webby: row 194 b14 carry check, row 278 design look, and session line

agents/webby/work/queue-194/REVIEW-b8.md

@@ -229,3 +229,13 @@ Git reads only. No tests have run yet.
 - The drift 0f8235277..0fa7bf421 covers 14 files. The only one 194 also touches is packages/webui/src/public/index.html. 191 changes lines 14 and 20-22, and 194 changes line 7 (adds agents.js to the script line), so the hunks are separate.
 - Tests that read index.html: agents.test (in 194, row 194 N5 at :214), processing-ui.test:66 and shell.test:40. None of them pins the script list. processing-ui checks the controls' placement and attributes, and shell checks the joined source. stack-release.sh drift is read only by the cli stack-* tests, and 194 touches none of those.
 - My run list stays at 24 files. processing-ui, processing-browser and shell are already in it since b10. Runs go on 7609210a3 at Sage's CLEAR, after Honker's runb8.
+
+## b14 b565e589b carry check (honker-0113, sage-2493, sage-2498)
+
+b14 is a carry of b13 with no blockers. These are git reads only. I did no runs, because the slot is Honker's.
+- 14 commits on refactor 23c3d6218.
+- range-diff 0fa7bf421..7609210a3 against 23c3d6218..b565e589b shows 14 of 14 `=`.
+- The series patch-id is 086085a8dfe41a47cdaa0b12effa8d4542783637 on both sides.
+- The path list is identical.
+- The drift 0fa7bf421..23c3d6218 (205 and 268, 24 files) meets 194 at two paths, broker.mjs and business.test.mjs. For both files, the +/- lines of 194's own diff are identical on the old and new bases. So 194's hunks are unchanged, and git applied them without touching 205's or 268's lines.
+- Whether the merged files run together is a matter for Honker's runs on b14, which Sage is gating.

agents/webby/work/queue-278/REVIEW-design.md

@@ -0,0 +1,44 @@
+# Row 278 (#1783) design note review, gander-0087
+
+The brief is in docs/plans/2026-10-22_owner-thread-claims.md, in the section "Brief: the Console shows thread claims". I read the code at refactor 23c3d6218. This is a design look only. No code exists yet, and the row chains on 277.
+
+Gander's shape is the right one, and I accept it. The role section stays as is, and a separate table shows four fields: thread id, holder_run, harness and at. It doesn't use the s1-agents selector, empty shows an empty-state line, and the adapter is Console-owned. There are two required changes before code and one note.
+
+## R1. The local catch must keep 403 local
+
+There are two problems in the code today.
+- bus.js:1028 defines `refusal` as a 403 or one of not-configured, no-bus-host or queue-refused.
+- The existing local-catch idiom (bus.js:815-822) rethrows `err.status === 403`. A rethrow reaches the page handler at :1134-1139. For a refusal, that handler renders failedView and calls forget(), so the role rows are lost.
+
+If 278 copies the idiom, a 403 from thread.claims wipes the role rows. The brief's item 4 forbids that.
+
+Required behaviour:
+- The thread.claims catch rethrows only `err.code === 'signed-out'`.
+- Every other error, 403 included, renders a section-local reason and drops only the claims cache.
+
+Required test: the role read succeeds while thread.claims returns HTTP 403. The role rows and count must be byte-equal to a run without claims.
+
+Required mutant: the catch also rethrows 403. A named test must kill it.
+
+## R2. The tester listener must refuse with a real refusal, not a missing method
+
+Two facts about the code:
+- serve.mjs:619 checks only the BUS_VERBS list.
+- The generic busRead (serve.mjs:70 onward) then calls `bus[verb](arg)`.
+
+Suppose 278 adds `'thread.claims'` to BUS_VERBS and to `bus` in webui cli.mjs:78, but not to `testerBus` at :108. Then a tester GET /api/bus/thread.claims throws a TypeError. The handler turns that into 'invalid-response', which is a server-fault answer. It is not a refusal.
+
+Required behaviour: the tester listener answers thread.claims with an explicit 403 refusal code. It can do this with a tester-only guard, or with a testerBus entry that throws a BusReadError the bus already uses, for example tester-required. It must not answer through a missing function.
+
+Required test: a tester-socket GET of /api/bus/thread.claims gets 403 with that code, and the bus is never called.
+
+## N1. Let 277's refusal decide the reader case
+
+The brief says "a human or reader session". The client shouldn't decide eligibility. It shows whatever the bus answers, and R1 keeps any refusal local. If 277's r2 refuses a reader, the section shows that refusal, and that's correct.
+
+## Checks at the manifest round
+- The role rows at bus.js:447, :462 and :474 keep their shape (I'll re-pin the line numbers on the candidate's base). Byte-equal before and after a claims refresh.
+- The section lists only the four fields, through txt/esc. A test with hostile extra fields (name, body, instance, address) shows that none of them render.
+- A released claim drops on the next refresh.
+- M1 (no section) and M2 (claims counted into the role total) are each killed by a named test, and so is the R1 mutant.
+- A signed-out read still takes the global sign-out path, and no claims data stays cached afterwards.

docs/SESSIONS.md

@@ -1454,3 +1454,4 @@ are never rewritten or removed; corrections are new entries.
 2026-10-22T04:51Z | Webby (Opus 5.5, reviewer seat) | row 268 r3 aca53c4f0 carry check of r2 on 0fa7bf421 | approve carry, rerun counts owed, sent webby-0112
 2026-10-22T04:53Z | Webby (Opus 5.5, reviewer seat) | row 268 r3 verdict sent webby-0112 (no record, sage-2467); row 194 b13 7609210a3 carry check | 14 =, patch-id 086085a8 equal, 54 paths, index.html hunks separate; runs at CLEAR
 2026-10-22T05:05Z | Webby (Opus 5.5, reviewer seat) | row 268 r4 c27207f6e carry check on 205 landing ce6a96ad6 | APPROVE carry: range-diff =, patch-id equal, 9 blobs equal, rerun 14/83/209
+2026-10-22T05:21Z | Webby (Opus 5.5, reviewer seat) | row 194 b14 b565e589b carry check; row 278 design note look (gander-0087) | 194 b14 carry: 14 =, patch-id equal, overlap hunks identical; 278 design accepted with R1 (403 stays local) and R2 (tester refusal is explicit)