row 252: mos-1321, reword the shell.test write-boundary comment so Approve and Deny is the one decision control; BUILD.md records the ruling and its channel-proof review condition

agents/scrooge/work/queue-252/BUILD.md

@@ -47,7 +47,14 @@ No agent creates a grant. Approve and Deny are human-only Console actions.
 
 ## Old tests changed (for Mos, per mos-1272)
 
-- **`webui/tests/shell.test.mjs`**, write-boundary test. Gating `done` waits on Mos's ruling.
+Mos ruled both changes allowed in mos-1321 (17:12:28Z), each with one condition.
+- **shell.test condition:** reword the comment that opened "No Resolve control", since it is false once the row lands. It now says row 252's Approve and Deny is the one decision control, that its labels come from ACTIONS, and that the doesNotMatch keeps any literal label out of the markup. Webby checks the wording in review.
+- **channel-proof condition:** a header comment is not enough, because human.mjs changes what readProcess keeps. In the review, Webby reads the human.mjs and webui bus.mjs diffs and states two things:
+  - the human proof's checks are unchanged
+  - only the console verifier reads the five MOSAIC_BUS_CONSOLE_* keys, and each case is covered by a named test in console-decide or decide-sso
+- **Second row to land (252 or 239):** it recomputes the webui bus.mjs hash, adds its own header line, and its reviewer re-reads bus.mjs from the base to the combined tip.
+
+- **`webui/tests/shell.test.mjs`**, write-boundary test. Allowed under mos-1321, with the comment reworded.
   - The `writes` list gains the new `fetch(url, ...)` in `decidePost`. It is first in file order (bus.js:362).
   - The `method:` count goes from 7 to 8.
   - A new assertion pins `decidePost`'s callers to `url` plus the two literal `/api/decisions/${enc(a.id)}/...` routes.

packages/webui/tests/shell.test.mjs

@@ -50,13 +50,13 @@ test('shipped strings are unchanged, and the web keeps its write boundary', () =
     ['bus.js', 'No open tasks.'], ['bus.js', 'No role is held right now.'], ['bus.js', 'Nothing of this kind in the trail.'],
     ['bus.js', 'Console shows nothing rather than a guess. Nothing was written.'],
   ]) assert.equal(plain[file].split(s).length - 1, n, `${file}: ${s}`);
-  // No Resolve control. The board's Seen and reply are app.js's POSTs; bus.js has four explicit writes:
+  // Row 252 (#1753, mos-1321): the one decision control is the Console's grant Approve and Deny, one
+  // fetch(url, ...) in decidePost, called only for a decision's confirmation and its resolve. Its labels
+  // come from ACTIONS, and the doesNotMatch below keeps any literal Resolve, Decide or Approve label out
+  // of the markup. The board's Seen and reply are app.js's POSTs; bus.js's other explicit writes are
   // row 76's message to a role, row 122's human Settings update, row 125's token-limit reset (one path,
   // to the same Settings route) and row 148's spec and docs save. Row 165 (#1662) adds the role
   // instance add or change to /api/instances, and row 65 the routing table's save to /api/routes.
-  // Row 252 (#1753) adds the Console's grant Approve and Deny: one fetch(url, ...) in decidePost,
-  // called only for a decision's confirmation and its resolve. Its labels come from ACTIONS, so no
-  // button carries a literal Resolve, Decide or Approve.
   assert.doesNotMatch(src, /<button[^>]*>[^<]*(Resolve|Decide|Approve)/i);
   const writes = read('bus.js').toString().match(/fetch\([^;]*method:\s*['"](POST|PUT|PATCH|DELETE)[^;]*;/g) ?? [];
   assert.deepEqual(writes, ["fetch(url, { method: 'POST', headers: { 'content-type': 'application/json' }, body: JSON.stringify(body), cache: 'no-store', redirect: 'manual' });", "fetch('/api/settings',{method:'POST',headers:{'content-type':'application/json'},body:JSON.stringify(payload),cache:'no-store',redirect:'manual'});", "fetch('/api/settings',{method:'POST',headers:{'content-type':'application/json'},body:JSON.stringify({revision,reset:[JSON.parse(path)]}),cache:'no-store',redirect:'manual'});", "fetch(url,{method:'POST',headers:{'content-type':'application/json'},body:JSON.stringify(payload),cache:'no-store',redirect:'manual'});", "fetch('/api/instances',{method:'POST',headers:{'content-type':'application/json'},body:JSON.stringify(payload),cache:'no-store',redirect:'manual'});", "fetch('/api/routes',{method:'POST',headers:{'content-type':'application/json'},body:JSON.stringify(payload),cache:'no-store',redirect:'manual'});", "fetch('/api/project-file', { method: 'POST', headers: { 'content-type': 'application/json' }, body: JSON.stringify(sent), cache: 'no-store', redirect: 'manual' });", "fetch('/api/bus/message', { method: 'POST', headers: { 'content-type': 'application/json' }, body: JSON.stringify({ to, body: text }), cache: 'no-store', redirect: 'manual' });"]);