row 173 (#1671) r2: rebased onto 78b69e1e6 as dewey/row173-r2 (cherry-pick of 25ff7cd3f, range-diff equal, no conflict); BUILD.md round 2 section with overlap note, run list from app.js readers, mutant procedure; no runs yet (sage-4361)

agents/dewey/work/queue-173/BUILD.md

@@ -61,3 +61,34 @@ counts only as an assertion or a named wait failing in the named test.
 
 None yet. Gander holds the gate slot (row 253 run 5) from 16:32Z. The claim, the push and every run wait for
 Sage's CLEAR.
+
+## Round 2: rebase onto 78b69e1e6 (sage-4361)
+
+- Branch dewey/row173-r2 off refactor 78b69e1e6. The round 1 commit 25ff7cd3f (on aca16404c, 555 commits
+  behind) was cherry-picked as a new commit; dewey/row173 is untouched. No force-push.
+- The pick merged on its own. `git range-diff aca16404c..25ff7cd3f 78b69e1e6..<pick>` reports the commit equal.
+- Overlap with refactor: one app.js line, the `/api/config` handler at the end of the file (federation render).
+  It is far from both row 173 hunks and changes no assertion or reviewed line. board-held.test.mjs and the brief
+  (blob 225ac823b) are unchanged on refactor.
+- No test pins app.js by hash (grepped tests for app.js plus 64-hex).
+
+### Run list
+
+app.js is a page script, loaded by index.html, not imported by any module. Its test readers:
+- by name: board-held, browser, granted-user, serve, shell, sso-browser, user-option-swap;
+- by page load: every webui test that opens the Console through tests/browser.mjs (31 test files).
+No test outside packages/webui reads or serves app.js (`git grep` over packages/*/tests and scripts: none).
+
+Order, each run with `TMPDIR` from `mktemp -d /mnt/storage/scratch/tmp/d173XXXXXX` and absolute paths:
+1. M1-M4 below, each with board-held.test.mjs whole.
+2. board-held.test.mjs whole on the restored tree.
+3. packages/webui whole (all 70 test files), which covers both reader groups.
+case1-accept.test.mjs is not in the list (mos-1612). Runs need Sage's CLEAR.
+
+### Mutant procedure
+
+The M1-M5 table above stands. M5 stays equivalent: the new branch is reached only after the waited-out Board
+read's `accept` (refresh, app.js:372) has redrawn the row, so `seen` is the detached old button. Each mutant is one
+edit to app.js. Before the next mutant, the restored app.js must match the candidate's sha256. Each run is in its
+own process group so a timeout kill takes its browser with it. Afterwards I sweep for orphaned node/chromium
+processes in my run directory.