deferred: the host pi auth file entry (059577886) moves to Done with row 244 (e69260a3c); real-model suite cases run outside the gate is open (Webby N2 on row 244 r1, #1757)

docs/plans/DEFERRED.md

@@ -270,20 +270,6 @@ at every gate. Started 2026-09-12 during the control board MVP.
   (`:1538`, `:1689`, `:1691`). For a later row that edits
   `stack-release.sh`. Webby N1 on row 238 r1 (REVIEW-r1.md, 433a95292,
   #1744). (2026-10-21)
-- **Gate runs mount the host's pi auth file.** `compose.yaml:43` mounts
-  `${PI_AUTH_FILE:-/home/jwoltje/.pi/agent/auth.json}` read-only into
-  the agent container. No suite sets `PI_AUTH_FILE`, so the
-  `test-task.sh` cases that call `scripts/run-task.sh`, and
-  `test-release.sh` through `release.sh` `health_check` (`:41-54`), run
-  Compose with the host file. Row 197's lane `cleanEnv`
-  (`scripts/testing/gate-lane.mjs:109`) keeps the default too: it neither
-  sets nor passes `PI_AUTH_FILE`. The mount is read-only, and the legacy
-  gate already worked this way before row 197. `test-auth.sh` uses its
-  own fixtures but calls `auth.sh`, not Compose. The fix: a fixture
-  `PI_AUTH_FILE` for the Compose-reaching cases, set by the suites or by
-  the lane's `cleanEnv`, and a test that no gate step mounts the host
-  default. It needs its own row. Webby N4 on the row 197 proof driver
-  (bba870ee9), traced by Herb (herb-0051). (2026-10-21)
 - **Lane image prep inspects a base that BuildKit never tagged.**
   (N7 of the row 197 proof.) After the Compose build,
   `scripts/testing/lane-image.mjs:41` (`prepareImage`) runs
@@ -376,6 +362,16 @@ at every gate. Started 2026-09-12 during the control board MVP.
   planted process would survive and the "planted process killed" assert
   would fail. This binds the next row that touches
   `packages/bus/tests/host-run.test.mjs`. (2026-10-21)
+- **Real-model suite cases run outside the gate.** Row 244 moved
+  `test-task.sh` fork recall (M11) and user recall (M16) behind
+  `MOSAIC_LIVE_PROVIDER=1`, and `test-release.sh` activations to the mock
+  adapter. Before any re-pin whose tree changes `packages/harness` or the
+  session fork code (`scripts/mosaic-task.mjs` session and
+  `sessionForkFrom` handling, the pi adapter), an operator runs
+  `MOSAIC_LIVE_PROVIDER=1 bash scripts/test-task.sh` with the real pi
+  credential and a real `release.sh activate`, and records both results on
+  the re-pin row. Morgana's wording (row 244 BUILD.md), Webby N2 on row 244
+  r1 (#1757). (2026-10-21)
 
 ## Queue
 
@@ -441,3 +437,10 @@ Moved to `docs/plans/QUEUE.md` on 2026-09-13. This file holds only gaps.
     at a time (Filbert F2; Darkwing and Filbert T1 on #1522;
     flows.test.mjs).
   The frozen-cgroup test (Filbert F1) stays open above.
+- Gate runs mount the host's pi auth file (Webby N4 on the row 197 proof
+  driver, 059577886): closed by row 244 (#1757), landing e69260a3c. The
+  suites and the lane's `cleanEnv` export a 0600 fixture `PI_AUTH_FILE`,
+  `guardDocker` refuses a Compose run without one, and
+  `packages/cli/tests/gate-lane-auth.test.mjs` proves no gate step mounts
+  the host default. The real-model cases this moved off the gate are open
+  above.