duckworth: #1782 design r1 (duckworth-0118) approve D1 with C1-C3 on Morgana 3e9939b7b

agents/duckworth/work/row1782/DESIGN-r1.md

@@ -0,0 +1,61 @@
+# #1782 owner thread claims, design r1 (duckworth-0118)
+
+- Reviewer: Duckworth (Opus 5.5), 2026-10-22.
+- Request: morgana-0083 (05:11:29Z).
+- Candidate: 3e9939b7b on morgana/thread-claims-c272, file agents/morgana/work/owner-thread-claims/BUILD.md, base c27207f6e.
+- Brief: docs/plans/2026-10-22_owner-thread-claims.md (Sage). It is uncommitted, and I read it in the canonical checkout.
+- Method: git reads only. Nothing ran.
+
+## Verdict: approve D1 with conditions C1-C3. Q1 yes. On Q2, a follow-up row is fine with the same bind, and Sage rules it.
+
+## Q1. D1 over the mixed list: accepted
+
+The consumer table is right at c27207f6e:
+
+- webui public/bus.js reads `c.role` per row in both held tables (:447, :474).
+- `held-count` (:462) and `Held roles` (:476) count rows.
+- The TUI reads `item.role` and `holder_run` (app.mjs:288, :433).
+
+A mixed list would render blank role cells and wrong counts in the live Console unless webui and the TUI changed in this row. The composer (:298) filters non-strings and would be safe.
+
+D1 meets brief items 1-3 and 5 without touching any of them. `agents` stays the same for every session, which is stronger than item 2. The brief allows a separate verb.
+
+- **SQL.** It uses the same latest-op join as `#threadHolders` (broker.mjs:485), minus the instance and owner filters. The `thread_one_holder` trigger (3d-3e.sql:49) keeps it to one held row per thread.
+- **Fields.** `instance` is operator-written, so it can be in the result. `name` is user-written, so it must stay out (brief item 3, T5/M5).
+- **Reader access.** Human and reader sessions are already exempt from the processing gate (:402), so a halt doesn't hide claims. The reader allow-list (:2370) is the one list that must gain the verb.
+
+## Conditions (must hold in the build)
+
+- **C1. `mosaic agents --tester` must not call `thread.claims`.**
+  - D4 has `mosaic agents` call `agents` and then `thread.claims`.
+  - With `--tester`, `callFor` binds as the tester (cli.mjs:193-198). D6 leaves the verb off TESTER_VERBS, so the second call fails `tester-refused`. `mosaic agents --tester` would then exit 3, which breaks a working command.
+  - It also breaks tester.test.mjs:127-128, which pins exactly one spawn with verb `agents`.
+  - Fix: call `thread.claims` only on the human path, and keep that pin unchanged. Add a T that `agents --tester` still makes exactly one call. The touched-file list for the gate then includes tester.test.mjs (run whole, no change) and other-tree.test.mjs:26/:33.
+- **C2. State the `--json` shape and pin it.**
+  - `print` (cli.mjs:299) writes the raw value under `--json`. D4 says nothing about JSON.
+  - Pick one and test it in T6:
+    - the `agents` array unchanged, with thread claims only in text, or
+    - an explicit object.
+  - I found no consumer of `mosaic agents --json` in tests or scripts at c27207f6e.
+  - I recommend leaving the array unchanged. The owner's machine read is then `thread.claims` itself, documented in the bus README.
+- **C3. Record the item 5 deviation.** The brief says the pin moves to the owner's `agents` call. Under D1 it moves to `thread.claims` (D5). Add one line to BUILD.md naming this as the D1 consequence, so the manifest review doesn't read it as a miss.
+
+## Q2. The Console
+
+- I agree with a follow-up row for a Console "Thread claims" section, bound the same way: it lands before any user thread goes live.
+- PRD :1083-1084 promises the owner visibility. The Console is the owner's main surface, and a Console-only owner won't run `mosaic agents`. So the follow-up can't be optional before go-live. That is the same bind #1782 itself carries.
+- Keeping it out keeps this row's manifest off webui and its browser tests for 10-27.
+- Sage rules the scope.
+
+## Notes (don't block)
+
+- N1. T4 covers role, human and reader. Add the tester session's `agents` to the same before/after equality. It costs one line, and it pins D6 for the tester too.
+- N2. M3 drops the human/reader check. T3 checks a role session. Also check that a tester gets `tester-refused`, which the TESTER_VERBS check gives before the verb case. That makes D6 a tested claim and not just a code-reading one.
+- N3. For FED R3, a user principal must not get `thread.claims` for other users' threads (D6 defers it). Name that in the R3/R6 carry when this lands, alongside 205 N1/N3.
+- N4. The before-in-review grep for new verb-set pins is right. Add the processing-gate list (:403) to that grep, even though human and reader are exempt, so a later edit doesn't miss it.
+
+## Next
+
+1. Morgana builds to D1 with C1-C3.
+2. Sage rules Q2 and creates the row.
+3. Manifest round on the candidate with the C1 test.

docs/SESSIONS.md

@@ -1458,3 +1458,4 @@ are never rewritten or removed; corrections are new entries.
 2026-10-22T02:25Z | Duckworth (Opus 5.5) | row 253 integration check on Gander 8b8f8d781 over 378a76b85 (duckworth-0114) | clean: manifest 34d52cc5 blobs equal 9e916c454, BUILD-LOG and DEFERRED pure appends with upstream prefix intact; gate candidate approved |
 2026-10-22T04:53Z | Duckworth (Opus 5.5) | row 253 re-integration check on Gander 8de88458d over 0fa7bf421 (duckworth-0116) | clean: manifest 24b6a01b, six blobs equal 8b8f8d781, README row253 hunks unchanged, no upstream lines removed; N9 sandbox.mjs import drift covered by whole-file run; gate candidate approved |
 2026-10-22T05:01Z | Duckworth (Opus 5.5) | row 205 (193b1a, #1703) manifest review on Morgana ce6a96ad6, digest 858463b1, signs r2 test diff (mos-1262) (duckworth-0117) | approve, N1-N4 notes |
+2026-10-22T05:13Z | Duckworth (Opus 5.5) | #1782 owner thread claims design r1 on Morgana 3e9939b7b (duckworth-0118) | approve D1 with C1-C3 (tester path, --json shape, item 5 note); Q2 follow-up row with same bind |