gosalyn: Case 2 C2-13a precheck refuses a port floor at or below the Console port, and a bwrap bind test shows EACCES below 1024 (mos-1100)

docs/plans/2026-10-20_case2-rows.md

@@ -845,7 +845,9 @@ checks below. C2-13b adds the library checks to the same file. It refuses unless
   `<user>`'s shell, outside the unit's hardening, so it can't show that the unit lets bwrap run. Design
   10 step 9 checks that.
 - `net.ipv4.ip_unprivileged_port_start` is above the Console's `--port`, read from the installed
-  Console unit. Otherwise a session could bind that port while the Console is down (design 9.3).
+  Console unit. It refuses when the floor is at or below the port, because a lowered floor lets any
+  `mosaic` process bind the port, a session included, and makes the Console's capability pointless
+  (design 9.3, mos-1100).
 - When some instance's harness is claude-code, one marker prompt run through the host's claude with
   `--system-prompt-file` shows that it replaces the default prompt. The claude version is printed. With
   the design's model path, Bean and Chet run pi, so this check is skipped unless she adds a claude-code
@@ -897,6 +899,14 @@ with `ZAI_API_KEY=x` followed by `ZAI_API_KEY=`. A search of the test output for
 finds nothing. `factory` passes with the tester on and refuses a business file with a library project.
 `library` refuses with the tester on.
 
+The bind test (mos-1100). A session can't take the Console's port. The test builds the argv a real
+session gets, with `binds()` and `sandboxArgv()` from `packages/seat/src/sandbox.mjs`, around a node
+one-liner that binds `127.0.0.1` on a port below 1024 and prints the error code. Inside bwrap the bind
+fails with `EACCES`. The control runs the same one-liner in the same sandbox on a free port of 1024 or
+above, and that bind succeeds, so the failure comes from the port floor and not from a broken sandbox.
+The test reads `net.ipv4.ip_unprivileged_port_start` first. If the test host's floor is at or below the
+chosen port, the test fails and says so, rather than skipping.
+
 ### Out of scope
 
 Running either script on a host. Design 10 steps 2 to 9 are Jason's, and the root step 2c is ops-01's