row 198 r4: BUILD.md records the rebase onto 45dca69f6 (sage-3586)

Conflict hunks, the range-diff against r3-253, the auto-merged files to rerun, and the four fake-board tests not yet ported. Status UNVERIFIED; no test has run.

agents/bushroot/work/queue-198/BUILD.md

@@ -187,3 +187,111 @@ Still in the README, on purpose: `packages/webui/README.md` line 826 runs the co
   500 for that case would need `ConfigError` to tell refusals from scan failures.
 - M14: Sage accepted the gap as recorded (sage-2834). The mutant run is the check.
 - Push: not done. Sage's gaps govern it.
+
+## r4: rebase onto 45dca69f6 (sage-3575 step 1, sage-3586 ruling a)
+
+Branch `bushroot/row198-r4-45dca69f6`: the eight r3 commits replayed on `origin/refactor` 45dca69f6.
+`bushroot/row198-r3-253` stays at 1fb66792e and is not touched. Seven commits replayed clean. Only the
+retire commit (0bde5c8d7, now 4288b7b16) conflicted, in three files and seven hunks.
+
+Ruling applied: every upstream feature stays (federation view, decisionWrite, userOptions, the
+`/api/config` fields, granted-user gating). The board runs in-process. The URL proxy to a board origin is
+removed, because the proxy is the route to the 7331 writer that row 198 retires. This is the one place an
+upstream behaviour changes. Board routes now answer from the in-process board with the same response
+shapes. A granted user still gets `owner-only` 403 on board routes, because the granted-user gate runs before
+them.
+
+### Conflict hunks
+
+Each hunk: upstream side, our side, resolution, reason.
+
+1. `packages/webui/src/serve.mjs`, `startServer` signature. Upstream: `board = DEFAULT_BOARD`, with
+   `decisionWrite`, `userOptions`, `federation`. Ours: `board = null`, none of the three. Resolved: upstream
+   signature with `board = null`, and our doc comment above it. Reason: keeps upstream's parameters; no board
+   is now the default, not port 7331.
+2. `packages/webui/src/serve.mjs`, body after the tester checks. Upstream: decision check, `confirmations`,
+   `const upstream = boardURL(board)`, `userOptions` check, `owner` with `upstream`, `hub`. Ours: nothing.
+   Resolved: upstream minus `const upstream = boardURL(board);`; `owner` drops `upstream`. Reason:
+   `boardURL` is the proxy's loopback validator; there is no proxy. The `let {...}` destructure and the
+   granted-user `upstream = null` line lose the same name.
+3. `packages/webui/src/serve.mjs`, the board proxy block (`allowed`, `fetch(upstream + path ...)`, 502 on
+   failure). Upstream: the proxy, after the read-only gate. Ours: nothing here; in-process routes sit at two
+   points. Writes (`/api/seen`, `/api/reply`) answer 405 for a non-POST, 403 `{error:'read-only', sent:false}`
+   without `--send` and a named human, 503 with no board, then `boardSend`. Reads (`/api/board`,
+   `/api/conversations`, `/api/conversation`) answer 405 for a non-GET, 503 with no board, then
+   `consoleRead(board.index())` or `board.conversation`. Resolved: ours, upstream block removed. Reason: this
+   block is the 7331 route. Auth check order: the sign-in gate (401 for an unsigned request under `--sso`)
+   and the granted-user owner-only gate both run before the write routes and the read routes.
+4. `packages/webui/src/serve.mjs`, `/api/config`. Upstream: `board: upstream`. Ours: `board: boardLabel`.
+   Resolved: `board: granted ? null : boardLabel`, with every upstream field after it unchanged. Reason:
+   upstream sent `null` to a granted user (its `upstream` was null); `boardLabel` is `'in the Console'` for the
+   owner and `null` with no system config.
+5. `packages/webui/src/cli.mjs`, imports. Upstream: `DEFAULT_BOARD` in the `./serve.mjs` import, plus the bus
+   and console imports. Ours: `createBoard`, the two scan discovery imports, and `busCaller` again. Resolved:
+   upstream imports minus `DEFAULT_BOARD`, plus `createBoard` and `discoverRepoAgents`/`discoverFleetAgents`.
+   Reason: `DEFAULT_BOARD` no longer exists; `busCaller` was already imported by upstream.
+6. `packages/webui/src/cli.mjs`, the `startServer` call. Upstream: `board: options.board`, with
+   `federation: system?.federation ?? null`. Ours: `board`, without `federation`, `decisionWrite`,
+   `userOptions`. Resolved: upstream call with `board`. Reason: `--board` is refused at `cli.mjs:39`, so
+   `options.board` no longer exists; the new `board` is the in-process object.
+7. `packages/webui/src/public/app.js`, `/api/config` handler. Upstream: `board = config.board`, the federation
+   render, the sso line. Ours: `board = config.board || 'the Console board'`. Resolved: upstream handler with
+   our fallback label. Reason: `config.board` is `null` for a granted user and with no system config, which
+   would print `Board: null`.
+
+### Upstream tests changed to match (same commit, 4288b7b16)
+
+Upstream added tests that pass a URL board string or `f.boardURL`. Each now means "no board" (`board: null`,
+which answers the board routes 503) or the in-process fixture (`f.board`). `board: 'http://127.0.0.1:9'` and
+`board:'http://127.0.0.1:9'` became `board: null`; `f.boardURL` became `f.board` in decide-browser,
+thread-claims-browser, processing-browser and granted-user. No assertion compared the URL string. The fake
+`DEFAULT_BOARD` export strings in library-cli and thread-claims are left: they are fake module text, not board
+config.
+
+### Not ported: fake HTTP board servers (known to fail; port before the gate)
+
+These still pass a fake HTTP origin as `board`. The in-process board never calls it, so each test's
+board-route assumptions are false now. Each needs a read and a port to an in-process `board` object:
+
+- `packages/webui/tests/browser-edge.test.mjs:19` (waits for an HTTP `/api/board` request, lines 15 and 31)
+- `packages/webui/tests/preview.test.mjs:62` (fake board answers `/api/board`; line 160 asserts 200)
+- `packages/webui/tests/tester-listener.test.mjs:29` (`hits` counter on the fake board)
+- `packages/webui/tests/shell.test.mjs:111` and `:427` (fake board with unavailable, empty, one, fail, refuse modes)
+
+Also a risk, not checked: any test that reaches a board route with no `board` argument. The default moved
+from 7331 (a 502 on a dead origin) to `null` (503). A test asserting 502 there would now fail.
+
+### Range-diff
+
+`git range-diff 48e450ce8..bushroot/row198-r3-253 45dca69f6..HEAD`, markers only:
+
+    1:  0bde5c8d7 ! 1:  4288b7b16 retire the board writer on 7331 (resolved above)
+    2:  69ac924bc = 2:  aad3000fe build design item 8; killers for M1-M15; B4 drops; docs; BUILD.md
+    3:  716b46adf = 3:  77c12b554 rollback always drops --board (sage-2834 ruling a)
+    4:  0bb5f230f = 4:  c9c8badc3 drop --board for every op, reason by target (sage-2837)
+    5:  d388f47ec = 5:  f2fd6145a real-run M13 pairs, reply join killer M16, real-board M14 (sage-2839)
+    6:  02d5bd9b4 = 6:  f913d0e76 index() clears a settled scan; B4 tests and mutant M17 (webby-0157)
+    7:  25565fa97 = 7:  41b5aae3c BUILD.md places the reply join killer (B3, M16)
+    8:  1fb66792e = 8:  3c57ebb22 BUILD.md records N2 as a named follow-up (sage-2868)
+
+Seven commits are unchanged by patch-id. Only the retire commit is `!`.
+
+### Files to rerun (auto-merged or changed on rebase)
+
+The drift check found nine paths touched by both r3 and upstream. Six auto-merged and need a test rerun:
+
+- `packages/cli/tests/stack-release.test.mjs`
+- `packages/webui/README.md`
+- `packages/webui/tests/browser.test.mjs`
+- `packages/webui/tests/chat-browser.test.mjs`
+- `packages/webui/tests/chat.test.mjs`
+- `scripts/stack-release.sh`
+
+The three conflicted src files are in the hunk list above. The 21 upstream-stub test files listed above also
+need a rerun, because the drift check did not cover them: they are upstream-only changes.
+
+### Gate status
+
+UNVERIFIED. No node, no test run, and no mutant has run on r4. The gate waits for Sage's CLEAR, after 226,
+220/216 and 285 in gate order. The four fake-board tests above are known red. The rest are unknown until the
+run.