diff --git a/docs/plans/2026-10-13_pm-tester-and-fresh-state.md b/docs/plans/2026-10-13_pm-tester-and-fresh-state.md
index db4e402e5..f07964d91 100644
--- a/docs/plans/2026-10-13_pm-tester-and-fresh-state.md
+++ b/docs/plans/2026-10-13_pm-tester-and-fresh-state.md
@@ -70,6 +70,24 @@ Darkwing's proposal is `agents/darkwing/work/queue-110/placement.md`
    test covers each. The packet states, from the row 92 sandbox code,
    whether a role session can reach `broker.sock` at all. If it can, a
    test shows a role session's tester bind refuses.
+   Amended the same evening: a role session can reach it (Darkwing,
+   `agents/darkwing/work/queue-110/sandbox-reach.md`, commit af191a3a6),
+   so "no proof" is withdrawn. A tester binds with a process proof from
+   a new shim, `packages/bus/src/tester-cli.mjs`, of the same shape as
+   human-cli. The proof refuses a launch-record ancestor and the managed
+   run markers `MOSAIC_RUN_ID`, `MOSAIC_BUS_CAP` and `MOSAIC_AGENT_RUN`,
+   and allows agent markers and binaries. It is path-bound to the bus's
+   own `tester-cli.mjs`, as the human proof is to `human-cli.mjs`, and it
+   uses its own nonce variable, so neither CLI's nonce proves the other.
+   `verifyTester` lives in a new `packages/bus/src/tester.mjs`.
+   `human.mjs` may change only to export an existing helper.
+   `verifyHuman`'s body stays byte-identical, and the existing human
+   tests pass untouched. A request that carries `tester` together with
+   `cap` or `human` refuses. The real bwrap case in
+   `packages/seat/tests/sandbox.test.mjs` must run, not skip, in both
+   the packet's gate and Sage's, and the packet's log shows it ran.
+   Files added: `tester-cli.mjs`, `tester.mjs`, `human.mjs` (export
+   only) and `packages/seat/tests/sandbox.test.mjs` (that case only).
 3. Replies to a tester go to a new `tester` address. A role may send to
    `tester` only with `in_reply_to` naming a tester message. A tester
    reply never appears in the human's inbox or the Console's Messages