review(55): Darkwing round 1 build packet (candidate manifest 93fa48c1cdfe)

The full-screen terminal app (#1544): BUILD.md, build.patch over fe5c68fa (9 files), candidate manifest, the gate logs on 23d566d6 and the pty smoke script. The candidate itself is not committed. Co-Authored-By: Claude Opus 5.5 <[email protected]>
2026-10-11 12:51:09 -05:00
parent 23d566d62d
commit 93bd679069
22 changed files with 2280 additions and 0 deletions
@@ -0,0 +1,203 @@
 # Row 55 (#1544): the full-screen terminal app, candidate packet, round 1
 Author: Darkwing. Reviewers: Dewey and Filbert. Brief:
 `docs/plans/2026-10-10_design-implementation.md`, section "Full-screen
 terminal app", with `docs/design/IMPLEMENTING.md` "The full-screen
 terminal app" and "Strings to keep exactly". Base: `fe5c68fa` (row 41,
 `base.txt`). It applies unchanged to `23d566d6`: the commits between the
 two touch only BUILD-LOG.md, docs/SESSIONS.md and the queue files, none of
 them in this candidate. The feature is uncommitted; only this packet is
 committed. I pushed nothing.
 ## Files
 `files.txt` lists the nine repository paths. `candidate-manifest.sha256`
 has their sha256. `build.patch` is `git diff --cached --binary fe5c68fa`
 over them: 9 files, +1363/−16.
 | File | Change |
 |---|---|
 | `packages/cli/src/app.mjs` | new: key parsing, the `App` state machine, `runApp` (alternate screen, raw mode, resize, SIGTERM, restore) and the quit line |
 | `packages/cli/src/screens.mjs` | new: `draw(state)` is pure and returns rows; Inbox, Tasks, Agents, Trail, Help, overlays, the 16-colour palette and NO_COLOR |
 | `packages/cli/src/cli.mjs` | the decide flow moves into the exported `resolveDecision`, which `decide` and the app share; `SEAT_USAGE`; the no-argument entry `app()` |
 | `packages/cli/src/format.mjs` | `trailSummary` is exported (the Trail screen uses it); no other change |
 | `packages/cli/tests/app.test.mjs` | new: 14 tests, listed below |
 | `packages/cli/README.md` | the intro names row 55; new section "The app" |
 | `docs/TOOLS.md` | the `mosaic` entry: the no-argument line and a four-line paragraph |
 | `scripts/mosaic` | a decided scope addition (Sage, 2026-10-11); see below |
 | `packages/queue/tests/dispatch.test.mjs` | follows from `scripts/mosaic`; my addition, for Sage to confirm; see below |
 `resolveDecision` writes the same lines in the same order and asks the
 same question as before. `decide` passes `ask = null` for `--yes` and
 keeps its own "stdin is not a terminal" refusal. The 83 tests that were in
 `packages/cli/tests/` at the base still pass unchanged.
 ### Scope addition: scripts/mosaic
 `scripts/mosaic` is not in the brief's files. Sage approved it on
 2026-10-11 as a decided scope addition. Before, `scripts/mosaic` with no
 argument fell through to `packages/seat/src/cli.mjs`, which printed
 `refused: <seat usage>` and exited 4. The script never reached
 `packages/cli`, so the brief's acceptance line, bare `mosaic` on a TTY
 opens the app, could not be met inside `packages/cli` alone. The change is
 one case that sends no argument to `packages/cli/src/cli.mjs`. Nothing
 else in the script changed.
 The entry checks in Sage's order:
 1. Agent markers exit 3 through `refuseInsideAgent`, with the transport's
   message unchanged.
 2. stdin or stdout not a TTY exits 4 with the usage.
 3. Otherwise the app opens.
 Test 11 below covers each branch through `main([])`. Test 12 spawns
 `scripts/mosaic` itself for exits 4 and 3.
 ### The queue dispatch test
 My first gate run had test-queue red, 26 passed and 1 failed
 (`out/round1-first-gate/test-queue.log`). `packages/queue/tests/dispatch.test.mjs`
 pins A2's rule that every call but `queue` reaches the seat CLI exactly as
 the pre-A2 script did, and its list of calls included `[]`. Sage's approved
 change sends exactly that call somewhere else, so the pin can't hold as
 written. This file is outside the brief and outside what Sage approved. I
 changed it because the gate needs every suite green and the change follows
 directly from the approved one. Sage, please confirm or rule it out.
 The change, 16 lines in and 5 out:
 - `[]` leaves the list of seat calls. `[""]` stays: it is one argument, so
  it still goes to the seat CLI.
 - The fake root gains a fake `packages/cli/src/cli.mjs`.
 - A new test: no argument reaches `packages/cli/src/cli.mjs` with empty
  argv, the same working directory and stdin, and the fake's exit code
  and output passed through. The same call on the pre-A2 fixture still
  reaches the seat CLI.
 - The header comment names row 55.
 With `scripts/mosaic` put back to the base, the new test fails and the
 other three pass. With the candidate, all four pass. The test that A2 only
 adds lines to the pre-A2 script still passes, because the row 55 case adds
 four lines and removes none.
 ## How the brief maps to the candidate
 | Brief | Where | Test |
 |---|---|---|
 | no argument on a TTY opens the app | `cli.mjs` `app()`, `app.mjs` `runApp` | 11, 12; `out/smoke.txt` |
 | not a TTY: usage, exit 4 | `cli.mjs` `app()` | 11, 12 |
 | agent run: exit 3 | `refuseInsideAgent` in `transport.mjs` | 11, 12 |
 | Inbox, Tasks, Agents, Trail, Help; keys c i t a r j k : ? q | `app.mjs` `#key`, `screens.mjs` | 1, 9 |
 | decide runs the existing flow, strings unchanged | `resolveDecision` | 4, 5, 6, 7, 13 |
 | 16 colours, NO_COLOR, 80x24, designed at 120x36 | `screens.mjs` | 1, 3 |
 | no new dependency | `package.json` untouched | |
 | every screen fits 120 columns and 80x24 | | 1 |
 | NO_COLOR output has no escape codes | | 3 (see deviation 1) |
 | the string grep test | | 13 |
 The tests in `packages/cli/tests/app.test.mjs`:
 1. Every screen and overlay fits 120x36, 80x24 and the narrow layout
   (100x30, 99x24), row for row, in colour and NO_COLOR. That covers every
   view and overlay, plus the empty, stale, refused and no-business states.
 2. Broker text is shown, never interpreted. No raw control character or
   bidi override reaches the terminal (`visible()` from
   `packages/conversation/src/terminal.mjs`).
 3. NO_COLOR: no escape codes except reverse video (7/27) on the selected
   row. A frame with nothing selected has none.
 4. 1-9 shows the decide flow's own lines and question. Only y resolves,
   and it goes through the test broker.
 5. The app's decide text equals `mosaic decide` stdout for the same
   decision.
 6. n, N, Esc, Enter and q at the question cancel. Other keys wait.
   Nothing is sent.
 7. Outcome unknown shows the CLI's sentence and offers no retry. Then v
   opens the trail, or r reads again.
 8. Refused and failed reads keep the last list, marked stale. A refused
   decide says refused.
 9. Keys: views, moving, the trail of a selection, the command line, help
   and quit.
 10. No business: the app says so, and `:business <id>` picks one.
 11. `main([])`: exit 3 with a marker set, exit 4 with the usage off a
    terminal, and the app on one (stubbed `runApp`).
 12. `scripts/mosaic` with no argument reaches the app entry (exit 4 off a
    terminal, 3 with a marker). `SEAT_USAGE` still equals what the seat
    CLI prints, so the copy can't drift.
 13. Strings to keep exactly appear once, in `cli.mjs` and `transport.mjs`.
    `app.mjs` and `screens.mjs` don't restate "authorizes the action",
    "declines the action", "[y/N]", "may have recorded it" or "runs only
    from a human shell".
 14. `draw` is pure: the same state gives the same frame.
 ## Deviations, stated
 1. **NO_COLOR keeps reverse video on the selected row.** The brief's test
   line says NO_COLOR output has no escape codes. `IMPLEMENTING.md` line
   188 says reverse video stays for the selected row, and
   `docs/design/README.md` line 148 makes reverse video the selection
   mark. I followed the design. Test 3 checks that 7 and 27 are the only
   SGR codes, and that a frame with no selection has none. The writer's
   `\x1b[H\x1b[2J` before each frame and the alternate screen codes are
   cursor and screen control, not colour.
 2. **The non-TTY message gains one line.** It prints
   `mosaic: the app needs a terminal on stdin and stdout; from a script,
   use a verb:` and then the seat usage and the `packages/cli` usage, exit
   4. Before, it printed `refused: <seat usage>`. `IMPLEMENTING.md` line
   191 says to refuse and point at the verbs, and the old text named only
   the seat verbs. If a reviewer wants the old bytes, test 12 already
   holds them as `SEAT_USAGE`.
 3. **The Terminal class is not the base.** The brief says the app is built
   on the conversation `Terminal` class. Only `visible()` is imported.
   `Terminal` is a line editor for Talk, and Talk is out of scope here. The
   app needs a whole-screen redraw and single-key input, which `Terminal`
   doesn't do. When Talk joins, the Talk screen embeds `Terminal`.
 4. **Reads block redraw.** `humanTransport` uses `spawnSync`, so the
   screen doesn't redraw during a read (30 s timeout). That is the existing
   transport, unchanged. The README says so.
 ## Evidence
 All runs in a detached worktree of `23d566d6` with `build.patch` applied
 and `node_modules` linked (`out/gate/`).
 - `packages/cli`: 97/97 (83 before, plus the 14 new), `out/gate/cli-tests.log`.
 - Every `scripts/test-*.sh`, run in sequence on the final candidate, all
  exit 0 (`out/gate/summary.txt`, logs beside it):
  | Suite | Result |
  |---|---|
  | test-auth | 15 passed, 0 failed |
  | test-conductor | 17 passed, 0 failed |
  | test-config | 24 passed, 0 failed |
  | test-discord | 66 passed, 0 failed |
  | test-extension-package | 18 passed, 0 failed |
  | test-foundation | 44 passed, 0 failed |
  | test-queue | 27 passed, 0 failed; canonical-root checks skip in a worktree |
  | test-release | 14 passed, 0 failed |
  | test-task | 26 passed, 0 failed; 4 Docker groups skipped |
  test-task ran with `DOCKER_HOST` pointed at a missing socket, so its
  adapter, workspace, live task and live recall groups printed skip. The
  live ones call a real model. Nothing this candidate changes runs in
  those groups. Sage's gate rerun covers them with Docker.
 - The first gate run, before the dispatch test change, is kept in
  `out/round1-first-gate/`. `out/dispatch-mutant.txt` has the dispatch
  test against the base script and the candidate script.
 - Smoke, `smoke.sh`: the app in a pty at 80x24 against a fixture config,
  never the real bus. Keys ? Esc t q. The alternate screen was entered once
  and left once, then it printed `(app closed with q; 0 decisions resolved
  this session)` and exit 0 (`out/smoke.txt`).
 - `out/apply.txt`: `build.patch` applies to `23d566d6` in a fresh
  worktree and the manifest matches.
 ## Follow-ups (not in this row)
 - The transport's "did not finish" `CliError` (`transport.mjs` line 60)
  has no `.code`, so the outcome-unknown branch in `resolveDecision` does
  not see it. `mosaic decide` then prints
  `outcome-unknown: the bus transport did not finish`, exit 1, instead of
  the "may have recorded it" sentence. The app matches the message text
  and shows its outcome-unknown overlay, so only the verb has the gap. It
  predates this row.
 - Talk and stop in the app, Decision Seen, and the web console stay out of
  scope, as the brief says.
@@ -0,0 +1 @@
 fe5c68fa031923ff79cbd8aeebb4c8925eb5af23
@@ -0,0 +1,9 @@
 fcc2791aa2f80d7e196b0ce18f02475f9fc6730c74cbb56d2db3f9aae333253e  docs/TOOLS.md
 001ae6159638f783520fa300c3f9ce71c25701568058664a032760dc6d79062e  packages/cli/README.md
 534fdf2e70f7459789c32f31e467e78400a44d90df53dd319a774d8cf959506e  packages/cli/src/app.mjs
 c33d3fedb91be7977cf7b468c908719d8f07cd7a2dad1bb7d9c24d62bcdac432  packages/cli/src/cli.mjs
 c2f6852226c7071dec132d422773d76bdfc356450f582ac28cb7a5077860b4c0  packages/cli/src/format.mjs
 681279edb4982ce103cdbb1a5fe3490721bca27f0877163f5a8c2f5ce6ace419  packages/cli/src/screens.mjs
 17e4a3ccb8a8e896c0d9fb6d0781db9636ceff65ba3d48dd7bdff75934150e4d  packages/cli/tests/app.test.mjs
 5c892aea6a455f05aabb28d312f5fc4bb256584254357c6499319ac956f58109  packages/queue/tests/dispatch.test.mjs
 ab246b3e39ea0c503d97e7af93ef8b958caedb3cf3006e387f14fa93b329856c  scripts/mosaic
@@ -0,0 +1,9 @@
 docs/TOOLS.md
 packages/cli/README.md
 packages/cli/src/app.mjs
 packages/cli/src/cli.mjs
 packages/cli/src/format.mjs
 packages/cli/src/screens.mjs
 packages/cli/tests/app.test.mjs
 packages/queue/tests/dispatch.test.mjs
 scripts/mosaic
@@ -0,0 +1,13 @@
 base: 23d566d62db9189e5d7c252ae278c80c99213423
 check: ok
 apply: ok
 docs/TOOLS.md: OK
 packages/cli/README.md: OK
 packages/cli/src/app.mjs: OK
 packages/cli/src/cli.mjs: OK
 packages/cli/src/format.mjs: OK
 packages/cli/src/screens.mjs: OK
 packages/cli/tests/app.test.mjs: OK
 packages/queue/tests/dispatch.test.mjs: OK
 scripts/mosaic: OK
 9 files changed, 1363 insertions(+), 16 deletions(-)
@@ -0,0 +1,16 @@
 # packages/queue/tests/dispatch.test.mjs with scripts/mosaic at fe5c68fa (the base):
 ✔ every call but `queue` reaches the seat CLI exactly as before A2 (669.173751ms)
 ✖ failing tests:
 ℹ fail 1
 ℹ pass 3
 ✖ no argument reaches the app entry in packages/cli, and only that call (34.852154ms)
 ✔ `queue` reaches the queue CLI with the rest of the arguments (210.558498ms)
 ✔ the pre-A2 fixture is the script A2 changed (0.318757ms)
 # with the candidate's scripts/mosaic:
 ✔ every call but `queue` reaches the seat CLI exactly as before A2 (607.518999ms)
 ✔ no argument reaches the app entry in packages/cli, and only that call (71.984814ms)
 ✔ `queue` reaches the queue CLI with the rest of the arguments (224.724883ms)
 ✔ the pre-A2 fixture is the script A2 changed (0.339528ms)
 ℹ pass 4
 ℹ fail 0
@@ -0,0 +1,107 @@
 ✔ every screen and overlay fits 120x36, 80x24 and the narrow layout, row for row (657.730481ms)
 ✔ broker text is shown, never interpreted: no raw control character or bidi override reaches the terminal (86.710314ms)
 ✔ NO_COLOR: no escape codes, except reverse video on the selected row (85.638005ms)
 ✔ 1-9 shows the decide flow's own lines and question; only y resolves (159.198152ms)
 ✔ the app shows the same decide text as mosaic decide (130.463236ms)
 ✔ n, Esc, Enter and q at the question cancel; other keys wait; nothing is sent (658.383117ms)
 ✔ outcome unknown: the CLI's sentence, no retry, then the trail or a re-read (128.743686ms)
 ✔ refused and failed reads keep the last list, marked stale; a refused decide says refused (177.266492ms)
 ✔ keys: views, moving, trail of a selection, the command line, help and quit (163.853199ms)
 ✔ no business: the app says so and :business picks one (82.097108ms)
 ✔ mosaic with no argument: exit 3 in an agent run, exit 4 with the usage off a terminal, the app on one (1.988286ms)
 ✔ scripts/mosaic with no argument reaches the app entry; the seat usage it printed before has not drifted (258.258873ms)
 ✔ strings to keep exactly live once, in the decide flow and the transport; the app does not restate them (1.575316ms)
 ✔ draw is pure: same state, same frame (1.081875ms)
 ✔ inbox lists only decisions routed to the human, with what approving authorizes and how to decide (129.136475ms)
 ✔ decide resolves by id prefix with --yes, and the trail shows it in broker order with the task to follow (138.929431ms)
 ✔ decide refuses without a terminal or --yes, on an unknown option and on a short reference (117.191582ms)
 ✔ decide prints a declining choice as declining (131.258653ms)
 ✔ an unknown outcome is reported once and never resent (124.564502ms)
 ✔ a decision closed before the answer arrives exits 2 and points at its trail (100.431046ms)
 ✔ a prefix that matches two open decisions exits 2 and resolves neither (115.464391ms)
 ✔ without --business a command uses the live host's business, and a stale host.json is not a host (105.521856ms)
 ✔ every human command refuses inside an agent run before it touches the bus (105.068364ms)
 ✔ usage errors exit 4; no business and no host is a usage error (93.017952ms)
 ✔ agents and tasks print through the broker (106.492206ms)
 ✔ notify.json: missing, loose, malformed and extra keys refuse; a binding or null passes (1.649953ms)
 ✔ bootConfig builds the broker's boot message for one business, with no trackers key when no project names one (88.090598ms)
 ✔ trackers come from the tracker.* variables of the one project that names a tracker project (66.070636ms)
 ✔ with two projects, the one that sets tracker.project supplies the tracker and the other is no conflict (67.66776ms)
 ✔ two projects that each name a tracker project refuse, since the boot shape holds one (54.311037ms)
 ✔ a business without tracker.baseUrl gets no trackers entry (42.543295ms)
 ✔ an unknown business and a broken system config refuse with exit 3 (103.913445ms)
 ✔ empty views say so (1.499ms)
 ✔ the trail keeps the broker's order and names a decision's task without its rows (1.958082ms)
 ✔ tasks print the tracker fields the snapshot carries (0.30169ms)
 ✔ the host boots the broker, binds a launch in process, and the notifier DMs a blocking decision exactly once (1040.624201ms)
 ✔ a notifier that dies takes the host down with exit 1, so the unit restarts the pair (348.328083ms)
 ✔ a second host for the same data root refuses with exit 3 while the first runs (219.533172ms)
 ✔ a broker reply that misses the wait breaks the channel: the late reply answers nothing, later requests refuse, the host exits 1 (1190.312123ms)
 ✔ a broker reply with another request's id, or none, breaks the channel and the host exits 1 (317.451334ms)
 ✔ a broker reply with no request waiting breaks the channel and the host exits 1 (169.522641ms)
 ✔ a notifier that refuses stops the broker and the host refuses with exit 3 (462.061614ms)
 ✔ a notifier that refuses after the broker died still refuses with exit 3, without a send to the dead broker (220.316923ms)
 ✔ a notifier that dies before it replies, after the broker died, still refuses, without a send to the dead broker (141.186895ms)
 ✔ a close send that fails with EPIPE after the notifier refuses still gives the notifier's refusal, exit 3 (207.730923ms)
 ✔ a close send that fails with EPIPE after the notifier dies unanswered still gives the notifier's error (173.736902ms)
 ✔ close() whose stop and close sends fail with EPIPE still finishes, with exit 1 (326.023075ms)
 ✔ watchChildren reports a child that died before it was called, and one that dies later (38.675069ms)
 ✔ bus stop refuses to signal a live pid that is not a bus host (205.281889ms)
 ✔ bus start refuses with exit 3 and the code when the broker refuses to boot; bus status names the lock (343.372644ms)
 ✔ bus start refuses with exit 3 without a notifier config (114.419596ms)
 ✔ bus start runs until bus stop; status reports it while it runs (865.081835ms)
 ✔ bus-service.sh renders the unit and installs it into a given directory (40.694753ms)
 ✔ bus start --pm: the PM runs under its own PID namespace, registered, with a manifest (1368.731037ms)
 ✔ the PM launches a coder through its launch tool; the coder answers; refusals name their code (787.355153ms)
 ✔ a runner that stops at once ends its launch with the runner's reason (255.975513ms)
 ✔ a host that died hard leaves its sessions to the next host, which kills them and ends their runs so the role can be launched again (803.364181ms)
 ✔ a host that died hard leaves its sessions to the next host, which finds one already exited (23) and ends their runs so the role can be launched again (3947.590018ms)
 ✔ a malformed sessions.json refuses the host start with exit 3 and stays as it was (140.226608ms)
 ✔ an over-long launch request is refused at once, not at the 10 s idle timeout (151.079496ms)
 ✔ a launch client that never closes its side doesn't hold the host's close (149.960005ms)
 ✔ a runner that ignores SIGTERM is killed when the host closes (1294.430684ms)
 ✔ zoned uses the IANA zone across DST (26.013355ms)
 ✔ each open blocking decision is DM'd once, across polls and a restart; non-blocking ones are not (147.099869ms)
 ✔ two blocking decisions get two DMs with different nonces (132.429819ms)
 ✔ the digest nonce differs per business and per day and fits Discord's 25 characters (0.4487ms)
 ✔ a failed DM is journaled, backs off, and is retried until it lands (106.047926ms)
 ✔ five definite refusals stop a DM: one gave-up line, one log line, and a restart keeps the count (126.668979ms)
 ✔ 429s, 5xx-style unknowns and refusals without a status never count toward the limit (134.274487ms)
 ✔ a crash between the fifth refusal and its gave-up line: the next poll appends it and sends nothing (109.872742ms)
 ✔ polled every POLL_MS against a permanent 403, a DM is sent at 0, 30, 60, 90 and 120 min and gives up only then (197.106078ms)
 ✔ a restart after the second refusal does not send before that refusal's 30 min are up (156.492966ms)
 ✔ the digest goes at 08:00 Chicago once a day, with blocking ones marked as DM'd (138.849231ms)
 ✔ a late start with no digest for the day sends one at once; an empty inbox gets one line (89.590199ms)
 ✔ an inbox read failure is logged and the next poll retries (1.258133ms)
 ✔ no Discord id reaches the journal or the log (161.188556ms)
 ✔ the journal: a torn tail is copied out and truncated, so an append after it reopens cleanly (35.942562ms)
 ✔ the journal: a crash between the copy and the truncate leaves a tail the next open repairs (55.52388ms)
 ✔ the journal: a whole file that is one torn line truncates to empty (28.58631ms)
 ✔ the journal: a malformed complete line refuses and leaves the file and any torn tail alone (2.411597ms)
 ✔ the journal: a loose file mode, a loose directory or a symlinked journal refuses (1.159198ms)
 ✔ the journal: a line with a wrong type refuses with exit 3 and names the field (5.236096ms)
 ✔ the journal: a symlinked directory refuses and says it is a link (0.461047ms)
 ✔ the journal: a dangling directory link, a parent that is a file and a journal that is a directory each refuse with exit 3 (0.645397ms)
 ✔ the journal: an append after the file was swapped for a symlink refuses and writes nothing through it (0.530816ms)
 ✔ the journal: a directory it cannot write or create refuses with exit 3 and names the path (0.583496ms)
 ✔ digest content stays within Discord's 2000 characters (0.355957ms)
 ✔ runLoop never overlaps ticks and stops after the one in flight (111.677618ms)
 task.close {} answered: invalid-request; fake saw 18 requests, first GET /info 200, GET /projects/1 200, GET /projects/1/views 200
 task.close on a missing task answered: task-not-found; it made GET /tasks/999 404
 ✔ bootConfig trackers reach the S3 adapter in the real broker child, which goes ready against a fake Vikunja (521.916131ms)
 ✔ the transport writes {business, verb, args} to the child and reads its JSON (61.362517ms)
 ✔ a bus code on stderr becomes the exit code; garbage and timeouts are outcome problems (2268.525051ms)
 ✔ busExit and refuseInsideAgent (0.502004ms)
 ✔ talk sends a REQUEST, prints and reads everything that arrives, and stops at the reply (236.288887ms)
 ✔ talk --wait 0 only sends; no reply within --wait exits 1 and says where it will show (1126.015734ms)
 ✔ talk, stop and launches off/on refuse inside an agent run; bad arguments are usage errors (181.101284ms)
 ✔ launches off and on go to the broker and change the business's launch state (124.237954ms)
 ✔ launches list reads sessions.json and marks a stale entry; stop reports it and refuses a non-runner (100.26265ms)
 ℹ tests 97
 ℹ suites 0
 ℹ pass 97
 ℹ fail 0
 ℹ cancelled 0
 ℹ skipped 0
 ℹ todo 0
 ℹ duration_ms 9077.632776
@@ -0,0 +1,11 @@
 cli rc=0
 test-auth rc=0
 test-conductor rc=0
 test-config rc=0
 test-discord rc=0
 test-extension-package rc=0
 test-foundation rc=0
 test-queue rc=0
 test-release rc=0
 test-task rc=0
 DONE
@@ -0,0 +1,17 @@
 OK    status with missing harness credential exits 3 and still lists accounts
 OK    status reports harness credential (read-only) + mosaic accounts
 OK    api key material never reaches output
 OK    oauth token material never reaches output
 OK    unparseable credential file exits 2
 OK    symlinked credential file exits 4
 OK    env-side credential names reported
 OK    env var values never reach output
 OK    accounts without an accounts dir reports none and creates nothing
 OK    accounts lists files and marks the active one
 OK    loose account perms flagged in listing
 OK    agent --auth with missing account file refuses (exit 4)
 OK    agent --auth with non-0600 account file refuses
 OK    agent --auth with invalid account name refuses
 OK    auth.sh without valid config refuses
 selftest: 15 passed, 0 failed
@@ -0,0 +1,23 @@
 On branch refactor
 Your branch is up to date with 'origin/refactor'.
 nothing to commit, working tree clean
 OK    dry-run: allowed change, exit 0, nothing committed (exit 0)
 OK    dry-run committed nothing
 OK    apply: allowed change exits 0 (exit 0)
 OK    apply: attribution in commit subject
 OK    apply: target tree clean after commit
 OK    disallowed path refused (exit 1)
 OK    disallowed path: target untouched
 OK    syntax gate refused broken .mjs (exit 1)
 OK    syntax gate: target untouched
 OK    suite failure refused (exit 1)
 OK    suite failure: target reverted to clean
 OK    disabled policy refused (exit 2)
 OK    disabled policy: target untouched
 OK    failed run refused (exit 1)
 OK    failed run: target untouched
 OK    missing run exits 4 (exit 4)
 OK    invalid policy exits 2 (exit 2)
 selftest: 17 passed, 0 failed
@@ -0,0 +1,26 @@
 OK    absent adapter defaults to pi
 OK    adapter mock validates (exit 0)
 OK    unsupported adapter exits 2 (exit 2)
 OK    env exports adapter
 OK    bootstrap creates default when absent (exit 0)
 OK    bootstrap wrote config file
 OK    bootstrap is idempotent on existing config (exit 0)
 OK    bootstrap did not rewrite existing config
 OK    validate missing config exits 3 (exit 3)
 OK    malformed JSON exits 2 (exit 2)
 OK    unsupported configVersion exits 2 (exit 2)
 OK    unknown top-level key exits 2 (exit 2)
 OK    unknown execution key exits 2 (exit 2)
 OK    unsupported backend exits 2 (exit 2)
 OK    unsupported environment exits 2 (exit 2)
 OK    relative dataRoot exits 2 (exit 2)
 OK    non-canonical dataRoot exits 2 (exit 2)
 OK    filesystem root dataRoot exits 2 (exit 2)
 OK    home directory dataRoot exits 2 (exit 2)
 OK    dataRoot containing config dir exits 2 (exit 2)
 OK    control character in provider exits 2 (exit 2)
 OK    symlinked config file exits 2 (exit 2)
 OK    env exports resolve correctly
 OK    failed validation modified nothing
 selftest: 24 passed, 0 failed
@@ -0,0 +1,70 @@
 toolchain: node v26.8.1
 OK    syntax: packages/discord/src/approvals.mjs
 OK    syntax: packages/discord/src/authorize.mjs
 OK    syntax: packages/discord/src/binding.mjs
 OK    syntax: packages/discord/src/cli.mjs
 OK    syntax: packages/discord/src/connector.mjs
 OK    syntax: packages/discord/src/context.mjs
 OK    syntax: packages/discord/src/engine-pi.mjs
 OK    syntax: packages/discord/src/errors.mjs
 OK    syntax: packages/discord/src/gateway.mjs
 OK    syntax: packages/discord/src/git.mjs
 OK    syntax: packages/discord/src/journal.mjs
 OK    syntax: packages/discord/src/notify.mjs
 OK    syntax: packages/discord/src/rest.mjs
 OK    syntax: packages/discord/src/setspark.mjs
 OK    syntax: packages/discord/src/tools.mjs
 OK    syntax: packages/discord/src/web.mjs
 OK    syntax: packages/discord/bin/git-credential.mjs
 OK    syntax: packages/discord/extension/tools.mjs
 OK    syntax: packages/discord/tests/approvals.test.mjs
 OK    syntax: packages/discord/tests/authorize.test.mjs
 OK    syntax: packages/discord/tests/binding.test.mjs
 OK    syntax: packages/discord/tests/connector.test.mjs
 OK    syntax: packages/discord/tests/context.test.mjs
 OK    syntax: packages/discord/tests/engine.test.mjs
 OK    syntax: packages/discord/tests/fake-pi.mjs
 OK    syntax: packages/discord/tests/gateway.test.mjs
 OK    syntax: packages/discord/tests/git.test.mjs
 OK    syntax: packages/discord/tests/helpers.mjs
 OK    syntax: packages/discord/tests/journal.test.mjs
 OK    syntax: packages/discord/tests/notify.test.mjs
 OK    syntax: packages/discord/tests/recover.test.mjs
 OK    syntax: packages/discord/tests/rest.test.mjs
 OK    syntax: packages/discord/tests/setspark.test.mjs
 OK    syntax: packages/discord/tests/tools.test.mjs
 OK    syntax: packages/discord/tests/web.test.mjs
 OK    syntax: packages/discord/fixtures/claim-worker.mjs
 OK    syntax: packages/discord/fixtures/legacy-owner-worker.mjs
 OK    syntax: scripts/discord.sh
 OK    syntax: scripts/discord-service.sh
 OK    packages/discord declares no dependencies
 OK    no bot-token-shaped string in packages/discord
 OK    fixture binding uses placeholder ids only
 OK    fixture binding validates
 OK    real pi with the extension exposes exactly list_dir, read_file, search and no built-in tool
 OK    real pi with a writable root exposes exactly the three reads plus write_file and edit_file, and writes nothing at start
 OK    real pi with a web key exposes the three reads plus web_fetch and web_search, and no write tool without a writable root
 OK    real pi with a git root exposes the reads, writes and the four git verbs, commits nothing at start, and never shows the token
 OK    real pi with protocol vault adds reserve_id to the git verbs
 OK    real pi with a setspark key exposes the reads and the eight record verbs, no counters, and never shows the key
 OK    real pi refuses a git key on a read-only root (fail closed)
 OK    real pi with the pilot flags (--no-tools) exposes no tool at all
 OK    real pi exits non-zero without MOSAIC_DISCORD_TOOLS: no session, no tools (fail closed)
 OK    a failing nested test fails the run under a parent runner's NODE_TEST_CONTEXT
 OK    node --test packages/discord/tests/ (ℹ pass 178)
 OK    scripts/discord.sh --help exits 0
 OK    scripts/discord.sh check without a binding exits 4
 OK    scripts/discord.sh recover without a binding exits 4
 OK    scripts/discord.sh reload without a binding exits 4
 OK    scripts/discord-service.sh without a command exits 4
 OK    service unit renders with the repository path, a supervised run as the main process, exit 3 never retried, and reload as SIGHUP
 OK    service install writes the rendered unit (0644) and leaves no temp file
 OK    service install a second time reports unchanged
 OK    systemd-analyze verify accepts the rendered unit
 OK    service uninstall removes the unit file
 OK    service install with an unknown flag exits 4
 OK    service install with USER unset finishes and names the account for lingering
 discord suite: 66 passed, 0 failed
@@ -0,0 +1,21 @@
 OK    initial ordinary-file install
 OK    installed tree matches canonical source
 OK    installed tree has no symlinks
 OK    check detects installation drift
 OK    sync refuses to overwrite installation drift
 OK    check detects an extra destination file
 OK    check detects an extra destination directory
 OK    check rejects a destination symlink
 OK    sync accepts a canonical source update
 OK    updated installation matches canonical source
 scripts/test-extension-package.sh: line 14: 414866 Killed                     "$@" > /dev/null 2>&1
 OK    forced interruption kills the replacing process
 OK    next invocation recovers old consistent installation
 OK    interrupted replacement rolled back
 OK    sync succeeds after interruption recovery
 OK    unlocked stale lock file does not block
 OK    active lock refuses a concurrent sync
 OK    source symlink fails closed
 OK    nested second entrypoint fails closed
 extension package selftest: 18 passed, 0 failed
@@ -0,0 +1,53 @@
 toolchain: node v26.8.1, python 3.12.8, jsonschema 4.26.0
 OK    syntax: scripts/foundation-inspect.mjs
 OK    syntax: scripts/foundation/strict-json.mjs
 OK    syntax: scripts/foundation/canonical.mjs
 OK    syntax: scripts/foundation/resolve.mjs
 OK    syntax: scripts/foundation/validate-record.mjs
 OK    syntax: scripts/foundation/fixtures/build-fixtures.mjs
 OK    syntax: scripts/foundation/canonical.test.mjs
 OK    syntax: scripts/foundation/cli.test.mjs
 OK    syntax: scripts/foundation/fixtures.test.mjs
 OK    syntax: scripts/foundation/resolve.test.mjs
 OK    syntax: scripts/foundation/strict-json.test.mjs
 OK    syntax: scripts/foundation/verify-schema.py (ast only; no bytecode written)
 OK    fixture generator runs
 OK    checked-in fixtures/bundles equal a fresh generation
 OK    checked-in fixtures/raw equal a fresh generation
 OK    checked-in fixtures/index.json equal a fresh generation
 OK    checked-in demo bundles equal a fresh generation
 OK    a failing nested test fails the run under a parent runner's NODE_TEST_CONTEXT
 OK    node --test scripts/foundation/ (ℹ pass 80)
 OK    differential schema oracle: PASS: differential schema oracle (finite corpus; compatibility evidence, not equivalence proof)
      platform witness: strftime('%Y') for year 999 -> '999' (pinned checker refuses years 0001..0999)
      node v26.8.1; corpus 1568 records (38 pinned fixtures, 478 unique bundle records, 1052 typeCase/mutation/lexical cases)
      schema column: agree-valid 540, agree-invalid 991, DISAGREEMENTS 0; strict-only (parser-bound) cases: 27; unsupported-kind records not schema-assessed by the inspector: 10
      profile column (schema-valid records only): profile-valid 510, profile-invalid 30
      profile refusals asserted: 30 schema-agreed-valid records refused only by the strict typed-string profile (rule profile-pattern-mismatch), 12 declared by name; 73 named probes verified against declared schema/profile columns
 OK    oracle: zero schema-column disagreements with the pinned checker
 OK    oracle: strict-only profile refusals are counted and asserted
 OK    demo: permitted read preview exits 0 (exit 0)
 OK    demo: permitted file.change preview exits 0 (exit 0)
 OK    demo: assignment.change proposal is unresolved (exit 3) (exit 3)
 OK    demo: revoked registration is refused (exit 3) (exit 3)
 OK    demo: message is not authority (exit 3) (exit 3)
 OK    usage: no arguments exits 2 (exit 2)
 OK    io: missing file exits 4 (exit 4)
 OK    io: directory exits 4 (exit 4)
 OK    io: symlink exits 4 (O_NOFOLLOW) (exit 4)
 OK    bound: oversize fixture exits 2 (exit 2)
 OK    profile: one final LF in a typed selection id is refused before admission (exit 2) (exit 2)
 OK    profile: two final LFs fail the schema pattern itself (exit 2) (exit 2)
 OK    profile: escaped newlines in free-form text stay allowed (exit 0) (exit 0)
 OK    profile refusal is invalid-request/profile-pattern-mismatch with selection and operation withheld, value not echoed
 OK    text output starts with the disclaimer
 OK    json output is valid JSON with result allowed and exactly the charter §7 fields
 OK    json golden matches byte-for-byte
 OK    sandboxed bundle run (env -i, PATH=/nonexistent) produced the unresolved proposal
 OK    sandbox inventory (path/type/size/mode/uid/gid/inode/mtime/sha256) unchanged by runs
 OK    canary never printed (bundle run and credential-file run)
 OK    a non-bundle JSON file is refused at the shape gate, not read into output
 OK    no field of the non-bundle file is echoed
 selftest: 44 passed, 0 failed
@@ -0,0 +1,35 @@
 toolchain: node v26.8.1, git version 2.55.0
 OK    syntax: packages/queue/src/cli.mjs
 OK    syntax: packages/queue/src/errors.mjs
 OK    syntax: packages/queue/src/io.mjs
 OK    syntax: packages/queue/src/lock.mjs
 OK    syntax: packages/queue/src/queue.mjs
 OK    syntax: packages/queue/src/review.mjs
 OK    syntax: packages/queue/src/store.mjs
 OK    syntax: packages/queue/tests/commit.test.mjs
 OK    syntax: packages/queue/tests/data.test.mjs
 OK    syntax: packages/queue/tests/dispatch.test.mjs
 OK    syntax: packages/queue/tests/helpers.mjs
 OK    syntax: packages/queue/tests/lock.test.mjs
 OK    syntax: packages/queue/tests/migration.test.mjs
 OK    syntax: packages/queue/tests/review.test.mjs
 OK    syntax: packages/queue/tests/store.test.mjs
 OK    syntax: packages/queue/tests/write.test.mjs
 OK    syntax: packages/queue/tests/fixtures/fake-gitea.mjs
 OK    syntax: packages/queue/tests/fixtures/kill-at.mjs
 OK    syntax: packages/queue/tests/fixtures/lock-child.mjs
 OK    syntax: packages/queue/tests/fixtures/mosaic-pre-a2.sh
 OK    syntax: scripts/queue-commit.sh
 OK    syntax: scripts/git-hooks/pre-commit
 OK    syntax: scripts/mosaic
 OK    queue-commit.sh, the guard and scripts/mosaic are executable
 OK    packages/queue declares no dependencies
 ℹ tests 150
 ℹ pass 150
 ℹ fail 0
 OK    node --test packages/queue/tests/
 OK    scripts/mosaic queue help
 skip  queue verify and render --check: this checkout (/home/jwoltje/darkwing-scratch/r55/gate) is not the queue's canonical root (/mnt/storage/src/mosaic-stack)
 queue suite: 27 passed, 0 failed
@@ -0,0 +1,16 @@
 OK    valid RELEASE resolves (exit 0)
 OK    invalid RELEASE exits 1 (exit 1)
 OK    missing RELEASE exits 1 (exit 1)
 OK    valid RELEASE leaves image tag consistent with version
 OK    status safe on empty state (exit 0)
 OK    status created no pointer
 OK    fault-injected activation refuses (exit 1)
 OK    refused activation wrote no pointer
 OK    refusal logged exactly once with valid fields
 OK    healthy activation succeeds (exit 0)
 OK    pointer written with valid fields
 OK    repeat activation succeeds (log grows) (exit 0)
 OK    log is append-only across activations
 OK    rollback without previous refuses (exit 1)
 selftest: 14 passed, 0 failed
@@ -0,0 +1,32 @@
 OK    valid task validates (exit 0)
 OK    unknown task key exits 2 (exit 2)
 OK    unsupported taskVersion exits 2 (exit 2)
 OK    invalid task id exits 2 (exit 2)
 OK    empty prompt exits 2 (exit 2)
 OK    NUL in expectExact exits 2 (exit 2)
 OK    out-of-range timeout exits 2 (exit 2)
 OK    missing mission file exits 4 (exit 4)
 OK    task with valid mission validates (exit 0)
 OK    invalid mission exits 2 (exit 2)
 OK    validate missing task exits 4 (exit 4)
 OK    validation does not modify the task file
 OK    prune dry-run exits 0 (exit 0)
 OK    dry-run deleted nothing
 OK    prune --keep=2 --yes removes oldest (exit 0)
 OK    kept exactly 2 newest runs
 OK    newest run kept, oldest pruned
 OK    append-only receipt written (3 entries)
 OK    sessions/workspaces untouched by prune
 OK    prune with invalid keep exits 4 (exit 4)
 skip adapter seam cases (docker daemon unavailable)
 skip workspace/capability cases (docker daemon unavailable)
 skip live task cases (docker unavailable)
 OK    onboard without name exits 4 (non-interactive) (exit 4)
 OK    onboard --name renders profile (exit 0)
 OK    profile written
 OK    canon structure: required filled, optional placeholdered
 OK    canon sections present
 skip live recall pair: user recall run, recalled user name (docker daemon unavailable)
 OK    no agent identity on headless run
 selftest: 26 passed, 0 failed
@@ -0,0 +1,11 @@
 cli rc=0
 test-auth rc=0
 test-conductor rc=0
 test-config rc=0
 test-discord rc=0
 test-extension-package rc=0
 test-foundation rc=0
 test-queue rc=1
 test-release rc=0
 test-task rc=0
 DONE
@@ -0,0 +1,41 @@
 toolchain: node v26.8.1, git version 2.55.0
 OK    syntax: packages/queue/src/cli.mjs
 OK    syntax: packages/queue/src/errors.mjs
 OK    syntax: packages/queue/src/io.mjs
 OK    syntax: packages/queue/src/lock.mjs
 OK    syntax: packages/queue/src/queue.mjs
 OK    syntax: packages/queue/src/review.mjs
 OK    syntax: packages/queue/src/store.mjs
 OK    syntax: packages/queue/tests/commit.test.mjs
 OK    syntax: packages/queue/tests/data.test.mjs
 OK    syntax: packages/queue/tests/dispatch.test.mjs
 OK    syntax: packages/queue/tests/helpers.mjs
 OK    syntax: packages/queue/tests/lock.test.mjs
 OK    syntax: packages/queue/tests/migration.test.mjs
 OK    syntax: packages/queue/tests/review.test.mjs
 OK    syntax: packages/queue/tests/store.test.mjs
 OK    syntax: packages/queue/tests/write.test.mjs
 OK    syntax: packages/queue/tests/fixtures/fake-gitea.mjs
 OK    syntax: packages/queue/tests/fixtures/kill-at.mjs
 OK    syntax: packages/queue/tests/fixtures/lock-child.mjs
 OK    syntax: packages/queue/tests/fixtures/mosaic-pre-a2.sh
 OK    syntax: scripts/queue-commit.sh
 OK    syntax: scripts/git-hooks/pre-commit
 OK    syntax: scripts/mosaic
 OK    queue-commit.sh, the guard and scripts/mosaic are executable
 OK    packages/queue declares no dependencies
 ℹ tests 149
 ℹ pass 148
 ℹ fail 1
 ✖ every call but `queue` reaches the seat CLI exactly as before A2 (423.059344ms)
 ✖ failing tests:
 ✖ every call but `queue` reaches the seat CLI exactly as before A2 (423.059344ms)
  AssertionError [ERR_ASSERTION]: []
  +     "Error: Cannot find module '/home/jwoltje/darkwing-scratch/r55/tmp/mosaic-queue-dispatch-CI2rEd/packages/cli/src/cli.mjs'\n" +
    actual: { status: 1, out: '', err: "node:internal/modules/cjs/loader:1573\n  throw err;\n  ^\n\nError: Cannot find module '/home/jwoltje/darkwing-scratch/r55/tmp/mosaic-queue-dispatch-CI2rEd/packages/cli/src/cli.mjs'\n    at Module._resolveFilename (node:internal/modules/cjs/loader:1569:15)\n    at wrapResolveFilename (node:internal/modules/cjs/loader:1123:27)\n    at defaultResolveImplForCJSLoading (node:internal/modules/cjs/loader:1147:10)\n    at resolveForCJSWithHooks (node:internal/modules/cjs/loader:1174:12)\n    at Module._load (node:internal/modules/cjs/loader:1346:5)\n    at wrapModuleLoad (node:internal/modules/cjs/loader:261:19)\n    at Module.executeUserEntryPoint [as runMain] (node:internal/modules/run_main:154:5)\n    at node:internal/main/run_main_module:33:47 {\n  code: 'MODULE_NOT_FOUND',\n  requireStack: []\n}\n\nNode.js v26.8.1\n", capture: null },
 FAIL node --test packages/queue/tests/
 OK    scripts/mosaic queue help
 skip  queue verify and render --check: this checkout (/home/jwoltje/darkwing-scratch/r55/gate) is not the queue's canonical root (/mnt/storage/src/mosaic-stack)
 queue suite: 26 passed, 1 failed
@@ -0,0 +1,4 @@
 (app closed with q; 0 decisions resolved this session)
 EXIT=0
 alternate screen entered: 1
 alternate screen left: 1
@@ -0,0 +1,21 @@
 #!/usr/bin/env bash
 # Row 55 smoke run: opens the app in a pty at 80x24 against a fixture
 # config (never the real bus), presses ? Esc t q, and prints what the
 # terminal got after the last frame. Usage: smoke.sh <repo> <scratch-dir>
 set -euo pipefail
 REPO="$(cd "$1" && pwd)"; S="$(mkdir -p "$2" && cd "$2" && pwd)"
 cat > "$S/mkfix.mjs" <<JS
 import { fixture } from "$REPO/packages/cli/tests/helpers.mjs";
 const f = fixture(process.argv[2]);
 console.log(f.config + " " + f.roles);
 JS
 mkdir -p "$S/fx"
 read -r CONFIG ROLES < <(node "$S/mkfix.mjs" "$S/fx")
 { sleep 1.5; printf '?'; sleep 0.5; printf '\033'; sleep 0.5; printf 't'; sleep 0.5; printf 'q'; sleep 1; } \
  | env -u MOSAIC_BUS_CAP -u MOSAIC_RUN_ID -u CLAUDECODE -u CLAUDE_CODE_ENTRYPOINT -u MOSAIC_AGENT_RUN -u CODEX_THREAD_ID -u PI_AGENT_DIR \
      MOSAIC_CONFIG="$CONFIG" MOSAIC_ROLES_DIR="$ROLES" \
      script -qfec "stty cols 80 rows 24; '$REPO/scripts/mosaic'; echo EXIT=\$?" "$S/typescript.log" > "$S/drive.out"
 # The tail after the alternate screen closes: the quit line and the exit code.
 sed -n 's/.*\x1b\[?1049l//p; /^EXIT=/p' "$S/drive.out" | tr -d '\r'
 grep -c $'\x1b\[?1049h' "$S/drive.out" | sed 's/^/alternate screen entered: /'
 grep -c $'\x1b\[?1049l' "$S/drive.out" | sed 's/^/alternate screen left: /'