docs(row253): integrate row191 base and refresh manifest

agents/gander/work/queue-253/BUILD.md

@@ -195,3 +195,5 @@ N4: SID confirmation now waits within the existing inner watchdog budget rather
 The required gate base is the refactor tip Sage names at CLEAR, 378a76b85 or later. This delta is prepared on the current seat branch for static review only; no old-base gate is authorized. The final integrated gate candidate will get fresh hashes and integration records before execution. c4/delta-0112/ freezes the seven source/test/doc paths, the delta from aa81ca390, and static uniqueness. Prior frozen packets remain unchanged.
 
 Duckworth-0113 approves 761893dac after git reads only (8d3fa3f20). B1 and M1 are closed; real timing remains unverified until the gate. N5 is harmless diagnostic noise on a vanished stat entry: the input redirection can report before stderr is redirected, and tester_capture discards supervisor stderr. No source change is made for it. N6 is recorded with R3: if the inner watchdog expires before kernel SID confirmation, finish has only the known child PID and kills that PID, not an unverified session. Other members may remain. Root still refuses, discards stdout and waits only within the outer bound. This is an explicit limit of cleanup before session identity is established, not a claim that the session was swept. The independent outer bound does not prove cross-session cleanup. Source/test bytes and the seven-entry manifest remain exactly those approved at 761893dac.
+
+Sage-2463 integration onto 0fa7bf421: new gander/row253-0fa7 preserves both earlier branches. Only BUILD-LOG append conflicted; current upstream remains an exact prefix. README auto-merged with row191 processing controls. Focused row253 tests do not read the changed Console/processing code, but WebUI whole covers it on this base. Only README changed in the manifest; refreshed digest 24b6a01b2ede6f025ec898fa4ec830bb9585ce6151d6298e713e31c7430a502b. integration-0fa7/ records source-only dependency inspection, range-diff and every commit patch-id. No test/syntax/probe ran.

agents/gander/work/queue-253/CANDIDATE-SHAS.json

@@ -4,6 +4,6 @@
   "packages/cli/tests/case-sudo-fixture.mjs": "b259b8c7926e49829c8a956674021cb0cc85ddd65aebdc786d05cc08d7790008",
   "packages/cli/tests/case2-unit.test.mjs": "1e0696eb196e83a0766b433ef71f27df0a3f8fcb6399787ab8c1c0f05c54dc44",
   "packages/cli/tests/case1-accept.test.mjs": "6cfd2963303315aa6911c4d4f6d75d3ab87d9fcba8e128b056216e7f85fd8901",
-  "packages/webui/README.md": "2eeb1f79324f64463a9b3427e67492d672b8d1c14db6c0349c7de17d89e52fc9",
+  "packages/webui/README.md": "9de6c8356e1f1e0ecb8d0be8ec523cb817b04bb633f0cd8aed7db32565ffd009",
   "docs/plans/DEFERRED.md": "3ea465cf7ed664ceb1ea4076b829f706f8480f80c4a8aaa6a7487e4eceaf318f"
 }

agents/gander/work/queue-253/MANIFEST.md

@@ -5,3 +5,5 @@ MANIFEST.sha256 names seven source/test/doc landing paths and pins their bytes.
 Base before the required gate integration: c3d88840c. Initial static repair packet: b64aa316a; initial runnable candidate: aa81ca390. The delta packet is c4/delta-0112/. Full records live under agents/gander/work/queue-253/ as review evidence. DEFERRED.md preserves upstream entries and names row276 / #1781 for F5 and N1/N2.
 
 Sage-2335 authorizes the runnable commit before the whole gate. No repaired-source syntax check, test, probe or host experiment has run. No results from 8a8df4171 carry. After Duckworth's delta static verdict, the gate must use the candidate integrated onto the refactor tip named by Sage at CLEAR (378a76b85 or later under sage-2342), never this old base. Fresh integration records and hashes will identify that final gate candidate.
+
+Superseding integration under sage-2463: gander/row253-0fa7 on 0fa7bf421. See integration-0fa7/. Only README changed among the seven landing entries, retaining row191 processing-control documentation; the refreshed manifest digest is 24b6a01b2ede6f025ec898fa4ec830bb9585ce6151d6298e713e31c7430a502b. No gate has run.

agents/gander/work/queue-253/MANIFEST.sha256

@@ -2,6 +2,6 @@
 b259b8c7926e49829c8a956674021cb0cc85ddd65aebdc786d05cc08d7790008  packages/cli/tests/case-sudo-fixture.mjs
 6cfd2963303315aa6911c4d4f6d75d3ab87d9fcba8e128b056216e7f85fd8901  packages/cli/tests/case1-accept.test.mjs
 1e0696eb196e83a0766b433ef71f27df0a3f8fcb6399787ab8c1c0f05c54dc44  packages/cli/tests/case2-unit.test.mjs
-2eeb1f79324f64463a9b3427e67492d672b8d1c14db6c0349c7de17d89e52fc9  packages/webui/README.md
+9de6c8356e1f1e0ecb8d0be8ec523cb817b04bb633f0cd8aed7db32565ffd009  packages/webui/README.md
 c02bef6b3495e5a4548d7b4e89675ed52be26a0c9ccce4d9d5cfc5fe2ce437bd  scripts/case1-accept.sh
 d7670bdb049ae41ba3774fc83de633636859b6723be858cfb31ea106b0e8812b  scripts/case2-unit.sh

agents/gander/work/queue-253/integration-0fa7/NOTES.md

@@ -0,0 +1,15 @@
+# Row253 integration onto 0fa7bf421
+
+Authority: sage-2463. New branch gander/row253-0fa7, rebase tip before these records 67224933425e9687bf366cd7ba7c31c1daa4e9f3. Both earlier branches remain unchanged. Nine commits replayed onto 0fa7bf421fc153a226b5f06ed484e089e48e23ba.
+
+One conflict: the first design commit's BUILD-LOG.md append. Kept upstream in full, then appended the row253 phase. The integrated log has the entire current base blob as its exact prefix. It stays outside the manifest and lands as a separate doc-only append after code. README merged automatically, retaining row253's tester-socket wording and row191's complete Instance processing controls section. No runtime or test conflict.
+
+Only packages/webui/README.md changes among the seven manifest entries. CANDIDATE-SHAS.json and MANIFEST.sha256 are refreshed. The old C4 packets remain historical exact snapshots; the README addition is the sole new manifest blob. Runtime scripts, focused test files and shared fixture remain byte-identical to the approved candidate.
+
+## Static test dependency inspection
+
+The row253 focused case1/case2 files read their two host scripts, generated fixtures, kernel proc data, the two service templates, and case2-precheck.sh. They import the shared case-sudo fixture, cli test helpers, business test helpers and seat sandbox helpers. Neither directly reads or imports the row191 changes in webui cli.mjs, serve.mjs, index.html, processing.js/css or processing-http.mjs. The cli.mjs/config.mjs in their scratch copies are stand-ins written by the fixtures, not the repository Console code.
+
+The required WebUI whole suite does consume row191's changed modules and UI, including the processing/browser/shell tests now present on the integrated base. The full CLI suite also runs against the new base and scripts/mosaic. No focused test, suite, syntax execution, browser, probe or host experiment ran. Dependency inspection used source reads only.
+
+range-diff.json covers the nine replayed commits. patch-ids.json lists each old/new pair; the final record/manifest refresh commit has no old counterpart. The requested exact range-diff through the final committed tip is sent with the handoff. Publishing uses only the repo helper and waits for a clear busy check.

agents/gander/work/queue-253/integration-0fa7/manifest-check.json

@@ -0,0 +1,47 @@
+{
+  "digest": "24b6a01b2ede6f025ec898fa4ec830bb9585ce6151d6298e713e31c7430a502b",
+  "entries": [
+    {
+      "path": "scripts/case2-unit.sh",
+      "before": "d7670bdb049ae41ba3774fc83de633636859b6723be858cfb31ea106b0e8812b",
+      "after": "d7670bdb049ae41ba3774fc83de633636859b6723be858cfb31ea106b0e8812b",
+      "changed": false
+    },
+    {
+      "path": "scripts/case1-accept.sh",
+      "before": "c02bef6b3495e5a4548d7b4e89675ed52be26a0c9ccce4d9d5cfc5fe2ce437bd",
+      "after": "c02bef6b3495e5a4548d7b4e89675ed52be26a0c9ccce4d9d5cfc5fe2ce437bd",
+      "changed": false
+    },
+    {
+      "path": "packages/cli/tests/case-sudo-fixture.mjs",
+      "before": "b259b8c7926e49829c8a956674021cb0cc85ddd65aebdc786d05cc08d7790008",
+      "after": "b259b8c7926e49829c8a956674021cb0cc85ddd65aebdc786d05cc08d7790008",
+      "changed": false
+    },
+    {
+      "path": "packages/cli/tests/case2-unit.test.mjs",
+      "before": "1e0696eb196e83a0766b433ef71f27df0a3f8fcb6399787ab8c1c0f05c54dc44",
+      "after": "1e0696eb196e83a0766b433ef71f27df0a3f8fcb6399787ab8c1c0f05c54dc44",
+      "changed": false
+    },
+    {
+      "path": "packages/cli/tests/case1-accept.test.mjs",
+      "before": "6cfd2963303315aa6911c4d4f6d75d3ab87d9fcba8e128b056216e7f85fd8901",
+      "after": "6cfd2963303315aa6911c4d4f6d75d3ab87d9fcba8e128b056216e7f85fd8901",
+      "changed": false
+    },
+    {
+      "path": "packages/webui/README.md",
+      "before": "2eeb1f79324f64463a9b3427e67492d672b8d1c14db6c0349c7de17d89e52fc9",
+      "after": "9de6c8356e1f1e0ecb8d0be8ec523cb817b04bb633f0cd8aed7db32565ffd009",
+      "changed": true
+    },
+    {
+      "path": "docs/plans/DEFERRED.md",
+      "before": "3ea465cf7ed664ceb1ea4076b829f706f8480f80c4a8aaa6a7487e4eceaf318f",
+      "after": "3ea465cf7ed664ceb1ea4076b829f706f8480f80c4a8aaa6a7487e4eceaf318f",
+      "changed": false
+    }
+  ]
+}

agents/gander/work/queue-253/integration-0fa7/patch-ids.json

@@ -0,0 +1,74 @@
+[
+  {
+    "old": "971681f29a347a3771802b19d1b9a65c88943a79",
+    "new": "39c30f1c200a1f5f27767dae4b730cade7703777",
+    "subject": "gander: design tester socket migration for host scripts",
+    "old_patch_id": "47bdc56d349c8fcce2e5f56f3f5ce4ce7b1d6f14",
+    "new_patch_id": "895656745186c2dc4cb1ee1261c323af90bf9fb9",
+    "equal": false
+  },
+  {
+    "old": "43f17b9afe60bfe256e924b1317332d6068a8b4f",
+    "new": "d004b44982db5196777710e20163f877b07bf54d",
+    "subject": "test: prepare row253 socket fixtures and fix gate collisions",
+    "old_patch_id": "d597cc7402b568d845a87c1f142bde74ce6ae9da",
+    "new_patch_id": "d597cc7402b568d845a87c1f142bde74ce6ae9da",
+    "equal": true
+  },
+  {
+    "old": "f9b9112b970b634ee7c990447ded04dfe622d8cc",
+    "new": "9e4bbee25d3a97e9dfec743d92c20f50154222da",
+    "subject": "docs: propose row253 C4 session supervisor and draft hop fake",
+    "old_patch_id": "899327761a9bde7e7b4fefd790c1a523488e8029",
+    "new_patch_id": "899327761a9bde7e7b4fefd790c1a523488e8029",
+    "equal": true
+  },
+  {
+    "old": "70e6bb16159dd28391dbbfe0b4808f0c3dde5225",
+    "new": "69474277277fe87e7c398c508f6450aa0d691de7",
+    "subject": "docs(row253): freeze C4 repair for static review",
+    "old_patch_id": "38dcf7f0ec2a39bad2696d971a684a729b154747",
+    "new_patch_id": "38dcf7f0ec2a39bad2696d971a684a729b154747",
+    "equal": true
+  },
+  {
+    "old": "bef1bd886b6e90f2a404825cce728e3901328ba3",
+    "new": "d85cf93d64a4ebf37865cbb74719d842105a1864",
+    "subject": "docs(row253): store repair patch without context whitespace",
+    "old_patch_id": "1cf1916dab2a8552fadd07ce81246fce5f105b3d",
+    "new_patch_id": "1cf1916dab2a8552fadd07ce81246fce5f105b3d",
+    "equal": true
+  },
+  {
+    "old": "ecb15d1debdad4fbd2e9bdfedb639143467709c6",
+    "new": "463a97f49f6bcaa65a10a54c2ad40e428e7fd135",
+    "subject": "fix(row253): supervise socket queries across sudo sessions",
+    "old_patch_id": "d104bd53960b75c1e9d9402ec2ea193a55bf8164",
+    "new_patch_id": "08a16c862148ddae13044130cac740064d0e86fe",
+    "equal": false
+  },
+  {
+    "old": "39b98a26e9ac00edf3b8d77690cf06bc689a6272",
+    "new": "de93d8e038f591ea7be2f850c5fb0dea272c3d63",
+    "subject": "fix(row253): bound cleanup retries after initial inventory",
+    "old_patch_id": "aee9e5492bf07ee71687fd899c4e632bb36bc1e3",
+    "new_patch_id": "aee9e5492bf07ee71687fd899c4e632bb36bc1e3",
+    "equal": true
+  },
+  {
+    "old": "2f466464cccfe7b4f2522936a7f8409b74af7b5c",
+    "new": "36bd3c3a8bda8c31da8219cc726ce005ec2dbd2b",
+    "subject": "docs(row253): record static approval and pre-confirmation residual",
+    "old_patch_id": "d2aecebf222474b0e06c5109b5f22caf768176ce",
+    "new_patch_id": "d2aecebf222474b0e06c5109b5f22caf768176ce",
+    "equal": true
+  },
+  {
+    "old": "8b8f8d7810d076974aedcae3c800123bf791fa47",
+    "new": "67224933425e9687bf366cd7ba7c31c1daa4e9f3",
+    "subject": "docs(row253): record integration onto refactor 378a76b85",
+    "old_patch_id": "efb06f08af899d8f03390ab24ab65f6558cbae58",
+    "new_patch_id": "efb06f08af899d8f03390ab24ab65f6558cbae58",
+    "equal": true
+  }
+]

agents/gander/work/queue-253/integration-0fa7/range-diff.json

@@ -0,0 +1,9 @@
+{
+  "command": [
+    "git",
+    "range-diff",
+    "378a76b85..8b8f8d781",
+    "0fa7bf421..672249334"
+  ],
+  "stdout": " 1:  971681f29 !  1:  39c30f1c2 gander: design tester socket migration for host scripts\n    @@ Commit message\n     \n      ## BUILD-LOG.md ##\n     @@ BUILD-LOG.md: Before: managed project/thread verbs had no Console conversation area. After: fi\n    - 2026-10-21T22:30:20Z | Huey | T1 sessions design r3, scrooge-0007 R1, Vikunja 463 | Before: r2 e19e30df2 nested new session checkouts under the retained legacy instance workspace, allowing project-name collision or historical parent inspection to reach live siblings. After: exact path is dataRoot/session-workspaces/business/instance/session, outside the legacy root; canonicalized ancestor/descendant overlap refuses; T2 nesting mutant covers historical mount/inspection and a legacy project named sessions. All other r2 content retained as approved, revision label updated. Verification: old nested path absent, manual R1-only delta, whitespace and installed queue guard checked; no code/builds/suites/live changes/provider calls/credential reads.\n    + 2026-10-22 02:01:30 UTC | Sage (Claude Opus 5.5, 1ef1e4f8) | row 202 #1700 FED R5 landing | ddfb29af7 on 9c9732983: 6 manifest paths from a74cd9f87 (digests match CANDIDATE.sha256, patch-id 9d89077b equal); Duckworth APPROVE r5 rev 3026; C1 gate by Quackerjack on merge 3b86180b9: cli 771/771 skip 0 (run 2, run 1 red on gate TMPDIR length), 10 test-*.sh rc 0, M1-M13 killed; done rev 3108; landing note refused for length before the done move, so the record is the commit body and #1700 c30265; 191 and 194 rebased onto it (one scripts/mosaic case line)\n      \n    - 2026-10-22T00:18:12Z | Sage (Opus 5.5) | row 254 landing (#1759), library.sync human timeout | Before: the human transport gave library.sync the 5-second default, so a sync longer than that reported outcome-unknown, and six library-* codes reached the Console as 502. After: 331597709 lands Megavolt's candidate (7 paths, tree d49e4626f, manifest digest be63cfbe recomputed and matched). human-cli.mjs waits 130 s for library.sync, past the server's 120 s hold, and 5 s for other verbs. webui bus.mjs maps library-sync-busy, library-diverged and library-accept-stale to 409, library-accept-invalid to 400, and library-credential-missing and library-fetch-failed to 503. channel-proof re-pinned. Merged-tree gate on the landing commit: library 77/0, bus 628/0, webui 305/0 (1 skip), cli 749/0 (23:44:33-23:55:11Z). eb9672c91 adds the README request-timeout sentence (Dewey N1) and a DEFERRED entry for the four library codes still at 502 (Dewey N2, binds the Console library routes row). Overlap sweep before push: 268 rebased to r2 ecd9b35eb (README only, approval carried webby-0096), 194 rebased to b7. Done rev 3072, #1759 closed.\n    + 2026-10-22 03:35:55 UTC | Sage (Claude Opus 5.5, 1ef1e4f8) | row 273 #1778 activate --send/--no-sso landing | 0bbf0f6d1 landed on 378a76b85, a rebase of cac7d0f67 (0042f713d) with all 6 range-diff pairs = and equal patch-ids; 4-path manifest e1031023 unchanged; Filbert APPROVE rev 3111 (c30308) carried merge-scoped under mos-1160, carry comment c30319 names 0bbf0f6d1. Gate on 0bbf0f6d1 by Darkwing: stack-release.test.mjs 218/218 skip 0, stack-release-external.test.mjs 25/25 skip 0, test-release.sh rc 0 (selftest 14/0, no skips), T58 controls c0 11/11 pass and c1 11/11 fail, M1-M7 killed. Rerun because row 202 changed scripts/mosaic, which stack-release.test.mjs copies. Red 1 was 978143bf4 (T53 test 6 usage pin). This doc commit adds the TOOLS.md usage line and F39 rules (Filbert N1).\n     +2026-10-21 21:24:47 UTC | Gander row253 #1758 design r1 | Investigation began21:12Z under sage-2162; recorded now. Before: case2 installer still renders tester TCP and case1 acceptance requires it. After: proposed design covers socket marker migration, actual configured dataRoot within unchanged hardening, target-uid metadata queries, kernel-peer acceptance observation and explicit same-uid residual. Initial inventory saved; no passing final static-check claim, product edit, test, host or live action. Duckworth design review precedes code.\n     \n      ## agents/gander/work/queue-253/BASE-PORT-INVENTORY.json (new) ##\n 2:  43f17b9af =  2:  d004b4498 test: prepare row253 socket fixtures and fix gate collisions\n 3:  f9b9112b9 =  3:  9e4bbee25 docs: propose row253 C4 session supervisor and draft hop fake\n 4:  70e6bb161 =  4:  694742772 docs(row253): freeze C4 repair for static review\n 5:  bef1bd886 =  5:  d85cf93d6 docs(row253): store repair patch without context whitespace\n 6:  ecb15d1de !  6:  463a97f49 fix(row253): supervise socket queries across sudo sessions\n    @@ Commit message\n      ## BUILD-LOG.md ##\n     @@ BUILD-LOG.md: Before: managed project/thread verbs had no Console conversation area. After: fi\n      \n    - 2026-10-22T00:18:12Z | Sage (Opus 5.5) | row 254 landing (#1759), library.sync human timeout | Before: the human transport gave library.sync the 5-second default, so a sync longer than that reported outcome-unkLine truncated
+}

agents/gander/work/queue-253/integration-0fa7/upstream-paths.json

@@ -0,0 +1,98 @@
+[
+  "BUILD-LOG.md",
+  "Containerfile",
+  "agents/darkwing/work/queue-273/BUILD.md",
+  "agents/rocko/work/queue-191/stoprun-build/BUILD.md",
+  "compose.yaml",
+  "docs/TOOLS.md",
+  "docs/plans/QUEUE.md",
+  "docs/plans/queue.json",
+  "packages/bus/README.md",
+  "packages/bus/src/broker.mjs",
+  "packages/bus/src/client.mjs",
+  "packages/bus/src/runtime.mjs",
+  "packages/bus/src/server.mjs",
+  "packages/bus/src/web.mjs",
+  "packages/bus/tests/processing-runtime.test.mjs",
+  "packages/bus/tests/processing-timeout.test.mjs",
+  "packages/bus/tests/processing-web.test.mjs",
+  "packages/bus/tests/processing.test.mjs",
+  "packages/bus/tests/project-runtime.test.mjs",
+  "packages/bus/tests/tasks.test.mjs",
+  "packages/cli/README.md",
+  "packages/cli/src/cli.mjs",
+  "packages/cli/src/git-socket.mjs",
+  "packages/cli/src/launcher.mjs",
+  "packages/cli/src/notifier-process.mjs",
+  "packages/cli/src/notifier.mjs",
+  "packages/cli/tests/gate-lane-image.test.mjs",
+  "packages/cli/tests/host.test.mjs",
+  "packages/cli/tests/launch-account.test.mjs",
+  "packages/cli/tests/launch-limit-checks.test.mjs",
+  "packages/cli/tests/launch-limits.test.mjs",
+  "packages/cli/tests/launch-routes.test.mjs",
+  "packages/cli/tests/launcher.test.mjs",
+  "packages/cli/tests/notifier.test.mjs",
+  "packages/cli/tests/processing-cli.test.mjs",
+  "packages/cli/tests/stack-copy.test.mjs",
+  "packages/cli/tests/stack-release-external.test.mjs",
+  "packages/cli/tests/stack-release.test.mjs",
+  "packages/discord/src/cli.mjs",
+  "packages/discord/src/connector.mjs",
+  "packages/discord/src/engine-pi.mjs",
+  "packages/discord/src/journal.mjs",
+  "packages/discord/src/processing.mjs",
+  "packages/discord/tests/binding.test.mjs",
+  "packages/discord/tests/processing-stop.test.mjs",
+  "packages/discord/tests/processing.test.mjs",
+  "packages/discord/tests/recover.test.mjs",
+  "packages/processing-control/README.md",
+  "packages/processing-control/package.json",
+  "packages/processing-control/src/container-cli.mjs",
+  "packages/processing-control/src/containers.mjs",
+  "packages/processing-control/src/coordinator.mjs",
+  "packages/processing-control/src/effects.mjs",
+  "packages/processing-control/src/entrypoint.mjs",
+  "packages/processing-control/src/runtimes.mjs",
+  "packages/processing-control/src/state.mjs",
+  "packages/processing-control/tests/containers.test.mjs",
+  "packages/processing-control/tests/coordinator.test.mjs",
+  "packages/processing-control/tests/effects.test.mjs",
+  "packages/processing-control/tests/mount.test.mjs",
+  "packages/processing-control/tests/runtimes.test.mjs",
+  "packages/processing-control/tests/state.test.mjs",
+  "packages/processing-control/tests/stop-run.test.mjs",
+  "packages/processing-control/tests/task.test.mjs",
+  "packages/project/src/git.mjs",
+  "packages/seat/src/checkout.mjs",
+  "packages/seat/src/landing.mjs",
+  "packages/seat/src/sandbox.mjs",
+  "packages/seat/src/working.mjs",
+  "packages/seat/tests/working.test.mjs",
+  "packages/tasks/src/adapter.mjs",
+  "packages/tasks/src/vikunja.mjs",
+  "packages/tasks/tests/processing.test.mjs",
+  "packages/webui/README.md",
+  "packages/webui/src/cli.mjs",
+  "packages/webui/src/processing-http.mjs",
+  "packages/webui/src/public/index.html",
+  "packages/webui/src/public/processing.css",
+  "packages/webui/src/public/processing.js",
+  "packages/webui/src/serve.mjs",
+  "packages/webui/tests/browser.test.mjs",
+  "packages/webui/tests/processing-browser.test.mjs",
+  "packages/webui/tests/processing-ui.test.mjs",
+  "packages/webui/tests/processing.test.mjs",
+  "packages/webui/tests/shell.test.mjs",
+  "scripts/agent.sh",
+  "scripts/common.sh",
+  "scripts/hello.sh",
+  "scripts/mosaic",
+  "scripts/mosaic-task.mjs",
+  "scripts/run-task.sh",
+  "scripts/stack-copy.sh",
+  "scripts/stack-release.sh",
+  "scripts/testing/lane-image.mjs",
+  "scripts/verify.sh",
+  "src/run-agent.sh"
+]