  const bareServer = await serve({ broker: b, path: bare });
++  t.after(async () => {
++    await server.close();
++    await bareServer.close();
++    store.close();
++    rmSync(root, { recursive: true, force: true });
++  });
++  const raw = (at, request) =>
++    new Promise((resolve, reject) => {
++      const s = connect(at);
++      let out = '';
++      s.on('data', (d) => (out += d));
++      s.on('end', () => resolve(JSON.parse(out)));
++      s.on('error', reject);
++      s.end(JSON.stringify(request) + '\n');
++    });
++  const p = { business: 'demo', pid: 2, startTime: '1', nonce };
++  const cap = b.bindReader({ business: 'demo' });
++  for (const r of [{ tester: p, cap }, { tester: p, human: p }, { tester: p, human: p, cap }])
++    assert.deepEqual(await raw(path, { ...r, verb: 'agents' }), { ok: false, error: 'invalid-envelope' }, Object.keys(r).join('+'));
++  assert.equal(calls, 0);
++  assert.deepEqual(await raw(bare, { tester: p, verb: 'agents' }), { ok: false, error: 'tester-required' });
++  assert.deepEqual(await raw(path, { tester: p, verb: 'agents' }), { ok: true, result: [] });
++  assert.equal(calls, 1);
++  // The tester's capability lasts one request, as the human's does.
++  assert.throws(() => b.request(bound, { verb: 'agents' }), { code: 'unauthenticated' });
++  assert.deepEqual(await new Client({ path, tester: p }).call('agents'), []);
++});
++
++// The real shim against a real runtime. The test process is not a managed run, so the proof
++// passes here; a managed run's marker on the shim itself refuses.
++const shim = fileURLToPath(new URL('../src/tester-cli.mjs', import.meta.url));
++// Async: the broker runs in this process, so a synchronous spawn would block its answer.
++function run(socket, request, env = {}) {
++  const clean = Object.fromEntries(Object.entries(process.env).filter(([k]) => !/^MOSAIC_BUS_(TESTER|CLI)_NONCE$/.test(k)));
++  return new Promise((resolve, reject) => {
++    const child = spawn(process.execPath, [shim, socket], { env: { ...clean, ...env }, timeout: 20000 });
++    let out = '';
++    let err = '';
++    child.stdout.on('data', (d) => (out += d));
++    child.stderr.on('data', (d) => (err += d));
++    child.on('error', reject);
++    child.on('close', (status) => resolve({ status, out: out.trim(), err: err.trim() }));
++    child.stdin.end(JSON.stringify(request));
++  });
++}
++async function runtime(t, vars, launches = []) {
++  const root = mkdtempSync(join(tmpdir(), 'bus-tester-rt-'));
++  const rt = await startBroker({ dataRoot: root, businesses: business(vars), readers: ['demo'], launches });
++  t.after(async () => {
++    await rt.close();
++    rmSync(root, { recursive: true, force: true });
++  });
++  return rt;
++}
++
++test('tester-cli.mjs binds through the runtime when the switch is on, and refuses off or under a run marker', async (t) => {
++  const on = await runtime(t, { 'bus.tester': true });
++  const reader = new Client({ path: on.path, cap: on.readers[0].cap });
++  const sent = await run(on.path, { business: 'demo', verb: 'message.send', args: { to: 'pm', body: say() } });
++  assert.equal(sent.status, 0, sent.err);
++  const id = JSON.parse(sent.out).id;
++  assert.equal((await reader.call('trail', { subject: id })).find((r) => r.table === 'messages').from_role, 'tester');
++  assert.deepEqual(await run(on.path, { business: 'demo', verb: 'state' }), { status: 2, out: '', err: 'tester-refused' });
++  for (const marker of ['MOSAIC_RUN_ID', 'MOSAIC_BUS_CAP', 'MOSAIC_AGENT_RUN'])
++    assert.deepEqual(await run(on.path, { business: 'demo', verb: 'agents' }, { [marker]: 'x' }), { status: 2, out: '', err: 'tester-required' }, marker);
++  assert.equal((await run(on.path, { business: 'demo', verb: 'agents' }, { CLAUDECODE: '1' })).status, 0);
++  assert.deepEqual(await run(on.path, { business: 'demo', verb: 'agents', cap: 'x' }), { status: 2, out: '', err: 'invalid-request' });
++  // This test process as a managed run's launch record: the shim it spawns has it as an ancestor.
++  const me = readProcess(process.pid);
++  const under = await runtime(t, { 'bus.tester': true }, [{ business: 'demo', role: 'cto', run: 'cto-run', harness: 'pi', pid: me.pid, startTime: me.startTime }]);
++  assert.deepEqual(await run(under.path, { business: 'demo', verb: 'agents' }), { status: 2, out: '', err: 'tester-required' });
++  const off = await runtime(t, null);
++  assert.deepEqual(await run(off.path, { business: 'demo', verb: 'agents' }), { status: 2, out: '', err: 'tester-off' });
++});
+diff --git a/packages/cli/tests/tester.test.mjs b/packages/cli/tests/tester.test.mjs
+new file mode 100644
+index 000000000..0994b12cf
+--- /dev/null
++++ b/packages/cli/tests/tester.test.mjs
+@@ -0,0 +1,128 @@
++import { test } from "node:test";
++import assert from "node:assert/strict";
++import { existsSync } from "node:fs";
++import { join } from "node:path";
++import { main } from "../src/cli.mjs";
++import { HUMAN_CLI, TESTER_CLI, busExit, testerTransport } from "../src/transport.mjs";
++import { BusError, Broker } from "../../bus/src/broker.mjs";
++import { Store } from "../../bus/src/store.mjs";
++import { BUSINESSES, humanEnv, io, tmp } from "./helpers.mjs";
++
++// Row 110 (#1604): --tester binds as the business's tester instead of as the
++// human. The in-process broker here has bus.tester on; the real tester-cli.mjs
++// runs in packages/bus/tests/tester.test.mjs.
++function setup(t) {
++  const store = new Store(tmp(t, "mosaic-cli-tester-"));
++  t.after(() => store.close());
++  const businesses = { demo: { ...BUSINESSES.demo, vars: { "bus.tester": true } } };
++  const b = new Broker({ store, businesses });
++  const coder = b.bindLaunch({ business: "demo", role: "coder", run: "coder-run", harness: "pi", address: "coder-run" });
++  b.request(coder, { verb: "role.claim" });
++  const human = b.bindHuman({ business: "demo", human: "jason", via: "cli", outsideAgent: true });
++  const tester = b.bindTester({ business: "demo" });
++  const calls = { human: [], tester: [] };
++  const via = (cap, list) => (business) => async (verb, args = {}) => {
++    list.push({ business, verb, args });
++    try {
++      return structuredClone(b.request(cap, { verb, args }));
++    } catch (e) {
++      if (!(e instanceof BusError)) throw e;
++      const error = new Error(e.code);
++      error.code = e.code;
++      throw error;
++    }
++  };
++  const deps = { system: { dataRoot: tmp(t) }, transport: via(human, calls.human), testerTransport: via(tester, calls.tester), talkPollMs: 5 };
++  return { b, store, coder, human, calls, deps };
++}
++// The tester runs inside an agent: a T3 seat or Mos.
++const inAgent = () => io({ ...humanEnv(), CLAUDECODE: "1", CLAUDE_CODE_ENTRYPOINT: "sdk-ts" });
++
++test("talk --tester sends a [mos test] message as tester from inside an agent and prints the role's reply", async (t) => {
++  const s = setup(t);
++  const x = inAgent();
++  const deps = {
++    ...s.deps,
++    testerTransport: (business) => {
++      const inner = s.deps.testerTransport(business);
++      return async (verb, args) => {
++        if (verb === "message.receive") {
++          const ask = s.store.get("SELECT id FROM messages WHERE from_role='tester'");
++          if (ask && !s.store.get("SELECT 1 FROM messages WHERE to_role='tester'")) {
++            s.b.request(s.coder, { verb: "message.receive", args: {} });
++            s.b.request(s.coder, { verb: "message.send", args: { to: "tester", body: "the plan is current", in_reply_to: ask.id } });
++          }
++        }
++        return inner(verb, args);
++      };
++    },
++  };
++  await main(["talk", "coder", "[mos test] is the plan current?", "--tester", "--business", "demo"], x, deps);
++  assert.match(x.out.text, /^sent [0-9a-f-]{8} to coder\n/);
++  assert.match(x.out.text, /coder \(INFO, re [0-9a-f-]{8}\) [0-9a-f-]{8}:\nthe plan is current\n/);
++  assert.deepEqual(s.calls.human, []);
++  assert.deepEqual(s.calls.tester.map((c) => c.verb), ["message.send", "message.receive", "message.read"]);
++  const row = s.store.get("SELECT * FROM messages WHERE from_role='tester'");
++  assert.equal(row.from_run, "tester-cli");
++  assert.equal(row.class, "REQUEST");
++  assert.deepEqual(s.b.request(s.human, { verb: "message.receive", args: {} }), []);
++  assert.equal(s.store.get("SELECT count(*) n FROM events WHERE kind='human.input'").n, 0);
++});
++
++test("talk --tester refuses text without the [mos test] prefix before any call", async (t) => {
++  const s = setup(t);
++  await assert.rejects(main(["talk", "coder", "is the plan current?", "--tester", "--business", "demo"], inAgent(), s.deps), (e) => e.exitCode === 2 && /starts with "\[mos test\]"/.test(e.message));
++  assert.deepEqual(s.calls.tester, []);
++  // follow sends nothing, so it takes no prefix.
++  const controller = new AbortController();
++  const deps = { ...s.deps, signal: controller.signal, testerTransport: (b) => async (verb, args) => (controller.abort(), s.deps.testerTransport(b)(verb, args)) };
++  await main(["follow", "--tester", "--business", "demo"], inAgent(), deps);
++  assert.deepEqual(s.calls.tester.map((c) => c.verb), ["message.receive"]);
++});
++
++test("the read verbs take --tester inside an agent, and the trail shows the tester as the sender", async (t) => {
++  const s = setup(t);
++  await main(["talk", "coder", "[mos test] hello", "--tester", "--wait", "0", "--business", "demo"], inAgent(), s.deps);
++  const id = s.store.get("SELECT id FROM messages WHERE from_role='tester'").id;
++  for (const verb of ["inbox", "tasks", "agents"]) {
++    const x = inAgent();
++    await main([verb, "--tester", "--business", "demo"], x, s.deps);
++    assert.ok(x.out.text.length > 0, verb);
++  }
++  const x = inAgent();
++  await main(["trail", id, "--tester", "--business", "demo"], x, s.deps);
++  assert.match(x.out.text, /messages#\d+ {2}tester → coder: \[mos test\] hello/);
++  assert.deepEqual([...new Set(s.calls.tester.map((c) => c.verb))], ["message.send", "inbox", "messages", "tasks", "agents", "trail"]);
++  assert.deepEqual(s.calls.human, []);
++  // Without --tester the same commands refuse inside an agent, before any call.
++  for (const argv of [["inbox"], ["agents"], ["talk", "coder", "[mos test] hi"], ["follow"]])
++    await assert.rejects(main([...argv, "--business", "demo"], inAgent(), s.deps), (e) => e.exitCode === 3, argv[0]);
++  assert.deepEqual(s.calls.human, []);
++});
++
++test("decide, stop and launches take no --tester", async (t) => {
++  const s = setup(t);
++  for (const argv of [["decide", "d1", "yes", "--tester"], ["stop", "run-1", "--tester"], ["launches", "off", "--tester"], ["launches", "on", "--tester"], ["launches", "list", "--tester"]])
++    await assert.rejects(main(argv, inAgent(), s.deps), (e) => e.exitCode === 4 && /unknown option --tester/.test(e.message), argv.join(" "));
++  assert.deepEqual(s.calls, { human: [], tester: [] });
++});
++
++test("the tester transport runs tester-cli.mjs, and the tester's refusals exit 3", async () => {
++  assert.ok(TESTER_CLI.endsWith("/packages/bus/src/tester-cli.mjs") && existsSync(TESTER_CLI));
++  assert.notEqual(TESTER_CLI, HUMAN_CLI);
++  let seen;
++  const spawn = (cmd, argv, options) => ((seen = { cmd, argv, input: options.input }), { status: 0, stdout: "[]" });
++  assert.deepEqual(await testerTransport({ socket: "/run/fake.sock", business: "acme", env: {}, spawn })("agents"), []);
++  assert.deepEqual(seen.argv, [TESTER_CLI, "/run/fake.sock"]);
++  assert.deepEqual(JSON.parse(seen.input), { business: "acme", verb: "agents", args: {} });
++  for (const code of ["tester-required", "tester-off", "tester-refused"]) assert.equal(busExit(code), 3, code);
++  assert.equal(busExit("tester-prefix"), 2);
++});
++
++test("with no stand-in transport, --tester runs tester-cli.mjs on the data root's socket", async (t) => {
++  const dataRoot = tmp(t);
++  const seen = [];
++  const testerSpawn = (cmd, argv, options) => (seen.push({ argv, input: JSON.parse(options.input) }), { status: 0, stdout: "[]" });
++  await main(["agents", "--tester", "--business", "demo"], inAgent(), { system: { dataRoot }, testerSpawn });
++  assert.deepEqual(seen, [{ argv: [TESTER_CLI, join(dataRoot, "bus", "broker.sock")], input: { business: "demo", verb: "agents", args: {} } }]);
++});
diff --git a/agents/darkwing/work/queue-110/r1/candidate-manifest.sha256 b/agents/darkwing/work/queue-110/r1/candidate-manifest.sha256
new file mode 100644
index 000000000..7363a17ad
--- /dev/null
+++ b/agents/darkwing/work/queue-110/r1/candidate-manifest.sha256
@@ -0,0 +1,19 @@
+03840e1ea7cedac04b000a238f8960d5a45d3f31207075fd0150c99ef65f9b0e  packages/business/README.md
+4e0c4f56557843ca4953d55ee09f26bdcdf96de8e71c9362567be0d9c3a16dd8  packages/business/src/vars.mjs
+88073d8bbe0dda96e981549197954bd9f3a5d8d557430f48fda2349398196fb1  packages/business/tests/vars.test.mjs
+a2103a3cab534469ffdbc40f0b4259ae19839e5173e3d97fdc6463f53b90c01a  packages/bus/README.md
+071406a566efc819e031dec8563df2e7005391926a9dedd0bdc6cb7fbcb7844d  packages/bus/src/broker.mjs
+a3d6052f93fea672a0a78c5a655450af90170c3442fae513aea61885c05ec6f5  packages/bus/src/client.mjs
+dc3633f9c1c2049b4cbf3527e7e51fa379361093abd30bbefed52c9796c700c5  packages/bus/src/runtime.mjs
+c4f37a6194abf0433f86d439c0e9896a8402ec90038e421b166d4d14b5647ea8  packages/bus/src/server.mjs
+c04c434ec76252fbc93fb047e7a0c996225590e805f2c82a8d521c161cc9b80b  packages/bus/src/tester-cli.mjs
+5e9e08ca8069e1de35232f26d48a77792388128dda659893909f2d34b5af2346  packages/bus/src/tester.mjs
+39c225c5765c05d463f542b035961ef6492e2977ba2467b17142f4020e91fd04  packages/bus/tests/tester.test.mjs
+f408c0fb5753b19159d6cfbf57f051ca379ef9a697697b0923f286605b1c5818  packages/cli/README.md
+e6e8b6164f2dd97ddb2a0f5c8982ddba1ace3de0a5d88f29f1522696cc3aff43  packages/cli/src/cli.mjs
+5129c44b4d9f642e825344df65c9bfb4bac4fc8d6b25343b42d39853dbd40774  packages/cli/src/transport.mjs
+76e267cdd221d395a545fb1c3631cecc5bbb67d367e6f42e0eb552a8238184ec  packages/cli/tests/stack-copy.test.mjs
+a7ecb7c95c76730308b32a43cf3ed01b2809ce14983ec89290729b8d0031f472  packages/cli/tests/tester.test.mjs
+819a6bd2c77199d88c4b7e0374c08b3732fb3b22cc874c35baf957f35bcb94da  packages/harness/src/runner.mjs
+45024be17bfeb039979a7bafbaba9357a52f4b83ffdd072c2c1cb9f21fe8abb8  packages/harness/tests/runner.test.mjs
+34802b1d5773e79e0c282921b968466b306661146bf15d7093df3be226b7e184  packages/seat/tests/sandbox.test.mjs
diff --git a/agents/darkwing/work/queue-110/r1/gate-run-1.log b/agents/darkwing/work/queue-110/r1/gate-run-1.log
new file mode 100644
index 000000000..0c0f678ee
--- /dev/null
+++ b/agents/darkwing/work/queue-110/r1/gate-run-1.log
@@ -0,0 +1,26 @@
+base badfa52b9 DOCKER_HOST=unset docker=29.7.2 start 00:41:55
+pkg-bus rc=0 00:41:55-00:41:59 ℹ pass 147 ℹ fail 0 ℹ skipped 0  | ℹ duration_ms 3715.261375
+pkg-business rc=0 00:41:59-00:42:01 ℹ pass 67 ℹ fail 0 ℹ skipped 0  | ℹ duration_ms 1785.178848
+pkg-cli rc=0 00:42:01-00:42:19 ℹ pass 184 ℹ fail 0 ℹ skipped 0  | ℹ duration_ms 18104.695921
+pkg-control-board rc=0 00:42:19-00:42:19 ℹ pass 124 ℹ fail 0 ℹ skipped 0  | ℹ duration_ms 584.209919
+pkg-conversation rc=0 00:42:19-00:43:07 ℹ pass 182 ℹ fail 0 ℹ skipped 0  | ℹ duration_ms 47139.407255
+pkg-discord rc=0 00:43:07-00:43:09 ℹ pass 178 ℹ fail 0 ℹ skipped 0  | ℹ duration_ms 2569.68502
+pkg-harness rc=0 00:43:09-00:43:20 ℹ pass 80 ℹ fail 0 ℹ skipped 0  | ℹ duration_ms 11078.043305
+pkg-ledger rc=0 00:43:20-00:43:39 ℹ pass 78 ℹ fail 0 ℹ skipped 0  | ℹ duration_ms 18781.62127
+pkg-mosaic rc=0 00:43:39-00:43:41 ℹ pass 69 ℹ fail 0 ℹ skipped 0  | ℹ duration_ms 2112.82323
+pkg-queue rc=0 00:43:41-00:44:10 ℹ pass 156 ℹ fail 0 ℹ skipped 0  | ℹ duration_ms 28736.038517
+pkg-runs rc=0 00:44:10-00:44:11 ℹ pass 43 ℹ fail 0 ℹ skipped 0  | ℹ duration_ms 725.724756
+pkg-seat rc=0 00:44:11-00:44:16 ℹ pass 120 ℹ fail 0 ℹ skipped 0  | ℹ duration_ms 4838.492492
+pkg-tasks rc=0 00:44:16-00:44:21 ℹ pass 92 ℹ fail 0 ℹ skipped 0  | ℹ duration_ms 5590.970828
+pkg-webui rc=0 00:44:21-00:45:16 ℹ pass 108 ℹ fail 0 ℹ skipped 0  | ℹ duration_ms 54647.300163
+script-auth rc=0 00:45:16-00:45:16  | selftest: 15 passed, 0 failed
+script-conductor rc=0 00:45:16-00:45:23  | selftest: 17 passed, 0 failed
+script-config rc=0 00:45:23-00:45:24  | selftest: 24 passed, 0 failed
+script-discord rc=0 00:45:24-00:45:31  | discord suite: 66 passed, 0 failed
+script-extension-package rc=0 00:45:31-00:45:32  | extension package selftest: 18 passed, 0 failed
+script-foundation rc=0 00:45:32-00:46:11  | selftest: 44 passed, 0 failed
+script-queue rc=0 00:46:11-00:46:42 ℹ pass 156 ℹ fail 0  | queue suite: 28 passed, 0 failed
+script-release rc=0 00:46:42-00:46:52  | selftest: 14 passed, 0 failed
+script-task rc=0 00:46:52-00:47:22  | selftest: 98 passed, 0 failed
+GATE_PASSED 00:47:22
+exit 0
diff --git a/agents/darkwing/work/queue-110/r1/gate-run-2.log b/agents/darkwing/work/queue-110/r1/gate-run-2.log
new file mode 100644
index 000000000..63a052ec4
--- /dev/null
+++ b/agents/darkwing/work/queue-110/r1/gate-run-2.log
@@ -0,0 +1,26 @@
+base badfa52b9 DOCKER_HOST=unset docker=29.7.2 start 00:55:51
+pkg-bus rc=0 00:55:51-00:55:55 ℹ pass 147 ℹ fail 0 ℹ skipped 0  | ℹ duration_ms 3930.905503
+pkg-business rc=0 00:55:55-00:55:56 ℹ pass 67 ℹ fail 0 ℹ skipped 0  | ℹ duration_ms 1767.016409
+pkg-cli rc=0 00:55:56-00:56:15 ℹ pass 184 ℹ fail 0 ℹ skipped 0  | ℹ duration_ms 18894.469054
+pkg-control-board rc=0 00:56:15-00:56:16 ℹ pass 124 ℹ fail 0 ℹ skipped 0  | ℹ duration_ms 591.635633
+pkg-conversation rc=0 00:56:16-00:57:03 ℹ pass 182 ℹ fail 0 ℹ skipped 0  | ℹ duration_ms 47010.27538
+pkg-discord rc=0 00:57:03-00:57:06 ℹ pass 178 ℹ fail 0 ℹ skipped 0  | ℹ duration_ms 2553.939905
+pkg-harness rc=0 00:57:06-00:57:17 ℹ pass 80 ℹ fail 0 ℹ skipped 0  | ℹ duration_ms 11306.942418
+pkg-ledger rc=0 00:57:17-00:57:36 ℹ pass 78 ℹ fail 0 ℹ skipped 0  | ℹ duration_ms 19116.574679
+pkg-mosaic rc=0 00:57:36-00:57:38 ℹ pass 69 ℹ fail 0 ℹ skipped 0  | ℹ duration_ms 2050.354066
+pkg-queue rc=0 00:57:38-00:58:07 ℹ pass 156 ℹ fail 0 ℹ skipped 0  | ℹ duration_ms 28365.492408
+pkg-runs rc=0 00:58:07-00:58:07 ℹ pass 43 ℹ fail 0 ℹ skipped 0  | ℹ duration_ms 713.488715
+pkg-seat rc=0 00:58:07-00:58:12 ℹ pass 120 ℹ fail 0 ℹ skipped 0  | ℹ duration_ms 4898.257313
+pkg-tasks rc=0 00:58:12-00:58:17 ℹ pass 92 ℹ fail 0 ℹ skipped 0  | ℹ duration_ms 5211.472156
+pkg-webui rc=0 00:58:17-00:59:13 ℹ pass 108 ℹ fail 0 ℹ skipped 0  | ℹ duration_ms 55509.91308
+script-auth rc=0 00:59:13-00:59:14  | selftest: 15 passed, 0 failed
+script-conductor rc=0 00:59:14-00:59:20  | selftest: 17 passed, 0 failed
+script-config rc=0 00:59:20-00:59:21  | selftest: 24 passed, 0 failed
+script-discord rc=0 00:59:21-00:59:28  | discord suite: 66 passed, 0 failed
+script-extension-package rc=0 00:59:28-00:59:29  | extension package selftest: 18 passed, 0 failed
+script-foundation rc=0 00:59:29-01:00:08  | selftest: 44 passed, 0 failed
+script-queue rc=0 01:00:08-01:00:39 ℹ pass 156 ℹ fail 0  | queue suite: 28 passed, 0 failed
+script-release rc=0 01:00:39-01:00:50  | selftest: 14 passed, 0 failed
+script-task rc=0 01:00:50-01:01:18  | selftest: 98 passed, 0 failed
+GATE_PASSED 01:01:18
+exit 0
diff --git a/agents/darkwing/work/queue-110/r1/gate-run.log b/agents/darkwing/work/queue-110/r1/gate-run.log
new file mode 100644
index 000000000..6448990d4
--- /dev/null
+++ b/agents/darkwing/work/queue-110/r1/gate-run.log
@@ -0,0 +1,26 @@
+base badfa52b9 DOCKER_HOST=unset docker=29.7.2 start 01:03:44
+pkg-bus rc=0 01:03:44-01:03:48 ℹ pass 147 ℹ fail 0 ℹ skipped 0  | ℹ duration_ms 4040.253103
+pkg-business rc=0 01:03:48-01:03:50 ℹ pass 67 ℹ fail 0 ℹ skipped 0  | ℹ duration_ms 1726.440755
+pkg-cli rc=0 01:03:50-01:04:07 ℹ pass 184 ℹ fail 0 ℹ skipped 0  | ℹ duration_ms 17571.33179
+pkg-control-board rc=0 01:04:07-01:04:08 ℹ pass 124 ℹ fail 0 ℹ skipped 0  | ℹ duration_ms 588.690539
+pkg-conversation rc=0 01:04:08-01:04:55 ℹ pass 182 ℹ fail 0 ℹ skipped 0  | ℹ duration_ms 47503.069964
+pkg-discord rc=0 01:04:55-01:04:58 ℹ pass 178 ℹ fail 0 ℹ skipped 0  | ℹ duration_ms 2568.633148
+pkg-harness rc=0 01:04:58-01:05:09 ℹ pass 80 ℹ fail 0 ℹ skipped 0  | ℹ duration_ms 11177.988231
+pkg-ledger rc=0 01:05:09-01:05:28 ℹ pass 78 ℹ fail 0 ℹ skipped 0  | ℹ duration_ms 18716.646696
+pkg-mosaic rc=0 01:05:28-01:05:30 ℹ pass 69 ℹ fail 0 ℹ skipped 0  | ℹ duration_ms 2204.501458
+pkg-queue rc=0 01:05:30-01:05:58 ℹ pass 156 ℹ fail 0 ℹ skipped 0  | ℹ duration_ms 28234.729657
+pkg-runs rc=0 01:05:58-01:05:59 ℹ pass 43 ℹ fail 0 ℹ skipped 0  | ℹ duration_ms 698.50859
+pkg-seat rc=0 01:05:59-01:06:04 ℹ pass 120 ℹ fail 0 ℹ skipped 0  | ℹ duration_ms 4851.009466
+pkg-tasks rc=0 01:06:04-01:06:09 ℹ pass 92 ℹ fail 0 ℹ skipped 0  | ℹ duration_ms 5322.865518
+pkg-webui rc=0 01:06:09-01:07:05 ℹ pass 108 ℹ fail 0 ℹ skipped 0  | ℹ duration_ms 55563.501219
+script-auth rc=0 01:07:05-01:07:06  | selftest: 15 passed, 0 failed
+script-conductor rc=0 01:07:06-01:07:11  | selftest: 17 passed, 0 failed
+script-config rc=0 01:07:11-01:07:13  | selftest: 24 passed, 0 failed
+script-discord rc=0 01:07:13-01:07:20  | discord suite: 66 passed, 0 failed
+script-extension-package rc=0 01:07:20-01:07:21  | extension package selftest: 18 passed, 0 failed
+script-foundation rc=0 01:07:21-01:07:59  | selftest: 44 passed, 0 failed
+script-queue rc=0 01:07:59-01:08:29 ℹ pass 156 ℹ fail 0  | queue suite: 28 passed, 0 failed
+script-release rc=0 01:08:29-01:08:41  | selftest: 14 passed, 0 failed
+script-task rc=0 01:08:41-01:09:09  | selftest: 98 passed, 0 failed
+GATE_PASSED 01:09:09
+exit 0
diff --git a/agents/darkwing/work/queue-110/r1/gate.sh b/agents/darkwing/work/queue-110/r1/gate.sh
new file mode 100755
index 000000000..44bb89287
--- /dev/null
+++ b/agents/darkwing/work/queue-110/r1/gate.sh
@@ -0,0 +1,20 @@
+#!/bin/bash
+set -o pipefail
+# Darkwing gate, row 110 (#1604), candidate in the r110 worktree on base badfa52b9 (rows 109 and 111 landed).
+# Every package's node suite, then every scripts/test-*.sh, sequential, each
+# teed to its own log; stops at the first failure.
+G=$HOME/darkwing-scratch/r110/wt
+OUT=$HOME/darkwing-scratch/r110/gate
+export TMPDIR=$HOME/darkwing-scratch/r110/tmp
+mkdir -p "$OUT" "$TMPDIR"
+cd "$G" || exit 9
+[ -e "$G/node_modules" ] || { echo "STOP no node_modules in $G"; exit 8; }
+echo "base $(git rev-parse --short HEAD) DOCKER_HOST=${DOCKER_HOST:-unset} docker=$(docker info --format '{{.ServerVersion}}' 2>/dev/null || echo none) start $(date -u +%H:%M:%S)"
+run() { local name="$1" dir="$2" cmd="$3" t0; t0=$(date -u +%H:%M:%S)
+  (cd "$G/$dir" && bash -c "$cmd") 2>&1 | tee "$OUT/$name.log" > /dev/null; local rc=$?
+  echo "$name rc=$rc $t0-$(date -u +%H:%M:%S) $(grep -E '^ℹ (pass|fail|skipped) [0-9]+' "$OUT/$name.log" | tr '\n' ' ') | $(tail -n1 "$OUT/$name.log")"
+  [ $rc -eq 0 ] || { echo "STOP $name"; exit $rc; }; }
+for d in packages/*/; do p=$(basename "$d"); [ -d "$d/tests" ] || continue
+  run "pkg-$p" "packages/$p" 'node --test tests/*.test.mjs'; done
+for s in scripts/test-*.sh; do n=$(basename "$s" .sh); run "script-${n#test-}" . "bash $s"; done
+echo "GATE_PASSED $(date -u +%H:%M:%S)"
diff --git a/agents/darkwing/work/queue-110/r1/gate/pkg-bus.log b/agents/darkwing/work/queue-110/r1/gate/pkg-bus.log
new file mode 100644
index 000000000..eb1a4923b
--- /dev/null
+++ b/agents/darkwing/work/queue-110/r1/gate/pkg-bus.log
@@ -0,0 +1,155 @@
+✔ agents: a held role with nothing on the bus is idle; a role session gets the claim rows unchanged (174.703573ms)
+✔ agents: working counts what the holder received and has not read; routed alone is not working (207.960853ms)
+✔ agents: input needed is the role's open decisions routed to the human, gated first, then oldest (331.739201ms)
+✔ agents: working wins over waiting, and Input needed still shows (183.829234ms)
+✔ agents: a new holder doesn't inherit what the last one left unread; decisions stay with the role (244.24276ms)
+✔ agents: state reads only its own business, even for a run name both use (227.442337ms)
+✔ agents: a message the holder released unread is stranded; the next holder gets nothing and cannot read it (219.876383ms)
+✔ agents: a message the holder read is not stranded; one the current holder has not read is not listed (228.239085ms)
+✔ agents: stranded is oldest first and capped at 50 for a role (863.459045ms)
+✔ agents: stranded is per role and per business (309.621294ms)
+✔ agents: a message routed to a held role and not yet received is not stranded (124.859987ms)
+✔ launch identity is stamped, payload identity is refused and stale holder cannot send (217.530615ms)
+✔ decision classes route from policy; gated resolution is human-only, choice and target must match (265.797612ms)
+✔ claim exclusion, holder release, gated revoke and rerouting to a new holder are atomic (279.088319ms)
+✔ launch events require a human CLI capability; generic emit cannot forge authority events (202.472167ms)
+✔ within-role decisions close atomically and invalid options or blocking omissions refuse (232.182401ms)
+✔ observer capabilities read human inbox but cannot mutate or forge launch identity (197.361931ms)
+✔ task action subjects and linked decision trail are complete and ordered (210.233603ms)
+✔ launch binding is durable and reconnecting requires the identical trusted record (121.987657ms)
+✔ business isolation includes inherited object names and cross-business message references (208.964435ms)
+✔ authority never transfers between action, run, target, unresolved or replaced role holder (293.278013ms)
+✔ task projection uses schema current view, skipping earlier and equal-start polls (145.332266ms)
+✔ revocation permanently bars the old run from reclaiming first, including after broker restart (213.71772ms)
+✔ empty message references refuse before storage; refusal-evidence failure stays a typed error (144.49446ms)
+✔ both arbiters require human resolution when their cross-role route is themselves (207.630463ms)
+✔ the shipped coder role raises task.reassign as gated to the human; task.scope.change stays cross-role (149.546537ms)
+✔ S1 adapter takes resolved limits and refs, rejects mismatched instance, never mutates input (2.438544ms)
+✔ credentials gives human and reader sessions service, account, role, date and state, and nothing else (152.452702ms)
+✔ credentials refuses a role session and any argument (180.953814ms)
+✔ credentials reads the status on each request, and a broker without one lists none (231.570351ms)
+✔ the broker process answers credentials without a token, path or variable in its output, log or store (192.314452ms)
+✔ only validated broker references load; returned data and exceptions cannot expose a known token (4.002256ms)
+✔ bad file modes, symlinks, repository/data paths, malformed tokens and missing dates refuse (33.343757ms)
+✔ expiry refuses use and env references never become client data (0.616904ms)
+✔ S1 parsed service refs work, service mismatch refuses, Gitea rotation due is a warning state (1.10348ms)
+✔ opaque tokens shorter than 16 characters refuse before use (0.238454ms)
+✔ roles lists open decisions routed to a role, and never the human inbox (274.566918ms)
+✔ recent lists closed decisions of every route, newest close first, with how each closed (293.292804ms)
+✔ recent gives the closing event as closed when the decision was seen first (316.21447ms)
+✔ recent stops at RECENT rows (894.50638ms)
+✔ every row is what trail already gives the same session for that id (273.534634ms)
+✔ a role session can't list decisions, so it can't read another role's open decisions (417.641861ms)
+✔ decisions is a read: one business, strict arguments, nothing written (356.225039ms)
+✔ endLaunch writes session.ended, releases the run claim and kills its capabilities (190.302846ms)
+✔ endLaunch refuses an unknown run, a second end and a rebind of the ended run (140.826594ms)
+✔ a restarted broker refuses to rebind an ended run; a refused rebind leaves the run unbound (161.515891ms)
+✔ endLaunch leaves a claim another run took alone (174.445218ms)
+✔ refuse records action.refused against the caller with the code only (145.783193ms)
+✔ launches off refuses role.launch with launch-revoked until launches on (220.583184ms)
+✔ broker process: launch ops authorize role.launch, record refusals and end runs (305.943118ms)
+✔ human proof binds CLI entry, process start and nonce; agents and incomplete ancestry refuse (2.25284ms)
+✔ process reader gets own kernel identity without exposing environment values (0.446441ms)
+✔ EACCES ancestor environments skip only markers; commands and registered launches still refuse (0.629684ms)
+✔ real pid 1 remains inspectable when its environment is protected (0.251568ms)
+✔ within-role sends cite an open gated launch decision without spending it or naming it in grants (253.682208ms)
+✔ missing and foreign-business citations refuse and roll back message and grant (195.542553ms)
+✔ cross-role sends still need a matching resolved decision and consume it once (259.811334ms)
+✔ messages pages all human messages newest first without writes; read state is history (2736.844734ms)
+✔ messages refuses role callers, invalid paging and cursors outside this human feed (231.199351ms)
+✔ views messages passes only its paging arguments through (0.276023ms)
+✔ messages isolates businesses even with a valid foreign cursor (155.802995ms)
+✔ broker process binds trusted launches, offers reader capabilities, refuses human mutation, closes cleanly (238.913ms)
+✔ startup token refusal returns safe code without value or partial listening broker (36.900181ms)
+✔ loaded fixture token is absent from socket replies and SQLite, including refusal evidence (179.38059ms)
+✔ killed broker leaves an explicit stale lock; another process cannot silently reclaim it (169.081035ms)
+✔ trusted host registers later launches; socket clients never have a registration verb (175.962943ms)
+✔ runtime excludes declared project roots even when host supplies no repoRoots (36.719072ms)
+✔ a refused launch binding leaves the broker and existing capabilities alive; bad protocol stops it (196.657708ms)
+✔ a reply is listed for human and reader sessions, and its delivery rows are unchanged (258.813285ms)
+✔ the reply still reaches the human message.receive (mosaic talk) after the Console showed it (216.481508ms)
+✔ a message with no reply gives an empty list (166.920117ms)
+✔ replies come oldest first and stop at REPLIES (851.277175ms)
+✔ an id that names no message in the business refuses message-not-found, and the refusal is recorded (326.672265ms)
+✔ strict arguments; a role session gets human-required (395.758422ms)
+✔ views passes replies through as one call with the id (0.241892ms)
+✔ requirements returns the committed list to a holding role session, and no one else (256.31338ms)
+✔ the PM's prd.approve with no task, when no id fits, reaches the human's Inbox (147.880515ms)
+✔ the PM's non-blocking role.revoke with no task reaches the human's Inbox (190.256759ms)
+✔ a push is recorded as the action.allowed for git.push.working on the task, and only the host records one (277.42873ms)
+✔ review.request names the latest pushed commit and sends the reviewer a REVIEW-REQUEST (252.122937ms)
+✔ review.request says which run holds the reviewer role, or null, and a null request waits for a claim (311.836726ms)
+✔ review.request refuses a commit that isn't the latest push, a non-reviewer and a role without the action (453.503831ms)
+✔ reviewFetch answers only the addressed reviewer, for the request it cites (256.001015ms)
+✔ review.verdict answers one request once, to the role that asked (339.838017ms)
+✔ task.close on a pushed task needs an approve verdict for the latest push (381.172524ms)
+✔ a refusal the host decided is filed on the task it names, and only a task ref counts (253.920316ms)
+✔ v3b prototype refusals, views and append-only mutations (1144.399307ms)
+✔ gated approval authorizes once, survives store reopen, and fresh approval works (281.238795ms)
+✔ another run cannot consume an approval; a failed check leaves it usable (231.197988ms)
+✔ two scheduled callers have exactly one grant and one consumed refusal (175.316794ms)
+✔ failed commit rolls consumption back; cross-role consumes and within-role stays reusable (369.8025ms)
+✔ class drift gated to cross-role refuses before consumption (267.780413ms)
+✔ class drift cross-role to gated refuses before consumption (272.787008ms)
+✔ class drift gated to within-role refuses before consumption (246.584773ms)
+✔ class drift cross-role to within-role refuses before consumption (259.212607ms)
+✔ class drift within-role to gated refuses before consumption (229.266798ms)
+✔ class drift within-role to cross-role refuses before consumption (186.992516ms)
+✔ message.send consumes approval and prevents a later send or authorize (206.162695ms)
+✔ role.revoke consumes approval and prevents a later revoke or authorize (224.372868ms)
+✔ a business that never switched launches reads allowed with no time and no event (153.957179ms)
+✔ launches revoked and then restored read allowed, with the restore time and event id (159.62271ms)
+✔ a task closed on the tracker leaves the open list, and total counts the open ones (166.458039ms)
+✔ a tombstone is not open (137.394129ms)
+✔ the open list stops at the cap and says so; total still counts every open task (156.340443ms)
+✔ a role and a reader session read state; arguments, and an unbound cap, refuse (167.235628ms)
+✔ a human session reads the same state, with the same cap (182.568049ms)
+✔ reading state writes nothing: every table keeps its row count (171.226677ms)
+✔ creates private WAL store and excludes a second writer until explicit close (157.9811ms)
+✔ rollback is atomic and schema metadata is checked against trusted DDL, not just itself (154.212196ms)
+✔ existing empty database and symlink runtime directory refuse, never initialize over damage (187.07101ms)
+✔ crash during a transaction recovers no partial event after explicit fixture-only lock removal (164.550822ms)
+✔ writer refuses mixed at/read_at forms atomically, even through trusted SQL helpers (135.485804ms)
+✔ async transactions refuse before invoking their function (115.3258ms)
+✔ the session default fits under the reply cap and pages to the end with next (334.274018ms)
+✔ the short form: no description, assignees by role, every listed key (290.998336ms)
+✔ each filter, alone and together, and total counts every match (338.042576ms)
+✔ task_ref reads one task in full, as the whole board has it (295.855091ms)
+✔ no arguments is the read the Console and mosaic make, unchanged (261.435112ms)
+✔ an unknown argument or a bad value refuses invalid-request (912.003342ms)
+✔ tasks rows carry priority and requirement for every session that reads tasks (353.483186ms)
+✔ the read model rebuilds from the ledger: a reopened bus and each trail give the same values (377.783263ms)
+✔ an empty business and one with snapshots but no task.created read cleanly (131.349302ms)
+✔ recordTask keeps sync reads and a role write apart (213.631835ms)
+✔ read_at must be one canonical UTC format, so the projection compares strings safely (131.056397ms)
+✔ a bad entry refuses the whole record (143.496891ms)
+✔ taskView reads the projection for one business (134.52588ms)
+✔ requestTask hands only a holder and a task verb to the handler, and records refusals (260.554285ms)
+✔ the server sends task verbs to the adapter with its own timeout; other verbs stay synchronous (411.510467ms)
+✔ without an adapter the server refuses every task verb (221.654684ms)
+✔ the runtime refuses an invalid adapter and closes a valid one (223.926189ms)
+✔ the process loads the S3 adapter from plain-data trackers (255.421512ms)
+✔ the tester binds only when the business sets bus.tester to exactly true (848.155648ms)
+✔ a business may not name a role tester, so the tester address is never a role (260.761489ms)
+✔ every verb outside the tester list refuses tester-refused and is recorded against the tester (545.674908ms)
+✔ a tester message is from tester, starts [mos test], and writes no human.input or authority (191.631078ms)
+✔ a role answers a tester only in reply to a tester message, and the answer never reaches the human (234.862255ms)
+✔ the tester reads the human views a reader reads (88.91548ms)
+✔ tester proof binds its own CLI, start time and nonce, refuses a managed run and allows an agent (1.188673ms)
+✔ neither CLI's nonce proves the other: each proof is bound to its own CLI and nonce variable (0.377195ms)
+✔ testerNonce reads only the tester's variable and gives null on any read error (0.199719ms)
+✔ an envelope carries exactly one of cap, human and tester; no tester authenticator refuses (45.500833ms)
+✔ tester-cli.mjs binds through the runtime when the switch is on, and refuses off or under a run marker (713.376622ms)
+✔ socket capability stamps launch identity; shared views use wire, no SQL client (192.039953ms)
+✔ two wire claims serialize; a lost reply never automatically retries (186.099508ms)
+✔ malformed, oversized and identity-forging envelopes refuse without echoing input (122.488904ms)
+✔ client preserves UTF-8 when a response divides a multibyte character (12.545821ms)
+✔ committed mutation followed by dropped reply reports unknown and is never retried (142.787389ms)
+ℹ tests 147
+ℹ suites 0
+ℹ pass 147
+ℹ fail 0
+ℹ cancelled 0
+ℹ skipped 0
+ℹ todo 0
+ℹ duration_ms 4040.253103
diff --git a/agents/darkwing/work/queue-110/r1/gate/pkg-business.log b/agents/darkwing/work/queue-110/r1/gate/pkg-business.log
new file mode 100644
index 000000000..c4ac8a40d
--- /dev/null
+++ b/agents/darkwing/work/queue-110/r1/gate/pkg-business.log
@@ -0,0 +1,75 @@
+✔ config directory and file path follow MOSAIC_CONFIG (1.218556ms)
+✔ the fixture business validates and comes back frozen (3.202147ms)
+✔ two instances may share a definition (0.99767ms)
+✔ top-level refusals (3.514427ms)
+✔ arbiters and projects (5.20306ms)
+✔ role instances (2.338679ms)
+✔ Vikunja bots (5.100392ms)
+✔ a role without Vikunja takes no tracker block (1.823607ms)
+✔ credential references match the definition's services (2.105252ms)
+✔ launch (7.168739ms)
+✔ loadBusiness: file checks (1.646121ms)
+✔ loadBusiness: not a regular file (36.505685ms)
+✔ loading writes nothing (0.979612ms)
+✔ names that are Object.prototype properties don't count as declared (2.509315ms)
+✔ the shipped example refuses as written and validates once filled in (0.514386ms)
+✔ the role file loads and resolves through loadBusiness (4.46797ms)
+✔ the shipped file is exactly decision 104's list (0.662635ms)
+✔ the resolved record matches decision 104, so a widened file fails (1.288241ms)
+✔ message.send is within role and every other action is gated (1.007576ms)
+✔ a business grant of a gated action through limits does not widen the role (1.009659ms)
+✔ a launch block whose by is the chief-of-staff instance is refused (1.250972ms)
+✔ the instance takes no credential references and no tracker (2.158934ms)
+✔ usage errors exit 4 (246.893878ms)
+✔ validate: a good business exits 0 and prints instance digests (63.296037ms)
+✔ validate: project files (294.266784ms)
+✔ validate: missing files and a broken system config (227.271549ms)
+✔ validate: credential reference problems exit 2 and name each one (56.077046ms)
+✔ validate: a token file inside the repository is refused (61.480908ms)
+✔ validate: role definitions come from MOSAIC_ROLES_DIR (179.986927ms)
+✔ resolve: prints one instance's record (174.644151ms)
+✔ resolve: refusals (359.102239ms)
+✔ parse: exactly one of file or env, plus the service's date (2.81824ms)
+✔ check: a good file has no problems (0.861846ms)
+✔ check never opens the file: a write-only token passes (0.413284ms)
+✔ check: file problems (1.00368ms)
+✔ check: token files can't live in the repository or dataRoot, even through a linked directory (1.008039ms)
+✔ check: dates and environment references (0.463094ms)
+✔ path and load (1.69041ms)
+✔ refusals (0.840711ms)
+✔ systemVars flattens the validated config (1.435239ms)
+✔ precedence: system, business, project, project role, agent (4.107576ms)
+✔ limits narrow the definition and never widen it (1.920331ms)
+✔ role.launch stays within-role only for the instance the launch block names (3.530802ms)
+✔ limits.authority without role.launch leaves the launcher with no launch block (1.356515ms)
+✔ limits.authority narrows cross-role actions too (0.952854ms)
+✔ classify (1.361867ms)
+✔ the record carries what the broker and launcher need (1.174583ms)
+✔ digest: key order doesn't matter, any value change does (6.724557ms)
+✔ refusals (1.902507ms)
+✔ the four shipped version 2 roles load (3.464833ms)
+✔ shipped role scopes match addendum B section 2 and the SR runbook (1.183282ms)
+✔ shipped authority follows the note's table (0.757208ms)
+✔ version 1 files keep loading with no authority (1.09593ms)
+✔ the conductor policy isn't a role (0.248451ms)
+✔ a missing role file is exit 4, a symbolic link too (0.454399ms)
+✔ version 2 refusals (1.599087ms)
+✔ authority: closed vocabulary, no gated-only action, no overlap (2.527835ms)
+✔ credentials: Gitea scopes (0.691399ms)
+✔ credentials: Vikunja scopes are a group-to-verbs map from the grantable list (0.905817ms)
+✔ credentials: services (0.517189ms)
+✔ contract: a non-empty regular Markdown file beside the role file (0.561034ms)
+✔ every key names known layers and a merge rule (0.646456ms)
+✔ unknown keys and wrong layers refuse (0.545247ms)
+✔ types (1.455482ms)
+✔ merge: defaults, then the most specific layer wins (0.242766ms)
+✔ merge: limits only narrow, and provenance lists each source (0.278765ms)
+✔ merge doesn't change its inputs (0.129117ms)
+ℹ tests 67
+ℹ suites 0
+ℹ pass 67
+ℹ fail 0
+ℹ cancelled 0
+ℹ skipped 0
+ℹ todo 0
+ℹ duration_ms 1726.440755
diff --git a/agents/darkwing/work/queue-110/r1/gate/pkg-cli.log b/agents/darkwing/work/queue-110/r1/gate/pkg-cli.log
new file mode 100644
index 000000000..f55dbe61b
--- /dev/null
+++ b/agents/darkwing/work/queue-110/r1/gate/pkg-cli.log
@@ -0,0 +1,194 @@
+✔ every screen and overlay fits 120x36, 80x24 and the narrow layout, row for row (1214.620859ms)
+✔ width counts terminal cells: wide CJK and emoji 2, U+FE0F after a one-cell base 1, marks 0 (67.559173ms)
+✔ broker text is shown, never interpreted: no raw control character or bidi override reaches the terminal (154.069145ms)
+✔ NO_COLOR: no escape codes, except reverse video on the selected row (252.362018ms)
+✔ 1-9 shows the decide flow's own lines and question; only y resolves (193.707815ms)
+✔ the app shows the same decide text as mosaic decide (108.879239ms)
+✔ any key but y or Y at the question answers No; nothing is sent (2449.62795ms)
+✔ below 40x10 the question is hidden, so every key answers it No, y included (Filbert R3) (410.329041ms)
+✔ under 40 columns a tall terminal shows the too-small screen even where the decide box would fit; y sends nothing (Filbert N10) (1429.759146ms)
+✔ a hidden decide box names the way out, and the status line under it does not promise y (Filbert N12) (105.729087ms)
+✔ a throw while answering the question goes to crash, sends nothing and leaves no job pending (136.836025ms)
+✔ type-ahead never answers the question: a paste, keys typed before it is drawn, keys inside askMs (688.57389ms)
+✔ quitting at the question answers No and sends nothing, armed or not (210.216115ms)
+✔ a timer tick reads nothing under an overlay, never answers the question, and keeps a resolved status (134.080512ms)
+✔ a long question is cut inside the question; the action, target, choice and prompt stay (Dewey B1) (121.302346ms)
+✔ a decide box too big for the terminal says so, and every key answers it No, y included (Dewey B1, round 3) (904.732702ms)
+✔ at every size the decide box shows each line y depends on, or says it is hidden (7923.943003ms)
+✔ outcome unknown: the CLI's sentence, no retry, then the trail or a re-read (155.242465ms)
+✔ refused and failed reads keep the last list, marked stale; a refused decide says refused (116.742527ms)
+✔ help or a detail box cut to fit keeps its last line, Esc included (Dewey) (60.5011ms)
+✔ keys: views, moving, trail of a selection, the command line, help and quit (224.821284ms)
+✔ one option: the status line says Press 1, not 1-1 (86.570909ms)
+✔ no business: the app says so and :business picks one (45.083058ms)
+✔ mosaic with no argument: exit 3 in an agent run, exit 4 with the usage off a terminal, the app on one (1.670197ms)
+✔ scripts/mosaic with no argument reaches the app entry; the seat usage it printed before has not drifted (166.65064ms)
+✔ strings to keep exactly live once, in the decide flow and the transport; the app does not restate them (0.46942ms)
+✔ decide with --note still asks; a No sends nothing (52.68113ms)
+✔ the app's business comes from a live bus host only (0.978913ms)
+✔ runApp leaves the terminal as it found it on q, end of input, SIGTERM, SIGINT, SIGHUP and an error, the first frame's included (7.042389ms)
+✔ draw is pure: same state, same frame (0.740265ms)
+✔ inbox lists only decisions routed to the human, with what approving authorizes and how to decide (137.734379ms)
+✔ decide resolves by id prefix with --yes, and the trail shows it in broker order with the task to follow (128.484607ms)
+✔ decide refuses without a terminal or --yes, on an unknown option and on a short reference (100.325418ms)
+✔ decide prints a declining choice as declining (110.048271ms)
+✔ an unknown outcome is reported once and never resent (92.910645ms)
+✔ a decision closed before the answer arrives exits 2 and points at its trail (128.448931ms)
+✔ a prefix that matches two open decisions exits 2 and resolves neither (91.51967ms)
+✔ without --business a command uses the live host's business, and a stale host.json is not a host (100.519951ms)
+✔ every human command refuses inside an agent run before it touches the bus (121.790179ms)
+✔ usage errors exit 4; no business and no host is a usage error (91.746345ms)
+✔ agents and tasks print through the broker (93.708862ms)
+✔ notify.json: missing, loose, malformed and extra keys refuse; a binding or null passes (1.231867ms)
+✔ bootConfig builds the broker's boot message for one business, with no trackers key when no project names one (58.327984ms)
+✔ trackers come from the tracker.* variables of the one project that names a tracker project (78.419004ms)
+✔ with two projects, the one that sets tracker.project supplies the tracker and the other is no conflict (36.581631ms)
+✔ two projects that each name a tracker project refuse, since the boot shape holds one (31.40453ms)
+✔ a business without tracker.baseUrl gets no trackers entry (27.949503ms)
+✔ an unknown business and a broken system config refuse with exit 3 (60.517373ms)
+✔ follow prints an unsolicited message after plain talk returned (179.701254ms)
+✔ talk --follow continues after reply and prints a later unsolicited message (170.140827ms)
+✔ inbox lists all unread human messages under decisions, does not deliver or read them (2744.564634ms)
+✔ follow refuses agent context and bad arguments (432.850995ms)
+✔ follow Ctrl-C wakes the poll sleep and removes its handler; transport errors also clean up (113.890841ms)
+✔ plain talk leaves the process SIGINT handlers unchanged (471.80286ms)
+✔ empty views say so (1.079362ms)
+✔ the trail keeps the broker's order and names a decision's task without its rows (1.36781ms)
+✔ tasks print the tracker fields the snapshot carries (0.244931ms)
+✔ the review loop: the coder pushes and asks, the reviewer fetches and approves, and the task's trail holds each step (670.786852ms)
+✔ refusals: no action, non-fast-forward, an unknown commit or request, and a push for another task moves only that task's ref (596.264846ms)
+✔ the size cap refuses a push before any byte (348.667963ms)
+✔ a fetch over the cap refuses before any byte reaches the reviewer (575.823147ms)
+✔ the socket refuses a request with no capability, an unknown one, and a bad request line (390.420802ms)
+✔ a rigged clone runs nothing: hooks, fsmonitor, a filter, a gitlink and a symlinked .git/config leave no marker (1590.077264ms)
+✔ an identity with no role, or of another business, refuses not-a-role and moves no ref (473.410036ms)
+✔ a review of a project the business no longer has refuses unknown-project (356.909046ms)
+✔ past maxActive connections the socket refuses git-busy, and a hung-up connection frees its slot (268.332873ms)
+✔ close() answers host-closing to a connection still sending its request line (513.530726ms)
+✔ a bundle that trickles in refuses body-timeout at its deadline and frees its slot (718.817903ms)
+✔ a reviewer gone before its bundle was sent is filed fetch-aborted, not as the host's fault (562.288598ms)
+✔ a reviewer that hangs up the moment it has the whole bundle was served, not aborted (584.518925ms)
+✔ send: a close after every byte left is served; one that fails a queued write is fetch-aborted (42.641991ms)
+✔ a bundle with no bytes for bodyIdle refuses body-timeout long before its deadline (583.436238ms)
+✔ send: a close once the loop is past its last chunk is served, and a failed write there is fetch-aborted (44.666531ms)
+✔ letGo waits for an answer to leave for at most its cap, then destroys the socket (301.725856ms)
+✔ a record that fails and can't be undone refuses rollback-failed, which the host logs (434.025616ms)
+✔ the host boots the broker, binds a launch in process, and the notifier DMs a blocking decision exactly once (970.465276ms)
+✔ a notifier that dies takes the host down with exit 1, so the unit restarts the pair (232.592927ms)
+✔ a second host for the same data root refuses with exit 3 while the first runs (174.338288ms)
+✔ two bus starts racing for one data root leave one host running; the other refuses that a host already runs (578.158714ms)
+✔ a host takes over a host.lock its dead host left, and puts back a live claim that replaced it meanwhile (3.454751ms)
+✔ a host.lock that goes between the check and the read is tried again; one that can't be parsed still refuses as unreadable (0.710609ms)
+✔ a live host's lock stays, however old the file is (0.531192ms)
+✔ a host.lock left by a host killed with SIGKILL doesn't stop the next bus start (862.625677ms)
+✔ while a host boots, a reader sees no host: the human commands still ask for --business, stop and status find none (232.82544ms)
+✔ a host started before host.lock existed, holding only host.json, still refuses a second start, which leaves no lock (26.41875ms)
+✔ a broker fork that throws leaves no host.lock and no host.json (29.826628ms)
+✔ a broker send that throws leaves no host.lock and no host.json (27.3603ms)
+✔ a broker that misses its boot wait leaves no host.lock and no host.json (29.872743ms)
+✔ a notifier fork that throws stops the broker and leaves no host.lock and no host.json (399.540055ms)
+✔ a notifier send that throws stops the broker and leaves no host.lock and no host.json (244.036727ms)
+✔ a boot reply with no reader for the business refuses with exit 3 naming it, before the notifier starts, and leaves no host.lock and no live broker (387.033475ms)
+✔ a boot reply with no reader for the business refuses with exit 3 naming it, with no notifier, and leaves no host.lock and no live broker (239.278898ms)
+✔ a host.json that can't be written stops both children and leaves no host.lock (257.126376ms)
+✔ an error event on the broker before it replies fails the start at once, and leaves no host.lock and no live child (27.741028ms)
+✔ an error event on the notifier before it replies fails the start at once, and leaves no host.lock and no live child (144.125848ms)
+✔ an error event on the broker while the notifier starts fails the start once the notifier replies (260.395543ms)
+✔ an error event on the broker once the host is up stops the host with exit 1, and leaves no host.lock and no host.json (285.132897ms)
+✔ an error event on the notifier once the host is up stops the host with exit 1, and leaves no host.lock and no host.json (333.520591ms)
+✔ a broker reply that misses the wait breaks the channel: the late reply answers nothing, later requests refuse, the host exits 1 (1160.0021ms)
+✔ a broker reply with another request's id, or none, breaks the channel and the host exits 1 (271.151324ms)
+✔ a broker reply with no request waiting breaks the channel and the host exits 1 (151.650398ms)
+✔ a notifier that refuses stops the broker and the host refuses with exit 3 (200.367401ms)
+✔ a notifier that refuses after the broker died still refuses with exit 3, without a send to the dead broker (183.533411ms)
+✔ a notifier that dies before it replies, after the broker died, still refuses, without a send to the dead broker (142.135797ms)
+✔ a close send that fails with EPIPE after the notifier refuses still gives the notifier's refusal, exit 3 (192.494643ms)
+✔ a close send that fails with EPIPE after the notifier dies unanswered still gives the notifier's error (139.678309ms)
+✔ close() whose stop and close sends fail with EPIPE still finishes, with exit 1 (195.534902ms)
+✔ watchChildren reports a child that died before it was called, and one that dies later (21.589222ms)
+✔ bus stop refuses to signal a live pid that is not a bus host (203.200688ms)
+✔ bus start refuses with exit 3 and the code when the broker refuses to boot; bus status names the lock (227.439748ms)
+✔ bus start refuses with exit 3 without a notifier config (108.310367ms)
+✔ bus start runs until bus stop; status reports it while it runs (692.961598ms)
+✔ bus-service.sh renders the unit and installs it into a given directory (53.291856ms)
+✔ bus-service.sh pins the claude binary, refuses one the unit can't carry, and renders without one (64.42287ms)
+✔ bus-service.sh refuses a directory pin and keeps a symlink default unresolved (13.000454ms)
+✔ bus-service.sh refuses a default claude without the execute bit, or in a PATH dir with a space (8.263012ms)
+✔ bus start --pm: the PM runs under its own PID namespace, registered, with a manifest (1329.533884ms)
+✔ the PM launches a coder through its launch tool; the coder answers; refusals name their code (779.119936ms)
+✔ each launch makes sure the workspace has a clone of the project: cloned, fast-forwarded, or kept and logged (2447.058354ms)
+✔ a project clone that can't be made refuses checkout-failed, from --pm and from a session, with no run and no clone left (201.843024ms)
+✔ a runner that stops at once ends its launch with the runner's reason (268.879262ms)
+✔ a Claude Code launch with no session credential refuses before it starts (163.235087ms)
+✔ a pi launch needs no session credential: pi logs in through its own ENV_ALLOW variables (351.400798ms)
+✔ a runner killed from the host ends its launch as killed, not failed (386.462506ms)
+✔ a missing or failing bwrap refuses sandbox-unavailable before anything starts; there is no unconfined fallback (139.870643ms)
+✔ a real Claude Code coder's shell can't read a stand-in secret or anything else its sandbox doesn't hold (1445.803575ms)
+✔ a host that died hard leaves its sessions to the next host, which kills them and ends their runs so the role can be launched again (780.117895ms)
+✔ a host that died hard leaves its sessions to the next host, which finds one already exited (23) and ends their runs so the role can be launched again (3680.317438ms)
+✔ a malformed sessions.json refuses the host start with exit 3 and stays as it was (120.549945ms)
+✔ an over-long launch request is refused at once, not at the 10 s idle timeout (130.183591ms)
+✔ a launch client that never closes its side doesn't hold the host's close (133.786987ms)
+✔ a runner that ignores SIGTERM is killed when the host closes (1253.927689ms)
+✔ claudeVersion asks MOSAIC_CLAUDE_BIN when set, else claude on PATH (4.867402ms)
+✔ zoned uses the IANA zone across DST (21.555174ms)
+✔ each open blocking decision is DM'd once, across polls and a restart; non-blocking ones are not (149.177146ms)
+✔ two blocking decisions get two DMs with different nonces (121.299165ms)
+✔ the digest nonce differs per business and per day and fits Discord's 25 characters (0.198785ms)
+✔ a failed DM is journaled, backs off, and is retried until it lands (106.890854ms)
+✔ five definite refusals stop a DM: one gave-up line, one log line, and a restart keeps the count (108.94581ms)
+✔ 429s, 5xx-style unknowns and refusals without a status never count toward the limit (98.432674ms)
+✔ a crash between the fifth refusal and its gave-up line: the next poll appends it and sends nothing (137.882571ms)
+✔ polled every POLL_MS against a permanent 403, a DM is sent at 0, 30, 60, 90 and 120 min and gives up only then (173.513948ms)
+✔ a restart after the second refusal does not send before that refusal's 30 min are up (154.837946ms)
+✔ the digest goes at 08:00 Chicago once a day, with blocking ones marked as DM'd (132.131356ms)
+✔ a late start with no digest for the day sends one at once; an empty inbox gets one line (85.523897ms)
+✔ an inbox read failure is logged and the next poll retries (0.656548ms)
+✔ no Discord id reaches the journal or the log (107.396701ms)
+✔ the journal: a torn tail is copied out and truncated, so an append after it reopens cleanly (30.18278ms)
+✔ the journal: a crash between the copy and the truncate leaves a tail the next open repairs (65.780888ms)
+✔ the journal: a whole file that is one torn line truncates to empty (30.758463ms)
+✔ the journal: a malformed complete line refuses and leaves the file and any torn tail alone (2.255836ms)
+✔ the journal: a loose file mode, a loose directory or a symlinked journal refuses (0.667732ms)
+✔ the journal: a line with a wrong type refuses with exit 3 and names the field (2.166884ms)
+✔ the journal: a symlinked directory refuses and says it is a link (0.385571ms)
+✔ the journal: a dangling directory link, a parent that is a file and a journal that is a directory each refuse with exit 3 (0.585684ms)
+✔ the journal: an append after the file was swapped for a symlink refuses and writes nothing through it (0.457959ms)
+✔ the journal: a directory it cannot write or create refuses with exit 3 and names the path (0.482942ms)
+✔ digest content stays within Discord's 2000 characters (0.306937ms)
+✔ runLoop never overlaps ticks and stops after the one in flight (111.938003ms)
+✔ shared copy: npm ci, pushed reachability, readonly/existing copy, webui delegation (613.539973ms)
+✔ wrapper preserves Q81 lease and marker, rejects foreign/symlink; check uses effective roots (393.720408ms)
+✔ bus unit copy/pm pins, install refuses all busy states and failed reads, drop-in refusal (411.167668ms)
+✔ missing package manifest refuses before npm; npm failure removes the unpublished temp copy (292.883937ms)
+✔ real pinned install loads bus and Console; same-copy mosaic talk passes proof, other trees refuse (3947.622568ms)
+✔ bus status reads effective copy/pm/drop-ins without writes; check refuses an overridden ExecStart (464.14714ms)
+✔ drop-ins in either override field and malformed metadata refuse; uninstall also checks --no-reload (164.169335ms)
+✔ install never shows a template name on systemd 261; template drop-ins still refuse (166.797304ms)
+✔ unlisted instance drop-in is found in another unit lookup directory; path discovery errors refuse (155.479116ms)
+✔ talk --tester sends a [mos test] message as tester from inside an agent and prints the role's reply (148.970614ms)
+✔ talk --tester refuses text without the [mos test] prefix before any call (98.999441ms)
+✔ the read verbs take --tester inside an agent, and the trail shows the tester as the sender (103.853144ms)
+✔ decide, stop and launches take no --tester (90.325375ms)
+✔ the tester transport runs tester-cli.mjs, and the tester's refusals exit 3 (0.325256ms)
+✔ with no stand-in transport, --tester runs tester-cli.mjs on the data root's socket (0.522465ms)
+task.close {} answered: invalid-request; fake saw 18 requests, first GET /info 200, GET /projects/1 200, GET /projects/1/views 200
+task.close on a missing task answered: task-not-found; it made GET /tasks/999 404
+✔ bootConfig trackers reach the S3 adapter in the real broker child, which goes ready against a fake Vikunja (397.923061ms)
+✔ the transport writes {business, verb, args} to the child and reads its JSON (49.116803ms)
+✔ a bus code on stderr becomes the exit code; garbage and timeouts are outcome problems (2163.899072ms)
+✔ busExit and refuseInsideAgent (0.481832ms)
+✔ talk sends a REQUEST, prints and reads everything that arrives, and stops at the reply (207.382136ms)
+✔ talk --wait 0 only sends; no reply within --wait exits 1 and says where it will show (1119.80874ms)
+✔ a late reply the Console has listed still reaches the next talk (2212.305272ms)
+✔ talk, stop and launches off/on refuse inside an agent run; bad arguments are usage errors (121.658725ms)
+✔ launches off and on go to the broker and change the business's launch state (450.744982ms)
+✔ launches list reads sessions.json and marks a stale entry; stop reports it and refuses a non-runner (171.902307ms)
+ℹ tests 184
+ℹ suites 0
+ℹ pass 184
+ℹ fail 0
+ℹ cancelled 0
+ℹ skipped 0
+ℹ todo 0
+ℹ duration_ms 17571.33179
diff --git a/agents/darkwing/work/queue-110/r1/gate/pkg-control-board.log b/agents/darkwing/work/queue-110/r1/gate/pkg-control-board.log
new file mode 100644
index 000000000..c313187e0
--- /dev/null
+++ b/agents/darkwing/work/queue-110/r1/gate/pkg-control-board.log
@@ -0,0 +1,132 @@
+✔ explicit request, Seen, ordinary completion and a new request have distinct attention states (3.613718ms)
+✔ attention convention ignores reasoning/quoted examples and permits leading blank lines (0.233013ms)
+✔ completed smoke replies and ordinary questions are idle, not human blockers (0.708642ms)
+✔ only an explicit first-line input request makes a finished reply waiting (0.146342ms)
+✔ tool activity, user text, errors and unfinished turns override attention text (0.124569ms)
+✔ STOP access failure is unknown, not absence, under a non-root identity (25.505396ms)
+✔ connector Task never inherits Discord routing envelopes; ordinary Task still uses user text (2.582558ms)
+✔ connector discovery keeps only safe identity; rejects modes, mismatches, links and traversal (1.334716ms)
+✔ canonical owner identity and STOP are independent; no tmux fallback or forged registration (4.998574ms)
+✔ connector reply refusal precedes forged live tmux registration; ordinary agent still sends (0.536472ms)
+✔ server rescans connector discovery and refuses HTTP reply without transport (31.197522ms)
+✔ connector session links and linked directories are not read (1.014416ms)
+✔ newer live matching launch marks old activity, preserves history/attention/attribution, then clears on new activity (2.362273ms)
+✔ CLI print uses the relaunch notice instead of old current preview (56.831168ms)
+✔ connector owner and fixed task never inherit a native relaunch notice (1.874435ms)
+✔ equality, stale/unknown/offline, mismatched registration and unknown activity do not assert relaunch (0.964354ms)
+✔ loadConfig: missing file throws ConfigError (1.399946ms)
+✔ loadConfig: invalid JSON throws ConfigError (0.269404ms)
+✔ loadConfig: missing dataRoot throws ConfigError (0.204184ms)
+✔ loadConfig: relative dataRoot throws ConfigError (0.198031ms)
+✔ loadConfig: valid config returns dataRoot (0.579637ms)
+✔ findNewestSession: picks the newest by mtime among two files (0.440241ms)
+✔ findNewestSession: finds files in nested subdirectories (0.265923ms)
+✔ findNewestSession: returns null for a missing dir (0.112601ms)
+✔ readSession: extracts fields, collapses/truncates text, counts a truncated final line (0.589093ms)
+✔ readSession: model and provider follow the latest model_change entry or assistant turn; null when the log names neither; scanAgent carries them (1.122091ms)
+✔ readSession: lastError carries the assistant errorMessage only when the last assistant turn errored (0.42816ms)
+✔ findNewestSession/scan: never read sibling auth or secrets next to a sessions dir (0.996805ms)
+✔ deriveState: full state table (0.157148ms)
+✔ rule: newest entry is an assistant message with a tool call, after a question-looking text, is working (0.29996ms)
+✔ rule: newest entry is a tool result with no assistant text after it is working (0.247982ms)
+✔ rule: a finished ordinary turn is idle, even if it says your move (0.251628ms)
+✔ task: the first user message of the session, from text blocks (0.228424ms)
+✔ task: a plain-string user content is accepted, whitespace collapsed and long text capped (0.235982ms)
+✔ task: no user message in the log means null (shown as unknown), never a guess (0.239388ms)
+✔ workspace: the live tmux pane path wins; the session cwd is the fallback; neither means null (0.350785ms)
+✔ activeProject: basename of the nearest .git directory or .git file above the workspace; none means null (0.474526ms)
+✔ scan: the written record carries task, workspace and activeProject (0.429714ms)
+✔ registration: overrides task, project and workspace; every source says registration; registered carries the launch fields; the grouping column is untouched (0.509611ms)
+✔ registration: empty task and null project/workspace leave the derived values in place; registered is still non-null (0.337369ms)
+✔ registration: a record whose pid is gone is stale; derived values win, sources say derived, registered stays with alive false; a pid the probe cannot decide is not stale; pidAlive itself (0.868357ms)
+✔ registration: no registration leaves the Gate A fields exactly as before, and registered is null (0.38728ms)
+✔ loadRegistrations: a missing seatsDir gives empty lists (0.129341ms)
+✔ loadRegistrations: one good record, one malformed JSON, one with an unknown field; a stray file under seatsDir is ignored (0.654912ms)
+✔ matchRegistration: matches by sessionsDir, and by realpath through a symlink; sessionsDir null never matches; same seat name with a different sessionsDir does not match (fleet vs repo darkwing) (0.284707ms)
+✔ scan: writes the registration override to disk; index.json carries registered and registrationErrors (1.086243ms)
+✔ scan: a relative seatsDir throws ConfigError; an omitted seatsDir behaves as before (0.204021ms)
+✔ scanAgent: waitingOnYou is true for waiting/error and false otherwise (0.407429ms)
+✔ scanAgent: ageSeconds is computed from the injected now (0.221621ms)
+✔ scanAgent: sessionFile null and state idle when sessions dir is empty but alive (0.129991ms)
+✔ discoverRepoAgents: finds agents with a sessions dir, skips those without, sorted by name (0.295697ms)
+✔ discoverFleetAgents: finds agents with a sessions dir, sorted by name, fleet tmux fields (0.306906ms)
+✔ scan: writes per-agent files and index.json, rerun overwrites, no leftover tmp files (0.746193ms)
+✔ scan: relative boardDir throws ConfigError (0.075511ms)
+✔ CLI: scan with assume-alive liveness exits 0, prints board summary, writes board files (56.71208ms)
+✔ CLI: missing config exits 2 with a refused: message (48.99644ms)
+✔ CLI: unknown command exits 2 (44.436829ms)
+✔ CLI: unknown --liveness value exits 2 (45.760012ms)
+✔ panesRunPi: true when any trimmed line equals 'pi' (0.180424ms)
+✔ panesRunPi: false for bash-only, claude, empty, or node-pi-style lines (0.067741ms)
+✔ tmuxIsAlive: a pane running pi is alive (0.157803ms)
+✔ tmuxIsAlive: session exists but pi has exited is not alive (0.064639ms)
+✔ tmuxIsAlive: no such tmux session is not alive (0.051157ms)
+✔ tmuxIsAlive: tmux could not be run at all is unknown (null), never assumed alive (0.058407ms)
+✔ tmuxIsAlive: passes -L <socket> only when a socket is given (0.106963ms)
+✔ parsePanes: one pane per line, command and optional tab-separated path (0.108732ms)
+✔ tmuxInspect: reports the path of the pane running pi, not of a shell pane (0.066597ms)
+✔ tmuxInspect: no pi pane, no session, or no tmux gives no workspace and the matching liveness (0.084152ms)
+✔ loadSeen: missing file returns {} (0.131222ms)
+✔ loadSeen: invalid JSON throws ConfigError (0.177202ms)
+✔ loadSeen: a JSON array throws ConfigError (0.146089ms)
+✔ loadSeen: a non-string value throws ConfigError (0.165106ms)
+✔ markSeen: seen true adds the key and writes seen.json mode 0600, no leftover tmp files (0.300347ms)
+✔ markSeen: seen false deletes the key (0.239134ms)
+✔ markSeen: missing, empty, or non-string fields throw ConfigError (0.184965ms)
+✔ markSeen: project containing '/' throws ConfigError (0.175805ms)
+✔ markSeen: non-boolean seen throws ConfigError (0.102695ms)
+✔ scanAgent: a seen mark matching the waiting session's lastTimestamp clears waitingOnYou (0.275048ms)
+✔ scanAgent: a stale mark (agent wrote something newer) is not seen and waitingOnYou is true (0.245242ms)
+✔ scanAgent: a working session with a matching mark is not seen (marks only apply to waiting/error) (0.216272ms)
+✔ scanAgent: an error-state session with a matching mark is seen (0.218353ms)
+✔ scan: index.seen and waitingOnYou reflect seen.json, which scan never rewrites or deletes (0.445089ms)
+✔ scan: a corrupt seen.json makes scan throw ConfigError (fail closed) (0.184291ms)
+✔ taskSetBy: a registered task carries the record's setter; a record without the field (pre-#1511) reads unknown; the value is not copied into registered (0.610026ms)
+✔ taskSetBy: null whenever the task shown is not the registered one: no registration, an empty registered task, a stale registration; the field is always present (0.56326ms)
+✔ taskSetBy: scan() reads the field from disk through the seat package (bounded there), writes it to the per-agent record and index, and an invalid on-disk value is a registrationError, never a row value (1.295901ms)
+✔ isLoopbackHost: recognizes loopback hosts (1.117304ms)
+✔ isLoopbackHost: rejects non-loopback hosts (4.053721ms)
+✔ startServer: refuses a non-loopback host with ConfigError, never opens a socket (2.776395ms)
+✔ startServer: serves page, healthz, and a rescanning /api/board (30.085187ms)
+✔ startServer: a seatsDir registration overrides the row and index.registered reflects it (5.396222ms)
+✔ startServer: /api/board returns 500 JSON with an error field when scan throws (2.081772ms)
+✔ CLI: serve refuses a non-loopback host with exit 2 and a refused: message (51.503943ms)
+✔ CLI: serve rejects a non-numeric --port with exit 2 (45.022369ms)
+✔ CLI: scan still works after the async cli refactor (50.321193ms)
+✔ CLI: live serve prints its URL and answers /healthz (57.533906ms)
+✔ page.html: esc() escapes every HTML-significant character (0.565824ms)
+✔ POST /api/seen marks a row; GET /api/board still shows it seen; seen:false clears it (7.684631ms)
+✔ POST /api/seen without a JSON content-type returns 400 and does not write a mark (2.700466ms)
+✔ POST /api/seen with invalid JSON returns 400 (1.51981ms)
+✔ POST /api/seen with a body over 4096 bytes returns 400 (or resets the connection) and writes no mark (1.90697ms)
+✔ POST /api/seen with a missing agent returns 400 (1.290019ms)
+✔ POST /api/board returns 405; PUT /api/seen returns 405 (1.598427ms)
+✔ CLI: scan --print marks a seen row with 's' and the summary line ends with 'N seen)' (48.754076ms)
+✔ page.html: seenControl() escapes rec.project/agent/lastActivity, and the POST uses a JSON content-type (0.302407ms)
+✔ page.html: has a collapsed Seen section that lists seen rows with the shared row builder (0.260953ms)
+✔ page.html: each project has a Hide seen checkbox (default on) beside Hide offline, with a hidden-count note (0.193717ms)
+✔ page.html: a project header reads "N of N" only while a checkbox hides rows (0.146979ms)
+✔ page.html: every row shows Task and Active project, derived or the word unknown, with the workspace in the detail (0.286372ms)
+✔ page.html: task and active project cells show their source via sourceTag(); the detail has a Registered row via registeredText(); SOURCE_LABEL maps registration to registered; every dynamic value in sourceTag/fromSource/registeredText is escaped (0.550278ms)
+✔ POST /api/reply: runs agent-send.sh with -s from the registration, -S <host>:control-board, -m text plus the fixed trailer, no -L on the default socket, MOSAIC_TMUX_SOCKET stripped; answers delivered with the exit code and both streams (25.83888ms)
+✔ POST /api/reply: a registration with a tmux socket adds -L <socket> (26.89519ms)
+✔ POST /api/reply: a non-zero tool exit is a 200 with delivered false, the exit code and the stderr verbatim (25.924684ms)
+✔ POST /api/reply: refusals before the tool runs: empty or blank or long text 400, unknown row 404, no registration 409, stale registration 409, no tmux session 409, bad JSON 400; the tool is never called (13.669425ms)
+✔ POST /api/reply: a missing agent-send.sh is a 500 with the path in the error, not a crash (4.159867ms)
+✔ replyToRow: DEFAULT_AGENT_SEND is the repository's tools/tmux/agent-send.sh and it is executable (0.140142ms)
+✔ page.html: the reply box appears only where canReply() holds (live registration with a tmux session), the detail has a Reply row, the submit posts JSON to /api/reply, receipts and drafts survive a refresh, and every receipt value is escaped (0.577389ms)
+✔ startServer: /api/board carries taskSetBy from a live registration and null for the derived rows (2.142534ms)
+✔ page.html: the task cell and detail show who set a registered task via setByTag()/setByText(), both escaped, only from rec.taskSetBy; the reply gate does not read it (0.27749ms)
+✔ Host/Origin guard: GET /api/board and POST /api/reply refuse a foreign Host, a wrong port and a cross-origin Origin with 403 JSON, before any scan or send, and never send CORS headers (7.479316ms)
+✔ Host/Origin guard: loopback names on this port are accepted, with or without a same-origin Origin (35.776053ms)
+✔ conversation routes (F16): a foreign Host, a wrong port and a cross-origin Origin get 403 before the reader runs, with no CORS headers (4.45165ms)
+✔ every refusal code the reader can raise has an HTTP status (0.878178ms)
+✔ conversation routes: catalogue, first page, next page and follow over HTTP; refusals map to 4xx with their code; nothing is written (42.880528ms)
+ℹ tests 124
+ℹ suites 0
+ℹ pass 124
+ℹ fail 0
+ℹ cancelled 0
+ℹ skipped 0
+ℹ todo 0
+ℹ duration_ms 588.690539
diff --git a/agents/darkwing/work/queue-110/r1/gate/pkg-conversation.log b/agents/darkwing/work/queue-110/r1/gate/pkg-conversation.log
new file mode 100644
index 000000000..c50b42a1d
--- /dev/null
+++ b/agents/darkwing/work/queue-110/r1/gate/pkg-conversation.log
@@ -0,0 +1,190 @@
+✔ W1: two processes acquire the same pair at once; exactly one claim (205.100292ms)
+✔ W1: two writers publish the same revision at once: one wins, the other gets null, the winner's record stays (30.924607ms)
+✔ W1: a revision name appears only after its bytes are synced; before that, only a temp file exists (17.486546ms)
+✔ W2: acquire while a claim is reserved or active refuses already-active (331.027238ms)
+✔ W3: acquire while stopping, uncertain, or stopped without proof refuses unsafe-replacement (365.31532ms)
+✔ W4: same session with another seat tuple, and the reverse, both refuse; a loser on the seat key closes it no-unit (223.518551ms)
+✔ W4: a hard link of one session under another seat is the same session: the second controller refuses already-active and launches nothing (187.570851ms)
+✔ W4: a copy of one session under another seat is the same session: the second controller refuses already-active and launches nothing (187.650904ms)
+✔ W4: a session header ID that changes after construction refuses target; nothing is claimed or launched (2.448772ms)
+✔ W5: SIGKILL between every publication barrier of acquire and transition; restart never finds two holders or a lost claim (9541.304531ms)
+✔ W5: SIGKILL between every publication barrier of release; restart finishes or holds the release (32046.868984ms)
+✔ W6: controller killed mid-turn while the engine lives; restart is uncertain, no launch, prompts refuse (244.586627ms)
+✔ W12: a live owner paused with SIGSTOP; a second controller refuses already-active and changes nothing (141.858051ms)
+✔ W13: crash after the engine spawns, before active; restart finds the live unit: uncertain, no second spawn, force stop only (408.548532ms)
+✔ W14: crash after reservation, before the spawn marker: stopped with a no-unit observation; the pair is free (265.677223ms)
+✔ W20: crash after the spawn marker, scope collected; uncertain in both runs, the marker is copied, no launch until a boot proof (336.31068ms)
+✔ W15: crash between the two keys during release; restart finishes it under the same claim ID (101.313595ms)
+✔ W7: recorded boot ID differs on the same machine: stopped with a boot proof; open tool calls become uncertain (171.594667ms)
+✔ W8: resume after a proven stop with the same pins: new claim ID, generation +1, same conversation, branch and leaf (266.376671ms)
+✔ W9: resume with a changed binary, argv digest, branch or leaf is refused and the claim is unchanged (736.361083ms)
+✔ W11: the controller writes no session file; only the fake engine's own appends appear (196.954264ms)
+✔ W16: a highest revision that won't parse holds the pair uncertain; the older stopped revision is not reused (94.254665ms)
+✔ W17: a claim root copied from another host refuses foreign-host and promotes nothing (64.996214ms)
+✔ G1: a session path or claim root under .pi/state, ~/.claude, the data root or a registration refuses at construction (3.737505ms)
+✔ G2: a symlink inside the fixture root to a live session file is refused by the real-path check (1.025005ms)
+✔ G3: a fixture path swapped for a live path after construction is refused at bind (1.871599ms)
+✔ no shim from this file's tests is left running for the after hook (4.322311ms)
+✔ K1: force stop kills a tool child that called setsid; stopped with a verified proof (549.130698ms)
+✔ K2: K1 on the process-group fallback ends uncertain, never stopped (422.088167ms)
+✔ K3: SIGTERM acknowledged while a member lives: stopping until the kill phase, never stopped from TERM (534.783301ms)
+✔ K4: two engines; force stop one; the other survives by independent observation (2764.280305ms)
+✔ K5: a stop during a tool call leaves the effect uncertain, and it is shown (465.146785ms)
+✔ K12: a member forking in a loop: the freeze stops it, enumeration is complete, populated 0 after cgroup.kill (565.868099ms)
+✔ K13: a member writing its pid into another cgroup is refused by the namespace; the kill is complete (475.683808ms)
+✔ K15: the shim gone, engine/cgroup.events unreadable, or the engine cgroup missing: evidence unavailable, not empty; uncertain (5184.201068ms)
+✔ K10: controller killed between the TERM and kill phases: restart checks the invocation ID and re-runs from TERM for the same stop (760.223969ms)
+✔ K11: controller killed after the confirmation is recorded, before TERM: restart checks the invocation ID and re-runs from TERM for the same stop (620.293833ms)
+✔ K14: a unit with the recorded name but another invocation ID: evidence unavailable, no signals, uncertain (423.934359ms)
+✔ K6: recover without proof, without confirmation, or with changed pins is refused (916.273196ms)
+✔ K7: recover after proof, then launch: new claim and execution, generation +1, same leaf; the cancelled prompt is not replayed (351.867909ms)
+✔ K8: an engine that loads another leaf on resume is refused before admission; it stays claimed until a proven stop (819.858345ms)
+✔ K9: an interrupt that never settles stays uncertain; force stop stays available; takeover is refused while fenced (3253.489741ms)
+✔ K16: a claim from another machine ID refuses foreign-host; no boot proof is issued (49.402872ms)
+✔ K17: two launcher calls with one eligibility record: one launch, the other refuses, no second engine (341.710508ms)
+✔ K18: the leaf changes after eligibility: launch refused; the reservation stays until released with proof (317.582736ms)
+✔ K19: a scope launched with only the engine environment still reaches the user manager; the engine sees no other names (82.555554ms)
+✔ R1: after a proven force stop the controller releases the scope; the shim and the unit are gone (365.456371ms)
+✔ R2: close releases the scope of a binding proven stopped, once, when the stop's own release hasn't run (512.447883ms)
+✔ R3: no release after an unavailable stop or an unverified proof: the scope and its shim stay as evidence (1144.645387ms)
+✔ E1: a natural engine exit with no member left: an engine-exit stop, stopped on a proof naming the engine, and the scope released (413.815094ms)
+✔ E2: an engine exit with a tool child alive: the stop ends uncertain and nothing is released; a force stop then ends it (2399.584181ms)
+✔ E3: an engine exit and a force stop take one escalation slot, in either order (1008.882267ms)
+✔ E4: a shim that doesn't answer: the engine-exit stop misses its deadline, ends uncertain and frees the slot (891.420514ms)
+✔ E5: an engine exit after a force stop ended uncertain starts no engine-exit stop; the force stop stays current (2569.132578ms)
+✔ E6: the engine-exit observation refuses a reaped process that isn't the recorded engine: another PID or start ticks (350.97567ms)
+✔ R5: the harness finds a running shim and reaps it, and never signals a shim outside a mosaic-chat- scope (Filbert N1 and N2 on #1533) (393.30762ms)
+✔ R6: releaseCohort releases nothing while the engine runs, for another invocation ID, or for a cohort without a scope (124.615547ms)
+✔ R7: controller killed after the claim is stopped, before the release: the restart releases the scope (2593.14744ms)
+✔ R8: controller killed between the two keys' stopped revisions: the restart releases the scope (370.60353ms)
+✔ R9: a release that ended unavailable is tried again on a confirmed recover, not a refused one (477.949953ms)
+✔ R10: close releases and signals nothing for a stopped binding whose proof no longer verifies (Filbert N3 on #1536) (389.283311ms)
+✔ R11: close({ killEngine: true }) after a proven stop sends no signal to the recorded engine PID; a restart releases nothing more (2549.049217ms)
+✔ R12: a restart onto a claim stopped on a boot proof releases nothing, though its scope is listed (276.927364ms)
+✔ no shim from this file's tests is left running for the after hook (3.388545ms)
+✔ S1: `/goal x`, with leading spaces or a tab, refuses text-policy at admission; zero engine bytes (202.684946ms)
+✔ S2: every prefix pinned Pi interprets is refused, from the list the code uses; the rest reach the engine exactly (185.094173ms)
+✔ S3: `/goal` on the second line is pinned from the source: Pi checks only index 0, so it is admitted and sent exactly (186.718268ms)
+✔ S4: a `/` left in the composer is cleared when control transfers and returns; the next submit sends only the new text (277.569748ms)
+✔ S5: an observer terminal gets a paste then Enter, as send-message.sh does: not admitted: controller, nothing sent (190.725487ms)
+✔ S6: a mediated-shaped registration (no tmux) passed to the board's replyToRow: 409 no tmux session; exec never runs (0.447493ms)
+✔ S7: ESC, bracketed-paste markers and U+2028/U+2029 travel as one JSON string; the engine receives the exact text in one record (193.004466ms)
+✔ P3: a Pi confirm, select, input or editor dialog is shown disabled with a reason and never answered (285.108142ms)
+✔ E1: send, ack, user, toolCall, toolResult, final answer: shown once, no refresh, draft and reading position kept (208.412827ms)
+✔ E2: U+2028, U+2029 inside JSON strings and CRLF line ends each parse as one record, on the splitter and through the controller (193.478914ms)
+✔ E3: a multipart final, two blocks, null request correlation and duplicate delivery (211.864554ms)
+✔ E4: a page read after message_end but before its entry is persisted: marker at the seam, re-read after run-settled, each message once (223.492321ms)
+✔ E4: a gap or a new epoch also reconciles; nothing is concatenated across a gap (11.370845ms)
+✔ E5: an unknown native event gives no client event; evidence records its type and bytes; the terminal count goes up (211.888878ms)
+✔ E6: a tool result delayed across a pause and a reconnect is reconciled without a manual refresh (224.971899ms)
+✔ E7: the terminal renders the same stream as the library client, as observer and then as controller, and submits only as controller (244.695617ms)
+✔ terminal: engine control characters are made visible; a lost connection refuses submit (185.298035ms)
+✔ terminal: outcome unknown is shown as such, with no resend offer, and nothing is resent (0.404376ms)
+✔ terminal: text after Enter in the same input chunk starts the next message; it never joins the one submitted (0.307182ms)
+✔ terminal: a paste-start marker split right after its ESC still opens the paste; the Enter inside it never submits (0.319148ms)
+✔ terminal: Ctrl-T then Enter in one chunk is judged after the takeover, as if typed one key at a time (Filbert F2, #1507) (0.474678ms)
+✔ terminal: input held behind Ctrl-T waits for that takeover while an earlier action is still pending (Darkwing T1 on #1522) (30.767014ms)
+✔ terminal: a hold inside held input holds again, and once it is drained later input and Ctrl-C still reach the terminal (Darkwing note 1 on #1522) (0.456027ms)
+✔ terminal: an action that throws still releases the input held behind it, in order, then rethrows (5.654716ms)
+✔ terminal: after an action throws, later input still runs; input() puts the error in the status line (Filbert N1 on #1522) (0.352166ms)
+✔ terminal: input() reports an error when it happens, so it never overwrites a later status; held input's promise doesn't carry the holder's error (Filbert N4 on #1522) (0.319669ms)
+✔ terminal: invisible and bidi characters are made visible; head, status and notice lines stay one line (0.096423ms)
+✔ every record these fixtures produced is a valid CHAT-01 record (E5: no record fails the schema) (214.47233ms)
+✔ H1: two takeovers with the same expected generation: one wins, +1; the other refuses generation (244.843392ms)
+✔ H2: the old controller's prompt after a takeover commits is refused with zero engine bytes (274.971969ms)
+✔ H3: a takeover while a prompt holds the dispatch lock: written under the old actor, or refused; never both (777.724874ms)
+✔ H4: self-takeover is refused (182.381387ms)
+✔ H9: Interrupt racing a prompt's dispatch: before the write, dispatch-refused and no-turn; after, §3 rules (428.780409ms)
+✔ H10: Interrupt and force stop together: one stop chain, force stop supersedes (1062.889927ms)
+✔ H10: an overlap during the pause before the abort: no abort, the stop ends uncertain (208.322666ms)
+✔ H10: a no-turn Interrupt lifts only its own fence; admission stays closed under force stop, overlap or revocation (547.709146ms)
+✔ H11: the controller disconnects mid-turn: work continues, the claim is unchanged, control stays put (255.944032ms)
+✔ H12: an exact retry after reconnecting to the same incarnation returns the same receipt; one dispatch (121.416504ms)
+✔ H13: a retry with the same request ID and different text is refused (190.734394ms)
+✔ H14: late stdout from the old engine after a replacement is dropped by incarnation, counted, never rendered (580.717821ms)
+✔ H15: a revoked connection's command is refused; the revocation fence holds (285.002371ms)
+✔ H16: a second controller for the same session refuses already-active; the first is untouched (191.357816ms)
+✔ H10: a second force stop while the first escalation runs refuses fenced; one escalation, and the claim records only the first stop's phases (836.303671ms)
+✔ a force stop whose fence throws leaves no escalation flag behind, so the next force stop runs (Darkwing F2, #1507) (347.457004ms)
+✔ H17: a confirmation reused, answered from another connection, or used after the stop changed is refused (749.422082ms)
+✔ H18: two prompts before any native output: the second refuses busy; one engine write (200.229684ms)
+✔ H19: the pipe fails mid-line under a large prompt: delivery-unknown transport-unknown, poisoned, no later write (352.626134ms)
+✔ H19: the link itself never writes again after an unknown outcome, whoever calls it (0.653458ms)
+✔ H19: the controller dies mid-write of a large line: after restart the outcome is unknown and nothing is resent (662.657411ms)
+✔ H20: the line is written but the ack is lost when the controller dies: orphan, outcome unknown, nothing resent (553.14761ms)
+✔ H21: a retry of the exact request with the old token after a crash is stale-incarnation; no second write (706.683997ms)
+✔ H22: after H21 and a valid recovery, a new request with the new token is admitted (3032.925722ms)
+✔ H23: requests pending at a restart are not resent; each shows outcome unknown (652.458877ms)
+✔ no shim from this file's tests is left running for the after hook (4.154519ms)
+✔ a plain conversation: catalogue row, one page, CHAT-01 records (5.702977ms)
+✔ native entries map to blocks: tools, thinking, bash, notices, ids that do not fit (1.501231ms)
+✔ F1: a malformed line is an unavailable part at its position, and reading continues (1.491954ms)
+✔ F1: a missing parent stops the history with a notice that names the unreadable lines (2.18843ms)
+✔ F1: an unreadable fork is never merged into another branch's history (1.440459ms)
+✔ F1: a follow stays on its branch when the next entry's parent is unreadable (1.920728ms)
+✔ F1: a file whose entries are all unreadable shows a notice per line (0.715687ms)
+✔ F2: a truncated trailing line marks the view incomplete, not an error (1.130792ms)
+✔ pagination: 100 parts, then the rest; parts concatenate to the whole branch (3.31295ms)
+✔ F3: a replaced file (new inode) refuses old cursors with reconcile (4.129541ms)
+✔ F4: a same-inode rewrite of the prefix refuses old cursors with reconcile (5.255794ms)
+✔ F5: growth between pages keeps the epoch and the page stops at the pinned length (5.09469ms)
+✔ F6: unknown, foreign and expired cursors refuse and leave the cursor usable (7.243011ms)
+✔ F7: a symlinked file and a symlinked directory component are refused, never opened (8.619325ms)
+✔ F8: a file swapped for a symlink after the catalogue is refused (1.863438ms)
+✔ F9: registrations never add or redirect a root (1.804425ms)
+✔ F10: a header cwd naming another project is refused (4.429309ms)
+✔ F11: parentSession renders with a marker and the parent is never opened (0.76195ms)
+✔ F12: two leaves: the default leaf is shown and the other branch reads alone (4.228056ms)
+✔ F12: a follow refuses when an appended duplicate id changes the branch's earlier parts (2.154135ms)
+✔ F12: a second root (Pi's resetLeaf) starts its own branch (1.422804ms)
+✔ F13: compaction is a marker in place, then the retained content (0.800413ms)
+✔ F14: long strings split into fragments and parts, reassemble exactly, and pages respect the byte cap (491.735584ms)
+✔ fragments never cut a surrogate pair and keep an empty string (4.377041ms)
+✔ F15: a Claude seat is an unsupported-harness placeholder whose directory is never read (1.333748ms)
+✔ unknown conversations, empty files and non-Pi files refuse (2.087611ms)
+✔ an unreadable file or root inside the roots is refused per row, not a failed catalogue (0.97058ms)
+✔ a seat directory without search permission refuses that root, not the catalogue (1.796199ms)
+✔ every page and cursor is a valid CHAT-01 record (738.28955ms)
+✔ the engine pin holds for the installed package (1.634626ms)
+✔ pinned Pi, sealed and without credentials, answers the controller's commands with the shapes the fake models (261.112259ms)
+✔ sealed, pinned Pi ignores a trusted project's .pi resources; --approve past the seal would load them, and checkSeal refuses it (Filbert F2 on #1522) (489.593675ms)
+✔ pinned Pi appends thinking_level_change at start when the branch lacks one, so the leaf moves (K8 then fails closed) (239.860452ms)
+✔ N25: ordinary Interrupt reconciles; a non-empty queue_update in the window is O5 (455.790291ms)
+✔ N1: an extension's follow-up queued after the fence is cleared before any abort; O5, Unknown (420.636514ms)
+✔ N1: a follow-up queued before the fence is O5 at once; the Interrupt refuses fenced (219.046257ms)
+✔ N2: with abort first, the fake runs the external item (the ordering guard has teeth) (20.877183ms)
+✔ N3: the fence lands in preflight, preflight errors, no run: failed, No run, uncertain (334.972411ms)
+✔ N4: the ack arrives after the first abort and a run starts: clear and abort again; Interrupted (195.212304ms)
+✔ N5: an input handler takes the prompt: ack, no run, delivery-unknown handled-without-run (294.50165ms)
+✔ N6: an extension queues between clear_queue and abort: O5 and O6, Unknown (494.138328ms)
+✔ N7: clear_queue times out: no abort, nativeQueue unknown, force stop still ends it (1888.639649ms)
+✔ N7: clear_queue answers an error: no abort, nativeQueue unknown, the link not poisoned (185.298637ms)
+✔ N8: an extension prompt starts a run during Mosaic preflight; the losing settle is O3 (274.570761ms)
+✔ N9: a run that started before the fence and ends aborted: failed interrupted, Interrupted (161.886846ms)
+✔ N9: decision 34: a run that ends aborted with no stop in progress: aborted-without-stop, uncertain, outcome unknown (216.35931ms)
+✔ N9: an aborted that lands after the fence but before any abort is written: aborted-without-stop, Unknown (372.906004ms)
+✔ N10: fake conformance (31.70594ms)
+✔ N11: the run fails before any user message_start: delivery-unknown ack-without-start, never failed (420.062814ms)
+✔ N12: input that starts a run after the final empty clear is O1 and not part of the stop's proof (269.754234ms)
+✔ N13: agent_start with no slot held is O1; a later prompt refuses with zero engine bytes (288.56439ms)
+✔ N14: the run completes while clear_queue is in flight: finished, Completed first, uncertain (364.776494ms)
+✔ N14: the run completes after the abort is written, before Pi applies it: finished, never relabelled (352.325278ms)
+✔ N15: the fence lands in preflight, then an input handler takes it: handled-without-run, No run (347.459796ms)
+✔ N16: Interrupt with no slot and no run refuses no-turn: no stop, no bytes, admission open (181.076842ms)
+✔ N17: the run fails on its own during the exchange: failed, Failed on its own (342.415294ms)
+✔ N18: no final assistant message_end, or a lost line: working stays working; before working, transport-unknown (679.800173ms)
+✔ N19: a losing extension prompt settles inside the Mosaic run before its user message: O3, run-overlap (533.164474ms)
+✔ N20: an extension triggerTurn during Mosaic preflight starts first; while streaming it queues with no signal (474.421414ms)
+✔ N21: a losing settle after the receipt settled finished is O2; the receipt stays finished (258.813691ms)
+✔ N22: an agent-level custom message is dropped by the clear with no signal; evidence names the seal (198.132156ms)
+✔ N23: a nextTurn message survives clear and abort and attaches to the next prompt, with no signal (189.242667ms)
+✔ N24: the seal is an allow-list: --extension, a missing --no-* flag, a second --mode or --session, a session or output flag, or a stray word refuses unsealed-engine; no engine starts (266.326308ms)
+✔ N24b: the seal covers the engine command and environment: config can't name either, the env is built from names, and a mutated command is refused at bind (184.30357ms)
+ℹ tests 182
+ℹ suites 0
+ℹ pass 182
+ℹ fail 0
+ℹ cancelled 0
+ℹ skipped 0
+ℹ todo 0
+ℹ duration_ms 47503.069964
diff --git a/agents/darkwing/work/queue-110/r1/gate/pkg-discord.log b/agents/darkwing/work/queue-110/r1/gate/pkg-discord.log
new file mode 100644
index 000000000..49300393b
--- /dev/null
+++ b/agents/darkwing/work/queue-110/r1/gate/pkg-discord.log
@@ -0,0 +1,186 @@
+✔ approvals: a request is validated before anything is posted; the rendering shows names and never ids (2.996564ms)
+✔ approvals: the ledger is appended and folded into open requests with bind and approval states (1.524688ms)
+✔ approvals: a reply approves only when it points at a request, says exactly approve, and comes from a listed approver once (0.561321ms)
+✔ approvals: a button approves only on its own request message with the matching custom id (0.483705ms)
+✔ approvals flow: a turn that opened a request posts the message with the button, records it, binds it, and both approvers approve (14.953052ms)
+✔ approvals flow: a non-approver, a repeat, a wrong custom id and a service refusal each get their fixed line and a drop entry (6.569049ms)
+✔ approvals flow: an invalid request from the model, a refused post, and no api client are recorded and post nothing (5.442994ms)
+✔ approvals flow: start retries a bind and an approval left as unknown, under their original keys (2.139459ms)
+✔ authorize: open channel, listed user (1.869093ms)
+✔ authorize: wrong guild (0.181822ms)
+✔ authorize: no guild (DM) (0.174154ms)
+✔ authorize: unlisted channel (0.174105ms)
+✔ authorize: unknown channel, no info (0.256315ms)
+✔ authorize: thread of listed parent (0.179483ms)
+✔ authorize: thread of unlisted parent (0.137141ms)
+✔ authorize: text channel that is not a thread and not listed (0.130538ms)
+✔ authorize: unlisted user (0.186334ms)
+✔ authorize: no author (0.283661ms)
+✔ authorize: bot author (listed id, bot flag) (0.419145ms)
+✔ authorize: system author (0.102389ms)
+✔ authorize: the bot itself (0.06431ms)
+✔ authorize: webhook (0.070874ms)
+✔ authorize: mention channel without mention (0.144077ms)
+✔ authorize: mention channel with bot mention (0.322869ms)
+✔ authorize: mention channel with @everyone only (0.079615ms)
+✔ authorize: mention channel mentioning someone else (0.08229ms)
+✔ authorize: mention channel, content says @bot but mentions empty (0.070476ms)
+✔ authorize: private thread under mention channel, mentioned (0.070432ms)
+✔ authorize: private thread under mention channel, not mentioned (0.0618ms)
+✔ authorize: thread in another guild per channel info (0.061662ms)
+✔ authorize: not an object (0.070671ms)
+✔ authorize: no id (0.059759ms)
+✔ authorize: oversize content is accepted and flagged (0.070297ms)
+✔ authorize: exactly the limit is not oversize (0.055382ms)
+✔ authorize: a user's channel allowlist drops them outside it, threads count as the parent, others are unaffected (2.967738ms)
+✔ authorize: order puts wrong guild before user, and user before channel (no channel lookup for strangers) (0.176935ms)
+✔ binding: a complete binding validates and is frozen (2.35202ms)
+✔ binding: unknown key, missing field, wrong type refuse with exit 2 (1.20726ms)
+✔ binding: empty allowlists refuse (0.478717ms)
+✔ binding: a user's channel allowlist must be non-empty, listed and unique; absent means every listed channel (1.342531ms)
+✔ reloadDiff: reloadable keys are summarised by id; every fixed key refuses with exit 2 (1.522851ms)
+✔ binding: dmRecipient is optional, a snowflake, one of the listed users, and a fixed key (0.430757ms)
+✔ binding: file must be 0600, regular, not a symlink (1.440713ms)
+✔ binding: token file mode, symlink, emptiness and shape are checked; token never appears in errors (1.20982ms)
+✔ cli: check refuses a non-0600 token file with exit 2 before any network use (80.493593ms)
+✔ context files: absolute paths, traversal, symlinks and out-of-repo targets refuse; in-repo files resolve (1.697389ms)
+✔ cli: check refuses a missing context file and a missing binding with exit 2; usage is exit 4 (282.564445ms)
+✔ cli: reload validates the file first (exit 2), then needs a live owner (exit 1); usage is exit 4 (173.066802ms)
+✔ cli: run refuses when STOP is present, before any network use (114.878196ms)
+✔ binding: tools is optional, validated strictly, a fixed key for reload, and its roots are resolved against the data root (1.659849ms)
+✔ binding: a git key is validated at load and reaches the extension whole, and only on a writable root (1.131023ms)
+✔ delivery: an accepted message is in the inbox before the turn, the reply is chunked with one nonce per chunk, and the turn record is write-once (15.200176ms)
+✔ delivery: refused and unknown outcomes are journaled; a later chunk is not sent after a failure (14.190752ms)
+✔ delivery: restart with an unknown entry re-sends the same nonce once and reconciles before accepting traffic (1.356921ms)
+✔ delivery: an unknown entry older than the dedupe window is marked refused, not re-sent; a still-unknown one refuses start (1.126053ms)
+✔ delivery: repeated unknown reconciliations never refresh the dedupe window; the original intent time decides (1.428219ms)
+✔ turn: a failed engine turn posts the fixed line, never model output, and writes a failed record (2.276244ms)
+✔ turn: a second message during a turn is held by the engine, both get their own reply and record (34.981173ms)
+✔ turn: a thread under a listed channel is answered in the thread; an unknown thread is looked up once (2.698998ms)
+✔ drop: an unlisted user gets silence and one drop line; no inbox entry, no REST call, no engine call (0.632772ms)
+✔ drop: an oversize message is accepted into the inbox, answered with the fixed line and journaled as a drop (0.617781ms)
+✔ restart: an inbox with three ids and a replay of the same three produces zero turns (40.401229ms)
+✔ stop: STOP present refuses start; STOP written while running refuses new turns and the current one finishes (31.567994ms)
+✔ ceiling: the ceiling plus one is refused and journaled; one fixed line per UTC day; a new day accepts again (4.992572ms)
+✔ ceiling: a burst arriving while turns are still running cannot queue past the ceiling (3.52787ms)
+✔ ceiling: a turn interrupted by a crash still counts after restart; admissions are durable (2.224347ms)
+✔ ceiling: the daily notice survives a same-day restart; one delivery attempt in total, even when the first attempt crashed mid-flight (3.1451ms)
+✔ duplicate: the same event delivered twice while the thread lookup is held yields one prompt, one admission and one reply (1.010938ms)
+✔ journal: no token-shaped string and no model output on the drop path reaches disk (0.359405ms)
+✔ receipt: an admitted message gets one eyes reaction on the inbound message; drops and refusals get none; a failed reaction is recorded and does not fail the turn (1.985305ms)
+✔ receipt: Discord refusing the reaction leaves the turn intact and records ok false (1.801977ms)
+✔ reload: a new user is silent before and answered after; a removed channel goes silent; a lower ceiling applies at once (3.69238ms)
+✔ reload: a fixed key refuses with exit 2 and the old binding stays in force (0.821568ms)
+✔ tools: with a tools binding the turn record lists every read and its outcome; without one the field is null (3.463837ms)
+✔ context: the Discord block names the server, channels and modes, and states the rules from Q15 and Q16 (2.416866ms)
+✔ context: with tools the block names the roots, keeps file content as data, and says to state refusals plainly (0.857595ms)
+✔ context: a writable root adds the write rules and says a write is real only once Jason commits (1.78213ms)
+✔ context: the envelope is one bracketed line then the text; names cannot break the line (1.175021ms)
+✔ context: a git root swaps the terminal-commit line for the git verbs, and a vault root adds the id protocol (1.40295ms)
+✔ context: assembleContext concatenates files in launcher format and appends the block; sha256 is stable (1.178228ms)
+✔ context: splitReply keeps paragraphs together under the limit and splits long ones at lines, spaces, then hard (0.646755ms)
+✔ engine: buildPiArgs carries the fixed flags, engine settings, session dir and prompt file (2.315253ms)
+✔ engine: with tools, buildPiArgs turns pi's own tools off, loads the extension explicitly and allowlists exactly our three (0.425334ms)
+✔ engine: a run with tool turns settles once, on the answer, with every tool call in the result (45.99967ms)
+✔ engine: a run that ends on a tool-only turn fails the prompt as empty; a retried run settles on the real end (28.969647ms)
+✔ engine: one prompt, one turn, text and usage come back (26.49034ms)
+✔ engine: a prompt while streaming is held until pi settles, then sent as its own run, and answered in order (338.307411ms)
+✔ engine: a held prompt that times out before pi settles fails on its own and is never sent (226.001672ms)
+✔ engine: timeout sends abort and fails only that turn; the process stays (104.058044ms)
+✔ engine: tool events from a run that outlived its timeout never land in the next prompt's record (229.993068ms)
+✔ engine: a prompt after a turn that timed out before its agent_start waits for pi to settle instead of being refused (125.035041ms)
+✔ engine: when pi has not started a timed-out turn by the end of the abort grace, the engine stops pi and fails held prompts (212.982189ms)
+✔ engine: a timed-out turn pi starts only after the grace never answers a later prompt (615.22778ms)
+✔ engine: late events of a run past its grace, before pi exits, answer nothing and nothing more is sent (early prompt response) (1.287735ms)
+✔ engine: late events of a run past its grace, before pi exits, answer nothing and nothing more is sent (late prompt response) (0.529476ms)
+✔ engine: a timed-out run pi did start outlives the grace; the next prompt goes out when it ends (427.165976ms)
+✔ engine: a malformed JSONL line fails the turn, not the process (23.754275ms)
+✔ engine: a turn that ends in error rejects with the error code; process exit fails pending turns (46.324991ms)
+✔ gateway: hello -> identify with intents, ready, heartbeat with jitter, ack (2.529715ms)
+✔ gateway: missed ack closes the socket and resumes with the last sequence (1.373234ms)
+✔ gateway: op 7 reconnect resumes; op 9 non-resumable re-identifies (0.46683ms)
+✔ gateway: op 9 resumable resumes (0.344072ms)
+✔ gateway: close 4014 is fatal, reports the missing intent, never reconnects (0.73529ms)
+✔ gateway: 4004 and 4013 are fatal too; 1006 reconnects with identify when no session (0.494986ms)
+✔ gateway: close() is final and unparseable frames are ignored (1.747365ms)
+✔ git: config validation is strict, needs write: true, a work tree and a private token file (54.764441ms)
+✔ git: the child environment drops every host git config, names one helper, and carries the token path only for origin (34.7674ms)
+✔ git: status reports the branch, ahead/behind and changed paths, and refuses off the named branch or mid-merge (57.752874ms)
+✔ git: parseStatus reads porcelain v2 including renames and conflicts (0.278733ms)
+✔ git: a commit stages exactly the named files, carries the seat author and the requester trailer, and pushes at once (69.15945ms)
+✔ git: commit refusals: message, paths, requester, nothing to commit, and an index that already holds other work (80.299876ms)
+✔ git: a commit whose push fails is still a commit, says so, and the next commit's push carries both (D6) (76.059653ms)
+✔ git: pull is fast-forward only; a diverged origin or dirty local files refuse with nothing merged (162.612921ms)
+✔ git: push pushes the named branch only and reports up to date (63.052452ms)
+✔ git: no token value or token path ever reaches a git argument list; outputs are masked and capped (74.556947ms)
+✔ git: the credential helper answers get over https from a private file and nothing else (179.231514ms)
+✔ git: the vault protocol validates before a commit, honours another owner's lock, reserves ids, and locks around writes (694.310317ms)
+✔ lock: the claim is exclusive; a second start against a live owner refuses (5.474373ms)
+✔ lock: a stale lock (dead owner, reused pid, or record without start) refuses run and is never signaled; only unlock clears it (60.444035ms)
+✔ lock: an incomplete claim (directory without owner record) is busy and refuses run; unlock clears it (0.646374ms)
+✔ lock: an owner record that exists but cannot be read is invalid: never signaled, never removed, never claimed over (2.361461ms)
+✔ lock: legacy upgrade; a live connector holding a {pid, start} record is unknown, unlock refuses and nothing changes; after it exits, unlock clears it (34.728266ms)
+✔ lock: a live pid whose record carries a malformed or noncanonical start or boot string is unknown, not a mismatch; nothing signals, removes, or claims over it (276.691971ms)
+✔ lock: identity syntax; only canonical unsigned decimal start ticks and lowercase boot uuids are identities (0.35848ms)
+✔ lock: a process whose start marker or boot id cannot be read refuses to claim (22.030795ms)
+✔ lock: a live pid whose identity cannot be read right now is unknown: never signaled, never removed, never claimed over (0.89244ms)
+✔ lock: four processes racing for the same binding; exactly one claims it and the others refuse (33.058751ms)
+✔ lock: stale handoff; concurrent starts over a stale lock all refuse, nothing reclaims, one unlock then exactly one live owner (124.850676ms)
+✔ lock: four-party schedule; claims landing inside an unlock's gap never survive, one unlock leaves no owner and no residue (76.386004ms)
+✔ notices: a kind is recorded per UTC day and found again (0.415442ms)
+✔ notify: the DM channel opens once, every send carries the nonce, and only the message id comes back (4.577605ms)
+✔ notify: refusals and unknowns surface as RestOutcome without ids; a refused send reopens the channel next time (1.904711ms)
+✔ notify: no dmRecipient, a non-0600 binding or token, or a missing binding refuse before any network use (1.323751ms)
+✔ recover: nothing to do is clean; a lock whose owner is gone or that has no record is cleared and STOP ends up absent (40.980413ms)
+✔ recover: an operator STOP refuses with exit 3 and is never removed, whatever the lock says (28.866022ms)
+✔ recover: a brake written during the unlock wins; STOP stays with both lines and the start is refused (25.88861ms)
+✔ recover: a held binding refuses with exit 3 and writes no STOP: live owner, alive pid without verifiable identity, unreadable record (64.884023ms)
+✔ cli: recover exits 0 when ready, 3 behind a brake or a held binding, and run's own STOP refusal is 3 (584.435328ms)
+✔ rest: createMessage sends nonce, enforce_nonce, empty allowed_mentions and a soft reply reference (2.344178ms)
+✔ rest: 429 waits retry_after and retries; 4xx is refused; 5xx and socket errors are unknown (2.731778ms)
+✔ rest: content and nonce limits are enforced locally; typing never throws (0.723531ms)
+✔ rest: react PUTs the encoded emoji on the inbound message for @me; 2xx is true, anything else is false and never throws (0.644287ms)
+✔ rest: createDm posts the recipient and resolves the channel id; 4xx refused, 5xx unknown, bad id never sent (0.77729ms)
+✔ setspark config: a bare https or loopback origin, a private key file, a principal (4.666801ms)
+✔ setspark config: reaches the tools config and the binding as a fixed key (2.852466ms)
+✔ setspark config: the binding's key survives resolveToolRoots and the engine's JSON hand-off to the extension (1.536698ms)
+✔ setspark config: approvers come from the binding's users, never from the binding's setspark key (2.022426ms)
+✔ setspark verbs: required_approvers go out as discord ids from names and come back as names (18.214963ms)
+✔ setspark verbs: no Discord user id reaches tool text, whatever shape the service returns it in (6.497833ms)
+✔ setspark contract: a decision made with names opens a request the connector accepts; names stored by an old record still refuse (4.360519ms)
+✔ setspark keys: read per call, one printable token per file, rotation without a restart (2.393499ms)
+✔ setspark idempotency keys: principal, turn id, call index; connector keys name a step (0.402697ms)
+✔ setspark http core: json in and out, bearer header, idempotency header, fixed user agent, no key anywhere else (1.800124ms)
+✔ setspark http core: error bodies become fixed refusals with code and the 409 fields; server text is data, cut (1006.702805ms)
+✔ setspark verbs: a setspark key enables the eight verbs and no counters (0.442672ms)
+✔ setspark verbs: writes carry the turn's key and the asserted requester, reads carry no key, and the api key never appears in text or details (5.857966ms)
+✔ setspark verbs: no turn refuses every write before any request; bad arguments refuse before any request; reads still work (1.162985ms)
+✔ setspark verbs: renderRecord caps long output and hides the accepted snapshot (0.193653ms)
+✔ setspark api: bind, add_approval (button and reply) and get use integer request ids and the connector's keys (2.207521ms)
+✔ tools: config refuses a missing, symlinked, dotted, non-directory or duplicate root and bad limits (4.273581ms)
+✔ tools: every escape is refused with a fixed reason and nothing outside the root is read (4.201667ms)
+✔ tools: happy paths list, read a window, and search case-insensitively; dotfiles and symlinks never appear (4.803581ms)
+✔ tools: the tool set renders text for the model, records details for the journal, and enforces the per-run budget (3.093656ms)
+✔ tools: listing and search caps hold (8.456069ms)
+✔ tools: credential shapes are caught; ordinary prose and ids are not (0.596654ms)
+✔ tools: the read uses the checked file itself; a symlink, a swapped file, a FIFO, a grown file or a hard link at read time is refused (3.899443ms)
+✔ tools: an unreadable file under the root is skipped by search and refused by read (0.888057ms)
+✔ tools: config accepts write: true only as a boolean, and enables the write tools only then (0.849259ms)
+✔ tools: every write outside the fence is refused before any byte lands, and no temp file remains (4.760631ms)
+✔ tools: write_file leaves the exact bytes, edit_file replaces one exact match, and the set renders the change as uncommitted (1.970447ms)
+✔ tools: a target that changed between the check and the rename is refused and the temp file is removed (1.762801ms)
+✔ web: config takes an https or loopback-http SearXNG base url and a bounded fetch cap (3.072023ms)
+✔ web: address rules refuse every private, loopback, link-local, mapped and multicast form (2.024133ms)
+✔ web: web_fetch refuses bad urls, private hosts, rebinding names, non-https redirects, too many hops, error status, non-text bodies, and times out (1027.202322ms)
+✔ web: web_fetch returns html as text with the title, follows an https redirect, keeps plain text and json, and cuts at the cap (4.215428ms)
+✔ web: html to text drops scripts, styles and comments, decodes entities and keeps block breaks (0.220182ms)
+✔ web: web_search asks the instance for json, returns at most ten clean results, and refuses a bad query, a down instance or an unusable answer (2.549449ms)
+✔ web: the tool set enables the web tools only with a web key, counts them in the budget, and records url, status and hits (2.137363ms)
+ℹ tests 178
+ℹ suites 0
+ℹ pass 178
+ℹ fail 0
+ℹ cancelled 0
+ℹ skipped 0
+ℹ todo 0
+ℹ duration_ms 2568.633148
diff --git a/agents/darkwing/work/queue-110/r1/gate/pkg-harness.log b/agents/darkwing/work/queue-110/r1/gate/pkg-harness.log
new file mode 100644
index 000000000..5f88eff5f
--- /dev/null
+++ b/agents/darkwing/work/queue-110/r1/gate/pkg-harness.log
@@ -0,0 +1,88 @@
+✔ sessionModel: agent vars win, then the system's execution settings (8.970286ms)
+✔ a pi bundle: prompt, policy, tools and manifest, 0600 in a 0700 directory (4.238711ms)
+✔ a claude-code bundle adds the wrapped gate hook and the MCP config (2.846735ms)
+✔ the prompt's built-in tools line is the harness's own names, as the manifest lists them (11.702305ms)
+✔ the prompt names the project clones in the workspace, and none when there are none (7.778364ms)
+✔ the prompt explains the review loop to a role with push_working, and reviews to one with fetch_review (8.922697ms)
+✔ a bundle is written once: an existing file refuses (1.538376ms)
+✔ a path with a single quote can't go into the hook command (1.477896ms)
+✔ allow exits 0, a deny exits 2 with the reason on stderr (113.868933ms)
+✔ a missing or wrong policy, or a bad event, exits 2 (83.573944ms)
+✔ the bundle's wrapped command: a missing gate or node still blocks (1087.259508ms)
+✔ claude: typed tools through MCP, the hook blocks, builtins outside --tools don't exist (769.143007ms)
+✔ claude: the hook alone blocks a path outside the workspace (449.357668ms)
+✔ claude: a second turn resumes the first turn's session (769.594822ms)
+✔ claude adapter: --restricted is always passed (5.21017ms)
+✔ claude adapter: MOSAIC_CLAUDE_BIN wins over PATH and must be an absolute executable (20.159965ms)
+✔ claude adapter: a directory pin exits 2 before it runs; a pin with a space runs (5.571463ms)
+✔ claude: CLAUDE.md files and auto-memory don't reach the model; without --restricted they do (733.744695ms)
+✔ claude: a missing hook or MCP file refuses before claude starts (7.261434ms)
+✔ pi: policy tools and typed tools pass, anything else is blocked (4.166813ms)
+✔ claude: builtins map from pi names, typed tools need the mcp prefix (0.833573ms)
+✔ file tool paths must resolve inside the workspace (1.259141ms)
+✔ pi's own path normalisation can't be used to step out (0.93917ms)
+✔ a symlink inside the workspace that points out is outside (0.78945ms)
+✔ a dangling symlink is refused at any depth, in both harnesses (2.602575ms)
+✔ read is checked under every spelling pi's read would open, in both harnesses (14.615549ms)
+✔ other spellings cover directories, dangling links and pi's cwd (1.431555ms)
+✔ a relative path climbs from the workspace's real path, in both harnesses (4.939839ms)
+✔ claude path fields per tool (2.664239ms)
+✔ glob patterns stay inside the workspace (1.541148ms)
+✔ a path that can't be checked is blocked (0.407067ms)
+✔ fetch_review's have lists the working refs before origin's, and no more than HAVE_MAX (205.492658ms)
+✔ fetch_review's have orders the working refs newest first within each clone, one clone after another (153.682769ms)
+✔ a runner git past its time: SIGTERM reaches its process group, and SIGKILL follows after the grace period (1809.295395ms)
+✔ once a signalled runner git has closed, its group gets SIGKILL, so a process that ignored SIGTERM dies too (304.422549ms)
+✔ initialize, ping and tools/list (43.470996ms)
+✔ tools/call goes through the tool socket; a refusal is an isError result (35.284349ms)
+✔ replies are compact JSON; over the cap a tool error names the size and the cap (39.73199ms)
+✔ unknown tools and methods are JSON-RPC errors and never reach the socket (30.773489ms)
+✔ a missing argument is a usage error (28.366071ms)
+✔ pi: typed tools reach the socket, the gate blocks, agent_end writes the marker (390.405442ms)
+✔ pi: a reply over the cap is a tool error naming the size and the cap; list_tasks asks for open tasks (337.974176ms)
+✔ pi: a write through a dangling symlink is blocked, and nothing appears outside (319.5427ms)
+✔ pi: a read is refused when pi would open another spelling outside (317.553243ms)
+✔ pi: a relative path climbs from the real path of a workspace behind a symlink (343.7026ms)
+✔ pi: a relative path climbs from the real path of a dataRoot behind a symlink (315.863192ms)
+✔ pi: a missing extension refuses before any model call (5.557936ms)
+✔ pi: an extension without its configuration fails pi's start (251.59832ms)
+✔ founderCheck: founder variables, then a needed service without a usable token (1.679202ms)
+✔ turnRequest names the sender, class, reply and decision (0.30774ms)
+✔ turnRequest says a tester's message is a test and never Jason's instruction (0.331566ms)
+✔ turnRequest shows the message's own sent time, a day old as well as new (0.205378ms)
+✔ stateBlock names the launch state with its time and event, and the open tasks with the cap (0.321346ms)
+✔ a message becomes a turn, the answer goes back as a RESULT, SIGTERM releases and exits 0 (256.202037ms)
+✔ launches revoked and then restored: the turn's block reads allowed and gives the restore time (234.616086ms)
+✔ a task closed on the tracker is missing from the next turn's open list (274.741324ms)
+✔ a message read a day after it was sent shows the time it was sent (171.79872ms)
+✔ a failed state read fails the turn: no adapter runs, the sender hears why, the message is read (121.965252ms)
+✔ a SIGTERM before the claim stops the runner with exit 0 and no claim (94.691626ms)
+✔ typed tools carry the runner's capability; launch goes to the host's launch socket (439.343223ms)
+✔ a RESULT gets no automatic reply; failed turns reply with the reason (1303.376946ms)
+✔ SIGTERM during a turn kills the turn's process group and still exits 0 (149.352393ms)
+✔ founder credentials stop before the claim (20) (170.422241ms)
+✔ a refused claim exits 21; an ended run's capability exits 22 (182.195128ms)
+✔ the launch ending under a running session exits 22 (143.626848ms)
+✔ a broker that stays unreachable exits 23 after brokerRetries polls (239.705116ms)
+✔ a broker that is down at the claim exits 23, not 21 (82.223333ms)
+✔ no capability, or a malformed one, on stdin exits 2 (182.301051ms)
+✔ a missing or malformed policy exits 2 before the claim (124.605908ms)
+✔ the PM gets launch, its task verbs and the reads (7.002951ms)
+✔ list_requirements reads the requirement ids, for a task.create holder with a tracker (3.548047ms)
+✔ a coder gets no launch, no resolve_decision, and no task tools without a tracker (1.501571ms)
+✔ a coder with a tracker gets its own task tools and no task_reassign (1.242424ms)
+✔ launch only when the business's launch block names the instance as launcher (2.533443ms)
+✔ an action outside the instance's authority has no tool (2.09545ms)
+✔ the review loop: push_working and request_review for the coder, fetch_review and review_verdict for the reviewer, none for the PM (5.258641ms)
+✔ callTool: one JSON line out, the result back, a refusal rejects (7.60395ms)
+✔ list_tasks takes the broker's filters and pages; get_task takes a task_ref (2.110825ms)
+✔ callTool sends list_tasks done false unless the session names done; other tools as given (2.402655ms)
+✔ replyText: compact JSON up to the cap, an error naming the size and the cap over it (0.647169ms)
+ℹ tests 80
+ℹ suites 0
+ℹ pass 80
+ℹ fail 0
+ℹ cancelled 0
+ℹ skipped 0
+ℹ todo 0
+ℹ duration_ms 11177.988231
diff --git a/agents/darkwing/work/queue-110/r1/gate/pkg-ledger.log b/agents/darkwing/work/queue-110/r1/gate/pkg-ledger.log
new file mode 100644
index 000000000..676962d9d
--- /dev/null
+++ b/agents/darkwing/work/queue-110/r1/gate/pkg-ledger.log
@@ -0,0 +1,86 @@
+✔ a raw token file, with or without one trailing newline, reaches curl only through the config stream (104.568094ms)
+✔ the raw path accepts nothing else, and refuses before curl runs (349.712025ms)
+✔ the file checks still apply on the raw path: mode, symlink, missing, directory (263.175202ms)
+✔ the raw path base URL has no override (55.865462ms)
+✔ the JSON path is unchanged, and JSON never falls through to the raw path (229.996335ms)
+✔ a file that changes between the two reads refuses before curl runs, with or without a body (662.323342ms)
+✔ the token reaches no child environment, even with an inherited CFG or SHELLOPTS=allexport (640.904579ms)
+✔ real helper GET HTTP 200 preserves exit 0 without credentials (13.015565ms)
+✔ real helper POST HTTP 201 preserves exit 0 without credentials (10.083331ms)
+✔ real helper GET HTTP 403 preserves exit 1 without credentials (8.664346ms)
+✔ fixture git subjects only, follow-ups and three session kinds (145.1171ms)
+✔ text and JSON carry same numbers, open and truncated title (208.449539ms)
+✔ missing credentials exit 2, no-issues never calls API and shows unknown (167.286502ms)
+✔ empty range gives no rows and zero totals (149.824852ms)
+✔ inclusive UTC dates, first-line preamble only, role and seat boundaries (144.225285ms)
+✔ close-only issue included, even median, missing metadata stays unknown (143.460886ms)
+✔ unique commits but per-issue links count multiple tags once each (140.791908ms)
+✔ page cap refuses rather than silently undercounting (128.276093ms)
+✔ bad API payload not JSON refuses (132.791859ms)
+✔ bad API payload {} refuses (126.319809ms)
+✔ bad API payload [{"number":1}] refuses (132.971277ms)
+✔ partial or malformed session log refuses with location, not content (144.082232ms)
+✔ a U+2028 or U+2029 inside a session string is one line, not a malformed record (142.838676ms)
+✔ no sessions is an empty table; symlink source refuses (202.965535ms)
+✔ reads only refactor even when another branch is checked out (135.942654ms)
+✔ invalid dates, reverse dates and duplicate options refuse (97.343704ms)
+✔ T3 agent assignments do not count as human in Table 2 (137.813713ms)
+✔ preamble parsing and issue number boundaries (0.440429ms)
+✔ T3 header: agent, or board from control-board; anything short of the full header is human (0.137139ms)
+✔ no closed issues with human messages means undefined ratio, not invented zero (0.206164ms)
+✔ T3: seat, archived, unmapped and Researcher threads count; imported, deleted and other-project threads do not (431.378546ms)
+✔ T3: the default path is read from HOME and prints no path line; --no-t3 says so (735.074236ms)
+✔ T3: a HOME with no database exits 1 and names --no-t3 (145.739609ms)
+✔ T3: a file that is not a database exits 1 and names --no-t3 (139.621685ms)
+✔ T3: a seat thread renamed to another seat exits 1 naming thread, title and roles (421.360389ms)
+✔ T3: an unmapped thread addressed as a seat exits 1 (389.669265ms)
+✔ T3: a header to another thread id is not cross-checked (397.516248ms)
+✔ T3: no project, or two, for this root exits 1 (965.55269ms)
+✔ T3: a removed column exits 1 and names it (244.463908ms)
+✔ T3: a missing table exits 1 and names it (235.639112ms)
+✔ T3: a counted row with an unknown role exits 1 without its text (381.140426ms)
+✔ T3: a counted row with non-text content exits 1 without its text (387.398356ms)
+✔ T3: a counted row with an unparseable created_at exits 1 without its text (379.048726ms)
+✔ T3: a missing orchestration_events makes the diagnostic unknown and keeps the counts (684.867218ms)
+✔ T3: a human message with no event counts in humanWithoutEvent (384.896974ms)
+✔ T3: an unparseable event makes the diagnostic unknown and keeps the counts (668.971581ms)
+✔ T3: an event with no string messageId makes the diagnostic unknown and keeps the counts (681.335086ms)
+✔ T3: an error that is not from SQLite is rethrown, not reported as a database failure (327.865555ms)
+✔ T3: a symlink at ~/.t3 exits 1 (135.881721ms)
+✔ T3: a symlink at ~/.t3/userdata exits 1 (130.959231ms)
+✔ T3: a symlink at ~/.t3/userdata/state.sqlite exits 1 (134.071405ms)
+✔ T3: with --t3-db, a symlinked file or directory exits 1 (426.507442ms)
+✔ T3 WAL: the newest message only in -wal, writer attached, is counted (393.616195ms)
+✔ T3 WAL: stopped cleanly, counts are correct and the main file is unchanged (397.265586ms)
+✔ T3 WAL: -wal without -shm in a writable directory is read (417.726301ms)
+✔ T3 WAL: -wal without -shm in a read-only directory exits 1 (388.400007ms)
+✔ T3 WAL: stopped cleanly in a read-only directory exits 1 (372.53093ms)
+✔ T3: a lock held past the 5 s busy timeout exits 1 and names --no-t3 (5386.661456ms)
+✔ a done row whose closing issue is open is a violation; a row that is not done is not (1.748377ms)
+✔ an issue several rows close is expected closed only once all of them are done (0.48058ms)
+✔ closure needs positive evidence: unknown is undecided, and so is a skipped or short issue check (0.358985ms)
+✔ each owner of an in-progress or in-review row gets one liveness class (7.637405ms)
+✔ a required row not done after 14 days is a violation; a legacy row uses genesis as its lower bound (0.419322ms)
+✔ an ISO requiredSince, as `set required` writes it, ages from its UTC day; one that does not parse is a violation (0.2348ms)
+✔ the text section always ends in a count and a result, and never prints a full pass (0.329765ms)
+✔ pidAlive: a running pid is present, an exited one is gone, and EPERM still means present (21.66052ms)
+✔ issue states: open list first, then the metric page, then at most 10 lookups (258.709385ms)
+✔ a full open list: lookups settle what it leaves out, and only an unsettled issue keeps it undecided (347.388325ms)
+✔ the open list refuses on a failed call or a bad record, and never echoes the helper (155.697894ms)
+✔ a helper call past the deadline is killed with its child, and the call reports it (2007.786582ms)
+✔ readQueue loads queue.json through the queue validator and refuses anything else (115.177922ms)
+✔ protected changes list every in-range entry that changes a required or parked row (435.456689ms)
+✔ the CLI prints the queue section above the weekly table and under a queue key in --json (489.82256ms)
+✔ a queue with nothing wrong prints 0 violations and a reduced pass, never a full pass (229.140088ms)
+✔ --no-issues makes no call and leaves the issue checks undecided; --no-queue skips the section (302.542025ms)
+✔ the CLI refuses a bad queue before any call, and a failed open list with exit 2 (285.340191ms)
+✔ --unsupported-runtime repeats once per seat and takes a seat name (330.324455ms)
+✔ an unreadable config makes every owner invalid instead of passing them (158.36826ms)
+ℹ tests 78
+ℹ suites 0
+ℹ pass 78
+ℹ fail 0
+ℹ cancelled 0
+ℹ skipped 0
+ℹ todo 0
+ℹ duration_ms 18716.646696
diff --git a/agents/darkwing/work/queue-110/r1/gate/pkg-mosaic.log b/agents/darkwing/work/queue-110/r1/gate/pkg-mosaic.log
new file mode 100644
index 000000000..6f7e3f333
--- /dev/null
+++ b/agents/darkwing/work/queue-110/r1/gate/pkg-mosaic.log
@@ -0,0 +1,77 @@
+✔ pure resolution selects current default or explicit enrolled account (3.650948ms)
+✔ scope is explicit, bounded and never inferred (3.014675ms)
+✔ fork pin is preserved against default change, override, missing account and revocation (1.165038ms)
+✔ unenrolled account/provider, missing harness, model expansion and native model ceiling refuse (1.055586ms)
+✔ only explicit synthetic credential forms and internal fixture stores admitted (7.289946ms)
+✔ two concurrent workspaces of the same agent publish distinct complete private generations (46.823611ms)
+✔ same execution ID is exclusively claimed and cannot overwrite a published generation (35.101338ms)
+✔ failed generation after-auth preserves prior files, records failure and refuses blind same-ID retry (51.563272ms)
+✔ failed generation before-publish preserves prior files, records failure and refuses blind same-ID retry (62.2424ms)
+✔ credential lock contention refuses without duplicate side effects (12.68012ms)
+✔ symlinked pre-existing final target is refused and never followed (29.928276ms)
+✔ invalid registry cannot resolve; no fallback to supplied partial entries (0.504434ms)
+✔ post-publication failure records uncertainty, preserves complete generation and prevents replay (30.886287ms)
+✔ expired credentials refresh under transaction and subsequent generation reuses rotation (96.164353ms)
+✔ refresh failure retains prior generation and store state (66.055541ms)
+✔ refresh timeout retains prior generation and store state (146.783493ms)
+✔ refresh malformed retains prior generation and store state (63.422402ms)
+✔ concurrent refresh on same account refuses contention while unrelated account proceeds (225.157881ms)
+✔ invalid refresh options refuse before burning claim (31.805217ms)
+✔ fixed fake process rotates both OAuth fields without mutating caller input (43.146603ms)
+✔ concurrent isolated processes preserve separate provider credentials (38.977265ms)
+✔ fake failure is refused with fixed diagnostics (26.090183ms)
+✔ fake malformed is refused with fixed diagnostics (27.336472ms)
+✔ fake timeout is refused with fixed diagnostics (103.784169ms)
+✔ fake unchanged is refused with fixed diagnostics (41.088729ms)
+✔ caller executable/environment injection is rejected before spawning (0.40945ms)
+✔ valid fixture tree validates and lists without secrets (89.387508ms)
+✔ unknown-field refuses (0.51562ms)
+✔ invalid-id refuses uppercase and traversal shapes (0.325634ms)
+✔ plain-http baseUrl requires allowInsecureTransport (0.350264ms)
+✔ native provider rejects allowInsecureTransport (0.246395ms)
+✔ unsupported credential type and kind refuse (0.188461ms)
+✔ account provider-path mismatch refuses (0.804113ms)
+✔ profile account refs must be provider/account shaped (0.273557ms)
+✔ seat selection accepts fork pin field, validates account refs (0.242649ms)
+✔ harness manifest id must equal executable (gate 1) (0.229767ms)
+✔ CLI validate: duplicate provider id across files refuses (40.44644ms)
+✔ CLI validate: missing referenced provider/account refuse (51.074556ms)
+✔ CLI validate: broken JSON refuses without secret echo (36.354145ms)
+✔ CLI usage errors exit 2 (62.864185ms)
+✔ credential.json sibling presence does not break validation and is never read (78.704465ms)
+✔ D1 missing, empty and structurally empty roots refuse, no list projection (237.28875ms)
+✔ D1 required directory auth cannot be absent (75.57094ms)
+✔ D1 required directory auth/providers cannot be absent (64.504454ms)
+✔ D1 required directory auth/accounts cannot be absent (67.762863ms)
+✔ D1 required directory auth/settings cannot be absent (59.551624ms)
+✔ D1 required directory harnesses cannot be absent (62.106424ms)
+✔ D1 root file and unreadable metadata refuse (102.521882ms)
+✔ D2 no symlink traversal at auth/providers/openai-codex.json (55.583343ms)
+✔ D2 no symlink traversal at auth/accounts/openai-codex/homelab-openai (61.463736ms)
+✔ D2 no symlink traversal at auth/providers (51.387062ms)
+✔ D2 no symlink traversal at auth (49.801194ms)
+✔ D2 root and ancestor symlinks and lexical traversal refuse (152.512703ms)
+✔ private filesystem modes enforced for root (52.20383ms)
+✔ private filesystem modes enforced for auth (51.634479ms)
+✔ private filesystem modes enforced for auth/providers/openai-codex.json (55.065357ms)
+✔ private filesystem modes enforced for auth/accounts/openai-codex/homelab-openai/account.json (62.958513ms)
+✔ D3 numeric version 1 only across all record kinds (1.219781ms)
+✔ D4 nested unknown keys and missing per-kind required fields refuse (60.539452ms)
+✔ D5 unenrolled default refuses even when account exists (62.73539ms)
+✔ D6 provider/account credential type must match (61.137184ms)
+✔ D7 every harness endpoint enforces HTTP opt-in and shape (0.460644ms)
+✔ D8 URLs reject embedded credentials and unsupported protocols without echo (160.505385ms)
+✔ D9 malformed JSON diagnostics contain no content excerpt (58.549373ms)
+✔ D10 missing metadata is missing-path, not invalid-json (65.54097ms)
+✔ D10 library returns no partial entries on any invalid record (73.51346ms)
+✔ null/scalar/array metadata refuses without stack or echo (241.25881ms)
+✔ credential sibling is never opened, even when an unreadable symlink (30.997901ms)
+✔ oversized metadata refuses before parsing (62.107808ms)
+ℹ tests 69
+ℹ suites 0
+ℹ pass 69
+ℹ fail 0
+ℹ cancelled 0
+ℹ skipped 0
+ℹ todo 0
+ℹ duration_ms 2204.501458
diff --git a/agents/darkwing/work/queue-110/r1/gate/pkg-queue.log b/agents/darkwing/work/queue-110/r1/gate/pkg-queue.log
new file mode 100644
index 000000000..32cbdafc9
--- /dev/null
+++ b/agents/darkwing/work/queue-110/r1/gate/pkg-queue.log
@@ -0,0 +1,166 @@
+✔ F1: an ordinary commit after update-ref is refused until step 8; then it commits and the queue stays at C (1176.497185ms)
+✔ F1: a plain `commit -e` whose guard ran before update-ref fails at its own HEAD update (1003.152033ms)
+ℹ git commit -e: index.lock free during the editor
+✔ F1: a `commit -e -- path` whose guard ran before update-ref fails at its own HEAD update (997.229063ms)
+ℹ git commit -e -- src.txt: index.lock held during the editor
+✔ F1: step 8 with index.lock held exits 3, and ordinary commits stay refused until the printed command runs (1005.400023ms)
+✔ F1: HEAD moving after the step-7 guard check and before update-ref: refused, nothing published (978.609944ms)
+✔ F1: H is recorded before the canary, so HEAD moving during the step-1 canary is refused at step 7 (980.311657ms)
+✔ F1: a queue commit landing after H is recorded: step 1 says HEAD moved, not the guard (1258.342744ms)
+✔ F1: a queue commit landing between the HEAD check and the canary: the failed clean run is reported as HEAD moved (909.161074ms)
+✔ F1: a shared-index change during the procedure is not committed (1021.92947ms)
+✔ F1: a queue path staged after update-ref: step 8 stops and touches nothing (1003.988492ms)
+✔ F1: a missing or a different hook refuses (699.347656ms)
+✔ F1: same bytes without the exec bit, a symlinked hook, and core.hooksPath in the local or global scope each refuse before update-ref (1155.060048ms)
+✔ F1: the canary refuses a hook that git would not run (652.132157ms)
+✔ F1: the guard deactivated after step 1 is refused at the step-7 recheck (915.060392ms)
+✔ bootstrap: implementation-only HEAD, the guard, genesis, the --genesis commit, then an extending commit (863.831047ms)
+✔ bootstrap: --genesis with a base present, no base without --genesis, an op before the first commit, a changed map, another branch (861.636883ms)
+✔ bootstrap: the archived tests and validator run outside any repository (870.701599ms)
+✔ general: an unrelated staged file stays staged, and the committed blobs are the snapshot bytes (884.049214ms)
+✔ general: a queue write after the snapshot is not committed (1261.389467ms)
+✔ general: a snapshot whose log does not extend the base refuses (936.600534ms)
+✔ general: install-hook privilege, repair of a same-bytes hook, and its refusals (150.458178ms)
+✔ general: environment overrides, a linked worktree and usage (613.393486ms)
+✔ general: a queue path staged before the run refuses at step 1 (648.149443ms)
+✔ general: HEAD's queue tests failing in the archive refuse (838.944552ms)
+✔ genesis document serializes deterministically and replays (3.756863ms)
+✔ a hand edit that stays valid JSON fails replay; a formatting-only edit fails re-serialization (2.144084ms)
+✔ a tampered result, receipt or viewSha fails replay (2.143478ms)
+✔ op ids: 8 to 72 characters for callers, 80 in the log for .outcome entries (0.224272ms)
+✔ add: defaults for an ordinary seat, privileged extras, refusals (5.370324ms)
+✔ matrix: queued→briefed privileged; briefed→in-progress owner with after satisfied (8.552582ms)
+✔ matrix: release, review round, changes requested and waiting-on-jason (14.567935ms)
+✔ matrix J5: in-review→done by the gate owner with evidence naming the current round (12.176721ms)
+✔ review issue, lead decision 23: none refuses, one is used, several need --issue, later rounds keep it (27.325312ms)
+✔ the row schema refuses a round with a null issue, and the A1 review shape (P2) (2.072304ms)
+✔ matrix R1: every state × target × actor class matches 8.7, gate owner jason or not, required or not (1262.26335ms)
+✔ matrix: blocked keeps the claim and returns only to previousState (3.394091ms)
+✔ matrix J4: parking is Jason's, refused while required; unpark returns to queued (2.559849ms)
+✔ field edits: who may change what (4.562314ms)
+✔ set issues keeps a logged narrowing of closes (N10) (2.500116ms)
+✔ text the table shows refuses \ and <, everywhere it enters (N8) (1.621193ms)
+✔ every accepted text renders to nine cells on every row (N8) (21.068031ms)
+✔ genesis: the map refuses an owner among its row's reviewers; replay doesn't (2026-10-04) (0.442287ms)
+✔ times and dates must be calendar values, not just the shape (2026-10-04) (1.434373ms)
+✔ replay holds every op id to the caller's rule (N11) (4.674933ms)
+✔ note: owner, listed reviewer or privileged; empty clears (1.050873ms)
+✔ assign moves the claim with the owner; done clears it (2.289673ms)
+✔ render is byte-stable and escapes pipes (0.456551ms)
+✔ view classification: current, genuine stale, edited stale marker, changed current body, markers (0.58388ms)
+✔ next: resume, then review, then start, then wait, then nothing; lowest id first (17.441785ms)
+✔ canonical args make a retry's identity independent of list order (0.331707ms)
+✔ manifests, headings and blob ids (0.407901ms)
+✔ the migration map: one queue-map block, exact keys (0.570092ms)
+✔ every call but `queue` reaches the seat CLI exactly as before A2 (482.107517ms)
+✔ no argument reaches the app entry in packages/cli, and only that call (60.793534ms)
+✔ `queue` reaches the queue CLI with the rest of the arguments (172.241428ms)
+✔ the pre-A2 fixture is the script A2 changed (0.272948ms)
+✔ an old privileged add with no gate owner still replays through loadDoc, and gets jason (5.087932ms)
+✔ a non-privileged add gets jason through the replay path and can't name a gate owner (1.73814ms)
+✔ the CLI refuses a privileged add without --gate-owner, for jason and sage, and writes nothing (299.937616ms)
+✔ the CLI add with --gate-owner carries the named owner and records a log entry (266.153917ms)
+✔ the CLI add by a non-privileged seat gets jason and can't name a gate owner (300.623117ms)
+✔ a retried sage add recorded with no gate owner answers (already recorded at rev N) and writes nothing (249.002164ms)
+✔ acquire publishes the record by link; release removes only its own lock (11.434119ms)
+✔ a kill between the temp write and the link leaves no lock (49.739278ms)
+✔ a short or failed temp write refuses and leaves no lock and no temp (12.65429ms)
+✔ a link error other than EEXIST refuses (9.479614ms)
+✔ an error after the link releases the lock: unreadable gate, failing temp stat (28.006261ms)
+✔ a release that fails on a gate path is reported, never a stack trace (P1) (37.526281ms)
+✔ a paused holder: another writer waits 10 s, then refuses naming it live (10097.02374ms)
+✔ two concurrent unlockers: the second refuses on the gate (33.571992ms)
+✔ a writer publishing during an unlock, lock first: unlock sees it live and refuses (15.465223ms)
+✔ a writer publishing during an unlock, gate first: the writer releases and refuses (11.126626ms)
+✔ a gate swapped while held is left in place and reported, on success and on refusal (N1) (14.662085ms)
+✔ a reused pid within one boot is mismatch; unlock removes the lock and never signals the process (18.315914ms)
+✔ the same pid and start on a different boot is mismatch (0.404538ms)
+✔ a foreign host is unknown whatever the local pid says; unlock refuses (58.237174ms)
+✔ unreadable /proc: classification is unknown and acquire refuses (0.696063ms)
+✔ invalid records: empty, unparsable, wrong keys, bad start or boot (0.188748ms)
+✔ a stale gate blocks writers; --check-gate says mismatch for a reused pid (12.575925ms)
+✔ a delayed release by a dead owner, after unlock and a new owner: the inode check keeps the new lock (19.044375ms)
+✔ release checks the inode too: a byte-identical lock file with a new inode is left in place (12.433593ms)
+✔ unlock refuses a live, unknown or invalid lock, and does nothing without one (39.875666ms)
+✔ the migration map validates and renders the golden genesis table (3.077403ms)
+✔ the marked QUEUE.md holds every row and parked item between its markers (1.702706ms)
+✔ map-check reports each kind of drift (4.876949ms)
+✔ a request posts once as the requester; a retry sends nothing (803.221985ms)
+✔ each transport answer maps to posted, failed or uncertain (8.9 step 3) (4399.761742ms)
+✔ the pre-send checks: GET user must name the requester, under the deadline (1543.314796ms)
+✔ the lead's request refuses a token for login sage (908.156931ms)
+✔ the credential file: the seat's own, 0600, no symlink, never the shared default (776.647653ms)
+✔ an unresolved request blocks a new request, a new round, waiting-on-jason and done (2206.151566ms)
+✔ a same-op retry after a kill sends nothing, even with a stale view (2964.588155ms)
+✔ a held lock at the outcome exits 3 and names what the transport said (673.270387ms)
+✔ late outcomes: after an abandon, and after a resolve with the same or another id (2121.580738ms)
+✔ resolve checks the comment: issue, markers, round, candidate and author (1643.08266ms)
+✔ the lead resolves a seat's request: the comment's author is the requester, fetched with the lead's token (655.018229ms)
+✔ validateRow checks a request round's shape, which every replayed entry must keep (461.10274ms)
+✔ request, changes, a new candidate, approval: every round pinned; no review files (1674.982825ms)
+✔ a row with no reviewers opens a round that posts nothing (1144.972ms)
+✔ verify-commit: a prospective tree must hold exactly the candidate's paths (1303.302264ms)
+✔ semantics: v1 entries replay as before; review entries need v2 (481.521193ms)
+✔ set reviewers refuses the row's owner (2026-09-28) (342.790394ms)
+✔ the owner records no verdict, even as a listed reviewer (482.828856ms)
+✔ a request comment over the length limit is not sent (541.140683ms)
+✔ a late POST on a closed row leaves a conflict nothing can resolve, and resolve asks nothing (611.116075ms)
+✔ a Jason-gated row reaches waiting-on-jason only on every reviewer's approval (2415.94408ms)
+✔ genesis: refusals before anything is written (399.046857ms)
+✔ genesis: the map must be committed, well formed, with committed briefs and seats (577.664178ms)
+✔ genesis: markers, a stray witness, once only; a retry returns the receipt (544.470276ms)
+✔ genesis: a file holding genesis alone with no witness is confirmed by sync or a retry (389.386268ms)
+✔ canonical checks: worktree, second clone, detached HEAD, wrong branch, GIT_DIR, foreign code; a symlink works (639.287749ms)
+✔ --by that differs from MOSAIC_AGENT_NAME warns on stderr and logs nothing more (N12) (721.531524ms)
+✔ op ids: missing, too long, reserved; a retry answers; another payload refuses (735.571248ms)
+✔ a retried add returns the id it first allocated, after reassignment and after done (913.293859ms)
+✔ Rocko's S4 schedule: a lost result, another writer, then the retry opens no second round (686.522347ms)
+✔ the review issue and the evidence round through the CLI (lead decision 23, 8.7) (1208.913705ms)
+✔ claims and add defaults through the CLI; candidates are manifests or reachable commits (774.309688ms)
+✔ add, set reviewers and assign refuse the row's owner as a reviewer (490.775866ms)
+✔ the working-brief check: a changed working copy refuses the start and flags next (663.292873ms)
+✔ next: resume first, then nothing for an idle seat; needs a seat (308.376312ms)
+✔ view stale: new ops and verify refuse naming the unshown op; retries answer; reads warn; render fixes (659.277608ms)
+✔ view unknown: a hand edit, an old marker over an edited body, missing or duplicate markers (1139.872425ms)
+✔ a hand edit to queue.json refuses every verb, reads included (578.963034ms)
+✔ verify and render --check leave bytes and mtimes unchanged (417.829099ms)
+✔ render is byte-stable across runs and repositories (280.355493ms)
+✔ snapshot and verify --snapshot (745.006524ms)
+✔ usage errors exit 4 (515.021228ms)
+✔ a short write, ENOSPC or a file fsync failure: nothing visible, temp removed (279.58244ms)
+✔ a rename failure: nothing visible, temp removed (195.86515ms)
+✔ a directory fsync failure: uncertain, exit 3, no receipt; the tail refuses new ops; a retry confirms (244.849981ms)
+✔ a directory fsync failure, then sync names the op (360.891225ms)
+✔ a witness write failure: uncertain, durable, exit 3; the view is untouched (225.749536ms)
+✔ the .git fsync after the witness rename fails: uncertain, exit 3, the witness says so (183.000297ms)
+✔ confirming a tail fsyncs queue.json and docs/plans before the witness; either failure changes nothing (224.636701ms)
+✔ the docs/plans fsync after the view rename fails: the op stands, the view is written, a warning says so (212.054318ms)
+✔ a lock swapped while held is left in place and reported, on a receipt and on a refusal (217.426568ms)
+✔ a lock that cannot be released after an op is reported, on a receipt and on a refusal (234.664863ms)
+✔ unlock prints a swapped gate's warning on stderr, the result on stdout (169.544096ms)
+✔ a view write that fails keeps the op and reports a stale view (200.028175ms)
+✔ SIGKILL before the rename: nothing recorded; the retry removes the leftover temp (655.143425ms)
+✔ SIGKILL after the rename, before the witness: the tail refuses new ops and sync names the op (689.634095ms)
+✔ SIGKILL after the witness, before the view: the stale refusal names the op (644.689747ms)
+✔ SIGKILL after the view, before the receipt: the retry returns the receipt (650.778332ms)
+✔ git checkout between steps 1 and 7: step 7 refuses and nothing is written (219.100399ms)
+✔ git stash restoring an older valid pair: history lost; accept-history needs privilege, a reason and --yes (1003.340571ms)
+✔ a deleted witness: refused after the locked recheck; accept-history records it absent (351.787892ms)
+✔ a header edit during a write: the op stands, the view write is skipped with a warning (211.570808ms)
+✔ a reader paused between the witness and the file while a writer finishes: no lost-history report (198.842261ms)
+✔ rows: every row as show prints it, in list order; writes nothing; same notes and refusals as list (246.754683ms)
+✔ file-then-witness order forced by a hook: the locked recheck prevents a false report (191.433735ms)
+✔ a writer paused before and after the witness rename: readers see a tail, then a match (178.721464ms)
+✔ a true rollback is reported only after the locked recheck; a held lock names its holder instead (603.560502ms)
+✔ an accept-history in progress: an unlocked reader waits on the lock and never reports lost history (577.892162ms)
+✔ the platform check refuses other filesystems (157.813737ms)
+✔ tmpfs passes only a test layer that allows it (N5) (228.120088ms)
+✔ unlock keeps a multi-line lock record on stdout (P3) (192.863656ms)
+ℹ tests 156
+ℹ suites 0
+ℹ pass 156
+ℹ fail 0
+ℹ cancelled 0
+ℹ skipped 0
+ℹ todo 0
+ℹ duration_ms 28234.729657
diff --git a/agents/darkwing/work/queue-110/r1/gate/pkg-runs.log b/agents/darkwing/work/queue-110/r1/gate/pkg-runs.log
new file mode 100644
index 000000000..0f7b56c46
--- /dev/null
+++ b/agents/darkwing/work/queue-110/r1/gate/pkg-runs.log
@@ -0,0 +1,51 @@
+✔ isRunId accepts the run id shape and nothing else (0.853125ms)
+✔ a missing data root or runs directory lists nothing (1.32618ms)
+✔ runs as a regular file lists nothing, as before (0.502709ms)
+✔ listRunIds keeps r- names only, sorted oldest first (0.650328ms)
+✔ listRunRecords returns each result, or null for an incomplete or unreadable one (1.688649ms)
+✔ readRunRecord returns documents and artifacts in directory order (0.863539ms)
+✔ readRunRecord is null for a missing run, a dangling link or a file (0.590553ms)
+✔ readRunRecord and readRunDocument refuse an invalid run id before touching the disk (0.556856ms)
+✔ readRunDocument reads only the three run documents (0.427981ms)
+✔ a link inside the data root is followed (0.812158ms)
+✔ a data root that is itself a link is trusted as configured (0.545707ms)
+✔ a run directory linked out of the data root is never read (0.56255ms)
+✔ a document linked out of the data root reads as null (0.735099ms)
+✔ a runs directory linked out of the data root refuses (0.497678ms)
+✔ a relative link that climbs out of the data root refuses (0.351873ms)
+✔ a sibling whose name starts with the data root's name is outside it (0.398119ms)
+✔ a link loop refuses instead of reading as missing (0.531193ms)
+✔ an unreadable runs directory refuses instead of listing nothing (0.353004ms)
+✔ an unreadable run directory refuses instead of reading as missing (0.423071ms)
+✔ a link to the data root's parent is outside it (0.31975ms)
+✔ listRunIds sorts whatever order the directory returns (0.616242ms)
+✔ listRunRecords lists an r- name that isn't a valid run id, as before (0.395964ms)
+✔ the readers write nothing (1.627836ms)
+✔ no pointer is null (1.435815ms)
+✔ the pointer release.sh writes reads back (0.954506ms)
+✔ a pointer that isn't the version 1 shape refuses with exit 2 (1.371863ms)
+✔ a pointer that is a directory refuses with exit 4 (0.932927ms)
+✔ a state file linked out of the data root refuses (0.805482ms)
+✔ a state directory linked out of the data root refuses (0.491513ms)
+✔ a state directory linked out to nothing reads as no release and an empty log (0.402403ms)
+✔ a missing log is empty (0.310946ms)
+✔ the log reads oldest first and counts malformed lines (0.811178ms)
+✔ last must be a positive integer (0.391124ms)
+✔ the state readers write nothing (0.669012ms)
+✔ list prints each run in the established format (61.48075ms)
+✔ list prints a damaged result.json as unknown and keeps listing the runs after it (63.003786ms)
+✔ list prints each result field that isn't a string as unknown or - (59.768867ms)
+✔ show prints the run in the established format (58.761435ms)
+✔ show of a missing run and an invalid id exit 4 as before (89.354769ms)
+✔ list and show refuse a runs directory linked out of the data root (118.139208ms)
+✔ show refuses a run linked out of the data root; list reports it unknown (112.292027ms)
+✔ list shows an r- name that isn't a valid run id, as before (53.782186ms)
+✔ show refuses an invalid id before reading the config (31.932144ms)
+ℹ tests 43
+ℹ suites 0
+ℹ pass 43
+ℹ fail 0
+ℹ cancelled 0
+ℹ skipped 0
+ℹ todo 0
+ℹ duration_ms 698.50859
diff --git a/agents/darkwing/work/queue-110/r1/gate/pkg-seat.log b/agents/darkwing/work/queue-110/r1/gate/pkg-seat.log
new file mode 100644
index 000000000..3309a2818
--- /dev/null
+++ b/agents/darkwing/work/queue-110/r1/gate/pkg-seat.log
@@ -0,0 +1,132 @@
+✔ a first launch clones the root at its branch, with the root's path as origin (32.774499ms)
+✔ the clone is not at its place until git clone has finished (24.162731ms)
+✔ a later launch fast-forwards a clean clone after a commit to the root, then finds it current (69.233708ms)
+✔ a clone ahead of the root keeps its commits and counts as current (45.199333ms)
+▶ a dirty clone, one on another branch and one diverged are kept as they are
+  ✔ a modified file (35.301522ms)
+  ✔ an untracked file (33.122731ms)
+  ✔ a staged file (31.959241ms)
+  ✔ another branch (31.705997ms)
+  ✔ a detached HEAD (30.371542ms)
+  ✔ a diverged branch (47.118002ms)
+✔ a dirty clone, one on another branch and one diverged are kept as they are (210.744294ms)
+▶ a clone with user.name or user.email in its config is kept, and git runs nothing in it
+  ✔ user.name (28.875258ms)
+  ✔ user.email (24.851412ms)
+✔ a clone with user.name or user.email in its config is kept, and git runs nothing in it (54.140407ms)
+✔ a commit git can't read after the fast-forward is null (49.636697ms)
+✔ a new clone whose commit can't be read refuses the launch and leaves nothing behind (22.037573ms)
+▶ a clone the session rigged is kept, and git runs nothing and writes nothing outside it
+  ✔ core.fsmonitor (37.338975ms)
+  ✔ core.hooksPath (36.072823ms)
+  ✔ a hook file (29.720421ms)
+  ✔ include.path (32.725138ms)
+  ✔ includeIf (34.884751ms)
+  ✔ a filter driver (37.288365ms)
+  ✔ origin moved (33.07881ms)
+  ✔ a second origin url (36.231886ms)
+  ✔ the origin url twice, both the root (31.802405ms)
+  ✔ an ext:: origin (35.231259ms)
+  ✔ a branch tracking another remote (31.742802ms)
+  ✔ a branch merging a tag (35.260279ms)
+  ✔ a fetch line onto local branches (31.63049ms)
+  ✔ no origin (34.653315ms)
+  ✔ a config file over the size cap (32.398545ms)
+  ✔ config a symlink to /dev/zero (33.226824ms)
+  ✔ the clone a symlink to the bait (34.197684ms)
+  ✔ the clone a file (29.610533ms)
+  ✔ the clone a plain directory (37.693195ms)
+  ✔ .git a gitdir: file (43.891422ms)
+  ✔ .git a symlink (35.860713ms)
+  ✔ .git/logs a symlink (30.657111ms)
+  ✔ .git/refs/heads a symlink (28.635908ms)
+  ✔ .git/objects a symlink (29.487695ms)
+  ✔ a reflog hard-linked to a file outside (35.58097ms)
+  ✔ HEAD a fifo (29.853516ms)
+  ✔ a commondir file (32.107512ms)
+  ✔ an alternates file (30.617756ms)
+  ✔ a gitlink staged, no .gitmodules (43.564579ms)
+  ✔ a gitlink and .gitmodules staged (45.885578ms)
+  ✔ a gitlink to a repository with its own gitlink (52.858511ms)
+  ✔ a gitlink and .gitmodules committed (46.236622ms)
+  ✔ a gitlink and submodule.active in config (42.949404ms)
+  ✔ a .git/modules with no gitlink (32.448553ms)
+✔ a clone the session rigged is kept, and git runs nothing and writes nothing outside it (1209.832227ms)
+▶ a root that can't be cloned refuses with the project id and leaves nothing behind
+  ✔ missing (10.628951ms)
+  ✔ not a repository (9.857662ms)
+  ✔ a plain directory inside another repository (16.939608ms)
+  ✔ unreadable (10.089519ms)
+  ✔ on no branch (11.649316ms)
+  ✔ missing an object (14.488637ms)
+✔ a root that can't be cloned refuses with the project id and leaves nothing behind (74.463806ms)
+✔ a clone whose root is on no branch, or gone, is kept and named (28.621302ms)
+✔ no credential or forge remote of the root reaches a clone (50.724499ms)
+✔ every project in the business file gets its own clone at its own branch (33.6523ms)
+✔ a clone past its time gets SIGTERM and refuses the launch, with nothing left in the workspace (512.429952ms)
+✔ a clone that ignores SIGTERM gets SIGKILL once the grace period is over (1017.45401ms)
+✔ a timeout signals git's process group, so a process git started dies with it (513.483652ms)
+✔ once a signalled git has closed, its group gets SIGKILL, so a process that ignored SIGTERM dies too (513.644891ms)
+✔ RUNNER_FILES is exactly what the runner and the harness sources it starts import (1.601086ms)
+✔ sandboxProblem names a missing bwrap and a bwrap that fails (7.985493ms)
+✔ every bind says why; the bundle and session file stay read-only over the run directory (1.366028ms)
+✔ the host's git socket is bound only when given, read-only and before the writable binds (0.670867ms)
+✔ the git identity is the instance's, at <instance>@<business>.mosaic.invalid, and sandboxArgv refuses without it (1.113836ms)
+✔ a confined session's shell reaches its own workspace and run directory and nothing of the founder's or another session's (1853.33152ms)
+✔ a bind that exposes a stand-in, or a missing workspace bind, fails the matching check (2471.383177ms)
+✔ a confined session that runs tester-cli.mjs is refused as tester, and the same shim outside the sandbox binds (260.163034ms)
+✔ resolveSeat: by name under --repo resolves the repo layout (1.225435ms)
+✔ resolveSeat: by path resolves the fleet layout (0.319465ms)
+✔ resolveSeat: refusals for missing dir, missing launch.sh, non-executable launch.sh, invalid name, and unknown layout (0.699561ms)
+✔ tmuxContext: outside tmux, default socket, custom socket, and exec failure (0.634136ms)
+✔ makeRegistration produces a record that validates; each shape violation throws SeatError (0.786504ms)
+✔ writeRegistration/readRegistration: round trip, permissions, absence, and malformed records (1.236057ms)
+✔ updateTask: changes task, taskSetBy and updatedAt only, and refuses appropriately (1.127349ms)
+✔ CLI launch: registers, execs the fake launch script, and passes args through (28.713386ms)
+✔ CLI launch: --harness lands in the record (27.00055ms)
+✔ CLI launch: the launch script's own exit code passes through (27.139109ms)
+✔ CLI launch: relaunching a seat rewrites the one registration record (60.281649ms)
+✔ CLI launch: omitting --task records an empty string, not null (30.626298ms)
+✔ CLI seat task: updates only the task after a launch, and refuses on an unlaunched seat (75.45189ms)
+✔ CLI refusals: no args, unknown flag, missing config, already-registered env, and exec failure (124.881841ms)
+✔ samePath: equal paths, symlinked dirs, distinct dirs, and non-strings (0.408397ms)
+✔ resolveSetBy: explicit --by wins over the environment; absent or empty environment gives unknown; invalid explicit or environment values refuse with exit 4 (0.573348ms)
+✔ validateRegistration/readRegistration: taskSetBy is optional; a record without it (written before #1511) still loads unchanged; an invalid one is refused; the version does not change (0.677615ms)
+✔ updateTask: records setBy, preserves startedAt and every unrelated field, upgrades an old record in place only when the task is set, and replaces a previous attribution (0.861225ms)
+✔ CLI seat task: --by beats MOSAIC_AGENT_NAME, the environment beats nothing, empty environment is unknown, invalid --by or environment refuses with exit 4 and leaves the record byte for byte (253.887353ms)
+✔ family: exactly one launch.max key in the model name, else null (0.729523ms)
+✔ sessionEnv passes only the allowlist, the repo's bin on PATH, and the run id (0.691038ms)
+✔ sessionExit gives a runner's signal death back as the signal; a session credential is one whole set of nonempty variables (0.247173ms)
+✔ newRun: short ids, 0700 directories, and a refusal when the socket path won't fit (1.482551ms)
+✔ session file and launch log: 0600, the session file written once (1.021269ms)
+✔ endReason maps the runner's exit codes; a signal is killed (0.114087ms)
+✔ Registry mirrors to sessions.json; readSessions marks live entries; bad files refuse (1.205413ms)
+✔ stopSession refuses an unknown run, reports a stale one, and won't signal a pid that isn't a runner (0.968004ms)
+✔ a session runs in its sandbox as pid 1 of its namespace, claims, answers, and stops on mosaic stop (313.496869ms)
+✔ workRef and validBranch take only what a ref name can hold (1.10107ms)
+✔ a push lands as the task's work ref, a fast-forward lands after it, and main is the root's (152.42874ms)
+✔ a rewritten branch refuses non-fast-forward and the work ref stays (126.836171ms)
+✔ a branch with no history in common with main refuses unrelated-history (79.492742ms)
+✔ a bundle that needs commits the working repository lacks refuses missing-prerequisite (39.547394ms)
+✔ main is fetched from the root again before each push, so a clone of a newer root pushes (149.45437ms)
+✔ a root moved back after the clone leaves the push's base unknown: missing-prerequisite (84.854545ms)
+✔ a commit with a broken object refuses invalid-bundle, and only because fsck is on (88.982484ms)
+✔ only a v2 bundle with the named branch is read (47.950526ms)
+✔ a branch named main, or named for another task, moves only this task's work ref (95.034418ms)
+✔ a record that throws moves the work ref back, or removes a new one (140.428173ms)
+✔ a work ref that can't go back refuses rollback-failed, naming the ref and the commit (429.384339ms)
+✔ a root that can't be read refuses root-unreadable (28.553301ms)
+✔ a git past its time gets SIGTERM, leaves no ref lock, and the next push lands (2163.152328ms)
+✔ a git that ignores SIGTERM gets SIGKILL once the grace period is over (1027.111116ms)
+✔ a working repository path that isn't a directory refuses (22.852984ms)
+✔ review bundles a pushed commit as refs/mosaic/review, leaving out what the reviewer has (109.319063ms)
+✔ review of a project with no working repository refuses unknown-commit (12.590701ms)
+✔ the runner's git tools hold the host's limits and branch rule (1.093212ms)
+ℹ tests 120
+ℹ suites 0
+ℹ pass 120
+ℹ fail 0
+ℹ cancelled 0
+ℹ skipped 0
+ℹ todo 0
+ℹ duration_ms 4851.009466
diff --git a/agents/darkwing/work/queue-110/r1/gate/pkg-tasks.log b/agents/darkwing/work/queue-110/r1/gate/pkg-tasks.log
new file mode 100644
index 000000000..2398c45e8
--- /dev/null
+++ b/agents/darkwing/work/queue-110/r1/gate/pkg-tasks.log
@@ -0,0 +1,100 @@
+✔ the boot config is checked before anything starts (77.90087ms)
+✔ a business with no tracker entry refuses task verbs (140.200184ms)
+✔ credential.expiring and .expired are recorded once per instance (241.43659ms)
+✔ a token file that changes on disk records credential.changed (117.025096ms)
+✔ autostart polls, reconciles and retries a startup the tracker was down for (137.401311ms)
+✔ a refusal a restart must clear is not retried by the poll (97.358075ms)
+✔ a poll that fires while two are queued is dropped (101.904305ms)
+✔ close waits for a running verb and refuses one that has not started (223.087825ms)
+✔ the bundled Vikunja is the pinned upstream image the runbook names (1.054208ms)
+✔ every published port is on 127.0.0.1, and no secret is in the file (0.395755ms)
+✔ the committed table loads frozen; its verbs are the broker task verbs (1.439577ms)
+✔ a write names a verb the table has as its own key, not one it inherits (0.622737ms)
+✔ the schema refuses any other shape (2.811865ms)
+✔ the Field table in the slice 1 plan names the verbs each field is written by (0.617223ms)
+✔ each verb refuses, asks for a decision and writes as the table and the role files say (1288.352377ms)
+✔ the list holds the PRD's requirement ids, in its order, at its version (5.488965ms)
+✔ the committed list loads frozen (0.528839ms)
+✔ the schema refuses any other shape (3.386627ms)
+✔ the fake answers each route with the statuses and shapes Vikunja v2.7.0 sent (374.861982ms)
+✔ the project list holds recorded project objects in the recorded list envelope (117.405342ms)
+✔ the recorded task bodies pass the checks S3 applies to every read (0.462973ms)
+✔ the client works against the fake over real HTTP with the platform fetch (245.312573ms)
+✔ a correct install starts, and the first reconcile records tasks that already exist (118.219858ms)
+✔ verbs refuse while a business is starting and after startup refused it (148.124931ms)
+✔ startup refuses a token that can do more than its role needs (412.440586ms)
+✔ startup refuses an unsupported version and flags an untested one (308.606782ms)
+✔ startup refuses a board that the runbook did not install (376.563633ms)
+✔ startup refuses a project the sync bot cannot read (94.921143ms)
+✔ startup refuses a configured label the pm bot cannot see (101.702224ms)
+✔ startup refuses an expired credential and a missing sync credential (197.300898ms)
+✔ an unreachable tracker refuses with tracker-unavailable (89.786914ms)
+✔ an edit in the UI is recorded once, with the fields that changed (218.92219ms)
+✔ a move between open buckets is seen on the board, though updated does not change (196.998691ms)
+✔ a person's comment is counted and a bot's is not (286.452287ms)
+✔ the hourly reconcile catches a comment through comment_count (220.27359ms)
+✔ a task closed in the UI leaves the open view with its done bucket (421.814211ms)
+✔ a task that leaves the board is recorded as deleted, moved or out of reach (284.611883ms)
+✔ a poll that read before a verb wrote does not overwrite the verb (192.591014ms)
+✔ a tracker fault during a tick is reported and the next tick catches up (193.503771ms)
+✔ a malformed answer refuses the tick with tracker-shape (146.07396ms)
+✔ no token value reaches the database, the log or a refusal (318.242046ms)
+✔ the first look at a task counts only comments inside the window (133.971047ms)
+✔ with descendants off the adapter reads no project list and no child, as in v0 (133.102792ms)
+✔ a three-level tree is read per project, and a project outside it is not (129.310504ms)
+✔ a watch-only child keeps the business ready, and a failed child read refuses as transient (240.071712ms)
+✔ a root without the installed buckets refuses with descendants on (105.659984ms)
+✔ the project list refuses without read_all, and skips archived projects and saved filters (199.468277ms)
+✔ descendants must be true or false (93.570252ms)
+✔ a move inside the tree is a moved tombstone plus a snapshot under the new ref (181.98311ms)
+✔ a child made after startup joins the tree at the next reconcile (174.762153ms)
+✔ a child that leaves the tree has its tasks recorded missing, and the ledger keeps their history (178.35227ms)
+✔ a child deleted or hidden between reconciles drops out at the next tick, and the root still refuses (198.436433ms)
+✔ a reconcile that fails keeps the previous tree (135.386869ms)
+✔ a closed task the cursor missed takes its own project's done bucket (141.631473ms)
+✔ closed tasks read at startup take their own project's done bucket (98.311227ms)
+✔ a closed task the cursor returns takes its own project's done bucket (123.385458ms)
+✔ a task moved out of a child that leaves the tree at the same time is moved, not no-access (145.421653ms)
+✔ a task in a bucket outside the five keeps its raw bucket id (110.000356ms)
+✔ bucket 0 on a watch-only task never becomes a bucket or a state (214.615163ms)
+✔ a child whose kanban view is deleted still refuses the tick, and the reconcile reads it watch-only (146.937088ms)
+✔ a child dropped at a tick comes back at the next reconcile once the bot reads it again (135.693198ms)
+✔ task.create needs a recorded human request and a requirement id (201.083011ms)
+✔ task.create takes only an approved requirement id (234.38966ms)
+✔ task.create cites the request a received message carries, not the message's id (180.892514ms)
+✔ only labels named in the business file can be written (224.999537ms)
+✔ task.schedule sets and clears a due date and relations (286.474975ms)
+✔ assign and reassign move the role bots and record task.assigned (344.624117ms)
+✔ task.update.assigned is for the assignee and records task.state (305.876284ms)
+✔ a wrong expected digest records task.conflict and writes nothing (195.411178ms)
+✔ a cross-role verb needs a resolved decision, used once (251.500306ms)
+✔ task.close needs a verdict; after it every verb refuses with task-done (241.840414ms)
+✔ a task with pushed work closes only citing an approve verdict for its latest push, and a refusal writes nothing (258.394987ms)
+✔ a lost answer is settled by a re-read and never retried (208.945679ms)
+✔ a create whose answer is lost is reported uncertain, and the poll finds the task (118.217842ms)
+✔ a task the sync bot cannot read refuses and records nothing (94.673318ms)
+✔ verbs and polls for one business run one at a time (166.56458ms)
+✔ a due date with milliseconds is written to the second (159.285786ms)
+✔ every write landed and the final read failed: the verb succeeds and records what it wrote (105.38079ms)
+✔ some writes landed and the final read failed: write-uncertain, and nothing is recorded (82.260996ms)
+✔ a create whose final read fails succeeds and records task.created (94.326881ms)
+✔ an edit between the last write and the final read shows as external on the next poll (112.980538ms)
+✔ task.created is recorded when a later label write fails (83.854152ms)
+✔ every verb acts in an installed child, on the child's own board (259.591333ms)
+✔ task.create refuses a project outside the tree, a watch-only one and one that is not an id (164.84879ms)
+✔ with descendants off, task.create takes only the root project (80.669958ms)
+✔ a verb on a watch-only task, or a relation to one, refuses with project-not-installed (108.987822ms)
+✔ a related task is read before authority: in another project than its ref names, task-moved; missing, task-not-found (136.91681ms)
+✔ a task moved to another project of the tree refuses its old ref with task-moved and takes its new one (91.048511ms)
+✔ a verb and a create in the child record the final read of the child's board (89.987493ms)
+✔ a create in the child whose final read fails records the child's todo bucket (101.736859ms)
+✔ a lost answer in the child is settled by a re-read of the child's board (136.642123ms)
+✔ every related task is read before authority, not only the first (98.085813ms)
+ℹ tests 92
+ℹ suites 0
+ℹ pass 92
+ℹ fail 0
+ℹ cancelled 0
+ℹ skipped 0
+ℹ todo 0
+ℹ duration_ms 5322.865518
diff --git a/agents/darkwing/work/queue-110/r1/gate/pkg-webui.log b/agents/darkwing/work/queue-110/r1/gate/pkg-webui.log
new file mode 100644
index 000000000..7ad959fbc
--- /dev/null
+++ b/agents/darkwing/work/queue-110/r1/gate/pkg-webui.log
@@ -0,0 +1,117 @@
+✔ the Board: held roles with no machine sessions, a claim with no address, the toggle kept across a reload, and Message addressed to the role (7343.019267ms)
+✔ a redirect answer on a Board read, a bus read, a conversation read, a board POST, a module read and a send signs the page out: one line, nothing stale, no further reads (6246.97077ms)
+✔ browser edge states: loading, empty, malformed, stale, hostile/long values, in-flight reply and appearance fallback (4899.649827ms)
+Rendered contrast: {"failures":[],"count":330,"lowest":4.504658476260286}
+✔ served Console browser: real board fixtures, keyboard, drafts, receipts, themes, 320px and failures (3977.396298ms)
+✔ the README says a refused field table names the file or the key at fault, never a path (1.356297ms)
+✔ S5 pages in a browser: real broker rows, inert text, Copy, routes, failures, layout and no writes (7581.280183ms)
+✔ bus routes serve the four reads from the reader view, unescaped JSON for the page to escape (642.973427ms)
+✔ decisions route serves the roles and recent lists from the reader view (1140.226236ms)
+✔ credentials route serves the broker credential status from the reader view (1682.757976ms)
+✔ replies route serves the replies to one message from the reader view (1552.709533ms)
+✔ bus routes are GET-only, have no write verb, and keep the same-origin checks (87.004695ms)
+✔ bus refusals map to statuses and never carry a path or a stack (38.916289ms)
+✔ humanCall speaks the human transport protocol without blocking the server (1950.244894ms)
+✔ busReader takes --business, else the live bus host, else refuses (295.563716ms)
+✔ humanCall kills a transport that runs past its timeout (529.909783ms)
+✔ serve refuses a --business value that is not a business id (431.642668ms)
+✔ conversation view: full history, collapsed tools, hidden thinking, inert hostile content, malformed and reconcile markers (4980.630098ms)
+✔ conversation view: a fork keeps the open branch, says so, and opens the new one on request (4145.966939ms)
+✔ conversation view: a newer session with no readable history keeps the marker (1661.122147ms)
+✔ conversation view: seats without history say so and offer no reply (1751.021391ms)
+✔ Discord row through real board/WebUI: independent brake/liveness, no Reply, literal content (4502.155624ms)
+✔ return flow through the conversation view: send, tool call, delayed result, peer message, exact long answers, relaunch (55160.692307ms)
+✔ messages HTTP read pages and preserves metadata; bad arguments refuse before a read; other reads unchanged (497.394292ms)
+✔ Console Messages lists late unsolicited messages on polling with sender class time read state and trail; nav count includes beyond the page; reads never deliver (9204.343376ms)
+✔ Messages nav count polls on Tasks and Board and clears on a Board refusal; messages 403 refuses local pages (2755.496865ms)
+✔ copy writes the Console paths at the full id, read-only, and leaves an existing copy alone (2910.110281ms)
+✔ copy refuses a commit off refactor, an unknown one, a worktree and a bad copies directory (1887.834767ms)
+✔ copy writes nothing when an archived path is missing at the commit (2853.531225ms)
+✔ a copy that loses the rename race leaves no read-only temp directory behind (739.870136ms)
+✔ a copy whose rename fails with no target refuses, writes no copy and leaves no temp directory (630.061282ms)
+✔ a copy that meets a target holding files says exists: and moves nothing into it (655.023701ms)
+✔ a copy that meets an empty target directory replaces it by rename, not by moving into it (498.901684ms)
+✔ serve runs from a copy: /healthz 200, the config check, roles and RELEASE from the copy, the queue from --checkout (1014.964391ms)
+✔ serve refuses a --checkout that is not an absolute directory path (255.869116ms)
+✔ consoleReads runs the queue read under queueRoot and reads RELEASE under root (48.729475ms)
+✔ preview options are all three or none, and each is checked (8.161662ms)
+✔ the CLI refuses a partial or invalid preview flag set at start (2267.332684ms)
+✔ the CLI with all three flags serves the preview mode (272.754277ms)
+✔ a request for the public name needs the header equal to the user id, else 401 and nothing read (69.416497ms)
+✔ the header name matches without regard to case, and the value compare is exact (6.107175ms)
+✔ the public name with the header reads the bus views, and the Host and Origin are checked first (47.602427ms)
+✔ in preview mode every write answers 403 read-only, from the public name and loopback, and reaches nothing (20.574645ms)
+✔ loopback requests are unchanged in preview mode, and the bus views work with the board down (10.095109ms)
+✔ a proxy that rewrites Host to the loopback port gets 403 on its first request, whatever the user (28.01313ms)
+✔ a repeated Host is 400 before any other check, in preview mode and without it (12.526172ms)
+✔ without the preview flags the public name is refused and writes still reach the board (7.858923ms)
+✔ redactor: config, dataRoot, any absolute path, Discord ids and the JSON parser quote (2.169879ms)
+✔ credential state from the date alone, as the bus states it (0.248331ms)
+✔ queue: rows, one row, ids and methods, notes; no path or id from a row (1897.437595ms)
+✔ queue: a refused read fails closed with the store's text, redacted (1899.992442ms)
+✔ queue: a store that fails to load, or a child that dies, gives a fixed message with no path or stack (4103.244825ms)
+✔ business: names, vars on the allowlist, authority, credential metadata only (26.16309ms)
+✔ business: missing or invalid file refuses with the module's text, redacted (40.157951ms)
+✔ business without --business: the live bus host, else no-bus-host; no system config: not-configured (21.010366ms)
+✔ settings: release, board, loopback address, notifier binding name only (600.11305ms)
+✔ task fields: the committed table with no reads configured, GET only; a bad table refuses with no path (23.861037ms)
+✔ both presentations replace old activity with relaunch notice, label retained history, then resume after new activity (4779.392692ms)
+✔ reported return flow and relative Age: reply sent from the inspector, then the new answer appears there without manual refresh (22471.514599ms)
+✔ the send box: held roles, the draft and caret across a refresh, each receipt, one POST per Send, and the trail link; the board Reply on a 4xx and a 5xx (7155.465774ms)
+✔ a sent receipt lists its replies as the page refreshes, oldest first and capped, and marks none delivered or read (12784.060125ms)
+✔ startServer takes send only as a function and only with the preview mode (5.819426ms)
+✔ the CLI refuses --send without the preview flags, and without a configured bus (397.253287ms)
+✔ the CLI with --send and a configured bus sends through the human transport and logs one line (116.035222ms)
+✔ without --send the route is read-only like every other write, and config says no send (7.662215ms)
+✔ with --send every other write is still 403 read-only, and nothing reaches the board or bus (4.807975ms)
+✔ config says send only on the public name with --send on (1.544704ms)
+✔ a send without the signed-in user is 401 and is neither sent nor logged, loopback included (3.491608ms)
+✔ each request check refuses before anything is sent, and logs the refusal without the body (11.073684ms)
+✔ a send passes exactly to, body and in_reply_to, answers the id, and logs it (2.20585ms)
+✔ a crafted role name cannot forge a log line (1.636686ms)
+✔ a bus refusal is not sent, with its status; an outcome the bus could not confirm is unknown and never retried (5.627643ms)
+✔ through the human transport the request is exactly the business, message.send and the keys (88.160167ms)
+✔ against a real broker: the message is written once as a human send, and its refusals map (1493.855219ms)
+✔ loopback host and board origin fail closed (7.342473ms)
+✔ real board fixture passes through WebUI; assets and isolated seen/reply work (601.033212ms)
+✔ proxy preserves exact request bytes, status and receipt, rejects forms and malformed JSON, never follows redirect (44.836522ms)
+✔ unreachable board reports URL; CLI rejects unsupported options (553.908466ms)
+✔ render prints the unit without the preview flags (10.09522ms)
+✔ render carries every serve flag, the preview set included (6.421832ms)
+✔ a partial preview set is refused (14.943897ms)
+✔ a value the unit cannot carry is refused, for every flag (266.993352ms)
+✔ the rendered unit names none of the human proof agent markers and sets no agent variable (17.728737ms)
+✔ install into --dir with --no-reload writes the file whole, then reports unchanged (98.493223ms)
+✔ install without --no-reload runs daemon-reload and nothing that starts the unit (55.690105ms)
+✔ uninstall refuses while the unit is running, with or without --no-reload, and removes it once it is not (520.574282ms)
+✔ status prints the unit state and GET /healthz on the installed port (330.905184ms)
+✔ usage: an unknown verb or flag, and start or enable, exit 4 (113.125652ms)
+✔ without --send, render is the template with its placeholders filled, byte for byte (28.417174ms)
+✔ render --send with the preview set ends ExecStart with --send and changes nothing else (43.606847ms)
+✔ --send without the whole preview set is refused and writes nothing (187.049453ms)
+✔ install --send into --dir with --no-reload writes the sending unit, and status says whether it sends (565.863964ms)
+✔ uninstall and status take no --send (59.475827ms)
+✔ install refuses while the unit is running, in any state but inactive or failed, and changes nothing (548.602727ms)
+✔ when the state read fails, install and uninstall refuse with one line and change nothing (65.162302ms)
+✔ install needs --copy naming a copy that exists, and refuses outside the canonical checkout without --allow-worktree (62.370586ms)
+✔ install refuses unless the bus unit runs from the same copy, naming both paths, and changes nothing (255.484922ms)
+✔ render --copy runs the copy and reads the queue in the checkout; without --copy the unit is unchanged (33.673784ms)
+✔ the uid header takes only an Authentik uid; the username header still takes a username (586.630657ms)
+✔ a preview value cannot start with - or . (27.789306ms)
+✔ status names the copy and whether refactor has moved past it, and says when the unit runs from no copy (448.204255ms)
+✔ tokens.css and icons.svg are byte copies of docs/design (0.764842ms)
+✔ JetBrains Mono files match the digests in their sources file, with the OFL text (1.439152ms)
+✔ shipped strings are unchanged, and the web keeps its write boundary (1.695837ms)
+✔ shell in a browser: System default, seeded states, 400px, focus and the Ctrl+K palette (7458.843819ms)
+✔ five states on Board, Inbox, Tasks, Agents and Trail (2447.698128ms)
+✔ Queue, Business and Settings in their five states, with no move button (5214.731616ms)
+✔ seeded secrets, Discord ids and paths reach no response and no page; business refusals in the module's words (2384.035915ms)
+✔ the server log names no config path when the system config refuses (261.400345ms)
+ℹ tests 108
+ℹ suites 0
+ℹ pass 108
+ℹ fail 0
+ℹ cancelled 0
+ℹ skipped 0
+ℹ todo 0
+ℹ duration_ms 55563.501219
diff --git a/agents/darkwing/work/queue-110/r1/gate/script-auth.log b/agents/darkwing/work/queue-110/r1/gate/script-auth.log
new file mode 100644
index 000000000..ac2287606
--- /dev/null
+++ b/agents/darkwing/work/queue-110/r1/gate/script-auth.log
@@ -0,0 +1,17 @@
+OK    status with missing harness credential exits 3 and still lists accounts
+OK    status reports harness credential (read-only) + mosaic accounts
+OK    api key material never reaches output
+OK    oauth token material never reaches output
+OK    unparseable credential file exits 2
+OK    symlinked credential file exits 4
+OK    env-side credential names reported
+OK    env var values never reach output
+OK    accounts without an accounts dir reports none and creates nothing
+OK    accounts lists files and marks the active one
+OK    loose account perms flagged in listing
+OK    agent --auth with missing account file refuses (exit 4)
+OK    agent --auth with non-0600 account file refuses
+OK    agent --auth with invalid account name refuses
+OK    auth.sh without valid config refuses
+
+selftest: 15 passed, 0 failed
diff --git a/agents/darkwing/work/queue-110/r1/gate/script-conductor.log b/agents/darkwing/work/queue-110/r1/gate/script-conductor.log
new file mode 100644
index 000000000..d6fd3e706
--- /dev/null
+++ b/agents/darkwing/work/queue-110/r1/gate/script-conductor.log
@@ -0,0 +1,55 @@
+Note: switching to 'badfa52b9d5b956392bd9cb141ff1f4ce9f402f0'.
+
+You are in 'detached HEAD' state. You can look around, make experimental
+changes and commit them, and you can discard any commits you make in this
+state without impacting any branches by switching back to a branch.
+
+If you want to create a new branch to retain commits you create, you may
+do so (now or later) by using -c with the switch command. Example:
+
+  git switch -c <new-branch-name>
+
+Or undo this operation with:
+
+  git switch -
+
+Turn off this advice by setting config variable advice.detachedHead to false
+
+Not currently on any branch.
+nothing to commit, working tree clean
+Note: switching to 'badfa52b9d5b956392bd9cb141ff1f4ce9f402f0'.
+
+You are in 'detached HEAD' state. You can look around, make experimental
+changes and commit them, and you can discard any commits you make in this
+state without impacting any branches by switching back to a branch.
+
+If you want to create a new branch to retain commits you create, you may
+do so (now or later) by using -c with the switch command. Example:
+
+  git switch -c <new-branch-name>
+
+Or undo this operation with:
+
+  git switch -
+
+Turn off this advice by setting config variable advice.detachedHead to false
+
+OK    dry-run: allowed change, exit 0, nothing committed (exit 0)
+OK    dry-run committed nothing
+OK    apply: allowed change exits 0 (exit 0)
+OK    apply: attribution in commit subject
+OK    apply: target tree clean after commit
+OK    disallowed path refused (exit 1)
+OK    disallowed path: target untouched
+OK    syntax gate refused broken .mjs (exit 1)
+OK    syntax gate: target untouched
+OK    suite failure refused (exit 1)
+OK    suite failure: target reverted to clean
+OK    disabled policy refused (exit 2)
+OK    disabled policy: target untouched
+OK    failed run refused (exit 1)
+OK    failed run: target untouched
+OK    missing run exits 4 (exit 4)
+OK    invalid policy exits 2 (exit 2)
+
+selftest: 17 passed, 0 failed
diff --git a/agents/darkwing/work/queue-110/r1/gate/script-config.log b/agents/darkwing/work/queue-110/r1/gate/script-config.log
new file mode 100644
index 000000000..76c05ef74
--- /dev/null
+++ b/agents/darkwing/work/queue-110/r1/gate/script-config.log
@@ -0,0 +1,26 @@
+OK    absent adapter defaults to pi
+OK    adapter mock validates (exit 0)
+OK    unsupported adapter exits 2 (exit 2)
+OK    env exports adapter
+OK    bootstrap creates default when absent (exit 0)
+OK    bootstrap wrote config file
+OK    bootstrap is idempotent on existing config (exit 0)
+OK    bootstrap did not rewrite existing config
+OK    validate missing config exits 3 (exit 3)
+OK    malformed JSON exits 2 (exit 2)
+OK    unsupported configVersion exits 2 (exit 2)
+OK    unknown top-level key exits 2 (exit 2)
+OK    unknown execution key exits 2 (exit 2)
+OK    unsupported backend exits 2 (exit 2)
+OK    unsupported environment exits 2 (exit 2)
+OK    relative dataRoot exits 2 (exit 2)
+OK    non-canonical dataRoot exits 2 (exit 2)
+OK    filesystem root dataRoot exits 2 (exit 2)
+OK    home directory dataRoot exits 2 (exit 2)
+OK    dataRoot containing config dir exits 2 (exit 2)
+OK    control character in provider exits 2 (exit 2)
+OK    symlinked config file exits 2 (exit 2)
+OK    env exports resolve correctly
+OK    failed validation modified nothing
+
+selftest: 24 passed, 0 failed
diff --git a/agents/darkwing/work/queue-110/r1/gate/script-discord.log b/agents/darkwing/work/queue-110/r1/gate/script-discord.log
new file mode 100644
index 000000000..b013f9ffa
--- /dev/null
+++ b/agents/darkwing/work/queue-110/r1/gate/script-discord.log
@@ -0,0 +1,70 @@
+toolchain: node v26.8.1
+
+OK    syntax: packages/discord/src/approvals.mjs
+OK    syntax: packages/discord/src/authorize.mjs
+OK    syntax: packages/discord/src/binding.mjs
+OK    syntax: packages/discord/src/cli.mjs
+OK    syntax: packages/discord/src/connector.mjs
+OK    syntax: packages/discord/src/context.mjs
+OK    syntax: packages/discord/src/engine-pi.mjs
+OK    syntax: packages/discord/src/errors.mjs
+OK    syntax: packages/discord/src/gateway.mjs
+OK    syntax: packages/discord/src/git.mjs
+OK    syntax: packages/discord/src/journal.mjs
+OK    syntax: packages/discord/src/notify.mjs
+OK    syntax: packages/discord/src/rest.mjs
+OK    syntax: packages/discord/src/setspark.mjs
+OK    syntax: packages/discord/src/tools.mjs
+OK    syntax: packages/discord/src/web.mjs
+OK    syntax: packages/discord/bin/git-credential.mjs
+OK    syntax: packages/discord/extension/tools.mjs
+OK    syntax: packages/discord/tests/approvals.test.mjs
+OK    syntax: packages/discord/tests/authorize.test.mjs
+OK    syntax: packages/discord/tests/binding.test.mjs
+OK    syntax: packages/discord/tests/connector.test.mjs
+OK    syntax: packages/discord/tests/context.test.mjs
+OK    syntax: packages/discord/tests/engine.test.mjs
+OK    syntax: packages/discord/tests/fake-pi.mjs
+OK    syntax: packages/discord/tests/gateway.test.mjs
+OK    syntax: packages/discord/tests/git.test.mjs
+OK    syntax: packages/discord/tests/helpers.mjs
+OK    syntax: packages/discord/tests/journal.test.mjs
+OK    syntax: packages/discord/tests/notify.test.mjs
+OK    syntax: packages/discord/tests/recover.test.mjs
+OK    syntax: packages/discord/tests/rest.test.mjs
+OK    syntax: packages/discord/tests/setspark.test.mjs
+OK    syntax: packages/discord/tests/tools.test.mjs
+OK    syntax: packages/discord/tests/web.test.mjs
+OK    syntax: packages/discord/fixtures/claim-worker.mjs
+OK    syntax: packages/discord/fixtures/legacy-owner-worker.mjs
+OK    syntax: scripts/discord.sh
+OK    syntax: scripts/discord-service.sh
+OK    packages/discord declares no dependencies
+OK    no bot-token-shaped string in packages/discord
+OK    fixture binding uses placeholder ids only
+OK    fixture binding validates
+OK    real pi with the extension exposes exactly list_dir, read_file, search and no built-in tool
+OK    real pi with a writable root exposes exactly the three reads plus write_file and edit_file, and writes nothing at start
+OK    real pi with a web key exposes the three reads plus web_fetch and web_search, and no write tool without a writable root
+OK    real pi with a git root exposes the reads, writes and the four git verbs, commits nothing at start, and never shows the token
+OK    real pi with protocol vault adds reserve_id to the git verbs
+OK    real pi with a setspark key exposes the reads and the eight record verbs, no counters, and never shows the key
+OK    real pi refuses a git key on a read-only root (fail closed)
+OK    real pi with the pilot flags (--no-tools) exposes no tool at all
+OK    real pi exits non-zero without MOSAIC_DISCORD_TOOLS: no session, no tools (fail closed)
+OK    a failing nested test fails the run under a parent runner's NODE_TEST_CONTEXT
+OK    node --test packages/discord/tests/ (ℹ pass 178)
+OK    scripts/discord.sh --help exits 0
+OK    scripts/discord.sh check without a binding exits 4
+OK    scripts/discord.sh recover without a binding exits 4
+OK    scripts/discord.sh reload without a binding exits 4
+OK    scripts/discord-service.sh without a command exits 4
+OK    service unit renders with the repository path, a supervised run as the main process, exit 3 never retried, and reload as SIGHUP
+OK    service install writes the rendered unit (0644) and leaves no temp file
+OK    service install a second time reports unchanged
+OK    systemd-analyze verify accepts the rendered unit
+OK    service uninstall removes the unit file
+OK    service install with an unknown flag exits 4
+OK    service install with USER unset finishes and names the account for lingering
+
+discord suite: 66 passed, 0 failed
diff --git a/agents/darkwing/work/queue-110/r1/gate/script-extension-package.log b/agents/darkwing/work/queue-110/r1/gate/script-extension-package.log
new file mode 100644
index 000000000..8f11a9994
--- /dev/null
+++ b/agents/darkwing/work/queue-110/r1/gate/script-extension-package.log
@@ -0,0 +1,21 @@
+OK    initial ordinary-file install
+OK    installed tree matches canonical source
+OK    installed tree has no symlinks
+OK    check detects installation drift
+OK    sync refuses to overwrite installation drift
+OK    check detects an extra destination file
+OK    check detects an extra destination directory
+OK    check rejects a destination symlink
+OK    sync accepts a canonical source update
+OK    updated installation matches canonical source
+scripts/test-extension-package.sh: line 14: 1674862 Killed                     "$@" > /dev/null 2>&1
+OK    forced interruption kills the replacing process
+OK    next invocation recovers old consistent installation
+OK    interrupted replacement rolled back
+OK    sync succeeds after interruption recovery
+OK    unlocked stale lock file does not block
+OK    active lock refuses a concurrent sync
+OK    source symlink fails closed
+OK    nested second entrypoint fails closed
+
+extension package selftest: 18 passed, 0 failed
diff --git a/agents/darkwing/work/queue-110/r1/gate/script-foundation.log b/agents/darkwing/work/queue-110/r1/gate/script-foundation.log
new file mode 100644
index 000000000..6338e1e6d
--- /dev/null
+++ b/agents/darkwing/work/queue-110/r1/gate/script-foundation.log
@@ -0,0 +1,53 @@
+toolchain: node v26.8.1, python 3.12.8, jsonschema 4.26.0
+
+OK    syntax: scripts/foundation-inspect.mjs
+OK    syntax: scripts/foundation/strict-json.mjs
+OK    syntax: scripts/foundation/canonical.mjs
+OK    syntax: scripts/foundation/resolve.mjs
+OK    syntax: scripts/foundation/validate-record.mjs
+OK    syntax: scripts/foundation/fixtures/build-fixtures.mjs
+OK    syntax: scripts/foundation/canonical.test.mjs
+OK    syntax: scripts/foundation/cli.test.mjs
+OK    syntax: scripts/foundation/fixtures.test.mjs
+OK    syntax: scripts/foundation/resolve.test.mjs
+OK    syntax: scripts/foundation/strict-json.test.mjs
+OK    syntax: scripts/foundation/verify-schema.py (ast only; no bytecode written)
+OK    fixture generator runs
+OK    checked-in fixtures/bundles equal a fresh generation
+OK    checked-in fixtures/raw equal a fresh generation
+OK    checked-in fixtures/index.json equal a fresh generation
+OK    checked-in demo bundles equal a fresh generation
+OK    a failing nested test fails the run under a parent runner's NODE_TEST_CONTEXT
+OK    node --test scripts/foundation/ (ℹ pass 80)
+OK    differential schema oracle: PASS: differential schema oracle (finite corpus; compatibility evidence, not equivalence proof)
+      platform witness: strftime('%Y') for year 999 -> '999' (pinned checker refuses years 0001..0999)
+      node v26.8.1; corpus 1568 records (38 pinned fixtures, 478 unique bundle records, 1052 typeCase/mutation/lexical cases)
+      schema column: agree-valid 540, agree-invalid 991, DISAGREEMENTS 0; strict-only (parser-bound) cases: 27; unsupported-kind records not schema-assessed by the inspector: 10
+      profile column (schema-valid records only): profile-valid 510, profile-invalid 30
+      profile refusals asserted: 30 schema-agreed-valid records refused only by the strict typed-string profile (rule profile-pattern-mismatch), 12 declared by name; 73 named probes verified against declared schema/profile columns
+OK    oracle: zero schema-column disagreements with the pinned checker
+OK    oracle: strict-only profile refusals are counted and asserted
+OK    demo: permitted read preview exits 0 (exit 0)
+OK    demo: permitted file.change preview exits 0 (exit 0)
+OK    demo: assignment.change proposal is unresolved (exit 3) (exit 3)
+OK    demo: revoked registration is refused (exit 3) (exit 3)
+OK    demo: message is not authority (exit 3) (exit 3)
+OK    usage: no arguments exits 2 (exit 2)
+OK    io: missing file exits 4 (exit 4)
+OK    io: directory exits 4 (exit 4)
+OK    io: symlink exits 4 (O_NOFOLLOW) (exit 4)
+OK    bound: oversize fixture exits 2 (exit 2)
+OK    profile: one final LF in a typed selection id is refused before admission (exit 2) (exit 2)
+OK    profile: two final LFs fail the schema pattern itself (exit 2) (exit 2)
+OK    profile: escaped newlines in free-form text stay allowed (exit 0) (exit 0)
+OK    profile refusal is invalid-request/profile-pattern-mismatch with selection and operation withheld, value not echoed
+OK    text output starts with the disclaimer
+OK    json output is valid JSON with result allowed and exactly the charter §7 fields
+OK    json golden matches byte-for-byte
+OK    sandboxed bundle run (env -i, PATH=/nonexistent) produced the unresolved proposal
+OK    sandbox inventory (path/type/size/mode/uid/gid/inode/mtime/sha256) unchanged by runs
+OK    canary never printed (bundle run and credential-file run)
+OK    a non-bundle JSON file is refused at the shape gate, not read into output
+OK    no field of the non-bundle file is echoed
+
+selftest: 44 passed, 0 failed
diff --git a/agents/darkwing/work/queue-110/r1/gate/script-queue.log b/agents/darkwing/work/queue-110/r1/gate/script-queue.log
new file mode 100644
index 000000000..5423d6cb8
--- /dev/null
+++ b/agents/darkwing/work/queue-110/r1/gate/script-queue.log
@@ -0,0 +1,36 @@
+toolchain: node v26.8.1, git version 2.55.0
+
+OK    syntax: packages/queue/src/cli.mjs
+OK    syntax: packages/queue/src/errors.mjs
+OK    syntax: packages/queue/src/io.mjs
+OK    syntax: packages/queue/src/lock.mjs
+OK    syntax: packages/queue/src/queue.mjs
+OK    syntax: packages/queue/src/review.mjs
+OK    syntax: packages/queue/src/store.mjs
+OK    syntax: packages/queue/tests/commit.test.mjs
+OK    syntax: packages/queue/tests/data.test.mjs
+OK    syntax: packages/queue/tests/dispatch.test.mjs
+OK    syntax: packages/queue/tests/gate-owner.test.mjs
+OK    syntax: packages/queue/tests/helpers.mjs
+OK    syntax: packages/queue/tests/lock.test.mjs
+OK    syntax: packages/queue/tests/migration.test.mjs
+OK    syntax: packages/queue/tests/review.test.mjs
+OK    syntax: packages/queue/tests/store.test.mjs
+OK    syntax: packages/queue/tests/write.test.mjs
+OK    syntax: packages/queue/tests/fixtures/fake-gitea.mjs
+OK    syntax: packages/queue/tests/fixtures/kill-at.mjs
+OK    syntax: packages/queue/tests/fixtures/lock-child.mjs
+OK    syntax: packages/queue/tests/fixtures/mosaic-pre-a2.sh
+OK    syntax: scripts/queue-commit.sh
+OK    syntax: scripts/git-hooks/pre-commit
+OK    syntax: scripts/mosaic
+OK    queue-commit.sh, the guard and scripts/mosaic are executable
+OK    packages/queue declares no dependencies
+ℹ tests 156
+ℹ pass 156
+ℹ fail 0
+OK    node --test packages/queue/tests/
+OK    scripts/mosaic queue help
+skip  queue verify and render --check: this checkout (/home/jwoltje/darkwing-scratch/r110/wt) is not the queue's canonical root (/mnt/storage/src/mosaic-stack)
+
+queue suite: 28 passed, 0 failed
diff --git a/agents/darkwing/work/queue-110/r1/gate/script-release.log b/agents/darkwing/work/queue-110/r1/gate/script-release.log
new file mode 100644
index 000000000..7202b85d4
--- /dev/null
+++ b/agents/darkwing/work/queue-110/r1/gate/script-release.log
@@ -0,0 +1,16 @@
+OK    valid RELEASE resolves (exit 0)
+OK    invalid RELEASE exits 1 (exit 1)
+OK    missing RELEASE exits 1 (exit 1)
+OK    valid RELEASE leaves image tag consistent with version
+OK    status safe on empty state (exit 0)
+OK    status created no pointer
+OK    fault-injected activation refuses (exit 1)
+OK    refused activation wrote no pointer
+OK    refusal logged exactly once with valid fields
+OK    healthy activation succeeds (exit 0)
+OK    pointer written with valid fields
+OK    repeat activation succeeds (log grows) (exit 0)
+OK    log is append-only across activations
+OK    rollback without previous refuses (exit 1)
+
+selftest: 14 passed, 0 failed
diff --git a/agents/darkwing/work/queue-110/r1/gate/script-task.log b/agents/darkwing/work/queue-110/r1/gate/script-task.log
new file mode 100644
index 000000000..df6724a77
--- /dev/null
+++ b/agents/darkwing/work/queue-110/r1/gate/script-task.log
@@ -0,0 +1,101 @@
+OK    valid task validates (exit 0)
+OK    unknown task key exits 2 (exit 2)
+OK    unsupported taskVersion exits 2 (exit 2)
+OK    invalid task id exits 2 (exit 2)
+OK    empty prompt exits 2 (exit 2)
+OK    NUL in expectExact exits 2 (exit 2)
+OK    out-of-range timeout exits 2 (exit 2)
+OK    missing mission file exits 4 (exit 4)
+OK    task with valid mission validates (exit 0)
+OK    invalid mission exits 2 (exit 2)
+OK    validate missing task exits 4 (exit 4)
+OK    validation does not modify the task file
+OK    prune dry-run exits 0 (exit 0)
+OK    dry-run deleted nothing
+OK    prune --keep=2 --yes removes oldest (exit 0)
+OK    kept exactly 2 newest runs
+OK    newest run kept, oldest pruned
+OK    append-only receipt written (3 entries)
+OK    sessions/workspaces untouched by prune
+OK    prune with invalid keep exits 4 (exit 4)
+OK    mock adapter: gate passes on matching mock response (exit 0)
+OK    mock adapter: expect-mismatch recorded (exit 1)
+OK    mismatch reason recorded
+OK    unknown adapter fails closed (exit 1)
+OK    mission task runs via mock adapter (exit 0)
+OK    mission section injected into generated prompt
+OK    retry of mission run succeeds (exit 0)
+OK    retriedFrom lineage recorded
+OK    mission section present after retry (relative path resolved)
+OK    retry of missing run exits 4 (exit 4)
+OK    skill install bundled ms-tools (exit 0)
+OK    installed to skills-available
+OK    double install refuses (exit 1)
+OK    activate enables skill (exit 0)
+OK    enabled dir populated
+OK    uninstall while enabled refuses (exit 1)
+OK    deactivate moves back to available (exit 0)
+OK    uninstall removes from available (exit 0)
+OK    seat with enabled skill launches
+OK    skill path delivered to adapter
+OK    shipped researcher contract resolves (ceiling + network)
+OK    resolve-role refuses a non-role document (conductor policy) (exit 2)
+OK    resolve-role refuses name/filename mismatch (exit 2)
+OK    resolve-role refuses unknown network declaration (exit 2)
+OK    resolve-role refuses duplicate role tool (exit 2)
+OK    resolve-role refuses unsupported tool (exit 2)
+OK    resolve-role refuses missing contract file (exit 4)
+OK    version 1 role prints no contract line
+OK    shipped version 2 roles resolve with their contracts (pm, cto, coder, reviewer)
+OK    resolve-role accepts a minimal version 2 role (exit 0)
+OK    resolve-role refuses an action outside the vocabulary (exit 2)
+OK    resolve-role refuses a gated-only action in a role file (exit 2)
+OK    resolve-role refuses a Vikunja verb no role may hold (exit 2)
+OK    resolve-role refuses a version 2 role whose contract is missing (exit 2)
+OK    resolve-role refuses a contract that is a symbolic link (exit 2)
+OK    seat launches under role ceiling
+OK    role ceiling narrows seat tools (read,write,bash -> read,bash)
+OK    narrowing recorded loudly
+OK    missing role contract refuses launch (exit 2)
+OK    missing-contract refusal names the role
+OK    empty ceiling intersection -> tool-free seat
+OK    tool-free outcome recorded loudly
+OK    overridden agents dir without seat definition refuses (exit 4)
+OK    seat-resolution refusal names the seat
+OK    policy: mission only -> mission tools
+OK    policy: task only -> task tools
+OK    policy: both -> intersection (task narrowed)
+OK    policy: empty intersection -> tool-free
+OK    invalid mission capabilities rejected (exit 2)
+mosaic-task: unsupported mission tool: "sudo" (supported: read, write, edit, bash, grep, find, ls)
+OK    task run with user layer present (exit 0)
+OK    user context dispatched into generated prompt
+OK    workspace+tools task runs via mock (exit 0)
+OK    workspace path + tools delivered to adapter
+OK    persistent workspace created on host
+OK    plain task still runs (no workspace/tools) (exit 0)
+OK    workspace var present but empty when absent
+OK    tools empty when absent
+OK    unknown tool exits 2 (exit 2)
+OK    workspace traversal exits 2 (exit 2)
+OK    live hello task succeeds with exact marker
+OK    result.json written in run dir
+OK    result.json contents are correct
+OK    wrong expectExact fails with exit 1 (reason: expect-mismatch)
+OK    each run gets a distinct run dir (no clobber)
+OK    list shows both runs
+OK    fork base: teach succeeds (exit 0)
+OK    fork child recalls ancestor context (exit 0)
+OK    forked child recalled ancestor code word
+OK    ancestor session untouched by fork
+OK    child session dir has its own branch file
+OK    onboard without name exits 4 (non-interactive) (exit 4)
+OK    onboard --name renders profile (exit 0)
+OK    profile written
+OK    canon structure: required filled, optional placeholdered
+OK    canon sections present
+OK    user recall run succeeds
+OK    recalled user name (response: Jason)
+OK    no agent identity on headless run
+
+selftest: 98 passed, 0 failed
diff --git a/agents/darkwing/work/queue-110/r1/mutants-run-1.log b/agents/darkwing/work/queue-110/r1/mutants-run-1.log
new file mode 100644
index 000000000..ae4a970bc
--- /dev/null
+++ b/agents/darkwing/work/queue-110/r1/mutants-run-1.log
@@ -0,0 +1,96 @@
+start candidate a266a3aa195a7841 00:47:34 mutants 92
+b00 BASE's broker.mjs under the new tests: killed (expected killed) [('tester.test.mjs ^the tester binds only', 1), ('tester.test.mjs ^every verb outside', 1), ('tester.test.mjs ^a tester message is from tester', 1), ('tester.test.mjs ^a role answers a tester', 1), ('tester.test.mjs ^the tester reads the human views', 1), ('tester.test.mjs ^an envelope carries', 1), ('tester.test.mjs ^tester-cli.mjs binds through', 1)]
+b01 no tester verb gate: killed (expected killed) [('tester.test.mjs ^every verb outside', 1)]
+b02 the tester list lets role.claim through: killed (expected killed) [('tester.test.mjs ^every verb outside', 1), ('tester.test.mjs ^a business may not name', 1)]
+b03 the tester list lets role.release through: survived (expected killed) [('tester.test.mjs ^every verb outside', 0)]
+b04 the tester list lets role.revoke through: killed (expected killed) [('tester.test.mjs ^every verb outside', 1)]
+b05 the tester list lets decision.raise through: survived (expected killed) [('tester.test.mjs ^every verb outside', 0)]
+b06 the tester list lets decision.resolve through: killed (expected killed) [('tester.test.mjs ^every verb outside', 1)]
+b07 the tester list lets decision.seen through: killed (expected killed) [('tester.test.mjs ^every verb outside', 1)]
+b08 the tester list lets decision.withdraw through: killed (expected killed) [('tester.test.mjs ^every verb outside', 1)]
+b09 the tester list lets review.request through: killed (expected killed) [('tester.test.mjs ^every verb outside', 1)]
+b10 the tester list lets review.verdict through: killed (expected killed) [('tester.test.mjs ^every verb outside', 1)]
+b11 the tester list lets launch.revoke through: killed (expected killed) [('tester.test.mjs ^every verb outside', 1)]
+b12 the tester list lets launch.restore through: killed (expected killed) [('tester.test.mjs ^every verb outside', 1)]
+b13 the tester list lets event.emit through: survived (expected killed) [('tester.test.mjs ^every verb outside', 0)]
+b14 the tester list lets state through: killed (expected killed) [('tester.test.mjs ^every verb outside', 1)]
+b15 the tester list lets credentials through: killed (expected killed) [('tester.test.mjs ^every verb outside', 1)]
+b16 the tester list lets requirements through: survived (expected killed) [('tester.test.mjs ^every verb outside', 0)]
+b17 the tester list drops message.send: killed (expected killed) [('tester.test.mjs ^a tester message is from tester', 1)]
+b18 the tester list drops message.receive: killed (expected killed) [('tester.test.mjs ^a role answers a tester', 1)]
+b19 the tester list drops message.read: killed (expected killed) [('tester.test.mjs ^a role answers a tester', 1)]
+b20 the tester list drops inbox: killed (expected killed) [('tester.test.mjs ^the tester reads the human views', 1)]
+b21 the tester list drops agents: killed (expected killed) [('tester.test.mjs ^the tester reads the human views', 1)]
+b22 the tester list drops tasks: killed (expected killed) [('tester.test.mjs ^the tester reads the human views', 1)]
+b23 the tester list drops trail: killed (expected killed) [('tester.test.mjs ^the tester reads the human views', 1)]
+b24 the tester list drops decisions: killed (expected killed) [('tester.test.mjs ^the tester reads the human views', 1)]
+b25 the tester list drops messages: killed (expected killed) [('tester.test.mjs ^the tester reads the human views', 1)]
+b26 the tester list drops replies: killed (expected killed) [('tester.test.mjs ^the tester reads the human views', 1)]
+b27 a tester's reads use its own session, not the reader view: killed (expected killed) [('tester.test.mjs ^the tester reads the human views', 1)]
+b28 task verbs don't refuse a tester: killed (expected killed) [('tester.test.mjs ^every verb outside', 1)]
+b29 bindTester ignores the switch: killed (expected killed) [('tester.test.mjs ^the tester binds only', 1)]
+b30 bindTester takes any truthy switch: killed (expected killed) [('tester.test.mjs ^the tester binds only', 1)]
+b31 bindTester takes extra keys: killed (expected killed) [('tester.test.mjs ^the tester binds only', 1)]
+b32 a business may name a role tester: killed (expected killed) [('tester.test.mjs ^a business may not name', 1)]
+b33 a tester message takes corrects and decision: killed (expected killed) [('tester.test.mjs ^a tester message is from tester', 1)]
+b34 a tester may send to human or tester: killed (expected killed) [('tester.test.mjs ^a tester message is from tester', 1)]
+b35 no [mos test] prefix check: killed (expected killed) [('tester.test.mjs ^a tester message is from tester', 1)]
+b36 the prefix may sit anywhere: killed (expected killed) [('tester.test.mjs ^a tester message is from tester', 1)]
+b37 a role may send to tester unasked: killed (expected killed) [('tester.test.mjs ^a role answers a tester', 1)]
+b38 a reply to any message reaches tester: killed (expected killed) [('tester.test.mjs ^a role answers a tester', 1)]
+b39 the human may send to tester: killed (expected killed) [('tester.test.mjs ^a role answers a tester', 1)]
+b40 a tester message's from_run is null: killed (expected killed) [('tester.test.mjs ^a tester message is from tester', 1), ('tester.test.mjs ^talk --tester sends', 1)]
+b41 receive refuses a tester: killed (expected killed) [('tester.test.mjs ^a role answers a tester', 1)]
+b42 read refuses a tester: killed (expected killed) [('tester.test.mjs ^a role answers a tester', 1)]
+b43 a tester's delivery says broker: killed (expected killed) [('tester.test.mjs ^a role answers a tester', 1)]
+b44 a tester's receive holder looks up role tester: survived (expected survived) [('tester.test.mjs ^a role answers a tester', 0)]
+b45 a tester's read holder looks up role tester: survived (expected survived) [('tester.test.mjs ^a role answers a tester', 0)]
+b46 a launch may name role tester: killed (expected killed) [('tester.test.mjs ^a business may not name', 1)]
+s00 BASE's server.mjs under the new tests: killed (expected killed) [('tester.test.mjs ^an envelope carries', 1), ('tester.test.mjs ^tester-cli.mjs binds through', 1)]
+s01 the envelope counts only cap and human: killed (expected killed) [('tester.test.mjs ^an envelope carries', 1)]
+s02 the envelope has no tester key: killed (expected killed) [('tester.test.mjs ^an envelope carries', 1)]
+s03 no tester-required without an authenticator: killed (expected killed) [('tester.test.mjs ^an envelope carries', 1)]
+s04 the tester's capability outlives its request: killed (expected killed) [('tester.test.mjs ^an envelope carries', 1)]
+c01 the client never sends tester: killed (expected killed) [('tester.test.mjs ^an envelope carries', 1), ('tester.test.mjs ^tester-cli.mjs binds through', 1)]
+r01 the runtime serves no tester: killed (expected killed) [('tester.test.mjs ^tester-cli.mjs binds through', 1)]
+r02 the runtime checks the human CLI's path: killed (expected killed) [('tester.test.mjs ^tester-cli.mjs binds through', 1)]
+r03 the runtime gives the tester no launch records: killed (expected killed) [('tester.test.mjs ^tester-cli.mjs binds through', 1)]
+t01 no uid check: killed (expected killed) [('tester.test.mjs ^tester proof binds', 1)]
+t02 no start time check: survived (expected killed) [('tester.test.mjs ^tester proof binds', 0)]
+t03 no nonce check: killed (expected killed) [('tester.test.mjs ^tester proof binds', 1), ('tester.test.mjs ^neither CLI', 1)]
+t04 no CLI path check: killed (expected killed) [('tester.test.mjs ^tester proof binds', 1), ('tester.test.mjs ^neither CLI', 1)]
+t05 MOSAIC_BUS_CAP is no run marker: killed (expected killed) [('tester.test.mjs ^tester proof binds', 1), ('tester.test.mjs ^tester-cli.mjs binds through', 1)]
+t06 MOSAIC_RUN_ID is no run marker: killed (expected killed) [('tester.test.mjs ^tester proof binds', 1), ('tester.test.mjs ^tester-cli.mjs binds through', 1)]
+t07 MOSAIC_AGENT_RUN is no run marker: killed (expected killed) [('tester.test.mjs ^tester proof binds', 1), ('tester.test.mjs ^tester-cli.mjs binds through', 1)]
+t08 no launch record check: killed (expected killed) [('tester.test.mjs ^tester proof binds', 1), ('tester.test.mjs ^tester-cli.mjs binds through', 1)]
+t09 no loop check: killed (expected killed) [('tester.test.mjs ^tester proof binds', 1)]
+t10 no ppid check: killed (expected killed) [('tester.test.mjs ^tester proof binds', 1)]
+t11 no re-read of the CLI: killed (expected killed) [('tester.test.mjs ^tester proof binds', 1)]
+t12 no proof keys check: survived (expected killed) [('tester.test.mjs ^tester proof binds', 0)]
+t13 a pid of 1 passes the shape check: survived (expected killed) [('tester.test.mjs ^tester proof binds', 0)]
+t14 any nonce string passes the shape check: survived (expected killed) [('tester.test.mjs ^tester proof binds', 0)]
+t15 testerNonce reads the human's variable: killed (expected killed) [('tester.test.mjs ^testerNonce reads', 1), ('tester.test.mjs ^tester-cli.mjs binds through', 1)]
+k01 the shim proves with the human's variable: killed (expected killed) [('tester.test.mjs ^tester-cli.mjs binds through', 1)]
+k02 the shim takes extra request keys: killed (expected killed) [('tester.test.mjs ^tester-cli.mjs binds through', 1)]
+l01 --tester still refuses inside an agent: killed (expected killed) [('tester.test.mjs ^talk --tester sends', 1), ('tester.test.mjs ^the read verbs take', 1)]
+l02 no agent check without --tester: killed (expected killed) [('tester.test.mjs ^the read verbs take', 1)]
+l03 --tester uses the human transport: FAULT (expected killed) [('tester.test.mjs ^talk --tester sends', 'timeout'), ('tester.test.mjs ^the read verbs take', 1), ('tester.test.mjs ^with no stand-in transport', 1)]
+l04 the default --tester transport is the human's: killed (expected killed) [('tester.test.mjs ^with no stand-in transport', 1)]
+l05 talk --tester has no prefix check: killed (expected killed) [('tester.test.mjs ^talk --tester refuses', 1)]
+l06 talk takes no --tester: killed (expected killed) [('tester.test.mjs ^talk --tester sends', 1), ('tester.test.mjs ^talk --tester refuses', 1)]
+l07 the read verbs take no --tester: killed (expected killed) [('tester.test.mjs ^the read verbs take', 1)]
+l08 decide takes --tester: killed (expected killed) [('tester.test.mjs ^decide, stop and launches', 1)]
+x01 TESTER_CLI is the human CLI: MIXED (expected killed) [('tester.test.mjs ^the tester transport runs', 1), ('tester.test.mjs ^with no stand-in transport', 0)]
+x02 tester-required has no exit code: killed (expected killed) [('tester.test.mjs ^the tester transport runs', 1)]
+x03 tester-off has no exit code: killed (expected killed) [('tester.test.mjs ^the tester transport runs', 1)]
+x04 tester-refused has no exit code: killed (expected killed) [('tester.test.mjs ^the tester transport runs', 1)]
+x05 testerTransport runs the default CLI: killed (expected killed) [('tester.test.mjs ^the tester transport runs', 1), ('tester.test.mjs ^with no stand-in transport', 1)]
+v01 bus.tester at any layer: killed (expected killed) [('vars.test.mjs ^types', 1)]
+v02 bus.tester is not a var: killed (expected killed) [('vars.test.mjs ^types', 1), ('vars.test.mjs ^merge: defaults', 1)]
+v03 bus.tester takes any string: killed (expected killed) [('vars.test.mjs ^types', 1)]
+v04 bus.tester defaults on: killed (expected killed) [('vars.test.mjs ^merge: defaults', 1)]
+h01 no tester line: killed (expected killed) [('runner.test.mjs ^turnRequest says a tester', 1)]
+h02 the tester line on every message: killed (expected killed) [('runner.test.mjs ^turnRequest says a tester', 1)]
+end candidate a266a3aa195a7841 same 00:52:57
+MUTANTS_BAD ['b03 the tester list lets role.release through', 'b05 the tester list lets decision.raise through', 'b13 the tester list lets event.emit through', 'b16 the tester list lets requirements through', 't02 no start time check', 't12 no proof keys check', 't13 a pid of 1 passes the shape check', 't14 any nonce string passes the shape check', 'l03 --tester uses the human transport', 'x01 TESTER_CLI is the human CLI']
+exit 0
diff --git a/agents/darkwing/work/queue-110/r1/mutants-run-2.log b/agents/darkwing/work/queue-110/r1/mutants-run-2.log
new file mode 100644
index 000000000..9c3fd0d20
--- /dev/null
+++ b/agents/darkwing/work/queue-110/r1/mutants-run-2.log
@@ -0,0 +1,100 @@
+start candidate 9b24af36791edf1d 00:54:06 mutants 96
+b00 BASE's broker.mjs under the new tests: killed (expected killed) [('tester.test.mjs ^the tester binds only', 1), ('tester.test.mjs ^every verb outside', 1), ('tester.test.mjs ^a tester message is from tester', 1), ('tester.test.mjs ^a role answers a tester', 1), ('tester.test.mjs ^the tester reads the human views', 1), ('tester.test.mjs ^an envelope carries', 1), ('tester.test.mjs ^tester-cli.mjs binds through', 1)]
+b01 no tester verb gate: killed (expected killed) [('tester.test.mjs ^every verb outside', 1)]
+b02 the tester list lets role.claim through: killed (expected killed) [('tester.test.mjs ^every verb outside', 1), ('tester.test.mjs ^a business may not name', 1)]
+b03 the tester list lets role.release through: survived (expected survived) [('tester.test.mjs ^every verb outside', 0)]
+b04 the tester list lets role.revoke through: killed (expected killed) [('tester.test.mjs ^every verb outside', 1)]
+b05 the tester list lets decision.raise through: survived (expected survived) [('tester.test.mjs ^every verb outside', 0)]
+b06 the tester list lets decision.resolve through: killed (expected killed) [('tester.test.mjs ^every verb outside', 1)]
+b07 the tester list lets decision.seen through: killed (expected killed) [('tester.test.mjs ^every verb outside', 1)]
+b08 the tester list lets decision.withdraw through: killed (expected killed) [('tester.test.mjs ^every verb outside', 1)]
+b09 the tester list lets review.request through: killed (expected killed) [('tester.test.mjs ^every verb outside', 1)]
+b10 the tester list lets review.verdict through: killed (expected killed) [('tester.test.mjs ^every verb outside', 1)]
+b11 the tester list lets launch.revoke through: killed (expected killed) [('tester.test.mjs ^every verb outside', 1)]
+b12 the tester list lets launch.restore through: killed (expected killed) [('tester.test.mjs ^every verb outside', 1)]
+b13 the tester list lets event.emit through: survived (expected survived) [('tester.test.mjs ^every verb outside', 0)]
+b14 the tester list lets state through: killed (expected killed) [('tester.test.mjs ^every verb outside', 1)]
+b15 the tester list lets credentials through: killed (expected killed) [('tester.test.mjs ^every verb outside', 1)]
+b16 the tester list lets requirements through: survived (expected survived) [('tester.test.mjs ^every verb outside', 0)]
+b17 the tester list drops message.send: killed (expected killed) [('tester.test.mjs ^a tester message is from tester', 1)]
+b18 the tester list drops message.receive: killed (expected killed) [('tester.test.mjs ^a role answers a tester', 1)]
+b19 the tester list drops message.read: killed (expected killed) [('tester.test.mjs ^a role answers a tester', 1)]
+b20 the tester list drops inbox: killed (expected killed) [('tester.test.mjs ^the tester reads the human views', 1)]
+b21 the tester list drops agents: killed (expected killed) [('tester.test.mjs ^the tester reads the human views', 1)]
+b22 the tester list drops tasks: killed (expected killed) [('tester.test.mjs ^the tester reads the human views', 1)]
+b23 the tester list drops trail: killed (expected killed) [('tester.test.mjs ^the tester reads the human views', 1)]
+b24 the tester list drops decisions: killed (expected killed) [('tester.test.mjs ^the tester reads the human views', 1)]
+b25 the tester list drops messages: killed (expected killed) [('tester.test.mjs ^the tester reads the human views', 1)]
+b26 the tester list drops replies: killed (expected killed) [('tester.test.mjs ^the tester reads the human views', 1)]
+b27 a tester's reads use its own session, not the reader view: killed (expected killed) [('tester.test.mjs ^the tester reads the human views', 1)]
+b28 task verbs don't refuse a tester: killed (expected killed) [('tester.test.mjs ^every verb outside', 1)]
+b29 bindTester ignores the switch: killed (expected killed) [('tester.test.mjs ^the tester binds only', 1)]
+b30 bindTester takes any truthy switch: killed (expected killed) [('tester.test.mjs ^the tester binds only', 1)]
+b31 bindTester takes extra keys: killed (expected killed) [('tester.test.mjs ^the tester binds only', 1)]
+b32 a business may name a role tester: killed (expected killed) [('tester.test.mjs ^a business may not name', 1)]
+b33 a tester message takes corrects and decision: killed (expected killed) [('tester.test.mjs ^a tester message is from tester', 1)]
+b34 a tester may send to human or tester: killed (expected killed) [('tester.test.mjs ^a tester message is from tester', 1)]
+b35 no [mos test] prefix check: killed (expected killed) [('tester.test.mjs ^a tester message is from tester', 1)]
+b36 the prefix may sit anywhere: killed (expected killed) [('tester.test.mjs ^a tester message is from tester', 1)]
+b37 a role may send to tester unasked: killed (expected killed) [('tester.test.mjs ^a role answers a tester', 1)]
+b38 a reply to any message reaches tester: killed (expected killed) [('tester.test.mjs ^a role answers a tester', 1)]
+b39 the human may send to tester: killed (expected killed) [('tester.test.mjs ^a role answers a tester', 1)]
+b40 a tester message's from_run is null: killed (expected killed) [('tester.test.mjs ^a tester message is from tester', 1), ('tester.test.mjs ^talk --tester sends', 1)]
+b41 receive refuses a tester: killed (expected killed) [('tester.test.mjs ^a role answers a tester', 1)]
+b42 read refuses a tester: killed (expected killed) [('tester.test.mjs ^a role answers a tester', 1)]
+b43 a tester's delivery says broker: killed (expected killed) [('tester.test.mjs ^a role answers a tester', 1)]
+b44 a tester's receive holder looks up role tester: survived (expected survived) [('tester.test.mjs ^a role answers a tester', 0)]
+b45 a tester's read holder looks up role tester: survived (expected survived) [('tester.test.mjs ^a role answers a tester', 0)]
+b46 a launch may name role tester: killed (expected killed) [('tester.test.mjs ^a business may not name', 1)]
+b47 the tester list lets role.release through and #agent lets a tester in: killed (expected killed) [('tester.test.mjs ^every verb outside', 1)]
+b48 the tester list lets decision.raise through and #agent lets a tester in: killed (expected killed) [('tester.test.mjs ^every verb outside', 1)]
+b49 the tester list lets event.emit through and #agent lets a tester in: killed (expected killed) [('tester.test.mjs ^every verb outside', 1)]
+b50 the tester list lets requirements through and #agent lets a tester in: killed (expected killed) [('tester.test.mjs ^every verb outside', 1)]
+s00 BASE's server.mjs under the new tests: killed (expected killed) [('tester.test.mjs ^an envelope carries', 1), ('tester.test.mjs ^tester-cli.mjs binds through', 1)]
+s01 the envelope counts only cap and human: killed (expected killed) [('tester.test.mjs ^an envelope carries', 1)]
+s02 the envelope has no tester key: killed (expected killed) [('tester.test.mjs ^an envelope carries', 1)]
+s03 no tester-required without an authenticator: killed (expected killed) [('tester.test.mjs ^an envelope carries', 1)]
+s04 the tester's capability outlives its request: killed (expected killed) [('tester.test.mjs ^an envelope carries', 1)]
+c01 the client never sends tester: killed (expected killed) [('tester.test.mjs ^an envelope carries', 1), ('tester.test.mjs ^tester-cli.mjs binds through', 1)]
+r01 the runtime serves no tester: killed (expected killed) [('tester.test.mjs ^tester-cli.mjs binds through', 1)]
+r02 the runtime checks the human CLI's path: killed (expected killed) [('tester.test.mjs ^tester-cli.mjs binds through', 1)]
+r03 the runtime gives the tester no launch records: killed (expected killed) [('tester.test.mjs ^tester-cli.mjs binds through', 1)]
+t01 no uid check: killed (expected killed) [('tester.test.mjs ^tester proof binds', 1)]
+t02 no start time check: killed (expected killed) [('tester.test.mjs ^tester proof binds', 1)]
+t03 no nonce check: killed (expected killed) [('tester.test.mjs ^tester proof binds', 1), ('tester.test.mjs ^neither CLI', 1)]
+t04 no CLI path check: killed (expected killed) [('tester.test.mjs ^tester proof binds', 1), ('tester.test.mjs ^neither CLI', 1)]
+t05 MOSAIC_BUS_CAP is no run marker: killed (expected killed) [('tester.test.mjs ^tester proof binds', 1), ('tester.test.mjs ^tester-cli.mjs binds through', 1)]
+t06 MOSAIC_RUN_ID is no run marker: killed (expected killed) [('tester.test.mjs ^tester proof binds', 1), ('tester.test.mjs ^tester-cli.mjs binds through', 1)]
+t07 MOSAIC_AGENT_RUN is no run marker: killed (expected killed) [('tester.test.mjs ^tester proof binds', 1), ('tester.test.mjs ^tester-cli.mjs binds through', 1)]
+t08 no launch record check: killed (expected killed) [('tester.test.mjs ^tester proof binds', 1), ('tester.test.mjs ^tester-cli.mjs binds through', 1)]
+t09 no loop check: killed (expected killed) [('tester.test.mjs ^tester proof binds', 1)]
+t10 no ppid check: killed (expected killed) [('tester.test.mjs ^tester proof binds', 1)]
+t11 no re-read of the CLI: killed (expected killed) [('tester.test.mjs ^tester proof binds', 1)]
+t12 no proof keys check: killed (expected killed) [('tester.test.mjs ^tester proof binds', 1)]
+t13 a pid of 1 passes the shape check: killed (expected killed) [('tester.test.mjs ^tester proof binds', 1)]
+t14 any nonce string passes the shape check: killed (expected killed) [('tester.test.mjs ^tester proof binds', 1)]
+t15 testerNonce reads the human's variable: killed (expected killed) [('tester.test.mjs ^testerNonce reads', 1), ('tester.test.mjs ^tester-cli.mjs binds through', 1)]
+k01 the shim proves with the human's variable: killed (expected killed) [('tester.test.mjs ^tester-cli.mjs binds through', 1)]
+k02 the shim takes extra request keys: killed (expected killed) [('tester.test.mjs ^tester-cli.mjs binds through', 1)]
+l01 --tester still refuses inside an agent: killed (expected killed) [('tester.test.mjs ^talk --tester sends', 1), ('tester.test.mjs ^the read verbs take', 1)]
+l02 no agent check without --tester: killed (expected killed) [('tester.test.mjs ^the read verbs take', 1)]
+l03 --tester uses the human transport: killed (expected killed) [('tester.test.mjs ^the read verbs take', 1), ('tester.test.mjs ^with no stand-in transport', 1)]
+l04 the default --tester transport is the human's: killed (expected killed) [('tester.test.mjs ^with no stand-in transport', 1)]
+l05 talk --tester has no prefix check: killed (expected killed) [('tester.test.mjs ^talk --tester refuses', 1)]
+l06 talk takes no --tester: killed (expected killed) [('tester.test.mjs ^talk --tester sends', 1), ('tester.test.mjs ^talk --tester refuses', 1)]
+l07 the read verbs take no --tester: killed (expected killed) [('tester.test.mjs ^the read verbs take', 1)]
+l08 decide takes --tester: killed (expected killed) [('tester.test.mjs ^decide, stop and launches', 1)]
+x01 TESTER_CLI is the human CLI: killed (expected killed) [('tester.test.mjs ^the tester transport runs', 1)]
+x02 tester-required has no exit code: killed (expected killed) [('tester.test.mjs ^the tester transport runs', 1)]
+x03 tester-off has no exit code: killed (expected killed) [('tester.test.mjs ^the tester transport runs', 1)]
+x04 tester-refused has no exit code: killed (expected killed) [('tester.test.mjs ^the tester transport runs', 1)]
+x05 testerTransport runs the default CLI: killed (expected killed) [('tester.test.mjs ^the tester transport runs', 1), ('tester.test.mjs ^with no stand-in transport', 1)]
+v01 bus.tester at any layer: killed (expected killed) [('vars.test.mjs ^types', 1)]
+v02 bus.tester is not a var: killed (expected killed) [('vars.test.mjs ^types', 1), ('vars.test.mjs ^merge: defaults', 1)]
+v03 bus.tester takes any string: killed (expected killed) [('vars.test.mjs ^types', 1)]
+v04 bus.tester defaults on: killed (expected killed) [('vars.test.mjs ^merge: defaults', 1)]
+h01 no tester line: killed (expected killed) [('runner.test.mjs ^turnRequest says a tester', 1)]
+h02 the tester line on every message: killed (expected killed) [('runner.test.mjs ^turnRequest says a tester', 1)]
+end candidate 9b24af36791edf1d same 00:54:29
+MUTANTS_OK
+exit 0
diff --git a/agents/darkwing/work/queue-110/r1/mutants-run.log b/agents/darkwing/work/queue-110/r1/mutants-run.log
new file mode 100644
index 000000000..de0bcdad8
--- /dev/null
+++ b/agents/darkwing/work/queue-110/r1/mutants-run.log
@@ -0,0 +1,100 @@
+start candidate 7a4ab9c9a6c7770b 01:03:15 mutants 96
+b00 BASE's broker.mjs under the new tests: killed (expected killed) [('tester.test.mjs ^the tester binds only', 1), ('tester.test.mjs ^every verb outside', 1), ('tester.test.mjs ^a tester message is from tester', 1), ('tester.test.mjs ^a role answers a tester', 1), ('tester.test.mjs ^the tester reads the human views', 1), ('tester.test.mjs ^an envelope carries', 1), ('tester.test.mjs ^tester-cli.mjs binds through', 1)]
+b01 no tester verb gate: killed (expected killed) [('tester.test.mjs ^every verb outside', 1)]
+b02 the tester list lets role.claim through: killed (expected killed) [('tester.test.mjs ^every verb outside', 1), ('tester.test.mjs ^a business may not name', 1)]
+b03 the tester list lets role.release through: killed (expected killed) [('tester.test.mjs ^every verb outside', 1)]
+b04 the tester list lets role.revoke through: killed (expected killed) [('tester.test.mjs ^every verb outside', 1)]
+b05 the tester list lets decision.raise through: killed (expected killed) [('tester.test.mjs ^every verb outside', 1)]
+b06 the tester list lets decision.resolve through: killed (expected killed) [('tester.test.mjs ^every verb outside', 1)]
+b07 the tester list lets decision.seen through: killed (expected killed) [('tester.test.mjs ^every verb outside', 1)]
+b08 the tester list lets decision.withdraw through: killed (expected killed) [('tester.test.mjs ^every verb outside', 1)]
+b09 the tester list lets review.request through: killed (expected killed) [('tester.test.mjs ^every verb outside', 1)]
+b10 the tester list lets review.verdict through: killed (expected killed) [('tester.test.mjs ^every verb outside', 1)]
+b11 the tester list lets launch.revoke through: killed (expected killed) [('tester.test.mjs ^every verb outside', 1)]
+b12 the tester list lets launch.restore through: killed (expected killed) [('tester.test.mjs ^every verb outside', 1)]
+b13 the tester list lets event.emit through: killed (expected killed) [('tester.test.mjs ^every verb outside', 1)]
+b14 the tester list lets state through: killed (expected killed) [('tester.test.mjs ^every verb outside', 1)]
+b15 the tester list lets credentials through: killed (expected killed) [('tester.test.mjs ^every verb outside', 1)]
+b16 the tester list lets requirements through: killed (expected killed) [('tester.test.mjs ^every verb outside', 1)]
+b17 the tester list drops message.send: killed (expected killed) [('tester.test.mjs ^a tester message is from tester', 1)]
+b18 the tester list drops message.receive: killed (expected killed) [('tester.test.mjs ^a role answers a tester', 1)]
+b19 the tester list drops message.read: killed (expected killed) [('tester.test.mjs ^a role answers a tester', 1)]
+b20 the tester list drops inbox: killed (expected killed) [('tester.test.mjs ^the tester reads the human views', 1)]
+b21 the tester list drops agents: killed (expected killed) [('tester.test.mjs ^the tester reads the human views', 1)]
+b22 the tester list drops tasks: killed (expected killed) [('tester.test.mjs ^the tester reads the human views', 1)]
+b23 the tester list drops trail: killed (expected killed) [('tester.test.mjs ^the tester reads the human views', 1)]
+b24 the tester list drops decisions: killed (expected killed) [('tester.test.mjs ^the tester reads the human views', 1)]
+b25 the tester list drops messages: killed (expected killed) [('tester.test.mjs ^the tester reads the human views', 1)]
+b26 the tester list drops replies: killed (expected killed) [('tester.test.mjs ^the tester reads the human views', 1)]
+b27 a tester's reads use its own session, not the reader view: killed (expected killed) [('tester.test.mjs ^the tester reads the human views', 1)]
+b28 task verbs don't refuse a tester: killed (expected killed) [('tester.test.mjs ^every verb outside', 1)]
+b29 bindTester ignores the switch: killed (expected killed) [('tester.test.mjs ^the tester binds only', 1)]
+b30 bindTester takes any truthy switch: killed (expected killed) [('tester.test.mjs ^the tester binds only', 1)]
+b31 bindTester takes extra keys: killed (expected killed) [('tester.test.mjs ^the tester binds only', 1)]
+b32 a business may name a role tester: killed (expected killed) [('tester.test.mjs ^a business may not name', 1)]
+b33 a tester message takes corrects and decision: killed (expected killed) [('tester.test.mjs ^a tester message is from tester', 1)]
+b34 a tester may send to human or tester: killed (expected killed) [('tester.test.mjs ^a tester message is from tester', 1)]
+b35 no [mos test] prefix check: killed (expected killed) [('tester.test.mjs ^a tester message is from tester', 1)]
+b36 the prefix may sit anywhere: killed (expected killed) [('tester.test.mjs ^a tester message is from tester', 1)]
+b37 a role may send to tester unasked: killed (expected killed) [('tester.test.mjs ^a role answers a tester', 1)]
+b38 a reply to any message reaches tester: killed (expected killed) [('tester.test.mjs ^a role answers a tester', 1)]
+b39 the human may send to tester: killed (expected killed) [('tester.test.mjs ^a role answers a tester', 1)]
+b40 a tester message's from_run is null: killed (expected killed) [('tester.test.mjs ^a tester message is from tester', 1), ('tester.test.mjs ^talk --tester sends', 1)]
+b41 receive refuses a tester: killed (expected killed) [('tester.test.mjs ^a role answers a tester', 1)]
+b42 read refuses a tester: killed (expected killed) [('tester.test.mjs ^a role answers a tester', 1)]
+b43 a tester's delivery says broker: killed (expected killed) [('tester.test.mjs ^a role answers a tester', 1)]
+b44 a tester's receive holder looks up role tester: survived (expected survived) [('tester.test.mjs ^a role answers a tester', 0)]
+b45 a tester's read holder looks up role tester: survived (expected survived) [('tester.test.mjs ^a role answers a tester', 0)]
+b46 a launch may name role tester: killed (expected killed) [('tester.test.mjs ^a business may not name', 1)]
+b47 the tester list lets role.release through and #agent lets a tester in: killed (expected killed) [('tester.test.mjs ^every verb outside', 1)]
+b48 the tester list lets decision.raise through and #agent lets a tester in: killed (expected killed) [('tester.test.mjs ^every verb outside', 1)]
+b49 the tester list lets event.emit through and #agent lets a tester in: killed (expected killed) [('tester.test.mjs ^every verb outside', 1)]
+b50 the tester list lets requirements through and #agent lets a tester in: killed (expected killed) [('tester.test.mjs ^every verb outside', 1)]
+s00 BASE's server.mjs under the new tests: killed (expected killed) [('tester.test.mjs ^an envelope carries', 1), ('tester.test.mjs ^tester-cli.mjs binds through', 1)]
+s01 the envelope counts only cap and human: killed (expected killed) [('tester.test.mjs ^an envelope carries', 1)]
+s02 the envelope has no tester key: killed (expected killed) [('tester.test.mjs ^an envelope carries', 1)]
+s03 no tester-required without an authenticator: killed (expected killed) [('tester.test.mjs ^an envelope carries', 1)]
+s04 the tester's capability outlives its request: killed (expected killed) [('tester.test.mjs ^an envelope carries', 1)]
+c01 the client never sends tester: killed (expected killed) [('tester.test.mjs ^an envelope carries', 1), ('tester.test.mjs ^tester-cli.mjs binds through', 1)]
+r01 the runtime serves no tester: killed (expected killed) [('tester.test.mjs ^tester-cli.mjs binds through', 1)]
+r02 the runtime checks the human CLI's path: killed (expected killed) [('tester.test.mjs ^tester-cli.mjs binds through', 1)]
+r03 the runtime gives the tester no launch records: killed (expected killed) [('tester.test.mjs ^tester-cli.mjs binds through', 1)]
+t01 no uid check: killed (expected killed) [('tester.test.mjs ^tester proof binds', 1)]
+t02 no start time check: killed (expected killed) [('tester.test.mjs ^tester proof binds', 1)]
+t03 no nonce check: killed (expected killed) [('tester.test.mjs ^tester proof binds', 1), ('tester.test.mjs ^neither CLI', 1)]
+t04 no CLI path check: killed (expected killed) [('tester.test.mjs ^tester proof binds', 1), ('tester.test.mjs ^neither CLI', 1)]
+t05 MOSAIC_BUS_CAP is no run marker: killed (expected killed) [('tester.test.mjs ^tester proof binds', 1), ('tester.test.mjs ^tester-cli.mjs binds through', 1)]
+t06 MOSAIC_RUN_ID is no run marker: killed (expected killed) [('tester.test.mjs ^tester proof binds', 1), ('tester.test.mjs ^tester-cli.mjs binds through', 1)]
+t07 MOSAIC_AGENT_RUN is no run marker: killed (expected killed) [('tester.test.mjs ^tester proof binds', 1), ('tester.test.mjs ^tester-cli.mjs binds through', 1)]
+t08 no launch record check: killed (expected killed) [('tester.test.mjs ^tester proof binds', 1), ('tester.test.mjs ^tester-cli.mjs binds through', 1)]
+t09 no loop check: killed (expected killed) [('tester.test.mjs ^tester proof binds', 1)]
+t10 no ppid check: killed (expected killed) [('tester.test.mjs ^tester proof binds', 1)]
+t11 no re-read of the CLI: killed (expected killed) [('tester.test.mjs ^tester proof binds', 1)]
+t12 no proof keys check: killed (expected killed) [('tester.test.mjs ^tester proof binds', 1)]
+t13 a pid of 1 passes the shape check: killed (expected killed) [('tester.test.mjs ^tester proof binds', 1)]
+t14 any nonce string passes the shape check: killed (expected killed) [('tester.test.mjs ^tester proof binds', 1)]
+t15 testerNonce reads the human's variable: killed (expected killed) [('tester.test.mjs ^testerNonce reads', 1), ('tester.test.mjs ^tester-cli.mjs binds through', 1)]
+k01 the shim proves with the human's variable: killed (expected killed) [('tester.test.mjs ^tester-cli.mjs binds through', 1)]
+k02 the shim takes extra request keys: killed (expected killed) [('tester.test.mjs ^tester-cli.mjs binds through', 1)]
+l01 --tester still refuses inside an agent: killed (expected killed) [('tester.test.mjs ^talk --tester sends', 1), ('tester.test.mjs ^the read verbs take', 1)]
+l02 no agent check without --tester: killed (expected killed) [('tester.test.mjs ^the read verbs take', 1)]
+l03 --tester uses the human transport: killed (expected killed) [('tester.test.mjs ^the read verbs take', 1), ('tester.test.mjs ^with no stand-in transport', 1)]
+l04 the default --tester transport is the human's: killed (expected killed) [('tester.test.mjs ^with no stand-in transport', 1)]
+l05 talk --tester has no prefix check: killed (expected killed) [('tester.test.mjs ^talk --tester refuses', 1)]
+l06 talk takes no --tester: killed (expected killed) [('tester.test.mjs ^talk --tester sends', 1), ('tester.test.mjs ^talk --tester refuses', 1)]
+l07 the read verbs take no --tester: killed (expected killed) [('tester.test.mjs ^the read verbs take', 1)]
+l08 decide takes --tester: killed (expected killed) [('tester.test.mjs ^decide, stop and launches', 1)]
+x01 TESTER_CLI is the human CLI: killed (expected killed) [('tester.test.mjs ^the tester transport runs', 1)]
+x02 tester-required has no exit code: killed (expected killed) [('tester.test.mjs ^the tester transport runs', 1)]
+x03 tester-off has no exit code: killed (expected killed) [('tester.test.mjs ^the tester transport runs', 1)]
+x04 tester-refused has no exit code: killed (expected killed) [('tester.test.mjs ^the tester transport runs', 1)]
+x05 testerTransport runs the default CLI: killed (expected killed) [('tester.test.mjs ^the tester transport runs', 1), ('tester.test.mjs ^with no stand-in transport', 1)]
+v01 bus.tester at any layer: killed (expected killed) [('vars.test.mjs ^types', 1)]
+v02 bus.tester is not a var: killed (expected killed) [('vars.test.mjs ^types', 1), ('vars.test.mjs ^merge: defaults', 1)]
+v03 bus.tester takes any string: killed (expected killed) [('vars.test.mjs ^types', 1)]
+v04 bus.tester defaults on: killed (expected killed) [('vars.test.mjs ^merge: defaults', 1)]
+h01 no tester line: killed (expected killed) [('runner.test.mjs ^turnRequest says a tester', 1)]
+h02 the tester line on every message: killed (expected killed) [('runner.test.mjs ^turnRequest says a tester', 1)]
+end candidate 7a4ab9c9a6c7770b same 01:03:39
+MUTANTS_OK
+exit 0
diff --git a/agents/darkwing/work/queue-110/r1/mutants.py b/agents/darkwing/work/queue-110/r1/mutants.py
new file mode 100644
index 000000000..7cb255afb
--- /dev/null
+++ b/agents/darkwing/work/queue-110/r1/mutants.py
@@ -0,0 +1,196 @@
+#!/usr/bin/env python3
+# Row 110 (#1604) mutants. Each takes out or bends one new check; every named
+# (test file, name pattern) run must fail on it. b00 and s00 put BASE's
+# broker.mjs and server.mjs back under the new tests. Two mutants are expected
+# to survive (b44, b45); the comment at them says why. Each file is restored from its .orig after the run,
+# and the candidate (tracked diff plus the new files) must hash the same at
+# the end as at the start.
+import hashlib, os, signal, subprocess, sys, time
+
+WT = os.path.expanduser("~/darkwing-scratch/r110/wt")
+OUT = os.path.expanduser("~/darkwing-scratch/r110/mutants")
+ENV = dict(os.environ, TMPDIR=os.path.expanduser("~/darkwing-scratch/r110/tmp"))
+for k in ("MOSAIC_BUS_TESTER_NONCE", "MOSAIC_BUS_CLI_NONCE"): ENV.pop(k, None)
+os.makedirs(OUT, exist_ok=True)
+os.makedirs(ENV["TMPDIR"], exist_ok=True)
+
+BR, SV, CL, RT = (f"packages/bus/src/{f}.mjs" for f in ("broker", "server", "client", "runtime"))
+TS, TC = "packages/bus/src/tester.mjs", "packages/bus/src/tester-cli.mjs"
+CLI, TR = "packages/cli/src/cli.mjs", "packages/cli/src/transport.mjs"
+VARS, RUN = "packages/business/src/vars.mjs", "packages/harness/src/runner.mjs"
+BT, CT = "packages/bus/tests/tester.test.mjs", "packages/cli/tests/tester.test.mjs"
+BIND, ROLE, REFUSE = (BT, "^the tester binds only"), (BT, "^a business may not name"), (BT, "^every verb outside")
+SEND, REPLY, VIEWS = (BT, "^a tester message is from tester"), (BT, "^a role answers a tester"), (BT, "^the tester reads the human views")
+PROOF, CROSS, NONCE = (BT, "^tester proof binds"), (BT, "^neither CLI"), (BT, "^testerNonce reads")
+ENVL, SHIM = (BT, "^an envelope carries"), (BT, "^tester-cli.mjs binds through")
+TALK, PREFIX, READS = (CT, "^talk --tester sends"), (CT, "^talk --tester refuses"), (CT, "^the read verbs take")
+NOFLAG, TRANS, DEFAULT = (CT, "^decide, stop and launches"), (CT, "^the tester transport runs"), (CT, "^with no stand-in transport")
+TYPES, MERGE = ("packages/business/tests/vars.test.mjs", "^types"), ("packages/business/tests/vars.test.mjs", "^merge: defaults")
+TURN = ("packages/harness/tests/runner.test.mjs", "^turnRequest says a tester")
+
+def base(path):
+    return (path, None, subprocess.run(["git", "-C", WT, "show", "HEAD:" + path], capture_output=True, text=True, check=True).stdout)
+
+ALLOWED = ['message.send', 'message.receive', 'message.read', 'inbox', 'agents', 'tasks', 'trail', 'decisions', 'messages', 'replies']
+TV = "const TESTER_VERBS = [" + ", ".join(f"'{v}'" for v in ALLOWED) + "];"
+def verbs(vs): return "const TESTER_VERBS = [" + ", ".join(f"'{v}'" for v in vs) + "];"
+REFUSED = ['role.claim', 'role.release', 'role.revoke', 'decision.raise', 'decision.resolve', 'decision.seen', 'decision.withdraw',
+           'review.request', 'review.verdict', 'launch.revoke', 'launch.restore', 'event.emit', 'state', 'credentials', 'requirements']
+NEEDS = {'message.send': [SEND], 'message.receive': [REPLY], 'message.read': [REPLY]}
+REPLY_BLOCK = """          // A role answers a tester only in reply to a tester's message.
+          if (
+            a.to === 'tester' &&
+            !(id(a.in_reply_to) && this.#store.get("SELECT 1 FROM messages WHERE id=? AND business=? AND from_role='tester'", a.in_reply_to, s.business))
+          )
+            fail('tester-reply-required');
+"""
+DEF_TT = "testerTransport({ socket: socketPath(system.dataRoot), business, env: io.env, spawn: deps.testerSpawn })"
+
+# (name, [(path, old, new)], [(test, pattern)], expect) with old None for a whole-file replacement.
+M = [
+    ("b00 BASE's broker.mjs under the new tests", [base(BR)], [BIND, REFUSE, SEND, REPLY, VIEWS, ENVL, SHIM], "killed"),
+    ("b01 no tester verb gate", [(BR, "        if (s.tester && !TESTER_VERBS.includes(request.verb)) fail('tester-refused');\n", "")], [REFUSE], "killed"),
+]
+# These four call #agent first, and #agent refuses a tester with the same code. Each checks its
+# arguments before #agent, though, so REFUSE's malformed-argument calls kill them (the first run had
+# them survive). b47-b50 add each one with #agent's tester line removed too.
+AGENT_FIRST = ['role.release', 'decision.raise', 'event.emit', 'requirements']
+AGENT_TESTER = (BR, "    if (s.tester) fail('tester-refused');\n    if (s.reader) fail('read-only');\n", "    if (s.reader) fail('read-only');\n")
+for i, v in enumerate(REFUSED):
+    M.append((f"b{2 + i:02d} the tester list lets {v} through", [(BR, TV, verbs(ALLOWED + [v]))], [REFUSE] + ([ROLE] if v == "role.claim" else []), "killed"))
+for i, v in enumerate(ALLOWED):
+    M.append((f"b{17 + i:02d} the tester list drops {v}", [(BR, TV, verbs([x for x in ALLOWED if x != v]))], NEEDS.get(v, [VIEWS]), "killed"))
+M += [
+    ("b27 a tester's reads use its own session, not the reader view", [(BR, "s.tester && !request.verb.startsWith('message.') ? { ...s, reader: true } : s", "s")], [VIEWS], "killed"),
+    ("b28 task verbs don't refuse a tester", [(BR, "    if (s.tester) fail('tester-refused');\n    if (s.reader) fail('read-only');\n", "    if (s.reader) fail('read-only');\n")], [REFUSE], "killed"),
+    ("b29 bindTester ignores the switch", [(BR, "    if (this.#business(record.business).vars?.['bus.tester'] !== true) fail('tester-off');\n", "")], [BIND], "killed"),
+    ("b30 bindTester takes any truthy switch", [(BR, "this.#business(record.business).vars?.['bus.tester'] !== true", "!this.#business(record.business).vars?.['bus.tester']")], [BIND], "killed"),
+    ("b31 bindTester takes extra keys", [(BR, "    keys(record, ['business'], ['business']);\n    if (this.#business(record.business).vars", "    if (this.#business(record.business).vars")], [BIND], "killed"),
+    ("b32 a business may name a role tester", [(BR, "role === 'human' || role === 'tester'", "role === 'human'")], [ROLE], "killed"),
+    ("b33 a tester message takes corrects and decision", [(BR, "          keys(a, ['to', 'body', 'class', 'in_reply_to'], ['to', 'body']);\n", "")], [SEND], "killed"),
+    ("b34 a tester may send to human or tester", [(BR, "          if (!Object.hasOwn(b.roles, a.to)) fail('unknown-role');\n          if (typeof a.body", "          if (typeof a.body")], [SEND], "killed"),
+    ("b35 no [mos test] prefix check", [(BR, "          if (typeof a.body !== 'string' || !a.body.startsWith(TESTER_PREFIX)) fail('tester-prefix');\n", "")], [SEND], "killed"),
+    ("b36 the prefix may sit anywhere", [(BR, "!a.body.startsWith(TESTER_PREFIX)", "!a.body.includes(TESTER_PREFIX)")], [SEND], "killed"),
+    ("b37 a role may send to tester unasked", [(BR, REPLY_BLOCK, "")], [REPLY], "killed"),
+    ("b38 a reply to any message reaches tester", [(BR, " AND from_role='tester'\", a.in_reply_to", "\", a.in_reply_to")], [REPLY], "killed"),
+    ("b39 the human may send to tester", [(BR, "          this.#human(s);\n          if (a.to === 'tester') fail('unknown-role');\n", "          this.#human(s);\n")], [REPLY], "killed"),
+    ("b40 a tester message's from_run is null", [(BR, "s.human ? 'human-cli' : s.tester ? 'tester-cli' : s.run", "s.human ? 'human-cli' : s.run")], [SEND, TALK], "killed"),
+    ("b41 receive refuses a tester", [(BR, "        else if (!s.tester) this.#agent(s);\n        const role", "        else this.#agent(s);\n        const role")], [REPLY], "killed"),
+    ("b42 read refuses a tester", [(BR, "        else if (!s.tester) this.#agent(s);\n        const m =", "        else this.#agent(s);\n        const m =")], [REPLY], "killed"),
+    ("b43 a tester's delivery says broker", [(BR, "s.human || s.tester ? 'cli' : 'broker'", "s.human ? 'cli' : 'broker'")], [REPLY], "killed"),
+    # Equivalent: role_claims rows come only from role.claim (role = the session's role) and #claimEnd
+    # (role = an existing holder's). The constructor refuses a business role named tester (b32), bindLaunch
+    # refuses a role outside the business (b46), and the tester's own role.claim refuses (b02). So
+    # #holder(business, 'tester') is always undefined and #delivery writes a null holder either way.
+    ("b44 a tester's receive holder looks up role tester", [(BR, "            s.human || s.tester ? null : this.#holder(s.business, s.role),\n", "            s.human ? null : this.#holder(s.business, s.role),\n")], [REPLY], "survived"),
+    ("b45 a tester's read holder looks up role tester", [(BR, "'read', s.human || s.tester ? null :", "'read', s.human ? null :")], [REPLY], "survived"),
+    ("b46 a launch may name role tester", [(BR, "    if (!Object.hasOwn(b.roles, record.role)) fail('unknown-role');\n    identifier(record.run);", "    if (!Object.hasOwn(b.roles, record.role) && record.role !== 'tester') fail('unknown-role');\n    identifier(record.run);")], [ROLE], "killed"),
+    *[(f"b{47 + i} the tester list lets {v} through and #agent lets a tester in", [(BR, TV, verbs(ALLOWED + [v])), AGENT_TESTER], [REFUSE], "killed") for i, v in enumerate(AGENT_FIRST)],
+    ("s00 BASE's server.mjs under the new tests", [base(SV)], [ENVL, SHIM], "killed"),
+    ("s01 the envelope counts only cap and human", [(SV, "[r.cap, r.human, r.tester].filter(Boolean).length !== 1", "Boolean(r.cap) === Boolean(r.human)")], [ENVL], "killed"),
+    ("s02 the envelope has no tester key", [(SV, "['cap', 'human', 'tester', 'verb', 'args']", "['cap', 'human', 'verb', 'args']")], [ENVL], "killed"),
+    ("s03 no tester-required without an authenticator", [(SV, "          if (!authenticateTester) throw new BusError('tester-required');\n", "")], [ENVL], "killed"),
+    ("s04 the tester's capability outlives its request", [(SV, "          transient = cap = authenticateTester(r.tester);", "          cap = authenticateTester(r.tester);")], [ENVL], "killed"),
+    ("c01 the client never sends tester", [(CL, "this.tester ? { tester: this.tester } : { cap: this.cap }", "{ cap: this.cap }")], [ENVL, SHIM], "killed"),
+    ("r01 the runtime serves no tester", [(RT, "      authenticateTester: (proof) => {", "      _authenticateTester: (proof) => {")], [SHIM], "killed"),
+    ("r02 the runtime checks the human CLI's path", [(RT, "new URL('./tester-cli.mjs', import.meta.url)", "new URL('./human-cli.mjs', import.meta.url)")], [SHIM], "killed"),
+    ("r03 the runtime gives the tester no launch records", [(RT, "cliPath: fileURLToPath(new URL('./tester-cli.mjs', import.meta.url)),\n          launches: launchRecords,", "cliPath: fileURLToPath(new URL('./tester-cli.mjs', import.meta.url)),\n          launches: [],")], [SHIM], "killed"),
+    ("t01 no uid check", [(TS, "      p.uid !== process.getuid() ||\n", "")], [PROOF], "killed"),
+    ("t02 no start time check", [(TS, "      p.startTime !== proof.startTime ||\n", "")], [PROOF], "killed"),
+    ("t03 no nonce check", [(TS, "      nonce !== proof.nonce ||\n", "")], [PROOF, CROSS], "killed"),
+    ("t04 no CLI path check", [(TS, "      p.argv[1] !== resolve(cliPath)\n", "      false\n")], [PROOF, CROSS], "killed"),
+    ("t05 MOSAIC_BUS_CAP is no run marker", [(TS, "['MOSAIC_BUS_CAP', 'MOSAIC_RUN_ID', 'MOSAIC_AGENT_RUN']", "['MOSAIC_RUN_ID', 'MOSAIC_AGENT_RUN']")], [PROOF, SHIM], "killed"),
+    ("t06 MOSAIC_RUN_ID is no run marker", [(TS, "['MOSAIC_BUS_CAP', 'MOSAIC_RUN_ID', 'MOSAIC_AGENT_RUN']", "['MOSAIC_BUS_CAP', 'MOSAIC_AGENT_RUN']")], [PROOF, SHIM], "killed"),
+    ("t07 MOSAIC_AGENT_RUN is no run marker", [(TS, "['MOSAIC_BUS_CAP', 'MOSAIC_RUN_ID', 'MOSAIC_AGENT_RUN']", "['MOSAIC_BUS_CAP', 'MOSAIC_RUN_ID']")], [PROOF, SHIM], "killed"),
+    ("t08 no launch record check", [(TS, " ||\n        launches.some((r) => r.pid === current.pid && r.startTime === current.startTime)\n", "\n")], [PROOF, SHIM], "killed"),
+    ("t09 no loop check", [(TS, "      if (seen.has(current.pid)) refuse();\n", "")], [PROOF], "killed"),
+    ("t10 no ppid check", [(TS, "      if (current.ppid < 2) refuse();\n", "")], [PROOF], "killed"),
+    ("t11 no re-read of the CLI", [(TS, "        if (again.startTime !== proof.startTime || again.ppid !== p.ppid) refuse();\n", "")], [PROOF], "killed"),
+    ("t12 no proof keys check", [(TS, "    Object.keys(proof).some((k) => !['pid', 'startTime', 'nonce', 'business'].includes(k)) ||\n", "")], [PROOF], "killed"),
+    ("t13 a pid of 1 passes the shape check", [(TS, "    proof.pid < 2 ||\n", "")], [PROOF], "killed"),
+    ("t14 any nonce string passes the shape check", [(TS, "    !/^[a-f0-9]{64}$/.test(proof.nonce)\n", "    false\n")], [PROOF], "killed"),
+    ("t15 testerNonce reads the human's variable", [(TS, "const NONCE = 'MOSAIC_BUS_TESTER_NONCE=';", "const NONCE = 'MOSAIC_BUS_CLI_NONCE=';")], [NONCE, SHIM], "killed"),
+    ("k01 the shim proves with the human's variable", [(TC, "      nonce: process.env.MOSAIC_BUS_TESTER_NONCE,", "      nonce: process.env.MOSAIC_BUS_CLI_NONCE,")], [SHIM], "killed"),
+    ("k02 the shim takes extra request keys", [(TC, "    Object.keys(request).some((k) => !['business', 'verb', 'args'].includes(k))", "    false")], [SHIM], "killed"),
+    ("l01 --tester still refuses inside an agent", [(CLI, "  if (!tester) refuseInsideAgent(io.env);\n", "  refuseInsideAgent(io.env);\n")], [TALK, READS], "killed"),
+    ("l02 no agent check without --tester", [(CLI, "  if (!tester) refuseInsideAgent(io.env);\n", "")], [READS], "killed"),
+    # Not TALK: on the human stand-in, talk waits its full 900 s for a reply that goes to the tester.
+    ("l03 --tester uses the human transport", [(CLI, "  if (tester) return deps.testerTransport ? deps.testerTransport(business) : " + DEF_TT + ";\n", "")], [READS, DEFAULT], "killed"),
+    ("l04 the default --tester transport is the human's", [(CLI, ": " + DEF_TT, ": human" + DEF_TT[len("tester"):].replace("Transport", "Transport", 1))], [DEFAULT], "killed"),
+    ("l05 talk --tester has no prefix check", [(CLI, "  if (!receiveOnly && parsed.flags.has(\"--tester\") && !body.startsWith(TESTER_PREFIX)) throw new CliError(`a tester message starts with \"${TESTER_PREFIX}\"`, 2);\n", "")], [PREFIX], "killed"),
+    ("l06 talk takes no --tester", [(CLI, 'flags: ["--follow", "--tester"]', 'flags: ["--follow"]')], [TALK, PREFIX], "killed"),
+    ("l07 the read verbs take no --tester", [(CLI, '{ flags: ["--json", "--tester"], values: ["--business"] }', '{ flags: ["--json"], values: ["--business"] }')], [READS], "killed"),
+    ("l08 decide takes --tester", [(CLI, '{ flags: ["--yes"], values: ["--business", "--note"] }', '{ flags: ["--yes", "--tester"], values: ["--business", "--note"] }')], [NOFLAG], "killed"),
+    # The default-transport test compares argv with the imported TESTER_CLI, so it follows this mutant; TRANS pins the path.
+    ("x01 TESTER_CLI is the human CLI", [(TR, 'new URL("../../bus/src/tester-cli.mjs", import.meta.url)', 'new URL("../../bus/src/human-cli.mjs", import.meta.url)')], [TRANS], "killed"),
+    ("x02 tester-required has no exit code", [(TR, '  "tester-required": 3,\n', "")], [TRANS], "killed"),
+    ("x03 tester-off has no exit code", [(TR, '  "tester-off": 3,\n', "")], [TRANS], "killed"),
+    ("x04 tester-refused has no exit code", [(TR, '  "tester-refused": 3,\n', "")], [TRANS], "killed"),
+    ("x05 testerTransport runs the default CLI", [(TR, "humanTransport({ cli: TESTER_CLI, ...options })", "humanTransport({ ...options })")], [TRANS, DEFAULT], "killed"),
+    ("v01 bus.tester at any layer", [(VARS, '"bus.tester": def(["business"], boolean,', '"bus.tester": def(["system", "business", "project", "agent"], boolean,')], [TYPES], "killed"),
+    ("v02 bus.tester is not a var", [(VARS, '  "bus.tester": def(["business"], boolean, { default: false }),\n', "")], [TYPES, MERGE], "killed"),
+    ("v03 bus.tester takes any string", [(VARS, '"bus.tester": def(["business"], boolean,', '"bus.tester": def(["business"], string(),')], [TYPES], "killed"),
+    ("v04 bus.tester defaults on", [(VARS, '"bus.tester": def(["business"], boolean, { default: false })', '"bus.tester": def(["business"], boolean, { default: true })')], [MERGE], "killed"),
+    ("h01 no tester line", [(RUN, 'm.from_role === "tester"', "false")], [TURN], "killed"),
+    ("h02 the tester line on every message", [(RUN, 'm.from_role === "tester"', "true")], [TURN], "killed"),
+]
+
+def candidate_hash():
+    h = hashlib.sha256(subprocess.run(["git", "-C", WT, "diff", "--", ".", ":!node_modules"], capture_output=True).stdout)
+    new = subprocess.run(["git", "-C", WT, "ls-files", "--others", "--exclude-standard"], capture_output=True, text=True).stdout.split()
+    for f in sorted(x for x in new if x != "node_modules"):
+        h.update(f.encode()); h.update(open(os.path.join(WT, f), "rb").read())
+    return h.hexdigest()
+
+def run(test, pattern, log):
+    pkg = os.path.join(WT, *test.split("/")[:2])
+    with open(log, "ab") as f:
+        f.write(f"== {test} /{pattern}/\n".encode()); f.flush()
+        p = subprocess.Popen(["node", "--test", f"--test-name-pattern={pattern}", os.path.relpath(os.path.join(WT, test), pkg)], cwd=pkg, env=ENV,
+                             stdout=f, stderr=subprocess.STDOUT, start_new_session=True)
+        try:
+            rc = p.wait(timeout=300)
+        except subprocess.TimeoutExpired:
+            os.killpg(p.pid, signal.SIGKILL); p.wait(); return "timeout"
+    # A pattern that matched nothing passes with no tests; count that as a fault.
+    tail = open(log, encoding="utf8", errors="replace").read().split(f"== {test} /{pattern}/\n")[-1]
+    ran = sum(int(l.split()[2]) for l in tail.splitlines() if l.startswith(("ℹ pass ", "ℹ fail ", "ℹ cancelled ")))
+    return "no-tests" if ran == 0 else rc
+
+for _, edits, *_ in M:
+    for path, *_ in edits:
+        if os.path.exists(os.path.join(WT, path + ".orig")):
+            sys.exit(f"STOP {path}.orig exists")
+start = candidate_hash()
+print(f"start candidate {start[:16]} {time.strftime('%H:%M:%S', time.gmtime())} mutants {len(M)}", flush=True)
+bad = []
+only = set(sys.argv[1:])
+for name, edits, tests, expect in M:
+    if only and name.split()[0] not in only: continue
+    srcs = {}
+    ok = True
+    for path, old, new in edits:
+        full = os.path.join(WT, path)
+        src = srcs.get(path) or open(full).read()
+        if old is not None and src.count(old) != 1:
+            print(f"{name}: ANCHOR {path} {src.count(old)}", flush=True); ok = False; break
+        srcs[path] = new if old is None else src.replace(old, new)
+    if not ok:
+        bad.append(name); continue
+    for path in srcs: os.rename(os.path.join(WT, path), os.path.join(WT, path + ".orig"))
+    try:
+        for path, text in srcs.items(): open(os.path.join(WT, path), "w").write(text)
+        log = os.path.join(OUT, name.split()[0] + ".log")
+        open(log, "w").close()
+        rcs = [run(t, p, log) for t, p in tests]
+    finally:
+        for path in srcs: os.replace(os.path.join(WT, path + ".orig"), os.path.join(WT, path))
+    if any(rc in ("timeout", "no-tests") for rc in rcs): got = "FAULT"
+    elif all(rc != 0 for rc in rcs): got = "killed"
+    elif all(rc == 0 for rc in rcs): got = "survived"
+    else: got = "MIXED"
+    print(f"{name}: {got} (expected {expect}) {list(zip([t.split('/')[-1] + ' ' + p for t, p in tests], rcs))}", flush=True)
+    if got != expect: bad.append(name)
+end = candidate_hash()
+print(f"end candidate {end[:16]} {'same' if end == start else 'CHANGED'} {time.strftime('%H:%M:%S', time.gmtime())}", flush=True)
+print("MUTANTS_OK" if not bad and end == start else f"MUTANTS_BAD {bad}")