feat(board): session attention, Discord rows, task attribution and relaunch activity (rows 18, 22, #1511, #1512)

One cumulative control-board, webui and seat state. The four rows edit the
same files (scan.mjs, page.html, README.md, app.js), so they land together,
each on its own receipt:

- Row 18, Discord connector rows on the board (#1509): R3 approved by
  Darkwing and Dewey, Gitea comment 26257, manifest 254403b8. Jason
  accepted the visual test.
- Row 22, board attention status (#1503): Filbert approved R1, comment
  26248, manifest e40b58ec; restart receipt 26249.
- #1511, task attribution (row 6 code phase): R2 approved by Filbert and
  Dewey, manifest d4c96395. docs/TOOLS.md carries the approved --by usage
  line (tools-usage.patch 86bcba3c).
- #1512, relaunch activity (row 6 pilot): R1 approved by Darkwing and
  Dewey, candidate manifest 47769fad. All seven source files match it.

Row 16, internal development bootstrap (#1510): the seven files outside
shared records match Filbert's R1 pins, receipt 26204 (agents/researcher/*,
scripts/test-darkwing-launch.mjs, the bootstrap plan).

packages/webui/src/public/app.js is committed at its #1512 R1 pin ce7d79a4.
The working copy holds Dewey's unreviewed return-flow candidate on top of
that, and it stays uncommitted.

Also: the four row briefs and Darkwing's evidence records under
agents/darkwing/work, including the 2026-09-26 tree manifest and the #1512
re-run against 21e3e908. Serial acceptance command: 397/397, three runs.
The failures that only show when tests run concurrently are in #1509 engine
tests, and they reproduce on clean HEAD.

Suites on the exact staged tree: config 24, task 90, foundation 43,
conductor 17, release 14, auth 15, discord 63; package union 397/397
(serial); test-darkwing-launch 5/5.

Shared records (BUILD-LOG, QUEUE, CURRENT, DEFERRED, SESSIONS, AGENTS.md,
agents/README.md) follow in Sage's records commit.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

packages/seat/src/cli.mjs

@@ -2,7 +2,11 @@
 // Usage:
 //   mosaic launch <seat|seat-dir> [--task TEXT] [--project NAME] [--workspace PATH]
 //                 [--harness NAME] [--repo PATH] [--config PATH] [-- args...]
-//   mosaic seat task <seat> <text> [--layout repo|fleet|unknown] [--config PATH]
+//   mosaic seat task <seat> <text> [--by NAME] [--layout repo|fleet|unknown] [--config PATH]
+//
+// `seat task` records who set the task as taskSetBy: `--by NAME`, else
+// $MOSAIC_AGENT_NAME, else "unknown". This is what the caller claimed; it is
+// not verified and it authorizes nothing.
 //
 // `launch` writes <dataRoot>/seats/<layout>/<seat>/registration.json, then replaces
 // itself with the seat's launch.sh, unchanged, with everything after `--` as
@@ -15,12 +19,12 @@
 import { rmSync } from "node:fs";
 import {
   SeatError, defaultConfigPath, loadDataRoot, seatsDir, resolveSeat, tmuxContext,
-  makeRegistration, writeRegistration, updateTask,
+  makeRegistration, writeRegistration, updateTask, resolveSetBy,
 } from "./seat.mjs";
 
 const USAGE = [
   "usage: mosaic launch <seat|seat-dir> [--task TEXT] [--project NAME] [--workspace PATH] [--harness NAME] [--repo PATH] [--config PATH] [-- args...]",
-  "       mosaic seat task <seat> <text> [--layout repo|fleet|unknown] [--config PATH]",
+  "       mosaic seat task <seat> <text> [--by NAME] [--layout repo|fleet|unknown] [--config PATH]",
 ].join("\n");
 
 export const REGISTERED_ENV = "MOSAIC_LAUNCH_REGISTERED";
@@ -49,10 +53,10 @@ function parseLaunch(argv) {
 }
 
 function parseSeatTask(argv) {
-  const opts = { seat: null, task: null, layout: null, config: defaultConfigPath() };
+  const opts = { seat: null, task: null, layout: null, by: null, config: defaultConfigPath() };
   for (let i = 0; i < argv.length; i++) {
     const a = argv[i];
-    if (a === "--config" || a === "--layout") {
+    if (a === "--config" || a === "--layout" || a === "--by") {
       if (i + 1 >= argv.length) throw new SeatError(`missing value for ${a}`, 4);
       opts[a.slice(2)] = argv[++i];
     } else if (a.startsWith("--")) throw new SeatError(`unknown argument: ${a}\n${USAGE}`, 4);
@@ -90,9 +94,12 @@ function launch(argv) {
 
 function seatTask(argv) {
   const opts = parseSeatTask(argv);
+  // Attribution is resolved (and an invalid value refused) before any read
+  // or write, so a refusal leaves the record exactly as it was.
+  const setBy = resolveSetBy({ by: opts.by, env: process.env });
   const seats = seatsDir(loadDataRoot(opts.config));
-  const record = updateTask(seats, opts.seat, opts.task, { layout: opts.layout });
-  process.stdout.write(`mosaic seat task: ${opts.seat} (${record.layout} layout) task set (${opts.task.length} characters)\n`);
+  const record = updateTask(seats, opts.seat, opts.task, { layout: opts.layout, setBy });
+  process.stdout.write(`mosaic seat task: ${opts.seat} (${record.layout} layout) task set (${opts.task.length} characters, set by ${setBy})\n`);
   return 0;
 }