honker: row 194 b7 notes: rebase onto dcd8d4dda (row 254), channel-proof pin, N3 as a behaviour change, routes.set keep and M-next, mutant (a) kill file corrected, N6 ruling for S6

agents/honker/work/queue-194/BUILD.md

@@ -865,3 +865,44 @@ belongs to row 191. Rocko and I agreed its shape in
 S6 maps killed and alive to `lifecycle.end.killed` and `lifecycle.end.alive`, and V3 terminate stays TERM
 only. It wires onto Rocko's implementation commit (`rocko/row191-stoprun-v1`) when that arrives. S6
 doesn't use the root-wide halt sweep.
+
+### b7: rebase onto row 254 (dcd8d4dda) and Webby's b6 review (webby-0095, sage-2246, sage-2248, sage-2251)
+
+`honker/row194-b7` replays all eight row 194 commits since da9555ca2 onto dcd8d4dda (row 254 landed as
+331597709, with docs in eb9672c91), plus the routes.set fix. b6 isn't changed.
+- Conflict: one, in `channel-proof.test.mjs`, the `webui/src/bus.mjs` pin. I kept row 194's comment and
+  pinned the merged file (15e8123f...). The other three pins (human.mjs, human-cli.mjs, transport.mjs) still
+  match their files.
+- `webui/src/bus.mjs` merged clean. Row 194's two tracker STATUS entries and row 254's six library entries
+  sit in separate lines, with no duplicate key.
+- `DEFERRED.md` merged clean and keeps both of row 194's entries.
+- Base drift that touches the manifest: those three paths only.
+
+Behaviour change for review (sage-2246, the b6 N3 fix): an agent can no longer re-point a
+`launch.models` key that a kept instance's `vars.model` names. Since the key is shared, that also
+changes the model for every other instance on that key. Only the human can. The chief may still add a
+key, or change one that no kept instance names. Before b6, the chief could re-point any key.
+
+webby-0095 N1 (sage-2248): routes.set was a second way to write a kept instance's model. setRoutes now
+calls `keptHumanOnly` after `creativeHumanOnly`, so the chief and the tester both get `instance-kept` and
+the human can still re-route. That makes b6's "the tester included" true on the bus: limits.set isn't a
+tester verb, but routes.set is. Test: "B7 kept instance: its route is the human's" in
+launch-settings.test.mjs.
+- **M-next**: drop that `keptHumanOnly` call from setRoutes. The new test has to kill it.
+
+Correction to the b6 notes: mutant (a), the instances.set-only restart line, can only be killed by
+reload.test. The CLI and Console tests stub the bus, so they never run runtime.mjs. The run list
+uses reload.test for (a).
+
+The run list for Sage's CLEAR is `scratch/honker-t/b7/runb7.sh <sha>`:
+- Each touched test file runs alone, on the committed candidate: reload, chief-of-staff, lifecycle-revoke,
+  channel-proof, instance-settings, launch-settings, cli instances, webui agents and agents-browser.
+- Then mutants (a), (b) (no fireCheck before step A: reload and chief-of-staff) and M-next
+  (launch-settings), each restored and checked clean.
+- The full gate with Docker reachable, and P3, wait for S6.
+
+N6 (sage-2246), done in the S6 commit, not before: when terminate's signal pass moves onto
+`stopRun`, it narrows to DESIGN.md:118-120. That means the runs the verb wrote into `lifecycle.end`, plus
+registry runs of the instance that have spawned but not bound. The test: a run that binds after the
+verb survives the pass, and the next terminate ends it. The mutant widens the pass back to every
+registry run of the instance.