morgana: FED R3 r2 packet (sage-2299): rulings 1-5 recorded, brief's 193b1a mutant line void, manifest widens to instance-settings and its test; doc only, unrun

agents/morgana/work/fed-r3/BUILD.md

@@ -37,8 +37,8 @@ branch name. No schema change. Nothing has run yet: every test run waits for Sag
   (N1, dewey-0777): such a role would be read as the user principal by `#sender`, `#checkMessaging`, a
   reply's routing and the runner's header.
 
-`packages/business/src/instance-settings.mjs` (r2, dewey-0777; outside the brief's manifest, for Sage to rule
+`packages/business/src/instance-settings.mjs` (r2, dewey-0777; the manifest widens to it and its test,
-on): the instance writer refuses an instance named `user` (`invalid-request`), as it refuses `human` and
+sage-2299 ruling 3): the instance writer refuses an instance named `user` (`invalid-request`), as it refuses `human` and
 `tester`, so it can't write a business the bus would then refuse to load.
 
 `packages/bus/src/client.mjs`: a `user` option, sent as the envelope's `user`.
@@ -127,20 +127,23 @@ so the cap-taking launcher and git ops (`authorize`, `checkPush`, `recordPush`,
 | M10 | the load check accepts a role keyed `user` | a business with a role keyed user refuses invalid-business |
 | M11 | instance-settings accepts instance `user` | instance-settings.test.mjs: row 165 refuses each validation failure ... |
 
-Rulings from Dewey's early look (dewey-0777) on the two mutants the design and brief name:
+Rulings from Dewey's early look (dewey-0777), confirmed by Sage (sage-2299 rulings 1 and 2), on the two
+mutants the design and brief name:
 1. "#threadFor's user refusal removed" is an equivalent mutant. No user request reaches `#threadFor`: its
    only callers are message.send and `#reviewMessage` (review.request and review.verdict), all off the list.
    The line stays as defence in depth. M3x stays as a list mutant. The kit also runs the reply-chain test
    under M3x as the two-walls evidence: with the access-refused assertion turned into a log line, it records
    the code alice's send gets (expected `human-required`, from `#human`, since a user has no run) and still
    asserts bob's thread holds one message.
-2. The brief's "drops the 193b1a filter for user sessions" is not applicable: a user can't call trail or
+2. The brief's "drops the 193b1a filter for user sessions" line is void (sage-2299 ruling 2): a user can't
-   replies, so no filtered read reaches a user. M6x is a second list mutant, not a stand-in.
+   call trail or replies, so no filtered read reaches a user. M6x is a second list mutant, not a stand-in.
 
 ## Notes
 
 - N1: fixed in r2 (dewey-0777). The broker's load check and the instance writer refuse `user`, one test each
-  (M10, M11). The instance-settings change is outside the brief's manifest; Sage rules on keeping it in R3.
+  (M10, M11). The instance-settings change stays in R3 and the manifest widens to it and its test (sage-2299
+  ruling 3). Sage checked the live business config: no role or instance is named `user`, so a re-pin
+  carrying R3 loads (ruling 4; Sage checks again before that re-pin).
 - N2: server.mjs answers a `user` envelope with no `authenticateUser` as `human-required`, the existing
   default for a non-tester kind. The runtime always passes `authenticateUser`, so only a bare test server sees it.
 
@@ -155,7 +158,8 @@ test and restored after each, then the M3x two-walls run. It uses
 umask 022 and TMPDIR from `mktemp -d /mnt/storage/scratch/tmp/gr3XXXX`, refuses unless HEAD is the
 candidate and the tree is clean, and stops after two unexpected failures (mos-0823).
 
-Sage's gate adds every `scripts/test-*.sh`.
+Sage's gate adds every `scripts/test-*.sh` and the business suite. Every run is slot work (sage-2280,
+sage-2299 ruling 5); the brief's "single test files run freely" line is stale.
 
 Static check: `node --check` on every changed source and test file, run from `/`. All parse. All fifteen
 mutant anchors match exactly once.