briefs: mos-1442 approvals for the 590 and 591 rows (#1811, #1812), the 295 N1 revoke-window row (#1813); DEFERRED 295 N1 (sage)

docs/plans/2026-10-23_gate-env-rows.md

@@ -5,7 +5,7 @@ added after 219 landed (5fdfd7275). Vikunja 590 and 591.
 
 ## Brief: claude-session test builds the memory slug the way the CLI does (Vikunja 590)
 
-Owner Rocko. Reviewer Dewey. Gate owner Sage.
+Gitea #1811. Owner Rocko. Reviewer Dewey. Gate owner Sage.
 
 `packages/harness/tests/claude-session.test.mjs` "CLAUDE.md files and auto-memory don't reach the
 model" (:270) plants MARKER-MEMORY under `projects/<slug>/memory/MEMORY.md`. It builds the slug at
@@ -26,11 +26,15 @@ runs whole and green three times: under a mktemp TMPDIR, under a TMPDIR whose na
 under one with a space if the CLI accepts it (record it if it doesn't). Mutant: revert :272 to the
 old regex; under the `_` TMPDIR it must fail at :298.
 
+Mos approved the :272 change under mos-1272 (mos-1442 point 1). No assertion changes. With the
+fix, the :298 control plants MARKER-MEMORY where the CLI reads it, so the restricted check at :291
+no longer passes vacuously for the memory marker under a `_` TMPDIR.
+
 Until this row lands, every gate keeps using an alphanumeric mktemp TMPDIR (mos-1432).
 
 ## Brief: shell suites remove the compose network they create (Vikunja 591)
 
-Owner Gizmoduck. Reviewer Filbert. Gate owner Sage.
+Gitea #1812. Owner Gizmoduck. Reviewer Filbert. Gate owner Sage.
 
 `scripts/run-task.sh` reaches `packages/processing-control/src/containers.mjs` `containerArgs`
 (:16), which runs `docker compose run --rm`. `--rm` removes the container but leaves the project's
@@ -60,4 +64,45 @@ Gate: Filbert approves the diff. On Sage's gate, in a gap, both suites run whole
 and after each run, record `docker network ls` filtered to that run's project name: the network
 must be absent after the run. Mutant: drop the `network rm`, and the new check must fail.
 
+Mos approved the export, the trap's `network rm` and one new check per suite under mos-1272
+(mos-1442 point 2). Both existing traps (test-task.sh:11, test-release.sh:15) keep everything they
+do now, including the RELEASE restore and the sandbox rm. The rm is only added. Before building on
+the export, confirm that COMPOSE_PROJECT_NAME reaches compose: `containers.mjs:25` passes
+`options` to spawnSync, and `compose.yaml` has no top-level `name:`. `scripts/mosaic-task.mjs:326`
+builds `spawnEnv` from `process.env`, so the task path looks like it carries the variable. Check
+every path the two suites take. If any path drops it, stop and report to Sage, and change no
+product file.
+
 Until this row lands, each gate removes its own `<dir>_default` network at the end (mos-1438).
+
+## Brief: a revoked run's late bus call stops it instead of exiting 22 (295 N1)
+
+Gitea #1813. Owner Morgana. Reviewer Dewey. Gate owner Sage. After row 272 is done, because both rows touch the broker.
+
+Row 295 (#1801, 2efd127ce) ends a revoked user's thread claims in one transaction (`#revokeLost`,
+`packages/bus/src/broker.mjs:1012`), and the launcher then sends SIGTERM. A run that calls the bus
+between the claim end and the SIGTERM fails `#agent` (:1068-1070) with not-holder. The runner
+(`packages/harness/src/runner.mjs:486-498`) counts not-holder as a gone session and exits 22, so
+the run record reads error. Row 302 gave the launcher's own release the answer launcher-released,
+which the runner maps to stopped. It covers threadIdle and landRelease only (`#launcherReleased`,
+:431).
+
+Change: a run whose claim `#revokeLost` ended answers thread-revoked on every call that needs the
+claim, until the run ends. The runner maps thread-revoked from a call to stopped, the same way it
+maps launcher-released. A new claim keeps refusing thread-revoked (:1371) as it does now. Not-holder
+from any other cause is unchanged.
+
+Tests, red first under mos-1272:
+- a forcing test holds the window open after the sweep and before SIGTERM, makes one bus call, and
+  checks the thread-revoked answer and the runner's stopped exit;
+- a run that lost its claim some other way still gets not-holder.
+
+Mutants:
+- drop the revoked check in `#agent`;
+- have the runner map thread-revoked to 22;
+- mark every ended claim as revoked.
+
+Changes to existing tests go to Mos through Sage first.
+
+Gate: Dewey approves the design and then the manifest. On Sage's gate, the bus, harness and cli
+suites run green, along with every `scripts/test-*.sh`.

docs/plans/DEFERRED.md

@@ -639,3 +639,8 @@ Open follow-up (duckworth-0228 N6), bound to row 272 (264e, #1777). Row 270 caps
 ## Row219 N1: the thread list and header don't show the persona label (U6)
 
 Open follow-up (dewey-0913 N1). Row 219 (#1720, C2-09a) lands on 5fdfd7275 with UI items U1-U5. The Create picker labels each instance with its persona name and instance key. U6 is deferred: the thread list and the thread header still show only the instance key (agents/rocko/work/queue-219/BUILD.md:81). The next row that touches the Console thread list (packages/webui/src/public/chat.js) shows the persona label there and in the header, with a chat-browser test and a mutant that the test kills.
+
+
+## Row295 N1: a revoked run's late bus call exits 22, not stopped
+
+Open follow-up (morgana-0167, sage-3318, sage-3360), to become a row. Row 295 (#1801) lands on 2efd127ce. Revocation ends a user's thread claim in one transaction, and the launcher then sends SIGTERM. A run that calls the bus between the claim end and the SIGTERM gets not-holder and exits 22, so its record reads error rather than stopped. Row 302's launcher-released answer covers only threadIdle and landRelease. The row gives a revoked claim the same shape: calls that need the claim answer thread-revoked until the run ends, and the runner maps that answer to stopped. It needs a forcing test that holds the window open and a mutant the test kills. Brief: docs/plans/2026-10-23_gate-env-rows.md; owner Morgana, reviewer Dewey, after row 272.