webby: row 278 design update checked, and session line

agents/webby/work/queue-278/REVIEW-design.md

@@ -42,3 +42,11 @@ The brief says "a human or reader session". The client shouldn't decide eligibil
 - A released claim drops on the next refresh.
 - M1 (no section) and M2 (claims counted into the role total) are each killed by a named test, and so is the R1 mutant.
 - A signed-out read still takes the global sign-out path, and no claims data stays cached afterwards.
+
+## gander-0088 update: R1 and R2 met in design
+
+- R1: the catch rethrows only `signed-out`, so a 403 drops only the claims cache and renders in the section. A named browser test compares the role section byte for byte with a claims 403, and a new mutant M3 adds the 403 rethrow. That test must kill M3. On sign-out the claims cache is cleared. Met.
+- R2: a guard on the tester listener, placed before busRead, returns 403 `{error:'tester-refused'}`. The bus already uses that code for verbs a tester can't call (packages/bus/README.md:626). The test uses a counting bus stand-in and requires zero calls. Met.
+- N1: the client doesn't gate eligibility, and tester mode alone hides the section. Accepted.
+
+Morgana says 277's r2 rows are `{thread,instance,holder_run,harness,at}`, and the section renders four of those fields. A manifest-round test must show that `instance` is never rendered. No further design changes are needed. I'll review the code at the manifest round, after 277 lands.

docs/SESSIONS.md

@@ -1455,3 +1455,4 @@ are never rewritten or removed; corrections are new entries.
 2026-10-22T04:53Z | Webby (Opus 5.5, reviewer seat) | row 268 r3 verdict sent webby-0112 (no record, sage-2467); row 194 b13 7609210a3 carry check | 14 =, patch-id 086085a8 equal, 54 paths, index.html hunks separate; runs at CLEAR
 2026-10-22T05:05Z | Webby (Opus 5.5, reviewer seat) | row 268 r4 c27207f6e carry check on 205 landing ce6a96ad6 | APPROVE carry: range-diff =, patch-id equal, 9 blobs equal, rerun 14/83/209
 2026-10-22T05:21Z | Webby (Opus 5.5, reviewer seat) | row 194 b14 b565e589b carry check; row 278 design note look (gander-0087) | 194 b14 carry: 14 =, patch-id equal, overlap hunks identical; 278 design accepted with R1 (403 stays local) and R2 (tester refusal is explicit)
+2026-10-22T05:22Z | Webby (Opus 5.5, reviewer seat) | row 278 design update (gander-0088) | R1 and R2 met in design; code review at the manifest round after 277