From a32481b780c65c82b75142ff61ff20bc9d3d0e87 Mon Sep 17 00:00:00 2001
From: Jason Woltje <jason@diversecanvas.com>
Date: Sun, 25 Oct 2026 00:18:40 -0500
Subject: [PATCH] row331: create private data root in real-bus test fixture

---
 agents/magica/work/queue-331/BUILD.md  | 31 ++++++++++++++++++++++++++
 packages/bus/tests/model-keys.test.mjs |  1 +
 2 files changed, 32 insertions(+)

diff --git a/agents/magica/work/queue-331/BUILD.md b/agents/magica/work/queue-331/BUILD.md
index b4b93ab2e..4228db02b 100644
--- a/agents/magica/work/queue-331/BUILD.md
+++ b/agents/magica/work/queue-331/BUILD.md
@@ -341,3 +341,34 @@ on this RED result. Complete per-run rc/counts/nice/hash receipts are green-rece
 Raw text logs are retained off-repo under /mnt/storage/scratch/tmp/JT6SN5/ with SHA256
 pins in that receipt. Archiving copies verified bytes across filesystems before
 removing the untracked worktree copies; it did not change any log contents.
+
+## 2026-10-25 — r2 fixture-only correction authorized (sage-4422)
+
+Added exactly `fs.mkdirSync(join(f.root, 'data'), { mode: 0o700 })` inside
+bootBusiness before startBroker in packages/bus/tests/model-keys.test.mjs. No
+production code, assertion, timeout or other test file changed. No test run.
+
+There was no build-time whole-file run of model-keys.test.mjs. The original RED
+slot (sage-4374) covered only client-probe, model-credential-store, CLI guards and
+bus model-proxy; this integration file was authored afterward, with execution
+held for separate GREEN CLEAR. Its first whole-file run was file55 of sage-4420
+on a86a881e1:24 controller cases passed;6 integration fixtures failed in Store's
+dataRoot lstat before their intended assertions. That explains why the six errors
+were absent from the build-time evidence. It was not a prior passing run.
+
+No intended fail-closed refusal path is removed by this correction. None of the
+six cases asserted ENOENT or deliberately omitted dataRoot: each failed during
+shared fixture setup. Store's missing-directory refusal is unchanged production
+code. The credential-revoke-failed, proxy-revoke-revision-conflict and
+proxy-key-issue-failed cases retain their original assertions and remote fault
+injection. They can first reach those paths in r2. The successful fire/hire and
+newly-hired-preflight assertions also first become reachable in r2; another RED
+is possible. No separate test by a new refusal code applies to this fixture
+precondition repair (no refusal code or production guard was added/changed).
+
+r2 request: restart full GREEN from file1, all262 whole files, test-config.sh,
+all4 mutants, each restored with a whole-file positive control; stop first RED.
+No tests until Sage CLEAR after288 landing and Poe's330 focused block.
+Frozen run-list SHA256:512d0c1c8823ff32a1c3308bd08950595e19ac87668fef3569be9c7aac3db674.
+Frozen import-manifest SHA256:a026f5637caf13bfac121b3fd6637e7052d1f90fa1a4114a94e59edf60344875.
+The import edges and262 file list are unchanged by this mkdir; case1-accept remains excluded.
diff --git a/packages/bus/tests/model-keys.test.mjs b/packages/bus/tests/model-keys.test.mjs
index 37c536516..bd6e29924 100644
--- a/packages/bus/tests/model-keys.test.mjs
+++ b/packages/bus/tests/model-keys.test.mjs
@@ -179,6 +179,7 @@ async function bootBusiness(f) {
   fs.writeFileSync(join(f.configDir, 'secrets', 'proxy-management.key'), 'fx331-manage', { mode: 0o600 });
   const business = loadBusiness('demo', { dir: f.configDir, rolesDir }), resolved = {};
   for (const instance of Object.keys(business.roles)) resolved[instance] = resolveInstance({ system, business, instance });
+  fs.mkdirSync(join(f.root, 'data'), { mode: 0o700 });
   const bus = await startBroker({ dataRoot: join(f.root, 'data'), businesses: { demo: busBusiness(business, resolved) },
     organization: { dir: f.configDir, rolesDir, system }, proxy: { port: Number(new URL(f.baseUrl).port), binary: '/fixture-unused' } });
   f.closers.push(() => bus.close());