diff --git a/agents/darkwing/work/queue-115/r1/build.md b/agents/darkwing/work/queue-115/r1/build.md
new file mode 100644
index 000000000..df0004b16
--- /dev/null
+++ b/agents/darkwing/work/queue-115/r1/build.md
@@ -0,0 +1,116 @@
+# Row 115 (#1609) round 1: a closed decision sends the raising role a message
+
+Brief: docs/plans/2026-10-14_decision-close-message.md. Mos found the gap. Jason resolved decision 03130d08, and the PM, which raised it, never got a turn, because a close wrote only `decision_events` and nothing reached the role.
+
+BASE: 94ece491f05ecbb737227da8a7ba1d57a1ac75fd. I built the candidate on 54b7c7b3e and moved the worktree to 94ece491f before the mutants and the gate. The commits between them touch only packages/ledger, docs/SESSIONS.md and the queue files, none of the manifest paths.
+Candidate: build.patch against BASE. candidate-manifest.sha256 lists the 5 files. I applied the patch to a fresh `git archive 94ece491f` export and every digest matched (DIGESTS_OK).
+
+## What changed
+
+### The close message
+
+packages/bus/src/broker.mjs, the `decision.resolve`/`decision.seen`/`decision.withdraw` case. After the `decision_events` insert and the human's `human.input` answer event, a close with `op !== 'seen'` by a human, or by a run other than `raised_by_run`, inserts one message:
+
+| Column | Value |
+|---|---|
+| `from_role`, `from_run` | `human`, `human-cli` for a human close; the closing role and run for a role close |
+| `to_role` | `d.raised_by_role` |
+| `class` | `DECISION` |
+| `decision` | the decision's id |
+| `in_reply_to`, `corrects` | null |
+| `body` | `Decision <id> on <action> was resolved by <by>: <choice> (<option text>).` or `Decision <id> on <action> was withdrawn by <by>.`, then `\nNote: <note>` when the close had a note |
+
+`<by>` is the same `by` the `decision_events` row gets: the human's name, or the closing run. The option text comes from the decision's own `options`, which `invalid-choice` has already checked. The message is routed like `message.send`'s, to the raising role's current holder, or with no holder until the next claim routes it.
+
+It runs inside `request()`'s transaction, after every refusal check, so a refused close (`invalid-choice`, `decision-closed`, `not-resolver`) writes no message.
+
+The cases that send nothing:
+
+- `decision.seen`, by the `op` check.
+- The raising run's own withdraw, by the run check. An agent withdraw is only ever the raising run (`not-resolver` otherwise), so a role's withdraw never sends one. A human withdraw does.
+- A supersede. Its withdrawal is a direct `decision_events` insert inside `decision.raise`, not this case.
+- A within-role decision. It closes inside `decision.raise`, so `decision.resolve` on it refuses `decision-closed`.
+
+### The request
+
+`message.receive` mapped `request` with one query, the `human.input` whose subject is the message id. That moves into a private `#request(business, m)`, unchanged for every message except one kind. When there's no event for the message itself and the message is a `DECISION` from `human` that cites a decision, it returns the `human.input` on that decision with `kind` `answer` and `op` `resolved` or `withdrawn`. A decision has at most one close, because both close paths refuse `decision-closed` and the broker never writes `expired`, so that event is unique. A human `message.send` with class `DECISION` keeps its own instruction event, because the first query finds it. A role close's message has no `human.input`, so its `request` is null.
+
+### The runner
+
+No change, as the brief says. `turnRequest` already prints `citing decision` and `request`, and the runner replies to `from_role`, so the role's RESULT goes to the human's inbox.
+
+### README
+
+packages/bus/README.md:
+
+- The `decision.resolve` row says it sends the raising role a DECISION message. The `decision.withdraw` row says a human withdraw does and the raising run's own withdraw doesn't. The `message.receive` row says a human close's message carries the close's answer as `request`, and a role close's has null.
+- A new section, "Decision close messages (row 115, #1609)", after the decision authorization text. It gives the columns, the routing, both body forms, `<by>`, the note line, the four cases that send nothing, the request, and that the message shows in the decision's `trail`.
+
+`unslop-check` is clean on the README.
+
+## Scope notes
+
+1. packages/bus/tests/single-use.test.mjs. "message.send consumes approval and prevents a later send or authorize" counted every message after its approval and expected 1. The approval's resolve is a cross-role close by the arbiter, so it now sends the raiser a DECISION message too, and the count was 2. The test now counts the DECISION message (1) and the other messages (1) separately. The brief lists packages/bus/tests/ as owned, and this was the only existing test that changed.
+2. The decision's `trail` gains the new message, since `#trail` adds messages whose `decision` is the decision. The human.input answer keeps the decision as its subject. The human resolve test checks the trail.
+3. `agents`. A role whose decision the human closed now has a routed message. It reads `working` while its runner takes the turn, then `idle` once the runner marks the message read. That's the turn the brief asks for, so I didn't change the state rules.
+4. Nothing reads the new message outside the bus's own verbs. The Console, the notifier and Discord are out of scope by the brief and unchanged.
+
+## Tests
+
+packages/bus/tests/decision-close.test.mjs is new, with 7 tests. Its fixture raises one decision routed to cto (technical), one to pm (delivery) and one gated to the human, all from coder.
+
+| Test | Checks |
+|---|---|
+| a human resolve sends the raising role one message from the human, and its request is the answer | one DECISION message. Every column, the body with the note line, `decision_events.by` is `jason`, one `routed` delivery to coder-run, and coder's `message.receive` returns it with `request` equal to the answer event id. The message is in the decision's trail |
+| a cross-role decision resolved by its arbiter comes from that role and run, with no request | from cto/cto-run to coder, the body with `resolved by cto-run: yes (Allow).` and no note line, `request` null |
+| a human withdraw sends one message with the note | from human to coder, `withdrawn by jason.`, a two-line note kept as written, `request` the answer |
+| the raising run's withdraw, a supersede, a within-role raise and seen send nothing | 3 closes and 2 seen rows in `decision_events`, no DECISION message, coder's receive is empty |
+| refused closes send nothing: invalid-choice, decision-closed, not-resolver | a human bad choice, pm resolving cto's decision, cto withdrawing coder's: no message. Then one real close, and the second resolve and a human withdraw of it refuse `decision-closed` with still one message |
+| a raising role nobody holds at the close gets the message on the next claim | coder releases, the human resolves: one `routed` delivery with no holder. coder-run-2 claims, the message is routed to it, and its `message.receive` returns it with the answer as `request` |
+| a human DECISION send keeps its own instruction as the request, not a close's answer | after a human resolve, a human `message.send` with class DECISION citing the same decision. Coder receives both: the close's has the answer, the send's has its own `request` |
+
+packages/harness/tests/runner.test.mjs gains "a decision the human resolves becomes a turn citing the decision and the answer". The runner holds coder, coder raises a gated `deploy`, and the human resolves it. The coder's RESULT reaches the human in reply to the close message, and its echoed turn ends with `Message <id> from human, sent <at>, class DECISION, citing decision <d>, request <answer>:` and the body. The close message is marked read.
+
+## Mutants
+
+mutants.py runs each mutant against the full bus suite (155 tests) and restores broker.mjs after each. Log: mutants-run.log, per-mutant output under mutants/.
+
+| Mutant | Change | Result |
+|---|---|---|
+| m1 | the send condition becomes `if (false)` | killed, 7 fail: the six close tests that expect a message, plus single-use's DECISION count |
+| m2 | `to_role` becomes `d.route_to` | killed, 6 fail: every close test that reads `to_role` or the coder's inbox |
+| m3 | the condition drops the run check, `if (op !== 'seen')` | killed, 1 fails: the raising run's withdraw test |
+
+All three were restored, and `git diff --stat` matched the candidate afterwards.
+
+## Gate
+
+gate.sh runs every package suite and every scripts/test-*.sh against the candidate worktree. GATE_PASSED at 16:43:58Z, 16:38:19 to 16:43:58. Log: gate-run.log, per-step logs under gate/.
+
+| Step | Pass |
+|---|---|
+| bus | 155 (148 at BASE, plus the 7 new) |
+| business | 67 |
+| cli | 184 |
+| control-board | 124 |
+| conversation | 182 |
+| discord | 178 |
+| harness | 81 (80 at BASE, plus the runner test) |
+| ledger | 86 |
+| mosaic | 69 |
+| queue | 156 |
+| runs | 43 |
+| seat | 120 |
+| tasks | 92 |
+| webui | 108 |
+| scripts | auth 15, conductor 17, config 24, discord 66, extension-package 18, foundation 44, queue 28 (node 156), release 14, task 98 |
+
+No failures and no flakes. The bwrap tester case passed (gate/pkg-seat.log:77).
+
+Sage saw a live managed coder session (`claude -p`, cwd ~/.mosaic-dev/workspaces/mosaic-stack/coder) run tests in its workspace at about 16:30Z, during their row 113 gate. My busy check now also flags test commands run from any process whose cwd is under ~/.mosaic-dev/workspaces/. It was clear before the mutants and before the gate, and a scan after the gate found no process with a cwd there. I can't rule out a short run between checks, but nothing failed.
+
+The release step created the `wt_default` Docker network at 16:43:10Z. It had 0 containers, and I removed it.
+
+## Going live
+
+This is a bus landing, so decision 109 applies. Mos gets a notice before and after landing. It goes live only through a stack copy, a re-pin and a bus restart on Mos's go. I start, stop and restart nothing.
diff --git a/agents/darkwing/work/queue-115/r1/build.patch b/agents/darkwing/work/queue-115/r1/build.patch
new file mode 100644
index 000000000..e4f33ab01
--- /dev/null
+++ b/agents/darkwing/work/queue-115/r1/build.patch
@@ -0,0 +1,362 @@
+diff --git a/packages/bus/README.md b/packages/bus/README.md
+index 7293f98db..4694e08b5 100644
+--- a/packages/bus/README.md
++++ b/packages/bus/README.md
+@@ -140,11 +140,11 @@ an operator inspect content and delivery evidence after an uncertain result.
+ | `role.release` | No args; only its current holder releases. |
+ | `role.revoke` | `{role,decision}`; needs human-approved gated decision for this exact target and holder incarnation. |
+ | `decision.raise` | `{action,question,options:[{key,text}],recommendation,blocking,domain?,target?,project?,task_ref?,requirement_ref?,supersedes?,choice?,approvalChoice?}`. Returns decision with decoded options and authorization context. A blocking decision holds a task: `blocking` true with no `task_ref` refuses `task-required`. A non-blocking one needs no task, and a gated action such as `prd.approve` or `role.revoke` still routes to the human's inbox. |
+-| `decision.resolve` | `{id,choice,note?}`; option must exist, resolver must be routed role or outside-agent human CLI. |
++| `decision.resolve` | `{id,choice,note?}`; option must exist, resolver must be routed role or outside-agent human CLI. Sends the raising role a DECISION message (Decision close messages, below). |
+ | `decision.seen` | `{id,note?}`; acknowledgement by resolver, not a resolution. |
+-| `decision.withdraw` | `{id,note?}`; raiser or human. Never rewrites the decision. |
++| `decision.withdraw` | `{id,note?}`; raiser or human. Never rewrites the decision. A human withdraw sends the raising role a DECISION message; the raising run's own withdraw sends none. |
+ | `message.send` | `{to,body,class?,in_reply_to?,corrects?,decision?}`; returns `{id,request}`. Human instruction's `request` is its `human.input` event ID. |
+-| `message.receive` | No args; up to 100 undelivered messages for current holder, including originating `request` for human instructions. |
++| `message.receive` | No args; up to 100 undelivered messages for current holder, including originating `request` for human instructions. A human decision close's message carries the close's `human.input` answer event as its `request`; a role close's has `null`. |
+ | `message.read` | `{id}`; recipient holder's acknowledgement; no new holder can acknowledge old holder's delivery. |
+ | `review.request` | `{task_ref,commit,to,note?,decision?}`; action `review.request` (row 93, #1587). `commit` must be the task's latest pushed commit: an older one refuses `stale-commit`, any other `unknown-commit`. `to` must be another role holding `review.verdict` (`unknown-role`, `self-review`, `not-a-reviewer`). Writes a `review.requested` event `{task_ref,project,ref,commit,to,message,held}` and sends `to` a REVIEW-REQUEST message naming it. `held` is the run id holding the `to` role when the request is routed (row 105, #1599), or `null` when no run holds it: the message then waits for a claim, and the requester should tell whoever launches roles. Returns `{request,message,commit,ref,held}`. |
+ | `review.verdict` | `{task_ref,request,verdict,body,decision?}`; action `review.verdict`. `verdict` is `approve` or `changes`. `request` must be a `review.requested` event on the task addressed to the caller's role (`request-not-found`), with no verdict yet (`verdict-exists`). Writes a `review.verdict` event `{task_ref,request,commit,verdict,message}` and sends the requesting role a REVIEW-RESULT in reply to the request's message. Returns `{verdict,message,commit}`. |
+@@ -250,6 +250,32 @@ an uncertain external outcome must not be retried with that approval. S3/S6
+ must implement their own external-operation identity and uncertain-outcome
+ handling. Raising/superseding and resolving are transactional.
+ 
++### Decision close messages (row 115, #1609)
++
++A `decision.resolve` or `decision.withdraw` by anyone but the raising run sends
++the raising role one message, written in the same transaction as the close, so
++a refused close sends nothing. It goes to `raised_by_role` with class
++`DECISION`, `decision` set to the decision's id, and no `in_reply_to` or
++`corrects`. A human close is sent `from_role 'human'`, `from_run 'human-cli'`;
++a role close is sent from the closing role and run. It is routed like
++`message.send`'s: to the role's current holder, or with no holder until the
++next claim routes it. The body is
++
++```
++Decision <id> on <action> was resolved by <by>: <choice> (<option text>).
++Decision <id> on <action> was withdrawn by <by>.
++```
++
++where `<by>` is the close's `decision_events.by` (the human's name or the
++closing run). A close with a note adds `Note: <note>` on its own line.
++
++No message goes out for `decision.seen`, for the raising run's own withdraw, for
++a supersede (also the raising run's withdraw), or for a within-role decision,
++which closes inside `decision.raise`. `message.receive` gives a human close's
++message the close's `human.input` answer event as its `request`, so the role's
++turn cites it as it cites a human instruction; a role close's `request` is
++`null`. The message also appears in the decision's `trail`.
++
+ ## Human and reader paths
+ 
+ `src/human-cli.mjs <socket>` is S4's transport shim, not another product CLI.
+diff --git a/packages/bus/src/broker.mjs b/packages/bus/src/broker.mjs
+index f4a39194f..4ab951135 100644
+--- a/packages/bus/src/broker.mjs
++++ b/packages/bus/src/broker.mjs
+@@ -889,6 +889,30 @@ export class Broker {
+             { kind: 'answer', decision: d.id, op, choice: a.choice ?? null },
+             d.id,
+           );
++        // Row 115 (#1609): a close by anyone but the raising run tells the raising role, routed like message.send's.
++        if (op !== 'seen' && (s.human || s.run !== d.raised_by_run)) {
++          const outcome =
++            op === 'resolved'
++              ? `resolved by ${by}: ${a.choice} (${JSON.parse(d.options).find((o) => o.key === a.choice).text})`
++              : `withdrawn by ${by}`;
++          const mid = randomUUID();
++          this.#store.run(
++            'INSERT INTO messages(id,at,business,from_role,from_run,to_role,class,in_reply_to,decision,corrects,body) VALUES(?,?,?,?,?,?,?,?,?,?,?)',
++            mid,
++            this.#now(),
++            s.business,
++            s.human ? 'human' : s.role,
++            s.human ? 'human-cli' : s.run,
++            d.raised_by_role,
++            'DECISION',
++            null,
++            d.id,
++            null,
++            `Decision ${d.id} on ${d.action} was ${outcome}.${a.note === undefined ? '' : `\nNote: ${a.note}`}`,
++          );
++          const h = this.#holder(s.business, d.raised_by_role);
++          this.#delivery(mid, 'routed', h?.op === 'claim' ? h : null);
++        }
+         return { id: d.id, op };
+       }
+       case 'message.send': {
+@@ -978,15 +1002,7 @@ export class Broker {
+             s.human || s.tester ? null : this.#holder(s.business, s.role),
+             s.human || s.tester ? 'cli' : 'broker',
+           );
+-        return rows.map((m) => ({
+-          ...m,
+-          request:
+-            this.#store.get(
+-              "SELECT id FROM events WHERE business=? AND kind='human.input' AND subject=? ORDER BY seq LIMIT 1",
+-              s.business,
+-              m.id,
+-            )?.id ?? null,
+-        }));
++        return rows.map((m) => ({ ...m, request: this.#request(s.business, m) }));
+       }
+       case 'message.read': {
+         keys(a, ['id'], ['id']);
+@@ -1292,6 +1308,24 @@ export class Broker {
+       decision,
+     );
+   }
++  // A message's originating human.input: a human instruction's own, or for the
++  // message a human decision close sends (row 115, #1609), the close's answer.
++  // A decision has one close, so the answer is unique.
++  #request(business, m) {
++    const own = this.#store.get(
++      "SELECT id FROM events WHERE business=? AND kind='human.input' AND subject=? ORDER BY seq LIMIT 1",
++      business,
++      m.id,
++    );
++    if (own || m.class !== 'DECISION' || m.from_role !== 'human' || !m.decision) return own?.id ?? null;
++    return (
++      this.#store.get(
++        "SELECT id FROM events WHERE business=? AND kind='human.input' AND subject=? AND json_extract(body,'$.kind')='answer' AND json_extract(body,'$.op') IN ('resolved','withdrawn') ORDER BY seq LIMIT 1",
++        business,
++        m.decision,
++      )?.id ?? null
++    );
++  }
+   // The message a review verb sends, routed like message.send's.
+   #reviewMessage(s, mid, { to, cls, in_reply_to = null, decision = null, body }) {
+     this.#store.run(
+diff --git a/packages/bus/tests/decision-close.test.mjs b/packages/bus/tests/decision-close.test.mjs
+new file mode 100644
+index 000000000..ee05c5349
+--- /dev/null
++++ b/packages/bus/tests/decision-close.test.mjs
+@@ -0,0 +1,165 @@
++// Row 115 (#1609): a decision closed by anyone but the raising run sends the
++// raising role a DECISION message in the same transaction as the close.
++import test from 'node:test';
++import assert from 'node:assert/strict';
++import { mkdtempSync, rmSync } from 'node:fs';
++import { tmpdir } from 'node:os';
++import { join } from 'node:path';
++import { Store } from '../src/store.mjs';
++import { Broker } from '../src/broker.mjs';
++
++const options = [
++  { key: 'yes', text: 'Allow' },
++  { key: 'no', text: 'Decline' },
++];
++const roles = {
++  pm: { authority: { withinRole: ['message.send'], crossRole: [] } },
++  cto: { authority: { withinRole: ['message.send'], crossRole: [] } },
++  coder: { authority: { withinRole: ['message.send'], crossRole: ['task.scope.change'] } },
++};
++const businesses = { demo: { id: 'demo', human: 'jason', arbiters: { technical: 'cto', delivery: 'pm' }, roles } };
++
++function setup(t) {
++  const root = mkdtempSync(join(tmpdir(), 'bus-decision-close-'));
++  const store = new Store(root);
++  const b = new Broker({ store, businesses });
++  t.after(() => {
++    store.close();
++    rmSync(root, { recursive: true, force: true });
++  });
++  const agent = (role, run = `${role}-run`) => {
++    const cap = b.bindLaunch({ business: 'demo', role, run, harness: 'pi', address: run });
++    b.request(cap, { verb: 'role.claim' });
++    return cap;
++  };
++  const human = b.bindHuman({ business: 'demo', human: 'jason', via: 'cli', outsideAgent: true });
++  const coder = agent('coder');
++  const cto = agent('cto');
++  const pm = agent('pm');
++  // Routed to cto (technical arbiter), to pm (delivery arbiter), and to the human (gated).
++  const toCto = raise(b, coder, 'task.scope.change', { domain: 'technical', target: 'vikunja:3/1' });
++  const toPm = raise(b, coder, 'task.scope.change', { domain: 'delivery', target: 'vikunja:3/2' });
++  const toHuman = raise(b, coder, 'deploy', { target: 'release-1', task_ref: 'vikunja:3/3', blocking: true });
++  assert.deepEqual([toCto.route_to, toPm.route_to, toHuman.route_to], ['cto', 'pm', 'human']);
++  return { b, store, agent, human, coder, cto, pm, toCto, toPm, toHuman };
++}
++const call = (b, cap, verb, args = {}) => b.request(cap, { verb, args });
++const raise = (b, cap, action, extra = {}) =>
++  call(b, cap, 'decision.raise', { action, question: `${action}?`, options, recommendation: 'no', blocking: false, ...extra });
++const closes = (store) => store.all("SELECT * FROM messages WHERE class='DECISION' ORDER BY seq");
++const deliveries = (store, mid) =>
++  store.all('SELECT op,holder_run,transport,address FROM deliveries WHERE message=? ORDER BY seq', mid).map((r) => ({ ...r }));
++const answer = (store, decision) =>
++  store.get("SELECT id FROM events WHERE kind='human.input' AND subject=? AND json_extract(body,'$.kind')='answer'", decision).id;
++
++test('a human resolve sends the raising role one message from the human, and its request is the answer', (t) => {
++  const { b, store, human, coder, toHuman } = setup(t);
++  call(b, human, 'decision.resolve', { id: toHuman.id, choice: 'no', note: 'not today' });
++  const [m, ...rest] = closes(store);
++  assert.equal(rest.length, 0);
++  const closed = store.get("SELECT by FROM decision_events WHERE decision=? AND op='resolved'", toHuman.id);
++  assert.equal(closed.by, 'jason');
++  assert.equal(m.business, 'demo');
++  assert.equal(m.from_role, 'human');
++  assert.equal(m.from_run, 'human-cli');
++  assert.equal(m.to_role, 'coder');
++  assert.equal(m.class, 'DECISION');
++  assert.equal(m.in_reply_to, null);
++  assert.equal(m.decision, toHuman.id);
++  assert.equal(m.corrects, null);
++  assert.equal(m.body, `Decision ${toHuman.id} on deploy was resolved by jason: no (Decline).\nNote: not today`);
++  // Routed to the coder's holder, as message.send routes.
++  assert.deepEqual(deliveries(store, m.id), [{ op: 'routed', holder_run: 'coder-run', transport: 'pi', address: 'coder-run' }]);
++  const [got] = call(b, coder, 'message.receive');
++  assert.equal(got.id, m.id);
++  assert.equal(got.request, answer(store, toHuman.id));
++  // The message joins the decision's trail.
++  assert.ok(call(b, human, 'trail', { subject: toHuman.id }).some((r) => r.table === 'messages' && r.id === m.id));
++});
++
++test('a cross-role decision resolved by its arbiter comes from that role and run, with no request', (t) => {
++  const { b, store, coder, cto, toCto } = setup(t);
++  call(b, cto, 'decision.resolve', { id: toCto.id, choice: 'yes' });
++  const [m, ...rest] = closes(store);
++  assert.equal(rest.length, 0);
++  assert.equal(m.from_role, 'cto');
++  assert.equal(m.from_run, 'cto-run');
++  assert.equal(m.to_role, 'coder');
++  assert.equal(m.decision, toCto.id);
++  // No note, so no Note line; by is the arbiter's run.
++  assert.equal(m.body, `Decision ${toCto.id} on task.scope.change was resolved by cto-run: yes (Allow).`);
++  const [got] = call(b, coder, 'message.receive');
++  assert.equal(got.id, m.id);
++  assert.equal(got.request, null);
++});
++
++test('a human withdraw sends one message with the note', (t) => {
++  const { b, store, human, coder, toPm } = setup(t);
++  call(b, human, 'decision.withdraw', { id: toPm.id, note: 'superseded by the plan\nsee #1609' });
++  const [m, ...rest] = closes(store);
++  assert.equal(rest.length, 0);
++  assert.equal(m.from_role, 'human');
++  assert.equal(m.to_role, 'coder');
++  assert.equal(m.body, `Decision ${toPm.id} on task.scope.change was withdrawn by jason.\nNote: superseded by the plan\nsee #1609`);
++  const [got] = call(b, coder, 'message.receive');
++  assert.equal(got.request, answer(store, toPm.id));
++});
++
++test("the raising run's withdraw, a supersede, a within-role raise and seen send nothing", (t) => {
++  const { b, store, human, coder, cto, toCto, toPm, toHuman } = setup(t);
++  call(b, coder, 'decision.withdraw', { id: toPm.id, note: 'not needed' });
++  raise(b, coder, 'task.scope.change', { domain: 'technical', target: 'vikunja:3/1', supersedes: toCto.id });
++  raise(b, coder, 'message.send', { choice: 'yes' });
++  const late = raise(b, coder, 'task.scope.change', { domain: 'technical', target: 'vikunja:3/4' });
++  call(b, cto, 'decision.seen', { id: late.id, note: 'looking' });
++  call(b, human, 'decision.seen', { id: toHuman.id });
++  // Three withdrawals or closes and two seen rows, and no DECISION message.
++  assert.equal(store.get("SELECT count(*) AS n FROM decision_events WHERE op IN ('withdrawn','resolved')").n, 3);
++  assert.equal(store.get("SELECT count(*) AS n FROM decision_events WHERE op='seen'").n, 2);
++  assert.deepEqual(closes(store), []);
++  assert.deepEqual(call(b, coder, 'message.receive'), []);
++});
++
++test('refused closes send nothing: invalid-choice, decision-closed, not-resolver', (t) => {
++  const { b, store, human, coder, cto, pm, toCto, toPm, toHuman } = setup(t);
++  assert.throws(() => call(b, human, 'decision.resolve', { id: toHuman.id, choice: 'maybe' }), /invalid-choice/);
++  assert.throws(() => call(b, pm, 'decision.resolve', { id: toCto.id, choice: 'yes' }), /not-resolver/);
++  assert.throws(() => call(b, cto, 'decision.withdraw', { id: toCto.id }), /not-resolver/);
++  assert.deepEqual(closes(store), []);
++  call(b, pm, 'decision.resolve', { id: toPm.id, choice: 'no' });
++  assert.equal(closes(store).length, 1);
++  assert.throws(() => call(b, pm, 'decision.resolve', { id: toPm.id, choice: 'yes' }), /decision-closed/);
++  assert.throws(() => call(b, human, 'decision.withdraw', { id: toPm.id }), /decision-closed/);
++  assert.equal(closes(store).length, 1);
++  assert.equal(call(b, coder, 'message.receive').length, 1);
++});
++
++test('a raising role nobody holds at the close gets the message on the next claim', (t) => {
++  const { b, store, agent, human, coder, toHuman } = setup(t);
++  call(b, coder, 'role.release');
++  call(b, human, 'decision.resolve', { id: toHuman.id, choice: 'yes' });
++  const [m] = closes(store);
++  assert.deepEqual(deliveries(store, m.id), [{ op: 'routed', holder_run: null, transport: null, address: null }]);
++  const next = agent('coder', 'coder-run-2');
++  assert.deepEqual(deliveries(store, m.id).at(-1), { op: 'routed', holder_run: 'coder-run-2', transport: 'pi', address: 'coder-run-2' });
++  const [got] = call(b, next, 'message.receive');
++  assert.equal(got.id, m.id);
++  assert.equal(got.body, `Decision ${toHuman.id} on deploy was resolved by jason: yes (Allow).`);
++  assert.equal(got.request, answer(store, toHuman.id));
++  assert.equal(deliveries(store, m.id).at(-1).op, 'delivered');
++});
++
++test("a human DECISION send keeps its own instruction as the request, not a close's answer", (t) => {
++  const { b, store, human, coder, toHuman } = setup(t);
++  call(b, human, 'decision.resolve', { id: toHuman.id, choice: 'no' });
++  const sent = call(b, human, 'message.send', { to: 'coder', body: 'about that', class: 'DECISION', decision: toHuman.id });
++  const got = call(b, coder, 'message.receive');
++  assert.deepEqual(
++    got.map((m) => [m.from_role, m.request]),
++    [
++      ['human', answer(store, toHuman.id)],
++      ['human', sent.request],
++    ],
++  );
++  assert.notEqual(sent.request, answer(store, toHuman.id));
++});
+diff --git a/packages/bus/tests/single-use.test.mjs b/packages/bus/tests/single-use.test.mjs
+index 00aed1d99..65e36292d 100644
+--- a/packages/bus/tests/single-use.test.mjs
++++ b/packages/bus/tests/single-use.test.mjs
+@@ -216,7 +216,9 @@ test('message.send consumes approval and prevents a later send or authorize', (t
+     /decision-consumed/,
+   );
+   assert.throws(() => f.use(d), /decision-consumed/);
+-  assert.equal(f.store.get('SELECT count(*) AS n FROM messages').n, 1);
++  // The approval's close sent the raiser one DECISION message (row 115, #1609); one send got through.
++  assert.equal(f.store.get("SELECT count(*) AS n FROM messages WHERE class='DECISION'").n, 1);
++  assert.equal(f.store.get("SELECT count(*) AS n FROM messages WHERE class<>'DECISION'").n, 1);
+   const fresh = f.approve('message.send', 'delivery', 'pm');
+   f.use(fresh);
+   assert.throws(
+diff --git a/packages/harness/tests/runner.test.mjs b/packages/harness/tests/runner.test.mjs
+index 896e5bafa..29d17af4b 100644
+--- a/packages/harness/tests/runner.test.mjs
++++ b/packages/harness/tests/runner.test.mjs
+@@ -266,6 +266,42 @@ test("a message read a day after it was sent shows the time it was sent", async
+   assert.ok(Date.parse(reply.at) - Date.parse(sentAt) >= 86_000_000);
+ });
+ 
++// Row 115 (#1609): the human closing the role's decision gives the role a turn. The runner is unchanged;
++// the header cites the decision and the close's human.input answer as the request.
++test("a decision the human resolves becomes a turn citing the decision and the answer", async (t) => {
++  const ctx = await setup(t);
++  const r = startRunner(ctx.runDir, ctx.cap);
++  t.after(() => r.child.kill("SIGKILL"));
++  await until(() => ctx.store.get("SELECT 1 FROM role_claims WHERE role='coder' AND op='claim'"));
++  const d = ctx.call(ctx.cap, "decision.raise", {
++    action: "deploy",
++    target: "release-1",
++    question: "Ship release-1?",
++    options: [{ key: "yes", text: "Allow" }, { key: "no", text: "Decline" }],
++    recommendation: "yes",
++    blocking: false,
++  });
++  assert.equal(d.route_to, "human");
++  ctx.call(ctx.human, "decision.resolve", { id: d.id, choice: "yes" });
++  const m = ctx.store.get("SELECT id,at FROM messages WHERE class='DECISION' AND decision=?", d.id);
++  const answer = ctx.store.get("SELECT id FROM events WHERE kind='human.input' AND subject=?", d.id).id;
++  const [reply] = await until(() => {
++    const got = ctx.call(ctx.human, "message.receive");
++    return got.length ? got : null;
++  });
++  assert.equal(reply.from_role, "coder");
++  assert.equal(reply.class, "RESULT");
++  assert.equal(reply.in_reply_to, m.id);
++  assert.ok(
++    reply.body.endsWith(
++      `\nMessage ${m.id} from human, sent ${m.at}, class DECISION, citing decision ${d.id}, request ${answer}:\n\n` +
++        `Decision ${d.id} on deploy was resolved by jason: yes (Allow).`,
++    ),
++    reply.body,
++  );
++  await until(() => ctx.store.get("SELECT 1 FROM deliveries WHERE message=? AND op='read'", m.id));
++});
++
+ test("a failed state read fails the turn: no adapter runs, the sender hears why, the message is read", async (t) => {
+   const ctx = await setup(t);
+   ctx.inbox = [];
diff --git a/agents/darkwing/work/queue-115/r1/candidate-manifest.sha256 b/agents/darkwing/work/queue-115/r1/candidate-manifest.sha256
new file mode 100644
index 000000000..947b3c1a7
--- /dev/null
+++ b/agents/darkwing/work/queue-115/r1/candidate-manifest.sha256
@@ -0,0 +1,5 @@
+f10e2d5f42e6d74b5be21e7bcabe20fd9e0bd2252aab924a5843e57551d30a38  packages/bus/README.md
+92a90ffdca975100f9dca9d5bc38a8fc924008a006e6f3b088d1473bbcbb2a3d  packages/bus/src/broker.mjs
+36b9ae4abc922f8a23d01f953959954f8d7b3ad4960423dd28f6e52d0e601ab4  packages/bus/tests/decision-close.test.mjs
+bbc2cbaac792633ae52382f5a557ce11fba483a5031363902d5b3a1bb9fa7095  packages/bus/tests/single-use.test.mjs
+0c6526ff3898f3f8c0cde14477f0648d705bcc522e9e6f263615cc4e658a462a  packages/harness/tests/runner.test.mjs
diff --git a/agents/darkwing/work/queue-115/r1/gate-run.log b/agents/darkwing/work/queue-115/r1/gate-run.log
new file mode 100644
index 000000000..da2611f54
--- /dev/null
+++ b/agents/darkwing/work/queue-115/r1/gate-run.log
@@ -0,0 +1,25 @@
+base 94ece491f DOCKER_HOST=unset docker=29.7.2 start 16:38:19
+pkg-bus rc=0 16:38:19-16:38:23 ℹ pass 155 ℹ fail 0 ℹ skipped 0  | ℹ duration_ms 4087.780627
+pkg-business rc=0 16:38:23-16:38:25 ℹ pass 67 ℹ fail 0 ℹ skipped 0  | ℹ duration_ms 1773.154237
+pkg-cli rc=0 16:38:25-16:38:44 ℹ pass 184 ℹ fail 0 ℹ skipped 0  | ℹ duration_ms 19086.166336
+pkg-control-board rc=0 16:38:44-16:38:45 ℹ pass 124 ℹ fail 0 ℹ skipped 0  | ℹ duration_ms 603.603165
+pkg-conversation rc=0 16:38:45-16:39:32 ℹ pass 182 ℹ fail 0 ℹ skipped 0  | ℹ duration_ms 47342.392526
+pkg-discord rc=0 16:39:32-16:39:35 ℹ pass 178 ℹ fail 0 ℹ skipped 0  | ℹ duration_ms 2586.926055
+pkg-harness rc=0 16:39:35-16:39:46 ℹ pass 81 ℹ fail 0 ℹ skipped 0  | ℹ duration_ms 11325.495606
+pkg-ledger rc=0 16:39:46-16:40:09 ℹ pass 86 ℹ fail 0 ℹ skipped 0  | ℹ duration_ms 22335.042077
+pkg-mosaic rc=0 16:40:09-16:40:11 ℹ pass 69 ℹ fail 0 ℹ skipped 0  | ℹ duration_ms 2095.007421
+pkg-queue rc=0 16:40:11-16:40:40 ℹ pass 156 ℹ fail 0 ℹ skipped 0  | ℹ duration_ms 28822.991906
+pkg-runs rc=0 16:40:40-16:40:40 ℹ pass 43 ℹ fail 0 ℹ skipped 0  | ℹ duration_ms 729.609106
+pkg-seat rc=0 16:40:40-16:40:46 ℹ pass 120 ℹ fail 0 ℹ skipped 0  | ℹ duration_ms 5023.994749
+pkg-tasks rc=0 16:40:46-16:40:51 ℹ pass 92 ℹ fail 0 ℹ skipped 0  | ℹ duration_ms 5410.017552
+pkg-webui rc=0 16:40:51-16:41:46 ℹ pass 108 ℹ fail 0 ℹ skipped 0  | ℹ duration_ms 54655.660789
+script-auth rc=0 16:41:46-16:41:46  | selftest: 15 passed, 0 failed
+script-conductor rc=0 16:41:46-16:41:52  | selftest: 17 passed, 0 failed
+script-config rc=0 16:41:52-16:41:53  | selftest: 24 passed, 0 failed
+script-discord rc=0 16:41:53-16:42:00  | discord suite: 66 passed, 0 failed
+script-extension-package rc=0 16:42:00-16:42:01  | extension package selftest: 18 passed, 0 failed
+script-foundation rc=0 16:42:01-16:42:37  | selftest: 44 passed, 0 failed
+script-queue rc=0 16:42:38-16:43:09 ℹ pass 156 ℹ fail 0  | queue suite: 28 passed, 0 failed
+script-release rc=0 16:43:09-16:43:22  | selftest: 14 passed, 0 failed
+script-task rc=0 16:43:22-16:43:58  | selftest: 98 passed, 0 failed
+GATE_PASSED 16:43:58
diff --git a/agents/darkwing/work/queue-115/r1/gate.sh b/agents/darkwing/work/queue-115/r1/gate.sh
new file mode 100755
index 000000000..1fa6bb61d
--- /dev/null
+++ b/agents/darkwing/work/queue-115/r1/gate.sh
@@ -0,0 +1,20 @@
+#!/bin/bash
+set -o pipefail
+# Darkwing gate, row 115 (#1609), candidate in the r115 worktree on base 94ece491f.
+# Every package's node suite, then every scripts/test-*.sh, sequential, each
+# teed to its own log; stops at the first failure.
+G=$HOME/darkwing-scratch/r115/wt
+OUT=$HOME/darkwing-scratch/r115/gate
+export TMPDIR=$HOME/darkwing-scratch/r115/tmp
+mkdir -p "$OUT" "$TMPDIR"
+cd "$G" || exit 9
+[ -e "$G/node_modules" ] || { echo "STOP no node_modules in $G"; exit 8; }
+echo "base $(git rev-parse --short HEAD) DOCKER_HOST=${DOCKER_HOST:-unset} docker=$(docker info --format '{{.ServerVersion}}' 2>/dev/null || echo none) start $(date -u +%H:%M:%S)"
+run() { local name="$1" dir="$2" cmd="$3" t0; t0=$(date -u +%H:%M:%S)
+  (cd "$G/$dir" && bash -c "$cmd") 2>&1 | tee "$OUT/$name.log" > /dev/null; local rc=$?
+  echo "$name rc=$rc $t0-$(date -u +%H:%M:%S) $(grep -E '^ℹ (pass|fail|skipped) [0-9]+' "$OUT/$name.log" | tr '\n' ' ') | $(tail -n1 "$OUT/$name.log")"
+  [ $rc -eq 0 ] || { echo "STOP $name"; exit $rc; }; }
+for d in packages/*/; do p=$(basename "$d"); [ -d "$d/tests" ] || continue
+  run "pkg-$p" "packages/$p" 'node --test tests/*.test.mjs'; done
+for s in scripts/test-*.sh; do n=$(basename "$s" .sh); run "script-${n#test-}" . "bash $s"; done
+echo "GATE_PASSED $(date -u +%H:%M:%S)"
diff --git a/agents/darkwing/work/queue-115/r1/gate/pkg-bus.log b/agents/darkwing/work/queue-115/r1/gate/pkg-bus.log
new file mode 100644
index 000000000..5ab47cdc1
--- /dev/null
+++ b/agents/darkwing/work/queue-115/r1/gate/pkg-bus.log
@@ -0,0 +1,163 @@
+✔ agents: a held role with nothing on the bus is idle; a role session gets the claim rows unchanged (120.741614ms)
+✔ agents: working counts what the holder received and has not read; routed alone is not working (216.44915ms)
+✔ agents: input needed is the role's open decisions routed to the human, gated first, then oldest (322.386723ms)
+✔ agents: working wins over waiting, and Input needed still shows (176.134969ms)
+✔ agents: a new holder doesn't inherit what the last one left unread; decisions stay with the role (212.903592ms)
+✔ agents: state reads only its own business, even for a run name both use (192.078922ms)
+✔ agents: a message the holder released unread is stranded; the next holder gets nothing and cannot read it (220.926197ms)
+✔ agents: a message the holder read is not stranded; one the current holder has not read is not listed (220.000119ms)
+✔ agents: stranded is oldest first and capped at 50 for a role (833.229819ms)
+✔ agents: stranded is per role and per business (302.646132ms)
+✔ agents: a message routed to a held role and not yet received is not stranded (139.303456ms)
+✔ launch identity is stamped, payload identity is refused and stale holder cannot send (151.637057ms)
+✔ decision classes route from policy; gated resolution is human-only, choice and target must match (277.277091ms)
+✔ claim exclusion, holder release, gated revoke and rerouting to a new holder are atomic (272.248368ms)
+✔ launch events require a human CLI capability; generic emit cannot forge authority events (186.129605ms)
+✔ within-role decisions close atomically and invalid options or blocking omissions refuse (185.14576ms)
+✔ a recommendation that is not exactly one option key refuses invalid-recommendation after the options (272.431562ms)
+✔ observer capabilities read human inbox but cannot mutate or forge launch identity (185.955157ms)
+✔ task action subjects and linked decision trail are complete and ordered (205.490136ms)
+✔ launch binding is durable and reconnecting requires the identical trusted record (114.213605ms)
+✔ business isolation includes inherited object names and cross-business message references (195.467102ms)
+✔ authority never transfers between action, run, target, unresolved or replaced role holder (264.937799ms)
+✔ task projection uses schema current view, skipping earlier and equal-start polls (127.628652ms)
+✔ revocation permanently bars the old run from reclaiming first, including after broker restart (208.256241ms)
+✔ empty message references refuse before storage; refusal-evidence failure stays a typed error (128.10388ms)
+✔ both arbiters require human resolution when their cross-role route is themselves (256.098379ms)
+✔ the shipped coder role raises task.reassign as gated to the human; task.scope.change stays cross-role (125.759088ms)
+✔ S1 adapter takes resolved limits and refs, rejects mismatched instance, never mutates input (2.427412ms)
+✔ credentials gives human and reader sessions service, account, role, date and state, and nothing else (104.719757ms)
+✔ credentials refuses a role session and any argument (160.344342ms)
+✔ credentials reads the status on each request, and a broker without one lists none (221.814276ms)
+✔ the broker process answers credentials without a token, path or variable in its output, log or store (187.400833ms)
+✔ only validated broker references load; returned data and exceptions cannot expose a known token (4.905933ms)
+✔ bad file modes, symlinks, repository/data paths, malformed tokens and missing dates refuse (3.227716ms)
+✔ expiry refuses use and env references never become client data (0.978361ms)
+✔ S1 parsed service refs work, service mismatch refuses, Gitea rotation due is a warning state (1.930729ms)
+✔ opaque tokens shorter than 16 characters refuse before use (0.403931ms)
+✔ a human resolve sends the raising role one message from the human, and its request is the answer (237.901045ms)
+✔ a cross-role decision resolved by its arbiter comes from that role and run, with no request (246.634758ms)
+✔ a human withdraw sends one message with the note (234.426188ms)
+✔ the raising run's withdraw, a supersede, a within-role raise and seen send nothing (285.428751ms)
+✔ refused closes send nothing: invalid-choice, decision-closed, not-resolver (303.907882ms)
+✔ a raising role nobody holds at the close gets the message on the next claim (286.34199ms)
+✔ a human DECISION send keeps its own instruction as the request, not a close's answer (243.046984ms)
+✔ roles lists open decisions routed to a role, and never the human inbox (216.566121ms)
+✔ recent lists closed decisions of every route, newest close first, with how each closed (292.963693ms)
+✔ recent gives the closing event as closed when the decision was seen first (298.170034ms)
+✔ recent stops at RECENT rows (810.273821ms)
+✔ every row is what trail already gives the same session for that id (272.803342ms)
+✔ a role session can't list decisions, so it can't read another role's open decisions (397.499069ms)
+✔ decisions is a read: one business, strict arguments, nothing written (350.985478ms)
+✔ endLaunch writes session.ended, releases the run claim and kills its capabilities (126.412269ms)
+✔ endLaunch refuses an unknown run, a second end and a rebind of the ended run (137.371877ms)
+✔ a restarted broker refuses to rebind an ended run; a refused rebind leaves the run unbound (156.715207ms)
+✔ endLaunch leaves a claim another run took alone (176.233022ms)
+✔ refuse records action.refused against the caller with the code only (141.053814ms)
+✔ launches off refuses role.launch with launch-revoked until launches on (186.698161ms)
+✔ broker process: launch ops authorize role.launch, record refusals and end runs (279.714844ms)
+✔ human proof binds CLI entry, process start and nonce; agents and incomplete ancestry refuse (2.467111ms)
+✔ process reader gets own kernel identity without exposing environment values (0.60575ms)
+✔ EACCES ancestor environments skip only markers; commands and registered launches still refuse (0.734712ms)
+✔ real pid 1 remains inspectable when its environment is protected (0.277733ms)
+✔ within-role sends cite an open gated launch decision without spending it or naming it in grants (190.50466ms)
+✔ missing and foreign-business citations refuse and roll back message and grant (199.38293ms)
+✔ cross-role sends still need a matching resolved decision and consume it once (250.991262ms)
+✔ messages pages all human messages newest first without writes; read state is history (2558.846571ms)
+✔ messages refuses role callers, invalid paging and cursors outside this human feed (237.738914ms)
+✔ views messages passes only its paging arguments through (0.267177ms)
+✔ messages isolates businesses even with a valid foreign cursor (171.367993ms)
+✔ broker process binds trusted launches, offers reader capabilities, refuses human mutation, closes cleanly (161.362715ms)
+✔ startup token refusal returns safe code without value or partial listening broker (38.65995ms)
+✔ loaded fixture token is absent from socket replies and SQLite, including refusal evidence (190.322324ms)
+✔ killed broker leaves an explicit stale lock; another process cannot silently reclaim it (167.789433ms)
+✔ trusted host registers later launches; socket clients never have a registration verb (185.819574ms)
+✔ runtime excludes declared project roots even when host supplies no repoRoots (38.431574ms)
+✔ a refused launch binding leaves the broker and existing capabilities alive; bad protocol stops it (182.635054ms)
+✔ a reply is listed for human and reader sessions, and its delivery rows are unchanged (225.69831ms)
+✔ the reply still reaches the human message.receive (mosaic talk) after the Console showed it (211.674091ms)
+✔ a message with no reply gives an empty list (166.151051ms)
+✔ replies come oldest first and stop at REPLIES (760.089844ms)
+✔ an id that names no message in the business refuses message-not-found, and the refusal is recorded (316.306433ms)
+✔ strict arguments; a role session gets human-required (375.304595ms)
+✔ views passes replies through as one call with the id (0.254517ms)
+✔ requirements returns the committed list to a holding role session, and no one else (214.486073ms)
+✔ the PM's prd.approve with no task, when no id fits, reaches the human's Inbox (154.253835ms)
+✔ the PM's non-blocking role.revoke with no task reaches the human's Inbox (183.935442ms)
+✔ a push is recorded as the action.allowed for git.push.working on the task, and only the host records one (240.808768ms)
+✔ review.request names the latest pushed commit and sends the reviewer a REVIEW-REQUEST (239.899804ms)
+✔ review.request says which run holds the reviewer role, or null, and a null request waits for a claim (290.656541ms)
+✔ review.request refuses a commit that isn't the latest push, a non-reviewer and a role without the action (368.907225ms)
+✔ reviewFetch answers only the addressed reviewer, for the request it cites (262.931839ms)
+✔ review.verdict answers one request once, to the role that asked (314.166805ms)
+✔ task.close on a pushed task needs an approve verdict for the latest push (362.110696ms)
+✔ a refusal the host decided is filed on the task it names, and only a task ref counts (236.94171ms)
+✔ v3b prototype refusals, views and append-only mutations (1067.591725ms)
+✔ gated approval authorizes once, survives store reopen, and fresh approval works (265.008379ms)
+✔ another run cannot consume an approval; a failed check leaves it usable (226.682563ms)
+✔ two scheduled callers have exactly one grant and one consumed refusal (168.140324ms)
+✔ failed commit rolls consumption back; cross-role consumes and within-role stays reusable (314.673193ms)
+✔ class drift gated to cross-role refuses before consumption (233.247768ms)
+✔ class drift cross-role to gated refuses before consumption (266.257722ms)
+✔ class drift gated to within-role refuses before consumption (235.195742ms)
+✔ class drift cross-role to within-role refuses before consumption (240.727751ms)
+✔ class drift within-role to gated refuses before consumption (215.259495ms)
+✔ class drift within-role to cross-role refuses before consumption (184.923922ms)
+✔ message.send consumes approval and prevents a later send or authorize (206.318222ms)
+✔ role.revoke consumes approval and prevents a later revoke or authorize (229.897401ms)
+✔ a business that never switched launches reads allowed with no time and no event (126.928893ms)
+✔ launches revoked and then restored read allowed, with the restore time and event id (157.967115ms)
+✔ a task closed on the tracker leaves the open list, and total counts the open ones (166.588096ms)
+✔ a tombstone is not open (142.824106ms)
+✔ the open list stops at the cap and says so; total still counts every open task (147.954464ms)
+✔ a role and a reader session read state; arguments, and an unbound cap, refuse (139.804033ms)
+✔ a human session reads the same state, with the same cap (149.174306ms)
+✔ reading state writes nothing: every table keeps its row count (152.126117ms)
+✔ creates private WAL store and excludes a second writer until explicit close (133.590482ms)
+✔ rollback is atomic and schema metadata is checked against trusted DDL, not just itself (160.044981ms)
+✔ existing empty database and symlink runtime directory refuse, never initialize over damage (195.359351ms)
+✔ crash during a transaction recovers no partial event after explicit fixture-only lock removal (184.330648ms)
+✔ writer refuses mixed at/read_at forms atomically, even through trusted SQL helpers (113.296111ms)
+✔ async transactions refuse before invoking their function (110.41787ms)
+✔ the session default fits under the reply cap and pages to the end with next (283.428017ms)
+✔ the short form: no description, assignees by role, every listed key (279.164438ms)
+✔ each filter, alone and together, and total counts every match (333.971382ms)
+✔ task_ref reads one task in full, as the whole board has it (295.677529ms)
+✔ no arguments is the read the Console and mosaic make, unchanged (238.907198ms)
+✔ an unknown argument or a bad value refuses invalid-request (889.396757ms)
+✔ tasks rows carry priority and requirement for every session that reads tasks (306.612894ms)
+✔ the read model rebuilds from the ledger: a reopened bus and each trail give the same values (348.746753ms)
+✔ an empty business and one with snapshots but no task.created read cleanly (136.997757ms)
+✔ recordTask keeps sync reads and a role write apart (183.994811ms)
+✔ read_at must be one canonical UTC format, so the projection compares strings safely (112.220551ms)
+✔ a bad entry refuses the whole record (130.098781ms)
+✔ taskView reads the projection for one business (138.282612ms)
+✔ requestTask hands only a holder and a task verb to the handler, and records refusals (246.13935ms)
+✔ the server sends task verbs to the adapter with its own timeout; other verbs stay synchronous (415.167724ms)
+✔ without an adapter the server refuses every task verb (197.055319ms)
+✔ the runtime refuses an invalid adapter and closes a valid one (206.451841ms)
+✔ the process loads the S3 adapter from plain-data trackers (240.351448ms)
+✔ the tester binds only when the business sets bus.tester to exactly true (807.363623ms)
+✔ a business may not name a role tester, so the tester address is never a role (237.882947ms)
+✔ every verb outside the tester list refuses tester-refused and is recorded against the tester (513.000491ms)
+✔ a tester message is from tester, starts [mos test], and writes no human.input or authority (203.055271ms)
+✔ a role answers a tester only in reply to a tester message, and the answer never reaches the human (248.889008ms)
+✔ the tester reads the human views a reader reads (72.305115ms)
+✔ tester proof binds its own CLI, start time and nonce, refuses a managed run and allows an agent (1.169518ms)
+✔ neither CLI's nonce proves the other: each proof is bound to its own CLI and nonce variable (0.357143ms)
+✔ testerNonce reads only the tester's variable and gives null on any read error (0.218528ms)
+✔ an envelope carries exactly one of cap, human and tester; no tester authenticator refuses (50.291387ms)
+✔ tester-cli.mjs binds through the runtime when the switch is on, and refuses off or under a run marker (708.699628ms)
+✔ socket capability stamps launch identity; shared views use wire, no SQL client (152.608116ms)
+✔ two wire claims serialize; a lost reply never automatically retries (200.641676ms)
+✔ malformed, oversized and identity-forging envelopes refuse without echoing input (121.062754ms)
+✔ client preserves UTF-8 when a response divides a multibyte character (12.374816ms)
+✔ committed mutation followed by dropped reply reports unknown and is never retried (149.975006ms)
+ℹ tests 155
+ℹ suites 0
+ℹ pass 155
+ℹ fail 0
+ℹ cancelled 0
+ℹ skipped 0
+ℹ todo 0
+ℹ duration_ms 4087.780627
diff --git a/agents/darkwing/work/queue-115/r1/gate/pkg-business.log b/agents/darkwing/work/queue-115/r1/gate/pkg-business.log
new file mode 100644
index 000000000..b18a3f483
--- /dev/null
+++ b/agents/darkwing/work/queue-115/r1/gate/pkg-business.log
@@ -0,0 +1,75 @@
+✔ config directory and file path follow MOSAIC_CONFIG (1.641148ms)
+✔ the fixture business validates and comes back frozen (4.792592ms)
+✔ two instances may share a definition (1.577505ms)
+✔ top-level refusals (4.935513ms)
+✔ arbiters and projects (5.87015ms)
+✔ role instances (2.257275ms)
+✔ Vikunja bots (4.915718ms)
+✔ a role without Vikunja takes no tracker block (1.744026ms)
+✔ credential references match the definition's services (2.11483ms)
+✔ launch (6.289798ms)
+✔ loadBusiness: file checks (1.53655ms)
+✔ loadBusiness: not a regular file (34.570244ms)
+✔ loading writes nothing (0.966015ms)
+✔ names that are Object.prototype properties don't count as declared (2.63967ms)
+✔ the shipped example refuses as written and validates once filled in (0.490974ms)
+✔ the role file loads and resolves through loadBusiness (4.448924ms)
+✔ the shipped file is exactly decision 104's list (0.575773ms)
+✔ the resolved record matches decision 104, so a widened file fails (1.307093ms)
+✔ message.send is within role and every other action is gated (1.13134ms)
+✔ a business grant of a gated action through limits does not widen the role (1.051741ms)
+✔ a launch block whose by is the chief-of-staff instance is refused (1.212131ms)
+✔ the instance takes no credential references and no tracker (1.911604ms)
+✔ usage errors exit 4 (260.372252ms)
+✔ validate: a good business exits 0 and prints instance digests (61.042053ms)
+✔ validate: project files (301.741259ms)
+✔ validate: missing files and a broken system config (238.907974ms)
+✔ validate: credential reference problems exit 2 and name each one (63.01813ms)
+✔ validate: a token file inside the repository is refused (61.414239ms)
+✔ validate: role definitions come from MOSAIC_ROLES_DIR (184.880101ms)
+✔ resolve: prints one instance's record (181.904715ms)
+✔ resolve: refusals (363.520943ms)
+✔ parse: exactly one of file or env, plus the service's date (1.89229ms)
+✔ check: a good file has no problems (0.595431ms)
+✔ check never opens the file: a write-only token passes (0.254356ms)
+✔ check: file problems (0.820397ms)
+✔ check: token files can't live in the repository or dataRoot, even through a linked directory (0.641292ms)
+✔ check: dates and environment references (0.307545ms)
+✔ path and load (1.669451ms)
+✔ refusals (1.129667ms)
+✔ systemVars flattens the validated config (2.267452ms)
+✔ precedence: system, business, project, project role, agent (5.645555ms)
+✔ limits narrow the definition and never widen it (2.606385ms)
+✔ role.launch stays within-role only for the instance the launch block names (4.197309ms)
+✔ limits.authority without role.launch leaves the launcher with no launch block (1.433556ms)
+✔ limits.authority narrows cross-role actions too (0.897219ms)
+✔ classify (0.91406ms)
+✔ the record carries what the broker and launcher need (0.809994ms)
+✔ digest: key order doesn't matter, any value change does (4.564885ms)
+✔ refusals (1.771515ms)
+✔ the four shipped version 2 roles load (2.590006ms)
+✔ shipped role scopes match addendum B section 2 and the SR runbook (1.162349ms)
+✔ shipped authority follows the note's table (0.712597ms)
+✔ version 1 files keep loading with no authority (1.025395ms)
+✔ the conductor policy isn't a role (0.169204ms)
+✔ a missing role file is exit 4, a symbolic link too (0.307234ms)
+✔ version 2 refusals (0.964376ms)
+✔ authority: closed vocabulary, no gated-only action, no overlap (1.592392ms)
+✔ credentials: Gitea scopes (0.641233ms)
+✔ credentials: Vikunja scopes are a group-to-verbs map from the grantable list (0.88756ms)
+✔ credentials: services (0.492108ms)
+✔ contract: a non-empty regular Markdown file beside the role file (0.547781ms)
+✔ every key names known layers and a merge rule (0.938488ms)
+✔ unknown keys and wrong layers refuse (0.798106ms)
+✔ types (2.136152ms)
+✔ merge: defaults, then the most specific layer wins (0.319593ms)
+✔ merge: limits only narrow, and provenance lists each source (0.399099ms)
+✔ merge doesn't change its inputs (0.164262ms)
+ℹ tests 67
+ℹ suites 0
+ℹ pass 67
+ℹ fail 0
+ℹ cancelled 0
+ℹ skipped 0
+ℹ todo 0
+ℹ duration_ms 1773.154237
diff --git a/agents/darkwing/work/queue-115/r1/gate/pkg-cli.log b/agents/darkwing/work/queue-115/r1/gate/pkg-cli.log
new file mode 100644
index 000000000..3f7199d37
--- /dev/null
+++ b/agents/darkwing/work/queue-115/r1/gate/pkg-cli.log
@@ -0,0 +1,194 @@
+✔ every screen and overlay fits 120x36, 80x24 and the narrow layout, row for row (1286.893351ms)
+✔ width counts terminal cells: wide CJK and emoji 2, U+FE0F after a one-cell base 1, marks 0 (74.357526ms)
+✔ broker text is shown, never interpreted: no raw control character or bidi override reaches the terminal (181.929359ms)
+✔ NO_COLOR: no escape codes, except reverse video on the selected row (274.131846ms)
+✔ 1-9 shows the decide flow's own lines and question; only y resolves (155.230513ms)
+✔ the app shows the same decide text as mosaic decide (118.386952ms)
+✔ any key but y or Y at the question answers No; nothing is sent (2143.243036ms)
+✔ below 40x10 the question is hidden, so every key answers it No, y included (Filbert R3) (499.485554ms)
+✔ under 40 columns a tall terminal shows the too-small screen even where the decide box would fit; y sends nothing (Filbert N10) (1624.476498ms)
+✔ a hidden decide box names the way out, and the status line under it does not promise y (Filbert N12) (115.007871ms)
+✔ a throw while answering the question goes to crash, sends nothing and leaves no job pending (155.893642ms)
+✔ type-ahead never answers the question: a paste, keys typed before it is drawn, keys inside askMs (967.285588ms)
+✔ quitting at the question answers No and sends nothing, armed or not (208.900787ms)
+✔ a timer tick reads nothing under an overlay, never answers the question, and keeps a resolved status (127.801759ms)
+✔ a long question is cut inside the question; the action, target, choice and prompt stay (Dewey B1) (134.566796ms)
+✔ a decide box too big for the terminal says so, and every key answers it No, y included (Dewey B1, round 3) (947.06211ms)
+✔ at every size the decide box shows each line y depends on, or says it is hidden (9015.620261ms)
+✔ outcome unknown: the CLI's sentence, no retry, then the trail or a re-read (154.34123ms)
+✔ refused and failed reads keep the last list, marked stale; a refused decide says refused (111.768711ms)
+✔ help or a detail box cut to fit keeps its last line, Esc included (Dewey) (54.694534ms)
+✔ keys: views, moving, trail of a selection, the command line, help and quit (217.461926ms)
+✔ one option: the status line says Press 1, not 1-1 (89.955321ms)
+✔ no business: the app says so and :business picks one (46.307887ms)
+✔ mosaic with no argument: exit 3 in an agent run, exit 4 with the usage off a terminal, the app on one (1.62498ms)
+✔ scripts/mosaic with no argument reaches the app entry; the seat usage it printed before has not drifted (165.817915ms)
+✔ strings to keep exactly live once, in the decide flow and the transport; the app does not restate them (0.43647ms)
+✔ decide with --note still asks; a No sends nothing (58.068069ms)
+✔ the app's business comes from a live bus host only (0.992027ms)
+✔ runApp leaves the terminal as it found it on q, end of input, SIGTERM, SIGINT, SIGHUP and an error, the first frame's included (6.831994ms)
+✔ draw is pure: same state, same frame (0.691882ms)
+✔ inbox lists only decisions routed to the human, with what approving authorizes and how to decide (133.534056ms)
+✔ decide resolves by id prefix with --yes, and the trail shows it in broker order with the task to follow (123.489239ms)
+✔ decide refuses without a terminal or --yes, on an unknown option and on a short reference (105.809668ms)
+✔ decide prints a declining choice as declining (147.473855ms)
+✔ an unknown outcome is reported once and never resent (100.401901ms)
+✔ a decision closed before the answer arrives exits 2 and points at its trail (104.039425ms)
+✔ a prefix that matches two open decisions exits 2 and resolves neither (94.209338ms)
+✔ without --business a command uses the live host's business, and a stale host.json is not a host (143.740235ms)
+✔ every human command refuses inside an agent run before it touches the bus (88.015376ms)
+✔ usage errors exit 4; no business and no host is a usage error (85.554546ms)
+✔ agents and tasks print through the broker (96.566216ms)
+✔ notify.json: missing, loose, malformed and extra keys refuse; a binding or null passes (1.227053ms)
+✔ bootConfig builds the broker's boot message for one business, with no trackers key when no project names one (61.437437ms)
+✔ trackers come from the tracker.* variables of the one project that names a tracker project (69.546508ms)
+✔ with two projects, the one that sets tracker.project supplies the tracker and the other is no conflict (33.873942ms)
+✔ two projects that each name a tracker project refuse, since the boot shape holds one (35.960405ms)
+✔ a business without tracker.baseUrl gets no trackers entry (28.518301ms)
+✔ an unknown business and a broken system config refuse with exit 3 (62.139223ms)
+✔ follow prints an unsolicited message after plain talk returned (185.286233ms)
+✔ talk --follow continues after reply and prints a later unsolicited message (164.24966ms)
+✔ inbox lists all unread human messages under decisions, does not deliver or read them (2254.638122ms)
+✔ follow refuses agent context and bad arguments (271.941331ms)
+✔ follow Ctrl-C wakes the poll sleep and removes its handler; transport errors also clean up (358.278765ms)
+✔ plain talk leaves the process SIGINT handlers unchanged (261.842976ms)
+✔ empty views say so (1.09926ms)
+✔ the trail keeps the broker's order and names a decision's task without its rows (1.422464ms)
+✔ tasks print the tracker fields the snapshot carries (0.254821ms)
+✔ the review loop: the coder pushes and asks, the reviewer fetches and approves, and the task's trail holds each step (679.283864ms)
+✔ refusals: no action, non-fast-forward, an unknown commit or request, and a push for another task moves only that task's ref (620.826252ms)
+✔ the size cap refuses a push before any byte (320.496159ms)
+✔ a fetch over the cap refuses before any byte reaches the reviewer (595.32233ms)
+✔ the socket refuses a request with no capability, an unknown one, and a bad request line (355.289821ms)
+✔ a rigged clone runs nothing: hooks, fsmonitor, a filter, a gitlink and a symlinked .git/config leave no marker (1207.836778ms)
+✔ an identity with no role, or of another business, refuses not-a-role and moves no ref (688.038058ms)
+✔ a review of a project the business no longer has refuses unknown-project (372.71763ms)
+✔ past maxActive connections the socket refuses git-busy, and a hung-up connection frees its slot (266.827825ms)
+✔ close() answers host-closing to a connection still sending its request line (459.233783ms)
+✔ a bundle that trickles in refuses body-timeout at its deadline and frees its slot (1026.704905ms)
+✔ a reviewer gone before its bundle was sent is filed fetch-aborted, not as the host's fault (773.038369ms)
+✔ a reviewer that hangs up the moment it has the whole bundle was served, not aborted (641.23788ms)
+✔ send: a close after every byte left is served; one that fails a queued write is fetch-aborted (41.611192ms)
+✔ a bundle with no bytes for bodyIdle refuses body-timeout long before its deadline (590.400906ms)
+✔ send: a close once the loop is past its last chunk is served, and a failed write there is fetch-aborted (23.692917ms)
+✔ letGo waits for an answer to leave for at most its cap, then destroys the socket (302.021176ms)
+✔ a record that fails and can't be undone refuses rollback-failed, which the host logs (461.038324ms)
+✔ the host boots the broker, binds a launch in process, and the notifier DMs a blocking decision exactly once (925.54778ms)
+✔ a notifier that dies takes the host down with exit 1, so the unit restarts the pair (221.729226ms)
+✔ a second host for the same data root refuses with exit 3 while the first runs (179.786804ms)
+✔ two bus starts racing for one data root leave one host running; the other refuses that a host already runs (605.671661ms)
+✔ a host takes over a host.lock its dead host left, and puts back a live claim that replaced it meanwhile (1.905146ms)
+✔ a host.lock that goes between the check and the read is tried again; one that can't be parsed still refuses as unreadable (0.886482ms)
+✔ a live host's lock stays, however old the file is (0.586098ms)
+✔ a host.lock left by a host killed with SIGKILL doesn't stop the next bus start (813.177427ms)
+✔ while a host boots, a reader sees no host: the human commands still ask for --business, stop and status find none (198.820475ms)
+✔ a host started before host.lock existed, holding only host.json, still refuses a second start, which leaves no lock (74.833403ms)
+✔ a broker fork that throws leaves no host.lock and no host.json (39.371477ms)
+✔ a broker send that throws leaves no host.lock and no host.json (27.263857ms)
+✔ a broker that misses its boot wait leaves no host.lock and no host.json (27.524905ms)
+✔ a notifier fork that throws stops the broker and leaves no host.lock and no host.json (299.376018ms)
+✔ a notifier send that throws stops the broker and leaves no host.lock and no host.json (167.539862ms)
+✔ a boot reply with no reader for the business refuses with exit 3 naming it, before the notifier starts, and leaves no host.lock and no live broker (245.9145ms)
+✔ a boot reply with no reader for the business refuses with exit 3 naming it, with no notifier, and leaves no host.lock and no live broker (388.184906ms)
+✔ a host.json that can't be written stops both children and leaves no host.lock (318.493958ms)
+✔ an error event on the broker before it replies fails the start at once, and leaves no host.lock and no live child (29.159394ms)
+✔ an error event on the notifier before it replies fails the start at once, and leaves no host.lock and no live child (152.86279ms)
+✔ an error event on the broker while the notifier starts fails the start once the notifier replies (257.236048ms)
+✔ an error event on the broker once the host is up stops the host with exit 1, and leaves no host.lock and no host.json (276.251776ms)
+✔ an error event on the notifier once the host is up stops the host with exit 1, and leaves no host.lock and no host.json (595.7873ms)
+✔ a broker reply that misses the wait breaks the channel: the late reply answers nothing, later requests refuse, the host exits 1 (1196.773485ms)
+✔ a broker reply with another request's id, or none, breaks the channel and the host exits 1 (309.557454ms)
+✔ a broker reply with no request waiting breaks the channel and the host exits 1 (159.447266ms)
+✔ a notifier that refuses stops the broker and the host refuses with exit 3 (192.510099ms)
+✔ a notifier that refuses after the broker died still refuses with exit 3, without a send to the dead broker (191.42738ms)
+✔ a notifier that dies before it replies, after the broker died, still refuses, without a send to the dead broker (141.224288ms)
+✔ a close send that fails with EPIPE after the notifier refuses still gives the notifier's refusal, exit 3 (209.522825ms)
+✔ a close send that fails with EPIPE after the notifier dies unanswered still gives the notifier's error (183.412525ms)
+✔ close() whose stop and close sends fail with EPIPE still finishes, with exit 1 (193.297923ms)
+✔ watchChildren reports a child that died before it was called, and one that dies later (23.678681ms)
+✔ bus stop refuses to signal a live pid that is not a bus host (202.454899ms)
+✔ bus start refuses with exit 3 and the code when the broker refuses to boot; bus status names the lock (236.319167ms)
+✔ bus start refuses with exit 3 without a notifier config (103.946948ms)
+✔ bus start runs until bus stop; status reports it while it runs (695.014594ms)
+✔ bus-service.sh renders the unit and installs it into a given directory (51.719808ms)
+✔ bus-service.sh pins the claude binary, refuses one the unit can't carry, and renders without one (66.596249ms)
+✔ bus-service.sh refuses a directory pin and keeps a symlink default unresolved (13.816423ms)
+✔ bus-service.sh refuses a default claude without the execute bit, or in a PATH dir with a space (8.385895ms)
+✔ bus start --pm: the PM runs under its own PID namespace, registered, with a manifest (1335.519709ms)
+✔ the PM launches a coder through its launch tool; the coder answers; refusals name their code (794.057516ms)
+✔ each launch makes sure the workspace has a clone of the project: cloned, fast-forwarded, or kept and logged (3115.319433ms)
+✔ a project clone that can't be made refuses checkout-failed, from --pm and from a session, with no run and no clone left (679.504516ms)
+✔ a runner that stops at once ends its launch with the runner's reason (270.940481ms)
+✔ a Claude Code launch with no session credential refuses before it starts (164.651735ms)
+✔ a pi launch needs no session credential: pi logs in through its own ENV_ALLOW variables (278.968279ms)
+✔ a runner killed from the host ends its launch as killed, not failed (453.674266ms)
+✔ a missing or failing bwrap refuses sandbox-unavailable before anything starts; there is no unconfined fallback (198.999463ms)
+✔ a real Claude Code coder's shell can't read a stand-in secret or anything else its sandbox doesn't hold (1409.956416ms)
+✔ a host that died hard leaves its sessions to the next host, which kills them and ends their runs so the role can be launched again (719.254839ms)
+✔ a host that died hard leaves its sessions to the next host, which finds one already exited (23) and ends their runs so the role can be launched again (3721.850107ms)
+✔ a malformed sessions.json refuses the host start with exit 3 and stays as it was (167.172551ms)
+✔ an over-long launch request is refused at once, not at the 10 s idle timeout (125.15881ms)
+✔ a launch client that never closes its side doesn't hold the host's close (187.320398ms)
+✔ a runner that ignores SIGTERM is killed when the host closes (1254.495387ms)
+✔ claudeVersion asks MOSAIC_CLAUDE_BIN when set, else claude on PATH (4.813854ms)
+✔ zoned uses the IANA zone across DST (25.414152ms)
+✔ each open blocking decision is DM'd once, across polls and a restart; non-blocking ones are not (142.209922ms)
+✔ two blocking decisions get two DMs with different nonces (116.15126ms)
+✔ the digest nonce differs per business and per day and fits Discord's 25 characters (0.262367ms)
+✔ a failed DM is journaled, backs off, and is retried until it lands (99.587157ms)
+✔ five definite refusals stop a DM: one gave-up line, one log line, and a restart keeps the count (144.561234ms)
+✔ 429s, 5xx-style unknowns and refusals without a status never count toward the limit (116.40618ms)
+✔ a crash between the fifth refusal and its gave-up line: the next poll appends it and sends nothing (97.270773ms)
+✔ polled every POLL_MS against a permanent 403, a DM is sent at 0, 30, 60, 90 and 120 min and gives up only then (160.857426ms)
+✔ a restart after the second refusal does not send before that refusal's 30 min are up (161.224926ms)
+✔ the digest goes at 08:00 Chicago once a day, with blocking ones marked as DM'd (100.066327ms)
+✔ a late start with no digest for the day sends one at once; an empty inbox gets one line (98.386265ms)
+✔ an inbox read failure is logged and the next poll retries (0.660762ms)
+✔ no Discord id reaches the journal or the log (132.721236ms)
+✔ the journal: a torn tail is copied out and truncated, so an append after it reopens cleanly (28.842413ms)
+✔ the journal: a crash between the copy and the truncate leaves a tail the next open repairs (47.684892ms)
+✔ the journal: a whole file that is one torn line truncates to empty (28.176091ms)
+✔ the journal: a malformed complete line refuses and leaves the file and any torn tail alone (1.977091ms)
+✔ the journal: a loose file mode, a loose directory or a symlinked journal refuses (0.758219ms)
+✔ the journal: a line with a wrong type refuses with exit 3 and names the field (4.456991ms)
+✔ the journal: a symlinked directory refuses and says it is a link (0.382223ms)
+✔ the journal: a dangling directory link, a parent that is a file and a journal that is a directory each refuse with exit 3 (0.495006ms)
+✔ the journal: an append after the file was swapped for a symlink refuses and writes nothing through it (0.368616ms)
+✔ the journal: a directory it cannot write or create refuses with exit 3 and names the path (0.444647ms)
+✔ digest content stays within Discord's 2000 characters (0.263471ms)
+✔ runLoop never overlaps ticks and stops after the one in flight (110.118146ms)
+✔ shared copy: npm ci, pushed reachability, readonly/existing copy, webui delegation (466.474335ms)
+✔ wrapper preserves Q81 lease and marker, rejects foreign/symlink; check uses effective roots (402.907595ms)
+✔ bus unit copy/pm pins, install refuses all busy states and failed reads, drop-in refusal (440.870029ms)
+✔ missing package manifest refuses before npm; npm failure removes the unpublished temp copy (306.683877ms)
+✔ real pinned install loads bus and Console; same-copy mosaic talk passes proof, other trees refuse (4285.751871ms)
+✔ bus status reads effective copy/pm/drop-ins without writes; check refuses an overridden ExecStart (457.143478ms)
+✔ drop-ins in either override field and malformed metadata refuse; uninstall also checks --no-reload (180.242817ms)
+✔ install never shows a template name on systemd 261; template drop-ins still refuse (175.323758ms)
+✔ unlisted instance drop-in is found in another unit lookup directory; path discovery errors refuse (181.600059ms)
+✔ talk --tester sends a [mos test] message as tester from inside an agent and prints the role's reply (148.193797ms)
+✔ talk --tester refuses text without the [mos test] prefix before any call (95.15893ms)
+✔ the read verbs take --tester inside an agent, and the trail shows the tester as the sender (111.099483ms)
+✔ decide, stop and launches take no --tester (132.172522ms)
+✔ the tester transport runs tester-cli.mjs, and the tester's refusals exit 3 (0.340785ms)
+✔ with no stand-in transport, --tester runs tester-cli.mjs on the data root's socket (0.524957ms)
+task.close {} answered: invalid-request; fake saw 18 requests, first GET /info 200, GET /projects/1 200, GET /projects/1/views 200
+task.close on a missing task answered: task-not-found; it made GET /tasks/999 404
+✔ bootConfig trackers reach the S3 adapter in the real broker child, which goes ready against a fake Vikunja (385.901481ms)
+✔ the transport writes {business, verb, args} to the child and reads its JSON (46.277482ms)
+✔ a bus code on stderr becomes the exit code; garbage and timeouts are outcome problems (2168.916748ms)
+✔ busExit and refuseInsideAgent (0.49853ms)
+✔ talk sends a REQUEST, prints and reads everything that arrives, and stops at the reply (209.723902ms)
+✔ talk --wait 0 only sends; no reply within --wait exits 1 and says where it will show (1118.929582ms)
+✔ a late reply the Console has listed still reaches the next talk (2147.144156ms)
+✔ talk, stop and launches off/on refuse inside an agent run; bad arguments are usage errors (241.155722ms)
+✔ launches off and on go to the broker and change the business's launch state (133.15123ms)
+✔ launches list reads sessions.json and marks a stale entry; stop reports it and refuses a non-runner (327.045198ms)
+ℹ tests 184
+ℹ suites 0
+ℹ pass 184
+ℹ fail 0
+ℹ cancelled 0
+ℹ skipped 0
+ℹ todo 0
+ℹ duration_ms 19086.166336
diff --git a/agents/darkwing/work/queue-115/r1/gate/pkg-control-board.log b/agents/darkwing/work/queue-115/r1/gate/pkg-control-board.log
new file mode 100644
index 000000000..e8db3231a
--- /dev/null
+++ b/agents/darkwing/work/queue-115/r1/gate/pkg-control-board.log
@@ -0,0 +1,132 @@
+✔ explicit request, Seen, ordinary completion and a new request have distinct attention states (11.604532ms)
+✔ attention convention ignores reasoning/quoted examples and permits leading blank lines (0.222342ms)
+✔ completed smoke replies and ordinary questions are idle, not human blockers (1.066197ms)
+✔ only an explicit first-line input request makes a finished reply waiting (0.258891ms)
+✔ tool activity, user text, errors and unfinished turns override attention text (0.200457ms)
+✔ STOP access failure is unknown, not absence, under a non-root identity (32.052633ms)
+✔ connector Task never inherits Discord routing envelopes; ordinary Task still uses user text (2.597814ms)
+✔ connector discovery keeps only safe identity; rejects modes, mismatches, links and traversal (1.27872ms)
+✔ canonical owner identity and STOP are independent; no tmux fallback or forged registration (5.547818ms)
+✔ connector reply refusal precedes forged live tmux registration; ordinary agent still sends (0.540838ms)
+✔ server rescans connector discovery and refuses HTTP reply without transport (30.630798ms)
+✔ connector session links and linked directories are not read (0.989378ms)
+✔ newer live matching launch marks old activity, preserves history/attention/attribution, then clears on new activity (2.226906ms)
+✔ CLI print uses the relaunch notice instead of old current preview (51.603344ms)
+✔ connector owner and fixed task never inherit a native relaunch notice (1.885936ms)
+✔ equality, stale/unknown/offline, mismatched registration and unknown activity do not assert relaunch (0.964193ms)
+✔ loadConfig: missing file throws ConfigError (1.78665ms)
+✔ loadConfig: invalid JSON throws ConfigError (0.265587ms)
+✔ loadConfig: missing dataRoot throws ConfigError (0.227576ms)
+✔ loadConfig: relative dataRoot throws ConfigError (0.213386ms)
+✔ loadConfig: valid config returns dataRoot (0.58809ms)
+✔ findNewestSession: picks the newest by mtime among two files (0.410882ms)
+✔ findNewestSession: finds files in nested subdirectories (0.27476ms)
+✔ findNewestSession: returns null for a missing dir (0.116379ms)
+✔ readSession: extracts fields, collapses/truncates text, counts a truncated final line (0.625803ms)
+✔ readSession: model and provider follow the latest model_change entry or assistant turn; null when the log names neither; scanAgent carries them (1.114184ms)
+✔ readSession: lastError carries the assistant errorMessage only when the last assistant turn errored (0.418313ms)
+✔ findNewestSession/scan: never read sibling auth or secrets next to a sessions dir (1.073251ms)
+✔ deriveState: full state table (0.161237ms)
+✔ rule: newest entry is an assistant message with a tool call, after a question-looking text, is working (0.285341ms)
+✔ rule: newest entry is a tool result with no assistant text after it is working (0.248988ms)
+✔ rule: a finished ordinary turn is idle, even if it says your move (0.244899ms)
+✔ task: the first user message of the session, from text blocks (0.251856ms)
+✔ task: a plain-string user content is accepted, whitespace collapsed and long text capped (0.229094ms)
+✔ task: no user message in the log means null (shown as unknown), never a guess (0.236351ms)
+✔ workspace: the live tmux pane path wins; the session cwd is the fallback; neither means null (0.331794ms)
+✔ activeProject: basename of the nearest .git directory or .git file above the workspace; none means null (0.491752ms)
+✔ scan: the written record carries task, workspace and activeProject (0.458413ms)
+✔ registration: overrides task, project and workspace; every source says registration; registered carries the launch fields; the grouping column is untouched (0.516657ms)
+✔ registration: empty task and null project/workspace leave the derived values in place; registered is still non-null (0.33403ms)
+✔ registration: a record whose pid is gone is stale; derived values win, sources say derived, registered stays with alive false; a pid the probe cannot decide is not stale; pidAlive itself (0.892518ms)
+✔ registration: no registration leaves the Gate A fields exactly as before, and registered is null (0.395981ms)
+✔ loadRegistrations: a missing seatsDir gives empty lists (0.130369ms)
+✔ loadRegistrations: one good record, one malformed JSON, one with an unknown field; a stray file under seatsDir is ignored (0.65192ms)
+✔ matchRegistration: matches by sessionsDir, and by realpath through a symlink; sessionsDir null never matches; same seat name with a different sessionsDir does not match (fleet vs repo darkwing) (0.29074ms)
+✔ scan: writes the registration override to disk; index.json carries registered and registrationErrors (1.076918ms)
+✔ scan: a relative seatsDir throws ConfigError; an omitted seatsDir behaves as before (0.212685ms)
+✔ scanAgent: waitingOnYou is true for waiting/error and false otherwise (0.409766ms)
+✔ scanAgent: ageSeconds is computed from the injected now (0.210148ms)
+✔ scanAgent: sessionFile null and state idle when sessions dir is empty but alive (0.135488ms)
+✔ discoverRepoAgents: finds agents with a sessions dir, skips those without, sorted by name (0.290563ms)
+✔ discoverFleetAgents: finds agents with a sessions dir, sorted by name, fleet tmux fields (0.317514ms)
+✔ scan: writes per-agent files and index.json, rerun overwrites, no leftover tmp files (0.771553ms)
+✔ scan: relative boardDir throws ConfigError (0.087501ms)
+✔ CLI: scan with assume-alive liveness exits 0, prints board summary, writes board files (53.635901ms)
+✔ CLI: missing config exits 2 with a refused: message (44.996312ms)
+✔ CLI: unknown command exits 2 (53.991862ms)
+✔ CLI: unknown --liveness value exits 2 (46.613003ms)
+✔ panesRunPi: true when any trimmed line equals 'pi' (0.172668ms)
+✔ panesRunPi: false for bash-only, claude, empty, or node-pi-style lines (0.064958ms)
+✔ tmuxIsAlive: a pane running pi is alive (0.154448ms)
+✔ tmuxIsAlive: session exists but pi has exited is not alive (0.071826ms)
+✔ tmuxIsAlive: no such tmux session is not alive (0.046316ms)
+✔ tmuxIsAlive: tmux could not be run at all is unknown (null), never assumed alive (0.057864ms)
+✔ tmuxIsAlive: passes -L <socket> only when a socket is given (0.109993ms)
+✔ parsePanes: one pane per line, command and optional tab-separated path (0.073491ms)
+✔ tmuxInspect: reports the path of the pane running pi, not of a shell pane (0.068607ms)
+✔ tmuxInspect: no pi pane, no session, or no tmux gives no workspace and the matching liveness (0.085627ms)
+✔ loadSeen: missing file returns {} (0.122904ms)
+✔ loadSeen: invalid JSON throws ConfigError (0.171131ms)
+✔ loadSeen: a JSON array throws ConfigError (0.150422ms)
+✔ loadSeen: a non-string value throws ConfigError (0.156821ms)
+✔ markSeen: seen true adds the key and writes seen.json mode 0600, no leftover tmp files (0.289485ms)
+✔ markSeen: seen false deletes the key (0.251832ms)
+✔ markSeen: missing, empty, or non-string fields throw ConfigError (0.217223ms)
+✔ markSeen: project containing '/' throws ConfigError (0.111425ms)
+✔ markSeen: non-boolean seen throws ConfigError (0.09935ms)
+✔ scanAgent: a seen mark matching the waiting session's lastTimestamp clears waitingOnYou (0.258764ms)
+✔ scanAgent: a stale mark (agent wrote something newer) is not seen and waitingOnYou is true (0.210029ms)
+✔ scanAgent: a working session with a matching mark is not seen (marks only apply to waiting/error) (0.211471ms)
+✔ scanAgent: an error-state session with a matching mark is seen (0.222122ms)
+✔ scan: index.seen and waitingOnYou reflect seen.json, which scan never rewrites or deletes (0.455087ms)
+✔ scan: a corrupt seen.json makes scan throw ConfigError (fail closed) (0.176031ms)
+✔ taskSetBy: a registered task carries the record's setter; a record without the field (pre-#1511) reads unknown; the value is not copied into registered (0.592311ms)
+✔ taskSetBy: null whenever the task shown is not the registered one: no registration, an empty registered task, a stale registration; the field is always present (0.573091ms)
+✔ taskSetBy: scan() reads the field from disk through the seat package (bounded there), writes it to the per-agent record and index, and an invalid on-disk value is a registrationError, never a row value (1.24233ms)
+✔ isLoopbackHost: recognizes loopback hosts (1.076081ms)
+✔ isLoopbackHost: rejects non-loopback hosts (3.905421ms)
+✔ startServer: refuses a non-loopback host with ConfigError, never opens a socket (2.733103ms)
+✔ startServer: serves page, healthz, and a rescanning /api/board (30.202746ms)
+✔ startServer: a seatsDir registration overrides the row and index.registered reflects it (5.350991ms)
+✔ startServer: /api/board returns 500 JSON with an error field when scan throws (2.095585ms)
+✔ CLI: serve refuses a non-loopback host with exit 2 and a refused: message (49.817817ms)
+✔ CLI: serve rejects a non-numeric --port with exit 2 (52.715715ms)
+✔ CLI: scan still works after the async cli refactor (51.207189ms)
+✔ CLI: live serve prints its URL and answers /healthz (58.619006ms)
+✔ page.html: esc() escapes every HTML-significant character (0.658545ms)
+✔ POST /api/seen marks a row; GET /api/board still shows it seen; seen:false clears it (7.874363ms)
+✔ POST /api/seen without a JSON content-type returns 400 and does not write a mark (2.891403ms)
+✔ POST /api/seen with invalid JSON returns 400 (1.530825ms)
+✔ POST /api/seen with a body over 4096 bytes returns 400 (or resets the connection) and writes no mark (1.895563ms)
+✔ POST /api/seen with a missing agent returns 400 (1.259269ms)
+✔ POST /api/board returns 405; PUT /api/seen returns 405 (1.591469ms)
+✔ CLI: scan --print marks a seen row with 's' and the summary line ends with 'N seen)' (50.42241ms)
+✔ page.html: seenControl() escapes rec.project/agent/lastActivity, and the POST uses a JSON content-type (0.298853ms)
+✔ page.html: has a collapsed Seen section that lists seen rows with the shared row builder (0.255702ms)
+✔ page.html: each project has a Hide seen checkbox (default on) beside Hide offline, with a hidden-count note (0.173739ms)
+✔ page.html: a project header reads "N of N" only while a checkbox hides rows (0.156206ms)
+✔ page.html: every row shows Task and Active project, derived or the word unknown, with the workspace in the detail (0.290812ms)
+✔ page.html: task and active project cells show their source via sourceTag(); the detail has a Registered row via registeredText(); SOURCE_LABEL maps registration to registered; every dynamic value in sourceTag/fromSource/registeredText is escaped (0.556386ms)
+✔ POST /api/reply: runs agent-send.sh with -s from the registration, -S <host>:control-board, -m text plus the fixed trailer, no -L on the default socket, MOSAIC_TMUX_SOCKET stripped; answers delivered with the exit code and both streams (26.367665ms)
+✔ POST /api/reply: a registration with a tmux socket adds -L <socket> (24.476521ms)
+✔ POST /api/reply: a non-zero tool exit is a 200 with delivered false, the exit code and the stderr verbatim (29.192163ms)
+✔ POST /api/reply: refusals before the tool runs: empty or blank or long text 400, unknown row 404, no registration 409, stale registration 409, no tmux session 409, bad JSON 400; the tool is never called (13.52559ms)
+✔ POST /api/reply: a missing agent-send.sh is a 500 with the path in the error, not a crash (4.270037ms)
+✔ replyToRow: DEFAULT_AGENT_SEND is the repository's tools/tmux/agent-send.sh and it is executable (0.134355ms)
+✔ page.html: the reply box appears only where canReply() holds (live registration with a tmux session), the detail has a Reply row, the submit posts JSON to /api/reply, receipts and drafts survive a refresh, and every receipt value is escaped (0.539158ms)
+✔ startServer: /api/board carries taskSetBy from a live registration and null for the derived rows (2.205175ms)
+✔ page.html: the task cell and detail show who set a registered task via setByTag()/setByText(), both escaped, only from rec.taskSetBy; the reply gate does not read it (0.276545ms)
+✔ Host/Origin guard: GET /api/board and POST /api/reply refuse a foreign Host, a wrong port and a cross-origin Origin with 403 JSON, before any scan or send, and never send CORS headers (7.474534ms)
+✔ Host/Origin guard: loopback names on this port are accepted, with or without a same-origin Origin (34.340087ms)
+✔ conversation routes (F16): a foreign Host, a wrong port and a cross-origin Origin get 403 before the reader runs, with no CORS headers (5.100803ms)
+✔ every refusal code the reader can raise has an HTTP status (0.89241ms)
+✔ conversation routes: catalogue, first page, next page and follow over HTTP; refusals map to 4xx with their code; nothing is written (43.886626ms)
+ℹ tests 124
+ℹ suites 0
+ℹ pass 124
+ℹ fail 0
+ℹ cancelled 0
+ℹ skipped 0
+ℹ todo 0
+ℹ duration_ms 603.603165
diff --git a/agents/darkwing/work/queue-115/r1/gate/pkg-conversation.log b/agents/darkwing/work/queue-115/r1/gate/pkg-conversation.log
new file mode 100644
index 000000000..8c70d25be
--- /dev/null
+++ b/agents/darkwing/work/queue-115/r1/gate/pkg-conversation.log
@@ -0,0 +1,190 @@
+✔ W1: two processes acquire the same pair at once; exactly one claim (205.740376ms)
+✔ W1: two writers publish the same revision at once: one wins, the other gets null, the winner's record stays (30.644587ms)
+✔ W1: a revision name appears only after its bytes are synced; before that, only a temp file exists (17.641943ms)
+✔ W2: acquire while a claim is reserved or active refuses already-active (336.776517ms)
+✔ W3: acquire while stopping, uncertain, or stopped without proof refuses unsafe-replacement (388.538726ms)
+✔ W4: same session with another seat tuple, and the reverse, both refuse; a loser on the seat key closes it no-unit (239.953782ms)
+✔ W4: a hard link of one session under another seat is the same session: the second controller refuses already-active and launches nothing (190.282552ms)
+✔ W4: a copy of one session under another seat is the same session: the second controller refuses already-active and launches nothing (184.732146ms)
+✔ W4: a session header ID that changes after construction refuses target; nothing is claimed or launched (2.935844ms)
+✔ W5: SIGKILL between every publication barrier of acquire and transition; restart never finds two holders or a lost claim (9567.622354ms)
+✔ W5: SIGKILL between every publication barrier of release; restart finishes or holds the release (31669.484984ms)
+✔ W6: controller killed mid-turn while the engine lives; restart is uncertain, no launch, prompts refuse (256.828516ms)
+✔ W12: a live owner paused with SIGSTOP; a second controller refuses already-active and changes nothing (153.564111ms)
+✔ W13: crash after the engine spawns, before active; restart finds the live unit: uncertain, no second spawn, force stop only (437.82047ms)
+✔ W14: crash after reservation, before the spawn marker: stopped with a no-unit observation; the pair is free (284.440677ms)
+✔ W20: crash after the spawn marker, scope collected; uncertain in both runs, the marker is copied, no launch until a boot proof (355.434332ms)
+✔ W15: crash between the two keys during release; restart finishes it under the same claim ID (102.866961ms)
+✔ W7: recorded boot ID differs on the same machine: stopped with a boot proof; open tool calls become uncertain (175.915664ms)
+✔ W8: resume after a proven stop with the same pins: new claim ID, generation +1, same conversation, branch and leaf (263.654566ms)
+✔ W9: resume with a changed binary, argv digest, branch or leaf is refused and the claim is unchanged (788.946719ms)
+✔ W11: the controller writes no session file; only the fake engine's own appends appear (186.825301ms)
+✔ W16: a highest revision that won't parse holds the pair uncertain; the older stopped revision is not reused (94.417349ms)
+✔ W17: a claim root copied from another host refuses foreign-host and promotes nothing (68.979487ms)
+✔ G1: a session path or claim root under .pi/state, ~/.claude, the data root or a registration refuses at construction (3.814536ms)
+✔ G2: a symlink inside the fixture root to a live session file is refused by the real-path check (1.037168ms)
+✔ G3: a fixture path swapped for a live path after construction is refused at bind (1.891926ms)
+✔ no shim from this file's tests is left running for the after hook (4.901574ms)
+✔ K1: force stop kills a tool child that called setsid; stopped with a verified proof (557.895541ms)
+✔ K2: K1 on the process-group fallback ends uncertain, never stopped (424.488574ms)
+✔ K3: SIGTERM acknowledged while a member lives: stopping until the kill phase, never stopped from TERM (556.863814ms)
+✔ K4: two engines; force stop one; the other survives by independent observation (2765.959547ms)
+✔ K5: a stop during a tool call leaves the effect uncertain, and it is shown (470.851456ms)
+✔ K12: a member forking in a loop: the freeze stops it, enumeration is complete, populated 0 after cgroup.kill (578.907658ms)
+✔ K13: a member writing its pid into another cgroup is refused by the namespace; the kill is complete (470.147023ms)
+✔ K15: the shim gone, engine/cgroup.events unreadable, or the engine cgroup missing: evidence unavailable, not empty; uncertain (5176.713778ms)
+✔ K10: controller killed between the TERM and kill phases: restart checks the invocation ID and re-runs from TERM for the same stop (766.559328ms)
+✔ K11: controller killed after the confirmation is recorded, before TERM: restart checks the invocation ID and re-runs from TERM for the same stop (563.919902ms)
+✔ K14: a unit with the recorded name but another invocation ID: evidence unavailable, no signals, uncertain (455.865814ms)
+✔ K6: recover without proof, without confirmation, or with changed pins is refused (751.169048ms)
+✔ K7: recover after proof, then launch: new claim and execution, generation +1, same leaf; the cancelled prompt is not replayed (386.105147ms)
+✔ K8: an engine that loads another leaf on resume is refused before admission; it stays claimed until a proven stop (531.394406ms)
+✔ K9: an interrupt that never settles stays uncertain; force stop stays available; takeover is refused while fenced (3296.522228ms)
+✔ K16: a claim from another machine ID refuses foreign-host; no boot proof is issued (40.784012ms)
+✔ K17: two launcher calls with one eligibility record: one launch, the other refuses, no second engine (355.752048ms)
+✔ K18: the leaf changes after eligibility: launch refused; the reservation stays until released with proof (331.805787ms)
+✔ K19: a scope launched with only the engine environment still reaches the user manager; the engine sees no other names (81.7685ms)
+✔ R1: after a proven force stop the controller releases the scope; the shim and the unit are gone (384.971378ms)
+✔ R2: close releases the scope of a binding proven stopped, once, when the stop's own release hasn't run (453.190419ms)
+✔ R3: no release after an unavailable stop or an unverified proof: the scope and its shim stay as evidence (1169.913241ms)
+✔ E1: a natural engine exit with no member left: an engine-exit stop, stopped on a proof naming the engine, and the scope released (411.287827ms)
+✔ E2: an engine exit with a tool child alive: the stop ends uncertain and nothing is released; a force stop then ends it (2449.668498ms)
+✔ E3: an engine exit and a force stop take one escalation slot, in either order (1022.949608ms)
+✔ E4: a shim that doesn't answer: the engine-exit stop misses its deadline, ends uncertain and frees the slot (943.685035ms)
+✔ E5: an engine exit after a force stop ended uncertain starts no engine-exit stop; the force stop stays current (2583.037225ms)
+✔ E6: the engine-exit observation refuses a reaped process that isn't the recorded engine: another PID or start ticks (368.843143ms)
+✔ R5: the harness finds a running shim and reaps it, and never signals a shim outside a mosaic-chat- scope (Filbert N1 and N2 on #1533) (384.110414ms)
+✔ R6: releaseCohort releases nothing while the engine runs, for another invocation ID, or for a cohort without a scope (126.445099ms)
+✔ R7: controller killed after the claim is stopped, before the release: the restart releases the scope (2595.796897ms)
+✔ R8: controller killed between the two keys' stopped revisions: the restart releases the scope (443.044792ms)
+✔ R9: a release that ended unavailable is tried again on a confirmed recover, not a refused one (460.641971ms)
+✔ R10: close releases and signals nothing for a stopped binding whose proof no longer verifies (Filbert N3 on #1536) (408.276278ms)
+✔ R11: close({ killEngine: true }) after a proven stop sends no signal to the recorded engine PID; a restart releases nothing more (2598.307078ms)
+✔ R12: a restart onto a claim stopped on a boot proof releases nothing, though its scope is listed (263.899869ms)
+✔ no shim from this file's tests is left running for the after hook (5.619476ms)
+✔ S1: `/goal x`, with leading spaces or a tab, refuses text-policy at admission; zero engine bytes (198.297132ms)
+✔ S2: every prefix pinned Pi interprets is refused, from the list the code uses; the rest reach the engine exactly (189.741584ms)
+✔ S3: `/goal` on the second line is pinned from the source: Pi checks only index 0, so it is admitted and sent exactly (187.953074ms)
+✔ S4: a `/` left in the composer is cleared when control transfers and returns; the next submit sends only the new text (269.728954ms)
+✔ S5: an observer terminal gets a paste then Enter, as send-message.sh does: not admitted: controller, nothing sent (190.522752ms)
+✔ S6: a mediated-shaped registration (no tmux) passed to the board's replyToRow: 409 no tmux session; exec never runs (0.498622ms)
+✔ S7: ESC, bracketed-paste markers and U+2028/U+2029 travel as one JSON string; the engine receives the exact text in one record (188.893273ms)
+✔ P3: a Pi confirm, select, input or editor dialog is shown disabled with a reason and never answered (297.501817ms)
+✔ E1: send, ack, user, toolCall, toolResult, final answer: shown once, no refresh, draft and reading position kept (205.917822ms)
+✔ E2: U+2028, U+2029 inside JSON strings and CRLF line ends each parse as one record, on the splitter and through the controller (197.711569ms)
+✔ E3: a multipart final, two blocks, null request correlation and duplicate delivery (206.178216ms)
+✔ E4: a page read after message_end but before its entry is persisted: marker at the seam, re-read after run-settled, each message once (200.454777ms)
+✔ E4: a gap or a new epoch also reconciles; nothing is concatenated across a gap (10.478303ms)
+✔ E5: an unknown native event gives no client event; evidence records its type and bytes; the terminal count goes up (200.014415ms)
+✔ E6: a tool result delayed across a pause and a reconnect is reconciled without a manual refresh (218.75403ms)
+✔ E7: the terminal renders the same stream as the library client, as observer and then as controller, and submits only as controller (254.506933ms)
+✔ terminal: engine control characters are made visible; a lost connection refuses submit (199.045946ms)
+✔ terminal: outcome unknown is shown as such, with no resend offer, and nothing is resent (0.41001ms)
+✔ terminal: text after Enter in the same input chunk starts the next message; it never joins the one submitted (0.281435ms)
+✔ terminal: a paste-start marker split right after its ESC still opens the paste; the Enter inside it never submits (0.327522ms)
+✔ terminal: Ctrl-T then Enter in one chunk is judged after the takeover, as if typed one key at a time (Filbert F2, #1507) (0.549976ms)
+✔ terminal: input held behind Ctrl-T waits for that takeover while an earlier action is still pending (Darkwing T1 on #1522) (30.112272ms)
+✔ terminal: a hold inside held input holds again, and once it is drained later input and Ctrl-C still reach the terminal (Darkwing note 1 on #1522) (0.490338ms)
+✔ terminal: an action that throws still releases the input held behind it, in order, then rethrows (5.719617ms)
+✔ terminal: after an action throws, later input still runs; input() puts the error in the status line (Filbert N1 on #1522) (0.356192ms)
+✔ terminal: input() reports an error when it happens, so it never overwrites a later status; held input's promise doesn't carry the holder's error (Filbert N4 on #1522) (0.318364ms)
+✔ terminal: invisible and bidi characters are made visible; head, status and notice lines stay one line (0.111588ms)
+✔ every record these fixtures produced is a valid CHAT-01 record (E5: no record fails the schema) (216.282091ms)
+✔ H1: two takeovers with the same expected generation: one wins, +1; the other refuses generation (243.160321ms)
+✔ H2: the old controller's prompt after a takeover commits is refused with zero engine bytes (276.502421ms)
+✔ H3: a takeover while a prompt holds the dispatch lock: written under the old actor, or refused; never both (774.089612ms)
+✔ H4: self-takeover is refused (186.359998ms)
+✔ H9: Interrupt racing a prompt's dispatch: before the write, dispatch-refused and no-turn; after, §3 rules (439.446129ms)
+✔ H10: Interrupt and force stop together: one stop chain, force stop supersedes (1032.690131ms)
+✔ H10: an overlap during the pause before the abort: no abort, the stop ends uncertain (219.5197ms)
+✔ H10: a no-turn Interrupt lifts only its own fence; admission stays closed under force stop, overlap or revocation (553.14945ms)
+✔ H11: the controller disconnects mid-turn: work continues, the claim is unchanged, control stays put (276.989563ms)
+✔ H12: an exact retry after reconnecting to the same incarnation returns the same receipt; one dispatch (150.724203ms)
+✔ H13: a retry with the same request ID and different text is refused (189.431373ms)
+✔ H14: late stdout from the old engine after a replacement is dropped by incarnation, counted, never rendered (590.640946ms)
+✔ H15: a revoked connection's command is refused; the revocation fence holds (288.72228ms)
+✔ H16: a second controller for the same session refuses already-active; the first is untouched (189.503745ms)
+✔ H10: a second force stop while the first escalation runs refuses fenced; one escalation, and the claim records only the first stop's phases (796.620691ms)
+✔ a force stop whose fence throws leaves no escalation flag behind, so the next force stop runs (Darkwing F2, #1507) (347.974124ms)
+✔ H17: a confirmation reused, answered from another connection, or used after the stop changed is refused (726.124885ms)
+✔ H18: two prompts before any native output: the second refuses busy; one engine write (194.423024ms)
+✔ H19: the pipe fails mid-line under a large prompt: delivery-unknown transport-unknown, poisoned, no later write (355.344603ms)
+✔ H19: the link itself never writes again after an unknown outcome, whoever calls it (0.609421ms)
+✔ H19: the controller dies mid-write of a large line: after restart the outcome is unknown and nothing is resent (647.293159ms)
+✔ H20: the line is written but the ack is lost when the controller dies: orphan, outcome unknown, nothing resent (551.870256ms)
+✔ H21: a retry of the exact request with the old token after a crash is stale-incarnation; no second write (690.358759ms)
+✔ H22: after H21 and a valid recovery, a new request with the new token is admitted (3024.70622ms)
+✔ H23: requests pending at a restart are not resent; each shows outcome unknown (657.781848ms)
+✔ no shim from this file's tests is left running for the after hook (4.581232ms)
+✔ a plain conversation: catalogue row, one page, CHAT-01 records (6.064049ms)
+✔ native entries map to blocks: tools, thinking, bash, notices, ids that do not fit (1.608409ms)
+✔ F1: a malformed line is an unavailable part at its position, and reading continues (1.516967ms)
+✔ F1: a missing parent stops the history with a notice that names the unreadable lines (2.292374ms)
+✔ F1: an unreadable fork is never merged into another branch's history (1.31168ms)
+✔ F1: a follow stays on its branch when the next entry's parent is unreadable (1.689274ms)
+✔ F1: a file whose entries are all unreadable shows a notice per line (0.689001ms)
+✔ F2: a truncated trailing line marks the view incomplete, not an error (1.170419ms)
+✔ pagination: 100 parts, then the rest; parts concatenate to the whole branch (3.365009ms)
+✔ F3: a replaced file (new inode) refuses old cursors with reconcile (3.96831ms)
+✔ F4: a same-inode rewrite of the prefix refuses old cursors with reconcile (5.189702ms)
+✔ F5: growth between pages keeps the epoch and the page stops at the pinned length (6.662266ms)
+✔ F6: unknown, foreign and expired cursors refuse and leave the cursor usable (7.031522ms)
+✔ F7: a symlinked file and a symlinked directory component are refused, never opened (8.016956ms)
+✔ F8: a file swapped for a symlink after the catalogue is refused (1.946619ms)
+✔ F9: registrations never add or redirect a root (1.722076ms)
+✔ F10: a header cwd naming another project is refused (4.019193ms)
+✔ F11: parentSession renders with a marker and the parent is never opened (0.705575ms)
+✔ F12: two leaves: the default leaf is shown and the other branch reads alone (4.24386ms)
+✔ F12: a follow refuses when an appended duplicate id changes the branch's earlier parts (1.942107ms)
+✔ F12: a second root (Pi's resetLeaf) starts its own branch (1.382316ms)
+✔ F13: compaction is a marker in place, then the retained content (0.745032ms)
+✔ F14: long strings split into fragments and parts, reassemble exactly, and pages respect the byte cap (502.266958ms)
+✔ fragments never cut a surrogate pair and keep an empty string (5.094034ms)
+✔ F15: a Claude seat is an unsupported-harness placeholder whose directory is never read (1.520367ms)
+✔ unknown conversations, empty files and non-Pi files refuse (2.346125ms)
+✔ an unreadable file or root inside the roots is refused per row, not a failed catalogue (1.120503ms)
+✔ a seat directory without search permission refuses that root, not the catalogue (2.137321ms)
+✔ every page and cursor is a valid CHAT-01 record (794.773076ms)
+✔ the engine pin holds for the installed package (1.69245ms)
+✔ pinned Pi, sealed and without credentials, answers the controller's commands with the shapes the fake models (259.282641ms)
+✔ sealed, pinned Pi ignores a trusted project's .pi resources; --approve past the seal would load them, and checkSeal refuses it (Filbert F2 on #1522) (502.12768ms)
+✔ pinned Pi appends thinking_level_change at start when the branch lacks one, so the leaf moves (K8 then fails closed) (260.928738ms)
+✔ N25: ordinary Interrupt reconciles; a non-empty queue_update in the window is O5 (467.539947ms)
+✔ N1: an extension's follow-up queued after the fence is cleared before any abort; O5, Unknown (411.709954ms)
+✔ N1: a follow-up queued before the fence is O5 at once; the Interrupt refuses fenced (228.974071ms)
+✔ N2: with abort first, the fake runs the external item (the ordering guard has teeth) (22.259053ms)
+✔ N3: the fence lands in preflight, preflight errors, no run: failed, No run, uncertain (334.901265ms)
+✔ N4: the ack arrives after the first abort and a run starts: clear and abort again; Interrupted (190.837778ms)
+✔ N5: an input handler takes the prompt: ack, no run, delivery-unknown handled-without-run (287.054678ms)
+✔ N6: an extension queues between clear_queue and abort: O5 and O6, Unknown (465.105104ms)
+✔ N7: clear_queue times out: no abort, nativeQueue unknown, force stop still ends it (1879.721874ms)
+✔ N7: clear_queue answers an error: no abort, nativeQueue unknown, the link not poisoned (186.480885ms)
+✔ N8: an extension prompt starts a run during Mosaic preflight; the losing settle is O3 (280.414571ms)
+✔ N9: a run that started before the fence and ends aborted: failed interrupted, Interrupted (167.89029ms)
+✔ N9: decision 34: a run that ends aborted with no stop in progress: aborted-without-stop, uncertain, outcome unknown (222.15964ms)
+✔ N9: an aborted that lands after the fence but before any abort is written: aborted-without-stop, Unknown (343.136083ms)
+✔ N10: fake conformance (32.161942ms)
+✔ N11: the run fails before any user message_start: delivery-unknown ack-without-start, never failed (409.682482ms)
+✔ N12: input that starts a run after the final empty clear is O1 and not part of the stop's proof (270.801385ms)
+✔ N13: agent_start with no slot held is O1; a later prompt refuses with zero engine bytes (282.259413ms)
+✔ N14: the run completes while clear_queue is in flight: finished, Completed first, uncertain (347.282961ms)
+✔ N14: the run completes after the abort is written, before Pi applies it: finished, never relabelled (337.340823ms)
+✔ N15: the fence lands in preflight, then an input handler takes it: handled-without-run, No run (332.394855ms)
+✔ N16: Interrupt with no slot and no run refuses no-turn: no stop, no bytes, admission open (213.594893ms)
+✔ N17: the run fails on its own during the exchange: failed, Failed on its own (370.631831ms)
+✔ N18: no final assistant message_end, or a lost line: working stays working; before working, transport-unknown (665.658544ms)
+✔ N19: a losing extension prompt settles inside the Mosaic run before its user message: O3, run-overlap (571.225118ms)
+✔ N20: an extension triggerTurn during Mosaic preflight starts first; while streaming it queues with no signal (493.644397ms)
+✔ N21: a losing settle after the receipt settled finished is O2; the receipt stays finished (194.820168ms)
+✔ N22: an agent-level custom message is dropped by the clear with no signal; evidence names the seal (246.379379ms)
+✔ N23: a nextTurn message survives clear and abort and attaches to the next prompt, with no signal (187.28279ms)
+✔ N24: the seal is an allow-list: --extension, a missing --no-* flag, a second --mode or --session, a session or output flag, or a stray word refuses unsealed-engine; no engine starts (211.395134ms)
+✔ N24b: the seal covers the engine command and environment: config can't name either, the env is built from names, and a mutated command is refused at bind (206.653904ms)
+ℹ tests 182
+ℹ suites 0
+ℹ pass 182
+ℹ fail 0
+ℹ cancelled 0
+ℹ skipped 0
+ℹ todo 0
+ℹ duration_ms 47342.392526
diff --git a/agents/darkwing/work/queue-115/r1/gate/pkg-discord.log b/agents/darkwing/work/queue-115/r1/gate/pkg-discord.log
new file mode 100644
index 000000000..ce00e98e3
--- /dev/null
+++ b/agents/darkwing/work/queue-115/r1/gate/pkg-discord.log
@@ -0,0 +1,186 @@
+✔ approvals: a request is validated before anything is posted; the rendering shows names and never ids (3.047116ms)
+✔ approvals: the ledger is appended and folded into open requests with bind and approval states (1.742134ms)
+✔ approvals: a reply approves only when it points at a request, says exactly approve, and comes from a listed approver once (0.642557ms)
+✔ approvals: a button approves only on its own request message with the matching custom id (0.487065ms)
+✔ approvals flow: a turn that opened a request posts the message with the button, records it, binds it, and both approvers approve (21.880453ms)
+✔ approvals flow: a non-approver, a repeat, a wrong custom id and a service refusal each get their fixed line and a drop entry (5.247548ms)
+✔ approvals flow: an invalid request from the model, a refused post, and no api client are recorded and post nothing (6.539628ms)
+✔ approvals flow: start retries a bind and an approval left as unknown, under their original keys (2.171843ms)
+✔ authorize: open channel, listed user (1.788092ms)
+✔ authorize: wrong guild (0.296143ms)
+✔ authorize: no guild (DM) (0.322222ms)
+✔ authorize: unlisted channel (0.185658ms)
+✔ authorize: unknown channel, no info (0.280287ms)
+✔ authorize: thread of listed parent (0.180422ms)
+✔ authorize: thread of unlisted parent (0.170952ms)
+✔ authorize: text channel that is not a thread and not listed (0.147919ms)
+✔ authorize: unlisted user (0.575811ms)
+✔ authorize: no author (0.508795ms)
+✔ authorize: bot author (listed id, bot flag) (0.23785ms)
+✔ authorize: system author (0.270475ms)
+✔ authorize: the bot itself (0.088127ms)
+✔ authorize: webhook (0.588496ms)
+✔ authorize: mention channel without mention (0.187912ms)
+✔ authorize: mention channel with bot mention (0.130338ms)
+✔ authorize: mention channel with @everyone only (0.19838ms)
+✔ authorize: mention channel mentioning someone else (0.080923ms)
+✔ authorize: mention channel, content says @bot but mentions empty (0.08582ms)
+✔ authorize: private thread under mention channel, mentioned (0.088527ms)
+✔ authorize: private thread under mention channel, not mentioned (0.069208ms)
+✔ authorize: thread in another guild per channel info (0.073459ms)
+✔ authorize: not an object (0.064127ms)
+✔ authorize: no id (0.058874ms)
+✔ authorize: oversize content is accepted and flagged (0.066351ms)
+✔ authorize: exactly the limit is not oversize (0.060131ms)
+✔ authorize: a user's channel allowlist drops them outside it, threads count as the parent, others are unaffected (0.43327ms)
+✔ authorize: order puts wrong guild before user, and user before channel (no channel lookup for strangers) (0.144571ms)
+✔ binding: a complete binding validates and is frozen (2.391536ms)
+✔ binding: unknown key, missing field, wrong type refuse with exit 2 (1.188315ms)
+✔ binding: empty allowlists refuse (0.390724ms)
+✔ binding: a user's channel allowlist must be non-empty, listed and unique; absent means every listed channel (1.403456ms)
+✔ reloadDiff: reloadable keys are summarised by id; every fixed key refuses with exit 2 (1.633604ms)
+✔ binding: dmRecipient is optional, a snowflake, one of the listed users, and a fixed key (0.474401ms)
+✔ binding: file must be 0600, regular, not a symlink (1.539717ms)
+✔ binding: token file mode, symlink, emptiness and shape are checked; token never appears in errors (8.714299ms)
+✔ cli: check refuses a non-0600 token file with exit 2 before any network use (78.393461ms)
+✔ context files: absolute paths, traversal, symlinks and out-of-repo targets refuse; in-repo files resolve (2.412045ms)
+✔ cli: check refuses a missing context file and a missing binding with exit 2; usage is exit 4 (296.716353ms)
+✔ cli: reload validates the file first (exit 2), then needs a live owner (exit 1); usage is exit 4 (189.887123ms)
+✔ cli: run refuses when STOP is present, before any network use (118.688912ms)
+✔ binding: tools is optional, validated strictly, a fixed key for reload, and its roots are resolved against the data root (1.638514ms)
+✔ binding: a git key is validated at load and reaches the extension whole, and only on a writable root (1.217807ms)
+✔ delivery: an accepted message is in the inbox before the turn, the reply is chunked with one nonce per chunk, and the turn record is write-once (18.692558ms)
+✔ delivery: refused and unknown outcomes are journaled; a later chunk is not sent after a failure (16.691511ms)
+✔ delivery: restart with an unknown entry re-sends the same nonce once and reconciles before accepting traffic (1.481949ms)
+✔ delivery: an unknown entry older than the dedupe window is marked refused, not re-sent; a still-unknown one refuses start (1.128019ms)
+✔ delivery: repeated unknown reconciliations never refresh the dedupe window; the original intent time decides (1.25795ms)
+✔ turn: a failed engine turn posts the fixed line, never model output, and writes a failed record (2.337635ms)
+✔ turn: a second message during a turn is held by the engine, both get their own reply and record (33.201277ms)
+✔ turn: a thread under a listed channel is answered in the thread; an unknown thread is looked up once (2.695799ms)
+✔ drop: an unlisted user gets silence and one drop line; no inbox entry, no REST call, no engine call (0.665564ms)
+✔ drop: an oversize message is accepted into the inbox, answered with the fixed line and journaled as a drop (0.705514ms)
+✔ restart: an inbox with three ids and a replay of the same three produces zero turns (40.183809ms)
+✔ stop: STOP present refuses start; STOP written while running refuses new turns and the current one finishes (32.210101ms)
+✔ ceiling: the ceiling plus one is refused and journaled; one fixed line per UTC day; a new day accepts again (5.280711ms)
+✔ ceiling: a burst arriving while turns are still running cannot queue past the ceiling (3.877429ms)
+✔ ceiling: a turn interrupted by a crash still counts after restart; admissions are durable (2.781891ms)
+✔ ceiling: the daily notice survives a same-day restart; one delivery attempt in total, even when the first attempt crashed mid-flight (4.295657ms)
+✔ duplicate: the same event delivered twice while the thread lookup is held yields one prompt, one admission and one reply (2.401703ms)
+✔ journal: no token-shaped string and no model output on the drop path reaches disk (0.510968ms)
+✔ receipt: an admitted message gets one eyes reaction on the inbound message; drops and refusals get none; a failed reaction is recorded and does not fail the turn (2.189857ms)
+✔ receipt: Discord refusing the reaction leaves the turn intact and records ok false (1.887817ms)
+✔ reload: a new user is silent before and answered after; a removed channel goes silent; a lower ceiling applies at once (3.629563ms)
+✔ reload: a fixed key refuses with exit 2 and the old binding stays in force (1.946202ms)
+✔ tools: with a tools binding the turn record lists every read and its outcome; without one the field is null (2.548153ms)
+✔ context: the Discord block names the server, channels and modes, and states the rules from Q15 and Q16 (2.382975ms)
+✔ context: with tools the block names the roots, keeps file content as data, and says to state refusals plainly (0.731409ms)
+✔ context: a writable root adds the write rules and says a write is real only once Jason commits (1.767382ms)
+✔ context: the envelope is one bracketed line then the text; names cannot break the line (1.115513ms)
+✔ context: a git root swaps the terminal-commit line for the git verbs, and a vault root adds the id protocol (1.312084ms)
+✔ context: assembleContext concatenates files in launcher format and appends the block; sha256 is stable (1.429163ms)
+✔ context: splitReply keeps paragraphs together under the limit and splits long ones at lines, spaces, then hard (0.864655ms)
+✔ engine: buildPiArgs carries the fixed flags, engine settings, session dir and prompt file (2.525364ms)
+✔ engine: with tools, buildPiArgs turns pi's own tools off, loads the extension explicitly and allowlists exactly our three (0.471112ms)
+✔ engine: a run with tool turns settles once, on the answer, with every tool call in the result (52.61302ms)
+✔ engine: a run that ends on a tool-only turn fails the prompt as empty; a retried run settles on the real end (35.869512ms)
+✔ engine: one prompt, one turn, text and usage come back (29.686694ms)
+✔ engine: a prompt while streaming is held until pi settles, then sent as its own run, and answered in order (340.881459ms)
+✔ engine: a held prompt that times out before pi settles fails on its own and is never sent (231.073698ms)
+✔ engine: timeout sends abort and fails only that turn; the process stays (105.032196ms)
+✔ engine: tool events from a run that outlived its timeout never land in the next prompt's record (227.924573ms)
+✔ engine: a prompt after a turn that timed out before its agent_start waits for pi to settle instead of being refused (124.762375ms)
+✔ engine: when pi has not started a timed-out turn by the end of the abort grace, the engine stops pi and fails held prompts (214.083225ms)
+✔ engine: a timed-out turn pi starts only after the grace never answers a later prompt (614.411262ms)
+✔ engine: late events of a run past its grace, before pi exits, answer nothing and nothing more is sent (early prompt response) (1.357092ms)
+✔ engine: late events of a run past its grace, before pi exits, answer nothing and nothing more is sent (late prompt response) (0.467478ms)
+✔ engine: a timed-out run pi did start outlives the grace; the next prompt goes out when it ends (426.039163ms)
+✔ engine: a malformed JSONL line fails the turn, not the process (24.53926ms)
+✔ engine: a turn that ends in error rejects with the error code; process exit fails pending turns (44.309806ms)
+✔ gateway: hello -> identify with intents, ready, heartbeat with jitter, ack (2.457558ms)
+✔ gateway: missed ack closes the socket and resumes with the last sequence (1.771858ms)
+✔ gateway: op 7 reconnect resumes; op 9 non-resumable re-identifies (0.639967ms)
+✔ gateway: op 9 resumable resumes (0.375641ms)
+✔ gateway: close 4014 is fatal, reports the missing intent, never reconnects (1.008807ms)
+✔ gateway: 4004 and 4013 are fatal too; 1006 reconnects with identify when no session (0.554907ms)
+✔ gateway: close() is final and unparseable frames are ignored (0.598089ms)
+✔ git: config validation is strict, needs write: true, a work tree and a private token file (59.877654ms)
+✔ git: the child environment drops every host git config, names one helper, and carries the token path only for origin (39.783192ms)
+✔ git: status reports the branch, ahead/behind and changed paths, and refuses off the named branch or mid-merge (62.59803ms)
+✔ git: parseStatus reads porcelain v2 including renames and conflicts (0.319469ms)
+✔ git: a commit stages exactly the named files, carries the seat author and the requester trailer, and pushes at once (72.648899ms)
+✔ git: commit refusals: message, paths, requester, nothing to commit, and an index that already holds other work (80.60857ms)
+✔ git: a commit whose push fails is still a commit, says so, and the next commit's push carries both (D6) (79.896972ms)
+✔ git: pull is fast-forward only; a diverged origin or dirty local files refuse with nothing merged (184.904102ms)
+✔ git: push pushes the named branch only and reports up to date (68.219258ms)
+✔ git: no token value or token path ever reaches a git argument list; outputs are masked and capped (82.819157ms)
+✔ git: the credential helper answers get over https from a private file and nothing else (189.324316ms)
+✔ git: the vault protocol validates before a commit, honours another owner's lock, reserves ids, and locks around writes (706.26153ms)
+✔ lock: the claim is exclusive; a second start against a live owner refuses (4.632315ms)
+✔ lock: a stale lock (dead owner, reused pid, or record without start) refuses run and is never signaled; only unlock clears it (63.558471ms)
+✔ lock: an incomplete claim (directory without owner record) is busy and refuses run; unlock clears it (0.992586ms)
+✔ lock: an owner record that exists but cannot be read is invalid: never signaled, never removed, never claimed over (3.098212ms)
+✔ lock: legacy upgrade; a live connector holding a {pid, start} record is unknown, unlock refuses and nothing changes; after it exits, unlock clears it (35.492097ms)
+✔ lock: a live pid whose record carries a malformed or noncanonical start or boot string is unknown, not a mismatch; nothing signals, removes, or claims over it (276.337199ms)
+✔ lock: identity syntax; only canonical unsigned decimal start ticks and lowercase boot uuids are identities (0.387733ms)
+✔ lock: a process whose start marker or boot id cannot be read refuses to claim (21.944564ms)
+✔ lock: a live pid whose identity cannot be read right now is unknown: never signaled, never removed, never claimed over (0.997322ms)
+✔ lock: four processes racing for the same binding; exactly one claims it and the others refuse (44.784525ms)
+✔ lock: stale handoff; concurrent starts over a stale lock all refuse, nothing reclaims, one unlock then exactly one live owner (127.61419ms)
+✔ lock: four-party schedule; claims landing inside an unlock's gap never survive, one unlock leaves no owner and no residue (81.727788ms)
+✔ notices: a kind is recorded per UTC day and found again (0.453794ms)
+✔ notify: the DM channel opens once, every send carries the nonce, and only the message id comes back (4.535992ms)
+✔ notify: refusals and unknowns surface as RestOutcome without ids; a refused send reopens the channel next time (1.99487ms)
+✔ notify: no dmRecipient, a non-0600 binding or token, or a missing binding refuse before any network use (1.476917ms)
+✔ recover: nothing to do is clean; a lock whose owner is gone or that has no record is cleared and STOP ends up absent (36.670371ms)
+✔ recover: an operator STOP refuses with exit 3 and is never removed, whatever the lock says (30.907626ms)
+✔ recover: a brake written during the unlock wins; STOP stays with both lines and the start is refused (29.75825ms)
+✔ recover: a held binding refuses with exit 3 and writes no STOP: live owner, alive pid without verifiable identity, unreadable record (64.522735ms)
+✔ cli: recover exits 0 when ready, 3 behind a brake or a held binding, and run's own STOP refusal is 3 (614.960929ms)
+✔ rest: createMessage sends nonce, enforce_nonce, empty allowed_mentions and a soft reply reference (2.340758ms)
+✔ rest: 429 waits retry_after and retries; 4xx is refused; 5xx and socket errors are unknown (2.865893ms)
+✔ rest: content and nonce limits are enforced locally; typing never throws (1.92538ms)
+✔ rest: react PUTs the encoded emoji on the inbound message for @me; 2xx is true, anything else is false and never throws (0.987028ms)
+✔ rest: createDm posts the recipient and resolves the channel id; 4xx refused, 5xx unknown, bad id never sent (0.988553ms)
+✔ setspark config: a bare https or loopback origin, a private key file, a principal (3.861687ms)
+✔ setspark config: reaches the tools config and the binding as a fixed key (2.215425ms)
+✔ setspark config: the binding's key survives resolveToolRoots and the engine's JSON hand-off to the extension (1.517433ms)
+✔ setspark config: approvers come from the binding's users, never from the binding's setspark key (1.464603ms)
+✔ setspark verbs: required_approvers go out as discord ids from names and come back as names (18.423125ms)
+✔ setspark verbs: no Discord user id reaches tool text, whatever shape the service returns it in (8.18819ms)
+✔ setspark contract: a decision made with names opens a request the connector accepts; names stored by an old record still refuse (6.18099ms)
+✔ setspark keys: read per call, one printable token per file, rotation without a restart (2.613993ms)
+✔ setspark idempotency keys: principal, turn id, call index; connector keys name a step (0.42033ms)
+✔ setspark http core: json in and out, bearer header, idempotency header, fixed user agent, no key anywhere else (1.751222ms)
+✔ setspark http core: error bodies become fixed refusals with code and the 409 fields; server text is data, cut (1008.237765ms)
+✔ setspark verbs: a setspark key enables the eight verbs and no counters (0.416396ms)
+✔ setspark verbs: writes carry the turn's key and the asserted requester, reads carry no key, and the api key never appears in text or details (5.847302ms)
+✔ setspark verbs: no turn refuses every write before any request; bad arguments refuse before any request; reads still work (1.195721ms)
+✔ setspark verbs: renderRecord caps long output and hides the accepted snapshot (0.186318ms)
+✔ setspark api: bind, add_approval (button and reply) and get use integer request ids and the connector's keys (2.252331ms)
+✔ tools: config refuses a missing, symlinked, dotted, non-directory or duplicate root and bad limits (3.781168ms)
+✔ tools: every escape is refused with a fixed reason and nothing outside the root is read (3.800572ms)
+✔ tools: happy paths list, read a window, and search case-insensitively; dotfiles and symlinks never appear (4.919484ms)
+✔ tools: the tool set renders text for the model, records details for the journal, and enforces the per-run budget (3.309601ms)
+✔ tools: listing and search caps hold (9.449111ms)
+✔ tools: credential shapes are caught; ordinary prose and ids are not (0.675371ms)
+✔ tools: the read uses the checked file itself; a symlink, a swapped file, a FIFO, a grown file or a hard link at read time is refused (4.561813ms)
+✔ tools: an unreadable file under the root is skipped by search and refused by read (1.222196ms)
+✔ tools: config accepts write: true only as a boolean, and enables the write tools only then (0.998888ms)
+✔ tools: every write outside the fence is refused before any byte lands, and no temp file remains (4.137461ms)
+✔ tools: write_file leaves the exact bytes, edit_file replaces one exact match, and the set renders the change as uncommitted (1.909729ms)
+✔ tools: a target that changed between the check and the rename is refused and the temp file is removed (1.144677ms)
+✔ web: config takes an https or loopback-http SearXNG base url and a bounded fetch cap (2.380846ms)
+✔ web: address rules refuse every private, loopback, link-local, mapped and multicast form (1.641343ms)
+✔ web: web_fetch refuses bad urls, private hosts, rebinding names, non-https redirects, too many hops, error status, non-text bodies, and times out (1023.551389ms)
+✔ web: web_fetch returns html as text with the title, follows an https redirect, keeps plain text and json, and cuts at the cap (4.228993ms)
+✔ web: html to text drops scripts, styles and comments, decodes entities and keeps block breaks (0.220466ms)
+✔ web: web_search asks the instance for json, returns at most ten clean results, and refuses a bad query, a down instance or an unusable answer (2.606061ms)
+✔ web: the tool set enables the web tools only with a web key, counts them in the budget, and records url, status and hits (2.202399ms)
+ℹ tests 178
+ℹ suites 0
+ℹ pass 178
+ℹ fail 0
+ℹ cancelled 0
+ℹ skipped 0
+ℹ todo 0
+ℹ duration_ms 2586.926055
diff --git a/agents/darkwing/work/queue-115/r1/gate/pkg-harness.log b/agents/darkwing/work/queue-115/r1/gate/pkg-harness.log
new file mode 100644
index 000000000..98fb0db9e
--- /dev/null
+++ b/agents/darkwing/work/queue-115/r1/gate/pkg-harness.log
@@ -0,0 +1,89 @@
+✔ sessionModel: agent vars win, then the system's execution settings (10.347285ms)
+✔ a pi bundle: prompt, policy, tools and manifest, 0600 in a 0700 directory (5.555993ms)
+✔ a claude-code bundle adds the wrapped gate hook and the MCP config (3.636062ms)
+✔ the prompt's built-in tools line is the harness's own names, as the manifest lists them (11.510057ms)
+✔ the prompt names the project clones in the workspace, and none when there are none (6.108332ms)
+✔ the prompt explains the review loop to a role with push_working, and reviews to one with fetch_review (7.717726ms)
+✔ a bundle is written once: an existing file refuses (2.1771ms)
+✔ a path with a single quote can't go into the hook command (2.262674ms)
+✔ allow exits 0, a deny exits 2 with the reason on stderr (127.716983ms)
+✔ a missing or wrong policy, or a bad event, exits 2 (92.400777ms)
+✔ the bundle's wrapped command: a missing gate or node still blocks (1087.274407ms)
+✔ claude: typed tools through MCP, the hook blocks, builtins outside --tools don't exist (764.139729ms)
+✔ claude: the hook alone blocks a path outside the workspace (446.060417ms)
+✔ claude: a second turn resumes the first turn's session (754.94832ms)
+✔ claude adapter: --restricted is always passed (5.541475ms)
+✔ claude adapter: MOSAIC_CLAUDE_BIN wins over PATH and must be an absolute executable (16.154334ms)
+✔ claude adapter: a directory pin exits 2 before it runs; a pin with a space runs (5.6766ms)
+✔ claude: CLAUDE.md files and auto-memory don't reach the model; without --restricted they do (740.181938ms)
+✔ claude: a missing hook or MCP file refuses before claude starts (7.493881ms)
+✔ pi: policy tools and typed tools pass, anything else is blocked (3.98485ms)
+✔ claude: builtins map from pi names, typed tools need the mcp prefix (0.988674ms)
+✔ file tool paths must resolve inside the workspace (1.820751ms)
+✔ pi's own path normalisation can't be used to step out (1.394656ms)
+✔ a symlink inside the workspace that points out is outside (1.243779ms)
+✔ a dangling symlink is refused at any depth, in both harnesses (4.579334ms)
+✔ read is checked under every spelling pi's read would open, in both harnesses (15.567935ms)
+✔ other spellings cover directories, dangling links and pi's cwd (2.290934ms)
+✔ a relative path climbs from the workspace's real path, in both harnesses (5.598412ms)
+✔ claude path fields per tool (0.695139ms)
+✔ glob patterns stay inside the workspace (0.880898ms)
+✔ a path that can't be checked is blocked (0.374525ms)
+✔ fetch_review's have lists the working refs before origin's, and no more than HAVE_MAX (227.061423ms)
+✔ fetch_review's have orders the working refs newest first within each clone, one clone after another (137.059677ms)
+✔ a runner git past its time: SIGTERM reaches its process group, and SIGKILL follows after the grace period (1810.842274ms)
+✔ once a signalled runner git has closed, its group gets SIGKILL, so a process that ignored SIGTERM dies too (305.646243ms)
+✔ initialize, ping and tools/list (50.696205ms)
+✔ tools/call goes through the tool socket; a refusal is an isError result (36.39016ms)
+✔ replies are compact JSON; over the cap a tool error names the size and the cap (38.03129ms)
+✔ unknown tools and methods are JSON-RPC errors and never reach the socket (37.815066ms)
+✔ a missing argument is a usage error (33.657201ms)
+✔ pi: typed tools reach the socket, the gate blocks, agent_end writes the marker (385.070191ms)
+✔ pi: a reply over the cap is a tool error naming the size and the cap; list_tasks asks for open tasks (317.576861ms)
+✔ pi: a write through a dangling symlink is blocked, and nothing appears outside (312.118473ms)
+✔ pi: a read is refused when pi would open another spelling outside (310.701639ms)
+✔ pi: a relative path climbs from the real path of a workspace behind a symlink (306.095706ms)
+✔ pi: a relative path climbs from the real path of a dataRoot behind a symlink (317.774581ms)
+✔ pi: a missing extension refuses before any model call (5.983977ms)
+✔ pi: an extension without its configuration fails pi's start (267.17437ms)
+✔ founderCheck: founder variables, then a needed service without a usable token (1.188385ms)
+✔ turnRequest names the sender, class, reply and decision (0.186339ms)
+✔ turnRequest says a tester's message is a test and never Jason's instruction (0.224418ms)
+✔ turnRequest shows the message's own sent time, a day old as well as new (0.140576ms)
+✔ stateBlock names the launch state with its time and event, and the open tasks with the cap (0.242242ms)
+✔ a message becomes a turn, the answer goes back as a RESULT, SIGTERM releases and exits 0 (265.727605ms)
+✔ launches revoked and then restored: the turn's block reads allowed and gives the restore time (235.965959ms)
+✔ a task closed on the tracker is missing from the next turn's open list (217.465491ms)
+✔ a message read a day after it was sent shows the time it was sent (175.110743ms)
+✔ a decision the human resolves becomes a turn citing the decision and the answer (213.488065ms)
+✔ a failed state read fails the turn: no adapter runs, the sender hears why, the message is read (118.491432ms)
+✔ a SIGTERM before the claim stops the runner with exit 0 and no claim (102.71037ms)
+✔ typed tools carry the runner's capability; launch goes to the host's launch socket (422.096172ms)
+✔ a RESULT gets no automatic reply; failed turns reply with the reason (1293.239494ms)
+✔ SIGTERM during a turn kills the turn's process group and still exits 0 (150.156771ms)
+✔ founder credentials stop before the claim (20) (167.45365ms)
+✔ a refused claim exits 21; an ended run's capability exits 22 (201.213691ms)
+✔ the launch ending under a running session exits 22 (144.457268ms)
+✔ a broker that stays unreachable exits 23 after brokerRetries polls (253.963818ms)
+✔ a broker that is down at the claim exits 23, not 21 (101.405395ms)
+✔ no capability, or a malformed one, on stdin exits 2 (241.453984ms)
+✔ a missing or malformed policy exits 2 before the claim (148.41295ms)
+✔ the PM gets launch, its task verbs and the reads (8.682596ms)
+✔ list_requirements reads the requirement ids, for a task.create holder with a tracker (4.856353ms)
+✔ a coder gets no launch, no resolve_decision, and no task tools without a tracker (1.891822ms)
+✔ a coder with a tracker gets its own task tools and no task_reassign (1.343874ms)
+✔ launch only when the business's launch block names the instance as launcher (1.904065ms)
+✔ an action outside the instance's authority has no tool (1.851432ms)
+✔ the review loop: push_working and request_review for the coder, fetch_review and review_verdict for the reviewer, none for the PM (6.996691ms)
+✔ callTool: one JSON line out, the result back, a refusal rejects (11.272327ms)
+✔ list_tasks takes the broker's filters and pages; get_task takes a task_ref (2.55634ms)
+✔ callTool sends list_tasks done false unless the session names done; other tools as given (2.468354ms)
+✔ replyText: compact JSON up to the cap, an error naming the size and the cap over it (0.673375ms)
+ℹ tests 81
+ℹ suites 0
+ℹ pass 81
+ℹ fail 0
+ℹ cancelled 0
+ℹ skipped 0
+ℹ todo 0
+ℹ duration_ms 11325.495606
diff --git a/agents/darkwing/work/queue-115/r1/gate/pkg-ledger.log b/agents/darkwing/work/queue-115/r1/gate/pkg-ledger.log
new file mode 100644
index 000000000..04abe69a8
--- /dev/null
+++ b/agents/darkwing/work/queue-115/r1/gate/pkg-ledger.log
@@ -0,0 +1,94 @@
+✔ a raw token file, with or without one trailing newline, reaches curl only through the config stream (104.476604ms)
+✔ the raw path accepts nothing else, and refuses before curl runs (348.807194ms)
+✔ the file checks still apply on the raw path: mode, symlink, missing, directory (264.613859ms)
+✔ the raw path base URL has no override (51.590158ms)
+✔ the JSON path is unchanged, and JSON never falls through to the raw path (237.912868ms)
+✔ a file that changes between the two reads refuses before curl runs, with or without a body (698.031675ms)
+✔ the token reaches no child environment, even with an inherited CFG or SHELLOPTS=allexport (672.886536ms)
+✔ real helper GET HTTP 200 preserves exit 0 without credentials (13.429548ms)
+✔ real helper POST HTTP 201 preserves exit 0 without credentials (9.901501ms)
+✔ real helper GET HTTP 403 preserves exit 1 without credentials (8.540443ms)
+✔ fixture git subjects only, follow-ups and three session kinds (175.893398ms)
+✔ text and JSON carry same numbers, open and truncated title (203.766869ms)
+✔ missing credentials exit 2, no-issues never calls API and shows unknown (191.396969ms)
+✔ empty range gives no rows and zero totals (141.133115ms)
+✔ inclusive UTC dates, first-line preamble only, role and seat boundaries (155.620803ms)
+✔ close-only issue included, even median, missing metadata stays unknown (146.014255ms)
+✔ unique commits but per-issue links count multiple tags once each (144.69978ms)
+✔ issue pages of 50, 50 and 7 read 107 issues in 3 pages (300.186932ms)
+✔ one short page reads 1 page; --no-issues reads none and says so (243.538886ms)
+✔ a short page 10 is read; a full page 10 refuses at the ceiling (683.239931ms)
+✔ an issue number on two pages refuses (153.910914ms)
+✔ a failing page 2 refuses the whole read without its stderr (151.040039ms)
+✔ page 2 with a malformed record refuses (147.388804ms)
+✔ page 2 with more than 50 rows refuses (160.147027ms)
+✔ bad API payload not JSON refuses (158.91941ms)
+✔ bad API payload {} refuses (134.819986ms)
+✔ bad API payload [{"number":1}] refuses (156.168351ms)
+✔ partial or malformed session log refuses with location, not content (144.526854ms)
+✔ a U+2028 or U+2029 inside a session string is one line, not a malformed record (137.344266ms)
+✔ no sessions is an empty table; symlink source refuses (203.263306ms)
+✔ reads only refactor even when another branch is checked out (154.345431ms)
+✔ invalid dates, reverse dates and duplicate options refuse (110.746518ms)
+✔ T3 agent assignments do not count as human in Table 2 (180.733776ms)
+✔ preamble parsing and issue number boundaries (0.428873ms)
+✔ T3 header: agent, or board from control-board; anything short of the full header is human (0.159212ms)
+✔ no closed issues with human messages means undefined ratio, not invented zero (0.182842ms)
+✔ T3: seat, archived, unmapped and Researcher threads count; imported, deleted and other-project threads do not (508.179793ms)
+✔ T3: the default path is read from HOME and prints no path line; --no-t3 says so (671.517504ms)
+✔ T3: a HOME with no database exits 1 and names --no-t3 (128.320519ms)
+✔ T3: a file that is not a database exits 1 and names --no-t3 (136.801055ms)
+✔ T3: a seat thread renamed to another seat exits 1 naming thread, title and roles (377.267497ms)
+✔ T3: an unmapped thread addressed as a seat exits 1 (382.209844ms)
+✔ T3: a header to another thread id is not cross-checked (379.237748ms)
+✔ T3: no project, or two, for this root exits 1 (1003.730454ms)
+✔ T3: a removed column exits 1 and names it (245.409404ms)
+✔ T3: a missing table exits 1 and names it (237.76315ms)
+✔ T3: a counted row with an unknown role exits 1 without its text (396.068157ms)
+✔ T3: a counted row with role reasoning without the reasoning: id prefix exits 1 without its text (429.262346ms)
+✔ T3: a counted row with non-text content exits 1 without its text (386.976775ms)
+✔ T3: a counted row with an unparseable created_at exits 1 without its text (387.777513ms)
+✔ T3: a reasoning summary is skipped before any check and counted as excluded (1018.64913ms)
+✔ T3: a missing orchestration_events makes the diagnostic unknown and keeps the counts (726.930035ms)
+✔ T3: a human message with no event counts in humanWithoutEvent (385.366173ms)
+✔ T3: an unparseable event makes the diagnostic unknown and keeps the counts (700.468322ms)
+✔ T3: an event with no string messageId makes the diagnostic unknown and keeps the counts (700.869191ms)
+✔ T3: an error that is not from SQLite is rethrown, not reported as a database failure (324.694839ms)
+✔ T3: a symlink at ~/.t3 exits 1 (131.649989ms)
+✔ T3: a symlink at ~/.t3/userdata exits 1 (141.829415ms)
+✔ T3: a symlink at ~/.t3/userdata/state.sqlite exits 1 (155.56886ms)
+✔ T3: with --t3-db, a symlinked file or directory exits 1 (514.339857ms)
+✔ T3 WAL: the newest message only in -wal, writer attached, is counted (387.765831ms)
+✔ T3 WAL: stopped cleanly, counts are correct and the main file is unchanged (392.727365ms)
+✔ T3 WAL: -wal without -shm in a writable directory is read (425.371769ms)
+✔ T3 WAL: -wal without -shm in a read-only directory exits 1 (423.097073ms)
+✔ T3 WAL: stopped cleanly in a read-only directory exits 1 (396.120034ms)
+✔ T3: a lock held past the 5 s busy timeout exits 1 and names --no-t3 (5402.903295ms)
+✔ a done row whose closing issue is open is a violation; a row that is not done is not (1.736242ms)
+✔ an issue several rows close is expected closed only once all of them are done (0.48098ms)
+✔ closure needs positive evidence: unknown is undecided, and so is a skipped or short issue check (0.3408ms)
+✔ each owner of an in-progress or in-review row gets one liveness class (7.326809ms)
+✔ a required row not done after 14 days is a violation; a legacy row uses genesis as its lower bound (0.359687ms)
+✔ an ISO requiredSince, as `set required` writes it, ages from its UTC day; one that does not parse is a violation (0.222576ms)
+✔ the text section always ends in a count and a result, and never prints a full pass (0.316642ms)
+✔ pidAlive: a running pid is present, an exited one is gone, and EPERM still means present (22.296709ms)
+✔ issue states: open list first, then the metric page, then at most 10 lookups (272.962581ms)
+✔ a full open list: lookups settle what it leaves out, and only an unsettled issue keeps it undecided (355.777548ms)
+✔ the open list refuses on a failed call or a bad record, and never echoes the helper (163.518558ms)
+✔ a helper call past the deadline is killed with its child, and the call reports it (2006.917432ms)
+✔ readQueue loads queue.json through the queue validator and refuses anything else (119.186682ms)
+✔ protected changes list every in-range entry that changes a required or parked row (396.954525ms)
+✔ the CLI prints the queue section above the weekly table and under a queue key in --json (505.941801ms)
+✔ a queue with nothing wrong prints 0 violations and a reduced pass, never a full pass (232.473621ms)
+✔ --no-issues makes no call and leaves the issue checks undecided; --no-queue skips the section (339.160081ms)
+✔ the CLI refuses a bad queue before any call, and a failed open list with exit 2 (316.376265ms)
+✔ --unsupported-runtime repeats once per seat and takes a seat name (316.63609ms)
+✔ an unreadable config makes every owner invalid instead of passing them (176.879075ms)
+ℹ tests 86
+ℹ suites 0
+ℹ pass 86
+ℹ fail 0
+ℹ cancelled 0
+ℹ skipped 0
+ℹ todo 0
+ℹ duration_ms 22335.042077
diff --git a/agents/darkwing/work/queue-115/r1/gate/pkg-mosaic.log b/agents/darkwing/work/queue-115/r1/gate/pkg-mosaic.log
new file mode 100644
index 000000000..657892f27
--- /dev/null
+++ b/agents/darkwing/work/queue-115/r1/gate/pkg-mosaic.log
@@ -0,0 +1,77 @@
+✔ pure resolution selects current default or explicit enrolled account (1.971677ms)
+✔ scope is explicit, bounded and never inferred (1.613075ms)
+✔ fork pin is preserved against default change, override, missing account and revocation (0.761782ms)
+✔ unenrolled account/provider, missing harness, model expansion and native model ceiling refuse (0.788194ms)
+✔ only explicit synthetic credential forms and internal fixture stores admitted (5.487046ms)
+✔ two concurrent workspaces of the same agent publish distinct complete private generations (58.412392ms)
+✔ same execution ID is exclusively claimed and cannot overwrite a published generation (31.26334ms)
+✔ failed generation after-auth preserves prior files, records failure and refuses blind same-ID retry (43.756589ms)
+✔ failed generation before-publish preserves prior files, records failure and refuses blind same-ID retry (47.541913ms)
+✔ credential lock contention refuses without duplicate side effects (8.310068ms)
+✔ symlinked pre-existing final target is refused and never followed (33.262886ms)
+✔ invalid registry cannot resolve; no fallback to supplied partial entries (0.247098ms)
+✔ post-publication failure records uncertainty, preserves complete generation and prevents replay (26.548106ms)
+✔ expired credentials refresh under transaction and subsequent generation reuses rotation (87.89772ms)
+✔ refresh failure retains prior generation and store state (62.358227ms)
+✔ refresh timeout retains prior generation and store state (151.278267ms)
+✔ refresh malformed retains prior generation and store state (67.746502ms)
+✔ concurrent refresh on same account refuses contention while unrelated account proceeds (221.821562ms)
+✔ invalid refresh options refuse before burning claim (32.161144ms)
+✔ fixed fake process rotates both OAuth fields without mutating caller input (27.197492ms)
+✔ concurrent isolated processes preserve separate provider credentials (29.509565ms)
+✔ fake failure is refused with fixed diagnostics (22.348203ms)
+✔ fake malformed is refused with fixed diagnostics (20.396993ms)
+✔ fake timeout is refused with fixed diagnostics (103.057163ms)
+✔ fake unchanged is refused with fixed diagnostics (22.78483ms)
+✔ caller executable/environment injection is rejected before spawning (0.285621ms)
+✔ valid fixture tree validates and lists without secrets (64.278303ms)
+✔ unknown-field refuses (0.369028ms)
+✔ invalid-id refuses uppercase and traversal shapes (0.293796ms)
+✔ plain-http baseUrl requires allowInsecureTransport (0.308237ms)
+✔ native provider rejects allowInsecureTransport (0.135725ms)
+✔ unsupported credential type and kind refuse (0.151989ms)
+✔ account provider-path mismatch refuses (0.654973ms)
+✔ profile account refs must be provider/account shaped (0.220634ms)
+✔ seat selection accepts fork pin field, validates account refs (0.210939ms)
+✔ harness manifest id must equal executable (gate 1) (0.199478ms)
+✔ CLI validate: duplicate provider id across files refuses (29.691793ms)
+✔ CLI validate: missing referenced provider/account refuse (33.934069ms)
+✔ CLI validate: broken JSON refuses without secret echo (25.629487ms)
+✔ CLI usage errors exit 2 (48.30978ms)
+✔ credential.json sibling presence does not break validation and is never read (65.995366ms)
+✔ D1 missing, empty and structurally empty roots refuse, no list projection (170.222109ms)
+✔ D1 required directory auth cannot be absent (55.390525ms)
+✔ D1 required directory auth/providers cannot be absent (57.27897ms)
+✔ D1 required directory auth/accounts cannot be absent (63.035347ms)
+✔ D1 required directory auth/settings cannot be absent (58.924028ms)
+✔ D1 required directory harnesses cannot be absent (65.154046ms)
+✔ D1 root file and unreadable metadata refuse (105.801568ms)
+✔ D2 no symlink traversal at auth/providers/openai-codex.json (59.674298ms)
+✔ D2 no symlink traversal at auth/accounts/openai-codex/homelab-openai (57.127044ms)
+✔ D2 no symlink traversal at auth/providers (52.837778ms)
+✔ D2 no symlink traversal at auth (49.759611ms)
+✔ D2 root and ancestor symlinks and lexical traversal refuse (154.988583ms)
+✔ private filesystem modes enforced for root (51.998396ms)
+✔ private filesystem modes enforced for auth (49.92272ms)
+✔ private filesystem modes enforced for auth/providers/openai-codex.json (53.326434ms)
+✔ private filesystem modes enforced for auth/accounts/openai-codex/homelab-openai/account.json (59.466517ms)
+✔ D3 numeric version 1 only across all record kinds (1.199794ms)
+✔ D4 nested unknown keys and missing per-kind required fields refuse (64.079601ms)
+✔ D5 unenrolled default refuses even when account exists (63.388182ms)
+✔ D6 provider/account credential type must match (60.582579ms)
+✔ D7 every harness endpoint enforces HTTP opt-in and shape (0.472402ms)
+✔ D8 URLs reject embedded credentials and unsupported protocols without echo (158.182061ms)
+✔ D9 malformed JSON diagnostics contain no content excerpt (59.067789ms)
+✔ D10 missing metadata is missing-path, not invalid-json (59.715851ms)
+✔ D10 library returns no partial entries on any invalid record (72.349622ms)
+✔ null/scalar/array metadata refuses without stack or echo (247.841532ms)
+✔ credential sibling is never opened, even when an unreadable symlink (33.479506ms)
+✔ oversized metadata refuses before parsing (57.415057ms)
+ℹ tests 69
+ℹ suites 0
+ℹ pass 69
+ℹ fail 0
+ℹ cancelled 0
+ℹ skipped 0
+ℹ todo 0
+ℹ duration_ms 2095.007421
diff --git a/agents/darkwing/work/queue-115/r1/gate/pkg-queue.log b/agents/darkwing/work/queue-115/r1/gate/pkg-queue.log
new file mode 100644
index 000000000..68e322d26
--- /dev/null
+++ b/agents/darkwing/work/queue-115/r1/gate/pkg-queue.log
@@ -0,0 +1,166 @@
+✔ F1: an ordinary commit after update-ref is refused until step 8; then it commits and the queue stays at C (1262.559753ms)
+✔ F1: a plain `commit -e` whose guard ran before update-ref fails at its own HEAD update (960.782477ms)
+ℹ git commit -e: index.lock free during the editor
+✔ F1: a `commit -e -- path` whose guard ran before update-ref fails at its own HEAD update (937.206331ms)
+ℹ git commit -e -- src.txt: index.lock held during the editor
+✔ F1: step 8 with index.lock held exits 3, and ordinary commits stay refused until the printed command runs (1014.1323ms)
+✔ F1: HEAD moving after the step-7 guard check and before update-ref: refused, nothing published (1024.850086ms)
+✔ F1: H is recorded before the canary, so HEAD moving during the step-1 canary is refused at step 7 (990.049756ms)
+✔ F1: a queue commit landing after H is recorded: step 1 says HEAD moved, not the guard (1316.541269ms)
+✔ F1: a queue commit landing between the HEAD check and the canary: the failed clean run is reported as HEAD moved (963.574158ms)
+✔ F1: a shared-index change during the procedure is not committed (1022.940677ms)
+✔ F1: a queue path staged after update-ref: step 8 stops and touches nothing (1091.296385ms)
+✔ F1: a missing or a different hook refuses (757.76171ms)
+✔ F1: same bytes without the exec bit, a symlinked hook, and core.hooksPath in the local or global scope each refuse before update-ref (1202.359456ms)
+✔ F1: the canary refuses a hook that git would not run (628.769215ms)
+✔ F1: the guard deactivated after step 1 is refused at the step-7 recheck (958.672708ms)
+✔ bootstrap: implementation-only HEAD, the guard, genesis, the --genesis commit, then an extending commit (862.013741ms)
+✔ bootstrap: --genesis with a base present, no base without --genesis, an op before the first commit, a changed map, another branch (870.844237ms)
+✔ bootstrap: the archived tests and validator run outside any repository (913.902483ms)
+✔ general: an unrelated staged file stays staged, and the committed blobs are the snapshot bytes (868.10661ms)
+✔ general: a queue write after the snapshot is not committed (1259.314051ms)
+✔ general: a snapshot whose log does not extend the base refuses (946.809429ms)
+✔ general: install-hook privilege, repair of a same-bytes hook, and its refusals (153.299891ms)
+✔ general: environment overrides, a linked worktree and usage (590.498429ms)
+✔ general: a queue path staged before the run refuses at step 1 (640.689667ms)
+✔ general: HEAD's queue tests failing in the archive refuse (865.280394ms)
+✔ genesis document serializes deterministically and replays (5.157478ms)
+✔ a hand edit that stays valid JSON fails replay; a formatting-only edit fails re-serialization (3.151668ms)
+✔ a tampered result, receipt or viewSha fails replay (2.991444ms)
+✔ op ids: 8 to 72 characters for callers, 80 in the log for .outcome entries (0.151578ms)
+✔ add: defaults for an ordinary seat, privileged extras, refusals (3.658169ms)
+✔ matrix: queued→briefed privileged; briefed→in-progress owner with after satisfied (4.754448ms)
+✔ matrix: release, review round, changes requested and waiting-on-jason (12.841509ms)
+✔ matrix J5: in-review→done by the gate owner with evidence naming the current round (7.802121ms)
+✔ review issue, lead decision 23: none refuses, one is used, several need --issue, later rounds keep it (18.239017ms)
+✔ the row schema refuses a round with a null issue, and the A1 review shape (P2) (2.110697ms)
+✔ matrix R1: every state × target × actor class matches 8.7, gate owner jason or not, required or not (1419.908622ms)
+✔ matrix: blocked keeps the claim and returns only to previousState (3.436772ms)
+✔ matrix J4: parking is Jason's, refused while required; unpark returns to queued (2.462469ms)
+✔ field edits: who may change what (4.25801ms)
+✔ set issues keeps a logged narrowing of closes (N10) (2.384926ms)
+✔ text the table shows refuses \ and <, everywhere it enters (N8) (1.62736ms)
+✔ every accepted text renders to nine cells on every row (N8) (20.381325ms)
+✔ genesis: the map refuses an owner among its row's reviewers; replay doesn't (2026-10-04) (0.486924ms)
+✔ times and dates must be calendar values, not just the shape (2026-10-04) (1.468403ms)
+✔ replay holds every op id to the caller's rule (N11) (4.710186ms)
+✔ note: owner, listed reviewer or privileged; empty clears (1.098741ms)
+✔ assign moves the claim with the owner; done clears it (2.343832ms)
+✔ render is byte-stable and escapes pipes (0.442445ms)
+✔ view classification: current, genuine stale, edited stale marker, changed current body, markers (0.550556ms)
+✔ next: resume, then review, then start, then wait, then nothing; lowest id first (15.818532ms)
+✔ canonical args make a retry's identity independent of list order (0.304512ms)
+✔ manifests, headings and blob ids (0.3898ms)
+✔ the migration map: one queue-map block, exact keys (0.510962ms)
+✔ every call but `queue` reaches the seat CLI exactly as before A2 (548.670972ms)
+✔ no argument reaches the app entry in packages/cli, and only that call (70.942122ms)
+✔ `queue` reaches the queue CLI with the rest of the arguments (186.670958ms)
+✔ the pre-A2 fixture is the script A2 changed (0.410739ms)
+✔ an old privileged add with no gate owner still replays through loadDoc, and gets jason (5.276974ms)
+✔ a non-privileged add gets jason through the replay path and can't name a gate owner (1.981716ms)
+✔ the CLI refuses a privileged add without --gate-owner, for jason and sage, and writes nothing (280.479973ms)
+✔ the CLI add with --gate-owner carries the named owner and records a log entry (279.37693ms)
+✔ the CLI add by a non-privileged seat gets jason and can't name a gate owner (326.436194ms)
+✔ a retried sage add recorded with no gate owner answers (already recorded at rev N) and writes nothing (262.20533ms)
+✔ acquire publishes the record by link; release removes only its own lock (8.539708ms)
+✔ a kill between the temp write and the link leaves no lock (53.317824ms)
+✔ a short or failed temp write refuses and leaves no lock and no temp (6.771825ms)
+✔ a link error other than EEXIST refuses (9.598215ms)
+✔ an error after the link releases the lock: unreadable gate, failing temp stat (17.898579ms)
+✔ a release that fails on a gate path is reported, never a stack trace (P1) (38.154806ms)
+✔ a paused holder: another writer waits 10 s, then refuses naming it live (10086.30987ms)
+✔ two concurrent unlockers: the second refuses on the gate (40.321837ms)
+✔ a writer publishing during an unlock, lock first: unlock sees it live and refuses (19.529924ms)
+✔ a writer publishing during an unlock, gate first: the writer releases and refuses (20.715134ms)
+✔ a gate swapped while held is left in place and reported, on success and on refusal (N1) (16.567055ms)
+✔ a reused pid within one boot is mismatch; unlock removes the lock and never signals the process (13.418003ms)
+✔ the same pid and start on a different boot is mismatch (0.468532ms)
+✔ a foreign host is unknown whatever the local pid says; unlock refuses (85.585415ms)
+✔ unreadable /proc: classification is unknown and acquire refuses (0.678655ms)
+✔ invalid records: empty, unparsable, wrong keys, bad start or boot (0.185589ms)
+✔ a stale gate blocks writers; --check-gate says mismatch for a reused pid (20.281144ms)
+✔ a delayed release by a dead owner, after unlock and a new owner: the inode check keeps the new lock (16.658086ms)
+✔ release checks the inode too: a byte-identical lock file with a new inode is left in place (5.573601ms)
+✔ unlock refuses a live, unknown or invalid lock, and does nothing without one (33.814431ms)
+✔ the migration map validates and renders the golden genesis table (2.956998ms)
+✔ the marked QUEUE.md holds every row and parked item between its markers (1.223013ms)
+✔ map-check reports each kind of drift (6.826644ms)
+✔ a request posts once as the requester; a retry sends nothing (835.764092ms)
+✔ each transport answer maps to posted, failed or uncertain (8.9 step 3) (4233.402885ms)
+✔ the pre-send checks: GET user must name the requester, under the deadline (1556.674154ms)
+✔ the lead's request refuses a token for login sage (925.441511ms)
+✔ the credential file: the seat's own, 0600, no symlink, never the shared default (853.662401ms)
+✔ an unresolved request blocks a new request, a new round, waiting-on-jason and done (2324.566948ms)
+✔ a same-op retry after a kill sends nothing, even with a stale view (3121.603791ms)
+✔ a held lock at the outcome exits 3 and names what the transport said (682.455562ms)
+✔ late outcomes: after an abandon, and after a resolve with the same or another id (2260.694359ms)
+✔ resolve checks the comment: issue, markers, round, candidate and author (1645.015841ms)
+✔ the lead resolves a seat's request: the comment's author is the requester, fetched with the lead's token (669.105461ms)
+✔ validateRow checks a request round's shape, which every replayed entry must keep (462.470375ms)
+✔ request, changes, a new candidate, approval: every round pinned; no review files (1707.091203ms)
+✔ a row with no reviewers opens a round that posts nothing (1164.922653ms)
+✔ verify-commit: a prospective tree must hold exactly the candidate's paths (1321.481119ms)
+✔ semantics: v1 entries replay as before; review entries need v2 (485.071259ms)
+✔ set reviewers refuses the row's owner (2026-09-28) (350.74579ms)
+✔ the owner records no verdict, even as a listed reviewer (475.594632ms)
+✔ a request comment over the length limit is not sent (579.811923ms)
+✔ a late POST on a closed row leaves a conflict nothing can resolve, and resolve asks nothing (655.541969ms)
+✔ a Jason-gated row reaches waiting-on-jason only on every reviewer's approval (2430.596025ms)
+✔ genesis: refusals before anything is written (443.74271ms)
+✔ genesis: the map must be committed, well formed, with committed briefs and seats (607.727626ms)
+✔ genesis: markers, a stray witness, once only; a retry returns the receipt (522.095676ms)
+✔ genesis: a file holding genesis alone with no witness is confirmed by sync or a retry (386.226222ms)
+✔ canonical checks: worktree, second clone, detached HEAD, wrong branch, GIT_DIR, foreign code; a symlink works (603.933253ms)
+✔ --by that differs from MOSAIC_AGENT_NAME warns on stderr and logs nothing more (N12) (719.027006ms)
+✔ op ids: missing, too long, reserved; a retry answers; another payload refuses (723.060146ms)
+✔ a retried add returns the id it first allocated, after reassignment and after done (918.016699ms)
+✔ Rocko's S4 schedule: a lost result, another writer, then the retry opens no second round (671.823368ms)
+✔ the review issue and the evidence round through the CLI (lead decision 23, 8.7) (1202.000118ms)
+✔ claims and add defaults through the CLI; candidates are manifests or reachable commits (820.536012ms)
+✔ add, set reviewers and assign refuse the row's owner as a reviewer (549.803003ms)
+✔ the working-brief check: a changed working copy refuses the start and flags next (648.937468ms)
+✔ next: resume first, then nothing for an idle seat; needs a seat (307.756726ms)
+✔ view stale: new ops and verify refuse naming the unshown op; retries answer; reads warn; render fixes (667.631106ms)
+✔ view unknown: a hand edit, an old marker over an edited body, missing or duplicate markers (1188.71503ms)
+✔ a hand edit to queue.json refuses every verb, reads included (593.343963ms)
+✔ verify and render --check leave bytes and mtimes unchanged (424.353985ms)
+✔ render is byte-stable across runs and repositories (290.67542ms)
+✔ snapshot and verify --snapshot (760.894849ms)
+✔ usage errors exit 4 (527.65888ms)
+✔ a short write, ENOSPC or a file fsync failure: nothing visible, temp removed (273.569734ms)
+✔ a rename failure: nothing visible, temp removed (209.904904ms)
+✔ a directory fsync failure: uncertain, exit 3, no receipt; the tail refuses new ops; a retry confirms (255.897309ms)
+✔ a directory fsync failure, then sync names the op (389.035859ms)
+✔ a witness write failure: uncertain, durable, exit 3; the view is untouched (203.851909ms)
+✔ the .git fsync after the witness rename fails: uncertain, exit 3, the witness says so (188.969439ms)
+✔ confirming a tail fsyncs queue.json and docs/plans before the witness; either failure changes nothing (202.028288ms)
+✔ the docs/plans fsync after the view rename fails: the op stands, the view is written, a warning says so (195.526564ms)
+✔ a lock swapped while held is left in place and reported, on a receipt and on a refusal (195.403569ms)
+✔ a lock that cannot be released after an op is reported, on a receipt and on a refusal (199.173797ms)
+✔ unlock prints a swapped gate's warning on stderr, the result on stdout (141.649238ms)
+✔ a view write that fails keeps the op and reports a stale view (174.203888ms)
+✔ SIGKILL before the rename: nothing recorded; the retry removes the leftover temp (657.2067ms)
+✔ SIGKILL after the rename, before the witness: the tail refuses new ops and sync names the op (685.236927ms)
+✔ SIGKILL after the witness, before the view: the stale refusal names the op (614.595647ms)
+✔ SIGKILL after the view, before the receipt: the retry returns the receipt (624.32273ms)
+✔ git checkout between steps 1 and 7: step 7 refuses and nothing is written (242.144809ms)
+✔ git stash restoring an older valid pair: history lost; accept-history needs privilege, a reason and --yes (1022.892723ms)
+✔ a deleted witness: refused after the locked recheck; accept-history records it absent (336.401464ms)
+✔ a header edit during a write: the op stands, the view write is skipped with a warning (228.707875ms)
+✔ a reader paused between the witness and the file while a writer finishes: no lost-history report (205.495581ms)
+✔ rows: every row as show prints it, in list order; writes nothing; same notes and refusals as list (273.039122ms)
+✔ file-then-witness order forced by a hook: the locked recheck prevents a false report (223.600117ms)
+✔ a writer paused before and after the witness rename: readers see a tail, then a match (217.24114ms)
+✔ a true rollback is reported only after the locked recheck; a held lock names its holder instead (620.210183ms)
+✔ an accept-history in progress: an unlocked reader waits on the lock and never reports lost history (567.346659ms)
+✔ the platform check refuses other filesystems (147.796188ms)
+✔ tmpfs passes only a test layer that allows it (N5) (211.307043ms)
+✔ unlock keeps a multi-line lock record on stdout (P3) (214.938974ms)
+ℹ tests 156
+ℹ suites 0
+ℹ pass 156
+ℹ fail 0
+ℹ cancelled 0
+ℹ skipped 0
+ℹ todo 0
+ℹ duration_ms 28822.991906
diff --git a/agents/darkwing/work/queue-115/r1/gate/pkg-runs.log b/agents/darkwing/work/queue-115/r1/gate/pkg-runs.log
new file mode 100644
index 000000000..dee7dd147
--- /dev/null
+++ b/agents/darkwing/work/queue-115/r1/gate/pkg-runs.log
@@ -0,0 +1,51 @@
+✔ isRunId accepts the run id shape and nothing else (0.834244ms)
+✔ a missing data root or runs directory lists nothing (1.334917ms)
+✔ runs as a regular file lists nothing, as before (0.486801ms)
+✔ listRunIds keeps r- names only, sorted oldest first (0.645402ms)
+✔ listRunRecords returns each result, or null for an incomplete or unreadable one (1.220716ms)
+✔ readRunRecord returns documents and artifacts in directory order (0.846435ms)
+✔ readRunRecord is null for a missing run, a dangling link or a file (0.571359ms)
+✔ readRunRecord and readRunDocument refuse an invalid run id before touching the disk (0.54012ms)
+✔ readRunDocument reads only the three run documents (0.446762ms)
+✔ a link inside the data root is followed (0.805545ms)
+✔ a data root that is itself a link is trusted as configured (0.549473ms)
+✔ a run directory linked out of the data root is never read (0.57426ms)
+✔ a document linked out of the data root reads as null (0.716469ms)
+✔ a runs directory linked out of the data root refuses (0.492543ms)
+✔ a relative link that climbs out of the data root refuses (0.346702ms)
+✔ a sibling whose name starts with the data root's name is outside it (0.421875ms)
+✔ a link loop refuses instead of reading as missing (0.525745ms)
+✔ an unreadable runs directory refuses instead of listing nothing (0.349254ms)
+✔ an unreadable run directory refuses instead of reading as missing (0.404474ms)
+✔ a link to the data root's parent is outside it (0.313963ms)
+✔ listRunIds sorts whatever order the directory returns (0.646261ms)
+✔ listRunRecords lists an r- name that isn't a valid run id, as before (0.405616ms)
+✔ the readers write nothing (1.894634ms)
+✔ no pointer is null (1.484844ms)
+✔ the pointer release.sh writes reads back (0.932287ms)
+✔ a pointer that isn't the version 1 shape refuses with exit 2 (1.380257ms)
+✔ a pointer that is a directory refuses with exit 4 (0.861593ms)
+✔ a state file linked out of the data root refuses (0.763491ms)
+✔ a state directory linked out of the data root refuses (0.477329ms)
+✔ a state directory linked out to nothing reads as no release and an empty log (0.394575ms)
+✔ a missing log is empty (0.29684ms)
+✔ the log reads oldest first and counts malformed lines (0.796211ms)
+✔ last must be a positive integer (0.389634ms)
+✔ the state readers write nothing (0.663022ms)
+✔ list prints each run in the established format (64.057952ms)
+✔ list prints a damaged result.json as unknown and keeps listing the runs after it (59.213184ms)
+✔ list prints each result field that isn't a string as unknown or - (59.359545ms)
+✔ show prints the run in the established format (60.039569ms)
+✔ show of a missing run and an invalid id exit 4 as before (96.473086ms)
+✔ list and show refuse a runs directory linked out of the data root (121.727463ms)
+✔ show refuses a run linked out of the data root; list reports it unknown (126.49545ms)
+✔ list shows an r- name that isn't a valid run id, as before (58.939883ms)
+✔ show refuses an invalid id before reading the config (36.312306ms)
+ℹ tests 43
+ℹ suites 0
+ℹ pass 43
+ℹ fail 0
+ℹ cancelled 0
+ℹ skipped 0
+ℹ todo 0
+ℹ duration_ms 729.609106
diff --git a/agents/darkwing/work/queue-115/r1/gate/pkg-seat.log b/agents/darkwing/work/queue-115/r1/gate/pkg-seat.log
new file mode 100644
index 000000000..2102efa2c
--- /dev/null
+++ b/agents/darkwing/work/queue-115/r1/gate/pkg-seat.log
@@ -0,0 +1,132 @@
+✔ a first launch clones the root at its branch, with the root's path as origin (34.167796ms)
+✔ the clone is not at its place until git clone has finished (22.614601ms)
+✔ a later launch fast-forwards a clean clone after a commit to the root, then finds it current (66.340833ms)
+✔ a clone ahead of the root keeps its commits and counts as current (43.721705ms)
+▶ a dirty clone, one on another branch and one diverged are kept as they are
+  ✔ a modified file (34.706473ms)
+  ✔ an untracked file (34.101572ms)
+  ✔ a staged file (38.05511ms)
+  ✔ another branch (32.155206ms)
+  ✔ a detached HEAD (30.747643ms)
+  ✔ a diverged branch (47.443526ms)
+✔ a dirty clone, one on another branch and one diverged are kept as they are (218.449373ms)
+▶ a clone with user.name or user.email in its config is kept, and git runs nothing in it
+  ✔ user.name (25.715763ms)
+  ✔ user.email (27.659282ms)
+✔ a clone with user.name or user.email in its config is kept, and git runs nothing in it (53.811171ms)
+✔ a commit git can't read after the fast-forward is null (51.177526ms)
+✔ a new clone whose commit can't be read refuses the launch and leaves nothing behind (19.44399ms)
+▶ a clone the session rigged is kept, and git runs nothing and writes nothing outside it
+  ✔ core.fsmonitor (37.225706ms)
+  ✔ core.hooksPath (38.21649ms)
+  ✔ a hook file (35.156177ms)
+  ✔ include.path (39.902762ms)
+  ✔ includeIf (37.91183ms)
+  ✔ a filter driver (40.287645ms)
+  ✔ origin moved (38.218793ms)
+  ✔ a second origin url (41.398256ms)
+  ✔ the origin url twice, both the root (51.930779ms)
+  ✔ an ext:: origin (54.327151ms)
+  ✔ a branch tracking another remote (41.184945ms)
+  ✔ a branch merging a tag (42.854554ms)
+  ✔ a fetch line onto local branches (48.620934ms)
+  ✔ no origin (52.245885ms)
+  ✔ a config file over the size cap (51.127346ms)
+  ✔ config a symlink to /dev/zero (48.518038ms)
+  ✔ the clone a symlink to the bait (45.025217ms)
+  ✔ the clone a file (40.871269ms)
+  ✔ the clone a plain directory (41.72662ms)
+  ✔ .git a gitdir: file (39.888226ms)
+  ✔ .git a symlink (35.773402ms)
+  ✔ .git/logs a symlink (30.563327ms)
+  ✔ .git/refs/heads a symlink (32.483122ms)
+  ✔ .git/objects a symlink (34.382955ms)
+  ✔ a reflog hard-linked to a file outside (34.256752ms)
+  ✔ HEAD a fifo (40.43458ms)
+  ✔ a commondir file (42.136315ms)
+  ✔ an alternates file (37.605508ms)
+  ✔ a gitlink staged, no .gitmodules (45.841621ms)
+  ✔ a gitlink and .gitmodules staged (43.73331ms)
+  ✔ a gitlink to a repository with its own gitlink (52.601328ms)
+  ✔ a gitlink and .gitmodules committed (48.553989ms)
+  ✔ a gitlink and submodule.active in config (51.666121ms)
+  ✔ a .git/modules with no gitlink (39.685421ms)
+✔ a clone the session rigged is kept, and git runs nothing and writes nothing outside it (1441.606281ms)
+▶ a root that can't be cloned refuses with the project id and leaves nothing behind
+  ✔ missing (11.856396ms)
+  ✔ not a repository (12.233141ms)
+  ✔ a plain directory inside another repository (19.802483ms)
+  ✔ unreadable (14.235517ms)
+  ✔ on no branch (16.183489ms)
+  ✔ missing an object (25.199956ms)
+✔ a root that can't be cloned refuses with the project id and leaves nothing behind (100.720347ms)
+✔ a clone whose root is on no branch, or gone, is kept and named (37.619695ms)
+✔ no credential or forge remote of the root reaches a clone (56.98242ms)
+✔ every project in the business file gets its own clone at its own branch (41.227594ms)
+✔ a clone past its time gets SIGTERM and refuses the launch, with nothing left in the workspace (516.133716ms)
+✔ a clone that ignores SIGTERM gets SIGKILL once the grace period is over (1017.403882ms)
+✔ a timeout signals git's process group, so a process git started dies with it (524.162328ms)
+✔ once a signalled git has closed, its group gets SIGKILL, so a process that ignored SIGTERM dies too (514.275342ms)
+✔ RUNNER_FILES is exactly what the runner and the harness sources it starts import (1.670619ms)
+✔ sandboxProblem names a missing bwrap and a bwrap that fails (8.193853ms)
+✔ every bind says why; the bundle and session file stay read-only over the run directory (2.090648ms)
+✔ the host's git socket is bound only when given, read-only and before the writable binds (0.681959ms)
+✔ the git identity is the instance's, at <instance>@<business>.mosaic.invalid, and sandboxArgv refuses without it (1.061084ms)
+✔ a confined session's shell reaches its own workspace and run directory and nothing of the founder's or another session's (1837.418232ms)
+✔ a bind that exposes a stand-in, or a missing workspace bind, fails the matching check (2697.313162ms)
+✔ a confined session that runs tester-cli.mjs is refused as tester, and the same shim outside the sandbox binds (266.436904ms)
+✔ resolveSeat: by name under --repo resolves the repo layout (1.269529ms)
+✔ resolveSeat: by path resolves the fleet layout (0.325042ms)
+✔ resolveSeat: refusals for missing dir, missing launch.sh, non-executable launch.sh, invalid name, and unknown layout (0.724ms)
+✔ tmuxContext: outside tmux, default socket, custom socket, and exec failure (0.654834ms)
+✔ makeRegistration produces a record that validates; each shape violation throws SeatError (0.794548ms)
+✔ writeRegistration/readRegistration: round trip, permissions, absence, and malformed records (1.493073ms)
+✔ updateTask: changes task, taskSetBy and updatedAt only, and refuses appropriately (1.201698ms)
+✔ CLI launch: registers, execs the fake launch script, and passes args through (28.394445ms)
+✔ CLI launch: --harness lands in the record (28.468445ms)
+✔ CLI launch: the launch script's own exit code passes through (28.01593ms)
+✔ CLI launch: relaunching a seat rewrites the one registration record (64.400422ms)
+✔ CLI launch: omitting --task records an empty string, not null (28.420823ms)
+✔ CLI seat task: updates only the task after a launch, and refuses on an unlaunched seat (87.889379ms)
+✔ CLI refusals: no args, unknown flag, missing config, already-registered env, and exec failure (135.710014ms)
+✔ samePath: equal paths, symlinked dirs, distinct dirs, and non-strings (0.434288ms)
+✔ resolveSetBy: explicit --by wins over the environment; absent or empty environment gives unknown; invalid explicit or environment values refuse with exit 4 (0.573829ms)
+✔ validateRegistration/readRegistration: taskSetBy is optional; a record without it (written before #1511) still loads unchanged; an invalid one is refused; the version does not change (0.767441ms)
+✔ updateTask: records setBy, preserves startedAt and every unrelated field, upgrades an old record in place only when the task is set, and replaces a previous attribution (1.418016ms)
+✔ CLI seat task: --by beats MOSAIC_AGENT_NAME, the environment beats nothing, empty environment is unknown, invalid --by or environment refuses with exit 4 and leaves the record byte for byte (264.235236ms)
+✔ family: exactly one launch.max key in the model name, else null (0.66592ms)
+✔ sessionEnv passes only the allowlist, the repo's bin on PATH, and the run id (0.710192ms)
+✔ sessionExit gives a runner's signal death back as the signal; a session credential is one whole set of nonempty variables (0.253889ms)
+✔ newRun: short ids, 0700 directories, and a refusal when the socket path won't fit (1.521154ms)
+✔ session file and launch log: 0600, the session file written once (1.064267ms)
+✔ endReason maps the runner's exit codes; a signal is killed (0.115919ms)
+✔ Registry mirrors to sessions.json; readSessions marks live entries; bad files refuse (1.227985ms)
+✔ stopSession refuses an unknown run, reports a stale one, and won't signal a pid that isn't a runner (0.989556ms)
+✔ a session runs in its sandbox as pid 1 of its namespace, claims, answers, and stops on mosaic stop (306.446447ms)
+✔ workRef and validBranch take only what a ref name can hold (1.116671ms)
+✔ a push lands as the task's work ref, a fast-forward lands after it, and main is the root's (161.757236ms)
+✔ a rewritten branch refuses non-fast-forward and the work ref stays (147.76012ms)
+✔ a branch with no history in common with main refuses unrelated-history (68.371484ms)
+✔ a bundle that needs commits the working repository lacks refuses missing-prerequisite (41.98031ms)
+✔ main is fetched from the root again before each push, so a clone of a newer root pushes (139.831975ms)
+✔ a root moved back after the clone leaves the push's base unknown: missing-prerequisite (94.34647ms)
+✔ a commit with a broken object refuses invalid-bundle, and only because fsck is on (90.385383ms)
+✔ only a v2 bundle with the named branch is read (50.193154ms)
+✔ a branch named main, or named for another task, moves only this task's work ref (130.573813ms)
+✔ a record that throws moves the work ref back, or removes a new one (195.49797ms)
+✔ a work ref that can't go back refuses rollback-failed, naming the ref and the commit (399.82813ms)
+✔ a root that can't be read refuses root-unreadable (36.709277ms)
+✔ a git past its time gets SIGTERM, leaves no ref lock, and the next push lands (2208.670204ms)
+✔ a git that ignores SIGTERM gets SIGKILL once the grace period is over (1044.046078ms)
+✔ a working repository path that isn't a directory refuses (24.072881ms)
+✔ review bundles a pushed commit as refs/mosaic/review, leaving out what the reviewer has (113.234693ms)
+✔ review of a project with no working repository refuses unknown-commit (13.030629ms)
+✔ the runner's git tools hold the host's limits and branch rule (1.130716ms)
+ℹ tests 120
+ℹ suites 0
+ℹ pass 120
+ℹ fail 0
+ℹ cancelled 0
+ℹ skipped 0
+ℹ todo 0
+ℹ duration_ms 5023.994749
diff --git a/agents/darkwing/work/queue-115/r1/gate/pkg-tasks.log b/agents/darkwing/work/queue-115/r1/gate/pkg-tasks.log
new file mode 100644
index 000000000..ea7426db9
--- /dev/null
+++ b/agents/darkwing/work/queue-115/r1/gate/pkg-tasks.log
@@ -0,0 +1,100 @@
+✔ the boot config is checked before anything starts (107.999166ms)
+✔ a business with no tracker entry refuses task verbs (135.969744ms)
+✔ credential.expiring and .expired are recorded once per instance (253.689013ms)
+✔ a token file that changes on disk records credential.changed (162.667651ms)
+✔ autostart polls, reconciles and retries a startup the tracker was down for (170.622632ms)
+✔ a refusal a restart must clear is not retried by the poll (114.199323ms)
+✔ a poll that fires while two are queued is dropped (101.517899ms)
+✔ close waits for a running verb and refuses one that has not started (233.410196ms)
+✔ the bundled Vikunja is the pinned upstream image the runbook names (0.889021ms)
+✔ every published port is on 127.0.0.1, and no secret is in the file (0.323431ms)
+✔ the committed table loads frozen; its verbs are the broker task verbs (1.447712ms)
+✔ a write names a verb the table has as its own key, not one it inherits (0.507505ms)
+✔ the schema refuses any other shape (2.714459ms)
+✔ the Field table in the slice 1 plan names the verbs each field is written by (0.587866ms)
+✔ each verb refuses, asks for a decision and writes as the table and the role files say (1363.371315ms)
+✔ the list holds the PRD's requirement ids, in its order, at its version (5.452351ms)
+✔ the committed list loads frozen (0.550496ms)
+✔ the schema refuses any other shape (2.561774ms)
+✔ the fake answers each route with the statuses and shapes Vikunja v2.7.0 sent (390.555592ms)
+✔ the project list holds recorded project objects in the recorded list envelope (117.556221ms)
+✔ the recorded task bodies pass the checks S3 applies to every read (0.465865ms)
+✔ the client works against the fake over real HTTP with the platform fetch (300.498465ms)
+✔ a correct install starts, and the first reconcile records tasks that already exist (118.146586ms)
+✔ verbs refuse while a business is starting and after startup refused it (157.603788ms)
+✔ startup refuses a token that can do more than its role needs (474.07429ms)
+✔ startup refuses an unsupported version and flags an untested one (356.095497ms)
+✔ startup refuses a board that the runbook did not install (380.946272ms)
+✔ startup refuses a project the sync bot cannot read (80.0735ms)
+✔ startup refuses a configured label the pm bot cannot see (86.414247ms)
+✔ startup refuses an expired credential and a missing sync credential (171.800746ms)
+✔ an unreachable tracker refuses with tracker-unavailable (80.68095ms)
+✔ an edit in the UI is recorded once, with the fields that changed (235.191599ms)
+✔ a move between open buckets is seen on the board, though updated does not change (197.671295ms)
+✔ a person's comment is counted and a bot's is not (339.601229ms)
+✔ the hourly reconcile catches a comment through comment_count (270.544524ms)
+✔ a task closed in the UI leaves the open view with its done bucket (421.114661ms)
+✔ a task that leaves the board is recorded as deleted, moved or out of reach (246.518899ms)
+✔ a poll that read before a verb wrote does not overwrite the verb (165.044208ms)
+✔ a tracker fault during a tick is reported and the next tick catches up (154.402599ms)
+✔ a malformed answer refuses the tick with tracker-shape (135.03453ms)
+✔ no token value reaches the database, the log or a refusal (294.178754ms)
+✔ the first look at a task counts only comments inside the window (151.659868ms)
+✔ with descendants off the adapter reads no project list and no child, as in v0 (141.12133ms)
+✔ a three-level tree is read per project, and a project outside it is not (134.344185ms)
+✔ a watch-only child keeps the business ready, and a failed child read refuses as transient (231.648031ms)
+✔ a root without the installed buckets refuses with descendants on (139.373561ms)
+✔ the project list refuses without read_all, and skips archived projects and saved filters (256.706598ms)
+✔ descendants must be true or false (107.515239ms)
+✔ a move inside the tree is a moved tombstone plus a snapshot under the new ref (189.007237ms)
+✔ a child made after startup joins the tree at the next reconcile (169.600455ms)
+✔ a child that leaves the tree has its tasks recorded missing, and the ledger keeps their history (154.314247ms)
+✔ a child deleted or hidden between reconciles drops out at the next tick, and the root still refuses (197.533027ms)
+✔ a reconcile that fails keeps the previous tree (123.78632ms)
+✔ a closed task the cursor missed takes its own project's done bucket (130.722782ms)
+✔ closed tasks read at startup take their own project's done bucket (96.878969ms)
+✔ a closed task the cursor returns takes its own project's done bucket (137.649644ms)
+✔ a task moved out of a child that leaves the tree at the same time is moved, not no-access (136.025535ms)
+✔ a task in a bucket outside the five keeps its raw bucket id (118.88327ms)
+✔ bucket 0 on a watch-only task never becomes a bucket or a state (189.95184ms)
+✔ a child whose kanban view is deleted still refuses the tick, and the reconcile reads it watch-only (138.191634ms)
+✔ a child dropped at a tick comes back at the next reconcile once the bot reads it again (125.333823ms)
+✔ task.create needs a recorded human request and a requirement id (204.369021ms)
+✔ task.create takes only an approved requirement id (230.729197ms)
+✔ task.create cites the request a received message carries, not the message's id (216.143478ms)
+✔ only labels named in the business file can be written (280.299964ms)
+✔ task.schedule sets and clears a due date and relations (305.866036ms)
+✔ assign and reassign move the role bots and record task.assigned (306.129397ms)
+✔ task.update.assigned is for the assignee and records task.state (284.477187ms)
+✔ a wrong expected digest records task.conflict and writes nothing (192.637193ms)
+✔ a cross-role verb needs a resolved decision, used once (250.832502ms)
+✔ task.close needs a verdict; after it every verb refuses with task-done (247.595626ms)
+✔ a task with pushed work closes only citing an approve verdict for its latest push, and a refusal writes nothing (264.014677ms)
+✔ a lost answer is settled by a re-read and never retried (190.214089ms)
+✔ a create whose answer is lost is reported uncertain, and the poll finds the task (128.951249ms)
+✔ a task the sync bot cannot read refuses and records nothing (88.873436ms)
+✔ verbs and polls for one business run one at a time (157.193463ms)
+✔ a due date with milliseconds is written to the second (163.179528ms)
+✔ every write landed and the final read failed: the verb succeeds and records what it wrote (107.32977ms)
+✔ some writes landed and the final read failed: write-uncertain, and nothing is recorded (76.515311ms)
+✔ a create whose final read fails succeeds and records task.created (85.561196ms)
+✔ an edit between the last write and the final read shows as external on the next poll (112.239078ms)
+✔ task.created is recorded when a later label write fails (72.718036ms)
+✔ every verb acts in an installed child, on the child's own board (257.033991ms)
+✔ task.create refuses a project outside the tree, a watch-only one and one that is not an id (170.49502ms)
+✔ with descendants off, task.create takes only the root project (91.243917ms)
+✔ a verb on a watch-only task, or a relation to one, refuses with project-not-installed (107.116317ms)
+✔ a related task is read before authority: in another project than its ref names, task-moved; missing, task-not-found (144.340035ms)
+✔ a task moved to another project of the tree refuses its old ref with task-moved and takes its new one (93.9519ms)
+✔ a verb and a create in the child record the final read of the child's board (152.607063ms)
+✔ a create in the child whose final read fails records the child's todo bucket (95.876125ms)
+✔ a lost answer in the child is settled by a re-read of the child's board (123.852136ms)
+✔ every related task is read before authority, not only the first (101.109792ms)
+ℹ tests 92
+ℹ suites 0
+ℹ pass 92
+ℹ fail 0
+ℹ cancelled 0
+ℹ skipped 0
+ℹ todo 0
+ℹ duration_ms 5410.017552
diff --git a/agents/darkwing/work/queue-115/r1/gate/pkg-webui.log b/agents/darkwing/work/queue-115/r1/gate/pkg-webui.log
new file mode 100644
index 000000000..5d1c08537
--- /dev/null
+++ b/agents/darkwing/work/queue-115/r1/gate/pkg-webui.log
@@ -0,0 +1,117 @@
+✔ the Board: held roles with no machine sessions, a claim with no address, the toggle kept across a reload, and Message addressed to the role (7406.172623ms)
+✔ a redirect answer on a Board read, a bus read, a conversation read, a board POST, a module read and a send signs the page out: one line, nothing stale, no further reads (6611.427455ms)
+✔ browser edge states: loading, empty, malformed, stale, hostile/long values, in-flight reply and appearance fallback (4484.520238ms)
+Rendered contrast: {"failures":[],"count":330,"lowest":4.504658476260286}
+✔ served Console browser: real board fixtures, keyboard, drafts, receipts, themes, 320px and failures (5643.044642ms)
+✔ the README says a refused field table names the file or the key at fault, never a path (1.227482ms)
+✔ S5 pages in a browser: real broker rows, inert text, Copy, routes, failures, layout and no writes (7499.41086ms)
+✔ bus routes serve the four reads from the reader view, unescaped JSON for the page to escape (427.847251ms)
+✔ decisions route serves the roles and recent lists from the reader view (491.803711ms)
+✔ credentials route serves the broker credential status from the reader view (286.34272ms)
+✔ replies route serves the replies to one message from the reader view (1135.908676ms)
+✔ bus routes are GET-only, have no write verb, and keep the same-origin checks (157.670716ms)
+✔ bus refusals map to statuses and never carry a path or a stack (60.450904ms)
+✔ humanCall speaks the human transport protocol without blocking the server (1891.178036ms)
+✔ busReader takes --business, else the live bus host, else refuses (258.191269ms)
+✔ humanCall kills a transport that runs past its timeout (551.066971ms)
+✔ serve refuses a --business value that is not a business id (401.124348ms)
+✔ conversation view: full history, collapsed tools, hidden thinking, inert hostile content, malformed and reconcile markers (4445.47885ms)
+✔ conversation view: a fork keeps the open branch, says so, and opens the new one on request (3148.305973ms)
+✔ conversation view: a newer session with no readable history keeps the marker (2978.557598ms)
+✔ conversation view: seats without history say so and offer no reply (2513.267583ms)
+✔ Discord row through real board/WebUI: independent brake/liveness, no Reply, literal content (5116.558195ms)
+✔ return flow through the conversation view: send, tool call, delayed result, peer message, exact long answers, relaunch (54242.956896ms)
+✔ messages HTTP read pages and preserves metadata; bad arguments refuse before a read; other reads unchanged (605.354395ms)
+✔ Console Messages lists late unsolicited messages on polling with sender class time read state and trail; nav count includes beyond the page; reads never deliver (10135.009686ms)
+✔ Messages nav count polls on Tasks and Board and clears on a Board refusal; messages 403 refuses local pages (3497.361915ms)
+✔ copy writes the Console paths at the full id, read-only, and leaves an existing copy alone (2723.946015ms)
+✔ copy refuses a commit off refactor, an unknown one, a worktree and a bad copies directory (5719.732548ms)
+✔ copy writes nothing when an archived path is missing at the commit (2105.880532ms)
+✔ a copy that loses the rename race leaves no read-only temp directory behind (680.025632ms)
+✔ a copy whose rename fails with no target refuses, writes no copy and leaves no temp directory (892.145738ms)
+✔ a copy that meets a target holding files says exists: and moves nothing into it (648.748185ms)
+✔ a copy that meets an empty target directory replaces it by rename, not by moving into it (1009.583263ms)
+✔ serve runs from a copy: /healthz 200, the config check, roles and RELEASE from the copy, the queue from --checkout (732.579812ms)
+✔ serve refuses a --checkout that is not an absolute directory path (214.886445ms)
+✔ consoleReads runs the queue read under queueRoot and reads RELEASE under root (49.085622ms)
+✔ preview options are all three or none, and each is checked (10.794308ms)
+✔ the CLI refuses a partial or invalid preview flag set at start (2272.130367ms)
+✔ the CLI with all three flags serves the preview mode (300.052711ms)
+✔ a request for the public name needs the header equal to the user id, else 401 and nothing read (20.575637ms)
+✔ the header name matches without regard to case, and the value compare is exact (4.143221ms)
+✔ the public name with the header reads the bus views, and the Host and Origin are checked first (41.786249ms)
+✔ in preview mode every write answers 403 read-only, from the public name and loopback, and reaches nothing (19.012175ms)
+✔ loopback requests are unchanged in preview mode, and the bus views work with the board down (9.252061ms)
+✔ a proxy that rewrites Host to the loopback port gets 403 on its first request, whatever the user (28.713113ms)
+✔ a repeated Host is 400 before any other check, in preview mode and without it (14.387615ms)
+✔ without the preview flags the public name is refused and writes still reach the board (6.049729ms)
+✔ redactor: config, dataRoot, any absolute path, Discord ids and the JSON parser quote (2.143204ms)
+✔ credential state from the date alone, as the bus states it (0.250551ms)
+✔ queue: rows, one row, ids and methods, notes; no path or id from a row (1738.356877ms)
+✔ queue: a refused read fails closed with the store's text, redacted (1518.185556ms)
+✔ queue: a store that fails to load, or a child that dies, gives a fixed message with no path or stack (3391.697022ms)
+✔ business: names, vars on the allowlist, authority, credential metadata only (8.175957ms)
+✔ business: missing or invalid file refuses with the module's text, redacted (52.374932ms)
+✔ business without --business: the live bus host, else no-bus-host; no system config: not-configured (7.963981ms)
+✔ settings: release, board, loopback address, notifier binding name only (805.160795ms)
+✔ task fields: the committed table with no reads configured, GET only; a bad table refuses with no path (26.157467ms)
+✔ both presentations replace old activity with relaunch notice, label retained history, then resume after new activity (4348.149606ms)
+✔ reported return flow and relative Age: reply sent from the inspector, then the new answer appears there without manual refresh (23107.137752ms)
+✔ the send box: held roles, the draft and caret across a refresh, each receipt, one POST per Send, and the trail link; the board Reply on a 4xx and a 5xx (7388.472655ms)
+✔ a sent receipt lists its replies as the page refreshes, oldest first and capped, and marks none delivered or read (13830.450184ms)
+✔ startServer takes send only as a function and only with the preview mode (8.047261ms)
+✔ the CLI refuses --send without the preview flags, and without a configured bus (470.185007ms)
+✔ the CLI with --send and a configured bus sends through the human transport and logs one line (150.643899ms)
+✔ without --send the route is read-only like every other write, and config says no send (9.0901ms)
+✔ with --send every other write is still 403 read-only, and nothing reaches the board or bus (6.175339ms)
+✔ config says send only on the public name with --send on (2.36965ms)
+✔ a send without the signed-in user is 401 and is neither sent nor logged, loopback included (5.051241ms)
+✔ each request check refuses before anything is sent, and logs the refusal without the body (17.707749ms)
+✔ a send passes exactly to, body and in_reply_to, answers the id, and logs it (4.746722ms)
+✔ a crafted role name cannot forge a log line (3.35966ms)
+✔ a bus refusal is not sent, with its status; an outcome the bus could not confirm is unknown and never retried (8.345822ms)
+✔ through the human transport the request is exactly the business, message.send and the keys (90.653784ms)
+✔ against a real broker: the message is written once as a human send, and its refusals map (1466.165723ms)
+✔ loopback host and board origin fail closed (6.220287ms)
+✔ real board fixture passes through WebUI; assets and isolated seen/reply work (306.684787ms)
+✔ proxy preserves exact request bytes, status and receipt, rejects forms and malformed JSON, never follows redirect (48.936116ms)
+✔ unreachable board reports URL; CLI rejects unsupported options (524.178958ms)
+✔ render prints the unit without the preview flags (13.366006ms)
+✔ render carries every serve flag, the preview set included (18.069732ms)
+✔ a partial preview set is refused (15.844085ms)
+✔ a value the unit cannot carry is refused, for every flag (342.355714ms)
+✔ the rendered unit names none of the human proof agent markers and sets no agent variable (25.842867ms)
+✔ install into --dir with --no-reload writes the file whole, then reports unchanged (92.04974ms)
+✔ install without --no-reload runs daemon-reload and nothing that starts the unit (65.712717ms)
+✔ uninstall refuses while the unit is running, with or without --no-reload, and removes it once it is not (231.786407ms)
+✔ status prints the unit state and GET /healthz on the installed port (328.770912ms)
+✔ usage: an unknown verb or flag, and start or enable, exit 4 (161.66027ms)
+✔ without --send, render is the template with its placeholders filled, byte for byte (82.45544ms)
+✔ render --send with the preview set ends ExecStart with --send and changes nothing else (131.477862ms)
+✔ --send without the whole preview set is refused and writes nothing (207.80499ms)
+✔ install --send into --dir with --no-reload writes the sending unit, and status says whether it sends (377.365098ms)
+✔ uninstall and status take no --send (68.82118ms)
+✔ install refuses while the unit is running, in any state but inactive or failed, and changes nothing (476.737351ms)
+✔ when the state read fails, install and uninstall refuse with one line and change nothing (102.462889ms)
+✔ install needs --copy naming a copy that exists, and refuses outside the canonical checkout without --allow-worktree (65.090713ms)
+✔ install refuses unless the bus unit runs from the same copy, naming both paths, and changes nothing (310.010557ms)
+✔ render --copy runs the copy and reads the queue in the checkout; without --copy the unit is unchanged (29.992122ms)
+✔ the uid header takes only an Authentik uid; the username header still takes a username (761.509381ms)
+✔ a preview value cannot start with - or . (119.071127ms)
+✔ status names the copy and whether refactor has moved past it, and says when the unit runs from no copy (581.591485ms)
+✔ tokens.css and icons.svg are byte copies of docs/design (1.279232ms)
+✔ JetBrains Mono files match the digests in their sources file, with the OFL text (2.372985ms)
+✔ shipped strings are unchanged, and the web keeps its write boundary (2.975843ms)
+✔ shell in a browser: System default, seeded states, 400px, focus and the Ctrl+K palette (7708.722308ms)
+✔ five states on Board, Inbox, Tasks, Agents and Trail (3082.239039ms)
+✔ Queue, Business and Settings in their five states, with no move button (5171.863997ms)
+✔ seeded secrets, Discord ids and paths reach no response and no page; business refusals in the module's words (3519.136529ms)
+✔ the server log names no config path when the system config refuses (315.112734ms)
+ℹ tests 108
+ℹ suites 0
+ℹ pass 108
+ℹ fail 0
+ℹ cancelled 0
+ℹ skipped 0
+ℹ todo 0
+ℹ duration_ms 54655.660789
diff --git a/agents/darkwing/work/queue-115/r1/gate/script-auth.log b/agents/darkwing/work/queue-115/r1/gate/script-auth.log
new file mode 100644
index 000000000..ac2287606
--- /dev/null
+++ b/agents/darkwing/work/queue-115/r1/gate/script-auth.log
@@ -0,0 +1,17 @@
+OK    status with missing harness credential exits 3 and still lists accounts
+OK    status reports harness credential (read-only) + mosaic accounts
+OK    api key material never reaches output
+OK    oauth token material never reaches output
+OK    unparseable credential file exits 2
+OK    symlinked credential file exits 4
+OK    env-side credential names reported
+OK    env var values never reach output
+OK    accounts without an accounts dir reports none and creates nothing
+OK    accounts lists files and marks the active one
+OK    loose account perms flagged in listing
+OK    agent --auth with missing account file refuses (exit 4)
+OK    agent --auth with non-0600 account file refuses
+OK    agent --auth with invalid account name refuses
+OK    auth.sh without valid config refuses
+
+selftest: 15 passed, 0 failed
diff --git a/agents/darkwing/work/queue-115/r1/gate/script-conductor.log b/agents/darkwing/work/queue-115/r1/gate/script-conductor.log
new file mode 100644
index 000000000..e740e5a61
--- /dev/null
+++ b/agents/darkwing/work/queue-115/r1/gate/script-conductor.log
@@ -0,0 +1,55 @@
+Note: switching to '94ece491f05ecbb737227da8a7ba1d57a1ac75fd'.
+
+You are in 'detached HEAD' state. You can look around, make experimental
+changes and commit them, and you can discard any commits you make in this
+state without impacting any branches by switching back to a branch.
+
+If you want to create a new branch to retain commits you create, you may
+do so (now or later) by using -c with the switch command. Example:
+
+  git switch -c <new-branch-name>
+
+Or undo this operation with:
+
+  git switch -
+
+Turn off this advice by setting config variable advice.detachedHead to false
+
+Not currently on any branch.
+nothing to commit, working tree clean
+Note: switching to '94ece491f05ecbb737227da8a7ba1d57a1ac75fd'.
+
+You are in 'detached HEAD' state. You can look around, make experimental
+changes and commit them, and you can discard any commits you make in this
+state without impacting any branches by switching back to a branch.
+
+If you want to create a new branch to retain commits you create, you may
+do so (now or later) by using -c with the switch command. Example:
+
+  git switch -c <new-branch-name>
+
+Or undo this operation with:
+
+  git switch -
+
+Turn off this advice by setting config variable advice.detachedHead to false
+
+OK    dry-run: allowed change, exit 0, nothing committed (exit 0)
+OK    dry-run committed nothing
+OK    apply: allowed change exits 0 (exit 0)
+OK    apply: attribution in commit subject
+OK    apply: target tree clean after commit
+OK    disallowed path refused (exit 1)
+OK    disallowed path: target untouched
+OK    syntax gate refused broken .mjs (exit 1)
+OK    syntax gate: target untouched
+OK    suite failure refused (exit 1)
+OK    suite failure: target reverted to clean
+OK    disabled policy refused (exit 2)
+OK    disabled policy: target untouched
+OK    failed run refused (exit 1)
+OK    failed run: target untouched
+OK    missing run exits 4 (exit 4)
+OK    invalid policy exits 2 (exit 2)
+
+selftest: 17 passed, 0 failed
diff --git a/agents/darkwing/work/queue-115/r1/gate/script-config.log b/agents/darkwing/work/queue-115/r1/gate/script-config.log
new file mode 100644
index 000000000..76c05ef74
--- /dev/null
+++ b/agents/darkwing/work/queue-115/r1/gate/script-config.log
@@ -0,0 +1,26 @@
+OK    absent adapter defaults to pi
+OK    adapter mock validates (exit 0)
+OK    unsupported adapter exits 2 (exit 2)
+OK    env exports adapter
+OK    bootstrap creates default when absent (exit 0)
+OK    bootstrap wrote config file
+OK    bootstrap is idempotent on existing config (exit 0)
+OK    bootstrap did not rewrite existing config
+OK    validate missing config exits 3 (exit 3)
+OK    malformed JSON exits 2 (exit 2)
+OK    unsupported configVersion exits 2 (exit 2)
+OK    unknown top-level key exits 2 (exit 2)
+OK    unknown execution key exits 2 (exit 2)
+OK    unsupported backend exits 2 (exit 2)
+OK    unsupported environment exits 2 (exit 2)
+OK    relative dataRoot exits 2 (exit 2)
+OK    non-canonical dataRoot exits 2 (exit 2)
+OK    filesystem root dataRoot exits 2 (exit 2)
+OK    home directory dataRoot exits 2 (exit 2)
+OK    dataRoot containing config dir exits 2 (exit 2)
+OK    control character in provider exits 2 (exit 2)
+OK    symlinked config file exits 2 (exit 2)
+OK    env exports resolve correctly
+OK    failed validation modified nothing
+
+selftest: 24 passed, 0 failed
diff --git a/agents/darkwing/work/queue-115/r1/gate/script-discord.log b/agents/darkwing/work/queue-115/r1/gate/script-discord.log
new file mode 100644
index 000000000..b013f9ffa
--- /dev/null
+++ b/agents/darkwing/work/queue-115/r1/gate/script-discord.log
@@ -0,0 +1,70 @@
+toolchain: node v26.8.1
+
+OK    syntax: packages/discord/src/approvals.mjs
+OK    syntax: packages/discord/src/authorize.mjs
+OK    syntax: packages/discord/src/binding.mjs
+OK    syntax: packages/discord/src/cli.mjs
+OK    syntax: packages/discord/src/connector.mjs
+OK    syntax: packages/discord/src/context.mjs
+OK    syntax: packages/discord/src/engine-pi.mjs
+OK    syntax: packages/discord/src/errors.mjs
+OK    syntax: packages/discord/src/gateway.mjs
+OK    syntax: packages/discord/src/git.mjs
+OK    syntax: packages/discord/src/journal.mjs
+OK    syntax: packages/discord/src/notify.mjs
+OK    syntax: packages/discord/src/rest.mjs
+OK    syntax: packages/discord/src/setspark.mjs
+OK    syntax: packages/discord/src/tools.mjs
+OK    syntax: packages/discord/src/web.mjs
+OK    syntax: packages/discord/bin/git-credential.mjs
+OK    syntax: packages/discord/extension/tools.mjs
+OK    syntax: packages/discord/tests/approvals.test.mjs
+OK    syntax: packages/discord/tests/authorize.test.mjs
+OK    syntax: packages/discord/tests/binding.test.mjs
+OK    syntax: packages/discord/tests/connector.test.mjs
+OK    syntax: packages/discord/tests/context.test.mjs
+OK    syntax: packages/discord/tests/engine.test.mjs
+OK    syntax: packages/discord/tests/fake-pi.mjs
+OK    syntax: packages/discord/tests/gateway.test.mjs
+OK    syntax: packages/discord/tests/git.test.mjs
+OK    syntax: packages/discord/tests/helpers.mjs
+OK    syntax: packages/discord/tests/journal.test.mjs
+OK    syntax: packages/discord/tests/notify.test.mjs
+OK    syntax: packages/discord/tests/recover.test.mjs
+OK    syntax: packages/discord/tests/rest.test.mjs
+OK    syntax: packages/discord/tests/setspark.test.mjs
+OK    syntax: packages/discord/tests/tools.test.mjs
+OK    syntax: packages/discord/tests/web.test.mjs
+OK    syntax: packages/discord/fixtures/claim-worker.mjs
+OK    syntax: packages/discord/fixtures/legacy-owner-worker.mjs
+OK    syntax: scripts/discord.sh
+OK    syntax: scripts/discord-service.sh
+OK    packages/discord declares no dependencies
+OK    no bot-token-shaped string in packages/discord
+OK    fixture binding uses placeholder ids only
+OK    fixture binding validates
+OK    real pi with the extension exposes exactly list_dir, read_file, search and no built-in tool
+OK    real pi with a writable root exposes exactly the three reads plus write_file and edit_file, and writes nothing at start
+OK    real pi with a web key exposes the three reads plus web_fetch and web_search, and no write tool without a writable root
+OK    real pi with a git root exposes the reads, writes and the four git verbs, commits nothing at start, and never shows the token
+OK    real pi with protocol vault adds reserve_id to the git verbs
+OK    real pi with a setspark key exposes the reads and the eight record verbs, no counters, and never shows the key
+OK    real pi refuses a git key on a read-only root (fail closed)
+OK    real pi with the pilot flags (--no-tools) exposes no tool at all
+OK    real pi exits non-zero without MOSAIC_DISCORD_TOOLS: no session, no tools (fail closed)
+OK    a failing nested test fails the run under a parent runner's NODE_TEST_CONTEXT
+OK    node --test packages/discord/tests/ (ℹ pass 178)
+OK    scripts/discord.sh --help exits 0
+OK    scripts/discord.sh check without a binding exits 4
+OK    scripts/discord.sh recover without a binding exits 4
+OK    scripts/discord.sh reload without a binding exits 4
+OK    scripts/discord-service.sh without a command exits 4
+OK    service unit renders with the repository path, a supervised run as the main process, exit 3 never retried, and reload as SIGHUP
+OK    service install writes the rendered unit (0644) and leaves no temp file
+OK    service install a second time reports unchanged
+OK    systemd-analyze verify accepts the rendered unit
+OK    service uninstall removes the unit file
+OK    service install with an unknown flag exits 4
+OK    service install with USER unset finishes and names the account for lingering
+
+discord suite: 66 passed, 0 failed
diff --git a/agents/darkwing/work/queue-115/r1/gate/script-extension-package.log b/agents/darkwing/work/queue-115/r1/gate/script-extension-package.log
new file mode 100644
index 000000000..dd1116c32
--- /dev/null
+++ b/agents/darkwing/work/queue-115/r1/gate/script-extension-package.log
@@ -0,0 +1,21 @@
+OK    initial ordinary-file install
+OK    installed tree matches canonical source
+OK    installed tree has no symlinks
+OK    check detects installation drift
+OK    sync refuses to overwrite installation drift
+OK    check detects an extra destination file
+OK    check detects an extra destination directory
+OK    check rejects a destination symlink
+OK    sync accepts a canonical source update
+OK    updated installation matches canonical source
+scripts/test-extension-package.sh: line 14: 2121746 Killed                     "$@" > /dev/null 2>&1
+OK    forced interruption kills the replacing process
+OK    next invocation recovers old consistent installation
+OK    interrupted replacement rolled back
+OK    sync succeeds after interruption recovery
+OK    unlocked stale lock file does not block
+OK    active lock refuses a concurrent sync
+OK    source symlink fails closed
+OK    nested second entrypoint fails closed
+
+extension package selftest: 18 passed, 0 failed
diff --git a/agents/darkwing/work/queue-115/r1/gate/script-foundation.log b/agents/darkwing/work/queue-115/r1/gate/script-foundation.log
new file mode 100644
index 000000000..6338e1e6d
--- /dev/null
+++ b/agents/darkwing/work/queue-115/r1/gate/script-foundation.log
@@ -0,0 +1,53 @@
+toolchain: node v26.8.1, python 3.12.8, jsonschema 4.26.0
+
+OK    syntax: scripts/foundation-inspect.mjs
+OK    syntax: scripts/foundation/strict-json.mjs
+OK    syntax: scripts/foundation/canonical.mjs
+OK    syntax: scripts/foundation/resolve.mjs
+OK    syntax: scripts/foundation/validate-record.mjs
+OK    syntax: scripts/foundation/fixtures/build-fixtures.mjs
+OK    syntax: scripts/foundation/canonical.test.mjs
+OK    syntax: scripts/foundation/cli.test.mjs
+OK    syntax: scripts/foundation/fixtures.test.mjs
+OK    syntax: scripts/foundation/resolve.test.mjs
+OK    syntax: scripts/foundation/strict-json.test.mjs
+OK    syntax: scripts/foundation/verify-schema.py (ast only; no bytecode written)
+OK    fixture generator runs
+OK    checked-in fixtures/bundles equal a fresh generation
+OK    checked-in fixtures/raw equal a fresh generation
+OK    checked-in fixtures/index.json equal a fresh generation
+OK    checked-in demo bundles equal a fresh generation
+OK    a failing nested test fails the run under a parent runner's NODE_TEST_CONTEXT
+OK    node --test scripts/foundation/ (ℹ pass 80)
+OK    differential schema oracle: PASS: differential schema oracle (finite corpus; compatibility evidence, not equivalence proof)
+      platform witness: strftime('%Y') for year 999 -> '999' (pinned checker refuses years 0001..0999)
+      node v26.8.1; corpus 1568 records (38 pinned fixtures, 478 unique bundle records, 1052 typeCase/mutation/lexical cases)
+      schema column: agree-valid 540, agree-invalid 991, DISAGREEMENTS 0; strict-only (parser-bound) cases: 27; unsupported-kind records not schema-assessed by the inspector: 10
+      profile column (schema-valid records only): profile-valid 510, profile-invalid 30
+      profile refusals asserted: 30 schema-agreed-valid records refused only by the strict typed-string profile (rule profile-pattern-mismatch), 12 declared by name; 73 named probes verified against declared schema/profile columns
+OK    oracle: zero schema-column disagreements with the pinned checker
+OK    oracle: strict-only profile refusals are counted and asserted
+OK    demo: permitted read preview exits 0 (exit 0)
+OK    demo: permitted file.change preview exits 0 (exit 0)
+OK    demo: assignment.change proposal is unresolved (exit 3) (exit 3)
+OK    demo: revoked registration is refused (exit 3) (exit 3)
+OK    demo: message is not authority (exit 3) (exit 3)
+OK    usage: no arguments exits 2 (exit 2)
+OK    io: missing file exits 4 (exit 4)
+OK    io: directory exits 4 (exit 4)
+OK    io: symlink exits 4 (O_NOFOLLOW) (exit 4)
+OK    bound: oversize fixture exits 2 (exit 2)
+OK    profile: one final LF in a typed selection id is refused before admission (exit 2) (exit 2)
+OK    profile: two final LFs fail the schema pattern itself (exit 2) (exit 2)
+OK    profile: escaped newlines in free-form text stay allowed (exit 0) (exit 0)
+OK    profile refusal is invalid-request/profile-pattern-mismatch with selection and operation withheld, value not echoed
+OK    text output starts with the disclaimer
+OK    json output is valid JSON with result allowed and exactly the charter §7 fields
+OK    json golden matches byte-for-byte
+OK    sandboxed bundle run (env -i, PATH=/nonexistent) produced the unresolved proposal
+OK    sandbox inventory (path/type/size/mode/uid/gid/inode/mtime/sha256) unchanged by runs
+OK    canary never printed (bundle run and credential-file run)
+OK    a non-bundle JSON file is refused at the shape gate, not read into output
+OK    no field of the non-bundle file is echoed
+
+selftest: 44 passed, 0 failed
diff --git a/agents/darkwing/work/queue-115/r1/gate/script-queue.log b/agents/darkwing/work/queue-115/r1/gate/script-queue.log
new file mode 100644
index 000000000..a144c136f
--- /dev/null
+++ b/agents/darkwing/work/queue-115/r1/gate/script-queue.log
@@ -0,0 +1,36 @@
+toolchain: node v26.8.1, git version 2.55.0
+
+OK    syntax: packages/queue/src/cli.mjs
+OK    syntax: packages/queue/src/errors.mjs
+OK    syntax: packages/queue/src/io.mjs
+OK    syntax: packages/queue/src/lock.mjs
+OK    syntax: packages/queue/src/queue.mjs
+OK    syntax: packages/queue/src/review.mjs
+OK    syntax: packages/queue/src/store.mjs
+OK    syntax: packages/queue/tests/commit.test.mjs
+OK    syntax: packages/queue/tests/data.test.mjs
+OK    syntax: packages/queue/tests/dispatch.test.mjs
+OK    syntax: packages/queue/tests/gate-owner.test.mjs
+OK    syntax: packages/queue/tests/helpers.mjs
+OK    syntax: packages/queue/tests/lock.test.mjs
+OK    syntax: packages/queue/tests/migration.test.mjs
+OK    syntax: packages/queue/tests/review.test.mjs
+OK    syntax: packages/queue/tests/store.test.mjs
+OK    syntax: packages/queue/tests/write.test.mjs
+OK    syntax: packages/queue/tests/fixtures/fake-gitea.mjs
+OK    syntax: packages/queue/tests/fixtures/kill-at.mjs
+OK    syntax: packages/queue/tests/fixtures/lock-child.mjs
+OK    syntax: packages/queue/tests/fixtures/mosaic-pre-a2.sh
+OK    syntax: scripts/queue-commit.sh
+OK    syntax: scripts/git-hooks/pre-commit
+OK    syntax: scripts/mosaic
+OK    queue-commit.sh, the guard and scripts/mosaic are executable
+OK    packages/queue declares no dependencies
+ℹ tests 156
+ℹ pass 156
+ℹ fail 0
+OK    node --test packages/queue/tests/
+OK    scripts/mosaic queue help
+skip  queue verify and render --check: this checkout (/home/jwoltje/darkwing-scratch/r115/wt) is not the queue's canonical root (/mnt/storage/src/mosaic-stack)
+
+queue suite: 28 passed, 0 failed
diff --git a/agents/darkwing/work/queue-115/r1/gate/script-release.log b/agents/darkwing/work/queue-115/r1/gate/script-release.log
new file mode 100644
index 000000000..7202b85d4
--- /dev/null
+++ b/agents/darkwing/work/queue-115/r1/gate/script-release.log
@@ -0,0 +1,16 @@
+OK    valid RELEASE resolves (exit 0)
+OK    invalid RELEASE exits 1 (exit 1)
+OK    missing RELEASE exits 1 (exit 1)
+OK    valid RELEASE leaves image tag consistent with version
+OK    status safe on empty state (exit 0)
+OK    status created no pointer
+OK    fault-injected activation refuses (exit 1)
+OK    refused activation wrote no pointer
+OK    refusal logged exactly once with valid fields
+OK    healthy activation succeeds (exit 0)
+OK    pointer written with valid fields
+OK    repeat activation succeeds (log grows) (exit 0)
+OK    log is append-only across activations
+OK    rollback without previous refuses (exit 1)
+
+selftest: 14 passed, 0 failed
diff --git a/agents/darkwing/work/queue-115/r1/gate/script-task.log b/agents/darkwing/work/queue-115/r1/gate/script-task.log
new file mode 100644
index 000000000..df6724a77
--- /dev/null
+++ b/agents/darkwing/work/queue-115/r1/gate/script-task.log
@@ -0,0 +1,101 @@
+OK    valid task validates (exit 0)
+OK    unknown task key exits 2 (exit 2)
+OK    unsupported taskVersion exits 2 (exit 2)
+OK    invalid task id exits 2 (exit 2)
+OK    empty prompt exits 2 (exit 2)
+OK    NUL in expectExact exits 2 (exit 2)
+OK    out-of-range timeout exits 2 (exit 2)
+OK    missing mission file exits 4 (exit 4)
+OK    task with valid mission validates (exit 0)
+OK    invalid mission exits 2 (exit 2)
+OK    validate missing task exits 4 (exit 4)
+OK    validation does not modify the task file
+OK    prune dry-run exits 0 (exit 0)
+OK    dry-run deleted nothing
+OK    prune --keep=2 --yes removes oldest (exit 0)
+OK    kept exactly 2 newest runs
+OK    newest run kept, oldest pruned
+OK    append-only receipt written (3 entries)
+OK    sessions/workspaces untouched by prune
+OK    prune with invalid keep exits 4 (exit 4)
+OK    mock adapter: gate passes on matching mock response (exit 0)
+OK    mock adapter: expect-mismatch recorded (exit 1)
+OK    mismatch reason recorded
+OK    unknown adapter fails closed (exit 1)
+OK    mission task runs via mock adapter (exit 0)
+OK    mission section injected into generated prompt
+OK    retry of mission run succeeds (exit 0)
+OK    retriedFrom lineage recorded
+OK    mission section present after retry (relative path resolved)
+OK    retry of missing run exits 4 (exit 4)
+OK    skill install bundled ms-tools (exit 0)
+OK    installed to skills-available
+OK    double install refuses (exit 1)
+OK    activate enables skill (exit 0)
+OK    enabled dir populated
+OK    uninstall while enabled refuses (exit 1)
+OK    deactivate moves back to available (exit 0)
+OK    uninstall removes from available (exit 0)
+OK    seat with enabled skill launches
+OK    skill path delivered to adapter
+OK    shipped researcher contract resolves (ceiling + network)
+OK    resolve-role refuses a non-role document (conductor policy) (exit 2)
+OK    resolve-role refuses name/filename mismatch (exit 2)
+OK    resolve-role refuses unknown network declaration (exit 2)
+OK    resolve-role refuses duplicate role tool (exit 2)
+OK    resolve-role refuses unsupported tool (exit 2)
+OK    resolve-role refuses missing contract file (exit 4)
+OK    version 1 role prints no contract line
+OK    shipped version 2 roles resolve with their contracts (pm, cto, coder, reviewer)
+OK    resolve-role accepts a minimal version 2 role (exit 0)
+OK    resolve-role refuses an action outside the vocabulary (exit 2)
+OK    resolve-role refuses a gated-only action in a role file (exit 2)
+OK    resolve-role refuses a Vikunja verb no role may hold (exit 2)
+OK    resolve-role refuses a version 2 role whose contract is missing (exit 2)
+OK    resolve-role refuses a contract that is a symbolic link (exit 2)
+OK    seat launches under role ceiling
+OK    role ceiling narrows seat tools (read,write,bash -> read,bash)
+OK    narrowing recorded loudly
+OK    missing role contract refuses launch (exit 2)
+OK    missing-contract refusal names the role
+OK    empty ceiling intersection -> tool-free seat
+OK    tool-free outcome recorded loudly
+OK    overridden agents dir without seat definition refuses (exit 4)
+OK    seat-resolution refusal names the seat
+OK    policy: mission only -> mission tools
+OK    policy: task only -> task tools
+OK    policy: both -> intersection (task narrowed)
+OK    policy: empty intersection -> tool-free
+OK    invalid mission capabilities rejected (exit 2)
+mosaic-task: unsupported mission tool: "sudo" (supported: read, write, edit, bash, grep, find, ls)
+OK    task run with user layer present (exit 0)
+OK    user context dispatched into generated prompt
+OK    workspace+tools task runs via mock (exit 0)
+OK    workspace path + tools delivered to adapter
+OK    persistent workspace created on host
+OK    plain task still runs (no workspace/tools) (exit 0)
+OK    workspace var present but empty when absent
+OK    tools empty when absent
+OK    unknown tool exits 2 (exit 2)
+OK    workspace traversal exits 2 (exit 2)
+OK    live hello task succeeds with exact marker
+OK    result.json written in run dir
+OK    result.json contents are correct
+OK    wrong expectExact fails with exit 1 (reason: expect-mismatch)
+OK    each run gets a distinct run dir (no clobber)
+OK    list shows both runs
+OK    fork base: teach succeeds (exit 0)
+OK    fork child recalls ancestor context (exit 0)
+OK    forked child recalled ancestor code word
+OK    ancestor session untouched by fork
+OK    child session dir has its own branch file
+OK    onboard without name exits 4 (non-interactive) (exit 4)
+OK    onboard --name renders profile (exit 0)
+OK    profile written
+OK    canon structure: required filled, optional placeholdered
+OK    canon sections present
+OK    user recall run succeeds
+OK    recalled user name (response: Jason)
+OK    no agent identity on headless run
+
+selftest: 98 passed, 0 failed
diff --git a/agents/darkwing/work/queue-115/r1/mutants-run.log b/agents/darkwing/work/queue-115/r1/mutants-run.log
new file mode 100644
index 000000000..9bacc5f62
--- /dev/null
+++ b/agents/darkwing/work/queue-115/r1/mutants-run.log
@@ -0,0 +1,20 @@
+mutant m1 rc=1 ℹ pass 148 ℹ fail 7 ℹ skipped 0 restored=True
+  ✖ a cross-role decision resolved by its arbiter comes from that role and run, with no request (254.425078ms)
+  ✖ a human DECISION send keeps its own instruction as the request, not a close's answer (262.897184ms)
+  ✖ a human resolve sends the raising role one message from the human, and its request is the answer (224.963912ms)
+  ✖ a human withdraw sends one message with the note (239.892721ms)
+  ✖ a raising role nobody holds at the close gets the message on the next claim (268.708422ms)
+  ✖ message.send consumes approval and prevents a later send or authorize (179.591999ms)
+  ✖ refused closes send nothing: invalid-choice, decision-closed, not-resolver (308.402434ms)
+KILLED
+mutant m2 rc=1 ℹ pass 149 ℹ fail 6 ℹ skipped 0 restored=True
+  ✖ a cross-role decision resolved by its arbiter comes from that role and run, with no request (247.487265ms)
+  ✖ a human DECISION send keeps its own instruction as the request, not a close's answer (316.669026ms)
+  ✖ a human resolve sends the raising role one message from the human, and its request is the answer (244.331801ms)
+  ✖ a human withdraw sends one message with the note (228.711075ms)
+  ✖ a raising role nobody holds at the close gets the message on the next claim (291.888176ms)
+  ✖ refused closes send nothing: invalid-choice, decision-closed, not-resolver (343.2355ms)
+KILLED
+mutant m3 rc=1 ℹ pass 154 ℹ fail 1 ℹ skipped 0 restored=True
+  ✖ the raising run's withdraw, a supersede, a within-role raise and seen send nothing (331.104691ms)
+KILLED
diff --git a/agents/darkwing/work/queue-115/r1/mutants.py b/agents/darkwing/work/queue-115/r1/mutants.py
new file mode 100755
index 000000000..cb53378a7
--- /dev/null
+++ b/agents/darkwing/work/queue-115/r1/mutants.py
@@ -0,0 +1,56 @@
+#!/usr/bin/env python3
+# Row 115 (#1609): the brief's three mutants of the decision close message.
+# m1 drops the message: the close block never runs.
+# m2 addresses the message to route_to instead of the raising role.
+# m3 drops the raising-run check, so the raiser's own withdraw sends one too.
+# Each runs the FULL bus suite (node --test tests/*.test.mjs in packages/bus)
+# and restores the source from the .orig copy whatever happens.
+# Usage: mutants.py <worktree> <log dir>
+import os, shutil, subprocess, sys, signal
+
+WT, LOGS = sys.argv[1], sys.argv[2]
+MUTANTS = {
+    'm1': ('packages/bus/src/broker.mjs',
+           "        if (op !== 'seen' && (s.human || s.run !== d.raised_by_run)) {\n",
+           "        if (false) {\n"),
+    'm2': ('packages/bus/src/broker.mjs',
+           "            d.raised_by_role,\n            'DECISION',\n",
+           "            d.route_to,\n            'DECISION',\n"),
+    'm3': ('packages/bus/src/broker.mjs',
+           "        if (op !== 'seen' && (s.human || s.run !== d.raised_by_run)) {\n",
+           "        if (op !== 'seen') {\n"),
+}
+os.makedirs(LOGS, exist_ok=True)
+env = dict(os.environ, TMPDIR=os.path.expanduser('~/darkwing-scratch/r115/tmp'))
+for name, (rel, cur, new) in MUTANTS.items():
+    src = os.path.join(WT, rel)
+    text = open(src).read()
+    if text.count(cur) != 1:
+        sys.exit(f'STOP {name}: the target text in {rel} is not unique or has moved')
+    if os.path.exists(src + '.orig'):
+        sys.exit(f'STOP {rel}.orig already exists')
+    log_path = os.path.join(LOGS, f'mutant-{name}.log')
+    shutil.copy2(src, src + '.orig')
+    try:
+        open(src, 'w').write(text.replace(cur, new))
+        with open(log_path, 'w') as out:
+            p = subprocess.Popen('node --test tests/*.test.mjs', shell=True, cwd=os.path.join(WT, 'packages/bus'),
+                                 stdout=out, stderr=subprocess.STDOUT, env=env, start_new_session=True)
+            try:
+                rc = p.wait(timeout=600)
+            except subprocess.TimeoutExpired:
+                os.killpg(p.pid, signal.SIGKILL)
+                p.wait()
+                rc = 'timeout'
+    finally:
+        shutil.move(src + '.orig', src)
+    restored = open(src).read() == text
+    log = open(log_path).read()
+    counts = [l for l in log.splitlines() if l.startswith(('ℹ pass', 'ℹ fail', 'ℹ skipped'))]
+    failed = [l.strip() for l in log.splitlines() if l.lstrip().startswith('✖') and 'failing tests' not in l]
+    print(f'mutant {name} rc={rc} {" ".join(counts)} restored={restored}')
+    for f in sorted(set(failed)):
+        print('  ' + f)
+    print('KILLED' if rc != 0 else 'SURVIVED')
+    if not restored:
+        sys.exit(f'STOP {rel} was not restored')
diff --git a/agents/darkwing/work/queue-115/r1/mutants/mutant-m1.log b/agents/darkwing/work/queue-115/r1/mutants/mutant-m1.log
new file mode 100644
index 000000000..32ecc8cc5
--- /dev/null
+++ b/agents/darkwing/work/queue-115/r1/mutants/mutant-m1.log
@@ -0,0 +1,280 @@
+✔ agents: a held role with nothing on the bus is idle; a role session gets the claim rows unchanged (142.67842ms)
+✔ agents: working counts what the holder received and has not read; routed alone is not working (231.891433ms)
+✔ agents: input needed is the role's open decisions routed to the human, gated first, then oldest (344.805443ms)
+✔ agents: working wins over waiting, and Input needed still shows (191.028437ms)
+✔ agents: a new holder doesn't inherit what the last one left unread; decisions stay with the role (211.984345ms)
+✔ agents: state reads only its own business, even for a run name both use (233.97194ms)
+✔ agents: a message the holder released unread is stranded; the next holder gets nothing and cannot read it (235.758229ms)
+✔ agents: a message the holder read is not stranded; one the current holder has not read is not listed (238.331622ms)
+✔ agents: stranded is oldest first and capped at 50 for a role (899.31918ms)
+✔ agents: stranded is per role and per business (337.500323ms)
+✔ agents: a message routed to a held role and not yet received is not stranded (134.434318ms)
+✔ launch identity is stamped, payload identity is refused and stale holder cannot send (161.50972ms)
+✔ decision classes route from policy; gated resolution is human-only, choice and target must match (290.284878ms)
+✔ claim exclusion, holder release, gated revoke and rerouting to a new holder are atomic (281.868104ms)
+✔ launch events require a human CLI capability; generic emit cannot forge authority events (196.576436ms)
+✔ within-role decisions close atomically and invalid options or blocking omissions refuse (187.34039ms)
+✔ a recommendation that is not exactly one option key refuses invalid-recommendation after the options (301.998177ms)
+✔ observer capabilities read human inbox but cannot mutate or forge launch identity (200.005311ms)
+✔ task action subjects and linked decision trail are complete and ordered (205.183231ms)
+✔ launch binding is durable and reconnecting requires the identical trusted record (122.9702ms)
+✔ business isolation includes inherited object names and cross-business message references (220.35996ms)
+✔ authority never transfers between action, run, target, unresolved or replaced role holder (277.318006ms)
+✔ task projection uses schema current view, skipping earlier and equal-start polls (159.624588ms)
+✔ revocation permanently bars the old run from reclaiming first, including after broker restart (230.162004ms)
+✔ empty message references refuse before storage; refusal-evidence failure stays a typed error (154.874371ms)
+✔ both arbiters require human resolution when their cross-role route is themselves (246.44035ms)
+✔ the shipped coder role raises task.reassign as gated to the human; task.scope.change stays cross-role (131.45497ms)
+✔ S1 adapter takes resolved limits and refs, rejects mismatched instance, never mutates input (2.606188ms)
+✔ credentials gives human and reader sessions service, account, role, date and state, and nothing else (102.98889ms)
+✔ credentials refuses a role session and any argument (189.038513ms)
+✔ credentials reads the status on each request, and a broker without one lists none (237.313162ms)
+✔ the broker process answers credentials without a token, path or variable in its output, log or store (189.286361ms)
+✔ only validated broker references load; returned data and exceptions cannot expose a known token (3.731365ms)
+✔ bad file modes, symlinks, repository/data paths, malformed tokens and missing dates refuse (3.265958ms)
+✔ expiry refuses use and env references never become client data (0.903188ms)
+✔ S1 parsed service refs work, service mismatch refuses, Gitea rotation due is a warning state (1.843833ms)
+✔ opaque tokens shorter than 16 characters refuse before use (0.404309ms)
+✖ a human resolve sends the raising role one message from the human, and its request is the answer (224.963912ms)
+✖ a cross-role decision resolved by its arbiter comes from that role and run, with no request (254.425078ms)
+✖ a human withdraw sends one message with the note (239.892721ms)
+✔ the raising run's withdraw, a supersede, a within-role raise and seen send nothing (313.119898ms)
+✖ refused closes send nothing: invalid-choice, decision-closed, not-resolver (308.402434ms)
+✖ a raising role nobody holds at the close gets the message on the next claim (268.708422ms)
+✖ a human DECISION send keeps its own instruction as the request, not a close's answer (262.897184ms)
+✔ roles lists open decisions routed to a role, and never the human inbox (219.003259ms)
+✔ recent lists closed decisions of every route, newest close first, with how each closed (320.464523ms)
+✔ recent gives the closing event as closed when the decision was seen first (299.088758ms)
+✔ recent stops at RECENT rows (911.45798ms)
+✔ every row is what trail already gives the same session for that id (291.768096ms)
+✔ a role session can't list decisions, so it can't read another role's open decisions (413.178863ms)
+✔ decisions is a read: one business, strict arguments, nothing written (382.139943ms)
+✔ endLaunch writes session.ended, releases the run claim and kills its capabilities (126.808732ms)
+✔ endLaunch refuses an unknown run, a second end and a rebind of the ended run (152.770236ms)
+✔ a restarted broker refuses to rebind an ended run; a refused rebind leaves the run unbound (181.483573ms)
+✔ endLaunch leaves a claim another run took alone (180.07459ms)
+✔ refuse records action.refused against the caller with the code only (140.770406ms)
+✔ launches off refuses role.launch with launch-revoked until launches on (208.286955ms)
+✔ broker process: launch ops authorize role.launch, record refusals and end runs (275.008106ms)
+✔ human proof binds CLI entry, process start and nonce; agents and incomplete ancestry refuse (2.577683ms)
+✔ process reader gets own kernel identity without exposing environment values (0.719083ms)
+✔ EACCES ancestor environments skip only markers; commands and registered launches still refuse (1.088588ms)
+✔ real pid 1 remains inspectable when its environment is protected (0.396416ms)
+✔ within-role sends cite an open gated launch decision without spending it or naming it in grants (212.965946ms)
+✔ missing and foreign-business citations refuse and roll back message and grant (213.603776ms)
+✔ cross-role sends still need a matching resolved decision and consume it once (256.454015ms)
+✔ messages pages all human messages newest first without writes; read state is history (2742.717987ms)
+✔ messages refuses role callers, invalid paging and cursors outside this human feed (268.445284ms)
+✔ views messages passes only its paging arguments through (0.267464ms)
+✔ messages isolates businesses even with a valid foreign cursor (187.058657ms)
+✔ broker process binds trusted launches, offers reader capabilities, refuses human mutation, closes cleanly (196.429759ms)
+✔ startup token refusal returns safe code without value or partial listening broker (35.708649ms)
+✔ loaded fixture token is absent from socket replies and SQLite, including refusal evidence (206.14697ms)
+✔ killed broker leaves an explicit stale lock; another process cannot silently reclaim it (174.806422ms)
+✔ trusted host registers later launches; socket clients never have a registration verb (188.943856ms)
+✔ runtime excludes declared project roots even when host supplies no repoRoots (36.308424ms)
+✔ a refused launch binding leaves the broker and existing capabilities alive; bad protocol stops it (180.184215ms)
+✔ a reply is listed for human and reader sessions, and its delivery rows are unchanged (253.447915ms)
+✔ the reply still reaches the human message.receive (mosaic talk) after the Console showed it (231.258509ms)
+✔ a message with no reply gives an empty list (163.487884ms)
+✔ replies come oldest first and stop at REPLIES (848.344125ms)
+✔ an id that names no message in the business refuses message-not-found, and the refusal is recorded (342.998417ms)
+✔ strict arguments; a role session gets human-required (398.818701ms)
+✔ views passes replies through as one call with the id (0.212098ms)
+✔ requirements returns the committed list to a holding role session, and no one else (226.054051ms)
+✔ the PM's prd.approve with no task, when no id fits, reaches the human's Inbox (178.314689ms)
+✔ the PM's non-blocking role.revoke with no task reaches the human's Inbox (186.620191ms)
+✔ a push is recorded as the action.allowed for git.push.working on the task, and only the host records one (248.001349ms)
+✔ review.request names the latest pushed commit and sends the reviewer a REVIEW-REQUEST (274.435839ms)
+✔ review.request says which run holds the reviewer role, or null, and a null request waits for a claim (306.847145ms)
+✔ review.request refuses a commit that isn't the latest push, a non-reviewer and a role without the action (419.917493ms)
+✔ reviewFetch answers only the addressed reviewer, for the request it cites (289.665893ms)
+✔ review.verdict answers one request once, to the role that asked (334.620619ms)
+✔ task.close on a pushed task needs an approve verdict for the latest push (404.193996ms)
+✔ a refusal the host decided is filed on the task it names, and only a task ref counts (264.265142ms)
+✔ v3b prototype refusals, views and append-only mutations (1119.929718ms)
+✔ gated approval authorizes once, survives store reopen, and fresh approval works (281.305583ms)
+✔ another run cannot consume an approval; a failed check leaves it usable (239.012692ms)
+✔ two scheduled callers have exactly one grant and one consumed refusal (169.726254ms)
+✔ failed commit rolls consumption back; cross-role consumes and within-role stays reusable (350.654724ms)
+✔ class drift gated to cross-role refuses before consumption (272.807122ms)
+✔ class drift cross-role to gated refuses before consumption (281.454692ms)
+✔ class drift gated to within-role refuses before consumption (242.158726ms)
+✔ class drift cross-role to within-role refuses before consumption (276.074181ms)
+✔ class drift within-role to gated refuses before consumption (224.097243ms)
+✔ class drift within-role to cross-role refuses before consumption (200.797709ms)
+✖ message.send consumes approval and prevents a later send or authorize (179.591999ms)
+✔ role.revoke consumes approval and prevents a later revoke or authorize (267.496045ms)
+✔ a business that never switched launches reads allowed with no time and no event (131.617494ms)
+✔ launches revoked and then restored read allowed, with the restore time and event id (176.86995ms)
+✔ a task closed on the tracker leaves the open list, and total counts the open ones (169.483423ms)
+✔ a tombstone is not open (142.706572ms)
+✔ the open list stops at the cap and says so; total still counts every open task (156.733028ms)
+✔ a role and a reader session read state; arguments, and an unbound cap, refuse (158.473676ms)
+✔ a human session reads the same state, with the same cap (152.555096ms)
+✔ reading state writes nothing: every table keeps its row count (181.678576ms)
+✔ creates private WAL store and excludes a second writer until explicit close (149.075807ms)
+✔ rollback is atomic and schema metadata is checked against trusted DDL, not just itself (194.177244ms)
+✔ existing empty database and symlink runtime directory refuse, never initialize over damage (186.409464ms)
+✔ crash during a transaction recovers no partial event after explicit fixture-only lock removal (185.535105ms)
+✔ writer refuses mixed at/read_at forms atomically, even through trusted SQL helpers (118.817091ms)
+✔ async transactions refuse before invoking their function (122.484625ms)
+✔ the session default fits under the reply cap and pages to the end with next (299.295735ms)
+✔ the short form: no description, assignees by role, every listed key (292.217426ms)
+✔ each filter, alone and together, and total counts every match (335.846547ms)
+✔ task_ref reads one task in full, as the whole board has it (299.481971ms)
+✔ no arguments is the read the Console and mosaic make, unchanged (267.671566ms)
+✔ an unknown argument or a bad value refuses invalid-request (932.656775ms)
+✔ tasks rows carry priority and requirement for every session that reads tasks (337.284475ms)
+✔ the read model rebuilds from the ledger: a reopened bus and each trail give the same values (384.472399ms)
+✔ an empty business and one with snapshots but no task.created read cleanly (130.918207ms)
+✔ recordTask keeps sync reads and a role write apart (194.931813ms)
+✔ read_at must be one canonical UTC format, so the projection compares strings safely (134.442875ms)
+✔ a bad entry refuses the whole record (125.722013ms)
+✔ taskView reads the projection for one business (156.216048ms)
+✔ requestTask hands only a holder and a task verb to the handler, and records refusals (263.152294ms)
+✔ the server sends task verbs to the adapter with its own timeout; other verbs stay synchronous (435.896872ms)
+✔ without an adapter the server refuses every task verb (216.531763ms)
+✔ the runtime refuses an invalid adapter and closes a valid one (207.142328ms)
+✔ the process loads the S3 adapter from plain-data trackers (274.128497ms)
+✔ the tester binds only when the business sets bus.tester to exactly true (899.22688ms)
+✔ a business may not name a role tester, so the tester address is never a role (256.37128ms)
+✔ every verb outside the tester list refuses tester-refused and is recorded against the tester (561.244372ms)
+✔ a tester message is from tester, starts [mos test], and writes no human.input or authority (235.041158ms)
+✔ a role answers a tester only in reply to a tester message, and the answer never reaches the human (218.684484ms)
+✔ the tester reads the human views a reader reads (81.29134ms)
+✔ tester proof binds its own CLI, start time and nonce, refuses a managed run and allows an agent (1.09937ms)
+✔ neither CLI's nonce proves the other: each proof is bound to its own CLI and nonce variable (0.327389ms)
+✔ testerNonce reads only the tester's variable and gives null on any read error (0.197535ms)
+✔ an envelope carries exactly one of cap, human and tester; no tester authenticator refuses (53.981694ms)
+✔ tester-cli.mjs binds through the runtime when the switch is on, and refuses off or under a run marker (716.948233ms)
+✔ socket capability stamps launch identity; shared views use wire, no SQL client (180.100951ms)
+✔ two wire claims serialize; a lost reply never automatically retries (204.674936ms)
+✔ malformed, oversized and identity-forging envelopes refuse without echoing input (127.229089ms)
+✔ client preserves UTF-8 when a response divides a multibyte character (12.143276ms)
+✔ committed mutation followed by dropped reply reports unknown and is never retried (152.414563ms)
+ℹ tests 155
+ℹ suites 0
+ℹ pass 148
+ℹ fail 7
+ℹ cancelled 0
+ℹ skipped 0
+ℹ todo 0
+ℹ duration_ms 4312.897179
+
+✖ failing tests:
+
+test at tests/decision-close.test.mjs:55:1
+✖ a human resolve sends the raising role one message from the human, and its request is the answer (224.963912ms)
+  TypeError: Cannot read properties of undefined (reading 'business')
+      at TestContext.<anonymous> (file:///home/jwoltje/darkwing-scratch/r115/wt/packages/bus/tests/decision-close.test.mjs:62:18)
+      at Test.runInAsyncScope (node:async_hooks:226:14)
+      at Test.run (node:internal/test_runner/test:1402:25)
+      at Test.start (node:internal/test_runner/test:1262:17)
+      at startSubtestAfterBootstrap (node:internal/test_runner/harness:387:17)
+
+test at tests/decision-close.test.mjs:80:1
+✖ a cross-role decision resolved by its arbiter comes from that role and run, with no request (254.425078ms)
+  TypeError: Cannot read properties of undefined (reading 'from_role')
+      at TestContext.<anonymous> (file:///home/jwoltje/darkwing-scratch/r115/wt/packages/bus/tests/decision-close.test.mjs:85:18)
+      at Test.runInAsyncScope (node:async_hooks:226:14)
+      at Test.run (node:internal/test_runner/test:1402:25)
+      at Test.processPendingSubtests (node:internal/test_runner/test:974:18)
+      at Test.postRun (node:internal/test_runner/test:1542:19)
+      at Test.run (node:internal/test_runner/test:1467:12)
+      at async startSubtestAfterBootstrap (node:internal/test_runner/harness:387:3)
+
+test at tests/decision-close.test.mjs:96:1
+✖ a human withdraw sends one message with the note (239.892721ms)
+  TypeError: Cannot read properties of undefined (reading 'from_role')
+      at TestContext.<anonymous> (file:///home/jwoltje/darkwing-scratch/r115/wt/packages/bus/tests/decision-close.test.mjs:101:18)
+      at Test.runInAsyncScope (node:async_hooks:226:14)
+      at Test.run (node:internal/test_runner/test:1402:25)
+      at Test.processPendingSubtests (node:internal/test_runner/test:974:18)
+      at Test.postRun (node:internal/test_runner/test:1542:19)
+      at Test.run (node:internal/test_runner/test:1467:12)
+      at async Test.processPendingSubtests (node:internal/test_runner/test:974:7)
+
+test at tests/decision-close.test.mjs:123:1
+✖ refused closes send nothing: invalid-choice, decision-closed, not-resolver (308.402434ms)
+  AssertionError [ERR_ASSERTION]: Expected values to be strictly equal:
+  
+  0 !== 1
+  
+      at TestContext.<anonymous> (file:///home/jwoltje/darkwing-scratch/r115/wt/packages/bus/tests/decision-close.test.mjs:130:10)
+      at Test.runInAsyncScope (node:async_hooks:226:14)
+      at Test.run (node:internal/test_runner/test:1402:25)
+      at Test.processPendingSubtests (node:internal/test_runner/test:974:18)
+      at Test.postRun (node:internal/test_runner/test:1542:19)
+      at Test.run (node:internal/test_runner/test:1467:12)
+      at async Test.processPendingSubtests (node:internal/test_runner/test:974:7) {
+    generatedMessage: true,
+    code: 'ERR_ASSERTION',
+    actual: 0,
+    expected: 1,
+    operator: 'strictEqual',
+    diff: 'simple'
+  }
+
+test at tests/decision-close.test.mjs:137:1
+✖ a raising role nobody holds at the close gets the message on the next claim (268.708422ms)
+  TypeError: Cannot read properties of undefined (reading 'id')
+      at TestContext.<anonymous> (file:///home/jwoltje/darkwing-scratch/r115/wt/packages/bus/tests/decision-close.test.mjs:142:40)
+      at Test.runInAsyncScope (node:async_hooks:226:14)
+      at Test.run (node:internal/test_runner/test:1402:25)
+      at Test.processPendingSubtests (node:internal/test_runner/test:974:18)
+      at Test.postRun (node:internal/test_runner/test:1542:19)
+      at Test.run (node:internal/test_runner/test:1467:12)
+      at async Test.processPendingSubtests (node:internal/test_runner/test:974:7)
+
+test at tests/decision-close.test.mjs:152:1
+✖ a human DECISION send keeps its own instruction as the request, not a close's answer (262.897184ms)
+  AssertionError [ERR_ASSERTION]: Expected values to be strictly deep-equal:
+  + actual - expected
+  
+    [
+      [
+        'human',
+  -     '30cb2e5d-fdb5-4744-8af2-3520c4048bfe'
+  -   ],
+  -   [
+  -     'human',
+        'bf412038-536c-4c5b-be62-a4ec6463404c'
+      ]
+    ]
+  
+      at TestContext.<anonymous> (file:///home/jwoltje/darkwing-scratch/r115/wt/packages/bus/tests/decision-close.test.mjs:157:10)
+      at Test.runInAsyncScope (node:async_hooks:226:14)
+      at Test.run (node:internal/test_runner/test:1402:25)
+      at Test.processPendingSubtests (node:internal/test_runner/test:974:18)
+      at Test.postRun (node:internal/test_runner/test:1542:19)
+      at Test.run (node:internal/test_runner/test:1467:12)
+      at async Test.processPendingSubtests (node:internal/test_runner/test:974:7) {
+    generatedMessage: true,
+    code: 'ERR_ASSERTION',
+    actual: [ [ 'human', 'bf412038-536c-4c5b-be62-a4ec6463404c' ] ],
+    expected: [ [ 'human', '30cb2e5d-fdb5-4744-8af2-3520c4048bfe' ], [ 'human', 'bf412038-536c-4c5b-be62-a4ec6463404c' ] ],
+    operator: 'deepStrictEqual',
+    diff: 'simple'
+  }
+
+test at tests/single-use.test.mjs:206:1
+✖ message.send consumes approval and prevents a later send or authorize (179.591999ms)
+  AssertionError [ERR_ASSERTION]: Expected values to be strictly equal:
+  
+  0 !== 1
+  
+      at TestContext.<anonymous> (file:///home/jwoltje/darkwing-scratch/r115/wt/packages/bus/tests/single-use.test.mjs:220:10)
+      at Test.runInAsyncScope (node:async_hooks:226:14)
+      at Test.run (node:internal/test_runner/test:1402:25)
+      at Test.processPendingSubtests (node:internal/test_runner/test:974:18)
+      at Test.postRun (node:internal/test_runner/test:1542:19)
+      at Test.run (node:internal/test_runner/test:1467:12)
+      at async Test.processPendingSubtests (node:internal/test_runner/test:974:7) {
+    generatedMessage: true,
+    code: 'ERR_ASSERTION',
+    actual: 0,
+    expected: 1,
+    operator: 'strictEqual',
+    diff: 'simple'
+  }
diff --git a/agents/darkwing/work/queue-115/r1/mutants/mutant-m2.log b/agents/darkwing/work/queue-115/r1/mutants/mutant-m2.log
new file mode 100644
index 000000000..2255fa4d3
--- /dev/null
+++ b/agents/darkwing/work/queue-115/r1/mutants/mutant-m2.log
@@ -0,0 +1,308 @@
+✔ agents: a held role with nothing on the bus is idle; a role session gets the claim rows unchanged (148.823395ms)
+✔ agents: working counts what the holder received and has not read; routed alone is not working (255.422914ms)
+✔ agents: input needed is the role's open decisions routed to the human, gated first, then oldest (353.986033ms)
+✔ agents: working wins over waiting, and Input needed still shows (258.005656ms)
+✔ agents: a new holder doesn't inherit what the last one left unread; decisions stay with the role (228.351548ms)
+✔ agents: state reads only its own business, even for a run name both use (238.066818ms)
+✔ agents: a message the holder released unread is stranded; the next holder gets nothing and cannot read it (236.218117ms)
+✔ agents: a message the holder read is not stranded; one the current holder has not read is not listed (280.237043ms)
+✔ agents: stranded is oldest first and capped at 50 for a role (987.810043ms)
+✔ agents: stranded is per role and per business (360.890922ms)
+✔ agents: a message routed to a held role and not yet received is not stranded (139.969852ms)
+✔ launch identity is stamped, payload identity is refused and stale holder cannot send (177.304896ms)
+✔ decision classes route from policy; gated resolution is human-only, choice and target must match (317.253772ms)
+✔ claim exclusion, holder release, gated revoke and rerouting to a new holder are atomic (287.746107ms)
+✔ launch events require a human CLI capability; generic emit cannot forge authority events (273.688504ms)
+✔ within-role decisions close atomically and invalid options or blocking omissions refuse (199.041646ms)
+✔ a recommendation that is not exactly one option key refuses invalid-recommendation after the options (333.303572ms)
+✔ observer capabilities read human inbox but cannot mutate or forge launch identity (217.828968ms)
+✔ task action subjects and linked decision trail are complete and ordered (248.875253ms)
+✔ launch binding is durable and reconnecting requires the identical trusted record (138.708157ms)
+✔ business isolation includes inherited object names and cross-business message references (247.63579ms)
+✔ authority never transfers between action, run, target, unresolved or replaced role holder (311.749545ms)
+✔ task projection uses schema current view, skipping earlier and equal-start polls (163.331609ms)
+✔ revocation permanently bars the old run from reclaiming first, including after broker restart (249.901396ms)
+✔ empty message references refuse before storage; refusal-evidence failure stays a typed error (148.586723ms)
+✔ both arbiters require human resolution when their cross-role route is themselves (242.992291ms)
+✔ the shipped coder role raises task.reassign as gated to the human; task.scope.change stays cross-role (152.403458ms)
+✔ S1 adapter takes resolved limits and refs, rejects mismatched instance, never mutates input (1.730294ms)
+✔ credentials gives human and reader sessions service, account, role, date and state, and nothing else (108.854031ms)
+✔ credentials refuses a role session and any argument (204.663152ms)
+✔ credentials reads the status on each request, and a broker without one lists none (250.114613ms)
+✔ the broker process answers credentials without a token, path or variable in its output, log or store (194.946952ms)
+✔ only validated broker references load; returned data and exceptions cannot expose a known token (3.939291ms)
+✔ bad file modes, symlinks, repository/data paths, malformed tokens and missing dates refuse (2.089318ms)
+✔ expiry refuses use and env references never become client data (0.545146ms)
+✔ S1 parsed service refs work, service mismatch refuses, Gitea rotation due is a warning state (1.407373ms)
+✔ opaque tokens shorter than 16 characters refuse before use (0.390979ms)
+✖ a human resolve sends the raising role one message from the human, and its request is the answer (244.331801ms)
+✖ a cross-role decision resolved by its arbiter comes from that role and run, with no request (247.487265ms)
+✖ a human withdraw sends one message with the note (228.711075ms)
+✔ the raising run's withdraw, a supersede, a within-role raise and seen send nothing (380.070658ms)
+✖ refused closes send nothing: invalid-choice, decision-closed, not-resolver (343.2355ms)
+✖ a raising role nobody holds at the close gets the message on the next claim (291.888176ms)
+✖ a human DECISION send keeps its own instruction as the request, not a close's answer (316.669026ms)
+✔ roles lists open decisions routed to a role, and never the human inbox (248.194735ms)
+✔ recent lists closed decisions of every route, newest close first, with how each closed (323.095216ms)
+✔ recent gives the closing event as closed when the decision was seen first (376.070271ms)
+✔ recent stops at RECENT rows (948.862474ms)
+✔ every row is what trail already gives the same session for that id (340.021848ms)
+✔ a role session can't list decisions, so it can't read another role's open decisions (466.151184ms)
+✔ decisions is a read: one business, strict arguments, nothing written (424.244638ms)
+✔ endLaunch writes session.ended, releases the run claim and kills its capabilities (133.988068ms)
+✔ endLaunch refuses an unknown run, a second end and a rebind of the ended run (172.650003ms)
+✔ a restarted broker refuses to rebind an ended run; a refused rebind leaves the run unbound (176.071176ms)
+✔ endLaunch leaves a claim another run took alone (183.960021ms)
+✔ refuse records action.refused against the caller with the code only (148.441981ms)
+✔ launches off refuses role.launch with launch-revoked until launches on (281.693067ms)
+✔ broker process: launch ops authorize role.launch, record refusals and end runs (305.850274ms)
+✔ human proof binds CLI entry, process start and nonce; agents and incomplete ancestry refuse (2.020741ms)
+✔ process reader gets own kernel identity without exposing environment values (0.605961ms)
+✔ EACCES ancestor environments skip only markers; commands and registered launches still refuse (0.850055ms)
+✔ real pid 1 remains inspectable when its environment is protected (0.316458ms)
+✔ within-role sends cite an open gated launch decision without spending it or naming it in grants (234.646923ms)
+✔ missing and foreign-business citations refuse and roll back message and grant (218.709661ms)
+✔ cross-role sends still need a matching resolved decision and consume it once (262.647466ms)
+✔ messages pages all human messages newest first without writes; read state is history (3016.304405ms)
+✔ messages refuses role callers, invalid paging and cursors outside this human feed (281.482408ms)
+✔ views messages passes only its paging arguments through (0.241793ms)
+✔ messages isolates businesses even with a valid foreign cursor (174.815443ms)
+✔ broker process binds trusted launches, offers reader capabilities, refuses human mutation, closes cleanly (214.098716ms)
+✔ startup token refusal returns safe code without value or partial listening broker (35.864037ms)
+✔ loaded fixture token is absent from socket replies and SQLite, including refusal evidence (206.753406ms)
+✔ killed broker leaves an explicit stale lock; another process cannot silently reclaim it (171.667301ms)
+✔ trusted host registers later launches; socket clients never have a registration verb (213.507549ms)
+✔ runtime excludes declared project roots even when host supplies no repoRoots (32.620737ms)
+✔ a refused launch binding leaves the broker and existing capabilities alive; bad protocol stops it (220.389587ms)
+✔ a reply is listed for human and reader sessions, and its delivery rows are unchanged (272.288883ms)
+✔ the reply still reaches the human message.receive (mosaic talk) after the Console showed it (222.808628ms)
+✔ a message with no reply gives an empty list (174.071823ms)
+✔ replies come oldest first and stop at REPLIES (950.194638ms)
+✔ an id that names no message in the business refuses message-not-found, and the refusal is recorded (379.503535ms)
+✔ strict arguments; a role session gets human-required (439.390458ms)
+✔ views passes replies through as one call with the id (0.268075ms)
+✔ requirements returns the committed list to a holding role session, and no one else (261.295389ms)
+✔ the PM's prd.approve with no task, when no id fits, reaches the human's Inbox (178.137626ms)
+✔ the PM's non-blocking role.revoke with no task reaches the human's Inbox (183.590458ms)
+✔ a push is recorded as the action.allowed for git.push.working on the task, and only the host records one (285.776018ms)
+✔ review.request names the latest pushed commit and sends the reviewer a REVIEW-REQUEST (274.603545ms)
+✔ review.request says which run holds the reviewer role, or null, and a null request waits for a claim (374.851915ms)
+✔ review.request refuses a commit that isn't the latest push, a non-reviewer and a role without the action (465.77259ms)
+✔ reviewFetch answers only the addressed reviewer, for the request it cites (269.144892ms)
+✔ review.verdict answers one request once, to the role that asked (384.212548ms)
+✔ task.close on a pushed task needs an approve verdict for the latest push (441.344218ms)
+✔ a refusal the host decided is filed on the task it names, and only a task ref counts (273.000109ms)
+✔ v3b prototype refusals, views and append-only mutations (1267.048762ms)
+✔ gated approval authorizes once, survives store reopen, and fresh approval works (314.808079ms)
+✔ another run cannot consume an approval; a failed check leaves it usable (228.235266ms)
+✔ two scheduled callers have exactly one grant and one consumed refusal (181.233801ms)
+✔ failed commit rolls consumption back; cross-role consumes and within-role stays reusable (430.180097ms)
+✔ class drift gated to cross-role refuses before consumption (281.490079ms)
+✔ class drift cross-role to gated refuses before consumption (308.437462ms)
+✔ class drift gated to within-role refuses before consumption (278.422298ms)
+✔ class drift cross-role to within-role refuses before consumption (305.903361ms)
+✔ class drift within-role to gated refuses before consumption (234.673384ms)
+✔ class drift within-role to cross-role refuses before consumption (231.008393ms)
+✔ message.send consumes approval and prevents a later send or authorize (232.429829ms)
+✔ role.revoke consumes approval and prevents a later revoke or authorize (275.23709ms)
+✔ a business that never switched launches reads allowed with no time and no event (147.411584ms)
+✔ launches revoked and then restored read allowed, with the restore time and event id (202.159408ms)
+✔ a task closed on the tracker leaves the open list, and total counts the open ones (165.639147ms)
+✔ a tombstone is not open (152.765863ms)
+✔ the open list stops at the cap and says so; total still counts every open task (223.226675ms)
+✔ a role and a reader session read state; arguments, and an unbound cap, refuse (172.909574ms)
+✔ a human session reads the same state, with the same cap (159.56416ms)
+✔ reading state writes nothing: every table keeps its row count (190.461595ms)
+✔ creates private WAL store and excludes a second writer until explicit close (158.361727ms)
+✔ rollback is atomic and schema metadata is checked against trusted DDL, not just itself (251.759035ms)
+✔ existing empty database and symlink runtime directory refuse, never initialize over damage (216.785975ms)
+✔ crash during a transaction recovers no partial event after explicit fixture-only lock removal (207.915496ms)
+✔ writer refuses mixed at/read_at forms atomically, even through trusted SQL helpers (124.446145ms)
+✔ async transactions refuse before invoking their function (129.334071ms)
+✔ the session default fits under the reply cap and pages to the end with next (388.245087ms)
+✔ the short form: no description, assignees by role, every listed key (286.107518ms)
+✔ each filter, alone and together, and total counts every match (340.820798ms)
+✔ task_ref reads one task in full, as the whole board has it (330.945795ms)
+✔ no arguments is the read the Console and mosaic make, unchanged (291.613031ms)
+✔ an unknown argument or a bad value refuses invalid-request (980.518035ms)
+✔ tasks rows carry priority and requirement for every session that reads tasks (406.136647ms)
+✔ the read model rebuilds from the ledger: a reopened bus and each trail give the same values (413.803834ms)
+✔ an empty business and one with snapshots but no task.created read cleanly (132.662396ms)
+✔ recordTask keeps sync reads and a role write apart (201.956405ms)
+✔ read_at must be one canonical UTC format, so the projection compares strings safely (142.062729ms)
+✔ a bad entry refuses the whole record (128.841047ms)
+✔ taskView reads the projection for one business (160.964394ms)
+✔ requestTask hands only a holder and a task verb to the handler, and records refusals (312.926396ms)
+✔ the server sends task verbs to the adapter with its own timeout; other verbs stay synchronous (441.437051ms)
+✔ without an adapter the server refuses every task verb (232.838052ms)
+✔ the runtime refuses an invalid adapter and closes a valid one (226.017926ms)
+✔ the process loads the S3 adapter from plain-data trackers (277.265421ms)
+✔ the tester binds only when the business sets bus.tester to exactly true (956.299771ms)
+✔ a business may not name a role tester, so the tester address is never a role (270.323628ms)
+✔ every verb outside the tester list refuses tester-refused and is recorded against the tester (598.136438ms)
+✔ a tester message is from tester, starts [mos test], and writes no human.input or authority (235.079337ms)
+✔ a role answers a tester only in reply to a tester message, and the answer never reaches the human (252.618235ms)
+✔ the tester reads the human views a reader reads (98.233551ms)
+✔ tester proof binds its own CLI, start time and nonce, refuses a managed run and allows an agent (1.152923ms)
+✔ neither CLI's nonce proves the other: each proof is bound to its own CLI and nonce variable (0.363306ms)
+✔ testerNonce reads only the tester's variable and gives null on any read error (0.220165ms)
+✔ an envelope carries exactly one of cap, human and tester; no tester authenticator refuses (49.991264ms)
+✔ tester-cli.mjs binds through the runtime when the switch is on, and refuses off or under a run marker (708.276736ms)
+✔ socket capability stamps launch identity; shared views use wire, no SQL client (172.514958ms)
+✔ two wire claims serialize; a lost reply never automatically retries (202.937094ms)
+✔ malformed, oversized and identity-forging envelopes refuse without echoing input (144.339016ms)
+✔ client preserves UTF-8 when a response divides a multibyte character (12.444141ms)
+✔ committed mutation followed by dropped reply reports unknown and is never retried (158.876556ms)
+ℹ tests 155
+ℹ suites 0
+ℹ pass 149
+ℹ fail 6
+ℹ cancelled 0
+ℹ skipped 0
+ℹ todo 0
+ℹ duration_ms 4614.849924
+
+✖ failing tests:
+
+test at tests/decision-close.test.mjs:55:1
+✖ a human resolve sends the raising role one message from the human, and its request is the answer (244.331801ms)
+  AssertionError [ERR_ASSERTION]: Expected values to be strictly equal:
+  
+  'human' !== 'coder'
+  
+      at TestContext.<anonymous> (file:///home/jwoltje/darkwing-scratch/r115/wt/packages/bus/tests/decision-close.test.mjs:65:10)
+      at Test.runInAsyncScope (node:async_hooks:226:14)
+      at Test.run (node:internal/test_runner/test:1402:25)
+      at Test.start (node:internal/test_runner/test:1262:17)
+      at startSubtestAfterBootstrap (node:internal/test_runner/harness:387:17) {
+    generatedMessage: true,
+    code: 'ERR_ASSERTION',
+    actual: 'human',
+    expected: 'coder',
+    operator: 'strictEqual',
+    diff: 'simple'
+  }
+
+test at tests/decision-close.test.mjs:80:1
+✖ a cross-role decision resolved by its arbiter comes from that role and run, with no request (247.487265ms)
+  AssertionError [ERR_ASSERTION]: Expected values to be strictly equal:
+  
+  'cto' !== 'coder'
+  
+      at TestContext.<anonymous> (file:///home/jwoltje/darkwing-scratch/r115/wt/packages/bus/tests/decision-close.test.mjs:87:10)
+      at Test.runInAsyncScope (node:async_hooks:226:14)
+      at Test.run (node:internal/test_runner/test:1402:25)
+      at Test.processPendingSubtests (node:internal/test_runner/test:974:18)
+      at Test.postRun (node:internal/test_runner/test:1542:19)
+      at Test.run (node:internal/test_runner/test:1467:12)
+      at async startSubtestAfterBootstrap (node:internal/test_runner/harness:387:3) {
+    generatedMessage: true,
+    code: 'ERR_ASSERTION',
+    actual: 'cto',
+    expected: 'coder',
+    operator: 'strictEqual',
+    diff: 'simple'
+  }
+
+test at tests/decision-close.test.mjs:96:1
+✖ a human withdraw sends one message with the note (228.711075ms)
+  AssertionError [ERR_ASSERTION]: Expected values to be strictly equal:
+  
+  'pm' !== 'coder'
+  
+      at TestContext.<anonymous> (file:///home/jwoltje/darkwing-scratch/r115/wt/packages/bus/tests/decision-close.test.mjs:102:10)
+      at Test.runInAsyncScope (node:async_hooks:226:14)
+      at Test.run (node:internal/test_runner/test:1402:25)
+      at Test.processPendingSubtests (node:internal/test_runner/test:974:18)
+      at Test.postRun (node:internal/test_runner/test:1542:19)
+      at Test.run (node:internal/test_runner/test:1467:12)
+      at async Test.processPendingSubtests (node:internal/test_runner/test:974:7) {
+    generatedMessage: true,
+    code: 'ERR_ASSERTION',
+    actual: 'pm',
+    expected: 'coder',
+    operator: 'strictEqual',
+    diff: 'simple'
+  }
+
+test at tests/decision-close.test.mjs:123:1
+✖ refused closes send nothing: invalid-choice, decision-closed, not-resolver (343.2355ms)
+  AssertionError [ERR_ASSERTION]: Expected values to be strictly equal:
+  
+  0 !== 1
+  
+      at TestContext.<anonymous> (file:///home/jwoltje/darkwing-scratch/r115/wt/packages/bus/tests/decision-close.test.mjs:134:10)
+      at Test.runInAsyncScope (node:async_hooks:226:14)
+      at Test.run (node:internal/test_runner/test:1402:25)
+      at Test.processPendingSubtests (node:internal/test_runner/test:974:18)
+      at Test.postRun (node:internal/test_runner/test:1542:19)
+      at Test.run (node:internal/test_runner/test:1467:12)
+      at async Test.processPendingSubtests (node:internal/test_runner/test:974:7) {
+    generatedMessage: true,
+    code: 'ERR_ASSERTION',
+    actual: 0,
+    expected: 1,
+    operator: 'strictEqual',
+    diff: 'simple'
+  }
+
+test at tests/decision-close.test.mjs:137:1
+✖ a raising role nobody holds at the close gets the message on the next claim (291.888176ms)
+  AssertionError [ERR_ASSERTION]: Expected values to be strictly deep-equal:
+  + actual - expected
+  
+    {
+  +   address: null,
+  +   holder_run: null,
+  -   address: 'coder-run-2',
+  -   holder_run: 'coder-run-2',
+      op: 'routed',
+  +   transport: null
+  -   transport: 'pi'
+    }
+  
+      at TestContext.<anonymous> (file:///home/jwoltje/darkwing-scratch/r115/wt/packages/bus/tests/decision-close.test.mjs:144:10)
+      at Test.runInAsyncScope (node:async_hooks:226:14)
+      at Test.run (node:internal/test_runner/test:1402:25)
+      at Test.processPendingSubtests (node:internal/test_runner/test:974:18)
+      at Test.postRun (node:internal/test_runner/test:1542:19)
+      at Test.run (node:internal/test_runner/test:1467:12)
+      at async Test.processPendingSubtests (node:internal/test_runner/test:974:7) {
+    generatedMessage: true,
+    code: 'ERR_ASSERTION',
+    actual: { op: 'routed', holder_run: null, transport: null, address: null },
+    expected: { op: 'routed', holder_run: 'coder-run-2', transport: 'pi', address: 'coder-run-2' },
+    operator: 'deepStrictEqual',
+    diff: 'simple'
+  }
+
+test at tests/decision-close.test.mjs:152:1
+✖ a human DECISION send keeps its own instruction as the request, not a close's answer (316.669026ms)
+  AssertionError [ERR_ASSERTION]: Expected values to be strictly deep-equal:
+  + actual - expected
+  
+    [
+      [
+        'human',
+  -     'e9e45823-5e6a-4af9-be1e-01c07ff4bce9'
+  -   ],
+  -   [
+  -     'human',
+        '0c00d986-6b19-411c-b097-2569ff392405'
+      ]
+    ]
+  
+      at TestContext.<anonymous> (file:///home/jwoltje/darkwing-scratch/r115/wt/packages/bus/tests/decision-close.test.mjs:157:10)
+      at Test.runInAsyncScope (node:async_hooks:226:14)
+      at Test.run (node:internal/test_runner/test:1402:25)
+      at Test.processPendingSubtests (node:internal/test_runner/test:974:18)
+      at Test.postRun (node:internal/test_runner/test:1542:19)
+      at Test.run (node:internal/test_runner/test:1467:12)
+      at async Test.processPendingSubtests (node:internal/test_runner/test:974:7) {
+    generatedMessage: true,
+    code: 'ERR_ASSERTION',
+    actual: [ [ 'human', '0c00d986-6b19-411c-b097-2569ff392405' ] ],
+    expected: [ [ 'human', 'e9e45823-5e6a-4af9-be1e-01c07ff4bce9' ], [ 'human', '0c00d986-6b19-411c-b097-2569ff392405' ] ],
+    operator: 'deepStrictEqual',
+    diff: 'simple'
+  }
diff --git a/agents/darkwing/work/queue-115/r1/mutants/mutant-m3.log b/agents/darkwing/work/queue-115/r1/mutants/mutant-m3.log
new file mode 100644
index 000000000..92393187c
--- /dev/null
+++ b/agents/darkwing/work/queue-115/r1/mutants/mutant-m3.log
@@ -0,0 +1,204 @@
+✔ agents: a held role with nothing on the bus is idle; a role session gets the claim rows unchanged (127.072487ms)
+✔ agents: working counts what the holder received and has not read; routed alone is not working (227.457123ms)
+✔ agents: input needed is the role's open decisions routed to the human, gated first, then oldest (385.412069ms)
+✔ agents: working wins over waiting, and Input needed still shows (184.906716ms)
+✔ agents: a new holder doesn't inherit what the last one left unread; decisions stay with the role (239.603829ms)
+✔ agents: state reads only its own business, even for a run name both use (211.927008ms)
+✔ agents: a message the holder released unread is stranded; the next holder gets nothing and cannot read it (246.790543ms)
+✔ agents: a message the holder read is not stranded; one the current holder has not read is not listed (234.615643ms)
+✔ agents: stranded is oldest first and capped at 50 for a role (923.984362ms)
+✔ agents: stranded is per role and per business (338.444257ms)
+✔ agents: a message routed to a held role and not yet received is not stranded (165.085522ms)
+✔ launch identity is stamped, payload identity is refused and stale holder cannot send (181.194594ms)
+✔ decision classes route from policy; gated resolution is human-only, choice and target must match (314.714392ms)
+✔ claim exclusion, holder release, gated revoke and rerouting to a new holder are atomic (323.064673ms)
+✔ launch events require a human CLI capability; generic emit cannot forge authority events (196.787014ms)
+✔ within-role decisions close atomically and invalid options or blocking omissions refuse (200.87518ms)
+✔ a recommendation that is not exactly one option key refuses invalid-recommendation after the options (320.157085ms)
+✔ observer capabilities read human inbox but cannot mutate or forge launch identity (206.438796ms)
+✔ task action subjects and linked decision trail are complete and ordered (227.06877ms)
+✔ launch binding is durable and reconnecting requires the identical trusted record (123.905493ms)
+✔ business isolation includes inherited object names and cross-business message references (229.743079ms)
+✔ authority never transfers between action, run, target, unresolved or replaced role holder (285.68889ms)
+✔ task projection uses schema current view, skipping earlier and equal-start polls (142.692163ms)
+✔ revocation permanently bars the old run from reclaiming first, including after broker restart (226.967555ms)
+✔ empty message references refuse before storage; refusal-evidence failure stays a typed error (149.467341ms)
+✔ both arbiters require human resolution when their cross-role route is themselves (267.605055ms)
+✔ the shipped coder role raises task.reassign as gated to the human; task.scope.change stays cross-role (138.973595ms)
+✔ S1 adapter takes resolved limits and refs, rejects mismatched instance, never mutates input (2.284423ms)
+✔ credentials gives human and reader sessions service, account, role, date and state, and nothing else (117.403094ms)
+✔ credentials refuses a role session and any argument (199.012215ms)
+✔ credentials reads the status on each request, and a broker without one lists none (252.302722ms)
+✔ the broker process answers credentials without a token, path or variable in its output, log or store (207.817766ms)
+✔ only validated broker references load; returned data and exceptions cannot expose a known token (3.395656ms)
+✔ bad file modes, symlinks, repository/data paths, malformed tokens and missing dates refuse (1.660114ms)
+✔ expiry refuses use and env references never become client data (0.54116ms)
+✔ S1 parsed service refs work, service mismatch refuses, Gitea rotation due is a warning state (1.227701ms)
+✔ opaque tokens shorter than 16 characters refuse before use (0.3125ms)
+✔ a human resolve sends the raising role one message from the human, and its request is the answer (265.607012ms)
+✔ a cross-role decision resolved by its arbiter comes from that role and run, with no request (273.016707ms)
+✔ a human withdraw sends one message with the note (263.964566ms)
+✖ the raising run's withdraw, a supersede, a within-role raise and seen send nothing (331.104691ms)
+✔ refused closes send nothing: invalid-choice, decision-closed, not-resolver (330.850044ms)
+✔ a raising role nobody holds at the close gets the message on the next claim (311.152009ms)
+✔ a human DECISION send keeps its own instruction as the request, not a close's answer (271.591802ms)
+✔ roles lists open decisions routed to a role, and never the human inbox (234.266349ms)
+✔ recent lists closed decisions of every route, newest close first, with how each closed (344.192145ms)
+✔ recent gives the closing event as closed when the decision was seen first (332.075329ms)
+✔ recent stops at RECENT rows (933.224309ms)
+✔ every row is what trail already gives the same session for that id (286.68338ms)
+✔ a role session can't list decisions, so it can't read another role's open decisions (451.338469ms)
+✔ decisions is a read: one business, strict arguments, nothing written (380.593462ms)
+✔ endLaunch writes session.ended, releases the run claim and kills its capabilities (128.218978ms)
+✔ endLaunch refuses an unknown run, a second end and a rebind of the ended run (151.693146ms)
+✔ a restarted broker refuses to rebind an ended run; a refused rebind leaves the run unbound (187.169405ms)
+✔ endLaunch leaves a claim another run took alone (212.321542ms)
+✔ refuse records action.refused against the caller with the code only (144.537442ms)
+✔ launches off refuses role.launch with launch-revoked until launches on (212.86624ms)
+✔ broker process: launch ops authorize role.launch, record refusals and end runs (278.002262ms)
+✔ human proof binds CLI entry, process start and nonce; agents and incomplete ancestry refuse (2.273347ms)
+✔ process reader gets own kernel identity without exposing environment values (0.652066ms)
+✔ EACCES ancestor environments skip only markers; commands and registered launches still refuse (0.922993ms)
+✔ real pid 1 remains inspectable when its environment is protected (0.285274ms)
+✔ within-role sends cite an open gated launch decision without spending it or naming it in grants (208.34646ms)
+✔ missing and foreign-business citations refuse and roll back message and grant (208.24156ms)
+✔ cross-role sends still need a matching resolved decision and consume it once (303.458919ms)
+✔ messages pages all human messages newest first without writes; read state is history (2862.802223ms)
+✔ messages refuses role callers, invalid paging and cursors outside this human feed (257.32751ms)
+✔ views messages passes only its paging arguments through (0.284949ms)
+✔ messages isolates businesses even with a valid foreign cursor (195.335624ms)
+✔ broker process binds trusted launches, offers reader capabilities, refuses human mutation, closes cleanly (214.093475ms)
+✔ startup token refusal returns safe code without value or partial listening broker (39.236348ms)
+✔ loaded fixture token is absent from socket replies and SQLite, including refusal evidence (204.373782ms)
+✔ killed broker leaves an explicit stale lock; another process cannot silently reclaim it (187.632741ms)
+✔ trusted host registers later launches; socket clients never have a registration verb (195.490988ms)
+✔ runtime excludes declared project roots even when host supplies no repoRoots (35.427272ms)
+✔ a refused launch binding leaves the broker and existing capabilities alive; bad protocol stops it (205.107349ms)
+✔ a reply is listed for human and reader sessions, and its delivery rows are unchanged (264.207831ms)
+✔ the reply still reaches the human message.receive (mosaic talk) after the Console showed it (230.964485ms)
+✔ a message with no reply gives an empty list (204.119172ms)
+✔ replies come oldest first and stop at REPLIES (864.223512ms)
+✔ an id that names no message in the business refuses message-not-found, and the refusal is recorded (338.397855ms)
+✔ strict arguments; a role session gets human-required (416.207941ms)
+✔ views passes replies through as one call with the id (0.212129ms)
+✔ requirements returns the committed list to a holding role session, and no one else (249.409632ms)
+✔ the PM's prd.approve with no task, when no id fits, reaches the human's Inbox (179.497622ms)
+✔ the PM's non-blocking role.revoke with no task reaches the human's Inbox (211.836506ms)
+✔ a push is recorded as the action.allowed for git.push.working on the task, and only the host records one (281.196861ms)
+✔ review.request names the latest pushed commit and sends the reviewer a REVIEW-REQUEST (296.181387ms)
+✔ review.request says which run holds the reviewer role, or null, and a null request waits for a claim (338.470119ms)
+✔ review.request refuses a commit that isn't the latest push, a non-reviewer and a role without the action (440.989861ms)
+✔ reviewFetch answers only the addressed reviewer, for the request it cites (277.597217ms)
+✔ review.verdict answers one request once, to the role that asked (340.890727ms)
+✔ task.close on a pushed task needs an approve verdict for the latest push (416.83893ms)
+✔ a refusal the host decided is filed on the task it names, and only a task ref counts (253.967564ms)
+✔ v3b prototype refusals, views and append-only mutations (1233.062022ms)
+✔ gated approval authorizes once, survives store reopen, and fresh approval works (308.484662ms)
+✔ another run cannot consume an approval; a failed check leaves it usable (278.134787ms)
+✔ two scheduled callers have exactly one grant and one consumed refusal (178.287853ms)
+✔ failed commit rolls consumption back; cross-role consumes and within-role stays reusable (368.870379ms)
+✔ class drift gated to cross-role refuses before consumption (250.626839ms)
+✔ class drift cross-role to gated refuses before consumption (306.819978ms)
+✔ class drift gated to within-role refuses before consumption (247.343883ms)
+✔ class drift cross-role to within-role refuses before consumption (282.987135ms)
+✔ class drift within-role to gated refuses before consumption (235.415712ms)
+✔ class drift within-role to cross-role refuses before consumption (203.629483ms)
+✔ message.send consumes approval and prevents a later send or authorize (214.913424ms)
+✔ role.revoke consumes approval and prevents a later revoke or authorize (291.008418ms)
+✔ a business that never switched launches reads allowed with no time and no event (149.147444ms)
+✔ launches revoked and then restored read allowed, with the restore time and event id (188.217191ms)
+✔ a task closed on the tracker leaves the open list, and total counts the open ones (204.783346ms)
+✔ a tombstone is not open (162.268645ms)
+✔ the open list stops at the cap and says so; total still counts every open task (167.499208ms)
+✔ a role and a reader session read state; arguments, and an unbound cap, refuse (166.292128ms)
+✔ a human session reads the same state, with the same cap (155.329544ms)
+✔ reading state writes nothing: every table keeps its row count (175.301809ms)
+✔ creates private WAL store and excludes a second writer until explicit close (145.628979ms)
+✔ rollback is atomic and schema metadata is checked against trusted DDL, not just itself (193.091176ms)
+✔ existing empty database and symlink runtime directory refuse, never initialize over damage (213.571709ms)
+✔ crash during a transaction recovers no partial event after explicit fixture-only lock removal (198.231443ms)
+✔ writer refuses mixed at/read_at forms atomically, even through trusted SQL helpers (137.384225ms)
+✔ async transactions refuse before invoking their function (96.291117ms)
+✔ the session default fits under the reply cap and pages to the end with next (320.434148ms)
+✔ the short form: no description, assignees by role, every listed key (267.270375ms)
+✔ each filter, alone and together, and total counts every match (362.439015ms)
+✔ task_ref reads one task in full, as the whole board has it (307.691027ms)
+✔ no arguments is the read the Console and mosaic make, unchanged (258.058657ms)
+✔ an unknown argument or a bad value refuses invalid-request (945.963379ms)
+✔ tasks rows carry priority and requirement for every session that reads tasks (369.039587ms)
+✔ the read model rebuilds from the ledger: a reopened bus and each trail give the same values (397.205425ms)
+✔ an empty business and one with snapshots but no task.created read cleanly (132.886188ms)
+✔ recordTask keeps sync reads and a role write apart (191.900548ms)
+✔ read_at must be one canonical UTC format, so the projection compares strings safely (135.312233ms)
+✔ a bad entry refuses the whole record (132.898598ms)
+✔ taskView reads the projection for one business (159.871937ms)
+✔ requestTask hands only a holder and a task verb to the handler, and records refusals (274.979179ms)
+✔ the server sends task verbs to the adapter with its own timeout; other verbs stay synchronous (433.978316ms)
+✔ without an adapter the server refuses every task verb (212.848454ms)
+✔ the runtime refuses an invalid adapter and closes a valid one (209.817048ms)
+✔ the process loads the S3 adapter from plain-data trackers (292.391194ms)
+✔ the tester binds only when the business sets bus.tester to exactly true (890.947951ms)
+✔ a business may not name a role tester, so the tester address is never a role (274.980511ms)
+✔ every verb outside the tester list refuses tester-refused and is recorded against the tester (539.781297ms)
+✔ a tester message is from tester, starts [mos test], and writes no human.input or authority (258.160391ms)
+✔ a role answers a tester only in reply to a tester message, and the answer never reaches the human (230.050761ms)
+✔ the tester reads the human views a reader reads (103.403422ms)
+✔ tester proof binds its own CLI, start time and nonce, refuses a managed run and allows an agent (1.070927ms)
+✔ neither CLI's nonce proves the other: each proof is bound to its own CLI and nonce variable (0.375415ms)
+✔ testerNonce reads only the tester's variable and gives null on any read error (0.22245ms)
+✔ an envelope carries exactly one of cap, human and tester; no tester authenticator refuses (55.486653ms)
+✔ tester-cli.mjs binds through the runtime when the switch is on, and refuses off or under a run marker (735.722819ms)
+✔ socket capability stamps launch identity; shared views use wire, no SQL client (184.088078ms)
+✔ two wire claims serialize; a lost reply never automatically retries (210.401694ms)
+✔ malformed, oversized and identity-forging envelopes refuse without echoing input (101.849831ms)
+✔ client preserves UTF-8 when a response divides a multibyte character (12.13097ms)
+✔ committed mutation followed by dropped reply reports unknown and is never retried (155.995523ms)
+ℹ tests 155
+ℹ suites 0
+ℹ pass 154
+ℹ fail 1
+ℹ cancelled 0
+ℹ skipped 0
+ℹ todo 0
+ℹ duration_ms 4490.314489
+
+✖ failing tests:
+
+test at tests/decision-close.test.mjs:108:1
+✖ the raising run's withdraw, a supersede, a within-role raise and seen send nothing (331.104691ms)
+  AssertionError [ERR_ASSERTION]: Expected values to be strictly deep-equal:
+  + actual - expected
+  
+  + [
+  +   [Object: null prototype] {
+  +     at: '2026-10-14T16:38:10.931Z',
+  +     body: 'Decision dff06e4d-939b-4a29-8334-37cd410fbcfa on task.scope.change was withdrawn by coder-run.\n' +
+  +       'Note: not needed',
+  +     business: 'demo',
+  +     class: 'DECISION',
+  +     corrects: null,
+  +     decision: 'dff06e4d-939b-4a29-8334-37cd410fbcfa',
+  +     from_role: 'coder',
+  +     from_run: 'coder-run',
+  +     id: 'df5eb492-101b-44c7-8b99-9833ddfffb52',
+  +     in_reply_to: null,
+  +     seq: 1,
+  +     to_role: 'coder'
+  +   }
+  + ]
+  - []
+  
+      at TestContext.<anonymous> (file:///home/jwoltje/darkwing-scratch/r115/wt/packages/bus/tests/decision-close.test.mjs:119:10)
+      at Test.runInAsyncScope (node:async_hooks:226:14)
+      at Test.run (node:internal/test_runner/test:1402:25)
+      at Test.processPendingSubtests (node:internal/test_runner/test:974:18)
+      at Test.postRun (node:internal/test_runner/test:1542:19)
+      at Test.run (node:internal/test_runner/test:1467:12)
+      at async Test.processPendingSubtests (node:internal/test_runner/test:974:7) {
+    generatedMessage: true,
+    code: 'ERR_ASSERTION',
+    actual: [ { seq: 1, id: 'df5eb492-101b-44c7-8b99-9833ddfffb52', at: '2026-10-14T16:38:10.931Z', business: 'demo', from_role: 'coder', from_run: 'coder-run', to_role: 'coder', class: 'DECISION', in_reply_to: null, decision: 'dff06e4d-939b-4a29-8334-37cd410fbcfa', corrects: null, body: 'Decision dff06e4d-939b-4a29-8334-37cd410fbcfa on task.scope.change was withdrawn by coder-run.\nNote: not needed' } ],
+    expected: [],
+    operator: 'deepStrictEqual',
+    diff: 'simple'
+  }