Row 266: add Console room timeline and member completion

BUILD-LOG.md

@@ -5554,3 +5554,7 @@ claim. Receipts and limitations in agents/lena/work/queue-296/BUILD.md and run-r
 2026-10-24T15:55:22Z | Sage | Row 225 (#1726, C2-10b, Fethry on Codex, Dewey) LANDED 9b6345466. Before: refactor at c63801959. After: Fethry's r2 candidate c1f9dfd3c (11 commits on 963303403) cherry-picked onto c63801959. 8 commits are equal by range-diff; the other 3 differ only in the append-only log hunks, kept both sides with 0 lines removed against either parent. All 13 manifest paths match manifest.r2.sha256 (517af41b). Dewey APPROVE c31599 rev 3960; request c31600 revs 3961-3962, posted by Sage because Fethry has no token. Sage gate GREEN 15:54:58Z with its own npm ci and MOSAIC_REQUIRE_EDITOR_BUILD=1: every package suite except queue 0 fail (webui 442, library 149, bus 981, cli 988 plus the allow-listed FED R7 skip, whose runner passed 1/1), all 12 scripts rc 0. The excluded M3 timeout attempt was not counted; the unchanged retry killed cleanly. Dewey N1-N3 non-blocking: the Discord relay must pass check once it calls renderReply; the M3 hang was in the new status test's after-hook teardown; the pre-217 residual stands under sage-3669. #1726 closed c31604. Not re-pinned.
 
 2026-10-24T16:12:35Z | Sage | Row 287 (#1792, C2-21, Steelbeak on Codex, Boyd and Dewey) LANDED 0e935776e. Before: refactor at 9b6345466. After: Steelbeak's c2338ed58 and doc follow-up a5370b198 cherry-picked onto 9b6345466. One commit equal by range-diff, the other differs only in log hunks, kept both sides. 56 manifest paths match 3683b40a. Boyd APPROVE c31602 rev 3967, Dewey APPROVE c31603 rev 3968; request c31601 revs 3965-3966 posted by Sage. Sage gate GREEN 16:11:38Z: bus 998 (Gitea Docker F-A/F-B and X-G3, minted 4, hits 0), business 283, webui 442, cli 989 plus the allowed FED R7 skip, every other suite 0 fail, all 12 scripts rc 0; fixture credential values in 0 of 29 run files with a positive control. Rulings applied: sage-4125 (library grants mint declared scopes, chief read), mos-1590 (new-test fixture fixes are the lead's call when no production code or old test changes and every fail-closed refusal keeps its own test), sage-4139 (fixture fixes) and sage-4141 (test-land-work.sh is mode 100644, run via bash). Follow-up: F-C negative, a protected Story/** rule refuses the owner too; binds the first row that needs owner pushes to a protected branch. Dewey N1-N3 non-blocking: the block's last line "can write every repository this user can write" contradicts the chief's read grant; a collaborator entry outlives a failed step 5, which still fails closed; #publishFacts would accept a library project, unreachable today. Closes Dewey's 286 r2 N2 (T7/T9 real mint). #1792 closed c31606. Not re-pinned.
+
+2026-10-24 | Fethry | Row266 C2-10c start (#1771), sage4154/4156. Before: Console seam/plugin only expose thread verbs; room.read omits check/last needed by225. New isolated worktree on487500a16, amended pin85e6fe2ecfc5. Plan: three fixed room calls, strict room HTTP, merged room UI and leading-@ completion, shared broker check hydration/last only under amendment1. No old tests or out-of-scope production edits; local installs/no canonical links; RED-first and serialized full webui/plugins/bus/scripts plus mutants under CLEAR. Detailed design/acceptance in agent BUILD.md.
+
+2026-10-24 | Fethry | Row266 implementation verified before candidate commit. Six owned production paths plus four new tests, no old tests edited. RED history and fixture corrections recorded before action. Editor build, webui458/0, plugins120/0, bus1000/0 and all12 scripts exit0. Initial bus999/1 hit old T9 50ms timer race; sage4158 authorized three unchanged credential-file6/0 reruns and whole bus1000/0 rerun, all green. Raw/normalized TAP provenance retained. Candidate/mutants/review next; no landing claim.

agents/fethry/work/queue-266/BUILD.md

@@ -0,0 +1,114 @@
+# Row266 C2-10c — Console rooms (#1771)
+
+Fethry14f80e3c, branch fethry/row266, NEW worktree /home/jwoltje/.t3/worktrees/mosaic-stack/fethry-row266.
+Original base962046aaa; fast-forwarded to doc-only487500a16 per sage4156. Both225 branches untouched.
+Pinned amended brief85e6fe2ecfc5, C2-10c; prior3a5ed91a had identical section but stale whole-file pin.
+Review order Boyd48a3ae38 then Dewey84fb346c; Sage owns landing. No token/other-seat credential access.
+Slot CLEAR sage4154 lasts until returned. Local root/webui npm ci, no dependency links.
+TMPDIR=/mnt/storage/scratch/tmp/KV9rHb, MOSAIC_REQUIRE_EDITOR_BUILD=1. Implementation and targeted checks complete; full gate in progress.
+
+## Current code and resolved seam
+
+- chat.mjs is the channel-gated fixed-verb seam. Add roomOpen({project}), roomRead({project,after,limit}),
+  roomSend({project,body}), exactly one matching room verb each. Never fetch thread.messages to hydrate rooms.
+- chat-http.mjs already provides signed-in/send/Origin/Fetch Metadata, bounded JSON, strict keys, safe
+  error text, audit and outcome-unknown handling. Extend it with POST rooms/PROJECT/open {},
+  GET rooms/PROJECT/messages ?after&limit, POST same messages {body}. Four room codes map409 and fixed lines.
+  Open returns {project,threads}; send returns {ids,to}; read returns {rows,after,hasMore,at}.
+  Room cursor is the LAST id in the final entry.ids, not the first entry.id; the broker groups human sends.
+- webui plugin needs exactly room.open/read/send in its allowlist, still rejecting arbitrary verbs.
+- /api/chat/instances already returns threaded instance keys and persona.name labels. No serve.mjs edit.
+- room.open returns canonical member threads; room.read returns one merged human entry with ids/to.
+  Read-only GET must never open/create a room or wake an agent. No implicit retry of any write.
+- Amendment1 (sage4156): broker.mjs is owned only for shared check-event hydration and routing room.read
+  through #withLast under the same condition as thread.messages. The missing check would otherwise
+  hide badges AND reopen225's forged-notice defect. No other broker verb/refusal/field changes.
+
+## Design and implementation plan
+
+1. New plugin, HTTP/seam, bus metadata and browser files first; run whole new files RED, report
+   first-run results per mos1272/1590, correct only demonstrably wrong NEW fixtures. No old test edits.
+2. Add the three plugin/seam calls and strict HTTP room routes/receipt validation. Reuse existing
+   principal/write fences. Owner room verbs stay human-only; hide controls from granted users/testers,
+   and never route a call through an owner transport for them.
+3. In broker, extract #withCheck(row), call it for thread messages and each final merged room entry;
+   extend the existing last-routing condition to room.read. Test real checked reply parity, unchecked
+   absence and unchanged merged human entry across two members. No broker room.open/send changes.
+4. Add /chat/rooms/PROJECT route inside chat.js, sharing its current state, generation/abort handling,
+   capture/paint/scroll preservation and225 message renderer. Project view gets explicit Open room;
+   direct room GET only reads and offers Open on room-not-open. Names come from instances catalog,
+   membership from canonical room threads, with server room.read authoritative. Quiet members stay
+   available for completion. Human entries display once, with all broker addressees; no client regrouping.
+5. Completion parses leading @ tokens with the exact broker grammar and its existing case vectors.
+   Display typed tags in a preview; use that production tag reader for completion and browser parity.
+   Suggest members by instance/name, insert the stable instance token, preserve unrelated text/caret.
+   Arrow keys/Enter/Tab/Escape and click work; labels/text remain escaped and bidi/control inert.
+   Browser sends original typed body, never a client-selected addressee list. Broker409 lines are fixed.
+6. Whole webui/plugins/bus (touched) suites, all12 scripts/test-*.sh under timeout -k10, then isolated
+   mutants. No live-provider calls (MOSAIC_LIVE_PROVIDER unset). New worker/temp process groups get
+   killpg cleanup and cwd/Chromium sweep; never touch another seat's processes. Record every red.
+7. Hash-pin audit by source path AND old64-hex digest for chat.js/chat-http.mjs/channel module before
+   in-review. Freeze manifest, push fethry/* only, owner queue move in-review, handoff Boyd+Sage with
+   candidate/digest; Sage posts because this seat has no Gitea token. No force push, merge or deploy.
+
+Acceptance focus: grouped paging cursor, one entry for a broadcast even across two threads, quiet
+member completion and parser parity, checked reply badges/notice safety, malformed receipts/unknown
+outcomes,4 refusal codes, no read-side mutation, late reads/sign-out and project draft isolation.
+
+Boundary rules: old-test red, any production path beyond the owned set/amendment, or weakened
+assertion goes to Sage BEFORE action. New-file first red is reported then fixture corrected.
+
+## Targeted RED/GREEN receipts (2026-10-24)
+
+Start op fethry-266-start succeeded rev3978 after sage4156's re-pin; old-pin refusal wrote nothing.
+First whole NEW files RED: plugin0/1,HTTP0/5,bus1/1,browser0/7, all intended missing-feature paths;
+reported fethry0028 before production. Component GREEN plugin1/0,HTTP5/0,bus2/0. Browser5/2 exposed a
+missing submit branch in our new room event dispatcher; reported fethry0029, fixed only that branch,
+then browser7/0. No fixture/assertion changed to fix production behavior.
+
+Boundary coverage added before full gate: malformed numeric member key was accepted by regex
+coercion (new HTTP6/1, fethry0030); required string and unique group ids/addressees, now HTTP7/0.
+New browser assertions use fresh send ids and read back exactly one broadcast entry. Expanded run8/1
+exposed a nested quote in our new runtime CSS selector; reported fethry0031 BEFORE fixing fixture
+with JSON.stringify, same exact count=1 assertion retained. Final browser9/0,4864.326ms, with quiet
+member Arrow/Tab/Escape, raw body preservation, no duplicate pending send, uncertain draft, parser
+vectors, all4 refusal lines, checked reply/cite/notice safety and late-read/sign-out coverage.
+No pre-existing test/helper edit and no assertion loosened. Production set is precisely six brief-
+owned paths including the narrow broker amendment. All red/green raw logs under unique TMPDIR.
+
+Full gate now runs run-gate.py: local editor build, whole webui/plugins/bus then all12 test scripts,
+serial timeout -k10, per-test30s, MOSAIC_REQUIRE_EDITOR_BUILD=1; live-provider env removed. Each step
+has its own process group and killpg cleanup, with signals recorded. Any failure stops for report.
+
+## Full gate first pass
+
+Editor build exit0; whole webui458/0 (270.066s), plugins120/0 (.866s), no skips/cancels.
+Bus999/1 (132.9s): OLD library-credential.test.mjs T9 at317 expected library-fetch-no-grant,
+received library-sync-busy. Reported fethry0032 before changes. No old test/source change.
+Read-only diagnosis: fixture starts a50ms periodic sync; waiting for a completed log does not
+prevent the next tick from acquiring running(mirror) before the manual sync. Existing sync.mjs140
+checks running before credential refusal. Row266 touches neither timer nor sync implementation.
+All12 scripts continue independently; rerun/ruling requested from Sage. Raw bus-full.tap and
+gate-summary.json remain in the scratch directory, preserving the red evidence.
+
+Sage4158 confirms the pre-existing50ms T9 timer race and authorizes three unchanged whole-file
+credential runs followed by one unchanged whole bus run. Any recurring T9 red stops for Sage;
+no fixture or production patch is authorized. The12-script runner proceeds serially first.
+
+All12 scripts/test-*.sh exited0 (scripts-summary.json). Queue's156 tests pass; wrapper28/0
+and explicitly skips canonical queue verify/render checks in an isolated worktree. Task92/0
+uses existing row244 live-provider exclusions, with MOSAIC_LIVE_PROVIDER unset. No script edited.
+Three unchanged whole credential-file reruns under sage4158 each pass6/0 without skips/cancels,
+1.367s each wall clock. Full unchanged bus rerun is next/running.
+
+Pin audit before in-review: source paths/basenames and old/current64hex values for chat.js,
+chat-http.mjs and channel/webui/index.mjs searched across package/script tests. No literal old
+or current digest pin. The10 frozen package hashes include all six production paths and four
+new test files; no existing test diff. sha256sum -c passes on all10.
+
+Unchanged full bus rerun GREEN1000/0, no skips/cancels,142.919s. T9 passes. This completes
+sage4158's four unchanged green reruns (credential6/0 three times, bus1000/0 once) after the
+initial999/1. Preserve all five TAPs. Pre-existing T9 timer race is Sage's follow-up, no source
+or old test changed for it. Full applicable suites and12 scripts are green; mutants next.
+Evidence display copies strip trailing whitespace only; raw-log-provenance.json records original
+paths and both digests. All10 package hashes remain unchanged from full-suite verification.

agents/fethry/work/queue-266/MANIFEST.md

@@ -0,0 +1,32 @@
+# Row266 review packet — Console rooms (#1771)
+
+Owner Fethry14f80e3c; first reviewer Boyd48a3ae38, second Dewey84fb346c.
+Base487500a16, pinned amended brief85e6fe2ecfc5. Sage owns gate and landing.
+
+The owner Console has an explicit Open room action and a merged project timeline. Human broadcasts
+show once with the broker's addressees; agent rows use the shared225 reply renderer including stored
+check metadata, badges, changed-file labels and safe notices. Completion suggests quiet and active room
+members and follows the broker's leading-tag grammar. The original body goes to room.send.
+
+The seam has exactly three room calls, and no thread.messages fanout. Four room refusals map to409
+with fixed lines. Read-only routes never open rooms. Writes retain existing authority/Origin fences,
+strict arguments, receipt validation, draft preservation and no automatic retry after uncertainty.
+
+manifest.r1.sha256 freezes exactly10 package paths: six production files and four NEW test files.
+No pre-existing test is edited. Check with sha256sum -c from the repository root. The only brief
+amendment is sage4156's narrow broker helper/check/last hydration for room.read; room.open/send and
+other broker fields/refusals remain unchanged. Other changes are append-only session/build records
+and this tracking packet. No queue JSON, role, policy, secret or generated editor asset changes.
+
+Evidence and RED/GREEN history are in BUILD.md. Full suites and scripts are green; isolated mutants are next. The initial
+full bus999/1 is the pre-existing T9 timer race, reported before action; unchanged reruns authorized
+by sage4158 all pass: credential6/0 three times, bus1000/0 once. Webui458/0, plugins120/0,
+all12 scripts exit0. Queue wrapper skips canonical-only verify/render, and task retains the
+row244 live-provider exclusions. No test-runner skips/cancellations in package suites. Review must consider every run, including the red.
+
+Pin audit: pin-audit-before.txt and pin-audit-after.txt search source paths/basenames and64-hex old
+and new digests across tests. No literal digest pin needs updating for any of the three named files.
+
+Review focus: grouped paging cursor, no body-based client regrouping, quiet membership/completion,
+raw body preservation, checked/unchecked renderer trust, grant/tester refusal, pending/uncertain writes,
+late reads/sign-out and strictly scoped broker hydration.

agents/fethry/work/queue-266/evidence/editor-build.tap

@@ -0,0 +1,16 @@
+npm notice run @mosaic/[email protected] build:editor
+npm notice run node editor/build.mjs
+▲ [WARNING] Ignoring this import because "third_party/editor/prosemirror-transform/src/mark.ts" was marked as having no side effects [ignored-bare-import]
+
+    third_party/editor/prosemirror-transform/src/index.ts:10:7:
+      10 │ import "./mark"
+         ╵        ~~~~~~~~
+
+  "sideEffects" is false in the enclosing "package.json" file:
+
+    third_party/editor/prosemirror-transform/package.json:13:2:
+      13 │   "sideEffects": false,
+         ╵   ~~~~~~~~~~~~~
+
+editor.js 9c881b13740fae2408717ad75fa1d85bfcfe3fa8b3af0f1b3f2e706c90e80fee (133 inputs)
+editor.css 8654ac57d1e7a561110138ecd7f701c34a074017ff8c4cd2768d8083908ee61f

agents/fethry/work/queue-266/evidence/gate-summary.json

@@ -0,0 +1,63 @@
+[
+  {
+    "step": "editor-build",
+    "command": [
+      "npm",
+      "run",
+      "build:editor"
+    ],
+    "cwd": "/home/jwoltje/.t3/worktrees/mosaic-stack/fethry-row266/packages/webui",
+    "outerSeconds": 120,
+    "exit": 0,
+    "seconds": 0.214,
+    "cleanupSignals": []
+  },
+  {
+    "step": "webui-full",
+    "command": [
+      "node",
+      "--test",
+      "--test-reporter=tap",
+      "--test-concurrency=1",
+      "--test-timeout=30000",
+      "packages/webui/tests/"
+    ],
+    "cwd": "/home/jwoltje/.t3/worktrees/mosaic-stack/fethry-row266",
+    "outerSeconds": 900,
+    "exit": 0,
+    "seconds": 270.066,
+    "cleanupSignals": []
+  },
+  {
+    "step": "plugins-full",
+    "command": [
+      "node",
+      "--test",
+      "--test-reporter=tap",
+      "--test-concurrency=1",
+      "--test-timeout=30000",
+      "packages/plugins/tests/"
+    ],
+    "cwd": "/home/jwoltje/.t3/worktrees/mosaic-stack/fethry-row266",
+    "outerSeconds": 300,
+    "exit": 0,
+    "seconds": 0.866,
+    "cleanupSignals": []
+  },
+  {
+    "step": "bus-full",
+    "command": [
+      "node",
+      "--test",
+      "--test-reporter=tap",
+      "--test-concurrency=1",
+      "--test-timeout=30000",
+      "packages/bus/tests/"
+    ],
+    "cwd": "/home/jwoltje/.t3/worktrees/mosaic-stack/fethry-row266",
+    "outerSeconds": 1200,
+    "exit": 1,
+    "seconds": 132.9,
+    "cleanupSignals": []
+  }
+]

agents/fethry/work/queue-266/evidence/plugin-green.tap

@@ -0,0 +1,16 @@
+TAP version 13
+# Subtest: C2-10c webui permits exactly the three added room verbs and preserves core refusals
+ok 1 - C2-10c webui permits exactly the three added room verbs and preserves core refusals
+  ---
+  duration_ms: 1.543022
+  type: 'test'
+  ...
+1..1
+# tests 1
+# suites 0
+# pass 1
+# fail 0
+# cancelled 0
+# skipped 0
+# todo 0
+# duration_ms 45.19296

agents/fethry/work/queue-266/evidence/plugin-red.tap

@@ -0,0 +1,28 @@
+TAP version 13
+# Subtest: C2-10c webui permits exactly the three added room verbs and preserves core refusals
+not ok 1 - C2-10c webui permits exactly the three added room verbs and preserves core refusals
+  ---
+  duration_ms: 0.69237
+  type: 'test'
+  location: '/home/jwoltje/.t3/worktrees/mosaic-stack/fethry-row266/packages/plugins/tests/room-channel.test.mjs:5:1'
+  failureType: 'testCodeFailure'
+  error: 'unsupported channel operation'
+  code: 'channel-operation'
+  name: 'PluginError'
+  stack: |-
+    dispatch (file:///home/jwoltje/.t3/worktrees/mosaic-stack/fethry-row266/packages/plugins/channel/webui/index.mjs:23:31)
+    TestContext.<anonymous> (file:///home/jwoltje/.t3/worktrees/mosaic-stack/fethry-row266/packages/plugins/tests/room-channel.test.mjs:8:28)
+    Test.runInAsyncScope (node:async_hooks:226:14)
+    Test.run (node:internal/test_runner/test:1402:25)
+    Test.start (node:internal/test_runner/test:1262:17)
+    startSubtestAfterBootstrap (node:internal/test_runner/harness:387:17)
+  ...
+1..1
+# tests 1
+# suites 0
+# pass 0
+# fail 1
+# cancelled 0
+# skipped 0
+# todo 0
+# duration_ms 46.133256

agents/fethry/work/queue-266/evidence/plugins-full.tap

@@ -0,0 +1,730 @@
+TAP version 13
+# Subtest: channel registry requires dispatch at interface 1 and switches a list
+ok 1 - channel registry requires dispatch at interface 1 and switches a list
+  ---
+  duration_ms: 1.093033
+  type: 'test'
+  ...
+# Subtest: channel shipped modules load and preserve every supported operation and bus refusal
+ok 2 - channel shipped modules load and preserve every supported operation and bus refusal
+  ---
+  duration_ms: 2.329081
+  type: 'test'
+  ...
+# Subtest: channel snapshot is a frozen matched pair and a captured array survives reload
+ok 3 - channel snapshot is a frozen matched pair and a captured array survives reload
+  ---
+  duration_ms: 3.672804
+  type: 'test'
+  ...
+# Subtest: channel guards refuse bad names, missing paths, exports and versions while retaining last good
+ok 4 - channel guards refuse bad names, missing paths, exports and versions while retaining last good
+  ---
+  duration_ms: 3.25585
+  type: 'test'
+  ...
+# Subtest: channel guards refuse symlinked module, index and kind directories
+ok 5 - channel guards refuse symlinked module, index and kind directories
+  ---
+  duration_ms: 2.246923
+  type: 'test'
+  ...
+# Subtest: channel caller re-reads settings and keeps off switches independent by module name
+ok 6 - channel caller re-reads settings and keeps off switches independent by module name
+  ---
+  duration_ms: 1.351401
+  type: 'test'
+  ...
+# Subtest: channel caller malformed settings refuse without a chat operation and no unrelated kind loads
+ok 7 - channel caller malformed settings refuse without a chat operation and no unrelated kind loads
+  ---
+  duration_ms: 0.435438
+  type: 'test'
+  ...
+# Subtest: channel caller uses last good after loader refusal and fails closed on first load
+ok 8 - channel caller uses last good after loader refusal and fails closed on first load
+  ---
+  duration_ms: 0.580004
+  type: 'test'
+  ...
+# Subtest: channel dispatch holds no selection lock while a slow send is awaiting
+ok 9 - channel dispatch holds no selection lock while a slow send is awaiting
+  ---
+  duration_ms: 0.491762
+  type: 'test'
+  ...
+# Subtest: channel last realpath check refuses an index swapped after component checks
+ok 10 - channel last realpath check refuses an index swapped after component checks
+  ---
+  duration_ms: 2.241815
+  type: 'test'
+  ...
+# Subtest: channel caller refuses invalid core construction
+ok 11 - channel caller refuses invalid core construction
+  ---
+  duration_ms: 0.150251
+  type: 'test'
+  ...
+# Subtest: channel caller invokes the selected loaded module instead of bypassing dispatch
+ok 12 - channel caller invokes the selected loaded module instead of bypassing dispatch
+  ---
+  duration_ms: 2.065095
+  type: 'test'
+  ...
+# Subtest: channel caller keeps the selected module operation filter in front of the core transport
+ok 13 - channel caller keeps the selected module operation filter in front of the core transport
+  ---
+  duration_ms: 0.241841
+  type: 'test'
+  ...
+# Subtest: REQ-LIMIT-2 daily-quota exports interface version 2 with mayLaunch, mustStop and report
+ok 14 - REQ-LIMIT-2 daily-quota exports interface version 2 with mayLaunch, mustStop and report
+  ---
+  duration_ms: 4.156727
+  type: 'test'
+  ...
+# Subtest: REQ-LIMIT-2 the count sums every kind of the account's known records since the later of the day start and since
+ok 15 - REQ-LIMIT-2 the count sums every kind of the account's known records since the later of the day start and since
+  ---
+  duration_ms: 12.582509
+  type: 'test'
+  ...
+# Subtest: REQ-LIMIT-2 a launch with no account (pi) is covered by no daily quota
+ok 16 - REQ-LIMIT-2 a launch with no account (pi) is covered by no daily quota
+  ---
+  duration_ms: 0.329543
+  type: 'test'
+  ...
+# Subtest: REQ-LIMIT-4 an unknown turn adds nothing and is counted apart
+ok 17 - REQ-LIMIT-4 an unknown turn adds nothing and is counted apart
+  ---
+  duration_ms: 0.442314
+  type: 'test'
+  ...
+# Subtest: REQ-LIMIT-2 the day turns at the reset in its zone, not in UTC, and before it the day is yesterday's
+ok 18 - REQ-LIMIT-2 the day turns at the reset in its zone, not in UTC, and before it the day is yesterday's
+  ---
+  duration_ms: 0.682365
+  type: 'test'
+  ...
+# Subtest: REQ-LIMIT-2 the spring DST change makes the day after a 00:00 reset 23 hours long
+ok 19 - REQ-LIMIT-2 the spring DST change makes the day after a 00:00 reset 23 hours long
+  ---
+  duration_ms: 0.387921
+  type: 'test'
+  ...
+# Subtest: REQ-LIMIT-2 the fall DST change makes the day after a 00:00 reset 25 hours long
+ok 20 - REQ-LIMIT-2 the fall DST change makes the day after a 00:00 reset 25 hours long
+  ---
+  duration_ms: 0.330814
+  type: 'test'
+  ...
+# Subtest: REQ-LIMIT-2 a reset the clocks skip starts the day at the first instant after the gap
+ok 21 - REQ-LIMIT-2 a reset the clocks skip starts the day at the first instant after the gap
+  ---
+  duration_ms: 1.372326
+  type: 'test'
+  ...
+# Subtest: REQ-LIMIT-2 a reset the clocks repeat starts one day, at the first one
+ok 22 - REQ-LIMIT-2 a reset the clocks repeat starts one day, at the first one
+  ---
+  duration_ms: 0.4571
+  type: 'test'
+  ...
+# Subtest: REQ-LIMIT-2 a launch is refused at the quota, a turn that reaches it stops, and the next day allows again
+ok 23 - REQ-LIMIT-2 a launch is refused at the quota, a turn that reaches it stops, and the next day allows again
+  ---
+  duration_ms: 1.027459
+  type: 'test'
+  ...
+# Subtest: REQ-LIMIT-2 counts past the safe integer range come back as digit strings
+ok 24 - REQ-LIMIT-2 counts past the safe integer range come back as digit strings
+  ---
+  duration_ms: 0.350076
+  type: 'test'
+  ...
+# Subtest: REQ-LIMIT-4 bad leaves, records or times throw a code, and the check reads nothing but its arguments
+ok 25 - REQ-LIMIT-4 bad leaves, records or times throw a code, and the check reads nothing but its arguments
+  ---
+  duration_ms: 2.155059
+  type: 'test'
+  ...
+# Subtest: REQ-LIMIT-2 no daily quotas: every launch is allowed and the report is empty
+ok 26 - REQ-LIMIT-2 no daily quotas: every launch is allowed and the report is empty
+  ---
+  duration_ms: 0.190579
+  type: 'test'
+  ...
+# Subtest: row 307 pi answers what row 270 read: plain
+ok 27 - row 307 pi answers what row 270 read: plain
+  ---
+  duration_ms: 2.273277
+  type: 'test'
+  ...
+# Subtest: row 307 pi answers what row 270 read: budget
+ok 28 - row 307 pi answers what row 270 read: budget
+  ---
+  duration_ms: 0.560346
+  type: 'test'
+  ...
+# Subtest: row 307 pi answers what row 270 read: cap
+ok 29 - row 307 pi answers what row 270 read: cap
+  ---
+  duration_ms: 0.447806
+  type: 'test'
+  ...
+# Subtest: row 307 pi answers what row 270 read: shrank
+ok 30 - row 307 pi answers what row 270 read: shrank
+  ---
+  duration_ms: 0.41824
+  type: 'test'
+  ...
+# Subtest: row 307 pi answers what row 270 read: header
+ok 31 - row 307 pi answers what row 270 read: header
+  ---
+  duration_ms: 0.525662
+  type: 'test'
+  ...
+# Subtest: row 307 pi's first collection over Claude history answers harness-unsupported without a scan, and a later one scans
+ok 32 - row 307 pi's first collection over Claude history answers harness-unsupported without a scan, and a later one scans
+  ---
+  duration_ms: 0.854402
+  type: 'test'
+  ...
+# Subtest: row 307 claude-code reads nothing and answers harness-unsupported with no version
+ok 33 - row 307 claude-code reads nothing and answers harness-unsupported with no version
+  ---
+  duration_ms: 0.145488
+  type: 'test'
+  ...
+# Subtest: row 307 a harness module without compactions doesn't load: missing-export
+ok 34 - row 307 a harness module without compactions doesn't load: missing-export
+  ---
+  duration_ms: 2.544641
+  type: 'test'
+  ...
+# Subtest: row 65 both harness modules load through the loader with every export the kind names
+ok 35 - row 65 both harness modules load through the loader with every export the kind names
+  ---
+  duration_ms: 7.887813
+  type: 'test'
+  ...
+# Subtest: row 65 each module answers for its own harness: adapter, levels, account, web, turn end and session files
+ok 36 - row 65 each module answers for its own harness: adapter, levels, account, web, turn end and session files
+  ---
+  duration_ms: 0.743006
+  type: 'test'
+  ...
+# Subtest: row 65 claude-code preflight: a missing credential, then a missing or relative binary, each refuse with their code
+ok 37 - row 65 claude-code preflight: a missing credential, then a missing or relative binary, each refuse with their code
+  ---
+  duration_ms: 3.607123
+  type: 'test'
+  ...
+# Subtest: row 65 claude-code version asks MOSAIC_CLAUDE_BIN when set, else claude on PATH, else null
+ok 38 - row 65 claude-code version asks MOSAIC_CLAUDE_BIN when set, else claude on PATH, else null
+  ---
+  duration_ms: 3.846673
+  type: 'test'
+  ...
+# Subtest: row 65 pi preflight passes with the repository's pi, and its version is the package pin
+ok 39 - row 65 pi preflight passes with the repository's pi, and its version is the package pin
+  ---
+  duration_ms: 8.397292
+  type: 'test'
+  ...
+# Subtest: row 65 env passes the thinking level to both adapters, and claude-code's bundle writes its hook and MCP files
+ok 40 - row 65 env passes the thinking level to both adapters, and claude-code's bundle writes its hook and MCP files
+  ---
+  duration_ms: 1.435832
+  type: 'test'
+  ...
+# Subtest: row 65 a route's thinking reaches pi as --thinking and claude as --effort, through each module's env and adapter
+ok 41 - row 65 a route's thinking reaches pi as --thinking and claude as --effort, through each module's env and adapter
+  ---
+  duration_ms: 15.483026
+  type: 'test'
+  ...
+# Subtest: row 65 no core source outside packages/plugins names a harness, apart from the listed exceptions
+ok 42 - row 65 no core source outside packages/plugins names a harness, apart from the listed exceptions
+  ---
+  duration_ms: 14.005572
+  type: 'test'
+  ...
+# Subtest: row 65 the grep's pattern catches a quoted name and a regex alternation, and not a word in prose
+ok 43 - row 65 the grep's pattern catches a quoted name and a regex alternation, and not a word in prose
+  ---
+  duration_ms: 0.162322
+  type: 'test'
+  ...
+# Subtest: REQ-PLUG-1 REQ-LIMIT-4 the registry: usage-source at interface version 1, limit-check at 2 (row 125), each a list
+ok 44 - REQ-PLUG-1 REQ-LIMIT-4 the registry: usage-source at interface version 1, limit-check at 2 (row 125), each a list
+  ---
+  duration_ms: 1.063022
+  type: 'test'
+  ...
+# Subtest: REQ-PLUG-1 checkPlugins accepts one key per kind, each a list of names, empty included
+ok 45 - REQ-PLUG-1 checkPlugins accepts one key per kind, each a list of names, empty included
+  ---
+  duration_ms: 0.24919
+  type: 'test'
+  ...
+# Subtest: REQ-PLUG-1 checkPlugins refuses bad shapes, unknown kinds, bad names and duplicates
+ok 46 - REQ-PLUG-1 checkPlugins refuses bad shapes, unknown kinds, bad names and duplicates
+  ---
+  duration_ms: 0.939348
+  type: 'test'
+  ...
+# Subtest: REQ-PLUG-1 a kind that switches on one module takes one name, not a list
+ok 47 - REQ-PLUG-1 a kind that switches on one module takes one name, not a list
+  ---
+  duration_ms: 0.155413
+  type: 'test'
+  ...
+# Subtest: REQ-PLUG-1 checkPlugins reports through the caller's fail callback
+ok 48 - REQ-PLUG-1 checkPlugins reports through the caller's fail callback
+  ---
+  duration_ms: 0.16264
+  type: 'test'
+  ...
+# Subtest: REQ-PLUG-1 fixture modules of each kind switch on from a test organization file, no core file changed
+ok 49 - REQ-PLUG-1 fixture modules of each kind switch on from a test organization file, no core file changed
+  ---
+  duration_ms: 9.287009
+  type: 'test'
+  ...
+# Subtest: REQ-PLUG-1 a name not matching ^[a-z][a-z0-9-]*$ refuses and keeps the old setting
+ok 50 - REQ-PLUG-1 a name not matching ^[a-z][a-z0-9-]*$ refuses and keeps the old setting
+  ---
+  duration_ms: 3.680508
+  type: 'test'
+  ...
+# Subtest: REQ-PLUG-1 a missing module directory or index.mjs refuses and keeps the old setting
+ok 51 - REQ-PLUG-1 a missing module directory or index.mjs refuses and keeps the old setting
+  ---
+  duration_ms: 3.446331
+  type: 'test'
+  ...
+# Subtest: REQ-PLUG-1 a symlinked module directory or index.mjs refuses and keeps the old setting
+ok 52 - REQ-PLUG-1 a symlinked module directory or index.mjs refuses and keeps the old setting
+  ---
+  duration_ms: 2.671649
+  type: 'test'
+  ...
+# Subtest: REQ-PLUG-1 a symlinked kind directory refuses and keeps the old setting
+ok 53 - REQ-PLUG-1 a symlinked kind directory refuses and keeps the old setting
+  ---
+  duration_ms: 2.37595
+  type: 'test'
+  ...
+# Subtest: REQ-PLUG-1 a symlinked packages/plugins refuses (run with --preserve-symlinks so the path keeps it)
+ok 54 - REQ-PLUG-1 a symlinked packages/plugins refuses (run with --preserve-symlinks so the path keeps it)
+  ---
+  duration_ms: 25.90956
+  type: 'test'
+  ...
+# Subtest: REQ-PLUG-1 index.mjs swapped for a symlink after the lstat checks refuses at the realpath check
+ok 55 - REQ-PLUG-1 index.mjs swapped for a symlink after the lstat checks refuses at the realpath check
+  ---
+  duration_ms: 2.906707
+  type: 'test'
+  ...
+# Subtest: REQ-PLUG-1 a path that can't be read refuses as unreadable, is logged and keeps the old setting
+ok 56 - REQ-PLUG-1 a path that can't be read refuses as unreadable, is logged and keeps the old setting
+  ---
+  duration_ms: 2.796915
+  type: 'test'
+  ...
+# Subtest: REQ-PLUG-1 a path that becomes unreadable after the lstat checks refuses at either realpath
+ok 57 - REQ-PLUG-1 a path that becomes unreadable after the lstat checks refuses at either realpath
+  ---
+  duration_ms: 2.400995
+  type: 'test'
+  ...
+# Subtest: REQ-PLUG-1 a module that fails to load refuses and keeps the old setting
+ok 58 - REQ-PLUG-1 a module that fails to load refuses and keeps the old setting
+  ---
+  duration_ms: 2.69425
+  type: 'test'
+  ...
+# Subtest: REQ-PLUG-1 a missing export refuses and keeps the old setting
+ok 59 - REQ-PLUG-1 a missing export refuses and keeps the old setting
+  ---
+  duration_ms: 3.312634
+  type: 'test'
+  ...
+# Subtest: REQ-PLUG-1 a different interface version refuses and keeps the old setting
+ok 60 - REQ-PLUG-1 a different interface version refuses and keeps the old setting
+  ---
+  duration_ms: 2.951412
+  type: 'test'
+  ...
+# Subtest: REQ-PLUG-1 REQ-LIMIT-3 a version 1 limit check refuses after the bump to 2, and the old setting stays
+ok 61 - REQ-PLUG-1 REQ-LIMIT-3 a version 1 limit check refuses after the bump to 2, and the old setting stays
+  ---
+  duration_ms: 2.585281
+  type: 'test'
+  ...
+# Subtest: REQ-PLUG-1 a kind refused on its first load has nothing switched on, and the log names kind and name
+ok 62 - REQ-PLUG-1 a kind refused on its first load has nothing switched on, and the log names kind and name
+  ---
+  duration_ms: 1.87625
+  type: 'test'
+  ...
+# Subtest: REQ-PLUG-1 the setting's shape: unknown kinds refuse alone, a bad whole setting keeps everything
+ok 63 - REQ-PLUG-1 the setting's shape: unknown kinds refuse alone, a bad whole setting keeps everything
+  ---
+  duration_ms: 2.675823
+  type: 'test'
+  ...
+# Subtest: REQ-PLUG-1 loads run one at a time, so the last requested setting wins
+ok 64 - REQ-PLUG-1 loads run one at a time, so the last requested setting wins
+  ---
+  duration_ms: 102.001355
+  type: 'test'
+  ...
+# Subtest: REQ-PLUG-1 the loader needs a log callback
+ok 65 - REQ-PLUG-1 the loader needs a log callback
+  ---
+  duration_ms: 1.130584
+  type: 'test'
+  ...
+# Subtest: C2-10c webui permits exactly the three added room verbs and preserves core refusals
+ok 66 - C2-10c webui permits exactly the three added room verbs and preserves core refusals
+  ---
+  duration_ms: 1.532674
+  type: 'test'
+  ...
+# Subtest: REQ-PLUG-2 the real tree's searxng-url module switches on as the search-source and answers
+ok 67 - REQ-PLUG-2 the real tree's searxng-url module switches on as the search-source and answers
+  ---
+  duration_ms: 2.616283
+  type: 'test'
+  ...
+# Subtest: REQ-PLUG-2 a SearXNG that refuses JSON (403) is search-down, a bad settings url throws
+ok 68 - REQ-PLUG-2 a SearXNG that refuses JSON (403) is search-down, a bad settings url throws
+  ---
+  duration_ms: 1.153042
+  type: 'test'
+  ...
+# Subtest: REQ-PLUG-2 search-source takes one name, not a list
+ok 69 - REQ-PLUG-2 search-source takes one name, not a list
+  ---
+  duration_ms: 0.232651
+  type: 'test'
+  ...
+# Subtest: REQ-PLUG-2 searxng-bundled queries the fixed loopback address and ignores web.searxng
+ok 70 - REQ-PLUG-2 searxng-bundled queries the fixed loopback address and ignores web.searxng
+  ---
+  duration_ms: 0.766974
+  type: 'test'
+  ...
+# Subtest: REQ-PLUG-2 harness-builtin switches on, serves no broker search, and refuses if called
+ok 71 - REQ-PLUG-2 harness-builtin switches on, serves no broker search, and refuses if called
+  ---
+  duration_ms: 0.633341
+  type: 'test'
+  ...
+# Subtest: the searxng modules end the request when the broker's AbortSignal fires
+ok 72 - the searxng modules end the request when the broker's AbortSignal fires
+  ---
+  duration_ms: 41.975824
+  type: 'test'
+  ...
+# Subtest: hasModule: true for a shipped module, false for a missing one, an unknown kind or a bad name
+ok 73 - hasModule: true for a shipped module, false for a missing one, an unknown kind or a bad name
+  ---
+  duration_ms: 0.572554
+  type: 'test'
+  ...
+# Subtest: REQ-LIMIT-3 token-limit exports interface version 2 with mayLaunch, mustStop and report
+ok 74 - REQ-LIMIT-3 token-limit exports interface version 2 with mayLaunch, mustStop and report
+  ---
+  duration_ms: 4.069294
+  type: 'test'
+  ...
+# Subtest: REQ-LIMIT-3 each subject kind refuses at its limit and allows under it
+ok 75 - REQ-LIMIT-3 each subject kind refuses at its limit and allows under it
+  ---
+  duration_ms: 1.264429
+  type: 'test'
+  ...
+# Subtest: REQ-LIMIT-3 a limit covers only its own subject's records and launches
+ok 76 - REQ-LIMIT-3 a limit covers only its own subject's records and launches
+  ---
+  duration_ms: 0.310153
+  type: 'test'
+  ...
+# Subtest: REQ-LIMIT-4 only known records count; an unknown turn adds nothing and is counted apart
+ok 77 - REQ-LIMIT-4 only known records count; an unknown turn adds nothing and is counted apart
+  ---
+  duration_ms: 0.245871
+  type: 'test'
+  ...
+# Subtest: REQ-LIMIT-3 a reset moves since: records before it no longer count
+ok 78 - REQ-LIMIT-3 a reset moves since: records before it no longer count
+  ---
+  duration_ms: 0.178373
+  type: 'test'
+  ...
+# Subtest: REQ-LIMIT-3 limit 0 refuses with no records; the first limit hit in file order is named
+ok 79 - REQ-LIMIT-3 limit 0 refuses with no records; the first limit hit in file order is named
+  ---
+  duration_ms: 0.159818
+  type: 'test'
+  ...
+# Subtest: REQ-LIMIT-3 a key limit is not enforced while every record's account is null (decision 150 Q1)
+ok 80 - REQ-LIMIT-3 a key limit is not enforced while every record's account is null (decision 150 Q1)
+  ---
+  duration_ms: 0.172512
+  type: 'test'
+  ...
+# Subtest: REQ-LIMIT-3 counts past the safe integer range come back as digit strings
+ok 81 - REQ-LIMIT-3 counts past the safe integer range come back as digit strings
+  ---
+  duration_ms: 0.145224
+  type: 'test'
+  ...
+# Subtest: REQ-LIMIT-4 bad records or times throw a code, and the check reads nothing but its arguments
+ok 82 - REQ-LIMIT-4 bad records or times throw a code, and the check reads nothing but its arguments
+  ---
+  duration_ms: 0.661745
+  type: 'test'
+  ...
+# Subtest: REQ-LIMIT-3 no token limits: every launch is allowed and the report is empty
+ok 83 - REQ-LIMIT-3 no token limits: every launch is allowed and the report is empty
+  ---
+  duration_ms: 0.624533
+  type: 'test'
+  ...
+# Subtest: REQ-LIMIT-3 token-limit ignores tokens.daily, which the daily-quota check enforces (row 126)
+ok 84 - REQ-LIMIT-3 token-limit ignores tokens.daily, which the daily-quota check enforces (row 126)
+  ---
+  duration_ms: 0.133942
+  type: 'test'
+  ...
+# Subtest: REQ-LIMIT-4 pi: reports all token kinds and deduplicates assistant ids
+ok 85 - REQ-LIMIT-4 pi: reports all token kinds and deduplicates assistant ids
+  ---
+  duration_ms: 2.821247
+  type: 'test'
+  ...
+# Subtest: REQ-LIMIT-4 claude-code: reports all token kinds and deduplicates assistant ids
+ok 86 - REQ-LIMIT-4 claude-code: reports all token kinds and deduplicates assistant ids
+  ---
+  duration_ms: 0.696333
+  type: 'test'
+  ...
+# Subtest: REQ-LIMIT-4 pi cut line is unknown, never zero or content
+ok 87 - REQ-LIMIT-4 pi cut line is unknown, never zero or content
+  ---
+  duration_ms: 1.007977
+  type: 'test'
+  ...
+# Subtest: REQ-LIMIT-4 pi invalid UTF-8 is unknown, never zero or content
+ok 88 - REQ-LIMIT-4 pi invalid UTF-8 is unknown, never zero or content
+  ---
+  duration_ms: 0.493409
+  type: 'test'
+  ...
+# Subtest: REQ-LIMIT-4 pi missing input is unknown, never zero or content
+ok 89 - REQ-LIMIT-4 pi missing input is unknown, never zero or content
+  ---
+  duration_ms: 0.57636
+  type: 'test'
+  ...
+# Subtest: REQ-LIMIT-4 pi negative count is unknown, never zero or content
+ok 90 - REQ-LIMIT-4 pi negative count is unknown, never zero or content
+  ---
+  duration_ms: 0.49758
+  type: 'test'
+  ...
+# Subtest: REQ-LIMIT-4 pi fractional count is unknown, never zero or content
+ok 91 - REQ-LIMIT-4 pi fractional count is unknown, never zero or content
+  ---
+  duration_ms: 0.422118
+  type: 'test'
+  ...
+# Subtest: REQ-LIMIT-4 pi unsafe integer is unknown, never zero or content
+ok 92 - REQ-LIMIT-4 pi unsafe integer is unknown, never zero or content
+  ---
+  duration_ms: 0.397082
+  type: 'test'
+  ...
+# Subtest: REQ-LIMIT-4 pi file size is unknown, never zero or content
+ok 93 - REQ-LIMIT-4 pi file size is unknown, never zero or content
+  ---
+  duration_ms: 6.459547
+  type: 'test'
+  ...
+# Subtest: REQ-LIMIT-4 pi line size is unknown, never zero or content
+ok 94 - REQ-LIMIT-4 pi line size is unknown, never zero or content
+  ---
+  duration_ms: 3.92269
+  type: 'test'
+  ...
+# Subtest: REQ-LIMIT-4 pi symlink file is unknown, never zero or content
+ok 95 - REQ-LIMIT-4 pi symlink file is unknown, never zero or content
+  ---
+  duration_ms: 0.488148
+  type: 'test'
+  ...
+# Subtest: REQ-LIMIT-4 pi hardlink file is unknown, never zero or content
+ok 96 - REQ-LIMIT-4 pi hardlink file is unknown, never zero or content
+  ---
+  duration_ms: 0.325503
+  type: 'test'
+  ...
+# Subtest: REQ-LIMIT-4 claude-code cut line is unknown, never zero or content
+ok 97 - REQ-LIMIT-4 claude-code cut line is unknown, never zero or content
+  ---
+  duration_ms: 0.377051
+  type: 'test'
+  ...
+# Subtest: REQ-LIMIT-4 claude-code invalid UTF-8 is unknown, never zero or content
+ok 98 - REQ-LIMIT-4 claude-code invalid UTF-8 is unknown, never zero or content
+  ---
+  duration_ms: 0.388899
+  type: 'test'
+  ...
+# Subtest: REQ-LIMIT-4 claude-code missing input is unknown, never zero or content
+ok 99 - REQ-LIMIT-4 claude-code missing input is unknown, never zero or content
+  ---
+  duration_ms: 0.403653
+  type: 'test'
+  ...
+# Subtest: REQ-LIMIT-4 claude-code negative count is unknown, never zero or content
+ok 100 - REQ-LIMIT-4 claude-code negative count is unknown, never zero or content
+  ---
+  duration_ms: 0.356921
+  type: 'test'
+  ...
+# Subtest: REQ-LIMIT-4 claude-code fractional count is unknown, never zero or content
+ok 101 - REQ-LIMIT-4 claude-code fractional count is unknown, never zero or content
+  ---
+  duration_ms: 0.388944
+  type: 'test'
+  ...
+# Subtest: REQ-LIMIT-4 claude-code unsafe integer is unknown, never zero or content
+ok 102 - REQ-LIMIT-4 claude-code unsafe integer is unknown, never zero or content
+  ---
+  duration_ms: 0.377099
+  type: 'test'
+  ...
+# Subtest: REQ-LIMIT-4 claude-code file size is unknown, never zero or content
+ok 103 - REQ-LIMIT-4 claude-code file size is unknown, never zero or content
+  ---
+  duration_ms: 6.07976
+  type: 'test'
+  ...
+# Subtest: REQ-LIMIT-4 claude-code line size is unknown, never zero or content
+ok 104 - REQ-LIMIT-4 claude-code line size is unknown, never zero or content
+  ---
+  duration_ms: 1.893556
+  type: 'test'
+  ...
+# Subtest: REQ-LIMIT-4 claude-code symlink file is unknown, never zero or content
+ok 105 - REQ-LIMIT-4 claude-code symlink file is unknown, never zero or content
+  ---
+  duration_ms: 0.403314
+  type: 'test'
+  ...
+# Subtest: REQ-LIMIT-4 claude-code hardlink file is unknown, never zero or content
+ok 106 - REQ-LIMIT-4 claude-code hardlink file is unknown, never zero or content
+  ---
+  duration_ms: 0.316423
+  type: 'test'
+  ...
+# Subtest: REQ-LIMIT-4 pi a symlink directory anywhere in the root refuses
+ok 107 - REQ-LIMIT-4 pi a symlink directory anywhere in the root refuses
+  ---
+  duration_ms: 0.322364
+  type: 'test'
+  ...
+# Subtest: REQ-LIMIT-4 claude-code a symlink directory anywhere in the root refuses
+ok 108 - REQ-LIMIT-4 claude-code a symlink directory anywhere in the root refuses
+  ---
+  duration_ms: 0.311861
+  type: 'test'
+  ...
+# Subtest: REQ-LIMIT-4 bounded directory entries refuse before scanning an arbitrary tree
+ok 109 - REQ-LIMIT-4 bounded directory entries refuse before scanning an arbitrary tree
+  ---
+  duration_ms: 8.32832
+  type: 'test'
+  ...
+# Subtest: REQ-LIMIT-4 conflicting repeated usage refuses rather than double counting
+ok 110 - REQ-LIMIT-4 conflicting repeated usage refuses rather than double counting
+  ---
+  duration_ms: 0.528438
+  type: 'test'
+  ...
+# Subtest: REQ-LIMIT-4 oversized metadata refuses before reading any transcript bytes
+ok 111 - REQ-LIMIT-4 oversized metadata refuses before reading any transcript bytes
+  ---
+  duration_ms: 5.788996
+  type: 'test'
+  ...
+# Subtest: REQ-LIMIT-4 a file growing after fstat cannot exceed the streaming byte budget
+ok 112 - REQ-LIMIT-4 a file growing after fstat cannot exceed the streaming byte budget
+  ---
+  duration_ms: 4.822522
+  type: 'test'
+  ...
+# Subtest: REQ-LIMIT-4 a same-size edit during a read is unknown rather than a stable snapshot
+ok 113 - REQ-LIMIT-4 a same-size edit during a read is unknown rather than a stable snapshot
+  ---
+  duration_ms: 0.77981
+  type: 'test'
+  ...
+# Subtest: REQ-LIMIT-4 record count is bounded even when each record is tiny
+ok 114 - REQ-LIMIT-4 record count is bounded even when each record is tiny
+  ---
+  duration_ms: 7.87409
+  type: 'test'
+  ...
+# Subtest: REQ-LIMIT-4 missing assistant usage, malformed JSON and conflicting identities are unknown
+ok 115 - REQ-LIMIT-4 missing assistant usage, malformed JSON and conflicting identities are unknown
+  ---
+  duration_ms: 0.831847
+  type: 'test'
+  ...
+# Subtest: REQ-LIMIT-4 caller roots, unsupported harnesses and non-object JSON never become zero usage
+ok 116 - REQ-LIMIT-4 caller roots, unsupported harnesses and non-object JSON never become zero usage
+  ---
+  duration_ms: 0.640367
+  type: 'test'
+  ...
+# Subtest: REQ-LIMIT-4 even a complete JSON record with no final newline is an unknown cut line
+ok 117 - REQ-LIMIT-4 even a complete JSON record with no final newline is an unknown cut line
+  ---
+  duration_ms: 0.331929
+  type: 'test'
+  ...
+# Subtest: REQ-LIMIT-4 final file opens are nonblocking before hostile file type is known
+ok 118 - REQ-LIMIT-4 final file opens are nonblocking before hostile file type is known
+  ---
+  duration_ms: 0.469933
+  type: 'test'
+  ...
+# Subtest: REQ-LIMIT-4 invalid transcript entry names refuse before file lookup
+ok 119 - REQ-LIMIT-4 invalid transcript entry names refuse before file lookup
+  ---
+  duration_ms: 0.279053
+  type: 'test'
+  ...
+# Subtest: REQ-LIMIT-4 claude-code refuses a symlinked project directory
+ok 120 - REQ-LIMIT-4 claude-code refuses a symlinked project directory
+  ---
+  duration_ms: 0.491358
+  type: 'test'
+  ...
+1..120
+# tests 120
+# suites 0
+# pass 120
+# fail 0
+# cancelled 0
+# skipped 0
+# todo 0
+# duration_ms 829.707835

agents/fethry/work/queue-266/evidence/raw-log-provenance.json

@@ -0,0 +1,200 @@
+[
+  {
+    "raw": "/mnt/storage/scratch/tmp/KV9rHb/bus-full.tap",
+    "display": "bus-full.tap",
+    "rawSHA256": "cecdb996f0d0f34b592bdc1d8f7015cf1fcef48b7235f34237fb7edf8c194d5c",
+    "displaySHA256": "21e5b1cecc5a1499a7ae12b73fef50adaad8ada5f6ad8c222ed098e0add2fe0c"
+  },
+  {
+    "raw": "/mnt/storage/scratch/tmp/KV9rHb/editor-build.tap",
+    "display": "editor-build.tap",
+    "rawSHA256": "6e4fb4cbdd36ff817c8246e727f382ada773d4667f314e0a5a187369c2c994ba",
+    "displaySHA256": "6e4fb4cbdd36ff817c8246e727f382ada773d4667f314e0a5a187369c2c994ba"
+  },
+  {
+    "raw": "/mnt/storage/scratch/tmp/KV9rHb/plugin-green.tap",
+    "display": "plugin-green.tap",
+    "rawSHA256": "812b4fe16ba42152021741cd518913c68a834afb2b41da2a704c9f1eea87ba3e",
+    "displaySHA256": "812b4fe16ba42152021741cd518913c68a834afb2b41da2a704c9f1eea87ba3e"
+  },
+  {
+    "raw": "/mnt/storage/scratch/tmp/KV9rHb/plugin-red.tap",
+    "display": "plugin-red.tap",
+    "rawSHA256": "a03dbb651717487be38b57bd793727e5627f37c8d3efd19483dbe979d2c7db46",
+    "displaySHA256": "a03dbb651717487be38b57bd793727e5627f37c8d3efd19483dbe979d2c7db46"
+  },
+  {
+    "raw": "/mnt/storage/scratch/tmp/KV9rHb/plugins-full.tap",
+    "display": "plugins-full.tap",
+    "rawSHA256": "287e1f34ebab1c9290d7553ac4ba5319bf6c660ce26b430b2c69535dd803013c",
+    "displaySHA256": "287e1f34ebab1c9290d7553ac4ba5319bf6c660ce26b430b2c69535dd803013c"
+  },
+  {
+    "raw": "/mnt/storage/scratch/tmp/KV9rHb/room-browser-final.tap",
+    "display": "room-browser-final.tap",
+    "rawSHA256": "9061501c7cc991c2710df07f1db7f564dc2bf6119de11ec9835ebd23e62f9137",
+    "displaySHA256": "9061501c7cc991c2710df07f1db7f564dc2bf6119de11ec9835ebd23e62f9137"
+  },
+  {
+    "raw": "/mnt/storage/scratch/tmp/KV9rHb/room-browser-final2.tap",
+    "display": "room-browser-final2.tap",
+    "rawSHA256": "e20f05a46438679273ab94a3bf8e718421e647c38068283bccb6895a5e2938c3",
+    "displaySHA256": "e20f05a46438679273ab94a3bf8e718421e647c38068283bccb6895a5e2938c3"
+  },
+  {
+    "raw": "/mnt/storage/scratch/tmp/KV9rHb/room-browser-green.tap",
+    "display": "room-browser-green.tap",
+    "rawSHA256": "a5197d7417efef5ba7dfa9c480516e26719e366adaeaeef49cbcfa9ae96285ee",
+    "displaySHA256": "a5197d7417efef5ba7dfa9c480516e26719e366adaeaeef49cbcfa9ae96285ee"
+  },
+  {
+    "raw": "/mnt/storage/scratch/tmp/KV9rHb/room-browser-green2.tap",
+    "display": "room-browser-green2.tap",
+    "rawSHA256": "d00a8f2842a74adbd304020dd4536bd0328a8fe50d10462267673bb87b93a69e",
+    "displaySHA256": "d00a8f2842a74adbd304020dd4536bd0328a8fe50d10462267673bb87b93a69e"
+  },
+  {
+    "raw": "/mnt/storage/scratch/tmp/KV9rHb/room-browser-red.tap",
+    "display": "room-browser-red.tap",
+    "rawSHA256": "0049cf34649eb250262a365dfa65f579f02d50cc1df4c0139c3e2c17c37d91a5",
+    "displaySHA256": "0049cf34649eb250262a365dfa65f579f02d50cc1df4c0139c3e2c17c37d91a5"
+  },
+  {
+    "raw": "/mnt/storage/scratch/tmp/KV9rHb/room-check-green.tap",
+    "display": "room-check-green.tap",
+    "rawSHA256": "efd5ac58b3cc94f4b5d831b5372c96cf1390af2eaf4215a55c179b97ad72bb64",
+    "displaySHA256": "efd5ac58b3cc94f4b5d831b5372c96cf1390af2eaf4215a55c179b97ad72bb64"
+  },
+  {
+    "raw": "/mnt/storage/scratch/tmp/KV9rHb/room-check-red.tap",
+    "display": "room-check-red.tap",
+    "rawSHA256": "b2917225a113bdf5a9cc2ff9efceb336f0cb8cbc4593bf8b4b2aa2292b025a9d",
+    "displaySHA256": "c41c959a330ff01db5941da91ee64e5ac398850710127920809ec0368b32026c"
+  },
+  {
+    "raw": "/mnt/storage/scratch/tmp/KV9rHb/room-http-final.tap",
+    "display": "room-http-final.tap",
+    "rawSHA256": "25844a7bcca478617d95ec23460dd58aca539232d2eb3047d6537b5b4b5f3261",
+    "displaySHA256": "25844a7bcca478617d95ec23460dd58aca539232d2eb3047d6537b5b4b5f3261"
+  },
+  {
+    "raw": "/mnt/storage/scratch/tmp/KV9rHb/room-http-green.tap",
+    "display": "room-http-green.tap",
+    "rawSHA256": "d2a309b9e9b9859f4c4ba4352cc70ecf70cdfded31c187b8361250071b508140",
+    "displaySHA256": "d2a309b9e9b9859f4c4ba4352cc70ecf70cdfded31c187b8361250071b508140"
+  },
+  {
+    "raw": "/mnt/storage/scratch/tmp/KV9rHb/room-http-red.tap",
+    "display": "room-http-red.tap",
+    "rawSHA256": "9d642f087190461f71d26d8a2e5802ed329f9499a07eafa763eacc1b1a7cde6e",
+    "displaySHA256": "2c27ec9c7ee06484440705b2166f95042c8db357a2879930f55b68fb62557f72"
+  },
+  {
+    "raw": "/mnt/storage/scratch/tmp/KV9rHb/room-http-validation-red.tap",
+    "display": "room-http-validation-red.tap",
+    "rawSHA256": "12ebb7b83c3f59bfefc5ea3964f40a868b2405661533a74f01644486baf6fe12",
+    "displaySHA256": "fbddc50f3cf24c42520b4b7fd7649c83f52409346cc177ddd946286ac712cc02"
+  },
+  {
+    "raw": "/mnt/storage/scratch/tmp/KV9rHb/t9-rerun-1.tap",
+    "display": "t9-rerun-1.tap",
+    "rawSHA256": "221bae8b7e9e8dee198580e8c3985dc7cef88f2b049b2c2f536df67cbb0d7ac9",
+    "displaySHA256": "221bae8b7e9e8dee198580e8c3985dc7cef88f2b049b2c2f536df67cbb0d7ac9"
+  },
+  {
+    "raw": "/mnt/storage/scratch/tmp/KV9rHb/t9-rerun-2.tap",
+    "display": "t9-rerun-2.tap",
+    "rawSHA256": "13cc40f64acd8311cc48d695a8f97c277ca115bf7e5dc72dbe3696b8144fc8be",
+    "displaySHA256": "13cc40f64acd8311cc48d695a8f97c277ca115bf7e5dc72dbe3696b8144fc8be"
+  },
+  {
+    "raw": "/mnt/storage/scratch/tmp/KV9rHb/t9-rerun-3.tap",
+    "display": "t9-rerun-3.tap",
+    "rawSHA256": "d398bd81d1f86a599bd8da59d5d45c6a534d75f656046880042d687ca1b2f07f",
+    "displaySHA256": "d398bd81d1f86a599bd8da59d5d45c6a534d75f656046880042d687ca1b2f07f"
+  },
+  {
+    "raw": "/mnt/storage/scratch/tmp/KV9rHb/test-auth.tap",
+    "display": "test-auth.tap",
+    "rawSHA256": "f91fc95a173339137f981e24fbf630acfde957e32c3cd71e28304532083c6a77",
+    "displaySHA256": "f91fc95a173339137f981e24fbf630acfde957e32c3cd71e28304532083c6a77"
+  },
+  {
+    "raw": "/mnt/storage/scratch/tmp/KV9rHb/test-conductor.tap",
+    "display": "test-conductor.tap",
+    "rawSHA256": "c50ff64b098027711e20445f4c02612a9a2db0c316b17160811f8beadf183ad6",
+    "displaySHA256": "c50ff64b098027711e20445f4c02612a9a2db0c316b17160811f8beadf183ad6"
+  },
+  {
+    "raw": "/mnt/storage/scratch/tmp/KV9rHb/test-config.tap",
+    "display": "test-config.tap",
+    "rawSHA256": "92ea8ce5e66d892fefacc76b87d140bcfb8c5a51dc77bdf4a47a6213ac5d2898",
+    "displaySHA256": "92ea8ce5e66d892fefacc76b87d140bcfb8c5a51dc77bdf4a47a6213ac5d2898"
+  },
+  {
+    "raw": "/mnt/storage/scratch/tmp/KV9rHb/test-discord.tap",
+    "display": "test-discord.tap",
+    "rawSHA256": "9b482b7a3f0672c872923c06e71d5a88ff085a08170905a6cabe1d2b6fc283b6",
+    "displaySHA256": "9b482b7a3f0672c872923c06e71d5a88ff085a08170905a6cabe1d2b6fc283b6"
+  },
+  {
+    "raw": "/mnt/storage/scratch/tmp/KV9rHb/test-extension-package.tap",
+    "display": "test-extension-package.tap",
+    "rawSHA256": "3aae7d4f584eb86c19a87fc2589ede0159617c1cc59d35e1e326ebf1830a4bfc",
+    "displaySHA256": "3aae7d4f584eb86c19a87fc2589ede0159617c1cc59d35e1e326ebf1830a4bfc"
+  },
+  {
+    "raw": "/mnt/storage/scratch/tmp/KV9rHb/test-federation-acceptance.tap",
+    "display": "test-federation-acceptance.tap",
+    "rawSHA256": "674d778090229d0d9adcad089e8cbeaf811c5e797380655a57dce37ca7fc768e",
+    "displaySHA256": "674d778090229d0d9adcad089e8cbeaf811c5e797380655a57dce37ca7fc768e"
+  },
+  {
+    "raw": "/mnt/storage/scratch/tmp/KV9rHb/test-foundation.tap",
+    "display": "test-foundation.tap",
+    "rawSHA256": "83dfaa21c4e4ad941088efab3f69e87ebd2f6bd3cc72ede938e21dc06da8a34f",
+    "displaySHA256": "83dfaa21c4e4ad941088efab3f69e87ebd2f6bd3cc72ede938e21dc06da8a34f"
+  },
+  {
+    "raw": "/mnt/storage/scratch/tmp/KV9rHb/test-land-work.tap",
+    "display": "test-land-work.tap",
+    "rawSHA256": "3e2f8024027592e77790db2bbe039803060915ebf37c7b67f04071a7e83d20dc",
+    "displaySHA256": "3e2f8024027592e77790db2bbe039803060915ebf37c7b67f04071a7e83d20dc"
+  },
+  {
+    "raw": "/mnt/storage/scratch/tmp/KV9rHb/test-push-check.tap",
+    "display": "test-push-check.tap",
+    "rawSHA256": "5d9a170308927264d212e3dd00e87463a21d55811cf9b4cb51dce74d6a10fea5",
+    "displaySHA256": "5d9a170308927264d212e3dd00e87463a21d55811cf9b4cb51dce74d6a10fea5"
+  },
+  {
+    "raw": "/mnt/storage/scratch/tmp/KV9rHb/test-queue.tap",
+    "display": "test-queue.tap",
+    "rawSHA256": "ac1a44f25384f67386ebc0864b4d8c853bb3991eb5c75c5fc9b882841797850a",
+    "displaySHA256": "ac1a44f25384f67386ebc0864b4d8c853bb3991eb5c75c5fc9b882841797850a"
+  },
+  {
+    "raw": "/mnt/storage/scratch/tmp/KV9rHb/test-release.tap",
+    "display": "test-release.tap",
+    "rawSHA256": "9f9dd11e2631a24ad55aaf7becc61965c592b00da08a4e72b98e0384d3a13ec7",
+    "displaySHA256": "9f9dd11e2631a24ad55aaf7becc61965c592b00da08a4e72b98e0384d3a13ec7"
+  },
+  {
+    "raw": "/mnt/storage/scratch/tmp/KV9rHb/test-task.tap",
+    "display": "test-task.tap",
+    "rawSHA256": "a065947f07d70a4721b423da597968630bc8ec1659db14681af42bb3f974077d",
+    "displaySHA256": "a065947f07d70a4721b423da597968630bc8ec1659db14681af42bb3f974077d"
+  },
+  {
+    "raw": "/mnt/storage/scratch/tmp/KV9rHb/webui-full.tap",
+    "display": "webui-full.tap",
+    "rawSHA256": "42fc6cc8d2d90ff8730a150942a16a12b3e1777c8b95c966a045c27c88c7777e",
+    "displaySHA256": "42fc6cc8d2d90ff8730a150942a16a12b3e1777c8b95c966a045c27c88c7777e"
+  },
+  {
+    "raw": "/mnt/storage/scratch/tmp/KV9rHb/bus-rerun.tap",
+    "display": "bus-rerun.tap",
+    "rawSHA256": "3a1901f3e1b7f80a0faa72d07b156bd9b8480a3d5e16f74d0d76401e2f26d456",
+    "displaySHA256": "3a1901f3e1b7f80a0faa72d07b156bd9b8480a3d5e16f74d0d76401e2f26d456"
+  }
+]

agents/fethry/work/queue-266/evidence/rerun-summary.json

@@ -0,0 +1,66 @@
+[
+  {
+    "step": "t9-rerun-1",
+    "command": [
+      "node",
+      "--test",
+      "--test-reporter=tap",
+      "--test-concurrency=1",
+      "--test-timeout=30000",
+      "packages/bus/tests/library-credential.test.mjs"
+    ],
+    "cwd": "/home/jwoltje/.t3/worktrees/mosaic-stack/fethry-row266",
+    "outerSeconds": 120,
+    "exit": 0,
+    "seconds": 1.367,
+    "cleanupSignals": []
+  },
+  {
+    "step": "t9-rerun-2",
+    "command": [
+      "node",
+      "--test",
+      "--test-reporter=tap",
+      "--test-concurrency=1",
+      "--test-timeout=30000",
+      "packages/bus/tests/library-credential.test.mjs"
+    ],
+    "cwd": "/home/jwoltje/.t3/worktrees/mosaic-stack/fethry-row266",
+    "outerSeconds": 120,
+    "exit": 0,
+    "seconds": 1.367,
+    "cleanupSignals": []
+  },
+  {
+    "step": "t9-rerun-3",
+    "command": [
+      "node",
+      "--test",
+      "--test-reporter=tap",
+      "--test-concurrency=1",
+      "--test-timeout=30000",
+      "packages/bus/tests/library-credential.test.mjs"
+    ],
+    "cwd": "/home/jwoltje/.t3/worktrees/mosaic-stack/fethry-row266",
+    "outerSeconds": 120,
+    "exit": 0,
+    "seconds": 1.367,
+    "cleanupSignals": []
+  },
+  {
+    "step": "bus-rerun",
+    "command": [
+      "node",
+      "--test",
+      "--test-reporter=tap",
+      "--test-concurrency=1",
+      "--test-timeout=30000",
+      "packages/bus/tests/"
+    ],
+    "cwd": "/home/jwoltje/.t3/worktrees/mosaic-stack/fethry-row266",
+    "outerSeconds": 1200,
+    "exit": 0,
+    "seconds": 142.919,
+    "cleanupSignals": []
+  }
+]

agents/fethry/work/queue-266/evidence/room-browser-final.tap

@@ -0,0 +1,74 @@
+TAP version 13
+# Subtest: C2-10c room merges members, shows a broadcast once, reuses cited renderer and suppresses checked notice forgery
+ok 1 - C2-10c room merges members, shows a broadcast once, reuses cited renderer and suppresses checked notice forgery
+  ---
+  duration_ms: 579.685618
+  type: 'test'
+  ...
+# Subtest: C2-10c explicit project Open room calls only room.open before navigating
+ok 2 - C2-10c explicit project Open room calls only room.open before navigating
+  ---
+  duration_ms: 590.781432
+  type: 'test'
+  ...
+# Subtest: C2-10c completion lists only room members, inserts instance tokens and preserves typed send exactly
+not ok 3 - C2-10c completion lists only room members, inserts instance tokens and preserves typed send exactly
+  ---
+  duration_ms: 477.156559
+  type: 'test'
+  location: '/home/jwoltje/.t3/worktrees/mosaic-stack/fethry-row266/packages/webui/tests/room-browser.test.mjs:103:1'
+  failureType: 'testCodeFailure'
+  error: 'Uncaught: SyntaxError: missing ) after argument list'
+  code: 'ERR_TEST_FAILURE'
+  stack: |-
+    Object.evaluate (file:///home/jwoltje/.t3/worktrees/mosaic-stack/fethry-row266/packages/webui/tests/browser.mjs:49:35)
+    process.processTicksAndRejections (node:internal/process/task_queues:104:5)
+    async TestContext.<anonymous> (file:///home/jwoltje/.t3/worktrees/mosaic-stack/fethry-row266/packages/webui/tests/room-browser.test.mjs:122:16)
+    async Test.run (node:internal/test_runner/test:1409:7)
+    async Test.processPendingSubtests (node:internal/test_runner/test:974:7)
+  ...
+# Subtest: C2-10c browser leading tag reader matches every broker parseAddress vector
+ok 4 - C2-10c browser leading tag reader matches every broker parseAddress vector
+  ---
+  duration_ms: 446.373694
+  type: 'test'
+  ...
+# Subtest: C2-10c room refusals show fixed lines, preserve drafts and never retry
+ok 5 - C2-10c room refusals show fixed lines, preserve drafts and never retry
+  ---
+  duration_ms: 467.224249
+  type: 'test'
+  ...
+# Subtest: C2-10c read-only room does not offer a send or an implicit open
+ok 6 - C2-10c read-only room does not offer a send or an implicit open
+  ---
+  duration_ms: 429.347385
+  type: 'test'
+  ...
+# Subtest: C2-10c late reads and sign-out cannot repaint private room state
+ok 7 - C2-10c late reads and sign-out cannot repaint private room state
+  ---
+  duration_ms: 481.360271
+  type: 'test'
+  ...
+# Subtest: C2-10c quiet members complete in an empty room, and Escape closes suggestions
+ok 8 - C2-10c quiet members complete in an empty room, and Escape closes suggestions
+  ---
+  duration_ms: 431.26383
+  type: 'test'
+  ...
+# Subtest: C2-10c pending sends do not duplicate and uncertain sends preserve the exact draft
+ok 9 - C2-10c pending sends do not duplicate and uncertain sends preserve the exact draft
+  ---
+  duration_ms: 445.816871
+  type: 'test'
+  ...
+1..9
+# tests 9
+# suites 0
+# pass 8
+# fail 1
+# cancelled 0
+# skipped 0
+# todo 0
+# duration_ms 4457.473253

agents/fethry/work/queue-266/evidence/room-browser-final2.tap

@@ -0,0 +1,64 @@
+TAP version 13
+# Subtest: C2-10c room merges members, shows a broadcast once, reuses cited renderer and suppresses checked notice forgery
+ok 1 - C2-10c room merges members, shows a broadcast once, reuses cited renderer and suppresses checked notice forgery
+  ---
+  duration_ms: 612.127424
+  type: 'test'
+  ...
+# Subtest: C2-10c explicit project Open room calls only room.open before navigating
+ok 2 - C2-10c explicit project Open room calls only room.open before navigating
+  ---
+  duration_ms: 523.14041
+  type: 'test'
+  ...
+# Subtest: C2-10c completion lists only room members, inserts instance tokens and preserves typed send exactly
+ok 3 - C2-10c completion lists only room members, inserts instance tokens and preserves typed send exactly
+  ---
+  duration_ms: 575.124776
+  type: 'test'
+  ...
+# Subtest: C2-10c browser leading tag reader matches every broker parseAddress vector
+ok 4 - C2-10c browser leading tag reader matches every broker parseAddress vector
+  ---
+  duration_ms: 503.401984
+  type: 'test'
+  ...
+# Subtest: C2-10c room refusals show fixed lines, preserve drafts and never retry
+ok 5 - C2-10c room refusals show fixed lines, preserve drafts and never retry
+  ---
+  duration_ms: 496.507579
+  type: 'test'
+  ...
+# Subtest: C2-10c read-only room does not offer a send or an implicit open
+ok 6 - C2-10c read-only room does not offer a send or an implicit open
+  ---
+  duration_ms: 461.20871
+  type: 'test'
+  ...
+# Subtest: C2-10c late reads and sign-out cannot repaint private room state
+ok 7 - C2-10c late reads and sign-out cannot repaint private room state
+  ---
+  duration_ms: 528.355937
+  type: 'test'
+  ...
+# Subtest: C2-10c quiet members complete in an empty room, and Escape closes suggestions
+ok 8 - C2-10c quiet members complete in an empty room, and Escape closes suggestions
+  ---
+  duration_ms: 557.487691
+  type: 'test'
+  ...
+# Subtest: C2-10c pending sends do not duplicate and uncertain sends preserve the exact draft
+ok 9 - C2-10c pending sends do not duplicate and uncertain sends preserve the exact draft
+  ---
+  duration_ms: 497.125002
+  type: 'test'
+  ...
+1..9
+# tests 9
+# suites 0
+# pass 9
+# fail 0
+# cancelled 0
+# skipped 0
+# todo 0
+# duration_ms 4864.325898

agents/fethry/work/queue-266/evidence/room-browser-green.tap

@@ -0,0 +1,72 @@
+TAP version 13
+# Subtest: C2-10c room merges members, shows a broadcast once, reuses cited renderer and suppresses checked notice forgery
+ok 1 - C2-10c room merges members, shows a broadcast once, reuses cited renderer and suppresses checked notice forgery
+  ---
+  duration_ms: 478.675099
+  type: 'test'
+  ...
+# Subtest: C2-10c explicit project Open room calls only room.open before navigating
+ok 2 - C2-10c explicit project Open room calls only room.open before navigating
+  ---
+  duration_ms: 482.553437
+  type: 'test'
+  ...
+# Subtest: C2-10c completion lists only room members, inserts instance tokens and preserves typed send exactly
+not ok 3 - C2-10c completion lists only room members, inserts instance tokens and preserves typed send exactly
+  ---
+  duration_ms: 3478.222635
+  type: 'test'
+  location: '/home/jwoltje/.t3/worktrees/mosaic-stack/fethry-row266/packages/webui/tests/room-browser.test.mjs:101:1'
+  failureType: 'testCodeFailure'
+  error: 'Uncaught (in promise) Error: window.__writes.length===1 && !document.querySelector("#chat-room-body").disabled: undefined'
+  code: 'ERR_TEST_FAILURE'
+  stack: |-
+    Object.evaluate (file:///home/jwoltje/.t3/worktrees/mosaic-stack/fethry-row266/packages/webui/tests/browser.mjs:49:35)
+    process.processTicksAndRejections (node:internal/process/task_queues:104:5)
+    async TestContext.<anonymous> (file:///home/jwoltje/.t3/worktrees/mosaic-stack/fethry-row266/packages/webui/tests/room-browser.test.mjs:113:3)
+    async Test.run (node:internal/test_runner/test:1409:7)
+    async Test.processPendingSubtests (node:internal/test_runner/test:974:7)
+  ...
+# Subtest: C2-10c browser leading tag reader matches every broker parseAddress vector
+ok 4 - C2-10c browser leading tag reader matches every broker parseAddress vector
+  ---
+  duration_ms: 469.757127
+  type: 'test'
+  ...
+# Subtest: C2-10c room refusals show fixed lines, preserve drafts and never retry
+not ok 5 - C2-10c room refusals show fixed lines, preserve drafts and never retry
+  ---
+  duration_ms: 3452.43392
+  type: 'test'
+  location: '/home/jwoltje/.t3/worktrees/mosaic-stack/fethry-row266/packages/webui/tests/room-browser.test.mjs:128:1'
+  failureType: 'testCodeFailure'
+  error: "Uncaught (in promise) Error: window.__writes.length===1 && !document.querySelector('#chat-room-body').disabled: undefined"
+  code: 'ERR_TEST_FAILURE'
+  stack: |-
+    Object.evaluate (file:///home/jwoltje/.t3/worktrees/mosaic-stack/fethry-row266/packages/webui/tests/browser.mjs:49:35)
+    process.processTicksAndRejections (node:internal/process/task_queues:104:5)
+    async TestContext.<anonymous> (file:///home/jwoltje/.t3/worktrees/mosaic-stack/fethry-row266/packages/webui/tests/room-browser.test.mjs:134:5)
+    async Test.run (node:internal/test_runner/test:1409:7)
+    async Test.processPendingSubtests (node:internal/test_runner/test:974:7)
+  ...
+# Subtest: C2-10c read-only room does not offer a send or an implicit open
+ok 6 - C2-10c read-only room does not offer a send or an implicit open
+  ---
+  duration_ms: 450.601494
+  type: 'test'
+  ...
+# Subtest: C2-10c late reads and sign-out cannot repaint private room state
+ok 7 - C2-10c late reads and sign-out cannot repaint private room state
+  ---
+  duration_ms: 505.231021
+  type: 'test'
+  ...
+1..7
+# tests 7
+# suites 0
+# pass 5
+# fail 2
+# cancelled 0
+# skipped 0
+# todo 0
+# duration_ms 9422.414756

agents/fethry/work/queue-266/evidence/room-browser-green2.tap

@@ -0,0 +1,52 @@
+TAP version 13
+# Subtest: C2-10c room merges members, shows a broadcast once, reuses cited renderer and suppresses checked notice forgery
+ok 1 - C2-10c room merges members, shows a broadcast once, reuses cited renderer and suppresses checked notice forgery
+  ---
+  duration_ms: 461.849386
+  type: 'test'
+  ...
+# Subtest: C2-10c explicit project Open room calls only room.open before navigating
+ok 2 - C2-10c explicit project Open room calls only room.open before navigating
+  ---
+  duration_ms: 457.623189
+  type: 'test'
+  ...
+# Subtest: C2-10c completion lists only room members, inserts instance tokens and preserves typed send exactly
+ok 3 - C2-10c completion lists only room members, inserts instance tokens and preserves typed send exactly
+  ---
+  duration_ms: 458.150891
+  type: 'test'
+  ...
+# Subtest: C2-10c browser leading tag reader matches every broker parseAddress vector
+ok 4 - C2-10c browser leading tag reader matches every broker parseAddress vector
+  ---
+  duration_ms: 608.340525
+  type: 'test'
+  ...
+# Subtest: C2-10c room refusals show fixed lines, preserve drafts and never retry
+ok 5 - C2-10c room refusals show fixed lines, preserve drafts and never retry
+  ---
+  duration_ms: 497.894326
+  type: 'test'
+  ...
+# Subtest: C2-10c read-only room does not offer a send or an implicit open
+ok 6 - C2-10c read-only room does not offer a send or an implicit open
+  ---
+  duration_ms: 460.087976
+  type: 'test'
+  ...
+# Subtest: C2-10c late reads and sign-out cannot repaint private room state
+ok 7 - C2-10c late reads and sign-out cannot repaint private room state
+  ---
+  duration_ms: 600.261859
+  type: 'test'
+  ...
+1..7
+# tests 7
+# suites 0
+# pass 7
+# fail 0
+# cancelled 0
+# skipped 0
+# todo 0
+# duration_ms 3647.620295

agents/fethry/work/queue-266/evidence/room-browser-red.tap

@@ -0,0 +1,131 @@
+TAP version 13
+# Subtest: C2-10c room merges members, shows a broadcast once, reuses cited renderer and suppresses checked notice forgery
+not ok 1 - C2-10c room merges members, shows a broadcast once, reuses cited renderer and suppresses checked notice forgery
+  ---
+  duration_ms: 3628.090522
+  type: 'test'
+  location: '/home/jwoltje/.t3/worktrees/mosaic-stack/fethry-row266/packages/webui/tests/room-browser.test.mjs:77:1'
+  failureType: 'testCodeFailure'
+  error: 'Uncaught (in promise) Error: document.querySelector(".chat-room"): undefined'
+  code: 'ERR_TEST_FAILURE'
+  stack: |-
+    Object.evaluate (file:///home/jwoltje/.t3/worktrees/mosaic-stack/fethry-row266/packages/webui/tests/browser.mjs:49:35)
+    process.processTicksAndRejections (node:internal/process/task_queues:104:5)
+    async setup (file:///home/jwoltje/.t3/worktrees/mosaic-stack/fethry-row266/packages/webui/tests/room-browser.test.mjs:74:3)
+    async TestContext.<anonymous> (file:///home/jwoltje/.t3/worktrees/mosaic-stack/fethry-row266/packages/webui/tests/room-browser.test.mjs:78:29)
+    async Test.run (node:internal/test_runner/test:1409:7)
+    async startSubtestAfterBootstrap (node:internal/test_runner/harness:387:3)
+  ...
+# Subtest: C2-10c explicit project Open room calls only room.open before navigating
+not ok 2 - C2-10c explicit project Open room calls only room.open before navigating
+  ---
+  duration_ms: 429.638963
+  type: 'test'
+  location: '/home/jwoltje/.t3/worktrees/mosaic-stack/fethry-row266/packages/webui/tests/room-browser.test.mjs:94:1'
+  failureType: 'testCodeFailure'
+  error: |-
+    Uncaught: TypeError: Cannot read properties of null (reading 'click')
+        at <anonymous>:1:42
+  code: 'ERR_TEST_FAILURE'
+  stack: |-
+    <anonymous>:1:42
+    Object.evaluate (file:///home/jwoltje/.t3/worktrees/mosaic-stack/fethry-row266/packages/webui/tests/browser.mjs:49:35)
+    process.processTicksAndRejections (node:internal/process/task_queues:104:5)
+    async TestContext.<anonymous> (file:///home/jwoltje/.t3/worktrees/mosaic-stack/fethry-row266/packages/webui/tests/room-browser.test.mjs:97:3)
+    async Test.run (node:internal/test_runner/test:1409:7)
+    async Test.processPendingSubtests (node:internal/test_runner/test:974:7)
+  ...
+# Subtest: C2-10c completion lists only room members, inserts instance tokens and preserves typed send exactly
+not ok 3 - C2-10c completion lists only room members, inserts instance tokens and preserves typed send exactly
+  ---
+  duration_ms: 3424.260935
+  type: 'test'
+  location: '/home/jwoltje/.t3/worktrees/mosaic-stack/fethry-row266/packages/webui/tests/room-browser.test.mjs:101:1'
+  failureType: 'testCodeFailure'
+  error: 'Uncaught (in promise) Error: document.querySelector(".chat-room"): undefined'
+  code: 'ERR_TEST_FAILURE'
+  stack: |-
+    Object.evaluate (file:///home/jwoltje/.t3/worktrees/mosaic-stack/fethry-row266/packages/webui/tests/browser.mjs:49:35)
+    process.processTicksAndRejections (node:internal/process/task_queues:104:5)
+    async setup (file:///home/jwoltje/.t3/worktrees/mosaic-stack/fethry-row266/packages/webui/tests/room-browser.test.mjs:74:3)
+    async TestContext.<anonymous> (file:///home/jwoltje/.t3/worktrees/mosaic-stack/fethry-row266/packages/webui/tests/room-browser.test.mjs:102:28)
+    async Test.run (node:internal/test_runner/test:1409:7)
+    async Test.processPendingSubtests (node:internal/test_runner/test:974:7)
+  ...
+# Subtest: C2-10c browser leading tag reader matches every broker parseAddress vector
+not ok 4 - C2-10c browser leading tag reader matches every broker parseAddress vector
+  ---
+  duration_ms: 3423.200884
+  type: 'test'
+  location: '/home/jwoltje/.t3/worktrees/mosaic-stack/fethry-row266/packages/webui/tests/room-browser.test.mjs:118:1'
+  failureType: 'testCodeFailure'
+  error: 'Uncaught (in promise) Error: document.querySelector(".chat-room"): undefined'
+  code: 'ERR_TEST_FAILURE'
+  stack: |-
+    Object.evaluate (file:///home/jwoltje/.t3/worktrees/mosaic-stack/fethry-row266/packages/webui/tests/browser.mjs:49:35)
+    process.processTicksAndRejections (node:internal/process/task_queues:104:5)
+    async setup (file:///home/jwoltje/.t3/worktrees/mosaic-stack/fethry-row266/packages/webui/tests/room-browser.test.mjs:74:3)
+    async TestContext.<anonymous> (file:///home/jwoltje/.t3/worktrees/mosaic-stack/fethry-row266/packages/webui/tests/room-browser.test.mjs:119:22)
+    async Test.run (node:internal/test_runner/test:1409:7)
+    async Test.processPendingSubtests (node:internal/test_runner/test:974:7)
+  ...
+# Subtest: C2-10c room refusals show fixed lines, preserve drafts and never retry
+not ok 5 - C2-10c room refusals show fixed lines, preserve drafts and never retry
+  ---
+  duration_ms: 3450.058918
+  type: 'test'
+  location: '/home/jwoltje/.t3/worktrees/mosaic-stack/fethry-row266/packages/webui/tests/room-browser.test.mjs:128:1'
+  failureType: 'testCodeFailure'
+  error: 'Uncaught (in promise) Error: document.querySelector(".chat-room"): undefined'
+  code: 'ERR_TEST_FAILURE'
+  stack: |-
+    Object.evaluate (file:///home/jwoltje/.t3/worktrees/mosaic-stack/fethry-row266/packages/webui/tests/browser.mjs:49:35)
+    process.processTicksAndRejections (node:internal/process/task_queues:104:5)
+    async setup (file:///home/jwoltje/.t3/worktrees/mosaic-stack/fethry-row266/packages/webui/tests/room-browser.test.mjs:74:3)
+    async TestContext.<anonymous> (file:///home/jwoltje/.t3/worktrees/mosaic-stack/fethry-row266/packages/webui/tests/room-browser.test.mjs:129:34)
+    async Test.run (node:internal/test_runner/test:1409:7)
+    async Test.processPendingSubtests (node:internal/test_runner/test:974:7)
+  ...
+# Subtest: C2-10c read-only room does not offer a send or an implicit open
+not ok 6 - C2-10c read-only room does not offer a send or an implicit open
+  ---
+  duration_ms: 3443.193406
+  type: 'test'
+  location: '/home/jwoltje/.t3/worktrees/mosaic-stack/fethry-row266/packages/webui/tests/room-browser.test.mjs:142:1'
+  failureType: 'testCodeFailure'
+  error: 'Uncaught (in promise) Error: document.querySelector(".chat-room"): undefined'
+  code: 'ERR_TEST_FAILURE'
+  stack: |-
+    Object.evaluate (file:///home/jwoltje/.t3/worktrees/mosaic-stack/fethry-row266/packages/webui/tests/browser.mjs:49:35)
+    process.processTicksAndRejections (node:internal/process/task_queues:104:5)
+    async setup (file:///home/jwoltje/.t3/worktrees/mosaic-stack/fethry-row266/packages/webui/tests/room-browser.test.mjs:74:3)
+    async TestContext.<anonymous> (file:///home/jwoltje/.t3/worktrees/mosaic-stack/fethry-row266/packages/webui/tests/room-browser.test.mjs:143:22)
+    async Test.run (node:internal/test_runner/test:1409:7)
+    async Test.processPendingSubtests (node:internal/test_runner/test:974:7)
+  ...
+# Subtest: C2-10c late reads and sign-out cannot repaint private room state
+not ok 7 - C2-10c late reads and sign-out cannot repaint private room state
+  ---
+  duration_ms: 3457.523072
+  type: 'test'
+  location: '/home/jwoltje/.t3/worktrees/mosaic-stack/fethry-row266/packages/webui/tests/room-browser.test.mjs:150:1'
+  failureType: 'testCodeFailure'
+  error: 'Uncaught (in promise) Error: document.querySelector(".chat-room"): undefined'
+  code: 'ERR_TEST_FAILURE'
+  stack: |-
+    Object.evaluate (file:///home/jwoltje/.t3/worktrees/mosaic-stack/fethry-row266/packages/webui/tests/browser.mjs:49:35)
+    process.processTicksAndRejections (node:internal/process/task_queues:104:5)
+    async setup (file:///home/jwoltje/.t3/worktrees/mosaic-stack/fethry-row266/packages/webui/tests/room-browser.test.mjs:74:3)
+    async TestContext.<anonymous> (file:///home/jwoltje/.t3/worktrees/mosaic-stack/fethry-row266/packages/webui/tests/room-browser.test.mjs:151:28)
+    async Test.run (node:internal/test_runner/test:1409:7)
+    async Test.processPendingSubtests (node:internal/test_runner/test:974:7)
+  ...
+1..7
+# tests 7
+# suites 0
+# pass 0
+# fail 7
+# cancelled 0
+# skipped 0
+# todo 0
+# duration_ms 21368.466856

agents/fethry/work/queue-266/evidence/room-check-green.tap

@@ -0,0 +1,22 @@
+TAP version 13
+# Subtest: C2-10c room.read carries exactly the thread check and current file last
+ok 1 - C2-10c room.read carries exactly the thread check and current file last
+  ---
+  duration_ms: 66.788688
+  type: 'test'
+  ...
+# Subtest: C2-10c check hydration preserves unchecked rows and one broadcast with two addressees
+ok 2 - C2-10c check hydration preserves unchecked rows and one broadcast with two addressees
+  ---
+  duration_ms: 14.902072
+  type: 'test'
+  ...
+1..2
+# tests 2
+# suites 0
+# pass 2
+# fail 0
+# cancelled 0
+# skipped 0
+# todo 0
+# duration_ms 154.8326

agents/fethry/work/queue-266/evidence/room-check-red.tap

@@ -0,0 +1,55 @@
+TAP version 13
+# Subtest: C2-10c room.read carries exactly the thread check and current file last
+not ok 1 - C2-10c room.read carries exactly the thread check and current file last
+  ---
+  duration_ms: 68.925074
+  type: 'test'
+  location: '/home/jwoltje/.t3/worktrees/mosaic-stack/fethry-row266/packages/bus/tests/room-check.test.mjs:10:1'
+  failureType: 'testCodeFailure'
+  error: |-
+    Expected values to be strictly deep-equal:
+    + actual - expected
+
+    + undefined
+    - {
+    -   citations: [
+    -     {
+    -       agent: null,
+    -       file: 'e46ffb32a683035cf812aa05e1773ba95f2c9ee4',
+    -       last: 'e46ffb32a683035cf812aa05e1773ba95f2c9ee4',
+    -       scope: 'canon'
+    -     }
+    -   ]
+    - }
+
+  code: 'ERR_ASSERTION'
+  name: 'AssertionError'
+  expected:
+    citations:
+      0:
+        scope: 'canon'
+        agent: ~
+        file: 'e46ffb32a683035cf812aa05e1773ba95f2c9ee4'
+        last: 'e46ffb32a683035cf812aa05e1773ba95f2c9ee4'
+  operator: 'deepStrictEqual'
+  stack: |-
+    TestContext.<anonymous> (file:///home/jwoltje/.t3/worktrees/mosaic-stack/fethry-row266/packages/bus/tests/room-check.test.mjs:20:10)
+    process.processTicksAndRejections (node:internal/process/task_queues:104:5)
+    async Test.run (node:internal/test_runner/test:1409:7)
+    async startSubtestAfterBootstrap (node:internal/test_runner/harness:387:3)
+  ...
+# Subtest: C2-10c check hydration preserves unchecked rows and one broadcast with two addressees
+ok 2 - C2-10c check hydration preserves unchecked rows and one broadcast with two addressees
+  ---
+  duration_ms: 16.111117
+  type: 'test'
+  ...
+1..2
+# tests 2
+# suites 0
+# pass 1
+# fail 1
+# cancelled 0
+# skipped 0
+# todo 0
+# duration_ms 159.952195

agents/fethry/work/queue-266/evidence/room-http-final.tap

@@ -0,0 +1,52 @@
+TAP version 13
+# Subtest: C2-10c seam exposes three fixed room calls without thread.messages fanout
+ok 1 - C2-10c seam exposes three fixed room calls without thread.messages fanout
+  ---
+  duration_ms: 10.41166
+  type: 'test'
+  ...
+# Subtest: C2-10c HTTP preserves original send, member receipt and the last grouped paging id
+ok 2 - C2-10c HTTP preserves original send, member receipt and the last grouped paging id
+  ---
+  duration_ms: 11.761026
+  type: 'test'
+  ...
+# Subtest: C2-10c room write fences and strict keys reject before transport
+ok 3 - C2-10c room write fences and strict keys reject before transport
+  ---
+  duration_ms: 9.734065
+  type: 'test'
+  ...
+# Subtest: C2-10c all four room refusals are409 with fixed text, never transport prose
+ok 4 - C2-10c all four room refusals are409 with fixed text, never transport prose
+  ---
+  duration_ms: 4.365649
+  type: 'test'
+  ...
+# Subtest: C2-10c malformed/lost write receipts are unknown and never retried
+ok 5 - C2-10c malformed/lost write receipts are unknown and never retried
+  ---
+  duration_ms: 2.682212
+  type: 'test'
+  ...
+# Subtest: C2-10c room receipts reject coerced member keys and duplicate grouped ids
+ok 6 - C2-10c room receipts reject coerced member keys and duplicate grouped ids
+  ---
+  duration_ms: 2.090283
+  type: 'test'
+  ...
+# Subtest: C2-10c granted-user room calls never borrow the owner transport
+ok 7 - C2-10c granted-user room calls never borrow the owner transport
+  ---
+  duration_ms: 0.625202
+  type: 'test'
+  ...
+1..7
+# tests 7
+# suites 0
+# pass 7
+# fail 0
+# cancelled 0
+# skipped 0
+# todo 0
+# duration_ms 144.565659

agents/fethry/work/queue-266/evidence/room-http-green.tap

@@ -0,0 +1,40 @@
+TAP version 13
+# Subtest: C2-10c seam exposes three fixed room calls without thread.messages fanout
+ok 1 - C2-10c seam exposes three fixed room calls without thread.messages fanout
+  ---
+  duration_ms: 9.140924
+  type: 'test'
+  ...
+# Subtest: C2-10c HTTP preserves original send, member receipt and the last grouped paging id
+ok 2 - C2-10c HTTP preserves original send, member receipt and the last grouped paging id
+  ---
+  duration_ms: 10.424582
+  type: 'test'
+  ...
+# Subtest: C2-10c room write fences and strict keys reject before transport
+ok 3 - C2-10c room write fences and strict keys reject before transport
+  ---
+  duration_ms: 9.318333
+  type: 'test'
+  ...
+# Subtest: C2-10c all four room refusals are409 with fixed text, never transport prose
+ok 4 - C2-10c all four room refusals are409 with fixed text, never transport prose
+  ---
+  duration_ms: 3.458143
+  type: 'test'
+  ...
+# Subtest: C2-10c malformed/lost write receipts are unknown and never retried
+ok 5 - C2-10c malformed/lost write receipts are unknown and never retried
+  ---
+  duration_ms: 3.395395
+  type: 'test'
+  ...
+1..5
+# tests 5
+# suites 0
+# pass 5
+# fail 0
+# cancelled 0
+# skipped 0
+# todo 0
+# duration_ms 135.694931

agents/fethry/work/queue-266/evidence/room-http-red.tap

@@ -0,0 +1,127 @@
+TAP version 13
+# Subtest: C2-10c seam exposes three fixed room calls without thread.messages fanout
+not ok 1 - C2-10c seam exposes three fixed room calls without thread.messages fanout
+  ---
+  duration_ms: 8.731172
+  type: 'test'
+  location: '/home/jwoltje/.t3/worktrees/mosaic-stack/fethry-row266/packages/webui/tests/room-http.test.mjs:34:1'
+  failureType: 'testCodeFailure'
+  error: |-
+    Expected values to be strictly equal:
+    + actual - expected
+
+    + 'undefined'
+    - 'function'
+
+  code: 'ERR_ASSERTION'
+  name: 'AssertionError'
+  expected: 'function'
+  actual: 'undefined'
+  operator: 'strictEqual'
+  stack: |-
+    TestContext.<anonymous> (file:///home/jwoltje/.t3/worktrees/mosaic-stack/fethry-row266/packages/webui/tests/room-http.test.mjs:37:12)
+    process.processTicksAndRejections (node:internal/process/task_queues:104:5)
+    async Test.run (node:internal/test_runner/test:1409:7)
+    async startSubtestAfterBootstrap (node:internal/test_runner/harness:387:3)
+  ...
+# Subtest: C2-10c HTTP preserves original send, member receipt and the last grouped paging id
+not ok 2 - C2-10c HTTP preserves original send, member receipt and the last grouped paging id
+  ---
+  duration_ms: 9.016525
+  type: 'test'
+  location: '/home/jwoltje/.t3/worktrees/mosaic-stack/fethry-row266/packages/webui/tests/room-http.test.mjs:44:1'
+  failureType: 'testCodeFailure'
+  error: |-
+    Expected values to be strictly equal:
+
+    404 !== 200
+
+  code: 'ERR_ASSERTION'
+  name: 'AssertionError'
+  expected: 200
+  actual: 404
+  operator: 'strictEqual'
+  stack: |-
+    TestContext.<anonymous> (file:///home/jwoltje/.t3/worktrees/mosaic-stack/fethry-row266/packages/webui/tests/room-http.test.mjs:48:10)
+    process.processTicksAndRejections (node:internal/process/task_queues:104:5)
+    async Test.run (node:internal/test_runner/test:1409:7)
+    async Test.processPendingSubtests (node:internal/test_runner/test:974:7)
+  ...
+# Subtest: C2-10c room write fences and strict keys reject before transport
+not ok 3 - C2-10c room write fences and strict keys reject before transport
+  ---
+  duration_ms: 3.141918
+  type: 'test'
+  location: '/home/jwoltje/.t3/worktrees/mosaic-stack/fethry-row266/packages/webui/tests/room-http.test.mjs:62:1'
+  failureType: 'testCodeFailure'
+  error: |-
+    Expected values to be strictly equal:
+
+    404 !== 400
+
+  code: 'ERR_ASSERTION'
+  name: 'AssertionError'
+  expected: 400
+  actual: 404
+  operator: 'strictEqual'
+  stack: |-
+    TestContext.<anonymous> (file:///home/jwoltje/.t3/worktrees/mosaic-stack/fethry-row266/packages/webui/tests/room-http.test.mjs:66:12)
+    process.processTicksAndRejections (node:internal/process/task_queues:104:5)
+    async Test.run (node:internal/test_runner/test:1409:7)
+    async Test.processPendingSubtests (node:internal/test_runner/test:974:7)
+  ...
+# Subtest: C2-10c all four room refusals are409 with fixed text, never transport prose
+not ok 4 - C2-10c all four room refusals are409 with fixed text, never transport prose
+  ---
+  duration_ms: 1.798433
+  type: 'test'
+  location: '/home/jwoltje/.t3/worktrees/mosaic-stack/fethry-row266/packages/webui/tests/room-http.test.mjs:75:1'
+  failureType: 'testCodeFailure'
+  error: |-
+    unknown-addressee
+
+    404 !== 409
+
+  code: 'ERR_ASSERTION'
+  name: 'AssertionError'
+  expected: 409
+  actual: 404
+  operator: 'strictEqual'
+  stack: |-
+    TestContext.<anonymous> (file:///home/jwoltje/.t3/worktrees/mosaic-stack/fethry-row266/packages/webui/tests/room-http.test.mjs:80:12)
+    process.processTicksAndRejections (node:internal/process/task_queues:104:5)
+    async Test.run (node:internal/test_runner/test:1409:7)
+    async Test.processPendingSubtests (node:internal/test_runner/test:974:7)
+  ...
+# Subtest: C2-10c malformed/lost write receipts are unknown and never retried
+not ok 5 - C2-10c malformed/lost write receipts are unknown and never retried
+  ---
+  duration_ms: 1.788338
+  type: 'test'
+  location: '/home/jwoltje/.t3/worktrees/mosaic-stack/fethry-row266/packages/webui/tests/room-http.test.mjs:85:1'
+  failureType: 'testCodeFailure'
+  error: |-
+    Expected values to be strictly equal:
+
+    404 !== 503
+
+  code: 'ERR_ASSERTION'
+  name: 'AssertionError'
+  expected: 503
+  actual: 404
+  operator: 'strictEqual'
+  stack: |-
+    TestContext.<anonymous> (file:///home/jwoltje/.t3/worktrees/mosaic-stack/fethry-row266/packages/webui/tests/room-http.test.mjs:90:12)
+    process.processTicksAndRejections (node:internal/process/task_queues:104:5)
+    async Test.run (node:internal/test_runner/test:1409:7)
+    async Test.processPendingSubtests (node:internal/test_runner/test:974:7)
+  ...
+1..5
+# tests 5
+# suites 0
+# pass 0
+# fail 5
+# cancelled 0
+# skipped 0
+# todo 0
+# duration_ms 124.767975

agents/fethry/work/queue-266/evidence/room-http-validation-red.tap

@@ -0,0 +1,69 @@
+TAP version 13
+# Subtest: C2-10c seam exposes three fixed room calls without thread.messages fanout
+ok 1 - C2-10c seam exposes three fixed room calls without thread.messages fanout
+  ---
+  duration_ms: 9.95559
+  type: 'test'
+  ...
+# Subtest: C2-10c HTTP preserves original send, member receipt and the last grouped paging id
+ok 2 - C2-10c HTTP preserves original send, member receipt and the last grouped paging id
+  ---
+  duration_ms: 11.053371
+  type: 'test'
+  ...
+# Subtest: C2-10c room write fences and strict keys reject before transport
+ok 3 - C2-10c room write fences and strict keys reject before transport
+  ---
+  duration_ms: 9.160608
+  type: 'test'
+  ...
+# Subtest: C2-10c all four room refusals are409 with fixed text, never transport prose
+ok 4 - C2-10c all four room refusals are409 with fixed text, never transport prose
+  ---
+  duration_ms: 4.022295
+  type: 'test'
+  ...
+# Subtest: C2-10c malformed/lost write receipts are unknown and never retried
+ok 5 - C2-10c malformed/lost write receipts are unknown and never retried
+  ---
+  duration_ms: 2.737076
+  type: 'test'
+  ...
+# Subtest: C2-10c room receipts reject coerced member keys and duplicate grouped ids
+not ok 6 - C2-10c room receipts reject coerced member keys and duplicate grouped ids
+  ---
+  duration_ms: 1.75248
+  type: 'test'
+  location: '/home/jwoltje/.t3/worktrees/mosaic-stack/fethry-row266/packages/webui/tests/room-http.test.mjs:95:1'
+  failureType: 'testCodeFailure'
+  error: |-
+    Expected values to be strictly equal:
+
+    200 !== 503
+
+  code: 'ERR_ASSERTION'
+  name: 'AssertionError'
+  expected: 503
+  actual: 200
+  operator: 'strictEqual'
+  stack: |-
+    TestContext.<anonymous> (file:///home/jwoltje/.t3/worktrees/mosaic-stack/fethry-row266/packages/webui/tests/room-http.test.mjs:99:10)
+    process.processTicksAndRejections (node:internal/process/task_queues:104:5)
+    async Test.run (node:internal/test_runner/test:1409:7)
+    async Test.processPendingSubtests (node:internal/test_runner/test:974:7)
+  ...
+# Subtest: C2-10c granted-user room calls never borrow the owner transport
+ok 7 - C2-10c granted-user room calls never borrow the owner transport
+  ---
+  duration_ms: 0.878763
+  type: 'test'
+  ...
+1..7
+# tests 7
+# suites 0
+# pass 6
+# fail 1
+# cancelled 0
+# skipped 0
+# todo 0
+# duration_ms 141.250822

agents/fethry/work/queue-266/evidence/scripts-summary.json

@@ -0,0 +1,146 @@
+[
+  {
+    "step": "test-auth",
+    "command": [
+      "bash",
+      "/home/jwoltje/.t3/worktrees/mosaic-stack/fethry-row266/scripts/test-auth.sh"
+    ],
+    "cwd": "/home/jwoltje/.t3/worktrees/mosaic-stack/fethry-row266",
+    "outerSeconds": 1200,
+    "exit": 0,
+    "seconds": 0.866,
+    "cleanupSignals": []
+  },
+  {
+    "step": "test-conductor",
+    "command": [
+      "bash",
+      "/home/jwoltje/.t3/worktrees/mosaic-stack/fethry-row266/scripts/test-conductor.sh"
+    ],
+    "cwd": "/home/jwoltje/.t3/worktrees/mosaic-stack/fethry-row266",
+    "outerSeconds": 1200,
+    "exit": 0,
+    "seconds": 7.53,
+    "cleanupSignals": []
+  },
+  {
+    "step": "test-config",
+    "command": [
+      "bash",
+      "/home/jwoltje/.t3/worktrees/mosaic-stack/fethry-row266/scripts/test-config.sh"
+    ],
+    "cwd": "/home/jwoltje/.t3/worktrees/mosaic-stack/fethry-row266",
+    "outerSeconds": 1200,
+    "exit": 0,
+    "seconds": 2.72,
+    "cleanupSignals": []
+  },
+  {
+    "step": "test-discord",
+    "command": [
+      "bash",
+      "/home/jwoltje/.t3/worktrees/mosaic-stack/fethry-row266/scripts/test-discord.sh"
+    ],
+    "cwd": "/home/jwoltje/.t3/worktrees/mosaic-stack/fethry-row266",
+    "outerSeconds": 1200,
+    "exit": 0,
+    "seconds": 8.131,
+    "cleanupSignals": []
+  },
+  {
+    "step": "test-extension-package",
+    "command": [
+      "bash",
+      "/home/jwoltje/.t3/worktrees/mosaic-stack/fethry-row266/scripts/test-extension-package.sh"
+    ],
+    "cwd": "/home/jwoltje/.t3/worktrees/mosaic-stack/fethry-row266",
+    "outerSeconds": 1200,
+    "exit": 0,
+    "seconds": 1.467,
+    "cleanupSignals": []
+  },
+  {
+    "step": "test-federation-acceptance",
+    "command": [
+      "bash",
+      "/home/jwoltje/.t3/worktrees/mosaic-stack/fethry-row266/scripts/test-federation-acceptance.sh"
+    ],
+    "cwd": "/home/jwoltje/.t3/worktrees/mosaic-stack/fethry-row266",
+    "outerSeconds": 1200,
+    "exit": 0,
+    "seconds": 3.972,
+    "cleanupSignals": []
+  },
+  {
+    "step": "test-foundation",
+    "command": [
+      "bash",
+      "/home/jwoltje/.t3/worktrees/mosaic-stack/fethry-row266/scripts/test-foundation.sh"
+    ],
+    "cwd": "/home/jwoltje/.t3/worktrees/mosaic-stack/fethry-row266",
+    "outerSeconds": 1200,
+    "exit": 0,
+    "seconds": 38.592,
+    "cleanupSignals": []
+  },
+  {
+    "step": "test-land-work",
+    "command": [
+      "bash",
+      "/home/jwoltje/.t3/worktrees/mosaic-stack/fethry-row266/scripts/test-land-work.sh"
+    ],
+    "cwd": "/home/jwoltje/.t3/worktrees/mosaic-stack/fethry-row266",
+    "outerSeconds": 1200,
+    "exit": 0,
+    "seconds": 12.039,
+    "cleanupSignals": []
+  },
+  {
+    "step": "test-push-check",
+    "command": [
+      "bash",
+      "/home/jwoltje/.t3/worktrees/mosaic-stack/fethry-row266/scripts/test-push-check.sh"
+    ],
+    "cwd": "/home/jwoltje/.t3/worktrees/mosaic-stack/fethry-row266",
+    "outerSeconds": 1200,
+    "exit": 0,
+    "seconds": 38.944,
+    "cleanupSignals": []
+  },
+  {
+    "step": "test-queue",
+    "command": [
+      "bash",
+      "/home/jwoltje/.t3/worktrees/mosaic-stack/fethry-row266/scripts/test-queue.sh"
+    ],
+    "cwd": "/home/jwoltje/.t3/worktrees/mosaic-stack/fethry-row266",
+    "outerSeconds": 1200,
+    "exit": 0,
+    "seconds": 21.708,
+    "cleanupSignals": []
+  },
+  {
+    "step": "test-release",
+    "command": [
+      "bash",
+      "/home/jwoltje/.t3/worktrees/mosaic-stack/fethry-row266/scripts/test-release.sh"
+    ],
+    "cwd": "/home/jwoltje/.t3/worktrees/mosaic-stack/fethry-row266",
+    "outerSeconds": 1200,
+    "exit": 0,
+    "seconds": 2.92,
+    "cleanupSignals": []
+  },
+  {
+    "step": "test-task",
+    "command": [
+      "bash",
+      "/home/jwoltje/.t3/worktrees/mosaic-stack/fethry-row266/scripts/test-task.sh"
+    ],
+    "cwd": "/home/jwoltje/.t3/worktrees/mosaic-stack/fethry-row266",
+    "outerSeconds": 1200,
+    "exit": 0,
+    "seconds": 13.793,
+    "cleanupSignals": []
+  }
+]

agents/fethry/work/queue-266/evidence/t9-rerun-1.tap

@@ -0,0 +1,46 @@
+TAP version 13
+# Subtest: C2-03b T6: the slot before any chief evidence, then the listed chief's live grant
+ok 1 - C2-03b T6: the slot before any chief evidence, then the listed chief's live grant
+  ---
+  duration_ms: 27.654269
+  type: 'test'
+  ...
+# Subtest: C2-03b T7: a chief revoked through grants.revoke or fired through instance.fire refuses, and the fallback stays ended
+ok 2 - C2-03b T7: a chief revoked through grants.revoke or fired through instance.fire refuses, and the fallback stays ended
+  ---
+  duration_ms: 293.65964
+  type: 'test'
+  ...
+# Subtest: C2-03b T7 choice checks: delisted, a fire under way and held each refuse; a rehire lists the chief again
+ok 3 - C2-03b T7 choice checks: delisted, a fire under way and held each refuse; a rehire lists the chief again
+  ---
+  duration_ms: 34.60293
+  type: 'test'
+  ...
+# Subtest: C2-03b T8: a chief grant on another project ends the fallback, and two listed chiefs refuse library-fetch-no-grant
+ok 4 - C2-03b T8: a chief grant on another project ends the fallback, and two listed chiefs refuse library-fetch-no-grant
+  ---
+  duration_ms: 30.656128
+  type: 'test'
+  ...
+# Subtest: C2-03b departure (sage-2928): with no chief entry, any Gitea grant evidence refuses
+ok 5 - C2-03b departure (sage-2928): with no chief entry, any Gitea grant evidence refuses
+  ---
+  duration_ms: 16.276807
+  type: 'test'
+  ...
+# Subtest: C2-03b T9 runtime: the chief's store file and user, then a real revoke that runs no git with the slot at 0000
+ok 6 - C2-03b T9 runtime: the chief's store file and user, then a real revoke that runs no git with the slot at 0000
+  ---
+  duration_ms: 789.168747
+  type: 'test'
+  ...
+1..6
+# tests 6
+# suites 0
+# pass 6
+# fail 0
+# cancelled 0
+# skipped 0
+# todo 0
+# duration_ms 1315.368631

agents/fethry/work/queue-266/evidence/t9-rerun-2.tap

@@ -0,0 +1,46 @@
+TAP version 13
+# Subtest: C2-03b T6: the slot before any chief evidence, then the listed chief's live grant
+ok 1 - C2-03b T6: the slot before any chief evidence, then the listed chief's live grant
+  ---
+  duration_ms: 27.978617
+  type: 'test'
+  ...
+# Subtest: C2-03b T7: a chief revoked through grants.revoke or fired through instance.fire refuses, and the fallback stays ended
+ok 2 - C2-03b T7: a chief revoked through grants.revoke or fired through instance.fire refuses, and the fallback stays ended
+  ---
+  duration_ms: 304.610774
+  type: 'test'
+  ...
+# Subtest: C2-03b T7 choice checks: delisted, a fire under way and held each refuse; a rehire lists the chief again
+ok 3 - C2-03b T7 choice checks: delisted, a fire under way and held each refuse; a rehire lists the chief again
+  ---
+  duration_ms: 33.464243
+  type: 'test'
+  ...
+# Subtest: C2-03b T8: a chief grant on another project ends the fallback, and two listed chiefs refuse library-fetch-no-grant
+ok 4 - C2-03b T8: a chief grant on another project ends the fallback, and two listed chiefs refuse library-fetch-no-grant
+  ---
+  duration_ms: 30.002925
+  type: 'test'
+  ...
+# Subtest: C2-03b departure (sage-2928): with no chief entry, any Gitea grant evidence refuses
+ok 5 - C2-03b departure (sage-2928): with no chief entry, any Gitea grant evidence refuses
+  ---
+  duration_ms: 16.524439
+  type: 'test'
+  ...
+# Subtest: C2-03b T9 runtime: the chief's store file and user, then a real revoke that runs no git with the slot at 0000
+ok 6 - C2-03b T9 runtime: the chief's store file and user, then a real revoke that runs no git with the slot at 0000
+  ---
+  duration_ms: 754.840215
+  type: 'test'
+  ...
+1..6
+# tests 6
+# suites 0
+# pass 6
+# fail 0
+# cancelled 0
+# skipped 0
+# todo 0
+# duration_ms 1293.310491

agents/fethry/work/queue-266/evidence/t9-rerun-3.tap

@@ -0,0 +1,46 @@
+TAP version 13
+# Subtest: C2-03b T6: the slot before any chief evidence, then the listed chief's live grant
+ok 1 - C2-03b T6: the slot before any chief evidence, then the listed chief's live grant
+  ---
+  duration_ms: 34.452051
+  type: 'test'
+  ...
+# Subtest: C2-03b T7: a chief revoked through grants.revoke or fired through instance.fire refuses, and the fallback stays ended
+ok 2 - C2-03b T7: a chief revoked through grants.revoke or fired through instance.fire refuses, and the fallback stays ended
+  ---
+  duration_ms: 299.162474
+  type: 'test'
+  ...
+# Subtest: C2-03b T7 choice checks: delisted, a fire under way and held each refuse; a rehire lists the chief again
+ok 3 - C2-03b T7 choice checks: delisted, a fire under way and held each refuse; a rehire lists the chief again
+  ---
+  duration_ms: 35.484814
+  type: 'test'
+  ...
+# Subtest: C2-03b T8: a chief grant on another project ends the fallback, and two listed chiefs refuse library-fetch-no-grant
+ok 4 - C2-03b T8: a chief grant on another project ends the fallback, and two listed chiefs refuse library-fetch-no-grant
+  ---
+  duration_ms: 31.417755
+  type: 'test'
+  ...
+# Subtest: C2-03b departure (sage-2928): with no chief entry, any Gitea grant evidence refuses
+ok 5 - C2-03b departure (sage-2928): with no chief entry, any Gitea grant evidence refuses
+  ---
+  duration_ms: 16.905839
+  type: 'test'
+  ...
+# Subtest: C2-03b T9 runtime: the chief's store file and user, then a real revoke that runs no git with the slot at 0000
+ok 6 - C2-03b T9 runtime: the chief's store file and user, then a real revoke that runs no git with the slot at 0000
+  ---
+  duration_ms: 766.473551
+  type: 'test'
+  ...
+1..6
+# tests 6
+# suites 0
+# pass 6
+# fail 0
+# cancelled 0
+# skipped 0
+# todo 0
+# duration_ms 1302.772185

agents/fethry/work/queue-266/evidence/test-auth.tap

@@ -0,0 +1,17 @@
+OK    status with missing harness credential exits 3 and still lists accounts
+OK    status reports harness credential (read-only) + mosaic accounts
+OK    api key material never reaches output
+OK    oauth token material never reaches output
+OK    unparseable credential file exits 2
+OK    symlinked credential file exits 4
+OK    env-side credential names reported
+OK    env var values never reach output
+OK    accounts without an accounts dir reports none and creates nothing
+OK    accounts lists files and marks the active one
+OK    loose account perms flagged in listing
+OK    agent --auth with missing account file refuses (exit 4)
+OK    agent --auth with non-0600 account file refuses
+OK    agent --auth with invalid account name refuses
+OK    auth.sh without valid config refuses
+
+selftest: 15 passed, 0 failed

agents/fethry/work/queue-266/evidence/test-conductor.tap

@@ -0,0 +1,23 @@
+On branch fethry/row266
+Your branch is up to date with 'origin/fethry/row266'.
+
+nothing to commit, working tree clean
+OK    dry-run: allowed change, exit 0, nothing committed (exit 0)
+OK    dry-run committed nothing
+OK    apply: allowed change exits 0 (exit 0)
+OK    apply: attribution in commit subject
+OK    apply: target tree clean after commit
+OK    disallowed path refused (exit 1)
+OK    disallowed path: target untouched
+OK    syntax gate refused broken .mjs (exit 1)
+OK    syntax gate: target untouched
+OK    suite failure refused (exit 1)
+OK    suite failure: target reverted to clean
+OK    disabled policy refused (exit 2)
+OK    disabled policy: target untouched
+OK    failed run refused (exit 1)
+OK    failed run: target untouched
+OK    missing run exits 4 (exit 4)
+OK    invalid policy exits 2 (exit 2)
+
+selftest: 17 passed, 0 failed

agents/fethry/work/queue-266/evidence/test-config.tap

@@ -0,0 +1,57 @@
+OK    absent adapter defaults to pi
+OK    adapter mock validates (exit 0)
+OK    unsupported adapter exits 2 (exit 2)
+OK    env exports adapter
+OK    bootstrap creates default when absent (exit 0)
+OK    bootstrap wrote config file
+OK    bootstrap is idempotent on existing config (exit 0)
+OK    bootstrap did not rewrite existing config
+OK    validate missing config exits 3 (exit 3)
+OK    malformed JSON exits 2 (exit 2)
+OK    unsupported configVersion exits 2 (exit 2)
+OK    unknown top-level key exits 2 (exit 2)
+OK    unknown execution key exits 2 (exit 2)
+OK    unsupported backend exits 2 (exit 2)
+OK    unsupported environment exits 2 (exit 2)
+OK    relative dataRoot exits 2 (exit 2)
+OK    non-canonical dataRoot exits 2 (exit 2)
+OK    filesystem root dataRoot exits 2 (exit 2)
+OK    home directory dataRoot exits 2 (exit 2)
+OK    dataRoot containing config dir exits 2 (exit 2)
+OK    control character in provider exits 2 (exit 2)
+OK    symlinked config file exits 2 (exit 2)
+OK    env exports resolve correctly
+OK    valid console.sso loads and is in the output
+OK    console.sso HS256 alg exits 2 naming the path (exit 2)
+OK    console.sso alg none exits 2 naming the path (exit 2)
+OK    console.sso missing slot field exits 2 naming the path (exit 2)
+OK    console.sso slot name outside the pattern exits 2 naming the path (exit 2)
+OK    unknown key under console exits 2 naming the path (exit 2)
+OK    valid federation key loads and is in the output
+OK    federation unknown sub-key exits 2 naming the key (exit 2)
+OK    federation peer unknown sub-key exits 2 naming the key (exit 2)
+OK    federation peer origin over http exits 2 naming the key (exit 2)
+OK    federation peer origin with a path exits 2 naming the key (exit 2)
+OK    federation peer origin with userinfo exits 2 naming the key (exit 2)
+OK    federation peer id equal to self exits 2 naming the key (exit 2)
+OK    federation peer label empty exits 2 naming the key (exit 2)
+OK    federation not an object exits 2 naming the key (exit 2)
+OK    federation self pattern exits 2 naming the key (exit 2)
+OK    federation peers not an array exits 2 naming the key (exit 2)
+OK    federation peer not an object exits 2 naming the key (exit 2)
+OK    federation peer id pattern exits 2 naming the key (exit 2)
+OK    federation peer label over 80 characters exits 2 naming the key (exit 2)
+OK    federation duplicate peer id exits 2 naming the key (exit 2)
+OK    federation peer origin with a trailing slash exits 2 naming the key (exit 2)
+OK    federation self missing exits 2 naming the key (exit 2)
+OK    federation peer id missing exits 2 naming the key (exit 2)
+OK    federation peer label missing exits 2 naming the key (exit 2)
+OK    config without federation loads and has no federation output
+OK    config without console loads with unchanged output
+OK    compactionReadBytes 8388608 loads and is in the output as written
+OK    compactionReadBytes "x" loads and is in the output as written
+OK    compactionStreams 2048 loads and is in the output as written
+OK    compactionStreams "x" loads and is in the output as written
+OK    failed validation modified nothing
+
+selftest: 55 passed, 0 failed

agents/fethry/work/queue-266/evidence/test-discord.tap

@@ -0,0 +1,86 @@
+toolchain: node v26.8.1
+
+OK    syntax: packages/discord/src/approvals.mjs
+OK    syntax: packages/discord/src/authorize.mjs
+OK    syntax: packages/discord/src/binding.mjs
+OK    syntax: packages/discord/src/cli.mjs
+OK    syntax: packages/discord/src/connector.mjs
+OK    syntax: packages/discord/src/context.mjs
+OK    syntax: packages/discord/src/engine-pi.mjs
+OK    syntax: packages/discord/src/errors.mjs
+OK    syntax: packages/discord/src/gateway.mjs
+OK    syntax: packages/discord/src/git.mjs
+OK    syntax: packages/discord/src/journal.mjs
+OK    syntax: packages/discord/src/notify.mjs
+OK    syntax: packages/discord/src/processing.mjs
+OK    syntax: packages/discord/src/rest.mjs
+OK    syntax: packages/discord/src/setspark.mjs
+OK    syntax: packages/discord/src/tools.mjs
+OK    syntax: packages/discord/src/web.mjs
+OK    syntax: packages/discord/bin/git-credential.mjs
+OK    syntax: packages/discord/extension/tools.mjs
+OK    syntax: packages/discord/tests/approvals.test.mjs
+OK    syntax: packages/discord/tests/authorize.test.mjs
+OK    syntax: packages/discord/tests/binding.test.mjs
+OK    syntax: packages/discord/tests/connector.test.mjs
+OK    syntax: packages/discord/tests/context.test.mjs
+OK    syntax: packages/discord/tests/copy-service.test.mjs
+OK    syntax: packages/discord/tests/engine.test.mjs
+OK    syntax: packages/discord/tests/fake-pi.mjs
+OK    syntax: packages/discord/tests/gateway.test.mjs
+OK    syntax: packages/discord/tests/git.test.mjs
+OK    syntax: packages/discord/tests/helpers.mjs
+OK    syntax: packages/discord/tests/journal.test.mjs
+OK    syntax: packages/discord/tests/library-seat.test.mjs
+OK    syntax: packages/discord/tests/notify.test.mjs
+OK    syntax: packages/discord/tests/offline-check.test.mjs
+OK    syntax: packages/discord/tests/processing-stop.test.mjs
+OK    syntax: packages/discord/tests/processing.test.mjs
+OK    syntax: packages/discord/tests/recover.test.mjs
+OK    syntax: packages/discord/tests/rest.test.mjs
+OK    syntax: packages/discord/tests/setspark.test.mjs
+OK    syntax: packages/discord/tests/tools.test.mjs
+OK    syntax: packages/discord/tests/web.test.mjs
+OK    syntax: packages/discord/fixtures/claim-worker.mjs
+OK    syntax: packages/discord/fixtures/legacy-owner-worker.mjs
+OK    syntax: scripts/discord.sh
+OK    syntax: scripts/discord-service.sh
+OK    packages/discord declares no dependencies
+OK    no bot-token-shaped string in packages/discord
+OK    fixture binding uses placeholder ids only
+OK    fixture binding validates
+OK    real pi with the extension exposes exactly list_dir, read_file, search and no built-in tool
+OK    real pi with a writable root exposes exactly the three reads plus write_file and edit_file, and writes nothing at start
+OK    real pi with a web key exposes the three reads plus web_fetch and web_search, and no write tool without a writable root
+OK    real pi with a git root exposes the reads, writes and the four git verbs, commits nothing at start, and never shows the token
+OK    real pi with protocol vault adds reserve_id to the git verbs
+OK    real pi with a setspark key exposes the reads and the eight record verbs, no counters, and never shows the key
+OK    real pi refuses a git key on a read-only root (fail closed)
+OK    real pi with the pilot flags (--no-tools) exposes no tool at all
+OK    real pi exits non-zero without MOSAIC_DISCORD_TOOLS: no session, no tools (fail closed)
+OK    a failing nested test fails the run under a parent runner's NODE_TEST_CONTEXT
+OK    node --test packages/discord/tests/ (ℹ pass 200)
+OK    scripts/discord.sh --help exits 0
+OK    scripts/discord.sh check without a binding exits 4
+OK    scripts/discord.sh recover without a binding exits 4
+OK    scripts/discord.sh reload without a binding exits 4
+OK    scripts/discord-service.sh without a command exits 4
+OK    service unit renders with the repository path, a supervised run as the main process, exit 3 never retried, and reload as SIGHUP
+OK    service install writes the rendered unit (0644) and leaves no temp file
+OK    service install a second time reports unchanged
+OK    systemd-analyze verify accepts the rendered unit
+OK    service uninstall removes the unit file
+OK    service install with an unknown flag exits 4
+OK    service install with USER unset finishes and names the account for lingering
+OK    pinned render runs copy CLI with copy cwd/repo and no checkout executable
+OK    pinned install writes the rendered unit in a temporary unit directory
+OK    pinned install refuses short prerequisite and writes no unit
+OK    pinned install refuses missing prerequisite and writes no unit
+OK    pinned install refuses cli prerequisite and writes no unit
+OK    pinned install refuses pi prerequisite and writes no unit
+OK    status names the copy from fake systemctl effective cwd
+OK    checkout install explicitly recommends --copy
+OK    wrapper check --offline passes local fixture and makes no network call
+OK    wrapper run --offline refuses usage
+
+discord suite: 82 passed, 0 failed

agents/fethry/work/queue-266/evidence/test-extension-package.tap

@@ -0,0 +1,21 @@
+OK    initial ordinary-file install
+OK    installed tree matches canonical source
+OK    installed tree has no symlinks
+OK    check detects installation drift
+OK    sync refuses to overwrite installation drift
+OK    check detects an extra destination file
+OK    check detects an extra destination directory
+OK    check rejects a destination symlink
+OK    sync accepts a canonical source update
+OK    updated installation matches canonical source
+/home/jwoltje/.t3/worktrees/mosaic-stack/fethry-row266/scripts/test-extension-package.sh: line 14: 2236844 Killed                     "$@" > /dev/null 2>&1
+OK    forced interruption kills the replacing process
+OK    next invocation recovers old consistent installation
+OK    interrupted replacement rolled back
+OK    sync succeeds after interruption recovery
+OK    unlocked stale lock file does not block
+OK    active lock refuses a concurrent sync
+OK    source symlink fails closed
+OK    nested second entrypoint fails closed
+
+extension package selftest: 18 passed, 0 failed

agents/fethry/work/queue-266/evidence/test-federation-acceptance.tap

@@ -0,0 +1,10 @@
+✔ FED R7 scratch two-instance acceptance (3582.728896ms)
+ℹ tests 1
+ℹ suites 0
+ℹ pass 1
+ℹ fail 0
+ℹ cancelled 0
+ℹ skipped 0
+ℹ todo 0
+ℹ duration_ms 3676.59229
+R7 cleanup: no child groups, ports or sockets remain; no units created

agents/fethry/work/queue-266/evidence/test-foundation.tap

@@ -0,0 +1,53 @@
+toolchain: node v26.8.1, python 3.12.8, jsonschema 4.26.0
+
+OK    syntax: scripts/foundation-inspect.mjs
+OK    syntax: scripts/foundation/strict-json.mjs
+OK    syntax: scripts/foundation/canonical.mjs
+OK    syntax: scripts/foundation/resolve.mjs
+OK    syntax: scripts/foundation/validate-record.mjs
+OK    syntax: scripts/foundation/fixtures/build-fixtures.mjs
+OK    syntax: scripts/foundation/canonical.test.mjs
+OK    syntax: scripts/foundation/cli.test.mjs
+OK    syntax: scripts/foundation/fixtures.test.mjs
+OK    syntax: scripts/foundation/resolve.test.mjs
+OK    syntax: scripts/foundation/strict-json.test.mjs
+OK    syntax: scripts/foundation/verify-schema.py (ast only; no bytecode written)
+OK    fixture generator runs
+OK    checked-in fixtures/bundles equal a fresh generation
+OK    checked-in fixtures/raw equal a fresh generation
+OK    checked-in fixtures/index.json equal a fresh generation
+OK    checked-in demo bundles equal a fresh generation
+OK    a failing nested test fails the run under a parent runner's NODE_TEST_CONTEXT
+OK    node --test scripts/foundation/ (ℹ pass 80)
+OK    differential schema oracle: PASS: differential schema oracle (finite corpus; compatibility evidence, not equivalence proof)
+      platform witness: strftime('%Y') for year 999 -> '999' (pinned checker refuses years 0001..0999)
+      node v26.8.1; corpus 1568 records (38 pinned fixtures, 478 unique bundle records, 1052 typeCase/mutation/lexical cases)
+      schema column: agree-valid 540, agree-invalid 991, DISAGREEMENTS 0; strict-only (parser-bound) cases: 27; unsupported-kind records not schema-assessed by the inspector: 10
+      profile column (schema-valid records only): profile-valid 510, profile-invalid 30
+      profile refusals asserted: 30 schema-agreed-valid records refused only by the strict typed-string profile (rule profile-pattern-mismatch), 12 declared by name; 73 named probes verified against declared schema/profile columns
+OK    oracle: zero schema-column disagreements with the pinned checker
+OK    oracle: strict-only profile refusals are counted and asserted
+OK    demo: permitted read preview exits 0 (exit 0)
+OK    demo: permitted file.change preview exits 0 (exit 0)
+OK    demo: assignment.change proposal is unresolved (exit 3) (exit 3)
+OK    demo: revoked registration is refused (exit 3) (exit 3)
+OK    demo: message is not authority (exit 3) (exit 3)
+OK    usage: no arguments exits 2 (exit 2)
+OK    io: missing file exits 4 (exit 4)
+OK    io: directory exits 4 (exit 4)
+OK    io: symlink exits 4 (O_NOFOLLOW) (exit 4)
+OK    bound: oversize fixture exits 2 (exit 2)
+OK    profile: one final LF in a typed selection id is refused before admission (exit 2) (exit 2)
+OK    profile: two final LFs fail the schema pattern itself (exit 2) (exit 2)
+OK    profile: escaped newlines in free-form text stay allowed (exit 0) (exit 0)
+OK    profile refusal is invalid-request/profile-pattern-mismatch with selection and operation withheld, value not echoed
+OK    text output starts with the disclaimer
+OK    json output is valid JSON with result allowed and exactly the charter §7 fields
+OK    json golden matches byte-for-byte
+OK    sandboxed bundle run (env -i, PATH=/nonexistent) produced the unresolved proposal
+OK    sandbox inventory (path/type/size/mode/uid/gid/inode/mtime/sha256) unchanged by runs
+OK    canary never printed (bundle run and credential-file run)
+OK    a non-bundle JSON file is refused at the shape gate, not read into output
+OK    no field of the non-bundle file is echoed
+
+selftest: 44 passed, 0 failed

agents/fethry/work/queue-266/evidence/test-land-work.tap

@@ -0,0 +1,88 @@
+OK    args: exit 2, target-branch
+OK    args: exit 2, target-branch
+OK    args: exit 4
+OK    args: exit 4
+OK    args: exit 4
+OK    --base next refuses before the config is read (got 2)
+OK    a missing system config exits 3 (got 3)
+OK    nobus: exit 3
+OK    schema-table: exit 2, bus-schema
+OK    schema-meta: exit 2, bus-schema
+OK    openBus opens the database read-only
+OK    other-business: exit 2, decision-not-found
+OK    no-raise: exit 2, decision-not-found
+OK    not-a-merge: exit 2, not-a-merge
+OK    open: exit 2, not-resolved
+OK    withdrawn: exit 2, not-resolved
+OK    by-agent: exit 2, not-human
+OK    via-webui: exit 2, not-human
+OK    no-answer: exit 2, not-human
+OK    answer-role: exit 2, not-human
+OK    answer-run: exit 2, not-human
+OK    answer-choice: exit 2, not-human
+OK    two-answers: exit 2, not-human
+OK    arbiter-cross: exit 2, not-human
+OK    arbiter-cited: exit 2, not-human
+OK    chose-no: exit 2, not-merge-option
+OK    two-refs: exit 2, work-ref
+OK    bad-ref: exit 2, work-ref
+OK    task-ref-disagrees: exit 2, work-ref
+OK    raise-task-disagrees: exit 2, work-ref
+OK    target-main: exit 2, target-branch
+OK    superseded-question: exit 2, superseded
+OK    superseded-task: exit 2, superseded
+OK    superseded-by: exit 2, superseded
+OK    no-verdict: exit 2, no-verdict
+OK    changes-later: exit 2, not-approved
+OK    short-commit: exit 2, not-approved
+OK    wrong-task-body: exit 2, not-approved
+OK    args: exit 2, decision-not-found
+OK    earlier-merge: exit 0
+OK    ref-moved: exit 2, ref-moved
+OK    root-top: exit 2, root-file
+OK    root-newdir: exit 2, root-file
+OK    root-src: exit 2, root-file
+OK    unrelated: exit 2, base-conflict
+OK    empty: exit 2, base-conflict
+OK    an empty reviewed diff says so
+OK    dirty-changed: exit 2, checkout-dirty
+OK    dirty-staged: exit 2, checkout-dirty
+OK    dirty-untracked: exit 2, checkout-dirty
+OK    conflict: exit 2, base-conflict
+OK    a refusal after the worktree is added leaves no worktree or scratch
+OK    cleanup looks for the worktree's Docker network
+OK    dirty-during: exit 2, checkout-dirty
+OK    a reviewed path dirtied during the gate moves no ref
+OK    drift: exit 2, patch-drift
+OK    patch-drift leaves no worktree or scratch
+OK    gate-pkg: exit 2, gate-failed
+OK    gate-failed names the failing step's log, and it exists
+OK    gate-failed leaves no worktree or scratch
+OK    gate-script: exit 2, gate-failed
+OK    a failing scripts/test-*.sh fails the gate
+OK    a failed gate moves no ref
+OK    nomods: exit 4
+OK    a target without node_modules leaves no worktree or scratch
+OK    moved: exit 2, base-moved
+OK    base-moved keeps the base where it moved to
+OK    dry: exit 0
+OK    --dry-run writes no ref
+OK    --dry-run prints the commit with --subject and --attribution
+OK    --dry-run runs the gate
+OK    --dry-run leaves no worktree or scratch
+OK    land: exit 0
+OK    the landing is one commit on the old base
+OK    its diff is the reviewed diff by patch-id
+OK    its tree is the dry run's
+OK    the message has the option's subject, the citations and the attribution last
+OK    it prints the line for the PM
+OK    the checked-out base has the reviewed paths and keeps the unrelated edit
+OK    only refs/heads/refactor exists in the target
+OK    the work ref is unchanged
+OK    the bus database is unchanged
+OK    the gate ran each package suite but queue, and each scripts/test-*.sh
+OK    the landing leaves no worktree or scratch
+OK    the target's node_modules is still there, with its contents
+OK    the worktree's Docker network is removed
+---
+land-work selftests: 86 passed, 0 failed

agents/fethry/work/queue-266/evidence/test-push-check.tap

@@ -0,0 +1,7 @@
+PASS push-check 38 checks
+KILLED skip-hash
+KILLED accept-changes
+KILLED earlier-round
+KILLED working-tree
+KILLED no-row
+KILLED skip-nul-scan

agents/fethry/work/queue-266/evidence/test-queue.tap

@@ -0,0 +1,36 @@
+toolchain: node v26.8.1, git version 2.55.0
+
+OK    syntax: packages/queue/src/cli.mjs
+OK    syntax: packages/queue/src/errors.mjs
+OK    syntax: packages/queue/src/io.mjs
+OK    syntax: packages/queue/src/lock.mjs
+OK    syntax: packages/queue/src/queue.mjs
+OK    syntax: packages/queue/src/review.mjs
+OK    syntax: packages/queue/src/store.mjs
+OK    syntax: packages/queue/tests/commit.test.mjs
+OK    syntax: packages/queue/tests/data.test.mjs
+OK    syntax: packages/queue/tests/dispatch.test.mjs
+OK    syntax: packages/queue/tests/gate-owner.test.mjs
+OK    syntax: packages/queue/tests/helpers.mjs
+OK    syntax: packages/queue/tests/lock.test.mjs
+OK    syntax: packages/queue/tests/migration.test.mjs
+OK    syntax: packages/queue/tests/review.test.mjs
+OK    syntax: packages/queue/tests/store.test.mjs
+OK    syntax: packages/queue/tests/write.test.mjs
+OK    syntax: packages/queue/tests/fixtures/fake-gitea.mjs
+OK    syntax: packages/queue/tests/fixtures/kill-at.mjs
+OK    syntax: packages/queue/tests/fixtures/lock-child.mjs
+OK    syntax: packages/queue/tests/fixtures/mosaic-pre-a2.sh
+OK    syntax: scripts/queue-commit.sh
+OK    syntax: scripts/git-hooks/pre-commit
+OK    syntax: scripts/mosaic
+OK    queue-commit.sh, the guard and scripts/mosaic are executable
+OK    packages/queue declares no dependencies
+ℹ tests 156
+ℹ pass 156
+ℹ fail 0
+OK    node --test packages/queue/tests/
+OK    scripts/mosaic queue help
+skip  queue verify and render --check: this checkout (/home/jwoltje/.t3/worktrees/mosaic-stack/fethry-row266) is not the queue's canonical root (/mnt/storage/src/mosaic-stack)
+
+queue suite: 28 passed, 0 failed

agents/fethry/work/queue-266/evidence/test-release.tap

@@ -0,0 +1,17 @@
+OK    valid RELEASE resolves (exit 0)
+OK    invalid RELEASE exits 1 (exit 1)
+OK    missing RELEASE exits 1 (exit 1)
+OK    valid RELEASE leaves image tag consistent with version
+OK    status safe on empty state (exit 0)
+OK    status created no pointer
+OK    fault-injected activation refuses (exit 1)
+OK    refused activation wrote no pointer
+OK    refusal logged exactly once with valid fields
+OK    healthy activation succeeds (exit 0)
+OK    pointer written with valid fields
+OK    repeat activation succeeds (log grows) (exit 0)
+OK    log is append-only across activations
+OK    rollback without previous refuses (exit 1)
+OK    compose network made under the run's project and removed after the run
+
+selftest: 15 passed, 0 failed

agents/fethry/work/queue-266/evidence/test-task.tap

@@ -0,0 +1,97 @@
+OK    valid task validates (exit 0)
+OK    unknown task key exits 2 (exit 2)
+OK    unsupported taskVersion exits 2 (exit 2)
+OK    invalid task id exits 2 (exit 2)
+OK    empty prompt exits 2 (exit 2)
+OK    NUL in expectExact exits 2 (exit 2)
+OK    out-of-range timeout exits 2 (exit 2)
+OK    missing mission file exits 4 (exit 4)
+OK    task with valid mission validates (exit 0)
+OK    invalid mission exits 2 (exit 2)
+OK    validate missing task exits 4 (exit 4)
+OK    validation does not modify the task file
+OK    prune dry-run exits 0 (exit 0)
+OK    dry-run deleted nothing
+OK    prune --keep=2 --yes removes oldest (exit 0)
+OK    kept exactly 2 newest runs
+OK    newest run kept, oldest pruned
+OK    append-only receipt written (3 entries)
+OK    sessions/workspaces untouched by prune
+OK    prune with invalid keep exits 4 (exit 4)
+OK    mock adapter: gate passes on matching mock response (exit 0)
+OK    mock adapter: expect-mismatch recorded (exit 1)
+OK    mismatch reason recorded
+OK    unknown adapter fails closed (exit 1)
+OK    mission task runs via mock adapter (exit 0)
+OK    mission section injected into generated prompt
+OK    retry of mission run succeeds (exit 0)
+OK    retriedFrom lineage recorded
+OK    mission section present after retry (relative path resolved)
+OK    retry of missing run exits 4 (exit 4)
+OK    skill install bundled ms-tools (exit 0)
+OK    installed to skills-available
+OK    double install refuses (exit 1)
+OK    activate enables skill (exit 0)
+OK    enabled dir populated
+OK    uninstall while enabled refuses (exit 1)
+OK    deactivate moves back to available (exit 0)
+OK    uninstall removes from available (exit 0)
+OK    seat with enabled skill launches
+OK    skill path delivered to adapter
+OK    shipped researcher contract resolves (ceiling + network)
+OK    resolve-role refuses a non-role document (conductor policy) (exit 2)
+OK    resolve-role refuses name/filename mismatch (exit 2)
+OK    resolve-role refuses unknown network declaration (exit 2)
+OK    resolve-role refuses duplicate role tool (exit 2)
+OK    resolve-role refuses unsupported tool (exit 2)
+OK    resolve-role refuses missing contract file (exit 4)
+OK    version 1 role prints no contract line
+OK    shipped version 2 roles resolve with their contracts (pm, cto, coder, reviewer)
+OK    resolve-role accepts a minimal version 2 role (exit 0)
+OK    resolve-role refuses an action outside the vocabulary (exit 2)
+OK    resolve-role refuses a gated-only action in a role file (exit 2)
+OK    resolve-role refuses a Vikunja verb no role may hold (exit 2)
+OK    resolve-role refuses a version 2 role whose contract is missing (exit 2)
+OK    resolve-role refuses a contract that is a symbolic link (exit 2)
+OK    seat launches under role ceiling
+OK    role ceiling narrows seat tools (read,write,bash -> read,bash)
+OK    narrowing recorded loudly
+OK    missing role contract refuses launch (exit 2)
+OK    missing-contract refusal names the role
+OK    empty ceiling intersection -> tool-free seat
+OK    tool-free outcome recorded loudly
+OK    overridden agents dir without seat definition refuses (exit 4)
+OK    seat-resolution refusal names the seat
+OK    policy: mission only -> mission tools
+OK    policy: task only -> task tools
+OK    policy: both -> intersection (task narrowed)
+OK    policy: empty intersection -> tool-free
+OK    invalid mission capabilities rejected (exit 2)
+mosaic-task: unsupported mission tool: "sudo" (supported: read, write, edit, bash, grep, find, ls)
+OK    task run with user layer present (exit 0)
+OK    user context dispatched into generated prompt
+OK    workspace+tools task runs via mock (exit 0)
+OK    workspace path + tools delivered to adapter
+OK    persistent workspace created on host
+OK    plain task still runs (no workspace/tools) (exit 0)
+OK    workspace var present but empty when absent
+OK    tools empty when absent
+OK    unknown tool exits 2 (exit 2)
+OK    workspace traversal exits 2 (exit 2)
+OK    hello task succeeds with exact marker
+OK    result.json written in run dir
+OK    result.json contents are correct
+OK    wrong expectExact fails with exit 1 (reason: expect-mismatch)
+OK    each run gets a distinct run dir (no clobber)
+OK    list shows both runs
+skip live provider cases (row 244: no provider call in the gate)
+OK    onboard without name exits 4 (non-interactive) (exit 4)
+OK    onboard --name renders profile (exit 0)
+OK    profile written
+OK    canon structure: required filled, optional placeholdered
+OK    canon sections present
+skip live provider cases (row 244: no provider call in the gate)
+OK    no agent identity on headless run
+OK    compose network made under the run's project and removed after the run
+
+selftest: 92 passed, 0 failed

agents/fethry/work/queue-266/manifest.r1.sha256

@@ -0,0 +1,10 @@
+db30ea0f64bd72a5e263d8ea699d5ae561e3c2f6d3f9d1e80a035823078e1531  packages/bus/src/broker.mjs
+dac7cdd892b9965c64b16d138a49e4a0c4f5fd2189359780daf97ab7271c1938  packages/bus/tests/room-check.test.mjs
+789132601745a94027f9e9184e7fef1f70cff0cba450afed5cca647f683591f4  packages/plugins/channel/webui/index.mjs
+fe9b591422b5f793061a97f3fab92d817ce8ee9ca69830da2a9f4732f9ee37c6  packages/plugins/tests/room-channel.test.mjs
+3a5321a5f492a98d342e4ddcc1e9da3522cfff89a4f9bc3f51d2ab1426d3de1b  packages/webui/src/chat-http.mjs
+fe2072a7198771a82f58dca5fc05aa4d697dd3db25a206fb2a24c8514010b069  packages/webui/src/chat.mjs
+c02235d52dc4884a8d49b279b1724274627ad027304c255ebaebd0bc198788a4  packages/webui/src/public/chat.css
+abfed92be8c57024ee590a7669cdc7cabfbfece88f92c953a3bef2bedba412dd  packages/webui/src/public/chat.js
+92c0e956ef076af21c986b52e6f461f711b0b0e9115956cb1bcbeac0942a153c  packages/webui/tests/room-browser.test.mjs
+5b79a7523f087bec91d5c8a31ad59d9b34b21716a7032e120a4fe8358c72b5ce  packages/webui/tests/room-http.test.mjs

agents/fethry/work/queue-266/mutants.py

@@ -0,0 +1,78 @@
+#!/usr/bin/env python3
+"""Isolated room mutants. Own worktree dependencies, assertion kills only, killpg after each run."""
+import argparse, hashlib, json, os, signal, subprocess, tarfile, tempfile, time
+from pathlib import Path
+ROOT = Path(__file__).resolve().parents[4]
+UI = 'packages/webui/src/public/chat.js'
+HTTP = 'packages/webui/src/chat-http.mjs'
+BROKER = 'packages/bus/src/broker.mjs'
+PLUGIN = 'packages/plugins/channel/webui/index.mjs'
+SEAM = 'packages/webui/src/chat.mjs'
+BROWSER_TEST = 'packages/webui/tests/room-browser.test.mjs'
+HTTP_TEST = 'packages/webui/tests/room-http.test.mjs'
+BUS_TEST = 'packages/bus/tests/room-check.test.mjs'
+PLUGIN_TEST = 'packages/plugins/tests/room-channel.test.mjs'
+MUTANTS = [
+ ('M01-plugin', PLUGIN, '  "room.open",\n', '', PLUGIN_TEST),
+ ('M02-seam-body', SEAM, "channel('room.send', { project, body })", "channel('room.send', { project, body: body.trim() })", HTTP_TEST),
+ ('M03-page-cursor', HTTP, 'value.at(-1)?.ids.at(-1)', 'value.at(-1)?.id', HTTP_TEST),
+ ('M04-room-status', HTTP, 'Object.keys(ROOM_LINES).map(code => [code, 409])', 'Object.keys(ROOM_LINES).map(code => [code, 400])', HTTP_TEST),
+ ('M05-strict-body', HTTP, "!exact(v, ['body']) || ", '', HTTP_TEST),
+ ('M06-receipt-type', HTTP, "typeof t.instance === 'string' && ", '', HTTP_TEST),
+ ('M07-room-check', BROKER, 'return entries.map((m) => this.#withCheck(m));', 'return entries;', BUS_TEST),
+ ('M08-room-last', BROKER, "['thread.messages', 'room.read'].includes(request.verb)", "['thread.messages'].includes(request.verb)", BUS_TEST),
+ ('M09-browser-body', UI, 'request(`rooms/${c.id}/messages`, { body })', 'request(`rooms/${c.id}/messages`, { body: body.trim() })', BROWSER_TEST),
+ ('M10-members', UI, 'catalog.rows.filter(m => threads.rows.some(t => t.project === id && t.instance === m.instance && t.name === m.instance))', 'catalog.rows', BROWSER_TEST),
+ ('M11-checked-render', UI, 'messageBody({ ...m, from_role:', 'messageBody({ ...m, check: null, from_role:', BROWSER_TEST),
+ ('M12-leading-tags', UI, 'let body = input.trimStart();', 'let body = input;', BROWSER_TEST),
+ ('M13-readonly', UI, 'if (!roomOwner() || !c.canSend || !c.roomReady || out())', 'if (!roomOwner() || !c.roomReady || out())', BROWSER_TEST),
+ ('M14-uncertainty', HTTP, 'write ? sendOutcome(err) :', "write ? { code: 'invalid-request', sent: false } :", HTTP_TEST),
+ ('M15-pending', UI, '    if (s.pending) return;', '', BROWSER_TEST),
+ ('M16-body-dedup', UI, 'new Map((after ? [...s.rows, ...page.rows] : page.rows).map(m => [m.id, m]))', 'new Map((after ? [...s.rows, ...page.rows] : page.rows).map(m => [m.body, m]))', BROWSER_TEST),
+]
+def sha(p): return hashlib.sha256(p.read_bytes()).hexdigest()
+def main():
+ p=argparse.ArgumentParser(); p.add_argument('--output',type=Path,required=True);p.add_argument('--only');a=p.parse_args()
+ names=set(a.only.split(',')) if a.only else {m[0] for m in MUTANTS}
+ assert names <= {m[0] for m in MUTANTS}
+ assert not subprocess.check_output(['git','status','--porcelain','--','packages'],cwd=ROOT,text=True).strip(),'Commit tested packages first'
+ assert (ROOT/'node_modules').is_dir() and not (ROOT/'node_modules').is_symlink(),'Local install required'
+ before={f:sha(ROOT/f) for f in {m[1] for m in MUTANTS}}
+ head=subprocess.check_output(['git','rev-parse','HEAD'],cwd=ROOT,text=True).strip()
+ a.output.mkdir(parents=True,exist_ok=True);results=[]
+ with tempfile.TemporaryDirectory(prefix='fethry266-mutants-') as temp:
+  temp=Path(temp);archive=temp/'source.tar'
+  with archive.open('wb') as stream:
+   subprocess.run(['git','archive','HEAD','packages','roles','contracts','tasks','missions','package.json','RELEASE'],cwd=ROOT,stdout=stream,check=True)
+  for name,target,old,new,test in MUTANTS:
+   if name not in names:continue
+   tree=temp/name;tree.mkdir()
+   with tarfile.open(archive) as bundle:bundle.extractall(tree,filter='data')
+   (tree/'node_modules').symlink_to(ROOT/'node_modules',target_is_directory=True)
+   path=tree/target;source=path.read_text();hits=source.count(old)
+   assert hits==1,(name,'anchor hits',hits)
+   path.write_text(source.replace(old,new,1));limit=240 if test==BROWSER_TEST else 120
+   cmd=['timeout','-k','10',str(limit),'node','--test','--test-reporter=tap','--test-concurrency=1','--test-timeout=30000',test]
+   signals=[];started=time.monotonic()
+   with (a.output/(name+'.tap')).open('w') as log:
+    child=subprocess.Popen(cmd,cwd=tree,env={**os.environ,'MOSAIC_REQUIRE_EDITOR_BUILD':'1'},stdout=log,stderr=subprocess.STDOUT,start_new_session=True)
+    try:code=child.wait(timeout=limit+15)
+    except subprocess.TimeoutExpired:os.killpg(child.pid,signal.SIGKILL);signals.append('KILL');code=child.wait()
+    finally:
+     try:
+      os.killpg(child.pid,signal.SIGTERM);signals.append('TERM');time.sleep(.2)
+      try:os.killpg(child.pid,signal.SIGKILL);signals.append('KILL')
+      except ProcessLookupError:pass
+     except ProcessLookupError:pass
+   path.write_text(source)
+   restored=sha(path)==hashlib.sha256(source.encode()).hexdigest();unchanged=before=={f:sha(ROOT/f) for f in before}
+   assert restored and unchanged,(name,'restore changed')
+   output=(a.output/(name+'.tap')).read_text()
+   killed=code==1 and 'ERR_ASSERTION' in output and 'not ok ' in output and "failureType: 'hookFailed'" not in output and '# cancelled 0\n' in output and '# skipped 0\n' in output
+   result={'mutant':name,'test':test,'exit':code,'killed':killed,'hits':hits,'restored':restored,'candidateUnchanged':unchanged,'seconds':round(time.monotonic()-started,3),'cleanupSignals':signals}
+   results.append(result);print(json.dumps(result),flush=True)
+   if not killed:break
+ report={'source':head,'selected':sorted(names),'candidateUnchanged':before=={f:sha(ROOT/f) for f in before},'results':results}
+ (a.output/'summary.json').write_text(json.dumps(report,indent=2)+'\n')
+ if len(results)!=len(names) or not all(r['killed'] for r in results):raise SystemExit(1)
+if __name__=='__main__':main()

agents/fethry/work/queue-266/pin-audit-after.txt

@@ -0,0 +1,19 @@
+packages/webui/src/public/chat.js: old=52828c03b618e3754f0e59a395f4bcc16d1c9d8db01d403406a67ca0934f0188 new=abfed92be8c57024ee590a7669cdc7cabfbfece88f92c953a3bef2bedba412dd
+  packages/webui/tests/chat.test.mjs:319:   for (const name of ['chat.js', 'chat.css']) {
+  packages/webui/tests/browser.test.mjs:21:     // Rows 129, 154, 191, 194 and 294: chat.js, editor.js, processing.js, agents.js and federation.js are the scripts added, same origin; the list is the pin, so another script is a visible change.
+  packages/webui/tests/browser.test.mjs:22:     assert.deepEqual(await b.evaluate('[...document.querySelectorAll("script")].map(s => s.getAttribute("src"))'), ['/editor.js', '/processing.js', '/federation.js', '/brand.js', '/app.js', '/markdown
+  packages/webui/tests/browser.test.mjs:24:     assert.equal(await b.evaluate(`document.querySelectorAll('script[src="/chat.js"]').length`), 1);
+  packages/webui/tests/chat-sessions-access.test.mjs:34:     if(url.pathname === '/') {res.writeHead(200,{'content-type':'text/html'});res.end('<!doctype html><title>Session access fixture</title><div id="view"></div><script src="/chat.js"></script>');retur
+  packages/webui/tests/chat-sessions-access.test.mjs:35:     if(url.pathname === '/chat.js') {res.writeHead(200,{'content-type':'text/javascript'});res.end(readFileSync(new URL('../src/public/chat.js',import.meta.url)));return;}
+  packages/webui/tests/thread-sharing-fixture.mjs:52:   const source = readFileSync(new URL('../src/public/chat.js', import.meta.url), 'utf8');
+  packages/webui/tests/thread-sharing-fixture.mjs:69:     if (url.pathname === '/chat.js') { res.writeHead(200, { 'content-type': 'text/javascript' }); return res.end(chatSource); }
+  packages/webui/tests/thread-sharing-fixture.mjs:72:       return res.end('<!doctype html><title>Sharing fixture</title><div id="view"></div><script src="/chat.js"></script>');
+  literal old/current 64-hex hits in tests: []
+packages/webui/src/chat-http.mjs: old=854c86ae3fa6bfcdcfedbf49c2d3b50815a3ca6ce5849ff5f1c56d1aa1a55288 new=3a5321a5f492a98d342e4ddcc1e9da3522cfff89a4f9bc3f51d2ab1426d3de1b
+  packages/webui/tests/chat.test.mjs:273:   const { chatHTTP } = await import('../src/chat-http.mjs');
+  packages/webui/tests/thread-sharing-fixture.mjs:9: import { chatHTTP } from '../src/chat-http.mjs';
+  literal old/current 64-hex hits in tests: []
+packages/plugins/channel/webui/index.mjs: old=718139cae4a0bcd10bab4b334f560c28911509e4875b04618e6880d1579d9466 new=789132601745a94027f9e9184e7fef1f70cff0cba450afed5cca647f683591f4
+  packages/plugins/tests/room-channel.test.mjs:3: import { dispatch } from '../channel/webui/index.mjs';
+  packages/cli/tests/fixtures/federation-host.mjs:51:     `export * from ${JSON.stringify(new URL('../../../plugins/channel/webui/index.mjs', import.meta.url).href)};`)),
+  literal old/current 64-hex hits in tests: []

agents/fethry/work/queue-266/pin-audit-before.txt

@@ -0,0 +1,3 @@
+packages/webui/src/public/chat.js 52828c03b618e3754f0e59a395f4bcc16d1c9d8db01d403406a67ca0934f0188
+packages/webui/src/chat-http.mjs 854c86ae3fa6bfcdcfedbf49c2d3b50815a3ca6ce5849ff5f1c56d1aa1a55288
+packages/plugins/channel/webui/index.mjs 718139cae4a0bcd10bab4b334f560c28911509e4875b04618e6880d1579d9466

agents/fethry/work/queue-266/run-gate.py

@@ -0,0 +1,41 @@
+#!/usr/bin/env python3
+"""Owned worktree gate, with a fresh process group and bounded cleanup per command."""
+import json, os, signal, subprocess, sys, time
+from pathlib import Path
+root = Path(__file__).resolve().parents[4]
+scratch = Path(sys.argv[1]); scratch.mkdir(parents=True, exist_ok=True)
+env = {**os.environ, 'TMPDIR': str(scratch), 'MOSAIC_REQUIRE_EDITOR_BUILD': '1'}
+env.pop('MOSAIC_LIVE_PROVIDER', None)
+node = ['node', '--test', '--test-reporter=tap', '--test-concurrency=1', '--test-timeout=30000']
+steps = [('editor-build', 120, ['npm', 'run', 'build:editor'], root / 'packages/webui'),
+         ('webui-full', 900, node + ['packages/webui/tests/'], root),
+         ('plugins-full', 300, node + ['packages/plugins/tests/'], root),
+         ('bus-full', 1200, node + ['packages/bus/tests/'], root)]
+steps += [(p.stem, 1200, ['bash', str(p)], root) for p in sorted((root / 'scripts').glob('test-*.sh'))]
+if '--scripts-only' in sys.argv[2:]:
+    steps = [step for step in steps if step[0].startswith('test-')]
+if '--t9-reruns' in sys.argv[2:]:
+    steps = [(f't9-rerun-{i}', 120, node + ['packages/bus/tests/library-credential.test.mjs'], root) for i in range(1, 4)] + [('bus-rerun', 1200, node + ['packages/bus/tests/'], root)]
+results = []
+summary = scratch / ('scripts-summary.json' if '--scripts-only' in sys.argv[2:] else 'rerun-summary.json' if '--t9-reruns' in sys.argv[2:] else 'gate-summary.json')
+for name, limit, command, cwd in steps:
+    started = time.monotonic(); signals = []
+    with (scratch / (name + '.tap')).open('w') as log:
+        child = subprocess.Popen(['timeout', '-k', '10', str(limit), *command], cwd=cwd, env=env,
+                                 stdout=log, stderr=subprocess.STDOUT, start_new_session=True)
+        try:
+            code = child.wait(timeout=limit + 15)
+        except subprocess.TimeoutExpired:
+            os.killpg(child.pid, signal.SIGKILL); signals.append('KILL'); code = child.wait()
+        finally:
+            # This group was created for this command; never signal any other seat's group.
+            try:
+                os.killpg(child.pid, signal.SIGTERM); signals.append('TERM'); time.sleep(.2)
+                try: os.killpg(child.pid, signal.SIGKILL); signals.append('KILL')
+                except ProcessLookupError: pass
+            except ProcessLookupError: pass
+    entry = {'step': name, 'command': command, 'cwd': str(cwd), 'outerSeconds': limit,
+             'exit': code, 'seconds': round(time.monotonic()-started, 3), 'cleanupSignals': signals}
+    results.append(entry); summary.write_text(json.dumps(results, indent=2) + '\n')
+    print(json.dumps(entry), flush=True)
+    if code: sys.exit(code if 0 < code < 126 else 1)

docs/SESSIONS.md

@@ -1678,3 +1678,4 @@ are never rewritten or removed; corrections are new entries.
 - 2026-10-24 — steelbeak — row 287 C2-21 (#1792), builder complete under sage-4130: collaborator library grants and chief real read mint built; bus 998/business 283/CLI 989+FED1/Docker2/install27/all12 shell gates green, M1-M11 killed/restored, token/cleanup audits clean; preparing steelbeak/row287 push and manifest handoff to Boyd then Dewey, no live change or landing.
 - 2026-10-24 — steelbeak — row 287 first-review follow-up: Boyd approved c2338ed58/3683b40... with two doc-only corrections; append-only BUILD correction distinguishes clean product/test diff from raw-log whitespace and records old-test numstats. Queue round1 open; missing-seat-credential request failure reported to Sage. Frozen product and manifest preserved; no tests or slot use.
 2026-10-24T16:12:35Z | Sage (1ef1e4f8) | Rows 225 and 287 landed (mos-1576, mos-1590) | 225 9b6345466 (Dewey c31599, gate GREEN 15:54:58Z, #1726 closed c31604); 287 0e935776e (Boyd c31602, Dewey c31603, gate GREEN 16:11:38Z, #1792 closed c31606); F-C owner-push follow-up and Dewey N1-N3 recorded in BUILD-LOG; no re-pin.
+2026-10-24 | Fethry14f80e3c | Row266 C2-10c (#1771), sage4154/4156 | New fethry/row266 worktree from962046aaa, doc-only fast-forward487500a16. Read pinned brief and amendment; local npm ci roots, no links. Identified room.read missing guard check/last; Sage authorized bounded broker hydration amendment and re-pin. Owner start retried after stale-pin refusal; design/current-code notes in agents/fethry/work/queue-266/BUILD.md. Slot held; RED-first new tests next; no production edits yet.

packages/bus/src/broker.mjs

@@ -4851,7 +4851,7 @@ export class Broker {
       if (this.#guardPass?.s !== s) {
         if (request.verb === 'message.send' && this.#guarded(s, args.to))
           return this.#guardedSend(cap, s, request, structuredClone(args));
-        if (request.verb === 'thread.messages' && this.#libraryProject(s.business) && this.#library?.last)
+        if (['thread.messages', 'room.read'].includes(request.verb) && this.#libraryProject(s.business) && this.#library?.last)
           return this.#withLast(cap, s, request);
       }
       if (CREDENTIAL_VERBS.includes(request.verb)) return this.#requestCredential(s, request.verb, structuredClone(args));
@@ -5424,6 +5424,11 @@ export class Broker {
     }
     return this.#reenter(cap, s, { verb: 'message.send', args }, check);
   }
+  // The same immutable check evidence is attached to both thread and merged room reads.
+  #withCheck(m) {
+    const e = this.#store.get("SELECT body FROM events WHERE id=? AND kind='action.allowed' AND subject=?", checkEventId(m.id), m.id);
+    return e ? { ...m, check: JSON.parse(e.body).check } : m;
+  }
   // C2-06 (sage-3595, morgana-0200): each path cite of a checked row gains `last`, the file's last commit
   // at the served tip, one git call per distinct path. Rows without `check` are unchanged.
   async #withLast(cap, s, request) {
@@ -6700,7 +6705,7 @@ export class Broker {
           }
           previous = m;
         }
-        return entries;
+        return entries.map((m) => this.#withCheck(m));
       }
       // A thread belongs to the user who made it and to one declared thread instance.
       // Row 177 (#1675): a tester's thread is owned by `tester`, so neither reaches the other's.
@@ -6827,10 +6832,7 @@ export class Broker {
           `SELECT m.* FROM messages m JOIN message_threads mt ON mt.message=m.id WHERE mt.session=? AND m.seq>? ORDER BY m.seq LIMIT ${limit}`,
           session,
           after,
-        ).map((m) => {
+        ).map((m) => this.#withCheck(m));
-          const e = this.#store.get("SELECT body FROM events WHERE id=? AND kind='action.allowed' AND subject=?", checkEventId(m.id), m.id);
-          return e ? { ...m, check: JSON.parse(e.body).check } : m;
-        });
       }
       // Row 206 (193b2, #1704, design 5.3): the owner of a thread shares it read-only, or ends a share.
       // A user's collaborator grant must still cover the thread, and a user target needs a live grant

packages/bus/tests/room-check.test.mjs

@@ -0,0 +1,43 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { mkdtempSync, readFileSync, rmSync } from 'node:fs';
+import { join } from 'node:path';
+import { tmpdir } from 'node:os';
+import { Broker } from '../src/broker.mjs';
+import { Store } from '../src/store.mjs';
+import { citationWorld, citedBody, fixtureCite } from './citation-helpers.mjs';
+
+test('C2-10c room.read carries exactly the thread check and current file last', async t => {
+  const f = citationWorld(t, { definition: 'companion' });
+  const room = f.call(f.human, 'room.open', { project: f.store.get('SELECT id FROM projects').id });
+  const thread = room.threads[0].id;
+  const agent = f.broker.bindLaunch({ ...f.launch, run: 'room-agent', thread });
+  f.call(agent, 'role.claim');
+  const sent = await f.call(agent, 'message.send', { to: 'human', body: citedBody([fixtureCite(f.commit)]) });
+  const [single] = await f.call(f.human, 'thread.messages', { thread });
+  const merged = await f.call(f.human, 'room.read', { project: room.project });
+  const same = merged.find(m => m.id === sent.id);
+  assert.deepEqual(same.check, single.check);
+  assert.deepEqual(same.check.citations, [{ scope: 'canon', agent: null, file: f.commit, last: f.commit }]);
+  assert.equal(f.reads.length, 2, 'both read verbs route through last hydration');
+});
+
+test('C2-10c check hydration preserves unchecked rows and one broadcast with two addressees', t => {
+  const root = mkdtempSync(join(tmpdir(), 'room-check-')), store = new Store(root);
+  t.after(() => { store.close(); rmSync(root, { recursive: true, force: true }); });
+  const messaging = JSON.parse(readFileSync(new URL('../../../roles/companion.json', import.meta.url))).messaging;
+  const role = { definition: 'companion', authority: { withinRole: ['message.send'], crossRole: [] } };
+  const broker = new Broker({ store, businesses: { demo: { id: 'demo', human: 'jason', vars: {},
+    arbiters: { technical: 'bean', delivery: 'bean' }, roles: { bean: role, chet: role }, definitions: { companion: { messaging } } } } });
+  const human = broker.bindHuman({ business: 'demo', human: 'jason', via: 'cli', outsideAgent: true });
+  const call = (verb, args) => broker.request(human, { verb, args });
+  const project = call('project.create', { name: 'Room' }).id;
+  call('room.open', { project });
+  const receipt = call('room.send', { project, body: 'One broadcast.' });
+  const rows = call('room.read', { project });
+  assert.equal(rows.length, 1);
+  assert.deepEqual(rows[0].ids, receipt.ids);
+  assert.deepEqual(rows[0].to, ['bean', 'chet']);
+  assert.equal(Object.hasOwn(rows[0], 'check'), false);
+  assert.equal(rows[0].body, 'One broadcast.');
+});

packages/plugins/channel/webui/index.mjs

@@ -2,6 +2,9 @@
 import { PluginError } from "../../src/kinds.mjs";
 export const interfaceVersion = 1;
 const VERBS = new Set([
+  "room.open",
+  "room.read",
+  "room.send",
   "project.list",
   "project.create",
   "thread.list",

packages/plugins/tests/room-channel.test.mjs

@@ -0,0 +1,18 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { dispatch } from '../channel/webui/index.mjs';
+
+test('C2-10c webui permits exactly the three added room verbs and preserves core refusals', async () => {
+  for (const verb of ['room.open', 'room.read', 'room.send']) {
+    const calls = [], args = { project: 'p', body: 'typed @name' };
+    assert.deepEqual(await dispatch({ verb, args }, { call: async (...a) => { calls.push(a); return { ok: verb }; } }), { ok: verb });
+    assert.deepEqual(calls, [[verb, args]]);
+    const refused = Object.assign(new Error('refused'), { code: 'unknown-addressee' });
+    await assert.rejects(dispatch({ verb, args }, { call: async () => { throw refused; } }), e => e === refused);
+  }
+  for (const verb of ['room.delete', 'room.members', 'message.send', 'role.claim', 'shell.exec']) {
+    let called = false;
+    await assert.rejects(dispatch({ verb, args: {} }, { call: async () => { called = true; } }), { code: 'channel-operation' });
+    assert.equal(called, false);
+  }
+});

packages/webui/src/chat-http.mjs

@@ -9,7 +9,14 @@ const json = (res, status, value) => {
   res.writeHead(status, { 'content-type': 'application/json', 'cache-control': 'no-store' });
   res.end(JSON.stringify(value));
 };
+const ROOM_LINES = Object.freeze({
+  'unknown-addressee': 'Unknown addressee. Choose a room member.',
+  'addressee-ambiguous': "That addressee is ambiguous. Use a room member's instance name.",
+  'room-thread-name-taken': 'A room thread name is already in use. Resolve the conflicting thread before opening the room.',
+  'room-not-open': 'This room is not open. Open the room before sending.',
+});
 const STATUS = {
+  ...Object.fromEntries(Object.keys(ROOM_LINES).map(code => [code, 409])),
   'channel-disabled': 503,
   'invalid-request': 400, 'unknown-repo': 400, 'message-not-found': 400,
   'project-not-found': 404, 'thread-not-found': 404, 'thread-not-owned': 403,
@@ -26,6 +33,7 @@ const STATUS = {
   'access-refused': 403, 'access-revoked': 401,
 };
 function safeMessage(code) {
+  if (Object.hasOwn(ROOM_LINES, code)) return ROOM_LINES[code];
   if (code === 'unknown-verb' || code === 'channel-operation') return 'This session operation is unavailable until its dependency is installed.';
   if (code === 'channel-disabled') return 'Run mosaic plugins to read the revision, then mosaic plugins set --file PATCH with plugins.channel set to ["cli","webui"].';
   if (code === 'thread-not-owned') return 'This thread is not available to this user.';
@@ -53,7 +61,7 @@ const exact = (value, allowed, required = allowed) =>
   Object.keys(value).every(k => allowed.includes(k)) && required.every(k => Object.hasOwn(value, k));
 export async function chatHTTP(req, res, { path, search, chat, named, send, preview, log }) {
   const write = req.method === 'POST';
-  let action, args, thread;
+  let action, args, thread, room;
   const refuse = (status, code, sent = false) => json(res, status, {
     error: code, message: safeMessage(code), ...(write ? { sent } : {}),
   });
@@ -73,6 +81,12 @@ export async function chatHTTP(req, res, { path, search, chat, named, send, prev
     if (one(req, 'sec-fetch-site') !== 'same-origin') return refuse(403, 'cross-site');
   }
   try {
+    const roomMatch = /^\/api\/chat\/rooms\/([^/]+)\/(open|messages)$/.exec(path);
+    if (roomMatch) {
+      room = roomMatch[1];
+      if (!id(room)) throw Error();
+      if (preview?.tester) return refuse(403, 'human-required');
+    }
     const match = /^\/api\/chat\/threads\/([^/]+)\/(messages|open|sessions|clear|cancel|operation|shares|share|unshare)$/.exec(path);
     if (match) {
       thread = match[1];
@@ -82,7 +96,15 @@ export async function chatHTTP(req, res, { path, search, chat, named, send, prev
     if (write) {
       query(search, []);
       const v = await payload(req);
-      if (path === '/api/chat/projects') {
+      if (roomMatch) {
+        if (roomMatch[2] === 'open') {
+          if (!exact(v, [])) throw Error();
+          action = 'roomOpen'; args = { project: room };
+        } else {
+          if (!exact(v, ['body']) || typeof v.body !== 'string' || !v.body.trim() || v.body.length > 32768) throw Error();
+          action = 'roomSend'; args = { project: room, body: v.body };
+        }
+      } else if (path === '/api/chat/projects') {
         if (!exact(v, ['name', 'repo'], ['name']) || !name(v.name) ||
             (Object.hasOwn(v, 'repo') && (typeof v.repo !== 'string' || !KEY.test(v.repo)))) throw Error();
         action = 'createProject'; args = v;
@@ -110,6 +132,12 @@ export async function chatHTTP(req, res, { path, search, chat, named, send, prev
         if (!exact(v, ['session'], []) || (Object.hasOwn(v, 'session') && !id(v.session))) throw Error();
         action = 'open'; args = { thread, ...(v.session ? { session: v.session } : {}) };
       } else return refuse(404, 'not-found');
+    } else if (roomMatch) {
+      if (roomMatch[2] !== 'messages') return refuse(405, 'method-not-allowed');
+      const q = query(search, ['after', 'limit']);
+      if (q.has('after') && !id(q.get('after'))) throw Error();
+      if (q.has('limit') && (!/^[1-9]\d*$/.test(q.get('limit')) || Number(q.get('limit')) > 200)) throw Error();
+      action = 'roomRead'; args = { project: room, limit: q.has('limit') ? Number(q.get('limit')) : 100, ...(q.has('after') ? { after: q.get('after') } : {}) };
     } else if (path === '/api/chat/projects') {
       query(search, []); action = 'projects'; args = {};
     } else if (path === '/api/chat/threads') {
@@ -139,7 +167,24 @@ export async function chatHTTP(req, res, { path, search, chat, named, send, prev
   const line = outcome => log(`${new Date().toISOString()} chat action=${action} user=${JSON.stringify(preview?.user ?? null)} ${outcome}`);
   try {
     const value = await chat[action](args);
-    if (action === 'sessionOperation' || action === 'clearSession' || action === 'cancelSession') {
+    if (action === 'roomOpen' || action === 'roomSend') {
+      const valid = action === 'roomOpen'
+        ? value?.project === room && Array.isArray(value.threads) && value.threads.length > 0 && value.threads.every(t => id(t?.id) && typeof t.instance === 'string' && KEY.test(t.instance) && t.name === t.instance)
+          && new Set(value.threads.map(t => t.id)).size === value.threads.length && new Set(value.threads.map(t => t.instance)).size === value.threads.length
+        : Array.isArray(value?.ids) && value.ids.length > 0 && value.ids.every(id) && new Set(value.ids).size === value.ids.length
+          && Array.isArray(value.to) && value.to.length === value.ids.length && value.to.every(k => typeof k === 'string' && KEY.test(k)) && new Set(value.to).size === value.to.length;
+      if (!valid) { line('error=outcome-unknown'); return refuse(503, 'outcome-unknown', 'unknown'); }
+      line(`project=${room}`);
+      return json(res, 200, action === 'roomOpen'
+        ? { project: room, threads: value.threads.map(({ id, instance, name }) => ({ id, instance, name })) }
+        : { ids: value.ids, to: value.to });
+    }
+    if (action === 'roomRead') {
+      if (!Array.isArray(value) || value.some(m => !id(m?.id) || !Array.isArray(m.ids) || !m.ids.length || m.ids[0] !== m.id || !m.ids.every(id)
+          || new Set(m.ids).size !== m.ids.length || !Array.isArray(m.to) || new Set(m.to).size !== m.to.length || m.to.length !== m.ids.length || !m.to.every(k => typeof k === 'string' && KEY.test(k)))) return refuse(502, 'invalid-response');
+      return json(res, 200, { rows: value, after: value.at(-1)?.ids.at(-1) ?? args.after ?? null, hasMore: value.length === args.limit, at: new Date().toISOString() });
+    }
+    if (action === 'sessionOperation'  || action === 'clearSession' || action === 'cancelSession') {
       // Only this operation's receipt crosses the HTTP seam. Never expose native paths/proofs.
       if (!value || value.thread !== args.thread || value.op !== args.op || !id(value.session) ||
           !id(value.successor) || (action === 'clearSession' && value.session !== args.session) ||

packages/webui/src/chat.mjs

@@ -22,6 +22,9 @@ export function createChat({ call, owner = null }) {
     }
   };
   return Object.freeze({
+    roomOpen: ({ project }) => channel('room.open', { project }),
+    roomRead: ({ project, after, limit }) => channel('room.read', { project, ...(after ? { after } : {}), ...(limit === undefined ? {} : { limit }) }),
+    roomSend: ({ project, body }) => channel('room.send', { project, body }),
     projects: () => channel('project.list', {}),
     createProject: ({ name, repo }) => channel('project.create', { name, ...(repo === undefined ? {} : { repo }) }),
     threads: ({ project, shared } = {}) => channel('thread.list', { ...(project === undefined ? {} : { project }), ...(shared === true ? { shared: true } : {}) }),

packages/webui/src/public/chat.css

@@ -40,3 +40,13 @@
 .chat-library { font-size: .9rem; margin-block: .5rem; overflow-wrap: anywhere; }
 .chat-library p { margin: 0; }
 .chat-library-problems ul { margin: .4rem 0 0; padding-inline-start: 1.25rem; }
+
+/* C2-10c: the shared timeline and keyboard-accessible leading-@ completion. */
+.chat-room-entry { margin-block: .75rem; }
+.chat-room #chat-room-send-form { display: grid; gap: .5rem; }
+#chat-room-body { resize: vertical; min-height: 6rem; padding: .75rem; }
+.chat-room-completion { list-style: none; padding: .25rem; margin: 0; max-height: 12rem; overflow: auto; border: 1px solid var(--border); border-radius: .5rem; }
+.chat-room-completion button { display: block; width: 100%; text-align: start; padding: .5rem; overflow-wrap: anywhere; }
+.chat-room-completion [aria-selected="true"] { outline: 2px solid var(--action); outline-offset: -2px; }
+#chat-room-tags, #chat-room-receipt { overflow-wrap: anywhere; }
+#chat-room-tags span { display: inline-block; margin-inline-end: .4rem; }

packages/webui/src/public/chat.js

@@ -24,7 +24,7 @@
   // The library verbs name the business project, which is the chat project's repository link. These
   // codes mean that repository is no library, or this page may not read it: no status line at all.
   const NO_LIBRARY = ['project-not-declared', 'project-not-configured', 'not-configured', 'owner-only'];
-  const libraryOf = (c, t) => { const repo = c?.projects.find(p => p.id === t?.project)?.repo; return typeof repo === 'string' && NAME.test(repo) ? repo : null; };
+  const libraryOf = (c, t) => { const repo = c?.projects.find(p => p.id === (c.kind === 'room' ? c.id : t?.project))?.repo; return typeof repo === 'string' && NAME.test(repo) ? repo : null; };
   let renderReply = null;
   import('/render.mjs').then(m => { renderReply = m.renderReply; if (current && !out()) paint(); }, () => {});
   const libraries = new Map(), reverts = new Map();
@@ -191,6 +191,162 @@
     const receipt = s.receipt;
     return `<section class="chat-conversation" data-thread="${esc(t.id)}" data-session="${esc(current.session)}"><p>${link('projects', t.project, current.projects.find(p => p.id === t.project)?.name ?? 'Project')} / ${txt(t.instance)}</p>${heading(t.name)}${libraryLine(libraryOf(current, t))}${sessionControls(t)}${sharing(t)}<p class="muted">Reading never wakes the assistant. An accepted message is not an answer.</p>${threadWrites() ? `<button class="btn" type="button" id="chat-resume"${disabledSession(s.pending)}>Resume assistant</button>` : ''}<ol class="chat-log" tabindex="0" aria-label="Thread conversation">${messages || '<li class="muted">No messages yet.</li>'}</ol><div class="chat-paging">${s.more ? '<p>Showing earlier history. Read forward to reach the current conversation.</p><button class="btn" type="button" id="chat-next">Read next messages</button>' : '<p class="muted">Caught up to the last read.</p>'}<button class="btn" type="button" id="chat-new"${s.follow ? ' hidden' : ''}>New messages — go to end</button></div>${threadWrites() ? `<form id="chat-send-form"><label for="chat-body">Message this thread</label><textarea id="chat-body" rows="4"${disabledSession(s.pending)}>${esc(s.draft)}</textarea><button class="btn primary" type="submit"${disabledSession(s.pending)}>Send</button></form>` : ''}<p id="chat-receipt" role="status">${txt(receipt)}</p></section>`;
   }
+  // C2-10c: rooms reuse the same state, renderer and generation fences as threads.
+  const ROOM_LINES = Object.freeze({
+    'unknown-addressee': 'Unknown addressee. Choose a room member.',
+    'addressee-ambiguous': "That addressee is ambiguous. Use a room member's instance name.",
+    'room-thread-name-taken': 'A room thread name is already in use. Resolve the conflicting thread before opening the room.',
+    'room-not-open': 'This room is not open. Open the room before sending.',
+  });
+  const roomError = err => ROOM_LINES[err.code] ?? (err.sent === false || err.status >= 400 && err.status < 500
+    ? `Room operation refused (${inert(err.code)}).`
+    : 'Room unavailable. Refresh to read it again; nothing was retried.');
+  const roomOwner = () => current && !current.user && !current.tester;
+  // Same leading-token grammar as bus/address.mjs; the UI never resolves/replaces recipients on send.
+  function roomAddress(input) {
+    const tags = []; let body = input.trimStart();
+    while (true) {
+      const token = /^@(\S+)(?:\s+|$)/u.exec(body);
+      if (!token) break;
+      tags.push(token[1]); body = body.slice(token[0].length);
+    }
+    return { tags, body };
+  }
+  const roomName = instance => current.members?.find(m => m.instance === instance)?.name || instance;
+  function roomOpenControl(project) {
+    if (!roomOwner()) return '';
+    const f = form('room-open:' + project);
+    return `<section class="chat-room-entry" aria-label="Project room"><button class="btn" type="button" id="chat-room-open"${disabled(f.pending)}>Open room</button> <a href="#/chat/rooms/${esc(project)}">Read room</a><p id="chat-room-open-receipt" role="status">${txt(f.receipt)}</p></section>`;
+  }
+  function roomConversation() {
+    const c = current, s = state(c.key), p = c.projects.find(p => p.id === c.id);
+    const messages = s.rows.map(m => {
+      const speaker = m.from_role === 'human' ? 'Human' : roomName(m.from_role);
+      const recipients = m.from_role === 'human' ? ` → ${(m.to ?? []).map(r => txt(roomName(r))).join(', ')}` : '';
+      return `<li data-message="${esc(m.id)}"><div class="chat-message-meta"><strong>${txt(speaker)}</strong>${recipients} ${stamp(m.at)}</div>${messageBody({ ...m, from_role: m.from_role === 'human' ? m.from_role : speaker })}</li>`;
+    }).join('');
+    const off = !c.roomReady || s.pending || !roomOwner();
+    return `<section class="chat-room" data-project="${esc(c.id)}"><p>${link('projects', c.id, p?.name ?? 'Project')}</p>${heading((p?.name ?? 'Project') + ' room')}${roomOpenControl(c.id)}${libraryLine(libraryOf(c))}<p>Room members: ${(c.members ?? []).map(m => `${txt(m.name)} (@${txt(m.instance)})`).join(', ') || 'unavailable'}</p><ol class="chat-log chat-room-log" tabindex="0" aria-label="Room conversation">${messages || '<li>No messages yet.</li>'}</ol><div class="chat-paging">${s.more ? '<button class="btn" type="button" id="chat-next">Read next messages</button>' : '<p class="muted">Caught up to the last read.</p>'}<button class="btn" type="button" id="chat-new"${s.follow ? ' hidden' : ''}>New messages — go to end</button></div><form id="chat-room-send-form"><label for="chat-room-body">Message the room</label><p id="chat-room-help">Without leading @tags, your message goes to every member. The broker checks the addressees.</p><textarea id="chat-room-body" rows="4" aria-describedby="chat-room-help" aria-autocomplete="list" aria-controls="chat-room-completion" aria-expanded="false"${disabled(off)}>${esc(s.draft)}</textarea><div id="chat-room-tags"></div><ul id="chat-room-completion" class="chat-room-completion" role="listbox" aria-label="Room members" hidden></ul><button class="btn primary" type="submit"${disabled(off)}>Send to room</button></form><p id="chat-room-receipt" role="status">${txt(s.receipt)}</p></section>`;
+  }
+  function drawRoomCompletion() {
+    const list = document.getElementById('chat-room-completion'), field = document.getElementById('chat-room-body');
+    if (!list || !field) return;
+    const c = current.completion, active = !!c?.items.length;
+    list.hidden = !active; field.setAttribute('aria-expanded', String(active));
+    if (!active) { list.replaceChildren(); field.removeAttribute('aria-activedescendant'); return; }
+    list.innerHTML = c.items.map((m, i) => `<li role="presentation"><button type="button" role="option" tabindex="-1" id="chat-room-option-${i}" aria-selected="${i === c.index}" data-room-complete="${esc(m.instance)}">${txt(m.name)} (@${txt(m.instance)})</button></li>`).join('');
+    field.setAttribute('aria-activedescendant', `chat-room-option-${c.index}`);
+  }
+  function updateRoomCompletion() {
+    if (current?.kind !== 'room') return;
+    const field = document.getElementById('chat-room-body'), preview = document.getElementById('chat-room-tags');
+    if (!field || !preview) return;
+    const { tags } = roomAddress(field.value);
+    preview.innerHTML = tags.length ? 'Typed addressees: ' + tags.map(tag => `<span data-room-tag="${esc(tag)}">@${txt(tag)}</span>`).join(' ') : 'All room members';
+    const prefix = field.value.slice(0, field.selectionStart), token = /(?:^|\s)@([^\s@]*)$/u.exec(prefix);
+    current.completion = null;
+    if (document.activeElement === field && !field.disabled && token && !roomAddress(prefix.slice(0, token.index)).body.trim()) {
+      const needle = token[1].toLocaleLowerCase();
+      const items = (current.members ?? []).filter(m => m.instance.toLocaleLowerCase().startsWith(needle) || m.name.toLocaleLowerCase().startsWith(needle)).slice(0, 10);
+      current.completion = { items, index: 0, start: prefix.length - token[1].length - 1, end: field.selectionEnd };
+    }
+    drawRoomCompletion();
+  }
+  function completeRoom(instance) {
+    const field = document.getElementById('chat-room-body'), c = current?.completion;
+    if (!field || field.disabled || !c?.items.some(m => m.instance === instance)) return;
+    const value = field.value.slice(0, c.start) + '@' + instance + ' ' + field.value.slice(c.end);
+    const caret = c.start + instance.length + 2;
+    field.value = value; state(current.key).draft = value; field.focus(); field.setSelectionRange(caret, caret);
+    updateRoomCompletion();
+  }
+  async function renderRoom({ path, container, canSend, user, tester, navigated, next }) {
+    if (out()) return;
+    controller?.abort(); controller = new AbortController();
+    const signal = controller.signal, g = ++generation;
+    const match = /^\/chat\/rooms\/([0-9a-f-]+)$/i.exec(path), id = match?.[1];
+    current = { kind: 'room', id, key: 'room:' + id, path, container, canSend, user, tester,
+      projects: [], threads: [], members: [], roomReady: false, refused: false, error: '' };
+    if (!UUID.test(id ?? '') || !roomOwner()) {
+      current.error = UUID.test(id ?? '') ? 'Rooms require the business owner.' : 'Invalid room route.';
+      current.refused = true; paint(navigated); return;
+    }
+    const s = state(current.key);
+    if (navigated) container.innerHTML = '<p role="status">Reading room…</p>';
+    try {
+      const [projects, threads, catalog] = await Promise.all([
+        request('projects', undefined, signal), request('threads?project=' + id, undefined, signal), request('instances', undefined, signal),
+      ]);
+      if (g !== generation || out()) return;
+      if (!projects.rows.some(p => p.id === id)) throw new ChatError('project-not-found', 404);
+      if (!catalog.rows.every(m => typeof m?.instance === 'string' && /^[A-Za-z0-9][A-Za-z0-9_.-]{0,159}$/.test(m.instance) && typeof m.name === 'string')) throw new ChatError('invalid-response');
+      current.projects = projects.rows; current.threads = threads.rows;
+      current.members = catalog.rows.filter(m => threads.rows.some(t => t.project === id && t.instance === m.instance && t.name === m.instance));
+      const after = s.loaded && (!s.more || next) ? s.after : null;
+      const page = await request(`rooms/${id}/messages?limit=100${after ? '&after=' + after : ''}`, undefined, signal);
+      if (g !== generation || out()) return;
+      if (typeof page.hasMore !== 'boolean' || !(page.after === null || UUID.test(page.after)) || page.rows.some(m => !UUID.test(m?.id) || !Array.isArray(m.ids) || !m.ids.every(id => UUID.test(id)) || !Array.isArray(m.to))) throw new ChatError('invalid-response');
+      s.rows = [...new Map((after ? [...s.rows, ...page.rows] : page.rows).map(m => [m.id, m])).values()].slice(-200);
+      s.after = page.after ?? s.after; s.more = page.hasMore; s.loaded = true;
+      current.roomReady = current.members.length > 0;
+      if (s.receiptIds?.every(id => s.rows.some(m => m.ids.includes(id)))) { s.receipt = 'Message shown in the room.'; s.receiptIds = null; }
+    } catch (err) {
+      if (g !== generation || out() || err.name === 'AbortError' || err.code === 'signed-out') return;
+      current.error = roomError(err);
+      if (err.status === 403 || err.status === 404) { s.rows = []; current.members = []; }
+    }
+    if (g === generation && !out()) { paint(navigated); void loadLibrary(libraryOf(current), g, signal); }
+  }
+  async function openRoom() {
+    const c = current, id = c?.id;
+    if (!roomOwner() || !c.canSend || out() || !UUID.test(id ?? '')) return;
+    const f = form('room-open:' + id);
+    if (f.pending) return;
+    f.pending = true; f.receipt = ''; paint();
+    try {
+      const data = await request(`rooms/${id}/open`, {});
+      if (out()) return;
+      if (data.project !== id || !Array.isArray(data.threads) || !data.threads.length || data.threads.some(t => !UUID.test(t?.id) || typeof t.instance !== 'string' || t.name !== t.instance)) throw new ChatError('outcome-unknown');
+      f.receipt = 'Room opened.';
+      if (current?.id === id) {
+        if (location.hash === '#/chat/rooms/' + id) void refresh();
+        else location.hash = '#/chat/rooms/' + id;
+      }
+    } catch (err) {
+      if (out() || err.code === 'signed-out') return;
+      f.receipt = err.sent === false ? roomError(err) : 'Outcome unknown. Read the room before opening again; nothing was retried.';
+    } finally { f.pending = false; if (current?.id === id && !out()) paint(); }
+  }
+  async function sendRoom() {
+    const c = current;
+    if (!roomOwner() || !c.canSend || !c.roomReady || out()) return;
+    const s = state(c.key), body = s.draft;
+    if (s.pending) return;
+    if (!body.trim() || new TextEncoder().encode(JSON.stringify({ body })).length > 16384) {
+      s.receipt = body.trim() ? 'Message is too long (16 KiB JSON maximum).' : 'Write a message first.'; paint(); return;
+    }
+    s.pending = true; s.receipt = ''; paint();
+    try {
+      const data = await request(`rooms/${c.id}/messages`, { body });
+      if (out()) return;
+      if (!Array.isArray(data.ids) || !data.ids.length || !data.ids.every(id => UUID.test(id)) || !Array.isArray(data.to) || data.to.length !== data.ids.length) throw new ChatError('outcome-unknown');
+      s.receipt = 'Accepted room message. Waiting for the room to show it.'; s.receiptIds = data.ids;
+      if (s.draft === body) s.draft = '';
+      s.follow = true; s.tailRequested = true;
+    } catch (err) {
+      if (out() || err.code === 'signed-out') return;
+      s.receipt = err.sent === false ? roomError(err) : 'Outcome unknown. Read the room before trying again. Nothing was retried; your draft is kept.';
+    } finally { s.pending = false; if (current?.key === c.key && !out()) paint(); }
+  }
+  document.addEventListener('keydown', event => {
+    if (current?.kind !== 'room' || event.target.id !== 'chat-room-body' || !current.completion?.items.length) return;
+    const c = current.completion;
+    if (['ArrowDown', 'ArrowUp'].includes(event.key)) { event.preventDefault(); c.index = (c.index + (event.key === 'ArrowDown' ? 1 : c.items.length - 1)) % c.items.length; drawRoomCompletion(); }
+    if (['Enter', 'Tab'].includes(event.key)) { event.preventDefault(); completeRoom(c.items[c.index].instance); }
+    if (event.key === 'Escape') { event.preventDefault(); current.completion = null; drawRoomCompletion(); }
+  });
+  document.addEventListener('mousedown', event => { if (event.target.closest?.('[data-room-complete]')) event.preventDefault(); });
+
   function capture() {
     if (!current) return null;
     const active = document.activeElement, log = current.container.querySelector('.chat-log');
@@ -202,14 +358,16 @@
     const keep = capture(), c = current;
     let html = '<div class="chat-area"><p><a href="#/chat">Chat projects</a></p>';
     if (c.error) html += `<p class="chat-error banner err" role="alert">${txt(c.error)}</p>`;
-    if (c.kind === 'thread') {
+    if (c.kind === 'room') {
+      html += c.refused ? heading('Room unavailable') : roomConversation();
+    } else if (c.kind === 'thread') {
       const t = c.thread;
       if (t && (c.session || c.legacyDefault) && !c.refused) html += conversation(t);
       else html += heading('Thread unavailable');
     } else if (c.kind === 'project') {
       const p = c.projects.find(p => p.id === c.id);
       html += heading(p?.name ?? 'Project unavailable');
-      if (p && !c.refused) html += threads(c.threads.filter(t => !t.shared)) + '<h2>Shared with me</h2>' + threads(c.threads.filter(t => t.shared)) + creation('thread', c.id);
+      if (p && !c.refused) html += roomOpenControl(c.id) + threads(c.threads.filter(t => !t.shared)) + '<h2>Shared with me</h2>' + threads(c.threads.filter(t => t.shared)) + creation('thread', c.id);
     } else {
       html += heading('Chat') + '<p>Business projects and your named assistant threads.</p><div class="chat-projects">' +
         c.projects.map(p => `<section class="panel"><h2>${link('projects', p.id, p.name)}</h2>${p.repo ? `<p class="muted">Repository: ${txt(p.repo)}</p>` : ''}${threads(c.threads.filter(t => t.project === p.id && !t.shared))}</section>`).join('') + (c.projects.length ? '' : '<p>No projects yet.</p>') + '</div><h2>Shared with me</h2>' + threads(c.threads.filter(t => t.shared)) + creation('project', 'projects');
@@ -231,6 +389,7 @@
         if (keep.field.start != null && typeof f.setSelectionRange === 'function') f.setSelectionRange(keep.field.start, keep.field.end);
       }
     } else if (navigated) c.container.querySelector('h1')?.focus({ preventScroll: true });
+    updateRoomCompletion();
   }
   function readError(err) {
     return err.code === 'thread-not-owned' ? 'This thread is not available to this user.' :
@@ -239,6 +398,7 @@
   }
   async function render({ path, container, canSend, user = false, tester = false, navigated = false, next = false }) {
     if (out()) return;
+    if (/^\/chat\/rooms(?:\/|$)/.test(path)) return renderRoom({ path, container, canSend, user, tester, navigated, next });
     const match = /^\/chat(?:\/(projects|threads)\/([0-9a-f-]+)(?:\/sessions\/([0-9a-f-]+))?)?$/.exec(path);
     controller?.abort(); controller = new AbortController();
     const signal = controller.signal, g = ++generation;
@@ -389,6 +549,7 @@
   }
   document.addEventListener('input', event => {
     if (!current || out()) return;
+    if (event.target.id === 'chat-room-body') { state(current.key).draft = event.target.value; updateRoomCompletion(); return; }
     if (event.target.id === 'chat-operation') { const f = form('clear:' + current.key); if (f.pending) return; f.op = event.target.value; f.record = null; const button = document.getElementById('chat-cancel'); if (button) button.disabled = !current.canSend || f.pending || !f.op; }
     if (event.target.id === 'chat-share-target') form('share:' + current.id).to = event.target.value;
     if (event.target.id === 'chat-body') state(current.key ?? current.id).draft = event.target.value;
@@ -400,7 +561,7 @@
     }
   });
   document.addEventListener('scroll', event => {
-    if (event.target.matches?.('.chat-log') && current?.kind === 'thread') {
+    if (event.target.matches?.('.chat-log') && ['thread', 'room'].includes(current?.kind)) {
       const el = event.target;
       state(current.key ?? current.id).follow = el.scrollHeight - el.scrollTop - el.clientHeight < 40;
     }
@@ -449,7 +610,9 @@
   document.addEventListener('submit', event => {
     if (!current || !event.target.id.startsWith('chat-')) return;
     event.preventDefault();
-    if (event.target.id === 'chat-share-form') {
+    if (event.target.id === 'chat-room-send-form') {
+      void sendRoom();
+    } else if (event.target.id === 'chat-share-form') {
       void changeShare('share', form('share:' + current.id).to ?? '');
     } else if (event.target.id === 'chat-send-form') {
       const id = current.id, session = current.session, key = current.key;
@@ -473,6 +636,9 @@
   });
   document.addEventListener('click', event => {
     if (!current || out()) return;
+    if (event.target.id === 'chat-room-open') void openRoom();
+    const option = event.target.closest?.('[data-room-complete]');
+    if (option) completeRoom(option.dataset.roomComplete);
     if (event.target.dataset.unshare) void changeShare('unshare', event.target.dataset.unshare);
     if (event.target.id === 'chat-resume') void write('open', current.key, current.session ? { session: current.session } : {}, `threads/${current.id}/open`);
     if (event.target.id === 'chat-cancel') void cancelClear();

packages/webui/tests/room-browser.test.mjs

@@ -0,0 +1,198 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { fixture } from './fixture.mjs';
+import { browser } from './browser.mjs';
+import { addressCases } from '../../bus/tests/address-cases.mjs';
+const P = '10000000-0000-4000-8000-000000000001', Q = '10000000-0000-4000-8000-000000000002';
+const T = '20000000-0000-4000-8000-000000000001', U = '20000000-0000-4000-8000-000000000002';
+const M = '30000000-0000-4000-8000-000000000001', N = '30000000-0000-4000-8000-000000000002';
+const A = '40000000-0000-4000-8000-000000000001', B = '40000000-0000-4000-8000-000000000002';
+const C = '50000000-0000-4000-8000-000000000001', D = '50000000-0000-4000-8000-000000000002';
+const SHA = 'a'.repeat(40), LAST = 'b'.repeat(40), HOSTILE = '<img src=x onerror="window.injected=1">';
+const rows = [
+  { id: M, ids: [M, N], from_role: 'human', to: ['bean', 'chet'], body: 'Broadcast once.', at: '2026-10-24T16:00:00Z' },
+  { id: A, ids: [A], from_role: 'bean', instance: 'bean', to: ['bean'], at: '2026-10-24T16:01:00Z',
+    body: JSON.stringify({ text: 'A cited reply.', citations: [{ path: 'Notes/One.md', commit: SHA, lines: [1, 2], quote: HOSTILE }] }),
+    check: { citations: [{ scope: 'supporting', agent: 'demo/bean', file: SHA, last: LAST }] } },
+  { id: B, ids: [B], from_role: 'chet', instance: 'chet', to: ['chet'], at: '2026-10-24T16:02:00Z',
+    body: JSON.stringify({ notice: 'library-write', op: 'write', path: 'Notes/One.md', commit: SHA }) },
+  { id: C, ids: [C], from_role: 'human', to: ['bean'], body: 'Broadcast once.', at: '2026-10-24T16:00:00Z' },
+  { id: D, ids: [D], from_role: 'bean', to: ['bean'], body: JSON.stringify({ notice: 'library-write', op: 'delete', path: 'Fake.md', commit: SHA }), check: { citations: [] } },
+];
+const refusals = {
+  'unknown-addressee': 'Unknown addressee. Choose a room member.',
+  'addressee-ambiguous': "That addressee is ambiguous. Use a room member's instance name.",
+  'room-thread-name-taken': 'A room thread name is already in use. Resolve the conflicting thread before opening the room.',
+  'room-not-open': 'This room is not open. Open the room before sending.',
+};
+const stub = `(() => {
+ const real=window.fetch.bind(window);window.__writes=[];window.__reads=[];window.__roomRows=${JSON.stringify(rows)};
+ window.__projects=[{id:'${P}',name:'First project',repo:'books'},{id:'${Q}',name:'Second project',repo:null}];
+ window.__threads=[{id:'${T}',project:'${P}',instance:'bean',name:'bean'},{id:'${U}',project:'${P}',instance:'chet',name:'chet'}];
+ window.__instances=[{instance:'bean',name:'Bean'},{instance:'chet',name:${JSON.stringify(HOSTILE)}},{instance:'outsider',name:'Not a room member'}];
+ window.confirm=()=>true;
+ window.fetch=async(url,init={})=>{
+  const path=String(url),method=init.method||'GET',answer=(body,status=200)=>new Response(JSON.stringify(body),{status,headers:{'content-type':'application/json'}});
+  if(path==='/api/config')return answer({send:!location.search.includes('readonly'),user:location.search.includes('user')});
+  if(path.startsWith('/api/bus/'))return answer({rows:[],unread:0,at:new Date().toISOString()});
+  if(path==='/api/business')return answer({projects:['books']});
+  if(path.startsWith('/api/library/status'))return answer({project:'books',served:'${SHA}',problems:[]});
+  if(path==='/api/library/revert'){window.__writes.push({path,body:JSON.parse(init.body)});return answer({project:'books',path:'Notes/One.md',reverted:'${SHA}',commit:'${LAST}'});}
+  if(!path.startsWith('/api/chat/'))return real(url,init);
+  if(method==='GET')window.__reads.push(path);
+  if(path==='/api/chat/projects')return answer({rows:window.__projects});
+  if(path==='/api/chat/instances')return answer({rows:window.__instances});
+  if(path.includes('/rooms/')){
+   if(method==='POST'){
+    window.__writes.push({path,body:JSON.parse(init.body),redirect:init.redirect});
+    const code=path.endsWith('/open')?window.__openError:window.__sendError;
+    if(code)return answer({error:code,message:'Untrusted reason',sent:false},409);
+    if(window.__holdWrite)await new Promise(r=>window.__releaseWrite=r);
+    if(window.__networkFail)throw new TypeError('offline');
+    if(path.endsWith('/open')){window.__readError=null;return answer({project:'${P}',threads:window.__threads.map(({id,instance,name})=>({id,instance,name}))});}
+    const ids=['60000000-0000-4000-8000-000000000001','60000000-0000-4000-8000-000000000002'];
+    window.__roomRows.push({id:ids[0],ids,from_role:'human',to:['bean','chet'],body:JSON.parse(init.body).body,at:'2026-10-24T17:00:00Z'});
+    return answer({ids,to:['bean','chet']});
+   }
+   if(window.__readError)return answer({error:window.__readError,message:'Untrusted reason'},409);
+   if(window.__holdRead){window.__signal=init.signal;await new Promise(r=>window.__releaseRead=r);}
+   return answer({rows:window.__roomRows,after:window.__roomRows.at(-1)?.ids.at(-1)||null,hasMore:false});
+  }
+  if(path.includes('/shares'))return answer({rows:[]});
+  if(path.endsWith('/sessions'))return answer({rows:[{id:'${T}',name:'default',default:true}]});
+  if(path.includes('/messages'))return answer({rows:[],after:null,hasMore:false});
+  if(path.startsWith('/api/chat/threads'))return answer({rows:window.__threads});
+  return answer({rows:[]});
+ };
+})();`;
+async function setup(t, { path = `/chat/rooms/${P}`, before = '', suffix = '' } = {}) {
+  const f = await fixture(); t.after(() => f.close());
+  const b = await browser(); t.after(() => b.close());
+  await b.call('Page.addScriptToEvaluateOnNewDocument', { source: stub + before });
+  await b.navigate(`${f.base}/${suffix}#${path}`);
+  const wait = expression => b.evaluate(`(async()=>{for(let i=0;i<100;i++){if(${expression})return true;await new Promise(r=>setTimeout(r,30));}throw new Error(${JSON.stringify(expression)});})()`);
+  const text = selector => b.evaluate(`document.querySelector(${JSON.stringify(selector)})?.textContent??null`);
+  const set = value => b.evaluate(`(()=>{const el=document.querySelector('#chat-room-body');el.value=${JSON.stringify(value)};el.focus();el.setSelectionRange(el.value.length,el.value.length);el.dispatchEvent(new Event('input',{bubbles:true}));return true;})()`);
+  await wait(path.includes('/rooms/') ? 'document.querySelector(".chat-room")' : 'document.querySelector("#chat-thread-form")');
+  return { b, wait, text, set };
+}
+test('C2-10c room merges members, shows a broadcast once, reuses cited renderer and suppresses checked notice forgery', async t => {
+  const { b, wait, text } = await setup(t);
+  await wait('document.querySelector(".chat-cites")');
+  assert.equal(await b.evaluate('document.querySelectorAll(".chat-room-log > li[data-message]").length'), 5);
+  assert.equal(await b.evaluate('document.querySelectorAll(".chat-room-log > li[data-message]")[0].dataset.message'), M);
+  assert.match(await text('.chat-room-log > li:first-child .chat-message-meta'), /Human.*Bean/);
+  assert.equal(await text('.chat-scope'), 'supporting');
+  assert.equal(await text('.chat-agent-written'), 'agent-written: demo/bean');
+  assert.equal(await text('.chat-changed'), 'changed since');
+  assert.equal(await text('.chat-cites q'), HOSTILE);
+  assert.equal(await b.evaluate('!!document.querySelector(".chat-room img") || !!window.injected'), false);
+  assert.equal(await b.evaluate('document.querySelectorAll("[data-revert]").length'), 1);
+  assert.equal(await b.evaluate('window.__writes.length'), 0, 'reading never opens a room or wakes an agent');
+  await b.evaluate('document.querySelector("[data-revert]").click();true');
+  await wait('document.querySelector(".chat-revert-receipt")?.textContent.startsWith("Reverted")');
+  assert.deepEqual(await b.evaluate('window.__writes[0].body'), { project: 'books', commit: SHA });
+});
+test('C2-10c explicit project Open room calls only room.open before navigating', async t => {
+  const { b, wait } = await setup(t, { path: `/chat/projects/${P}` });
+  assert.equal(await b.evaluate('window.__writes.length'), 0);
+  await b.evaluate('document.querySelector("#chat-room-open").click();true');
+  await wait('document.querySelector(".chat-room")');
+  assert.deepEqual(await b.evaluate('window.__writes'), [{ path: `/api/chat/rooms/${P}/open`, body: {}, redirect: 'manual' }]);
+});
+test('C2-10c completion lists only room members, inserts instance tokens and preserves typed send exactly', async t => {
+  const { b, wait, set } = await setup(t);
+  await set('@be');
+  assert.deepEqual(await b.evaluate('[...document.querySelectorAll("[data-room-complete]")].map(e=>e.dataset.roomComplete)'), ['bean']);
+  await b.key('Enter');
+  assert.equal(await b.evaluate('document.querySelector("#chat-room-body").value'), '@bean ');
+  await set('@bean @ch');
+  await b.evaluate('document.querySelector("[data-room-complete=chet]").click();true');
+  assert.equal(await b.evaluate('document.querySelector("#chat-room-body").value'), '@bean @chet ');
+  const body = ' \t@bean\n@chet  unchanged  text ';
+  await set(body);
+  await b.evaluate('document.querySelector("#chat-room-send-form").dispatchEvent(new Event("submit",{bubbles:true,cancelable:true}));true');
+  await wait('window.__writes.length===1 && !document.querySelector("#chat-room-body").disabled');
+  assert.deepEqual(await b.evaluate('window.__writes[0]'), { path: `/api/chat/rooms/${P}/messages`, body: { body }, redirect: 'manual' });
+  assert.equal(await b.evaluate('document.querySelector("#chat-room-body").value'), '');
+  assert.equal(await b.evaluate('document.querySelectorAll(".chat-room-log > li[data-message]").length'), 5, 'no optimistic copies of a broadcast');
+  await wait('!document.querySelector("#refresh").disabled');
+  await b.evaluate('document.querySelector("#refresh").click();true');
+  await wait('document.querySelectorAll(".chat-room-log > li[data-message]").length===6');
+  const sentSelector = '.chat-room-log > li[data-message="60000000-0000-4000-8000-000000000001"]';
+  assert.equal(await b.evaluate(`document.querySelectorAll(${JSON.stringify(sentSelector)}).length`), 1);
+});
+test('C2-10c browser leading tag reader matches every broker parseAddress vector', async t => {
+  const { b, set } = await setup(t);
+  for (const [label, input, expected] of addressCases) {
+    await set(input);
+    assert.deepEqual(await b.evaluate('[...document.querySelectorAll("[data-room-tag]")].map(e=>e.dataset.roomTag)'), expected.tags, label);
+  }
+  await set('ordinary prose @be');
+  assert.equal(await b.evaluate('document.querySelectorAll("[data-room-complete]").length'), 0);
+  assert.equal(await b.evaluate('window.__writes.length'), 0);
+});
+test('C2-10c room refusals show fixed lines, preserve drafts and never retry', async t => {
+  const { b, wait, set, text } = await setup(t);
+  for (const code of ['unknown-addressee', 'addressee-ambiguous', 'room-not-open']) {
+    await set('@unknown hello');
+    const count = await b.evaluate('window.__writes.length');
+    await b.evaluate(`window.__sendError=${JSON.stringify(code)};document.querySelector('#chat-room-send-form').dispatchEvent(new Event('submit',{bubbles:true,cancelable:true}));true`);
+    await wait(`window.__writes.length===${count+1} && !document.querySelector('#chat-room-body').disabled`);
+    assert.equal(await text('#chat-room-receipt'), refusals[code]);
+    assert.equal(await b.evaluate('document.querySelector("#chat-room-body").value'), '@unknown hello');
+  }
+  await b.evaluate("window.__openError='room-thread-name-taken';document.querySelector('#chat-room-open').click();true");
+  await wait(`document.querySelector('#chat-room-open-receipt')?.textContent===${JSON.stringify(refusals['room-thread-name-taken'])}`);
+  assert.equal(await text('#chat-room-open-receipt'), refusals['room-thread-name-taken']);
+});
+test('C2-10c read-only room does not offer a send or an implicit open', async t => {
+  const { b, set } = await setup(t, { suffix: '?readonly' });
+  assert.equal(await b.evaluate('document.querySelector("#chat-room-body").disabled'), true);
+  assert.equal(await b.evaluate('document.querySelector("#chat-room-open").disabled'), true);
+  await set('not allowed');
+  await b.evaluate('document.querySelector("#chat-room-send-form").dispatchEvent(new Event("submit",{bubbles:true,cancelable:true}));true');
+  assert.equal(await b.evaluate('window.__writes.length'), 0);
+});
+test('C2-10c late reads and sign-out cannot repaint private room state', async t => {
+  const { b, wait, set } = await setup(t);
+  await set('private room draft');
+  await b.evaluate('window.__holdRead=true;document.querySelector("#refresh").click();true');
+  await wait('typeof window.__releaseRead==="function"');
+  await b.evaluate(`location.hash='#/chat/projects/${Q}';true`);
+  await wait('document.querySelector("#chat-thread-form")');
+  assert.equal(await b.evaluate('window.__signal.aborted'), true);
+  await b.evaluate('window.__holdRead=false;window.__releaseRead();true');
+  await b.evaluate('document.dispatchEvent(new Event("mosaic-signed-out"));true');
+  assert.equal(await b.evaluate('!!document.querySelector(".chat-room")'), false);
+  assert.equal(await b.evaluate('document.body.textContent.includes("private room draft")'), false);
+});
+
+
+test('C2-10c quiet members complete in an empty room, and Escape closes suggestions', async t => {
+  const { b, set } = await setup(t, { before: 'window.__roomRows=[];' });
+  await set('@');
+  assert.deepEqual(await b.evaluate('[...document.querySelectorAll("[data-room-complete]")].map(e=>e.dataset.roomComplete)'), ['bean', 'chet']);
+  await b.key('ArrowDown'); await b.key('Tab');
+  assert.equal(await b.evaluate('document.querySelector("#chat-room-body").value'), '@chet ');
+  await set('@b'); await b.key('Escape');
+  assert.equal(await b.evaluate('document.querySelector("#chat-room-completion").hidden'), true);
+  assert.equal(await b.evaluate('window.__writes.length'), 0);
+});
+
+test('C2-10c pending sends do not duplicate and uncertain sends preserve the exact draft', async t => {
+  const { b, wait, set, text } = await setup(t);
+  await set('one pending send');
+  await b.evaluate('window.__holdWrite=true;document.querySelector("#chat-room-send-form").dispatchEvent(new Event("submit",{bubbles:true,cancelable:true}));true');
+  await wait('typeof window.__releaseWrite==="function"');
+  await b.evaluate('document.querySelector("#chat-room-send-form").dispatchEvent(new Event("submit",{bubbles:true,cancelable:true}));true');
+  assert.equal(await b.evaluate('window.__writes.length'), 1);
+  await b.evaluate('window.__holdWrite=false;window.__releaseWrite();true');
+  await wait('!document.querySelector("#chat-room-body").disabled');
+  await set('keep this uncertain draft ');
+  await b.evaluate('window.__networkFail=true;document.querySelector("#chat-room-send-form").dispatchEvent(new Event("submit",{bubbles:true,cancelable:true}));true');
+  await wait('document.querySelector("#chat-room-receipt").textContent.includes("Outcome unknown")');
+  assert.equal(await b.evaluate('document.querySelector("#chat-room-body").value'), 'keep this uncertain draft ');
+  assert.equal(await b.evaluate('window.__writes.length'), 2);
+  assert.match(await text('#chat-room-receipt'), /Nothing was retried/);
+});

packages/webui/tests/room-http.test.mjs

@@ -0,0 +1,114 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { request } from 'node:http';
+import { startServer } from '../src/serve.mjs';
+import { createChat } from '../src/chat.mjs';
+import { BusReadError } from '../src/bus.mjs';
+const P = '10000000-0000-4000-8000-000000000001', T = '20000000-0000-4000-8000-000000000001';
+const M = '30000000-0000-4000-8000-000000000001', N = '30000000-0000-4000-8000-000000000002';
+const headers = { host: 'console.example', 'x-user': 'jason', origin: 'https://console.example', 'sec-fetch-site': 'same-origin', 'content-type': 'application/json' };
+const lines = {
+  'unknown-addressee': 'Unknown addressee. Choose a room member.',
+  'addressee-ambiguous': "That addressee is ambiguous. Use a room member's instance name.",
+  'room-thread-name-taken': 'A room thread name is already in use. Resolve the conflicting thread before opening the room.',
+  'room-not-open': 'This room is not open. Open the room before sending.',
+};
+async function setup(t, { enabled = true } = {}) {
+  const calls = [], state = { value: null };
+  const chat = createChat({ call: async (verb, args) => {
+    if (verb === 'plugins') return { plugins: { channel: ['webui'] } };
+    calls.push([verb, args]);
+    if (state.value instanceof Error) throw state.value;
+    return state.value;
+  } });
+  const server = await startServer({ port: 0, preview: { host: 'console.example', header: 'x-user', user: 'jason' }, send: enabled ? async () => ({}) : null, chat, log: () => {} });
+  t.after(() => new Promise(r => { server.close(r); server.closeIdleConnections(); }));
+  const call = (action, { method = 'GET', value, hs = headers, query = '' } = {}) => new Promise((resolve, reject) => {
+    const req = request({ host: '127.0.0.1', port: server.address().port, path: `/api/chat/rooms/${P}/${action}${query}`, method, headers: hs }, res => {
+      let text = ''; res.on('data', c => text += c); res.on('end', () => resolve({ status: res.statusCode, body: JSON.parse(text) }));
+    });
+    req.on('error', reject); req.end(value === undefined ? undefined : JSON.stringify(value));
+  });
+  return { calls, state, call, chat };
+}
+test('C2-10c seam exposes three fixed room calls without thread.messages fanout', async t => {
+  const f = await setup(t);
+  for (const [method, args, verb] of [['roomOpen', { project: P }, 'room.open'], ['roomRead', { project: P, after: M, limit: 2 }, 'room.read'], ['roomSend', { project: P, body: '@bean  exact\ntext ' }, 'room.send']]) {
+    assert.equal(typeof f.chat[method], 'function');
+    f.state.value = [];
+    await f.chat[method](args);
+    assert.deepEqual(f.calls.at(-1), [verb, args]);
+  }
+  assert.deepEqual(f.calls.map(c => c[0]), ['room.open', 'room.read', 'room.send']);
+});
+test('C2-10c HTTP preserves original send, member receipt and the last grouped paging id', async t => {
+  const f = await setup(t);
+  f.state.value = { project: P, threads: [{ id: T, instance: 'bean', name: 'bean' }] };
+  const open = await f.call('open', { method: 'POST', value: {} });
+  assert.equal(open.status, 200); assert.equal(open.body.project, P);
+  assert.deepEqual(f.calls.at(-1), ['room.open', { project: P }]);
+  const body = ' \t@bean\n exact text  ';
+  f.state.value = { ids: [M, N], to: ['bean', 'chet'] };
+  const sent = await f.call('messages', { method: 'POST', value: { body } });
+  assert.equal(sent.status, 200); assert.deepEqual(sent.body.ids, [M, N]);
+  assert.deepEqual(f.calls.at(-1), ['room.send', { project: P, body }]);
+  const check = { citations: [{ scope: 'supporting', agent: 'demo/bean', file: 'a'.repeat(40), last: 'b'.repeat(40) }] };
+  f.state.value = [{ id: M, ids: [M, N], to: ['bean', 'chet'], body: 'one', check }];
+  const page = await f.call('messages', { query: `?after=${T}&limit=1` });
+  assert.equal(page.status, 200); assert.equal(page.body.after, N); assert.equal(page.body.hasMore, true);
+  assert.deepEqual(page.body.rows[0].check, check);
+  assert.deepEqual(f.calls.at(-1), ['room.read', { project: P, after: T, limit: 1 }]);
+});
+test('C2-10c room write fences and strict keys reject before transport', async t => {
+  const f = await setup(t), off = await setup(t, { enabled: false });
+  assert.equal((await off.call('open', { method: 'POST', value: {} })).status, 403);
+  for (const value of [{ project: P }, { owner: 'other' }, null, [], { body: 'x' }])
+    assert.equal((await f.call('open', { method: 'POST', value })).status, 400);
+  for (const value of [{}, { body: '' }, { body: 'x', to: ['bean'] }, { body: 'x', project: P }])
+    assert.equal((await f.call('messages', { method: 'POST', value })).status, 400);
+  for (const query of ['?limit=0', '?limit=201', '?after=x', '?project=other', `?after=${M}&after=${N}`])
+    assert.equal((await f.call('messages', { query })).status, 400);
+  for (const hs of [{ ...headers, origin: 'https://evil.example' }, { ...headers, 'sec-fetch-site': 'cross-site' }, { ...headers, 'x-user': 'other' }])
+    assert.ok([401, 403].includes((await f.call('open', { method: 'POST', value: {}, hs })).status));
+  assert.deepEqual(f.calls, []); assert.deepEqual(off.calls, []);
+});
+test('C2-10c all four room refusals are409 with fixed text, never transport prose', async t => {
+  const f = await setup(t);
+  for (const [code, message] of Object.entries(lines)) {
+    f.state.value = new BusReadError(code, 'private transport reason');
+    const r = await f.call(code === 'room-thread-name-taken' ? 'open' : 'messages', { method: 'POST', value: code === 'room-thread-name-taken' ? {} : { body: '@unknown hello' } });
+    assert.equal(r.status, 409, code); assert.equal(r.body.error, code); assert.equal(r.body.message, message); assert.equal(r.body.sent, false);
+    assert.equal(JSON.stringify(r.body).includes('private transport reason'), false);
+  }
+  assert.equal(f.calls.length, 4);
+});
+test('C2-10c malformed/lost write receipts are unknown and never retried', async t => {
+  const f = await setup(t);
+  for (const value of [null, { ids: [M], to: [] }, { ids: ['bad'], to: ['bean'] }, new Error('socket closed')]) {
+    f.state.value = value;
+    const before = f.calls.length, r = await f.call('messages', { method: 'POST', value: { body: 'hi' } });
+    assert.equal(r.status, 503); assert.equal(r.body.error, 'outcome-unknown'); assert.equal(r.body.sent, 'unknown');
+    assert.equal(f.calls.length, before + 1);
+  }
+});
+
+test('C2-10c room receipts reject coerced member keys and duplicate grouped ids', async t => {
+  const f = await setup(t);
+  f.state.value = { project: P, threads: [{ id: T, instance: 17, name: 17 }] };
+  const opened = await f.call('open', { method: 'POST', value: {} });
+  assert.equal(opened.status, 503); assert.equal(opened.body.sent, 'unknown');
+  for (const row of [{ id: M, ids: [M, M], to: ['bean', 'chet'], body: 'x' }, { id: M, ids: [M, N], to: ['bean', 'bean'], body: 'x' }]) {
+    f.state.value = [row];
+    const read = await f.call('messages');
+    assert.equal(read.status, 502); assert.equal(read.body.error, 'invalid-response');
+  }
+});
+
+test('C2-10c granted-user room calls never borrow the owner transport', async () => {
+  const owner = [], user = [];
+  const chat = createChat({ owner: async (...a) => { owner.push(a); return { plugins: { channel: ['webui'] } }; },
+    call: async (...a) => { user.push(a); throw new BusReadError('human-required'); } });
+  await assert.rejects(chat.roomRead({ project: P, limit: 100 }), { code: 'human-required' });
+  assert.deepEqual(owner, [['plugins', {}]]);
+  assert.deepEqual(user, [['room.read', { project: P, limit: 100 }]]);
+});