docs(records): SetSpark approver fix deployed and surveyed, lead decision 28

Co-Authored-By: Claude Opus 5.5 <[email protected]>

docs/SESSIONS.md

@@ -420,3 +420,4 @@ are never rewritten or removed; corrections are new entries.
 2026-09-27T00:10:31Z | Sage (T3 Claude Code, thread 1ef1e4f8) | #1508 N13 commit | nested node --test fix in test-foundation/test-discord; pins 60f04822/2ad3be74 match; nine suites green on the index (foundation 44, discord 64); DEFERRED entry closed.
 2026-09-27T00:11:29Z | Filbert (T3 Claude Code, thread 9cb9731e) | CHAT-03 brief R2 review (#1507 row 5), BRIEF-r2 5c5b45a2 | changes requested: F1 extension turn can overlap Mosaic preflight (spurious agent_settled, order-based attribution unsound), F2 empty clear_queue omits extension custom messages; B2-B6 and N1-N12 closed; review agents/filbert/work/chat-03-brief-review-r2-2026-09-26.md d149e8cc
 2026-09-27T00:21:33Z | Sage (T3 Claude Code, thread 1ef1e4f8) | goals review, SetSpark deploy decision | Jason: decide. Deploy of shared-signals cc74d92 handed to the stack operator seat (12fe8cda). Goals review page written from ledger evidence (47.7, 33.0 human msgs per closed issue vs <10); CHAT-03 source held for rescope; two-round brief budget. Lead decision 27. North star to Jason for ratification.
+2026-09-27T00:24:20Z | Sage (T3 Claude Code, thread 1ef1e4f8) | SetSpark deploy outcome | Operations seat deployed shared-signals cc74d92 to VM 1022 00:23Z, verified; survey: DEC-009 only bad row, 0 Accepted over 16. DEFERRED entry moved to Done; lead decision 28 (DEC-009 stays as stored). Caddy recreate side effect sent to operations.

docs/plans/2026-09-26_lead-decisions.md

@@ -331,3 +331,15 @@ which stay with him. Each item names who decided it and what happened.
     - work for other repositories goes to their own seats;
     - the ledger runs every Monday.
     Jason ratifies the north star sentence and the goal order.
+28. **SetSpark deploy result and DEC-009.** The operations seat deployed
+    cc74d92 to VM 1022 at 00:23Z on 2026-09-27 and verified it (hash,
+    health, tunnel). The survey found one bad row, DEC-009 (Proposed), and
+    no Accepted decision over 16 approvers, so Jason has no correction to
+    make. DEC-009 stays as stored. It was the live-check record from item
+    16. The fixed service refuses to approve it, and correcting it would
+    change production data for no gain. If someone wants it approved, a
+    `record_update` through the Discord Sage writes `discord:` approvers
+    and request 1 closes as stale. The deploy also recreated caddy through
+    `depends_on`, about 20 s of edge downtime. I suggested
+    `--no-deps setspark-api` to the operations seat. The procedure is theirs
+    to change.

docs/plans/DEFERRED.md

@@ -114,35 +114,6 @@ at every gate. Started 2026-09-12 during the control board MVP.
   of the runtime files. Until then the rule is that unreviewed Discord source
   stays uncommitted in the tree only as long as a review needs it.
   (2026-09-26, #1509)
-- **SetSpark service accepts any string as a decision approver.** Create
-  checks only that `required_approvers` are distinct non-empty strings, and
-  approval checks `discord:<author id>` against them. So a decision stored
-  with names (DEC-009) can never be approved, and nothing says so until
-  an approval is tried. Mosaic's connector now writes only `discord:<id>`
-  (20ea5a0b), but the service should refuse other shapes. This belongs to
-  shared-signals, not Mosaic. Reported to Jason. (2026-09-26, #1509)
-  2026-09-26, before 21:41Z: at Jason's word, Sage sent it to the SetSpark lead
-  (T3 thread ac03938d). The message covers validating approvers on create
-  and update, what to do with DEC-009 and its open request 1, and a notice
-  before any change to the approver contract. The SetSpark lead replied:
-  they do not own it. setspark-api is built from shared-signals
-  `stack/api` and runs on VM 1022, and their rules keep them out of both.
-  Their read-only pointers: `setspark_api/service.py` 353 (the create and
-  update check, using `evidence()` at 152) is where the `discord:` plus
-  17 to 20 digits rule and the 1 to 16 bound go, with a 422
-  `invalid_record`. `add_approval` compares at 645, and `_discord_ids` at
-  567 strips the prefix for the view. Stored rows such as DEC-009 need a
-  check too. They passed the owner question and DEC-009 to Jason. No owner
-  yet.
-  2026-09-26 23:13Z: Jason gave the owner choice to Sage. A Sage subagent is
-  writing the fix, Rocko reviews it, and Sage commits it to shared-signals.
-  The rule keeps the sanctioned `pending:` markers. The reasons and the
-  DEC-009 disposition are in lead decisions item 21. Deploying to VM 1022 is
-  still a gated host action.
-  2026-09-26 23:50Z: fixed in source, shared-signals cc74d92 (Rocko
-  approved R2, lead decision 24). The SetSpark lead confirmed SetSpark
-  does not depend on free-text approvers. Still open: the deploy to VM 1022
-  and running the README survey query on production. Both are Jason's.
 - **Index-export suite runs leave Docker networks behind.** Each export
   directory becomes a compose project, and its `<dir>_default` network
   stays after the run. On 2026-09-26 the host ran out of address pools. The
@@ -177,3 +148,4 @@ Moved to `docs/plans/QUEUE.md` on 2026-09-13. This file holds only gaps.
 - Discord engine: leaked fake pi and the timeout gap in `busy` (2026-09-26, #1509): fixed in 3edb15eb (Darkwing 6b R2, Rocko approved, review ed5510a0). Tests stop the engine in `finally`. A turn pi never started now stops pi with exit 1 instead of guessing, and the unit restarts it. Known limit: see the open entry on wedge restarts.
 - Combined concurrent test hangs (2026-09-14, #1509): closed on evidence from 3edb15eb. At default concurrency the union passed 406/406 three times on the R2 snapshot and 408/408 on the commit's index, where clean HEAD had hung four runs out of four. The inherited-intermittency entry from 2026-09-15 stays open until a later run shows it is the same cause.
 - A nested `node --test` passes even when its tests fail (2026-09-26, #1508): closed. Queue A1 (34a72af9) clears NODE_TEST_CONTEXT on its own path. N13 fixes `test-foundation.sh` and `test-discord.sh`, each with a check that fails the suite if the clearing is lost. Darkwing wrote it (n13.patch 00868b2f) and Filbert approved it (e464be6c). Sage's grep on 2026-09-27 finds no other nested `node --test`: in scripts, only the two suites, `test-queue.sh` and `queue-commit.sh`, and in JS, only the queue test that covers the fix.
+- SetSpark service accepted any string as a decision approver (2026-09-26, #1509): closed. Fixed in shared-signals cc74d92 (Rocko approved R2, lead decision 24). The operations seat (T3 12fe8cda) deployed it to VM 1022 at 00:23Z on 2026-09-27. The running `service.py` hash matches cc74d92, and `/healthz` returns 200 inside the network and through the public tunnel. The read-only README survey found one row breaking the rule (DEC-009, Proposed, version 1), one open request that isn't ready (DEC-009's), and no Accepted decision with more than 16 approvers. No rows changed. DEC-009 stays as stored (lead decision 21, item 28). The service now refuses approvals on it, so nothing can go wrong silently. Side effect: `up -d` also recreated caddy, about 20 s of edge downtime for all hosts. That is for the shared-signals deploy procedure to fix, not Mosaic.