docs: R6 follow-up briefs for row 294 N1 (#1807) and N4 (#1808); docs only

docs/plans/2026-10-23_r6-followup-rows.md

@@ -0,0 +1,46 @@
+# FED R6 follow-up rows: the user-session swap test and the user-bus fold-back
+
+Two items from Duckworth's row 294 round 1 static approval (comment 30998, note
+`agents/duckworth/work/row294/ROUND1-ca710eabd.md` in 5b7089ea1, N1 and N4). Neither blocks 294.
+Sage filed them as rows so they aren't lost in BUILD.md (sage-3170, sage-3171).
+
+## Brief: R6-N1, an HTTP-level test of the user-session option swap
+
+Issue #1807.
+
+Owner Launchpad. Reviewer Duckworth. Gate owner Sage. After row 294 (FED R6, #1800) is done.
+
+Row 294's C2b swaps every bus option to the user transport for a granted user's session
+(`packages/webui/src/serve.mjs`, the `userOptions(session)` assignment behind `userRoute`). That swap
+is what keeps the human transport out of a user session. No test drives it through HTTP. G5 tests
+`consoleBus` over the user transport directly, and a mutant that swaps only the chat options
+survives, because the `userRoute` gate refuses the other routes first.
+
+Change: tests only. Add a test that drives a granted user's session through `serve.mjs` with the
+route gate stubbed open, and checks that no option reaches the owner transport. A G4-style check on
+`env.counts.owner` fits, or a direct check that a user session's options carry no owner caller
+besides the `plugins` read that mos-1394 allowed. Add mutant M12: serve.mjs keeps the owner's
+`send` for a user session. M12 must die on the new test.
+
+No product change. Any change to an existing assertion or fixture goes to Mos through Sage first.
+Gate: Duckworth approves the manifest. The new test's file runs whole, then the webui suite, and
+M12 dies.
+
+## Brief: R6-N4, fold user-bus.mjs back into bus.mjs
+
+Issue #1808.
+
+Owner Launchpad. Reviewer Duckworth. Gate owner Sage. After row 294 is done, and in the same window
+as the next re-pin of `packages/bus/tests/channel-proof.test.mjs`.
+
+Row 294 added `packages/webui/src/user-bus.mjs`, a copy of about 40 lines from
+`packages/webui/src/bus.mjs` (294's C7). It stayed separate because channel-proof.test pins
+`packages/webui/src/bus.mjs` by sha256 (row 164's frozen human transport), and 294 didn't re-pin it.
+
+Change: move the user transport into `bus.mjs` beside `humanCall` with the same protocol, delete
+`user-bus.mjs`, and update its imports. Re-pin `bus.mjs` in channel-proof.test only as part of a
+re-pin that Mos approves. A pin change is an old-test change. Behavior stays the same: the 294
+tests for the user transport pass unchanged.
+
+Gate: Duckworth approves the manifest. channel-proof.test, the webui suite and the 294 user-transport
+tests run whole and green. No re-pin lands without Mos's go.