docs: clarify Q198 health transport and approval questions

BUILD-LOG.md

@@ -5181,3 +5181,5 @@ Before: managed project/thread verbs had no Console conversation area. After: fi
 2026-10-21T16:34:44Z | Huey | Q198/Q199 system-manager design, mos-1183, Vikunja 452 | Before: pinned foundation 6c75887b0 has separate bus, development queue, run evidence, turn/cohort controls and launch/usage paths; the assignment requests a mechanical manager design. After: docs/plans/2026-10-21_q198-system-manager.md proposes admission/cooldown, priority and safe interruption, durable requests, bounded retry/DLQ/replay/rerouting, Console monitoring, optional decision adapters with USD reservations, six ordered slices and three recommended owner decisions. Verification: 26 pinned file:line references resolve, ten-line summary, manual source/contract review, git diff --check and installed queue guard pass. No builds/suites, runtime writes, credential reads, service changes or paid calls. Huey queue next refused the linked worktree, then returned nothing from canonical checkout; direct brief controls this assignment. Gitea issue and queue-row capture are handed to Sage under the no-credential-read/no-queue-write boundary.
 
 2026-10-21T18:45:47Z | Huey | Q198 system-manager design r2, mos-1194, Vikunja 452 | Before: Scrooge requested changes on add7cb506 for decision-key worker exposure, cap scope and absent sampler ownership. After: distinct MOSAIC_DECISION_OPENROUTER_KEY with S6 sessionEnv canary requirement; exclusive per-instance key with per-key caps and provider limit on every enablement; S2 owns supervisor sampler and waits until after MVP/re-pin. Also records P1 interpretation, missing-confidence fallback and stand-in timeout selection, explains verified Noul spelling, excludes notifier/gateway retry loops with citations, and cites lifecycle revocation requirement. Verification: 30 pinned citation spans resolve, ten-line summary, manual diff/source review and whitespace/queue-guard checks. No builds, suites, live changes, credential reads or paid calls.
+
+2026-10-21T19:56:11Z | Huey | Q198 design r3, mos-1201/1201a, Vikunja 452 | Before: Scrooge approved r2 7e785a08f with three notes. After: N1 names proposed system.health bus read verb and includes broker handler/authorization in S2 scope and review; N2 labels exclusive ownership as a setup attestation that cannot be mechanically proved and identifies provider key limit as real ceiling; N3 adds recommended Q4 for P1 narrowing and removes the Mos-flag instruction. Other design content retained. Verification: manual r2-to-r3 delta review, ten-line summary, whitespace and installed queue-guard checks. No builds, suites, live changes or paid calls.

docs/SESSIONS.md

@@ -1421,3 +1421,4 @@ are never rewritten or removed; corrections are new entries.
 2026-10-21T15:19:14Z | Sage (Opus 5.5, 1ef1e4f8) | MVP push 10-21 afternoon: rows 249, 197 proof 3/4, 222 singles, 66 r4d, queue-commit | 249 landed 9de5a57ab (+7b9737953 DEFERRED N1, #1751 closed, Vikunja 445 c442); 197 proof 3 rc=1 on a driver defect, Herb's fix a5b636750 to Webby, proof 4 set up in sage-r197p4; 222 singles 34/34 and 5 mutants killed (sage-2028); 66 round 4 in review (82c830779, c30083/30084); queue revs 2642-2904 committed 0636721e6
 2026-10-21T16:34:44Z | Huey (gpt-6.1-sol) | mos-1183, Q198/Q199 system-manager design, Vikunja 452, huey/system-manager-design on 6c75887b0 | design and six proposed slices documented; pinned citations and docs checks pass; no build, suite, live action or paid call; Gitea/queue capture remains Sage-owned
 2026-10-21T18:45:47Z | Huey (gpt-6.1-sol) | mos-1194, Q198 design r2, scrooge-0001 findings 1–8, Vikunja 452 | all findings addressed in design and slice acceptance criteria; 30 citation references checked, no suites/live changes/paid calls; Mos routes r2 back to Scrooge
+2026-10-21T19:56:11Z | Huey (gpt-6.1-sol) | mos-1201/1201a, Q198 design r3, scrooge-0002 N1–N3 | three doc notes applied; Q4 ready for Mos’s combined owner approval question; no builds, suites, live changes or paid calls

docs/plans/2026-10-21_q198-system-manager.md

@@ -12,7 +12,8 @@ No live trial, key installation or runtime change is authorized by this design.
 MVP work (Vikunja 414 and 416) keeps first claim on Sage’s gate.
 
 Brief: mos-1183, DECISIONS Q198/Q199, Vikunja **452**. Owner: Huey. Design only.
-Revision **r2**, mos-1194, addresses Scrooge’s review of `add7cb506` (scrooge-0001).
+Revision **r3**, mos-1201, applies Scrooge’s three notes on approved r2 `7e785a08f`
+(scrooge-0002).
 All defaults below are proposals, not measured safe operating limits or new authority.
 
 ## 1. Existing pieces and reuse
@@ -118,7 +119,7 @@ The P1 capacity/authorization hold narrows Jason’s Q198 “take precedent” d
 system recovery gets priority over eligible normal work, but heavy recovery cannot
 bypass authorization, kill state or hard capacity. This is a proposed safety restriction,
 not a claim that Jason already approved that exception. Bounded health and reconciliation
-retain reserved capacity. Mos should flag this interpretation when seeking design approval.
+retain reserved capacity. Section 9 Q4 puts this restriction to Jason for approval.
 
 | Work | What interrupt means | Hard-stop boundary |
 | --- | --- | --- |
@@ -225,8 +226,9 @@ is separate from enabling the decision hook. F10’s preflight fallback remains
 **D9 Sampler ownership.** S2’s implementer owns the live sampler inside the mechanical
 supervisor process proposed in D1, running in monitor-only mode before admission lands.
 That process samples every 2 seconds and supplies timestamped local snapshots through
-the Console’s authenticated bus read transport. The Console does not read `/proc`
+the Console’s authenticated bus read transport via the proposed `system.health` read
-itself. Process death/stale samples show unknown. Request/provider fields show unavailable
+verb. S2 includes the broker handler and its scoped authorization review. The Console
+does not read `/proc` itself. Process death/stale samples show unknown. Request/provider fields show unavailable
 until their adapters land. Starting this process and updating the live Console require
 an approved re-pin window after MVP. No sampler is started by this design work.
 
@@ -283,9 +285,11 @@ eligible set. Recheck eligibility after it returns. Never call it for safety act
 **D11 Cost scope.** Proposed opt-in defaults: **$0.10/day and $1/month per dedicated
 decision key**, both enforced by its owning instance’s durable ledger. Each instance
 must use a separately provisioned key used only for that instance’s decisions, with a
-non-secret provider key ID bound to the instance in the approved setup record. Reject
+non-secret provider key ID bound to the instance in the approved setup record. Exclusive
-enablement if exclusive ownership cannot be established. Do not reuse a worker key or
+ownership is a setup attestation, not something the manager can prove mechanically.
-share the decision key across instances or other clients. Shared-key operation is held
+Reject enablement without that attestation. The provider-side key limit is the real
+spending ceiling. Do not reuse a worker key or share the decision key across instances
+or other clients. Shared-key operation is held
 until a shared ledger exists. These are not account-wide caps: N enabled instances
 with N keys permit N times the defaults. Setup shows that combined authorized budget.
 Use integer currency units/decimal parsing, never binary-float threshold comparisons.
@@ -330,7 +334,7 @@ authorized here. Vikunja 450/451 and MVP 414/416 retain their existing order/aut
 | Ref/order | Slice and dependency | Acceptance evidence | Before 10-27? |
 | --- | --- | --- | --- |
 | S1 | Pressure parser and pure rules evaluator, no live enforcement | Synthetic load/memory/PSI/missing-signal cases, exact hold/release thresholds, fake-clock hysteresis, effective CPU/memory limit cases. No builds or real pressure generation. | Candidate could land if Sage has spare review/gate capacity. Never displace MVP. |
-| S2 | Live sampler in the mechanical supervisor process (monitor-only), plus read-only Console System status, after S1. S2 implementer owns process lifecycle and snapshot transport (D9). | Fixture sampler feeds timestamped Console responses for healthy/held/stale/unknown. Process death, unavailable adapters and auth scoping tested. No admission writer, secrets or command-line fields. | After MVP. Live sampler/Console activation needs an approved re-pin window. |
+| S2 | Live sampler in the mechanical supervisor process (monitor-only), plus read-only Console System status, after S1. S2 implementer owns process lifecycle and snapshot transport (D9), including the new `system.health` bus read verb and broker handler. Scope and review include broker authorization. | Fixture sampler feeds timestamped Console responses for healthy/held/stale/unknown. Process death, unavailable adapters and auth scoping tested. No admission writer, secrets or command-line fields. | After MVP. Live sampler/Console activation needs an approved re-pin window. |
 | S3 | Request journal/admission, after S1 and final kill/lifecycle contracts | Migration/rollback compatibility, duplicate-key conflict, crash before/after spawn, two dispatchers, generation fencing, queue limits/expiry, provider cooldown, fairness under sustained traffic, kill-at-launch race, instance isolation. | After MVP preferred. Schema and dispatch integration need a full owned gate. |
 | S4 | Cooperative interrupts and capacity ownership, after S3 and adopted gate lanes | Agent abort proof vs uncertain, test-step cancellation/quarantine, owned build cleanup, PID reuse, remote tool unknown outcome, emergency request during full backlog. No gate grant synthesized. | After MVP. |
 | S5 | Retry/DLQ/replay and permitted reroutes, after S3/S4 | Fake provider failures with exact total-attempt/time bounds, restart during backoff, Retry-After, unknown proxy budget, partial-stream/write no replay, authorized replay lineage, incompatible-route refusal. | After MVP. |
@@ -354,6 +358,10 @@ bounded synthetic pressure. No load experiment on the shared development host.
 - **Q3 Reroute consent:** may setup authorize a named alternative model/provider list?
   **Recommend yes**, per role and privacy requirement. Empty list means hold/fail
   visibly instead of silently changing providers or model quality.
+- **Q4 System recovery priority:** approve the P1 narrowing of Q198 so heavy recovery
+  takes priority over eligible normal work but still waits for authorization, kill-clear
+  and hard capacity? **Recommend yes.** Keep health/reconciliation on reserved control
+  capacity, without letting a recovery launch bypass those safeguards.
 
 ## Verification and handoff