diff --git a/BUILD-LOG.md b/BUILD-LOG.md
index 9277a58c7..7cac8d622 100644
--- a/BUILD-LOG.md
+++ b/BUILD-LOG.md
@@ -5478,3 +5478,5 @@ remain; no live state, schema or bus policy change.
 2026-10-24T07:18:53Z | Sage | Row 327 (#1825, Bradford, Poe and Dewey) LANDED 68c08b4e7. Before: refactor at 94d9e90a6; the push guard was a scratch script with no reviewed-binary check. After: scripts/push-check.sh and scripts/test-push-check.sh on refactor, 3 commits cherry-picked onto 6a5e12511 with blobs equal to the round 3 tip d858c9f8b, plus doc commits 76f84465f and 68c08b4e7. Binaries are found by numstat or a NUL in the first 8000 committed bytes, regardless of attributes; each needs its sha256 and path in an approved latest-round candidate; an unconfirmed queue tail exits 2. Reviews: Poe c31525 rev 3882, Dewey c31526 rev 3883. Gate: 1st run 06:57Z RED, not the candidate: canonical node_modules was empty from 05:45:15Z (sage-4023). Rerun with its own root npm ci GREEN 07:15:49Z: 17 package suites 0 failures (cli 986, plugins 119, webui 418), 11 scripts exit 0, push-check 6 mutants KILLED; skips are the queue canonical-root check and the row 244 live provider cases. The landed push-check.sh passed its own push (NO_BINARY, NO_ATTRIBUTION, PUSH_READY). mos-1575: gates install their own node_modules; canonical restored with npm ci (128 packages).
 
 - 2026-10-24 (rockerduck, row 286 / #1791, r3 before gate): transplanted Ludwig 45dca69f6..573fa0be0 onto b19ffa04f, preserved newer exports in sole index.mjs conflict; plain-text range-diff, patch IDs and reader/pin drift inventory in agents/rockerduck/work/queue-286/BUILD.md. UNTESTED by sage-4040: no setup or tests until CLEAR.
+
+- 2026-10-24 (rockerduck, row 286 / #1791, r3 after sage-4054 CLEAR): own-worktree installs; library 140/140 and bus 963/963; M1 forced-refspec and M2 missing-inode-compare killed at semantic assertions, restored before final suites; all gate-output fixture searches zero. Four first-run reds only in new credential test; setup corrections and intermediate findings recorded in agents/rockerduck/work/queue-286/BUILD.md. No old test edited during gate; shell/CLI suites remain Sage landing gate.
diff --git a/agents/rockerduck/work/queue-286/BUILD.md b/agents/rockerduck/work/queue-286/BUILD.md
index 02ff4d0d0..c0d5c41e2 100644
--- a/agents/rockerduck/work/queue-286/BUILD.md
+++ b/agents/rockerduck/work/queue-286/BUILD.md
@@ -458,3 +458,67 @@ The changed reader/mapping/survey interfaces add supporting scope and editor.use
 - First push succeeded through the repository helper; remote ls-remote confirms 29e830cac8f9ad1cd7e449eefd6053c7c2b841ab on rockerduck/row286-r3. Ready-for-CLEAR sent to Sage as rockerduck-0002.
 - git diff --check passed. Both changed test files compare byte-identically to Ludwig 573fa0be0; pre-existing sync test bodies compare byte-identically to b19ffa04f. These are static checks only.
 - No setup, npm, tests or mutants run. Remain at the explicit CLEAR boundary.
+
+## CLEAR gate (sage-4054, 2026-10-24)
+
+Sage released the slot at 10:33:37Z for 4b8261f41. Dependencies installed only in this worktree:
+- Root: npm ci --ignore-scripts --no-audit --no-fund -> 0 (128 packages).
+- packages/webui: same command -> 0 (2 packages).
+- Short TMPDIR created using export TMPDIR=$(mktemp -d /mnt/storage/scratch/tmp/XXXXXX).
+- Commands: timeout -k 10 900 node --test packages/library/tests/*.test.mjs;
+  timeout -k 10 1800 node --test packages/bus/tests/*.test.mjs.
+- No scripts/test-*.sh run by this seat: Sage runs every shell suite at landing; CLI counts from that landing gate (mos-1561).
+- Queue commands are no longer wrapped in timeout (sage-4054); no lock edits.
+
+First-run results: library 140/140; bus 959 passed, four failed, all in the NEW
+packages/bus/tests/library-credential.test.mjs. No old-test red. New-test setup fixes,
+placed under sage-4054 / mos-1272 without changing production policy:
+1. T7/T9 grant-chief-only at original line 150: boss is definition pm, and grant raises
+   require chief-of-staff. Bind/claim the existing chief and let it raise its own grant;
+   boss retains the separately ruled fire role. No SQL staging for grants/revokes/fire.
+2. T7 rehire at original line 215 and T8 two-chief at original line 234: Broker clones
+   its input. Explicitly reloadBusiness after changing each fixture organization.
+3. Next T9 run reached runtime and exposed its app project's missing checkout root
+   (project-path). Give verbDoc an explicit scratch root and app-checkout path.
+4. Next T9 assertion read credential before the initial timer published: command
+   construction only marks the start of the fetch. Wait for the completed sync log.
+   Also register runtime.close with t.after so assertion failure cannot retain its timer.
+5. Reopen of the shared T9 store found the fixture runs still claimed (role-already-held).
+   Release those runs through role.release before closing/reopening the fixture broker.
+
+Focused credential reruns exposed each newly reached setup path; final focused result
+6/6. The intermediate fixture run with a failed assertion retained a timer; its own
+180-second timeout process was terminated and the next run registered runtime cleanup.
+No other seat/process or canonical state was changed.
+
+Final complete suites after fixes and restored mutants:
+- library: 140 tests, 140 pass, 0 fail/cancelled/skipped/todo; exit 0.
+- bus: 963 tests, 963 pass, 0 fail/cancelled/skipped/todo; exit 0.
+- Both production trees match pre-gate 4b8261f41 byte-for-byte (git diff --quiet).
+- The pre-existing sync test declaration block still matches b19ffa04f byte-for-byte.
+
+Mutants (sequential, restored in finally before final suites):
+- M1 adds + only to syncCommand's push refspec. timeout -k 10 180 node --test,
+  pattern 'C2-03b argv|C2-03b T2', sync.test.mjs: exit 1, 2/2 semantic failures
+  at argv assertion line 331 and race result assertion line 365.
+- M2 removes only askpass's inode comparison. Same timeout, pattern 'C2-03b T5 helper':
+  exit 1, swapped-file refusal assertion at lines 510/526 fails.
+- A scratch Node reporter prints failed test names, assertion locations and counts only;
+  it excludes assertion values so the deliberately broken helper cannot print a fixture
+  token in diagnostics. Both mutants' output searches found zero matches.
+
+Evidence: gate-library.txt and gate-bus.txt contain final full text output;
+mutant-M1.txt and mutant-M2.txt contain mutant failure locations/counts. token-search.txt
+records exact fixture-string and general-pattern match counts for every captured run.
+Six exact fixture values were checked in memory; every count is zero. T1/T9 also cover
+argv, mirror config, data-root files and runtime log non-disclosure as specified in Ludwig's
+T11 map. No fixture values are printed by the search.
+
+The static-output slip reported before CLEAR remains in the earlier operational record;
+it is not represented as a clean source-inspection history. The gate-run outputs are clean.
+
+Candidate manifest covers all nine changed packages paths, inherited Ludwig rulings,
+this BUILD and gate receipts. Shared append-only BUILD-LOG/SESSIONS are excluded from
+candidate hashes so unrelated later appends do not invalidate the review.
+
+Scratch run directory retained for landing audit: /mnt/storage/scratch/tmp/FcfQ9q
diff --git a/agents/rockerduck/work/queue-286/candidate-manifest.sha256 b/agents/rockerduck/work/queue-286/candidate-manifest.sha256
new file mode 100644
index 000000000..766687554
--- /dev/null
+++ b/agents/rockerduck/work/queue-286/candidate-manifest.sha256
@@ -0,0 +1,16 @@
+7fab157be380502b726c4a84772bfb667850766062e4952b73f172f5ada363ed  agents/ludwig/work/queue-286/BUILD.md
+7ce8537c45ab0dc66a6a33c1f0db838506c96e4fe313dc197755aa7aa0dd41cb  agents/rockerduck/work/queue-286/BUILD.md
+e5026111e3c84f1294c80631fc5d5dad6dc77166209acdfd07c6ea8755469e19  agents/rockerduck/work/queue-286/gate-bus.txt
+4e191637baa4d8683679fd6e84d81e29ec6fe64faf38b4b33f9b5965fce1dfcf  agents/rockerduck/work/queue-286/gate-library.txt
+50291819572752733a1c33e846e1e1e8d66e89b677a6a6d0cc7d2402e8fa82ea  agents/rockerduck/work/queue-286/mutant-M1.txt
+ade72e9641ac5ee97b1ceaa266d54b48d28d0d613f415a030547963664a04646  agents/rockerduck/work/queue-286/mutant-M2.txt
+b3b9a19825a43f33942746bbaaa93670453d4f21b63005d915d9cf92523e9143  agents/rockerduck/work/queue-286/token-search.txt
+b6c4c71e83d90a4415337cd5bad93200232ff3a74e0bdc303c1351c2f1a4aae4  packages/bus/src/broker.mjs
+a93e322bd27fea2a5fe6a2f89aad04d9cf96b6cc2004dc1c663af5a46494fb09  packages/bus/src/runtime.mjs
+44e62c044caf66358c4469cd1549aebadaa1bc22e681e4e2ce1c8e07dae649b4  packages/bus/tests/library-credential.test.mjs
+d9c523d830c57df9fedf5cb42e6c74999fde529751e8a5eea95b3ae097d8548d  packages/library/README.md
+5c9b528fd69a2493f04933fc84f352b1101d276d69d9982806975def614fd740  packages/library/bin/askpass
+978c7a404baeb52c472948a57a606c0881793c25ee85feef68b681f9ea15fc05  packages/library/src/index.mjs
+0bea0f3553ecfca8bee81e545faf5142e5fa6521ea971fbd2d8a78932d644f2b  packages/library/src/mirror.mjs
+784af63a417b547b195ca835878daeba5b696b42a83a4c95de6728a0efa75e38  packages/library/src/sync.mjs
+c8500795d80f56536f0ffd17bcad4f38778d4b06ec39030200c17f31c750ac94  packages/library/tests/sync.test.mjs
diff --git a/agents/rockerduck/work/queue-286/gate-bus.txt b/agents/rockerduck/work/queue-286/gate-bus.txt
new file mode 100644
index 000000000..d6d71415f
--- /dev/null
+++ b/agents/rockerduck/work/queue-286/gate-bus.txt
@@ -0,0 +1,1017 @@
+✔ R4: the timer sweep after a hand edit ends only the lost user's run; its next call refuses thread-revoked (66.558264ms)
+✔ R4: an expiry with no write and no request ends the run at the next timer sweep (52.533654ms)
+✔ R4: a downgrade to viewer is a loss (41.753671ms)
+✔ R4: another user's request after a hand edit ends the lost user's run, and its own run stays (53.685786ms)
+✔ R4: a request reads the access file only when its stamp changed, once per change (47.338505ms)
+✔ R4: access.reload ends the lost runs at once for the human; the tester, a reader, an agent and a user are refused (55.503537ms)
+✔ R4: threadsState marks revoked: true on the lost user's thread only, a pending message included (37.84812ms)
+✔ R4: threadsState after an expiry with no write and no sweep ends the claim before it marks the row revoked (49.278347ms)
+✔ R4: a new run of a revoked thread refuses thread-revoked at bind and at claim; a rebind is allowed (38.444503ms)
+✔ R4 runtime: a hand edit ends the run at the first timer period, intervalMs is checked, and close stops the timer (90.507545ms)
+✔ REQ-LIMIT-4 3h copy migrates to 3i: every row keeps its seq, the sequence carries over, and only the account CHECK changes (186.183526ms)
+✔ REQ-LIMIT-4 a 3h→3i step that fails partway leaves the store at 3h with every row, the sequence and the schema intact (206.505839ms)
+✔ REQ-LIMIT-4 the 3h engine refuses a migrated store, migrating or not, and leaves it as it was (179.912228ms)
+✔ parseAddress: one (1.788166ms)
+✔ parseAddress: many (0.184192ms)
+✔ parseAddress: repeat (0.142988ms)
+✔ parseAddress: plain (0.135413ms)
+✔ parseAddress: stop (0.141266ms)
+✔ parseAddress: EOF tag (0.135192ms)
+✔ parseAddress: EOF last tag (0.126744ms)
+✔ parseAddress: leading whitespace (0.161112ms)
+✔ parseAddress: tags only (0.171809ms)
+✔ parseAddress: empty (0.22795ms)
+✔ parseAddress: whitespace (0.124336ms)
+✔ parseAddress: bare at (0.100353ms)
+✔ parseAddress: punctuation is a name (0.103192ms)
+✔ parseAddress rejects non-text without coercion (0.487235ms)
+✔ the mounted address parser has no import dependency (0.302528ms)
+✔ agents: a held role with nothing on the bus is idle; a role session gets the claim rows unchanged (49.532555ms)
+✔ agents: working counts what the holder received and has not read; routed alone is not working (45.334483ms)
+✔ agents: input needed is the role's open decisions routed to the human, gated first, then oldest (74.050935ms)
+✔ agents: working wins over waiting, and Input needed still shows (36.393667ms)
+✔ agents: a new holder doesn't inherit what the last one left unread; decisions stay with the role (38.258065ms)
+✔ agents: state reads only its own business, even for a run name both use (37.794656ms)
+✔ agents: a message the holder released unread is stranded; the next holder gets nothing and cannot read it (43.709086ms)
+✔ agents: a message the holder read is not stranded; one the current holder has not read is not listed (40.662212ms)
+✔ agents: stranded is oldest first and capped at 50 for a role (164.586306ms)
+✔ agents: stranded is per role and per business (64.743808ms)
+✔ agents: a message routed to a held role and not yet received is not stranded (30.552944ms)
+✔ REQ-DEC an approval outlives its run and a broker restart; a new run of the instance consumes it once (67.706895ms)
+✔ REQ-DEC another instance of the same definition cannot consume an approval, and its refusal consumes nothing (36.514681ms)
+✔ REQ-DEC REQ-THREAD-1 a thread approval is consumed only by a run holding the same thread (50.331284ms)
+✔ REQ-DEC a later run of the same instance supersedes an open decision; another instance cannot (43.760169ms)
+✔ REQ-DEC REQ-THREAD-1 a thread decision is superseded only from the same thread (48.019024ms)
+✔ REQ-DEC REQ-THREAD-1 a thread instance decision raised before row 121 is not consumed or superseded by any thread run (68.977036ms)
+✔ launch identity is stamped, payload identity is refused and stale holder cannot send (44.995991ms)
+✔ decision classes route from policy; gated resolution is human-only, choice and target must match (51.923098ms)
+✔ claim exclusion, holder release, gated revoke and rerouting to a new holder are atomic (53.930004ms)
+✔ launch events require a human CLI capability; generic emit cannot forge authority events (32.825989ms)
+✔ within-role decisions close atomically and invalid options or blocking omissions refuse (35.527235ms)
+✔ a recommendation that is not exactly one option key refuses invalid-recommendation after the options (52.659519ms)
+✔ observer capabilities read human inbox but cannot mutate or forge launch identity (31.98951ms)
+✔ task action subjects and linked decision trail are complete and ordered (46.202338ms)
+✔ launch binding is durable and reconnecting requires the identical trusted record (24.750766ms)
+✔ business isolation includes inherited object names and cross-business message references (41.227476ms)
+✔ authority never transfers between action, target, unresolved or replaced role holder; a later run of the instance keeps it (50.042243ms)
+✔ task projection uses schema current view, skipping earlier and equal-start polls (26.994822ms)
+✔ revocation permanently bars the old run from reclaiming first, including after broker restart (39.344205ms)
+✔ empty message references refuse before storage; refusal-evidence failure stays a typed error (30.632169ms)
+✔ both arbiters require human resolution when their cross-role route is themselves (51.263462ms)
+✔ the shipped coder role raises task.reassign as gated to the human; task.scope.change stays cross-role (38.558973ms)
+✔ S1 adapter takes resolved limits and refs, rejects mismatched instance, never mutates input (3.480189ms)
+✔ channel conversion preserves the four proof/transport byte baselines and modules cannot import a proof caller (1.625508ms)
+✔ channel recovery still requires the same shim path and rejects an absent or forged proof (591.708411ms)
+organization: {"event":"reload-needs-restart","business":"demo"}
+organization: {"event":"reload-needs-restart","business":"demo"}
+organization: {"event":"reload-needs-restart","business":"demo"}
+organization: {"event":"reload-needs-restart","business":"demo"}
+organization: {"event":"reload-needs-restart","business":"demo"}
+organization: {"event":"reload-needs-restart","business":"demo"}
+organization: {"event":"reload-needs-restart","business":"demo"}
+organization: {"event":"reload-needs-restart","business":"demo"}
+organization: {"event":"reload-needs-restart","business":"demo"}
+✔ REQ-COS-1, REQ-ROLE-2: the chief of staff ends a run with a reason and no decision, and the reason is logged (64.737992ms)
+✔ REQ-ROLE-2: a role without role.end still needs a resolved decision to revoke (57.146188ms)
+✔ REQ-ROLE-2: storage accepts a revoke with a reason or a decision and aborts one with neither (43.723131ms)
+✔ REQ-ROLE-2: the chief of staff may still cite a decision, and a decision alone is the old path (44.495355ms)
+✔ REQ-ROLE-2: a role without role.end still ends a run through a resolved decision, which is recorded and has no reason (54.125313ms)
+✔ REQ-ROLE-2: a reason is required, bounded, and never sent with a decision (49.478776ms)
+✔ REQ-COS-1: the chief of staff cannot end its own run; its end of the assistant stops the assistant's thread run (56.140905ms)
+✔ REQ-LIMIT-1, REQ-COS-1: organization.set from the chief of staff reaches the shared writer, named as the actor (44.556745ms)
+✔ REQ-LIMIT-1, REQ-COS-1: a refused organization.set logs action.refused and no action.allowed, like a refused limits.set (54.673792ms)
+✔ REQ-LIMIT-1: organization.set is refused for every caller whose role file lacks organization.change (66.382175ms)
+✔ REQ-LIMIT-1: the chief of staff is logged as allowed, and organization.set takes only the human's keys (67.89054ms)
+✔ REQ-COS-1: organization.revision answers the revision alone to the chief of staff and spends nothing (59.996198ms)
+✔ REQ-COS-1, REQ-LIMIT-1: organization.revision is refused for every caller whose role file lacks organization.change (64.563737ms)
+✔ REQ-ROLE-3, REQ-LIMIT-1: a chief-of-staff change is validated, written and logged like a human's; an invalid one is refused (203.30796ms)
+✔ REQ-COS-1: the chief of staff reads the revision, changes the file with it, and reads again after a stale one is refused (152.777922ms)
+✔ Q169: the chief of staff's change of the assistant is validated, written and logged; a stale or protection-stripping one is refused (160.390138ms)
+✔ row 65, Q169: the chief's change of the assistant's route runs the routing checks, and a valid one saves as the chief (113.191175ms)
+✔ REQ-ROLE-2, REQ-COS-1: the 3c→3d migration lets the chief of staff end a held role with a reason; neither is still refused (132.454623ms)
+✔ row 194 T10: the chief's reason end of a kept instance refuses instance-kept, holds the claim and spends nothing (39.557283ms)
+✔ row 194 T10 (Q2): a role.revoke citing a decision the human resolved still ends a kept run (40.467118ms)
+✔ row 194 T10 (B7): the chief's organization.set of a kept instance's model refuses before the writer; the human's limits.set does not (44.433332ms)
+✔ row 194 T13: organization.set and limits.set refuse the launch, retired, keep and noHire keys before the writer (54.885109ms)
+✔ row 194 T18 (D2.4): from a chief session veto.set and instances.set refuse, and nothing reaches the writer (50.668537ms)
+✔ row 194 T8: the chief hires with a reason and no decision, the writer gets the reason as context, and the log names it (55.241196ms)
+✔ row 194 T11: on a bus with two businesses, the chief of one hires and fires only in its own (43.005813ms)
+✔ row 194 T8: hire and fire need a reason of 1 to 500 characters and refuse a decision key (58.158655ms)
+✔ row 194 T8 (sage-1471): only the chief hires or fires; every other role refuses role-not-chief, even one granted the actions (55.503457ms)
+✔ row 194 T8 (sage-1471): a chief whose authority lacks role.hire or role.fire refuses decision-required before the writer (86.802403ms)
+✔ row 194 T8a: a re-hire of a fired name goes to the writer like a hire, and the writer's refusals pass through by name (54.818179ms)
+✔ row 194 T8b: a definition is hireable only when every action is on HIRE_ALLOWED, it is version 2, the chief lists it and noHire doesn't (1382.790022ms)
+✔ row 194 T8b: a hire without the role files configured refuses not-configured (40.146643ms)
+✔ row 194 T9: a fire revokes the claim, cancels open requests, asks the launcher to kill the runs, then delists and logs (51.833776ms)
+✔ row 194 T9a (bus): a fire end's done writes lifecycle.end.killed and lifecycle.end.alive with run and pid, and an unknown stop's reason; a terminate's done or a bad stop refuses (57.789018ms)
+✔ row 194 T9: fire refusals come before step A and leave the claim, the requests and the file alone (65.036049ms)
+✔ row 194 T9c: a writer failure at B leaves the instance firing, and the repeat delists and logs once (53.017244ms)
+✔ row 194 T9c: a failure at C leaves the fire unlogged and the instance firing, and the repeat logs it (60.345244ms)
+✔ row 194 W-N1: a fire.done before a later fire.stopped of the same instance leaves it firing; another instance's done does not end it (50.889383ms)
+✔ row 194 T10: a hire or fire of a kept name refuses instance-kept before the writer (45.403556ms)
+✔ row 194 T10: a fire the writer's check refuses from the file stops nothing and leaves the instance launchable (43.416866ms)
+✔ row 194 T18: hire and fire take only their own keys, and a refused call writes nothing (53.432356ms)
+✔ row 194 T8, T9, T18: through the runtime the chief hires and fires with the real writer, the receipt carries the reason, and a refusal leaves the file alone (141.721466ms)
+✔ row 194 W-N1: the launcher's take of a launch or regenerate of a firing instance closes it as instance-firing (51.377929ms)
+✔ comment cursors isolate businesses, move only forward and remain append-only (29.12184ms)
+✔ only trusted sync writes validated cursors; events and cursor share rollback (24.669461ms)
+✔ explicit 3b copy migration preserves evidence and opens as 3g; normal startup never migrates (146.79675ms)
+✔ migration refuses active writers and drifted legacy schemas, with no partial upgrade (190.402904ms)
+✔ named migration registry chains 3b through 3g to a fixture-only future version in order (158.626832ms)
+✔ migration refuses mismatched source metadata without changing schema or evidence (65.79873ms)
+✔ offline command migrates only the supplied fixture root and reports usage errors (323.815002ms)
+✔ N4: the console verbs are exactly the preview and the console resolve, and decision.resolve is not one (1.918078ms)
+✔ bindConsole takes only the business human and a three-string owner subject (49.468614ms)
+✔ J1, Q188: only a console cap reaches the console verbs, and a console cap reaches nothing else (82.70009ms)
+✔ preview: the two real answers, a grant summary and the digest, for an open grant request only (51.42061ms)
+✔ J1, J2: a decision that is not an eligible grant request refuses both console verbs (66.770936ms)
+✔ N2, J13: a Console approve records via console and the owner, before the executor starts, and the grant runs once (129.64876ms)
+✔ J15: a Console deny closes with the other key and starts nothing (151.492921ms)
+✔ J2: approve and deny come from approvalChoice and the options, not a fixed yes and no (180.199344ms)
+✔ J11: a stale digest or a key outside the two refuses decision-stale and writes nothing (68.526914ms)
+✔ J14: a via console close with no matching human.input approves nothing (80.648324ms)
+✔ recordEvent keeps human.input reserved, so no agent forges a console answer (54.240531ms)
+✔ J7: a console proof over the socket binds a cap for its one call and the reply releases it (183.393164ms)
+organization: {"event":"reload-needs-restart","business":"demo"}
+organization: {"event":"reload-needs-restart","business":"demo"}
+✔ M6: a creative raise refuses decision-not-allowed, cited or not, and no decision row appears; the assistant still raises (75.552255ms)
+✔ a creative instance sends only to the user and hears only from the user (90.07706ms)
+✔ M10 through the broker: the chief and the tester are refused on bean, the human's limits.set of its models key works (139.083473ms)
+✔ row 256 T6 the human deletes a creative instance through the broker; the chief and the tester are refused at the verb (107.622242ms)
+✔ X4: register adds a store reference to the running bus, and issue then writes the key (26.320843ms)
+✔ X4: register runs the constructor's reference checks (1.282394ms)
+✔ X4: register reads no file, so a key file left at the path stays unused, and a live token refuses (18.282638ms)
+✔ X3, X4: unregister drops an entry with no token and refuses one with a live token (15.491394ms)
+✔ X5: a claim holds the slot, so a second claim and a host.run refuse host-busy until release (9.383615ms)
+✔ X5: a claim made while a host.run is in flight refuses host-busy (9.610798ms)
+✔ X5: a stale release leaves a later claim in place (0.738025ms)
+✔ X5: abortClaim aborts a live claim and says pending, and revoke's abort reaches a claim too (10.687682ms)
+✔ credentials gives human and reader sessions service, account, role, date and state, and nothing else (33.130831ms)
+✔ credentials refuses a role session and any argument (39.598911ms)
+✔ credentials reads the status on each request, and a broker without one lists none (47.895597ms)
+✔ the broker process answers credentials without a token, path or variable in its output, log or store (252.705106ms)
+✔ T1: a store reference with no file yet starts, and the agent is not-issued until issue (8.018758ms)
+✔ T1: a store path the reference does not own, or no store root, refuses the reference (0.857605ms)
+✔ T1: a wrong mode on the store root, a business dir, an agent dir or the file refuses start (2.889146ms)
+✔ T1: a missing store root refuses start; a missing {file} reference still refuses start (1.172017ms)
+✔ T1: a store file that is a directory or a symlink refuses start (1.395256ms)
+✔ T2: useFor keys from the session only (3.070857ms)
+✔ T5: issue, rotate, revoke and delete are live with no restart, and revoke holds across one (6.4895ms)
+✔ T5: a failed commit leaves the token on disk but not in memory, and a bad token or date writes nothing (4.108801ms)
+✔ T5: revoke drops the token from memory before the unlink, so a failed unlink still leaves it revoked (2.91784ms)
+✔ T5: revoke of a {file} reference forgets the token and never unlinks the file (0.998968ms)
+✔ T5: delete refuses an agent dir holding anything but tokens (2.843327ms)
+✔ D5: every credentials use( call site is on the allowlist (40.149455ms)
+✔ row 199: the lifecycle verbs refuse every session but the human, and the tester revokes only (65.732497ms)
+✔ T5: issue, rotate, revoke and delete are live, rewrite the business file and leave one receipt each, with no value anywhere (167.259057ms)
+✔ only validated broker references load; returned data and exceptions cannot expose a known token (3.852669ms)
+✔ bad file modes, symlinks, repository/data paths, malformed tokens and missing dates refuse (2.482853ms)
+✔ expiry refuses use and env references never become client data (0.782354ms)
+✔ S1 parsed service refs work, service mismatch refuses, Gitea rotation due is a warning state (1.356447ms)
+✔ opaque tokens shorter than 16 characters refuse before use (0.440635ms)
+✔ each C-suite role file carries the same two lists: human, chief-of-staff, pm, cto (2.041381ms)
+✔ chief-executive-officer: messages to and from the user, chief of staff, pm and cto pass (97.238599ms)
+✔ chief-executive-officer: a message to or from the coder, reviewer or assistant is refused and logged, and nothing is stored (81.95286ms)
+✔ chief-executive-officer: another C-suite role isn't on the lists either (67.066456ms)
+✔ chief-financial-officer: messages to and from the user, chief of staff, pm and cto pass (78.009785ms)
+✔ chief-financial-officer: a message to or from the coder, reviewer or assistant is refused and logged, and nothing is stored (84.543599ms)
+✔ chief-financial-officer: another C-suite role isn't on the lists either (65.996108ms)
+✔ chief-information-officer: messages to and from the user, chief of staff, pm and cto pass (89.147352ms)
+✔ chief-information-officer: a message to or from the coder, reviewer or assistant is refused and logged, and nothing is stored (86.723506ms)
+✔ chief-information-officer: another C-suite role isn't on the lists either (73.457131ms)
+✔ chief-information-security-officer: messages to and from the user, chief of staff, pm and cto pass (115.368231ms)
+✔ chief-information-security-officer: a message to or from the coder, reviewer or assistant is refused and logged, and nothing is stored (87.387396ms)
+✔ chief-information-security-officer: another C-suite role isn't on the lists either (77.485002ms)
+✔ chief-marketing-officer: messages to and from the user, chief of staff, pm and cto pass (85.6375ms)
+✔ chief-marketing-officer: a message to or from the coder, reviewer or assistant is refused and logged, and nothing is stored (72.970532ms)
+✔ chief-marketing-officer: another C-suite role isn't on the lists either (77.327838ms)
+limits: {"event":"limit-reached","business":"demo","check":"daily-quota","export":"mayLaunch","subject":{"instance":"coder","provider":"anthropic","model":"opus","account":"jason-max"},"path":["tokens","daily","jason-max"],"limit":0,"count":0,"unknownTurns":0}
+usage: {"event":"usage-unknown","business":"demo","run":"run1","instance":"coder","turn":"80c2900a-8837-4d99-a0c1-05c5a6795e70","source":"@none","code":"baseline-unknown"}
+limits: {"event":"limit-reached","business":"demo","check":"daily-quota","export":"mustStop","subject":{"instance":"coder","provider":"anthropic","model":"opus","account":"jason-max"},"path":["tokens","daily","jason-max"],"limit":0,"count":0,"unknownTurns":1}
+usage: {"event":"usage-unknown","business":"demo","run":"run1","instance":"coder","turn":"9b267e70-1a39-47f0-8301-eea5a088f7eb","source":"@none","code":"baseline-unknown"}
+✔ REQ-LIMIT-2 runtime: limits counts the daily quota, and mayLaunch refuses only the account at it (198.53912ms)
+✔ REQ-LIMIT-4 runtime: a run bound with the account writes it on its usage records and stops at the quota (89.54233ms)
+✔ REQ-LIMIT-4 runtime: a run bound without an account records null and the daily quota never stops it (76.272059ms)
+✔ REQ-LIMIT-4 bindLaunch keeps the account off session.launched, refuses one that is not an identifier, and takes null as none (27.1503ms)
+✔ a human resolve sends the raising role one message from the human, and its request is the answer (67.632464ms)
+✔ a cross-role decision resolved by its arbiter comes from that role and run, with no request (42.695236ms)
+✔ a human withdraw sends one message with the note (47.328059ms)
+✔ a human seen before the close leaves the request on the close's answer, not the seen (49.520726ms)
+✔ the raising run's withdraw, a supersede, a within-role raise and seen send nothing (45.712128ms)
+✔ refused closes send nothing: invalid-choice, decision-closed, not-resolver (56.76173ms)
+✔ a raising role nobody holds at the close gets the message on the next claim (54.681213ms)
+✔ a human DECISION send keeps its own instruction as the request, not a close's answer (41.518786ms)
+✔ a cross-role raise whose arbiter the raiser does not hear from is refused and stores nothing (61.899412ms)
+✔ a gated raise by a role that does not hear from the human is refused and stores nothing (50.952226ms)
+✔ a route the raiser hears from is allowed, checked from the route to the raiser (65.739967ms)
+✔ a refused supersede withdraws nothing (52.625786ms)
+✔ the assistant's within-role and gated raises still work (56.83583ms)
+✔ roles lists open decisions routed to a role, and never the human inbox (51.853822ms)
+✔ recent lists closed decisions of every route, newest close first, with how each closed (52.655377ms)
+✔ recent gives the closing event as closed when the decision was seen first (57.716928ms)
+✔ recent stops at RECENT rows (169.876444ms)
+✔ every row is what trail already gives the same session for that id (81.641976ms)
+✔ a role session can't list decisions, so it can't read another role's open decisions (107.578732ms)
+✔ decisions is a read: one business, strict arguments, nothing written (84.048145ms)
+✔ endLaunch writes session.ended, releases the run claim and kills its capabilities (36.990465ms)
+✔ endLaunch refuses an unknown run, a second end and a rebind of the ended run (25.931576ms)
+✔ a restarted broker refuses to rebind an ended run; a refused rebind leaves the run unbound (30.735211ms)
+✔ endLaunch leaves a claim another run took alone (33.237022ms)
+✔ refuse records action.refused against the caller with the code only (22.573971ms)
+✔ launches off refuses role.launch with launch-revoked until launches on (35.920446ms)
+✔ broker process: launch ops authorize role.launch, record refusals and end runs (309.549594ms)
+✔ row 281 T2: a fire with host grants on two hosts and a Gitea grant answers with a job, then revokes all three (479.143908ms)
+✔ row 281 T3 (sage-2575): a delete with grants takes two requests: the first starts the job, the next completes (411.684251ms)
+✔ row 281 T3b (Q2): a delete whose job refuses on host B; the retry refuses grant-revoke-failed and revokes only B and Gitea (394.830847ms)
+✔ row 281 T3b: B cleared by hand with hosts.revoke; the next delete starts a job for Gitea and the leftover line only (388.124329ms)
+✔ row 281 T3c (sage-2575 condition 4): a delete of an instance with no grant completes in one request (103.589577ms)
+✔ row 281 T4: host B unreachable in a fire: the job refuses, A stays revoked, B and Gitea untouched; a repeat completes (357.377764ms)
+✔ row 281 T4b (Q1): a line a manual hosts.revoke left on C is removed by the fire, with its close (179.856665ms)
+✔ row 281 T4b (Q1): with C unreachable, the fire completes and names the line in grantsLeft (138.089593ms)
+✔ row 281 T5: Gitea's admin token can't be checked: the job refuses with the Gitea grant intact (205.940781ms)
+✔ row 281 T5b (N1): a failed token DELETE refuses gitea-left; the repeat retries only this agent's entries (549.123367ms)
+✔ row 281 T6 (sage-2574): a host decision approved before the fire and run after it ends revoked, with nothing applied (117.774419ms)
+✔ row 281 T6b (sage-2574): a Gitea decision approved before the fire and run after it ends revoked before any Gitea write (148.888937ms)
+✔ row 281 T6c: a host executor in flight aborts and ends revoked; a Gitea executor in flight is awaited and leaves no token (411.354164ms)
+✔ row 281 T6d (B1): undecided host and Gitea decisions are in the set, and approved after the fire both end revoked (168.92637ms)
+✔ row 281 T6e (B1): a grant raise refuses instance-fired while firing and after the fire, goes through after a rehire, and refuses grant-revoke-running during a delete job (193.190082ms)
+✔ row 281 T7: an instance with no grant fires as today, synchronously, with the same events (102.833367ms)
+✔ row 281 T9 (B3): one step G per agent; the manual verbs refuse while it runs, and sweep names it running (375.63857ms)
+✔ row 281 T10 (B2): the fire and the delete answer while their jobs are held, and the broker answers other verbs (360.336844ms)
+✔ row 281 T11 (C1): a fire's job completes after the chief's run ends and processing halts (146.245872ms)
+✔ row 281 T12 (C1, N7): a step B refusal in the job is fire.failed, and the repeat runs B and C synchronously (145.024642ms)
+✔ row 281 T13 (N4): a restart records each held job interrupted once, with one message each; an ended job gets none (232.323508ms)
+✔ row 281 T14 (N1, sage-2653): a host removed under an undecided decision stops the fire on host-unknown; the human's no closes it, and the repeat fire has no job (121.845948ms)
+✔ row 239 T4: a refusal after the writer's revoke is named -revoked, in the job's fire.failed and notice, a synchronous fire and a delete (169.489618ms)
+✔ row 239 T4b: an unmarked step B refusal keeps its code, and the notice says nothing of the tokens (120.883153ms)
+✔ X-G3: on scratch 1.27.1, a grant makes the user, mints, forks, checks reach, writes the file, and revoke deletes the token (12201.350675ms)
+✔ versionAtLeast compares numbers and refuses a prerelease of 1.27.0 (2.262487ms)
+✔ X-G1: a raise that fails a check refuses and stores nothing (126.313193ms)
+✔ X-G1: a creative role, a role without identity and a missing or due slot refuse at raise (412.330488ms)
+✔ X-G2: admin set refuses each failed check and writes nothing, then writes the slot once (278.758621ms)
+✔ X-G3 to X-G8: an approve makes the user, mints the token, forks, checks reach and writes the file, record and grant.applied (178.345483ms)
+✔ X-G4: a user this stack did not make, an admin, a disabled user and a remade user each refuse (535.993646ms)
+✔ X-G6 and X-G8: the user and mint steps are written before their calls, and each result after its call (194.546731ms)
+✔ X-G4: a fork by the seat user of another repository than the project refuses fork-foreign (160.721865ms)
+✔ X-G5: a failure after the mint deletes the token, unloads nothing it did not load and leaves no file (265.445125ms)
+✔ X-G5: a token delete that fails is left at Gitea, shown by status and taken by sweep (207.592886ms)
+✔ X-G5: a mint that fails deletes by name, and a refusal at step 0 leaves the decision unspent (267.803711ms)
+✔ X-G5: an agent held for an unknown token is refused at step 0 with no Gitea call (107.224198ms)
+✔ X-G5 and X-G9 (step 7): a rotation whose old-token delete fails stays applied with the old id left (346.223756ms)
+✔ X-G10: in a rotation the store file holds the new token before the old one is deleted (285.430422ms)
+✔ X-G6: a rotation cut before the rename settles back at once, and the old token stays live (331.522208ms)
+✔ X-G6: a rotation whose step 8 write fails is settle-pending, and a restart settles it forward (322.611238ms)
+✔ X-G6: a restart settles an open rotation back when the file still holds the old token (233.514459ms)
+✔ X-G6: a restart settles an open rotation forward when the file holds the new token (218.819043ms)
+✔ X-G6: a 401 on the file token loses the grant: both tokens go, the record goes and memory unloads (243.041679ms)
+✔ X-G6: a 403, 404, 500, a hang and a dropped socket each leave the rotation settle-pending with nothing deleted (1540.782642ms)
+✔ X-G6: a file token no grant minted is held; the next restart says so again; a revoke clears it and takes both ids (273.233039ms)
+✔ N9: a revoke of an open rotation, then a restart: no settle, no Gitea call and no message (222.539467ms)
+✔ N9: a 404 on a delete by id counts as done (239.417991ms)
+✔ X-G6: a restart undoes each step a killed child left, and spends an approved unspent decision (715.381495ms)
+✔ X-G6: a restart with no admin slot leaves the user an orphan and the token left (85.872679ms)
+✔ X-G7: a change to the definition, identity, publish remotes or admin slot after the raise ends decision-mismatch (186.861907ms)
+✔ X-G7 and X-G9: an admin rotate voids open decisions, and rotate --finish deletes what was left (160.44279ms)
+✔ X-G9: a rotate whose name is taken refuses and writes nothing; remove takes the slot away (88.925646ms)
+✔ X-G9: a slot past its rotate-by date refuses a run at step 0, leaving the decision unspent (69.957483ms)
+✔ X-G11: run refuses every caller but the human, an unapproved, a spent and a busy decision (137.465474ms)
+✔ kill switch (plan :16): while halted the chief still reads grants.status, and an agent grants.revoke refuses (126.944615ms)
+✔ X-G11: a revoke while the executor runs aborts it and the grant ends revoked (143.116062ms)
+✔ X-G11: a revoke unloads memory and removes the file before its Gitea delete (133.352459ms)
+✔ X-G11: a revoke during a rotation step 7 ends it revoked, and step 8 writes no record back (181.63255ms)
+✔ X-G11: a revoke while a sweep settles a rotation, forward or back, ends it revoked with no record (395.054222ms)
+✔ X-G11: a revoke during a settle whoami that finds a foreign token ends it revoked, not held (211.719835ms)
+✔ X-G11: a revoke during a settle whoami that gets a 401 ends it revoked, not lost (190.965346ms)
+✔ X-G12: a token that reaches wider than its forks fails with the repository named (469.823349ms)
+✔ X-G12: reach is paged by X-Total-Count and a count that does not add up refuses (290.476974ms)
+✔ X-G13: an agent cannot record a grant event, and the trigger refuses one from any writer but the grant writer (46.30834ms)
+✔ X-G14: credentials delete fires the user: tokens go, login is prohibited, and grant.revoke.closed records it (290.845229ms)
+✔ X-G14: a fire whose token delete or login PATCH fails lands it in serviceLeft (157.76557ms)
+✔ X-G14: a fire whose user is gone or remade skips the fire steps and says why (299.987085ms)
+✔ X-G14: a sweep retries a fire only for the user it fired: a remade or gone user is skipped and named (362.966877ms)
+✔ X-G14: a revoke Gitea cannot reach stays open, and a restart closes it (136.371743ms)
+✔ row 281 T8: a tester grants.revoke refuses tester-dev-only once bus.tester is off; the human revoke keeps its records and starts no job (130.604936ms)
+✔ X-G15: look-alike commit steps outside the grant writer are ignored at start, by revoke and by status (132.30733ms)
+✔ X-G15: a look-alike spend under another kind with the grant writer pair is not an open grant (48.039481ms)
+✔ status lists the slot, users, grants and nothing secret, and every grants verb needs service gitea (111.374863ms)
+✔ 3j copy migrates to 3k: every row kept, and sqlite_master gains only the two tables and their keys (176.351012ms)
+✔ a 3j→3k step that fails partway leaves the store at 3j with every row and the schema intact (224.896505ms)
+✔ the 3j engine refuses a migrated store, migrating or not, and leaves it as it was (184.144206ms)
+✔ gitea_users: one user per business and agent, an id above 0, a 16-hex nonce and a real decision (20.581122ms)
+✔ gitea_grants: one grant per agent, a projects array, a token id above 0, and only for a recorded user (24.409212ms)
+✔ G1, A1: only the chief raises a grant, and a refused raise stores nothing and runs no keyscan (72.466306ms)
+✔ G1: grant goes only with credential.mint, row a takes only host-enroll, and E1 refuses each bad field (97.952689ms)
+✔ G5, A5, A6: the scanned key set must equal the requested set, or host-key-mismatch and nothing stored (91.021723ms)
+✔ G4 (host-enroll block, M1): the broker appends the keys, fingerprints and sudo line, and the cap counts the block (63.138859ms)
+✔ G6, X1: the human's cli yes starts enrollment, which writes the record, the key file and the events in order (81.930461ms)
+✔ A2, A4: a credential.mint without grant, and a no, start nothing (259.841ms)
+✔ A3, X1: a resolve by the tester or an agent starts nothing (255.429953ms)
+✔ G6 (duckworth-0081 B3): a withdraw by the chief or the human, and an arbiter resolve, start nothing (261.146356ms)
+✔ G10 (duckworth-0081 B1): a second start for a spent decision refuses decision-consumed, and an unresolved or agent-resolved one not-authorized (77.376693ms)
+✔ A8, S1: two approved enrollments for one host: the second ends host-enrolled and the pin stays (99.741412ms)
+✔ A9: the hosts primary key refuses a second record for (business, host) (50.294879ms)
+✔ X3: a failure at step 2 deletes the record again and ends grant.failed, with no key file (64.571976ms)
+✔ A10, X3: at start a resolved, unspent enrollment is spent and ends interrupted, and never runs late (49.708201ms)
+✔ X3: at start an enrollment that stopped after its registry step loses its record and key file (75.516939ms)
+✔ G24 first sentence, M2, A12: tags are mosaic- and 32 hex, and differ by business, agent and host (0.513059ms)
+✔ E4: hosts.check sets the record ready and records grant.host.checked; a non-zero list leaves it pending (80.504459ms)
+✔ G20 (duckworth-0081 B3): the human's hosts.check marks the host ready, and the reader refuses (75.34987ms)
+✔ G18 (duckworth-0081 B2), broker half: a check refused host-key-mismatch leaves the host pending-install with no grant.host.checked (68.480941ms)
+✔ E4: a check whose installer fingerprint differs from the record refuses host-changed (62.645947ms)
+✔ E4, G21: hosts.remove is the human's or the tester's, deletes the key and the record, and records grant.host.removed (70.223396ms)
+✔ G21, F1, F2, M4, A22: hosts.remove refuses host-line-left on a guarded hostLineLeft, and ignores look-alikes (74.659729ms)
+✔ hosts.remove refuses host-in-use while a grant record names the host (75.87114ms)
+✔ the grant writer refuses a body outside section 7's shape (50.439936ms)
+✔ recordEvent refuses reserved-event for a grant.* action or operation (38.075168ms)
+✔ row 280: an occupied TCP port is attempted, refused, and retried with our sshd (105.549867ms)
+✔ row 280: every injected picker sample is unprivileged and outside the ephemeral range (0.748328ms)
+✔ G7: an Approve installs the tagged line, logs in with the new key, and writes the key file, record and grant.applied (834.168864ms)
+✔ G7: a commands change on a live grant updates the record in one transaction and keeps the key and line (629.916619ms)
+✔ G8: a failure at install or verify removes the line and leaves no record, key file or reference (1780.235538ms)
+✔ G8: a failed remove adds hostLineLeft and tells the human to sweep (754.625283ms)
+✔ G8: a failure in step 5 before commit unlinks the key file, drops the reference and removes the line (761.744593ms)
+✔ G8: a store fault in the commit transaction ends host-failed with no record, key file, reference or line (748.17331ms)
+✔ G8: a failed step 1 check spends the decision and runs nothing remote (110.297943ms)
+✔ G9: a registry, definition or commands change between raise and Approve ends decision-mismatch before any remote step (618.904102ms)
+✔ G9: an agent no longer a role or no longer declaring host ends with its code, spent (103.401439ms)
+✔ G10: a second start refuses decision-consumed, and an unresolved or agent-resolved decision not-authorized, writing nothing (588.666038ms)
+✔ G15: no event, message or decision holds the private key (579.887535ms)
+✔ G23: a revoke during install ends grant.failed revoked with no key file, no grant and no line (570.595973ms)
+✔ G23 (row 249): an add that writes after an abort's remove leaves hostLineLeft until the sweep (897.192411ms)
+✔ G23 (row 249): an add that writes after a timed-out install's remove leaves hostLineLeft until the sweep (870.532264ms)
+✔ G23: a revoke recorded after the raise and before the start ends step 1 revoked, and a held slot ends host-busy (532.180202ms)
+✔ G24: names at 64 characters with . and _ give distinct tags of the fixed length (0.375475ms)
+✔ G11: a restart after install removes the line, then ends interrupted with the tag, holding the slot until then (226.328763ms)
+✔ G11: a restart after a new key's commit, with the key file written, ends with no key file, record, reference or line (229.755656ms)
+✔ G11: a restart after a commands change's commit leaves the record as it was and asks nothing of the host (516.742555ms)
+✔ G11 (B2): a restart before step 1, spent or not yet spent, ends interrupted and nothing runs later (73.164792ms)
+✔ G11: a remote undo that fails ends interrupted with hostLineLeft and the sweep hint (286.936197ms)
+✔ G11: a restart leaves a finished grant alone, and the reconcile adds nothing for it (532.28423ms)
+✔ N1 (G27): the start sweep unlinks host.<id> files with no record in loaded businesses only, and refuses a store dir that is not private (6.470277ms)
+✔ G12: the human's hosts.revoke deletes the record, the key file, the reference and the line, with a closed marker (653.069193ms)
+✔ G12 (N4): a revoke with no record still removes the computed tag's line, with granted false; bad args refuse (230.553343ms)
+✔ G13: a revoke during install aborts the executor, which ends revoked, and the line goes (575.487418ms)
+✔ G26: the human, the assistant and the tester revoke; the chief and a pm refuse; sweep is the human's or the tester's (534.560088ms)
+✔ row 281 T8: a tester hosts.revoke refuses tester-dev-only once bus.tester is off, and a human revoke writes no job records (670.855819ms)
+✔ G27: a restart after step 1 sweeps the key file and runs step 3 once the bus is up; status shows the revoke until then (660.820379ms)
+✔ G27: after step 2 with the host down, the restart closes the marker with hostLineLeft; a marker without a revoke id is not reopened (968.779421ms)
+✔ G27: a key file a revoke could not unlink is reported left and goes at the next start (673.232473ms)
+✔ G28: a commands change, then a revoke, then a restart leave no record, key, reference or line (688.456419ms)
+✔ G24 (B4): hosts.sweep removes only this business's recorded tags no live grant holds, and records what it left (999.738814ms)
+✔ G12: the local steps finish before the host step, so a host that hangs leaves the agent no access (713.357449ms)
+✔ G23 (X5): a revoke right after the spend reaches the executor's claim, so the grant ends revoked (223.76904ms)
+✔ G23 (X5): a revoke that lands as verify returns ends revoked with no record, key file or line (672.574857ms)
+✔ G13: a revoke whose host remove fails still drops the record and key, and reports the line left for a sweep (689.193203ms)
+✔ G22: enroll, check, grant, host.run, a commands change the next host.run uses, and a revoke that kills a run in flight (1239.91349ms)
+✔ mos-1163: a grant whose agent became a creative role after the raise ends host-creative-role at step 1, spent, with nothing remote (70.366366ms)
+✔ sage-1908: once the agent of an applied grant is a creative role, host.run refuses host-creative-role, runs nothing remote and keeps the record (538.597523ms)
+✔ G1 (host): only the chief raises a host grant, a grant on any other action refuses, and nothing is stored (60.750138ms)
+✔ G1, R4: the grant takes exactly method, agent, host, commands and rotateBy, and an unknown method refuses (72.685411ms)
+✔ row 236 (#1742): a gitea grant on a broker with no Gitea path refuses gitea-not-configured, and nothing is stored (76.057414ms)
+✔ G2: an agent whose definition lacks host refuses host-not-declared, and an unknown agent unknown-role (52.582344ms)
+✔ mos-1163: a grant whose agent is a creative role refuses host-creative-role, even when its definition declares host (45.65629ms)
+✔ G3: wildcard, shell, empty and other 210 D6 argv prefixes refuse invalid-request (99.314421ms)
+✔ R4 rotateBy (sage-1782): a real calendar day after today UTC, or invalid-request (68.794969ms)
+✔ G19: a grant naming a host that is pending-install refuses host-not-ready, and an unknown host host-unknown (55.505105ms)
+✔ R4, G5: the raise routes to the human and its event body binds the eight fields with their hashes (38.914171ms)
+✔ G4 (host block): the broker appends the host, each prefix, the rotate date and new key or change (81.770395ms)
+✔ 3i copy migrates to 3j: every row kept, and sqlite_master gains only the two tables, their keys and the guard (195.425662ms)
+✔ a 3i→3j step that fails partway leaves the store at 3i with every row and the schema intact (212.932683ms)
+✔ the 3i engine refuses a migrated store, migrating or not, and leaves it as it was (167.246981ms)
+✔ A22b, sage-1703: a session-written grant.* row from before the step survives it, and the grant readers ignore it (152.853201ms)
+✔ the guard: a grant.* action or operation on action.allowed needs the (NULL, grant) actor (28.834261ms)
+✔ hosts: one record per business and host, a ready host has its installer and check, grants need the host (25.072189ms)
+organization: {"event":"reload-needs-restart","business":"demo"}
+✔ row 298 runtime: human scope approval writes the file and organization history at the supplied revision (159.898013ms)
+✔ row 298 (Q3): only the human at the cli reads or sets the scope; agents, the tester, a reader and the Console refuse (149.842701ms)
+✔ row 298 (Q1): organization.set and limits.set refuse a grantScope key, and nothing is written (94.911053ms)
+✔ row 298 (Q3): the human verb writes the scope and a grant.scope record with the human proof and both sha256 (88.951869ms)
+✔ row 298 (Q4): an in-scope Gitea grant is issued with no inbox item, logged with 236 records, and revocable (265.578704ms)
+✔ row 298: an out-of-scope Gitea grant waits for the human, whose Approve still issues it (220.301323ms)
+✔ row 298: with no scope, a bad scope or an unreadable file, an in-scope-looking grant waits (265.453564ms)
+✔ row 298 (Q6): a chief-of-staff instance that is not launch.by never raises in scope (94.799706ms)
+✔ row 298 (Q5): a scope narrowed between the raise and the spend ends the grant scope-changed (133.302736ms)
+✔ row 298 (Q2): an in-scope host grant is spent with no Approve; ls never covers lsblk, nor a scope command extra arguments (121.808247ms)
+✔ row 298 (Q5): a host scope narrowed before the spend ends scope-changed (109.397986ms)
+✔ row 298 Q4: missing scope evidence or a bad scope digest cannot authorize execution (154.73214ms)
+✔ row 298 T4/T8: an in-scope host grant issues, records and revokes through the existing executor (130.879802ms)
+✔ row 298 T6: host enrollment stays open for human Approve even with both methods in scope (93.100608ms)
+✔ row 298: scope without an organization revision never closes automatically (82.727367ms)
+✔ REQ-WAIT-1: the broker hard waits are exactly the list, and match the business vocabulary (2.083881ms)
+✔ REQ-WAIT-2: a business granting a hard wait at either class is refused; the actions that left are grantable (42.121221ms)
+✔ REQ-DEC-2: every hard wait goes to the human, cited or not, and the arbiter cannot resolve it (812.786358ms)
+✔ REQ-DEC-2: a gated raise citing the current spec goes to the arbiter for its domain; uncited, to the human (331.237932ms)
+✔ REQ-DEC-2: an arbiter-approved cited gated decision authorizes the raiser, and the human cannot resolve it (99.699178ms)
+✔ REQ-DEC-2: a cited merge raised by merge-gate goes to the technical arbiter; a merge raised without the grant routes by citation (139.2051ms)
+✔ REQ-DEC-2: a stale or unconfirmed citation refuses without a decision; an arbiter raising its own goes to the human (180.364228ms)
+✔ Q169: the chief of staff's end of the assistant stops every thread run; its own run and another ender's are refused (106.034494ms)
+✔ Q169: a revoke of the assistant the chief of staff raises goes to the human, cited or not, and no arbiter resolves it (219.627102ms)
+✔ Q169: another role's cited revoke of the assistant, resolved by an arbiter, is refused (114.281078ms)
+✔ Q169: a revoke of the assistant citing a decision the human resolved stops its thread run (94.884553ms)
+✔ Q169: a cited revoke of a role not in END_PROTECTED still goes to the arbiter, and executes (89.808176ms)
+✔ Q169: a role granted role.revoke at either class still sends a revoke of the assistant to the human (138.350338ms)
+✔ row 280: an occupied TCP port is attempted, refused, and retried with our sshd (105.900556ms)
+✔ row 280: every injected picker sample is unprivileged and outside the ephemeral range (0.560312ms)
+✔ the executor tests need sshd, ssh, ssh-agent, ssh-add, ssh-keygen and setpriv: a missing one fails, never skips (0.225164ms)
+✔ T3: organization.set, limits.set and instances.set refuse hosts, and the writer never runs (45.499379ms)
+✔ T4: the value check takes one unencrypted ed25519 key and nothing else (256.310329ms)
+✔ T5 to T8: registry, grant, argv shape and allowlist refusals (674.252091ms)
+✔ T9: under 1.7 every call needs a decision bound to its host, argv and stdin, spent once (403.388608ms)
+✔ T10, T11: argv reaches sudo unchanged after sudo -n -- (363.881992ms)
+✔ T12, T13: exit code passes through, the timeout kills the group, output is capped (1629.310039ms)
+✔ T14: a host key not in the registry refuses and nothing runs (242.304325ms)
+✔ G18: hosts.check with a wrong pin refuses host-key-mismatch and runs nothing on the host (391.938493ms)
+✔ N3: a remote exit 255 that prints the pin refusal text is the command result, and an ssh failure keeps its message (398.371291ms)
+✔ T15: ssh reads no config file and no user known_hosts (342.819199ms)
+✔ T16, T17: key material in output or stdin refuses credential-leak, and no event holds it (745.317833ms)
+✔ T18, T19, T20: one call at a time, no key in any argv or env, and nothing left after (4746.944807ms)
+✔ T21: revoke kills the call in flight, and the next call refuses (289.268678ms)
+✔ T22: events carry host, address, user and argv in clear, and sizes and hashes only (261.617288ms)
+✔ T24: no literal gitea and vikunja kind list outside vocabulary.mjs, and the credential use sites are known (16.298704ms)
+✔ T25: no role definition lists host.sudo while it is a hard wait (0.44684ms)
+✔ T27: the bus child dying takes ssh and ssh-agent with it (313.4289ms)
+✔ T27: ssh-add -t drops the key from an agent the test keeps alive (3553.985162ms)
+✔ N2: a hung ssh-add is killed at its limit or on abort, and nothing is left running (429.194251ms)
+✔ T27: the start sweep keeps a live bus dir and kills only a matching live process (26.482356ms)
+✔ T27: the bus start sweeps <configDir>/secrets/run before it listens, and a stray entry stops the start (51.725235ms)
+✔ M3: host.run refuses host-not-granted unless the grant record has an approved, spent host grant (140.335983ms)
+✔ M3: a host_grants record gives Credentials a store reference at start, and a restart reads its key (99.059277ms)
+✔ G16: the writer refuses each user, tag and key the design names, before any key file (6864.972824ms)
+✔ G16: from= comes from the host file, a privileged user skips the group and sudo checks, and the line is exact (1352.814994ms)
+✔ G16: list shows tagged lines only, and add and remove never touch a line outside the tag pattern (519.298735ms)
+✔ G25: the writer refuses a symlinked dir or user file, a group-writable dir and an odd tmp, and writes 0644 (781.980162ms)
+✔ G16: mosaic-keys passes the three requests to the writer through sudo and refuses anything else without it (77.809717ms)
+✔ E3: the sudoers line and the sshd drop-in are the design lines and parse (23.699871ms)
+✔ human proof binds CLI entry, process start and nonce; agents and incomplete ancestry refuse (4.03856ms)
+✔ process reader gets own kernel identity without exposing environment values (0.970041ms)
+✔ EACCES ancestor environments skip only markers; commands and registered launches still refuse (1.027992ms)
+✔ real pid 1 remains inspectable when its environment is protected (0.445463ms)
+organization: {"event":"reload-needs-restart","business":"demo"}
+organization: {"event":"reload-needs-restart","business":"demo"}
+✔ row 165: instances and instances.set refuse every non-human session but the tester, the chief of staff included, and pass the verified actor (64.809676ms)
+✔ row 165 runtime: an add and a change reach the organization file with the human as actor; each refusal keeps the bytes and logs nothing (220.641421ms)
+✔ row 194 T12: agent and reader sessions refuse veto.set; the tester gets add and change but not delete or veto.set; the human passes the hook for each listed verb (41.500455ms)
+✔ system Python is a resolved root-owned ELF, never a shim or home interpreter (3.04864ms)
+✔ real system interpreter is available and safely inspected (31.994881ms)
+✔ restart receipt appends actual replacement identity and refuses unsafe files (4.676497ms)
+✔ activation gate compares fresh startup receipt to the current interpreter identity (2.122964ms)
+✔ non-regular startup receipt refuses promptly without waiting on a FIFO peer (47.541072ms)
+✔ REQ-DEC-2: a merge-gate raise its arbiter resolved lands through the host op: checkLand answers the facts and a ticket, records nothing, and recordLand spends the decision once (61.078425ms)
+✔ checkLand refuses on the decision and the review (68.525775ms)
+✔ REQ-LAND-1: a gated merge decision refuses not-authorized, cited and approved by the arbiter or uncited and approved by the human (167.732054ms)
+✔ REQ-LAND-1: a within-role merge grant refuses not-authorized at the land (49.380094ms)
+✔ a cross-role merge that routes to the human, because merge-gate is its own arbiter, lands on the human's CLI answer (54.156019ms)
+✔ a merge option with no first line refuses no-subject, as land-work does (45.943286ms)
+✔ checkLand refuses with land-work's codes past the authority check, and a decision raised for refactor never lands (120.863353ms)
+✔ a ticket outlives the run that asked, and recordLand checks the task again (54.978736ms)
+✔ two tickets on one decision: the first recordLand lands, the second refuses decision-consumed and records nothing (53.920648ms)
+✔ landRefused files the code on the task, tells the role only with notify, and ends the ticket (56.697668ms)
+✔ landHeld is true only for an approved, unspent cross-role merge decision this role raised for a task in this thread (59.928677ms)
+✔ landHolders lists a merge decision exactly while landHeld is true for its non-thread instance, in decision order (80.557955ms)
+✔ landHolders leaves out a thread instance's decision, even one raised before its role became one (49.147763ms)
+✔ landRelease releases the holding run by land-relaunch once it has asked message.receive and nothing delivered to it is unread, and waiting messages go to the next holder (74.29668ms)
+✔ a landing run started after the resolution passes checkLand for its held decision before any message.receive, and lands it (53.029114ms)
+✔ the bus process answers landHolders and landRelease from their own lines, not as credentialStatus (224.554283ms)
+✔ usage.begin with a decision id needs it held for the run's instance, usage.end needs the begin, and the limit checks see the landing turn (73.965751ms)
+✔ no run may write the action.allowed for git.merge.protected itself (34.495018ms)
+✔ a message to a stopped role sends launch.by one notice, and the result says so (46.636829ms)
+✔ a message to a role outside launch.instances says so in its result and in the notice (30.94364ms)
+✔ a message to a running role sends no notice and its result is unchanged (31.06682ms)
+✔ a re-route at a claim, a release and claim, and a broker restart send no second notice (41.692567ms)
+✔ a run launched but not yet claimed counts as no holder (27.096596ms)
+✔ no notice for a message to launch.by, from it, a refused one from a tester, to the human, or in a thread to a thread instance (49.06815ms)
+✔ a business with no launch block tells nobody and says there is no launcher (27.760044ms)
+✔ the notice sender stays internal: no role is named _bus and no caller can send as it or to it (68.785838ms)
+✔ row 302 a run threadIdle released answers launcher-released on receive, state, read and send, logs each, and claims nothing again (82.602342ms)
+✔ row 302 with a run launcher-released, a run that lost its claim another way still answers not-holder (63.109687ms)
+✔ row 302 a run landRelease released answers launcher-released, and claims nothing again (67.582187ms)
+✔ C2-03b T6: the slot before any chief evidence, then the listed chief's live grant (55.515686ms)
+✔ C2-03b T7: a chief revoked through grants.revoke or fired through instance.fire refuses, and the fallback stays ended (541.354515ms)
+✔ C2-03b T7 choice checks: delisted, a fire under way and held each refuse; a rehire lists the chief again (69.1856ms)
+✔ C2-03b T8: a chief grant on another project ends the fallback, and two listed chiefs refuse library-fetch-no-grant (68.143335ms)
+✔ C2-03b departure (sage-2928): with no chief entry, any Gitea grant evidence refuses (38.874642ms)
+✔ C2-03b T9 runtime: the chief's store file and user, then a real revoke that runs no git with the slot at 0000 (1594.196796ms)
+✔ C2-03a library.sync: every agent, the tester and a reader are refused before the adapter runs (37.234309ms)
+✔ C2-03a library.sync: the human fetches, accept passes through, and a held sync is a recorded refusal (34.17144ms)
+✔ C2-03a library.sync: a LibraryError keeps its code and a host without sync is not configured (49.330814ms)
+✔ C2-03a runtime: a librarySync from a boot config, with no function, is refused (2.370446ms)
+✔ C2-03a runtime: the timer syncs each entry with a user at start and on each tick, logs codes only, and stops on close (820.228498ms)
+✔ row 254 human-cli: library.sync outlasts the 5 s client default, and library.status does not (6132.989267ms)
+✔ C2-04 M4: both verbs reject every agent before arguments or adapter access (65.141597ms)
+✔ C2-04 bus: human reads validate keys and return adapter results without path leakage (29.126478ms)
+✔ C2-04 socket: each async library verb resolves its result rather than serializing {} (129.874761ms)
+✔ C2-04 runtime: protectedRoots skips library but retains real code-root credential protection (185.539801ms)
+✔ C2-04 runtime: unsafe existing mirror refuses boot and never publishes a socket (48.33864ms)
+✔ C2-04 runtime: real library adapters reach the socket and lock waits leave other bus reads responsive (366.18109ms)
+organization: {"event":"reload-needs-restart","business":"demo"}
+✔ T20 fire: a revoke that fails stops the fire with the file unchanged; one that succeeds revokes, keeps the directory and names the services outside the store (169.798357ms)
+✔ T20 fire: an instance already delisted still has its tokens revoked and the file is left alone (101.35251ms)
+✔ T20 fire: with no entry in the running bus, a token on disk refuses and an empty store goes on (105.48094ms)
+✔ T20 delete: a revoke that fails keeps the file; one that succeeds clears the store, deletes, and names the tracker bot (137.806439ms)
+✔ T20 delete: with no entry in the running bus, a token file is cleared and the delete goes on; a file reference refuses (93.307104ms)
+✔ T21 delete: a write between the raise and the take makes the delete refuse revision-conflict before it revokes anything (102.833358ms)
+✔ row 281 T1 fire: a host.<id> or granted gitea file in the store refuses step B credential-revoke-failed, file unchanged (108.946186ms)
+✔ row 281 T1 start: a host grant record whose key file is gone starts and reads not-issued (99.045929ms)
+✔ row 194 T12: agent and reader sessions refuse the lifecycle verbs before any effect; the tester gets launch, end and the request read, never regenerate (65.962959ms)
+✔ row 194 V2 and V4 at the verb: the request is open, by the human, with a human.input; thread, retired, unknown and revoked refuse with no event (40.008061ms)
+✔ row 194 D1.1 take: a request is taken once, closes once, and lifecycleRequests lists only what is not closed (30.459814ms)
+✔ row 194 D1.1 take: a launch.revoke after the request closes it launch-revoked, and a request past 60 s closes request-expired (35.336611ms)
+✔ row 194 T15 (bus): while halted, launch and regenerate refuse processing-halted at the verb and at the take, hire and fire refuse, terminate goes; an unreadable switch refuses with its code (51.53855ms)
+✔ row 194 T12a: the tester launches and ends on its own business with actor tester; bus.tester off in the file refuses the call and the take tester-off (45.625106ms)
+✔ row 194 V3 terminate: claims revoked, open requests cancelled, bound runs named, taken requests listed; nothing at all answers not-held (50.870962ms)
+✔ row 194 V3 terminate of a thread instance: the human ends every thread, the tester only its own (38.165175ms)
+✔ row 194 T6 V5 order at the verb: the writer's named refusals, then instance-running, instance-starting, the last-listed refusal and the revision (57.997434ms)
+✔ row 194 V5: an open launch past its 60 s is not starting, as it can only close request-expired (25.554688ms)
+✔ row 194 V5 after the take: lifecycleDelete re-checks running and starting, then commits through the writer with the human as actor (47.268936ms)
+✔ row 194 V5 retry: a retired name deletes again only after workspace-rename-failed, and that request commits nothing (39.300047ms)
+✔ row 194 V5 runtime: a delete request, the take and lifecycleDelete commit the file with retired, log the human and reload so the name no longer binds (248.318154ms)
+✔ REQ-LIMIT-3 limitLeaves finds every limit object and skips the agent numbers (2.21154ms)
+✔ REQ-LIMIT-3 limitLeaves takes token limits at schema depth only, whatever their names (0.319113ms)
+✔ REQ-LIMIT-3 with no check switched on a launch is allowed, a turn never stops, and every limit is not enforced (25.258779ms)
+✔ REQ-LIMIT-3 a fixture check that refuses refuses the launch and stops the turn, logged with the limit and the count (26.914156ms)
+✔ REQ-LIMIT-3 a report that omits a limit shows it not enforced; a counted entry and a reason come through (24.45288ms)
+✔ REQ-LIMIT-4 each check gets the business, a copy of the limits, the subject, the records and the time (26.288689ms)
+✔ REQ-LIMIT-4 fail closed: a throw refuses, stops and fails the report, naming the check and the code (28.375281ms)
+✔ REQ-LIMIT-4 fail closed: a malformed answer, a promise, a rejected promise, a non-boolean or a bad hit is malformed-answer (27.517471ms)
+✔ REQ-LIMIT-4 fail closed: a check switched on but not loaded refuses, stops and fails every limit as not-loaded (22.487669ms)
+✔ REQ-LIMIT-4 state(), never-loaded case: before any load the report shows not enforced, or not-loaded for a switched-on check (16.470574ms)
+✔ REQ-LIMIT-4 state(), first-load-refused case: a check refused on its first load is not-loaded in mayLaunch, mustStop and report (19.905443ms)
+✔ REQ-LIMIT-4 fail closed: an unreadable organization file refuses and stops with check null; the report throws (20.205938ms)
+✔ REQ-LIMIT-4 fail closed: unreadable records refuse and stop with check null and fail the report (0.745173ms)
+✔ REQ-LIMIT-3 the shipped token-limit, through the real loader, counts known records only since the limit was set (31.700735ms)
+✔ REQ-LIMIT-3 a token limit for a provider named limit is counted and refuses, beside an agent limit of the same name (19.531245ms)
+✔ REQ-LIMIT-3 core reaches limit checks only through the plug-in loader (2.034268ms)
+✔ REQ-LIMIT-4 a role run at its limit stops at the end of its turn: RESULT and read land first, the claim is revoked by limit-check (59.64629ms)
+✔ REQ-LIMIT-4 the stop also lands on state; a run with no stop ends without a limit (68.287598ms)
+✔ REQ-LIMIT-4 fail closed: a mustStop throw or a malformed answer stops the run, naming the bus and the code (153.711085ms)
+✔ REQ-LIMIT-4 a thread run at its limit is released with the reason, and its end record names the limit (40.158817ms)
+✔ REQ-LIMIT-4 a broker with no limit checks configured never stops a run (30.253599ms)
+limits: {"event":"limit-reached","business":"demo","check":"token-limit","export":"mayLaunch","subject":{"instance":"coder","provider":"zai","model":"glm-5.3-flash","account":null},"path":["tokens","instances","coder"],"limit":0,"count":0,"unknownTurns":0}
+organization: {"event":"reload-needs-restart","business":"demo"}
+usage: {"event":"usage-unknown","business":"demo","run":"run1","instance":"coder","turn":"e6b111a2-4a95-4e8e-a450-d01ec40f4b0b","source":"@none","code":"baseline-unknown"}
+limits: {"event":"limit-reached","business":"demo","check":"token-limit","export":"mustStop","subject":{"instance":"coder","provider":"zai","model":"glm-5.3-flash","account":null},"path":["tokens","instances","coder"],"limit":0,"count":0,"unknownTurns":1}
+usage: {"event":"usage-unknown","business":"demo","run":"run1","instance":"coder","turn":"97e8fdd1-4749-4f4e-943d-921b7ec41c99","source":"@none","code":"baseline-unknown"}
+organization: {"event":"reload-needs-restart","business":"demo"}
+✔ REQ-LIMIT-3 REQ-LIMIT-4 runtime: limits carries the token count, mayLaunch refuses at the limit, a reset moves since (236.041961ms)
+✔ REQ-LIMIT-3 runtime: with no limit check switched on, the limit shows not enforced and every launch is allowed (62.066034ms)
+✔ REQ-LIMIT-4 runtime: the broker asks the shipped token-limit after a turn, and the run at its limit stops on its next receive (83.105996ms)
+✔ REQ-LIMIT-4 runtime: with no usage source a turn is unknown, counts zero and stops nothing under a limit of 1 (86.892511ms)
+✔ REQ-LIMIT-3 runtime: switching a limit check on with plugins.set loads it without a launch or a turn (100.61049ms)
+organization: {"event":"reload-needs-restart","business":"demo"}
+organization: {"event":"reload-needs-restart","business":"demo"}
+✔ limits binds actor from human proof and rejects role, reader, a tester set and forged actor (40.754906ms)
+✔ runtime wires verified human settings to the actual shared file writer and actor receipt (170.771777ms)
+✔ uncertain organization receipts leave bus startup and reads alone but refuse writes until reconciled (99.202453ms)
+✔ within-role sends cite an open gated launch decision without spending it or naming it in grants (48.791665ms)
+✔ missing and foreign-business citations refuse and roll back message and grant (37.035432ms)
+✔ cross-role sends still need a matching resolved decision and consume it once (46.831029ms)
+✔ trail on a hidden message id answers exactly as on an unknown id, for the owner, a reader and the tester (44.544201ms)
+✔ replies on a hidden message id answers exactly as on an unknown id, for the owner, a reader and the tester (52.539603ms)
+✔ trail on a decision keeps the decision and drops the user thread messages, their deliveries and their events (60.920586ms)
+✔ replies leaves out other users thread messages and still fills a page (379.213422ms)
+✔ messages in the business human and tester threads are not hidden (row 177 unchanged) (75.224656ms)
+✔ governance pin: the owner sees decisions, inbox entries, claims, tasks and project files, but not the user messages (219.375172ms)
+✔ messages pages all human messages newest first without writes; read state is history (594.132174ms)
+✔ messages refuses role callers, invalid paging and cursors outside this human feed (47.433603ms)
+✔ views messages passes only its paging arguments through (0.394739ms)
+✔ messages isolates businesses even with a valid foreign cursor (40.52885ms)
+✔ the assistant sends to the user and to the chief of staff only (80.462231ms)
+✔ an assistant send to any other role, or to the tester, is refused and logged (69.19546ms)
+✔ only the user and the chief of staff may send to the assistant; the tester is refused by default (70.079967ms)
+✔ REQ-ASSIST-2 REQ-THREAD-1 thread.send to an instance that does not hear from the user is refused and stores nothing (53.382267ms)
+✔ a sender-side list alone refuses a send to a role that has no list (55.78648ms)
+✔ a target-side list alone refuses a send from a role that has no list (53.864309ms)
+✔ the sender list is checked before the target list (50.701043ms)
+✔ roles without the field behave exactly as before (75.680863ms)
+✔ a business with no role definitions at all is unlimited (70.504145ms)
+✔ a malformed messaging field refuses at boot (24.636233ms)
+✔ the assistant's review.request to a reviewer is refused and logged, even with an approved decision (63.475132ms)
+✔ a review.verdict to the assistant from a role outside its receiveFrom is refused and logged (84.233948ms)
+✔ review requests and verdicts between roles without the field are unchanged (47.077031ms)
+✔ 3f copy migrates to 3g preserving every old column/row, with an empty instance_names and null to_name (189.155442ms)
+✔ REQ-MSG-2: the chief of staff names an instance under its within-role grant, and the write is logged (48.849099ms)
+✔ REQ-MSG-2: the human names an instance through the CLI (35.183787ms)
+✔ REQ-MSG-2: a role without the grant, or holding it cross-role, is refused not-authorized (41.115906ms)
+✔ REQ-MSG-2: a name is unique in the business and is never an instance key or a role name (71.174384ms)
+✔ REQ-MSG-2: a send by name reaches the instance and records both; a send by instance key is unchanged (53.85673ms)
+✔ REQ-MSG-2: an instance key beats a name that equals it, as when a later instance takes the key (37.065117ms)
+✔ REQ-MSG-2: a role name beats a name that equals it, as when a later definition takes the word (sage-0590) (41.264224ms)
+✔ proof receives actual peer, cap traffic never invokes helper and transient cap disconnects (11.460487ms)
+✔ proof helper error and disconnect during verification never dispatch or bind (3.05799ms)
+✔ Client receives explicit proof refusal codes without dispatch, not outcome-unknown (67.403036ms)
+✔ asynchronous proof calls release their transient session on success, failure and timeout (30.740214ms)
+✔ T2 eight proof callers and a racing copier bind the exact accepted socket, which survives helper exit (387.546628ms)
+✔ helper output and failures fail closed including unsafe gid (3.381257ms)
+✔ helper timeout, capacity and shutdown refuse without leaving children (26.164069ms)
+✔ missing or non-regular peer helper refuses at construction before opening the bus (0.423993ms)
+✔ shutdown waits for killed helper close before returning (6.244637ms)
+organization: {"event":"reload-needs-restart","business":"demo"}
+organization: {"event":"reload-needs-restart","business":"demo"}
+organization: {"event":"reload-needs-restart","business":"demo"}
+organization: {"event":"reload-needs-restart","business":"demo"}
+✔ plugins and plugins.set refuse every non-human session and a forged actor, and pass only the patch with the verified actor (43.999659ms)
+✔ runtime: the switch changes the organization file, the receipt carries the actor, and a bad shape, an unknown module and a stale revision are refused with nothing written (203.075319ms)
+✔ vikunja:19/309 through the broker, a patch switches the kinds it names and keeps the rest; null removes one kind and is trailed (107.119582ms)
+✔ principal binds kernel peer PID and uid, maps owner, and never takes identity or role from body (3.04203ms)
+✔ user requires its own nonce and full walk plus immediate same-tree Console parent (0.934034ms)
+✔ tester deliberately admits agent parents but rejects managed runs and another nonce (0.543389ms)
+✔ human leaf identity is reread after walking the parents (0.296974ms)
+✔ console requires its own wrapper, nonce and serve parent, and a configured owner from the spawn env (2.400757ms)
+✔ broker process binds trusted launches, offers reader capabilities, refuses human mutation, closes cleanly (268.323884ms)
+✔ startup token refusal returns safe code without value or partial listening broker (185.359668ms)
+✔ loaded fixture token is absent from socket replies and SQLite, including refusal evidence (258.28209ms)
+✔ killed broker leaves an explicit stale lock; another process cannot silently reclaim it (375.794179ms)
+✔ trusted host registers later launches; socket clients never have a registration verb (231.393497ms)
+✔ REQ-LIMIT-4 the broker process answers the launcher's mayLaunch op with the limits' awaited decision (239.425801ms)
+✔ runtime excludes declared project roots even when host supplies no repoRoots (181.028051ms)
+✔ a refused launch binding leaves the broker and existing capabilities alive; bad protocol stops it (227.205421ms)
+✔ real runtime injects the coordinator, stops its workload and mirrors stable stop events across restart (263.324857ms)
+✔ invalid state still starts the control bus and human halt then resume repairs it (117.38353ms)
+✔ processing halt and resume extend only the socket timeout while ordinary status retains the explicit timeout (189.409187ms)
+✔ a root halt aborts the active search-source signal before the normal web deadline (36.265835ms)
+✔ processing.halt refuses agent reader and tester before any transition (38.008715ms)
+✔ processing.resume refuses agent reader and tester before any transition (27.364883ms)
+✔ human halt and clear each have one event with verified actor; launch.restore cannot clear (33.276586ms)
+✔ all ordinary work verbs refuse before dispatch while pure reads remain available (63.079856ms)
+✔ task web authorization and bind paths refuse before external work (34.712273ms)
+✔ recordEvent cannot forge processing.halt (21.998468ms)
+✔ recordEvent cannot forge processing.resume (25.60697ms)
+✔ recordEvent cannot forge processing.stop (24.682865ms)
+✔ recordTask poll cannot forge a processing action through its kinds filter (26.275877ms)
+✔ recordTask self cannot forge a processing action through its kinds filter (22.563573ms)
+✔ spec read remains a read but cannot release new write work after an await (31.917544ms)
+✔ the real socket awaits halt and resume beyond the ordinary idle deadline (75.243553ms)
+✔ a malformed processing reader never silently admits agent work (32.097292ms)
+✔ halt refuses the newly landed host executor path before credentials or effects (29.242567ms)
+✔ D1: committed write with a failed receipt refuses outcome-unknown without action.allowed (42.080817ms)
+✔ D2: spec.read refuses without content if its role is released during the read (24.943611ms)
+✔ D3: spec.read secret check refuses flagged content without content (28.502889ms)
+✔ D3: spec.read secret check refuses flagged subject without content (26.665218ms)
+✔ a human lists, opens and saves; the save is one commit by the business human (215.901049ms)
+✔ an agent and a reader refuse every file verb and nothing is written (79.438426ms)
+✔ a stale base refuses stale-base and writes nothing (131.76089ms)
+✔ paths outside the spec and docs refuse, as do unknown projects, missing files and odd arguments (115.593294ms)
+✔ without a project adapter the file verbs refuse project-not-configured (48.708539ms)
+✔ on the socket a save may carry 1 MiB of text; every other request keeps the 64 KiB limit (390.82572ms)
+✔ a request that names the save verb first and another verb last is refused at 64 KiB (125.619884ms)
+✔ two saves racing for one repository make one commit (247.5191ms)
+✔ Broker keeps the sandbox client import closure: only the listed imports, no lazy project import (3.228892ms)
+✔ without a trusted project adapter all three async paths refuse project-not-configured (79.278856ms)
+✔ real startBroker injects the project adapter for socket reads and bound-author record writes (349.909449ms)
+✔ a raise with no recorded push refuses no-push; a raise binds the latest push and shows it (57.899841ms)
+✔ happy path: the fork is the upstream repo under the agent's own user, the destination is host-built (55.097622ms)
+✔ a hard wait: no decision refuses, and a decision for another task refuses (45.892323ms)
+✔ r4 B4: approve while the latest push is A, push B, publish refuses decision-mismatch (91.688489ms)
+✔ grant and fork refusals (81.056451ms)
+✔ remote-not-fork, compared without case, and remote-host-mismatch, at push (168.820049ms)
+✔ two agents granted one project each get their own fork (75.66753ms)
+✔ the request cannot name the fork, the user or the destination (39.53804ms)
+✔ one decision, one open publish: a second ticket refuses publish-busy, whatever its branch (88.499792ms)
+✔ publishRefused files the code on the task's trail and drops the ticket (39.017007ms)
+✔ git.push.remote is in neither ROUTED list and no shipped role grants it (1.290281ms)
+✔ runtime: withGitea keys from the open ticket only, and the store root is the organization dir (173.755016ms)
+✔ the bus process answers the publish ops from their own lines, not launch-op-refused (259.670509ms)
+organization: {"event":"reload-needs-restart","business":"demo"}
+organization: {"event":"reload-needs-restart","business":"demo"}
+✔ T14 a create goes live with no restart: the new instance binds at once and the answer says restart false (123.077304ms)
+organization: {"event":"reload-needs-restart","business":"demo"}
+organization: {"event":"reload-needs-restart","business":"demo"}
+organization: {"event":"reload-needs-restart","business":"demo"}
+organization: {"event":"reload-needs-restart","business":"demo"}
+organization: {"event":"reload-needs-restart","business":"demo"}
+organization: {"event":"reload-needs-restart","business":"demo"}
+✔ T14 every committed verb reloads once, limits.set, routes.set, plugins.set and veto.set included, and a refused one does not (158.894923ms)
+✔ T14 a definition change on a running instance refuses instance-running; a vars change still goes live (109.328034ms)
+✔ T14 a file whose credential references differ from the boot copy is not reloaded and the write answers restart true (81.074076ms)
+✔ T14 a date-only change to a credential reference still reloads: row 199 issue rewrites the date outside the reload (79.190828ms)
+✔ T19 a credentialed create answers restart true; issue works only after a restart, and a later vars change goes live (174.742633ms)
+✔ T14 after a refused reload veto.set, instance.hire and instance.fire answer restart true, and a fire of a name kept since refuses before step A (215.389288ms)
+✔ T14 a file whose project root differs from the boot copy is not reloaded, because the Credentials store protects the boot roots (85.886163ms)
+organization: {"event":"reload-needs-restart","business":"demo"}
+✔ T14 a file whose library mapping differs from the boot copy is not reloaded, because the mirror is ensured at start (324.217706ms)
+✔ T14 reloadBusiness refuses an unknown business, a changed human and a document the boot check refuses (20.978271ms)
+✔ a reply is listed for human and reader sessions, and its delivery rows are unchanged (62.708954ms)
+✔ the reply still reaches the human message.receive (mosaic talk) after the Console showed it (35.904586ms)
+✔ a message with no reply gives an empty list (28.916638ms)
+✔ replies come oldest first and stop at REPLIES (146.990176ms)
+✔ an id that names no message in the business refuses message-not-found, and the refusal is recorded (50.407825ms)
+✔ strict arguments; a role session gets human-required (62.570979ms)
+✔ views passes replies through as one call with the id (0.328771ms)
+✔ requirements returns the committed list to a holding role session, and no one else (44.983123ms)
+✔ the PM's prd.approve with no task, when no id fits, reaches the human's Inbox (29.403647ms)
+✔ the PM's non-blocking role.revoke with no task reaches the human's Inbox (36.634293ms)
+✔ a push is recorded as the action.allowed for git.push.working on the task, and only the host records one (52.939665ms)
+✔ review.request names the latest pushed commit and sends the reviewer a REVIEW-REQUEST (41.690804ms)
+✔ review.request says which run holds the reviewer role, or null, and a null request waits for a claim (53.787163ms)
+✔ review.request refuses a commit that isn't the latest push, a non-reviewer and a role without the action (60.839033ms)
+✔ reviewFetch answers only the addressed reviewer, for the request it cites (42.54023ms)
+✔ review.verdict answers one request once, to the role that asked (48.30516ms)
+✔ task.close on a pushed task needs an approve verdict for the latest push (68.98924ms)
+✔ a refusal the host decided is filed on the task it names, and only a task ref counts (40.689548ms)
+✔ row 306 T1: a run the timer sweep ended answers thread-revoked on every claim-needing call, logged, and its claim still refuses run-revoked (59.979544ms)
+✔ row 306 T1: a user's request and access.reload end the run the same way, and it answers thread-revoked (86.747594ms)
+✔ row 306 T2: after the sweep, a run the human stopped and a run the limit stop ended still answer not-holder (58.492583ms)
+✔ room.open sorts all threaded instances, creates defaults, and reuses caller-owned threads (40.887023ms)
+✔ room.open preflights instance collisions atomically (27.980764ms)
+✔ room.open preflights owner collisions atomically (27.129556ms)
+✔ room verbs require the human, and none is a tester verb (37.918614ms)
+✔ room verbs refuse missing projects and zero member businesses (56.262007ms)
+✔ send/read refuse a missing canonical member without effects (35.527221ms)
+✔ send/read refuse a foreign-owner canonical member without effects (33.757159ms)
+✔ send/read refuse a wrong-instance canonical member without effects (40.793912ms)
+✔ room.send targets a key, broadcasts without tags, and preserves original text and ordinary route/input rows (39.356598ms)
+✔ current display names and repeated tags resolve once; a replaced display name is unknown (45.097001ms)
+✔ a legacy name colliding with another member key is ambiguous; its own key resolves once (37.081012ms)
+✔ unknown or non-member addressees and tags-only bodies leave no message effects (41.077915ms)
+✔ messaging denial on the last target rolls back the entire broadcast; allowed subset still works (30.269308ms)
+✔ a clearing last member fences the whole send; another active target still accepts (42.406737ms)
+✔ room.read groups one send, pages by the last grouped id, and rejects foreign or absent cursors (60.236064ms)
+✔ room.read keeps identical sends at the same timestamp separate and includes every session (58.276158ms)
+✔ room.read defaults and caps the number of merged entries, not recipient rows (828.315123ms)
+✔ room.read includes an agent reply with its thread and instance without merging it with human rows (40.528195ms)
+organization: {"event":"reload-needs-restart","business":"demo"}
+✔ row 65: routes and routes.set refuse every non-human session, the chief of staff included, the tester may read and set, and each passes the verified actor (55.401636ms)
+✔ row 65: a new launch binds only on a switched-on harness with a module name, and a run an earlier broker bound binds again after its harness is switched off (41.992657ms)
+✔ row 65 runtime: harnessLevels answers each module in the tree, and null for a name with no module (65.489656ms)
+✔ row 65 runtime: routes and routes.set reach the organization file with the human as actor, a new bind reads plugins.harness, and each refusal keeps the bytes and logs nothing (155.731712ms)
+✔ v3b prototype refusals, views and append-only mutations (174.267464ms)
+✔ T4 D7: a clear of a held default session fences it, drains at the next receive, retires at the exit proof and moves the default (81.68483ms)
+✔ T4 D7: an unheld session drains at accept, its proof is run null, and a non-default clear leaves the default (36.278416ms)
+✔ T4 D7: a run that ends before its next receive drains at its end, with its generation (35.863604ms)
+✔ T4 D7: a run whose turn is running (delivered, unread) stays clearing; uncertain is recorded once and nothing more (55.088689ms)
+✔ T4 D7 B1: undelivered inputs are cancelled with receipts at accept, never delivered to the successor, and a routed reply is cancelled at arrival (57.154233ms)
+✔ T4 D7: repeat, conflict, a second op, a stale revision, confirm and a halt (56.900337ms)
+✔ T4 Q4: the successor takes <old>-N, the next N free, and a bound name stays taken (42.523918ms)
+✔ T4 D8: the successor start is held, refused or started, each report on its own counter (42.938935ms)
+✔ T4 D7 N4: a halt at retirement waits and writes nothing; retirement goes once processing resumes (30.860779ms)
+✔ T4 sage-2828: a cancel before retirement makes the session active again, keeps the claim and the cancelled messages, and never makes the successor (52.793855ms)
+✔ T4 sage-2828 sage-2830: a cancel after retirement ends the startup only, and a later thread-only send makes the successor pending as new input (41.553706ms)
+✔ T4 N4: a user's thread whose grant is gone by retirement ends the clear failed, writes no successor, and leaves the session as it was (39.203771ms)
+✔ T4 N4: a user's thread whose grant is live at retirement retires the session and makes its successor (39.885761ms)
+✔ T4 sage-2828: a cancel after the successor started refuses session-clear-complete (51.203712ms)
+✔ T4 B2: a run bound to a clearing session refuses its claim, and claims again once the clear is cancelled (41.005029ms)
+✔ T4 mos-1325: the tester clears its own thread; its clear, cancel and operation on a human-owned thread refuse thread-not-owned and write nothing (47.301578ms)
+✔ T4 schema: session_ops and message_cancels are append-only, and a second open clear of a session is refused below the broker (32.953688ms)
+✔ T4 schema: a 3m store migrates to 3n, session_ops and message_cancels are new and empty, and every other row stays as it was (171.482343ms)
+✔ T4 schema: the 3m engine refuses a 3n store, migrating or not, and leaves it as it was (298.623183ms)
+✔ session.list rows carry the reader count for each session, with its store identity (35.603722ms)
+✔ a legacy session is asked for with legacy true (31.44115ms)
+✔ without a reader the count is unknown, never 0; a reader that throws is store-unreadable (48.135592ms)
+✔ compactions must be a function (17.994336ms)
+✔ T1 REQ-ROLE-2: two sessions of one thread keep their own history, delivery and replies (87.575838ms)
+✔ T2 REQ-ROLE-2: one holder per session, generations count its claims, and a sibling session's message never reaches the other holder (69.988273ms)
+✔ T2 sage-2257: a released or revoked run's retired generation refuses its approval, delivery and read, and writes nothing (90.154131ms)
+✔ session.create is idempotent on its op, refuses a reused op or a taken name, and reaches only the owner's threads (59.420663ms)
+✔ the 3l triggers keep sessions in their thread and session ids apart from thread ids (122.82591ms)
+✔ T7: a 3k store migrates to 3l, each thread's default session has the thread's id, and old rows keep their seqs (199.94666ms)
+✔ T7 D9: the 3k engine refuses a 3l store, migrating or not, and leaves it as it was (273.666345ms)
+✔ gated approval authorizes once, survives store reopen, and fresh approval works (60.531759ms)
+✔ another run of the same instance consumes an approval once; a failed check leaves it usable (40.408714ms)
+✔ two scheduled callers have exactly one grant and one consumed refusal (29.444977ms)
+✔ failed commit rolls consumption back; cross-role consumes and within-role stays reusable (55.575508ms)
+✔ class drift gated to cross-role refuses before consumption (44.546836ms)
+✔ class drift cross-role to gated refuses before consumption (43.543892ms)
+✔ class drift gated to within-role refuses before consumption (39.587229ms)
+✔ class drift cross-role to within-role refuses before consumption (51.164236ms)
+✔ class drift within-role to gated refuses before consumption (40.167874ms)
+✔ class drift within-role to cross-role refuses before consumption (37.298906ms)
+✔ message.send consumes approval and prevents a later send or authorize (40.603701ms)
+✔ role.revoke consumes approval and prevents a later revoke or authorize (47.210822ms)
+✔ 3e copy migrates through 3f to 3g preserving every old column/row and adding null spec citations (160.388574ms)
+✔ a human spec save sends one notice to each pm and cto, naming the commit, and each commit sends its own (221.606056ms)
+✔ no notice for a docs save, an agent record commit, a git commit outside the Console, or a refused save (246.777628ms)
+✔ a notice to a role no run holds waits for a claim, and launches nobody and tells nobody (110.419017ms)
+✔ a business without a pm or a cto saves the spec and sends nothing (101.496939ms)
+✔ a notice that cannot be stored answers outcome-unknown, and the commit stands (122.94473ms)
+✔ a BLOCK reaches the chief of staff, the chief relays it to the assistant in the user's thread, and the commit stands (149.365032ms)
+✔ with no thread a BLOCK still reaches the chief of staff, and the relay to the assistant is refused (128.863537ms)
+✔ within the notice's project the relay lands in the user's most recently opened thread (139.170426ms)
+✔ a more recently opened thread in another project does not take the relay (125.172526ms)
+✔ a BLOCK is refused from anyone but a pm or cto, to anyone but the chief of staff, and outside a reply to its own notice (153.958308ms)
+✔ a role cannot forge a spec notice: its text opens neither a BLOCK nor the assistant's thread (133.408515ms)
+✔ the bus receives nothing: a reply to a notice addressed to _bus is refused (127.320541ms)
+✔ real socket awaits spec reads, record writes and cited raises; other requests still return normally (199.317317ms)
+✔ real socket preserves asynchronous refusal codes and disconnects its transient proof (105.197162ms)
+✔ two real socket writes to one repository yield one commit and one project-busy refusal (102.826835ms)
+✔ client disconnect during await tolerates late reply (94.884354ms)
+✔ client disconnect during await tolerates late refusal (75.622684ms)
+✔ N-a: slow admitted record.write returns its committed result after the idle deadline (255.697027ms)
+✔ current citation is recorded; docs commits do not stale it and a new spec never reopens settlement (177.20135ms)
+✔ stale, unconfirmed, missing and partial spec citations refuse without inserting a decision (164.897564ms)
+✔ uncited raises retain their synchronous path and spec read is available to any held role in its business (73.943305ms)
+✔ record writes bind the session author, require authority and refuse spec and impersonation paths (88.042056ms)
+✔ REQ-COS-1: the pm asks the chief of staff for roles and counts; the chief receives a STAFF-REQUEST and answers it (54.606811ms)
+✔ REQ-COS-1: only the pm can send a staff request; every other session is refused and the chief of staff hears nothing (53.40811ms)
+✔ REQ-COS-1: a pm without message.send is refused like any other gated action (25.713573ms)
+✔ REQ-COS-1: the request goes to the business launcher, and only when that is a chief of staff (78.645601ms)
+✔ REQ-COS-1: the sender is judged by definition: an instance `lead` of the pm definition can ask, an instance `pm` of the coder definition can't (66.843564ms)
+✔ REQ-COS-1: the launcher is judged by definition: an instance `boss` of the chief-of-staff definition receives, a `chief` of the coder definition gives no-chief-of-staff (61.324513ms)
+✔ REQ-COS-1: a refused staff request leaves no staff.request action.allowed event (40.042673ms)
+✔ REQ-ASSIST-2: the role definitions' messaging lists hold for a staff request, sender and recipient (97.302393ms)
+✔ a staff request names a task, 1 to 10 distinct roles and counts of 1 to 20; nothing else is accepted (76.347415ms)
+✔ REQ-COS-1: a staff request grants nothing: the pm still can't launch and the chief of staff launches as before (40.139315ms)
+✔ a business that never switched launches reads allowed with no time and no event (31.348369ms)
+✔ launches revoked and then restored read allowed, with the restore time and event id (31.350581ms)
+✔ a task closed on the tracker leaves the open list, and total counts the open ones (29.093825ms)
+✔ a tombstone is not open (23.892669ms)
+✔ the open list stops at the cap and says so; total still counts every open task (29.120164ms)
+✔ a role and a reader session read state; arguments, and an unbound cap, refuse (27.425863ms)
+✔ a human session reads the same state, with the same cap (28.557484ms)
+✔ reading state writes nothing: every table keeps its row count (28.711366ms)
+✔ creates private WAL store and excludes a second writer until explicit close (23.384643ms)
+✔ rollback is atomic and schema metadata is checked against trusted DDL, not just itself (22.743229ms)
+✔ existing empty database and symlink runtime directory refuse, never initialize over damage (24.668525ms)
+✔ crash during a transaction recovers no partial event after explicit fixture-only lock removal (115.738364ms)
+✔ writer refuses mixed at/read_at forms atomically, even through trusted SQL helpers (18.591869ms)
+✔ async transactions refuse before invoking their function (13.999449ms)
+✔ usage_records refuses non-canonical timestamps atomically (20.63521ms)
+✔ the session default fits under the reply cap and pages to the end with next (216.753761ms)
+✔ the short form: no description, assignees by role, every listed key (142.972831ms)
+✔ each filter, alone and together, and total counts every match (259.559891ms)
+✔ task_ref reads one task in full, as the whole board has it (159.016289ms)
+✔ no arguments is the read the Console and mosaic make, unchanged (127.602321ms)
+✔ an unknown argument or a bad value refuses invalid-request (554.780347ms)
+✔ tasks rows carry priority and requirement for every session that reads tasks (68.550153ms)
+✔ the read model rebuilds from the ledger: a reopened bus and each trail give the same values (80.299364ms)
+✔ an empty business and one with snapshots but no task.created read cleanly (26.097408ms)
+✔ recordTask keeps sync reads and a role write apart (36.668814ms)
+✔ read_at must be one canonical UTC format, so the projection compares strings safely (18.800091ms)
+✔ a bad entry refuses the whole record (23.403583ms)
+✔ taskView reads the projection for one business (27.838037ms)
+✔ requestTask hands only a holder and a task verb to the handler, and records refusals (44.784767ms)
+✔ the server sends task verbs to the adapter with its own timeout; other verbs stay synchronous (318.912001ms)
+✔ without an adapter the server refuses every task verb (67.382665ms)
+✔ the runtime refuses an invalid adapter and closes a valid one (103.632882ms)
+✔ the process loads the S3 adapter from plain-data trackers (411.341523ms)
+✔ row 177 T1: a tester thread is owned by tester, and neither side reaches or lists the other (46.823421ms)
+✔ row 177 T2: the tester thread.send is from tester-cli with no human.input; its open is by tester (33.930166ms)
+✔ row 177 T3: the lists read the tester as the human in its own thread, and nowhere else (30.896518ms)
+✔ row 177 T3: an assistant that would not hear the human refuses the tester too (31.702031ms)
+✔ row 177 T4: the tester thread run answers the tester, never the human (47.821714ms)
+✔ row 177 T5: each stop revokes only its own threads, recorded by its own actor (40.567665ms)
+✔ row 177 T5: the human stop never ends a tester run (31.501064ms)
+✔ row 177 T6: a business whose human is tester refuses invalid-business (19.718955ms)
+✔ row 177 T7: the human trail shows a tester thread message as the tester (34.020707ms)
+✔ row 177 T8: a tester-thread run never raises a decision to the human; a human-thread run still does (39.008039ms)
+✔ row 177 T8: a tester-thread raise routed to the arbiter stays allowed (35.503216ms)
+✔ row 182 T9: a tester reply into the human's thread refuses thread-not-owned and stores nothing (35.758454ms)
+✔ row 182 T9: a tester reply into its own thread lands there (33.959577ms)
+✔ row 182 T9: the chief's reply up a chain into a tester's thread lands there (39.736148ms)
+✔ row 182 T9: a tester reply to a spec notice refuses thread-not-owned; the chief's relay still lands (40.619516ms)
+organization: {"event":"reload-needs-restart","business":"demo"}
+organization: {"event":"reload-needs-restart","business":"demo"}
+organization: {"event":"reload-needs-restart","business":"demo"}
+organization: {"event":"reload-needs-restart","business":"demo"}
+organization: {"event":"reload-needs-restart","business":"demo"}
+✔ row 175: TESTER_VERBS and the organization branch tester set are pinned (2.015521ms)
+✔ row 175: each of the six reads as the tester deep-equals the human read (117.766706ms)
+✔ row 175: W1-W3 as the tester land with receipt actor tester; the human still logs the human (131.021914ms)
+✔ row 175: W2 as the tester refuses credentials, protected definitions, human, tester and bus.tester, and changes nothing (105.34333ms)
+✔ row 175: the human-only actions refuse a tester tester-refused, and the file and store stay as they were (113.248389ms)
+✔ row 175: W4 as the tester writes by tester and keeps every name check (34.645265ms)
+✔ row 175: W6 as the tester records created_by tester; the human records the human (24.386797ms)
+✔ row 175: with bus.tester unset or not exactly true no tester binds, so no read or write runs (93.684058ms)
+✔ the tester binds only when the business sets bus.tester to exactly true (143.884787ms)
+✔ a business may not name a role tester, so the tester address is never a role (46.057785ms)
+✔ every verb outside the tester list refuses tester-refused and is recorded against the tester (78.468942ms)
+✔ a tester message is from tester, needs no prefix, and writes no human.input or authority (34.031987ms)
+✔ a tester message to a role no run holds refuses tester-target-not-running and stores nothing (22.739063ms)
+✔ a tester message is refused while the run is only launched, and routes once it claims (32.930423ms)
+✔ a human message to a role no run holds still waits and tells launch.by (27.367044ms)
+✔ a role answers a tester only in reply to a tester message, and the answer never reaches the human (51.868629ms)
+✔ the tester reads the human views a reader reads (51.131804ms)
+✔ tester proof binds its own CLI, start time and nonce, refuses a managed run and allows an agent (1.654268ms)
+✔ neither CLI's nonce proves the other: each proof is bound to its own CLI and nonce variable (0.413851ms)
+✔ testerNonce reads only the tester's variable and gives null on any read error (0.249503ms)
+✔ an envelope carries exactly one of cap, human and tester; no tester authenticator refuses (160.602238ms)
+✔ tester-cli.mjs binds through the runtime when the switch is on, and refuses off or under a run marker (1465.263389ms)
+✔ T1: the human and the reader see a held thread claim; agents still lists the role only (44.267678ms)
+✔ T2: a released or revoked thread claim is not listed, though its thread has an earlier claim row (40.566672ms)
+✔ T3: a role session refuses human-required and the tester refuses tester-refused (36.768273ms)
+✔ T4: agents answers each session the same before and after a thread run claims (37.787103ms)
+✔ T5: the result carries neither the thread name a user wrote nor a message body (37.162325ms)
+✔ T6: two held sessions of one thread list as two rows, each its session's latest claim (39.47445ms)
+✔ REQ-THREAD-1 REQ-ORG-2: the 3d→3e migration adds the thread tables and leaves messages from before threads as written (158.985439ms)
+✔ REQ-THREAD-1: a 3d bus with a changed schema is refused and keeps its version and tables (78.702437ms)
+✔ REQ-THREAD-1: the offline command prints the kept-message counts before the ready line (202.298373ms)
+✔ a share lets the sharee read the thread and nothing else: every write verb stays the owner's (mutants 7, 9) (64.415363ms)
+✔ the business human shares too, and a `*` share reaches every covered principal but the tester (43.095888ms)
+✔ mutant 2: a share never widens a grant; when the sharee's grant stops covering the thread, its reads end (47.468519ms)
+✔ mutant 3: a thread whose user owner has lost coverage is hidden from its sharees, the owner's board included (57.163073ms)
+✔ mutant 4: a share's state is its latest row, so an unshare ends it and a share after it starts it again (51.5553ms)
+✔ mutant 8: a user target needs a live grant of any level covering the thread, else share-not-covered (41.907437ms)
+✔ a viewer reads a thread shared with it, and share, unshare and shares refuse a viewer access-refused (design 4.3) (46.38994ms)
+✔ a share target is `user:<id>`, the business human or `*`, and never the sharer (78.99071ms)
+✔ a user whose collaborator grant no longer covers its own thread can't share, unshare or list its shares (40.591569ms)
+✔ the tester and a reader session never share: each verb refuses and writes nothing (64.811887ms)
+✔ the owner's trail and replies show a user's message only while that user's thread is shared with the owner (54.067422ms)
+✔ a share covers every session of the thread (36.594796ms)
+✔ a sharee can't list the thread's sessions: session.list stays owner-only (Q7, sage-2818 Q1) (36.752325ms)
+✔ only a human principal matches a share: an agent bound to the thread and the tester match none (sage-2818 Q2) (62.539485ms)
+✔ a 3l store migrates to 3m: thread_shares is new and empty, and every other row stays as it was (161.027274ms)
+✔ the 3l engine refuses a 3m store, migrating or not, and leaves it as it was (282.395287ms)
+✔ REQ-ROLE-2 REQ-THREAD-1: one holder per thread, through the broker and the trigger (72.655884ms)
+✔ REQ-ROLE-2 REQ-THREAD-1: the 3e triggers refuse writes that skip the broker (128.821645ms)
+✔ REQ-MSG-1: a message to or from the assistant names its thread, or is refused (56.035855ms)
+✔ REQ-MSG-1: the chief of staff's reply comes back to the thread that sent the work (1020.593067ms)
+✔ REQ-MSG-1: a reply can't carry one thread instance's thread to another thread instance (31.541955ms)
+✔ REQ-THREAD-1 REQ-USER-2: one thread's messages never reach another thread's holder (38.618191ms)
+✔ REQ-LAUNCH-1: a message to a thread with no holder waits, and the next holder gets it (42.882869ms)
+✔ REQ-THREAD-2 REQ-LAUNCH-1: threadIdle releases only a thread with nothing waiting, and only for its holder (45.283327ms)
+✔ REQ-THREAD-2 REQ-LAUNCH-1: a message delivered to a run that ended unread doesn't hold up the next holder (41.662736ms)
+✔ REQ-ROLE-2 REQ-THREAD-1 Q169: a role.revoke the human approved ends every thread run of the assistant (34.34011ms)
+✔ Q169 REQ-USER-2: assistant.stop ends the human's own assistant thread runs, and only the human's (51.469944ms)
+✔ REQ-USER-2: the human verbs refuse another owner's thread (40.768162ms)
+✔ REQ-THREAD-1: thread.create refuses when the business has no thread instance or more than one (35.143095ms)
+✔ REQ-ORG-2: projects and threads are named once, and the repo names a business project (34.639199ms)
+✔ REQ-THREAD-2: thread.messages returns the thread's history in pages and writes nothing (114.016022ms)
+✔ project.create refuses a repository name without its matching repo before any write (19.695579ms)
+✔ project.create keeps unrelated names with and without a repository (15.994839ms)
+✔ C2-09a: explicit creative instances bind independent threads, default sessions and holders (59.553851ms)
+✔ C2-09a: explicit missing, non-thread and malformed selectors create no thread or session (23.038313ms)
+✔ C2-09a: creative bindLaunch without a thread refuses thread-required (12.928265ms)
+✔ socket capability stamps launch identity; shared views use wire, no SQL client (77.626779ms)
+✔ two wire claims serialize; a lost reply never automatically retries (61.156074ms)
+✔ malformed, oversized and identity-forging envelopes refuse without echoing input (50.963168ms)
+✔ client preserves UTF-8 when a response divides a multibyte character (12.508267ms)
+✔ committed mutation followed by dropped reply reports unknown and is never retried (60.04484ms)
+✔ REQ-LIMIT-4 usage protocol binds run identity, requires a delivered turn and isolates businesses (44.617018ms)
+✔ REQ-LIMIT-4 3g copy migrates through 3h, 3i, 3j and 3k to 3l preserving every old column, row and sequence; new usage table is empty (150.549229ms)
+✔ REQ-PLUG-1 runtime reaches transcript only through loader, over the real bus socket (96.988582ms)
+✔ REQ-LIMIT-4 loader source records new turn kinds, excludes history and retries exactly once (27.977511ms)
+✔ REQ-LIMIT-4 cut: unknown is durable and logged next to every total (19.756692ms)
+✔ REQ-LIMIT-4 disabled: unknown is durable and logged next to every total (21.902086ms)
+✔ REQ-LIMIT-4 missing-begin: unknown is durable and logged next to every total (21.108076ms)
+✔ REQ-LIMIT-4 no-new-usage: unknown is durable and logged next to every total (18.765791ms)
+✔ REQ-LIMIT-4 rewrite: unknown is durable and logged next to every total (20.068065ms)
+✔ REQ-LIMIT-4 unfinished turn remains visibly unknown after accounting restarts (16.493563ms)
+✔ usage records are append-only (18.492434ms)
+✔ REQ-LIMIT-4 parse failure logs its safe code, never transcript content (17.284055ms)
+✔ REQ-LIMIT-4 resumed run baselines history and exact totals do not overflow (22.228049ms)
+✔ REQ-PLUG-1 core has no transcript import and disabled sources do not read any transcript (19.766622ms)
+✔ REQ-LIMIT-4 a resumed thread bills only new assistant messages to its next run (19.713459ms)
+✔ REQ-LIMIT-4 every enabled source is called; failure is unknown and a partial total stays labelled (24.803446ms)
+✔ REQ-LIMIT-4 a turn whose reported sum exceeds safe precision is unknown, not rounded (19.114756ms)
+✔ row 65 a run bound without a transcript directory records no-transcript (17.289892ms)
+✔ R3: bindUser binds a granted user and refuses one with no live grant (27.315497ms)
+✔ R3: a user named like the business human, the tester or a principal word is refused, whatever the grants say (18.779093ms)
+✔ R3: each collaborator verb is allowed to a granted user (38.845155ms)
+✔ R3: every verb off the collaborator list refuses a user access-refused before its own checks (196.792568ms)
+✔ R3: task, web and host verbs refuse a user access-refused (44.60574ms)
+✔ R3 leak: project.list shows granted projects only (25.69739ms)
+✔ R3 leak: thread.create needs the project and the thread instance granted, and an ungranted id reads as one that does not exist (33.120437ms)
+✔ R3 leak: thread.list shows the user its own threads that are still granted, never others (59.447316ms)
+✔ R3 leak: names shows granted instances only (25.01142ms)
+✔ R3: thread.send is from user:<id> and writes no human.input (24.617485ms)
+✔ R3: a reply-chain message.send into another user thread is refused (25.79303ms)
+✔ R3: the run reply to a user message reaches that user thread.messages, with no waiting and no notice (28.555082ms)
+✔ R3: a reply to: user without a matching in_reply_to is refused user-reply-required (45.880448ms)
+✔ R3: a non-thread run, the human and the tester cannot send to: user (27.263622ms)
+✔ R3: a user thread run cannot message the owner, while its uncited gated raise reaches only the owner inbox, B9 (29.236575ms)
+✔ R3: a removed or expired grant refuses the next request access-revoked, and the file is read per request (31.447009ms)
+✔ R3: a user refusal is recorded as action.refused by user:<id> (23.020412ms)
+✔ R3: a business with a role keyed user refuses invalid-business (17.016266ms)
+✔ R3: name.set refuses the name user (15.930887ms)
+✔ R3 r4: while halted, a granted user's thread.send refuses processing-halted and thread.messages still answers (20.862915ms)
+✔ R3 r4: the chief's hire refuses an instance named user with the code it gives human and tester (22.825012ms)
+✔ R3 r4: a non-function access throws before the store is read (0.18962ms)
+✔ C2-09a: naming an instance cannot bypass its collaborator grant or disclose an ungranted project (26.220653ms)
+✔ 264e deferred B6: a reply cannot cite the same user in a sibling session (26.700486ms)
+✔ 275: VIEWER_VERBS is the ruled read list, inside USER_VERBS (1.46025ms)
+✔ 275: a viewer binds, and each viewer verb answers with what its grant covers (46.653034ms)
+✔ 275: a viewer is refused thread.create, thread.open and thread.send access-refused, and nothing is stored (41.302666ms)
+✔ 275: every verb off the user list refuses a viewer access-refused before its own checks (178.926634ms)
+✔ 275: mixed grants, collaborator on one project and viewer on another, take the level per project (36.923032ms)
+✔ 275: board reads refuse users and viewers access-refused (122.848657ms)
+✔ governance pin, user side: decisions, inbox entries, claims, tasks and project files are the owner's, the user reads its messages (66.967277ms)
+✔ web.search: a granted role gets labelled results, and the call is trailed with role, run, verb and query (39.215869ms)
+✔ web.fetch: a granted role gets the page as labelled text, and the call is trailed with the url (34.544677ms)
+✔ a role without the grant is refused, the refusal is logged with the verb, and nothing is fetched (33.406042ms)
+✔ a broker with no web service refuses a granted role (27.903886ms)
+✔ bad requests are refused: unknown verb, extra or missing argument, not a string, a human or reader session (32.047773ms)
+✔ a session that is not the role holder is refused (20.459482ms)
+✔ web.mjs's fences hold on the broker side: refusals are normal results with the fixed reason (65.29236ms)
+✔ web.search with no search source configured is a refused result, not an error (23.834341ms)
+✔ a search source that fails with its own refusal, or that throws, is handled (28.957479ms)
+✔ a slow search source ends in a refusal at the deadline (73.869834ms)
+✔ a secret in the arguments is refused before anything is trailed or fetched (20.99305ms)
+✔ over the socket: the server routes web verbs to the service; other roles are refused; no service is web-not-configured (96.530115ms)
+✔ busBusiness: the web grant comes from "web" in the resolved tool limit (0.390394ms)
+✔ webServices: the business's search-source plug-in and web.searxng var make web.search work; without either it is refused as not configured (64.275782ms)
+✔ an ungranted call is refused at once: no admission, no wait, nothing touched (26.89133ms)
+✔ over the socket an ungranted caller is dropped by the server timeout and a granted one gets the longer wait (354.562734ms)
+✔ a search that never answers is aborted at the deadline, the module sees the signal, and the call is trailed as refused (timeout) (82.493809ms)
+✔ a fetch that stalls is cut off at the deadline: the request is destroyed, not left running (99.023903ms)
+✔ one query limit: over SEARCH_MAX_QUERY_CHARS or empty is refused with the same reason before any backend, and the tool schema carries the same number (23.244048ms)
+✔ merge-gate's technical raise is cross-role, goes to the cto, and only merge-gate can use the approval (66.631082ms)
+✔ merge-gate has no message.send, and without a domain its raise goes to the delivery arbiter (44.588335ms)
+✔ the cto must be able to message merge-gate, or the technical raise is refused (row 133) (40.290897ms)
+✔ security-reviewer answers a review with its verdict alone; it holds no message.send (50.891802ms)
+ℹ tests 963
+ℹ suites 0
+ℹ pass 963
+ℹ fail 0
+ℹ cancelled 0
+ℹ skipped 0
+ℹ todo 0
+ℹ duration_ms 24078.693629
diff --git a/agents/rockerduck/work/queue-286/gate-library.txt b/agents/rockerduck/work/queue-286/gate-library.txt
new file mode 100644
index 000000000..31d916f6c
--- /dev/null
+++ b/agents/rockerduck/work/queue-286/gate-library.txt
@@ -0,0 +1,149 @@
+✔ the same commit, repo path and mapping return the same index, and only mapped files are in it (38.910506ms)
+✔ a different repo path, mapping or commit gets its own index (58.789692ms)
+✔ the cache holds at most eight indexes and evicts the least recently used (78.224098ms)
+✔ a failed read is not kept in the cache (15.140975ms)
+✔ a missing or unchecked mapping is refused before any read (12.020832ms)
+✔ a 3,000-file rebuild completes and its time is reported (2900.628078ms)
+ℹ 3,000-file index rebuild: 2680 ms
+✔ resolver step 1: a path from the repo root, with or without .md (1.1254ms)
+✔ resolver step 2: the same path with vaultPrefix/ stripped (0.211505ms)
+✔ resolver step 3: a path relative to the linking file, never above the repo root (0.200699ms)
+✔ resolver step 4: a base name that matches exactly one indexed file (0.260396ms)
+✔ a link into another of her repos resolves to nothing (0.191988ms)
+✔ wikilink forms, embeds, and links skipped inside code (1.098741ms)
+✔ only a body embed whose target has an extension other than .md, in any case, is an attachment (0.349473ms)
+✔ the fixture mapping checks and comes back frozen (2.412937ms)
+✔ C2-01c: a prefix inside or holding another entry's book refuses library-playground-other-universe (1.155505ms)
+✔ C2-01c: a prefix equal to a book folder, or holding its own, refuses library-mapping-invalid (0.650366ms)
+✔ C2-01c: universe-level prefixes lie outside every book, in a plain universe and in a hybrid with no books (0.710421ms)
+✔ C2-01c: a draft takes kind, name and playground only, and comes back frozen with books [] (1.484212ms)
+✔ C2-01d: supporting prefixes at book level, universe level, in a hybrid and in a draft, [] when absent (0.537029ms)
+✔ C2-01d: each supporting prefix rule refuses with its code (1.971647ms)
+✔ C2-01d: between the lists, a supporting prefix may equal its own playground, and a playground may hold its own supporting (0.392589ms)
+✔ C2-01d: editor is optional, kept when given, and refuses anything but a plain name and email (5.280718ms)
+✔ C2-01d: an accepted editor round-trips through a real git commit unchanged (15.73724ms)
+✔ no playground prefix holds another, and no book folder holds another (0.934567ms)
+✔ shape refusals: kind, remote, branch, unknown keys, types, manuscript, folder names (1.116891ms)
+✔ C2-03a sage-2021: user is optional, kept when given, and must be a plain account name (0.777602ms)
+✔ a hybrid universe is a shape the query code can take (1.4), with sources that must exist (1.069424ms)
+✔ a caller-supplied fail receives the code, as business file loading will pass it (C2-04) (0.375805ms)
+✔ scope comes from the path alone (design 1.2) (0.696744ms)
+✔ C2-04 mirror: exact default path, bare without checkout or remote, and idempotent initialization (59.246676ms)
+✔ C2-04 mirror: simultaneous creators publish one intact mirror and leave no staging paths (42.751841ms)
+✔ C2-04 mirror: skipped publication accepts both coreutils statuses without removing the winner (137.796639ms)
+✔ C2-04 mirror: preserve occupied directories and reject symlink ancestors and code overlaps (16.53077ms)
+✔ C2-04 mirror: existing metadata accepts only bare Git plus state and the precreated lock (29.399708ms)
+✔ C2-04 state: missing state is empty only while the served ref is absent (51.916373ms)
+✔ C2-04 state: valid problems and sync metadata return no content and change no state bytes (46.274776ms)
+✔ C2-04 state: strict keys, types, times, branch, commit and fixed R messages fail closed (131.367058ms)
+✔ C2-04 state: symlink, hardlink, non-private state and missing lock refuse without replacement (37.826957ms)
+✔ C2-04 file: served commit, not HEAD or a caller commit, owns the exact returned text (84.427946ms)
+✔ C2-04 file: R1, R2 and R7 exclusions and never-synced mirrors cannot return file bodies (100.550125ms)
+✔ C2-04 lock: a first-sync and fast-forward reader wait for a consistent pair across processes (258.847103ms)
+✔ C2-04 lock: same-process waits, timeout code, callback expiry and throw release (5032.288443ms)
+✔ C2-04 lock: owner death releases the kernel lock without replacing its file (54.703792ms)
+✔ C2-04 lock: a missing flock binary becomes a handled refusal (50.127819ms)
+✔ C2-04 lock: an unawaited scoped read drains before the lock is released (19.957011ms)
+✔ the query reply cap equals the harness reply cap (1.19734ms)
+✔ find is bound to its universe and refuses a call without one (53.893139ms)
+✔ every result carries its scope, and playground appears only when asked for (32.313169ms)
+✔ unmapped files never appear in any reply (27.837074ms)
+✔ a hybrid sees its sources canon, minus exclusions, and no playground (30.347014ms)
+✔ a hybrid gets a source file it can see, and not an excluded or foreign one (41.713814ms)
+✔ get lists visible links both ways and drops a target another universe cannot see (41.538976ms)
+✔ a long list pages by position, never cuts an item, and returns 50 per page (162.791386ms)
+✔ a page stays under the reply cap when items are large (78.463045ms)
+✔ a search line too long to fit alone comes back marked, with no excerpt, and the other hits still return (29.164591ms)
+✔ a find item that cannot fit alone is refused, not cut (28.322729ms)
+✔ get pages its lines, and the next line picks up where the page stopped (30.368574ms)
+✔ get refuses a file whose front matter alone is over the cap, and a line alone is over the cap (28.128026ms)
+✔ get pages the links of a hub note, every page carries the front matter, and the pages add up (869.902906ms)
+✔ get rejects a bad links_from (35.196585ms)
+✔ search returns scoped line hits, case-insensitively, and refuses empty text (28.459891ms)
+✔ a manuscript call returns one chapter, at most 400 lines, and names its next line (46.946258ms)
+✔ a manuscript call without a chapter returns the first chapter in path order and names the next (26.573024ms)
+✔ a chapter name that matches two visible files is refused (24.016997ms)
+✔ a hybrid reads a source chapter through its declared sources only (35.070966ms)
+✔ universe info reports a hybrid sources, constraints and notes, and refuses an unknown universe (13.168062ms)
+✔ an exclusion hides what it names from a hybrid and from nothing else (36.359286ms)
+✔ PRD 1.14: a lookup that names a book leaves book-null files out (30.463487ms)
+✔ PRD 1.14: library_manuscript never reads a book-null file (29.534997ms)
+✔ PRD 1.14: a draft universe has no canon, so its lookups return files only with scope playground (29.89583ms)
+✔ PRD 1.14: library_universe on a draft returns its kind, name and prefixes (14.363564ms)
+✔ a hybrid gets a source playground file as null, while the source gets it with scope playground (37.6646ms)
+✔ the fixture reads clean: every resolver step, appears_in and relationships wikilinks indexed (48.455238ms)
+✔ R1: executables, symlinks, gitlinks, blobs over 1 MiB and non-UTF-8 text are not indexed (76.694953ms)
+✔ R2: unmapped paths are reported and not indexed (26.809308ms)
+✔ R3: front matter not fully parsed stays raw, with the line where parsing stopped (31.113448ms)
+✔ front matter forms the reader accepts and refuses (0.475374ms)
+✔ R4: a link to no file, to more than one, or into another repo is reported and not followed (29.384746ms)
+✔ a block list link carries its item line, a scalar or flow link its key line, and problems follow (28.900438ms)
+✔ an unresolved attachment embed gives no problem; a link or front matter value to one is R4; a note embed resolves (29.126382ms)
+✔ an indexed Dr.Quinn.md resolves as a body link, a block list link and an embed (29.274318ms)
+✔ R5: a canon file that refers into the playground is reported, and the link still goes by path (29.580541ms)
+✔ R6: a canon file that refers into another universe is reported; a hybrid may refer into its sources (24.571442ms)
+✔ R7: two paths that differ only in case are both left out (31.165932ms)
+✔ the reader reads the commit, never the working tree, and refuses a bad commit id (28.951224ms)
+✔ a bare mirror reads the same as the clone (46.972003ms)
+✔ renderItems snapshot: fact (1.417516ms)
+✔ renderItems snapshot: finding (0.276536ms)
+✔ renderItems snapshot: correction (0.22018ms)
+✔ renderItems snapshot: question (0.181125ms)
+✔ renderItems snapshot: idea (0.204383ms)
+✔ renderItems numbers several items and takes a parsed body as well as a string (1.006969ms)
+✔ without options a path cite has no badge and is never marked changed (0.236544ms)
+✔ renderItems snapshot: notice no-cited-answer (0.194799ms)
+✔ renderItems snapshot: notice no-answer (0.230859ms)
+✔ renderItems snapshot: notice turn-failed (0.2386ms)
+✔ a body without the reply shape shows a fixed line and none of its text (0.636756ms)
+✔ C2-01c: each level gives its universe, and its book or null (3.423205ms)
+✔ C2-01c: prefixes come first: in a book that holds a prefix, a file outside it is canon and one under it playground (0.57979ms)
+✔ C2-01c: a canon file linking into a draft gives R6, and into its own universe-level prefix gives R5 (50.419041ms)
+✔ C2-01d: each supporting level gives its universe, and its book or null (0.8375ms)
+✔ C2-01d: supporting comes before playground; a folder in both lists is supporting, one in the playground only stays playground (0.479654ms)
+✔ C2-01d: only .md files are supporting; a .canvas or .base under a supporting prefix is unmapped (0.290969ms)
+✔ C2-01d: a path passes at book level, universe level, in a draft and in a folder in both lists (2.074148ms)
+✔ C2-01d: a path of exactly 1024 bytes passes, and 1025 bytes made of multi-byte characters refuses (0.982879ms)
+✔ C2-01d: a path outside the universe's supporting folders refuses (0.71389ms)
+✔ C2-01d: malformed paths refuse by class, in order (0.646566ms)
+✔ C2-01d: a symlink or gitlink on the way, or at the path itself, refuses (0.31072ms)
+✔ C2-01d: a name that differs from a tree name only in case or Unicode form refuses, at the file or any folder (1.011818ms)
+✔ the survey prints folder names, counts, key sets and link-form counts, and never text (49.619419ms)
+✔ folder names print DEL, C1 and bidi controls, U+061C among them, as escapes (26.757812ms)
+✔ an embed of an attachment counts as an embed and as an attachment; a plain link to one does not (19.118043ms)
+✔ with --mapping the survey adds scope, resolver step and problem counts (41.583182ms)
+✔ C2-01d: with --mapping the survey counts supporting files (37.584205ms)
+✔ survey exit codes: usage 4, bad mapping 3, unreadable repo 2 (15.886586ms)
+✔ scripts/mosaic library survey reaches the survey (98.91682ms)
+✔ C2-03a argv: the fixed sequence, one https allow, no other protocol key (2.475406ms)
+✔ C2-03a argv: only an https URL with a plain host, no userinfo, and a plain user (0.920886ms)
+✔ C2-03a helper: answers only the exact prompts for the configured host and user (dewey-0765) (40.63027ms)
+✔ C2-03a first sync: served is the fetched tip, HEAD is served, the survey reads it, and the token stays in the slot (164.393615ms)
+✔ C2-03a fast-forward: served moves, problems are rebuilt, and a repeat changes only lastFetch (242.672377ms)
+✔ C2-03a Filbert N2: a read that took served before a sync still finds its objects after served moves (201.409814ms)
+✔ C2-03a overlap: a reader during a sync sees the old pair or the new one, never a mix (182.181215ms)
+✔ C2-03a diverged: a non-fast-forward keeps serving and holds until a human accepts the tip (414.515618ms)
+✔ C2-03a accept starts the record over, so a changed branch gets a fresh state (174.335397ms)
+✔ C2-03a fetch failure: a wrong token keeps serving and records the error, lastFetch unchanged (200.468866ms)
+✔ C2-03a a failed first fetch records the error with nothing served (60.013342ms)
+✔ C2-03a a 302 to another host fails the fetch and the other host sees nothing (63.037701ms)
+✔ C2-03a the slot: missing or unsafe refuses before git, and sync never opens it (59.780442ms)
+✔ C2-03a sage-2021: an entry with no user refuses library-remote-invalid and runs no git (31.991782ms)
+✔ C2-03a one sync per mirror: an overlapping call refuses library-sync-busy (127.65035ms)
+✔ C2-03b argv: a push sends one full commit to the branch, fast-forward only, with the fetch prefix (0.498418ms)
+✔ C2-03b T1 push: a fast-forward lands with the seat's own user and file, and moves no local ref (123.563433ms)
+✔ C2-03b T2 and T3: a moved tip reports the race after one fetch, and a second race refuses stale-base (201.045487ms)
+✔ C2-03b race fetch: while a sync of the mirror runs, the race refuses library-sync-busy (217.586092ms)
+✔ C2-03b T4: a dead remote, a hook refusal and a wrong token each refuse library-push-failed (150.972736ms)
+✔ C2-03b push: a refused, missing or unsafe credential runs no git (91.830589ms)
+✔ C2-03b T10 humanCredential: her login and a 0600 slot library-human, or library-human-missing (0.868836ms)
+✔ C2-03b fetch credential: the state names the kind and user, a refusal runs no git, and a pre-286 state still reads (134.468925ms)
+✔ C2-03b T5 helper: the named seat's user and file, never a link, 0644, another uid, or a swapped file (27.628362ms)
+ℹ tests 140
+ℹ suites 0
+ℹ pass 140
+ℹ fail 0
+ℹ cancelled 0
+ℹ skipped 0
+ℹ todo 0
+ℹ duration_ms 6220.993116
diff --git a/agents/rockerduck/work/queue-286/mutant-M1.txt b/agents/rockerduck/work/queue-286/mutant-M1.txt
new file mode 100644
index 000000000..fbfcbd7e2
--- /dev/null
+++ b/agents/rockerduck/work/queue-286/mutant-M1.txt
@@ -0,0 +1,6 @@
+FAIL C2-03b argv: a push sends one full commit to the branch, fast-forward only, with the fetch prefix ERR_TEST_FAILURE
+    at TestContext.<anonymous> (file:///home/jwoltje/.t3/worktrees/mosaic-stack/rockerduck-row286-r3/packages/library/tests/sync.test.mjs:331:10)
+FAIL C2-03b T2 and T3: a moved tip reports the race after one fetch, and a second race refuses stale-base ERR_TEST_FAILURE
+    at TestContext.<anonymous> (file:///home/jwoltje/.t3/worktrees/mosaic-stack/rockerduck-row286-r3/packages/library/tests/sync.test.mjs:365:10)
+SUMMARY {"tests":2,"failed":2,"passed":0,"cancelled":0,"skipped":0,"todo":0,"topLevel":2,"suites":0}
+SUMMARY {"tests":2,"failed":2,"passed":0,"cancelled":0,"skipped":0,"todo":0,"topLevel":2,"suites":0}
diff --git a/agents/rockerduck/work/queue-286/mutant-M2.txt b/agents/rockerduck/work/queue-286/mutant-M2.txt
new file mode 100644
index 000000000..46e127c17
--- /dev/null
+++ b/agents/rockerduck/work/queue-286/mutant-M2.txt
@@ -0,0 +1,5 @@
+FAIL C2-03b T5 helper: the named seat's user and file, never a link, 0644, another uid, or a swapped file ERR_TEST_FAILURE
+    at refused (file:///home/jwoltje/.t3/worktrees/mosaic-stack/rockerduck-row286-r3/packages/library/tests/sync.test.mjs:510:40)
+    at TestContext.<anonymous> (file:///home/jwoltje/.t3/worktrees/mosaic-stack/rockerduck-row286-r3/packages/library/tests/sync.test.mjs:526:3)
+SUMMARY {"tests":1,"failed":1,"passed":0,"cancelled":0,"skipped":0,"todo":0,"topLevel":1,"suites":0}
+SUMMARY {"tests":1,"failed":1,"passed":0,"cancelled":0,"skipped":0,"todo":0,"topLevel":1,"suites":0}
diff --git a/agents/rockerduck/work/queue-286/token-search.txt b/agents/rockerduck/work/queue-286/token-search.txt
new file mode 100644
index 000000000..8caed7ee8
--- /dev/null
+++ b/agents/rockerduck/work/queue-286/token-search.txt
@@ -0,0 +1,12 @@
+Fixture exact values checked: 6
+M1.log: exact=0, pattern=0
+M2.log: exact=0, pattern=0
+bus-final.log: exact=0, pattern=0
+bus.log: exact=0, pattern=0
+credential-rerun.log: exact=0, pattern=0
+credential-rerun2.log: exact=0, pattern=0
+credential-rerun3.log: exact=0, pattern=0
+credential-rerun4.log: exact=0, pattern=0
+credential-t9.log: exact=0, pattern=0
+library-final.log: exact=0, pattern=0
+library.log: exact=0, pattern=0
diff --git a/docs/SESSIONS.md b/docs/SESSIONS.md
index 812464940..00265b62a 100644
--- a/docs/SESSIONS.md
+++ b/docs/SESSIONS.md
@@ -1628,3 +1628,5 @@ are never rewritten or removed; corrections are new entries.
 2026-10-24T07:18:53Z | Sage (1ef1e4f8) | Row 327 / #1825 push guard landed (mos-1572 option A, mos-1575) | Gate went red 06:57Z on an empty canonical node_modules (Glomgold's webui npm ci through a link to canonical, glomgold-0011); rerun with its own npm ci GREEN 07:15:49Z on 1bd214e38; pushed 68c08b4e7 07:18:03Z; #1825 closed c31530; canonical restored (128 packages); brief template rule 4db23a51f | landed
 
 - 2026-10-24 — rockerduck (Codex, a403aa78-b550-4bab-a613-7ea3fd75ec79), row 286 C2-03b / #1791 r3: twelve-commit transplant and static drift evidence prepared; UNTESTED, awaiting Sage CLEAR after own-branch push; no npm/tests run.
+
+- 2026-10-24 — rockerduck (Codex, a403aa78-b550-4bab-a613-7ea3fd75ec79), row 286 / #1791 r3 CLEAR gate: library 140/140, bus 963/963, both mutants killed/restored, gate-output fixture matches zero; new-test setup fixes only; candidate prepared for Boyd review and Sage landing.
diff --git a/packages/bus/tests/library-credential.test.mjs b/packages/bus/tests/library-credential.test.mjs
index 51b90ab96..ec7ac445a 100644
--- a/packages/bus/tests/library-credential.test.mjs
+++ b/packages/bus/tests/library-credential.test.mjs
@@ -76,7 +76,7 @@ function world(t, options) {
 // The business for the real paths. `boss` is launch.by: instance.fire is the launch.by role's verb and
 // refuses its own name (organization-instance-referenced), so the fired chief is the one listed
 // chief-of-staff instance, fired by boss. The grant targets project app; books is the library.
-function verbDoc(url) {
+function verbDoc(url, root) {
   return {
     id: 'acme', human: 'jason', arbiters: { technical: 'boss', delivery: 'boss' },
     roles: {
@@ -89,7 +89,8 @@ function verbDoc(url) {
       pm: { roleVersion: 2, credentials: [] },
       coder: { roleVersion: 2, credentials: [] },
     },
-    projects: { app: { remote: `${url}/acme/app` }, books: { ...mappingEntry(), user: 'books-bot' } },
+    // sage-4054 / mos-1272: runtime validates every code project's absolute checkout root.
+    projects: { app: { root: join(root, 'app-checkout'), remote: `${url}/acme/app` }, books: { ...mappingEntry(), user: 'books-bot' } },
     launch: { by: 'boss', instances: ['chief', 'coder'] },
   };
 }
@@ -112,7 +113,7 @@ async function verbWorld(t, opts = {}) {
   const dataRoot = opts.dataRoot ?? join(dir, 'data');
   mkdirSync(dataRoot, { recursive: true, mode: 0o700 });
   const storeRoot = opts.storeRoot ?? join(dir, 'secrets', 'agents');
-  const doc = opts.doc ?? verbDoc(gitea.url);
+  const doc = opts.doc ?? verbDoc(gitea.url, dir);
   const store = new Store(dataRoot);
   const references = {};
   const { held } = giteaStart(store, storeRoot, { acme: doc }, references);
@@ -142,12 +143,15 @@ async function verbWorld(t, opts = {}) {
   });
   const boss = broker.bindLaunch({ business: 'acme', role: 'boss', run: 'boss-run', harness: 'pi', address: 'boss' });
   broker.request(boss, { verb: 'role.claim' });
+  // sage-4054 / mos-1272: grant raises require the chief definition, independent of launch.by's fire authority.
+  const chief = broker.bindLaunch({ business: 'acme', role: 'chief', run: 'chief-run', harness: 'pi', address: 'chief' });
+  broker.request(chief, { verb: 'role.claim' });
   const human = broker.bindHuman({ business: 'acme', human: 'jason', via: 'cli', outsideAgent: true });
   const events = () => store.all(`SELECT body FROM events WHERE business='acme' AND ${GRANT_EVIDENCE} ORDER BY seq`).map((e) => JSON.parse(e.body));
   const ended = (id) => events().findLast((e) => e.grantDecision === id && ['grant.applied', 'grant.failed'].includes(e.action));
   const row = () => store.get("SELECT 1 FROM gitea_grants WHERE business='acme' AND agent='chief'");
   const approveChief = async () => {
-    const d = await broker.request(boss, {
+    const d = await broker.request(chief, {
       verb: 'decision.raise',
       args: {
         action: 'credential.mint', question: 'Grant chief Gitea?', options, recommendation: 'yes', blocking: false,
@@ -172,7 +176,12 @@ async function verbWorld(t, opts = {}) {
     await broker.grantsIdle();
     assert.equal(row(), undefined, 'the fire\'s step G deleted the row (row 281)');
   };
-  return { gitea, doc, store, broker, storeRoot, row, approveChief, revoke, fire, close, choose: () => broker.libraryFetchCredential('acme') };
+  // sage-4054 / mos-1272: a second fixture broker on this store needs the previous runs released.
+  const release = () => {
+    broker.request(chief, { verb: 'role.release' });
+    broker.request(boss, { verb: 'role.release' });
+  };
+  return { gitea, doc, store, broker, storeRoot, row, approveChief, revoke, fire, close, release, choose: () => broker.libraryFetchCredential('acme') };
 }
 
 const REFUSED = { refused: 'library-fetch-no-grant', fix: LIBRARY_FETCH_FIX };
@@ -212,6 +221,8 @@ test('C2-03b T7 choice checks: delisted, a fire under way and held each refuse;
   grant(delisted.store, 'chief');
   assert.deepEqual(delisted.choose(), REFUSED, 'delisted with the row still there');
   delisted.business.launch.instances.push('chief');
+  // sage-4054 / mos-1272: Broker clones input; publish the fixture's organization change.
+  delisted.broker.reloadBusiness('acme', delisted.business);
   assert.deepEqual(delisted.choose(), { kind: 'chief', agent: 'chief', user: 'chief-bot' }, 'a rehire lists it again');
   delisted.store.run("INSERT INTO events(id,at,business,kind,actor_role,actor_run,subject,body) VALUES('f1',?,?,'action.allowed','chief','run','chief',?)",
     AT, 'acme', JSON.stringify({ action: 'fire.stopped' }));
@@ -231,8 +242,10 @@ test('C2-03b T8: a chief grant on another project ends the fallback, and two lis
   grant(two.store, 'chief');
   assert.deepEqual(two.choose(), { kind: 'chief', agent: 'chief', user: 'chief-bot' });
   two.business.roles.second = { definition: 'chief-of-staff', ...role };
+  two.broker.reloadBusiness('acme', two.business); // sage-4054 / mos-1272: publish the fixture change
   assert.deepEqual(two.choose(), REFUSED, 'two chief-of-staff entries, both listed: one chief only');
   two.business.launch = { instances: ['coder'] };
+  two.broker.reloadBusiness('acme', two.business); // sage-4054 / mos-1272
   assert.deepEqual(two.choose(), REFUSED, 'neither listed');
 });
 
@@ -263,6 +276,7 @@ test('C2-03b T9 runtime: the chief\'s store file and user, then a real revoke th
   writeFileSync(slot, SLOT_TOKEN + '\n', { mode: 0o600 });
   const granted = await verbWorld(t, { dataRoot, storeRoot });
   await granted.approveChief();
+  granted.release();
   granted.close();
   const gitea = granted.gitea;
   const chiefFile = join(storeRoot, 'acme', 'chief', 'gitea');
@@ -275,12 +289,14 @@ test('C2-03b T9 runtime: the chief\'s store file and user, then a real revoke th
     return write.call(this, chunk, ...rest);
   };
   t.after(() => { process.stderr.write = write; });
-  const start = () => startBroker({ dataRoot, businesses: { acme: verbDoc(gitea.url) }, organization: { dir: root, rolesDir, system: systemFor(root) },
+  const start = () => startBroker({ dataRoot, businesses: { acme: verbDoc(gitea.url, root) }, organization: { dir: root, rolesDir, system: systemFor(root) },
     librarySync: { command, intervalMs: 50 } });
   const untilAsync = async (fn) => { const end = Date.now() + 10000; while (!fn() && Date.now() < end) await sleep(10); };
 
   let runtime = await start();
-  await untilAsync(() => calls.length >= 1);
+  t.after(async () => { await runtime.close(); }); // sage-4054 / mos-1272: close even on assertion failure
+  // sage-4054 / mos-1272: command construction precedes publication; wait for the completed sync log.
+  await untilAsync(() => lines.length >= 1);
   const human = runtime.broker.bindHuman({ business: 'acme', human: 'jason', via: 'cli', outsideAgent: true });
   await runtime.broker.request(human, { verb: 'library.sync', args: { project: 'books' } }).catch(e => e);
   // webby-0151 R3: library.status names the kind and user of the last fetch, never the file or value.
@@ -294,6 +310,7 @@ test('C2-03b T9 runtime: the chief\'s store file and user, then a real revoke th
   // Revoked through grants.revoke: the next start refuses before git, and the log names the fix.
   const revoking = await verbWorld(t, { dataRoot, storeRoot, gitea });
   await revoking.revoke();
+  revoking.release();
   revoking.close();
   chmodSync(slot, 0o000);
   calls.length = 0; lines.length = 0;
@@ -310,7 +327,7 @@ test('C2-03b T9 runtime: the chief\'s store file and user, then a real revoke th
   assert.deepEqual(JSON.parse(lines[0].slice('library: '.length)),
     { event: 'library-sync-held', business: 'acme', project: 'books', code: 'library-fetch-no-grant', fix: LIBRARY_FETCH_FIX });
   for (const line of lines) assert.equal(tokens().some(tok => line.includes(tok)), false);
-  const mirror = library.mirrorPath({ business: verbDoc(gitea.url), project: 'books', dataRoot });
+  const mirror = library.mirrorPath({ business: verbDoc(gitea.url, root), project: 'books', dataRoot });
   const state = await library.readSyncState(mirror, { branch: 'main' });
   assert.equal(state.lastError.code, 'library-fetch-no-grant');
   assert.equal(state.credential, null);