From ec8cb10c04eaa120406a04556f174b330e0670d7 Mon Sep 17 00:00:00 2001 From: Jason Woltje Date: Sat, 24 Oct 2026 08:46:02 -0500 Subject: [PATCH] Row 286 r5: record green read-grant fixtures, whole suites and restored semantic mutants --- BUILD-LOG.md | 2 + agents/rockerduck/work/queue-286/BUILD.md | 61 + .../work/queue-286/candidate-manifest.sha256 | 17 +- .../gate-r5/B285-M1-chief-write-control.txt | 2 + .../gate-r5/B285-M1-chief-write-mutant.txt | 4 + .../gate-r5/B285-M1-chief-write-restored.txt | 2 + .../gate-r5/P1-force-push-control.txt | 2 + .../gate-r5/P1-force-push-mutant.txt | 6 + .../gate-r5/P1-force-push-restored.txt | 2 + .../gate-r5/P2-drop-inode-control.txt | 2 + .../gate-r5/P2-drop-inode-mutant.txt | 5 + .../gate-r5/P2-drop-inode-restored.txt | 2 + .../work/queue-286/gate-r5/bus-r5.txt | 1035 +++++++++++++++++ .../work/queue-286/gate-r5/library-r5.txt | 160 +++ .../queue-286/gate-r5/mutants-summary.txt | 3 + .../work/queue-286/gate-r5/token-search.txt | 14 + .../queue-286/gate-r5/touched-credential.txt | 46 + .../work/queue-286/gate-r5/touched-sync.txt | 32 + docs/SESSIONS.md | 2 + 19 files changed, 1398 insertions(+), 1 deletion(-) create mode 100644 agents/rockerduck/work/queue-286/gate-r5/B285-M1-chief-write-control.txt create mode 100644 agents/rockerduck/work/queue-286/gate-r5/B285-M1-chief-write-mutant.txt create mode 100644 agents/rockerduck/work/queue-286/gate-r5/B285-M1-chief-write-restored.txt create mode 100644 agents/rockerduck/work/queue-286/gate-r5/P1-force-push-control.txt create mode 100644 agents/rockerduck/work/queue-286/gate-r5/P1-force-push-mutant.txt create mode 100644 agents/rockerduck/work/queue-286/gate-r5/P1-force-push-restored.txt create mode 100644 agents/rockerduck/work/queue-286/gate-r5/P2-drop-inode-control.txt create mode 100644 agents/rockerduck/work/queue-286/gate-r5/P2-drop-inode-mutant.txt create mode 100644 agents/rockerduck/work/queue-286/gate-r5/P2-drop-inode-restored.txt create mode 100644 agents/rockerduck/work/queue-286/gate-r5/bus-r5.txt create mode 100644 agents/rockerduck/work/queue-286/gate-r5/library-r5.txt create mode 100644 agents/rockerduck/work/queue-286/gate-r5/mutants-summary.txt create mode 100644 agents/rockerduck/work/queue-286/gate-r5/token-search.txt create mode 100644 agents/rockerduck/work/queue-286/gate-r5/touched-credential.txt create mode 100644 agents/rockerduck/work/queue-286/gate-r5/touched-sync.txt diff --git a/BUILD-LOG.md b/BUILD-LOG.md index e1bdc57ca..8e4cdde63 100644 --- a/BUILD-LOG.md +++ b/BUILD-LOG.md @@ -5525,3 +5525,5 @@ claim. Receipts and limitations in agents/lena/work/queue-296/BUILD.md and run-r - 2026-10-24 (rockerduck, row286 / #1791, r4 before gate, sage-4079): all 15 r3 commits transplanted to d0a6a87cd on new rockerduck/row286-r4. Three product overlaps auto-merged with row217 preserved; two append-log conflicts retain both histories. Range-diff and adjacent hunk evidence in agents/rockerduck/work/queue-286/BUILD.md. UNTESTED r4: Git-only until own-branch push, library/bus rerun waits for CLEAR after row285. - 2026-10-24 (rockerduck, row286 / #1791, r5 before gate, sage-4097/4100): transplanted r4 onto 1f3d0350f; kept row285 library.write routing and chief write-grant refusal plus both append-log histories. Chief fixture refs added; T7/T9 mint setup now pins real refusal then seeds read-only fixture as explicitly ruled, keeping real revoke/fire assertions. Scratch role declaration mutation removed; range-diff/drift evidence recorded. No r5 tests yet; CLEAR starts after own-branch push. + +- 2026-10-24 (rockerduck, row286 / #1791 r5 gate, sage-4097/4100): own-worktree installs; touched credential6/6 and sync24/24; whole library151/151 and bus981/981, zero fail/skip/cancel. P1 forced refspec, P2 missing inode compare and B285-M1 chief write-grant guard each killed on ERR_ASSERTION with green before/after controls and exact restoration hashes. All gate-output fixture searches zero. No normal red; source unchanged after pre-gate push045eec61a. Plain text evidence in agents/rockerduck/work/queue-286/BUILD.md and gate-r5; round2 candidate push follows. diff --git a/agents/rockerduck/work/queue-286/BUILD.md b/agents/rockerduck/work/queue-286/BUILD.md index 4d9bc783a..94fca9f02 100644 --- a/agents/rockerduck/work/queue-286/BUILD.md +++ b/agents/rockerduck/work/queue-286/BUILD.md @@ -1140,3 +1140,64 @@ successfully; no tests/mutants/build began. This historical fact corrects no cod For r5, sage-4097/4100 grants CLEAR after the own-branch push: every touched test file whole, full library/bus and affected broker mutant. Gate results follow as new entries; historical r3 logs above are not r5 results. + +## r5 CLEAR gate complete — sage-4097 / sage-4100 (2026-10-24) + +Source under test: pushed pre-gate 045eec61a. Own-worktree root npm ci +--ignore-scripts --no-audit --no-fund: exit0,128 packages; packages/webui same: +exit0,2 packages. No canonical npm/rm or module linking. Fresh TMPDIR created +with mktemp -d /mnt/storage/scratch/tmp/XXXXXX. Every test command used + timeout -k 10 (180 seconds focused,900 library,1800 bus). + +Every touched file whole, then package suites: +- node --test --test-reporter=tap packages/bus/tests/library-credential.test.mjs: + 6 tests,6 pass,0 fail/skip/cancel/todo; exit0. +- node --test packages/library/tests/sync.test.mjs: + 24 tests,24 pass,0 fail/skip/cancel/todo; exit0. +- node --test packages/library/tests/*.test.mjs: + 151 tests,151 pass,0 fail/skip/cancel/todo; exit0. +- node --test packages/bus/tests/*.test.mjs: + 981 tests,981 pass,0 fail/skip/cancel/todo; exit0. +No first-run red, no second red, no normal-run old-test red. No test/source edit +after these runs. T7/T9 passed on the ruled read seed; real grant raise refused, +real revoke/fire deleted the rows, and fetch/status refusals remained intact. + +Mutants, serially applied/restored in this worktree, with fresh green controls +before and after each. Custom scratch reporter emits only test name, assertion +code/location and counts, suppressing assertion values so a deliberately broken +askpass cannot print a fixture token in diagnostics: +- P1-force-push: add + only before syncCommand's push refspec. Control2/2, + mutant0/2 exit1 with ERR_ASSERTION at sync.test.mjs:331 and :365, + restored2/2. Target full SHA256 restored: + 784af63a417b547b195ca835878daeba5b696b42a83a4c95de6728a0efa75e38. +- P2-drop-inode: remove only askpass's inode compare. Control1/1, + mutant0/1 exit1 with ERR_ASSERTION at swapped-file refusal sync.test.mjs:510/:526, + restored1/1. Target full SHA256 restored: + 5c9b528fd69a2493f04933fc84f352b1101d276d69d9982806975def614fd740. +- B285-M1-chief-write: row285's affected broker mutant, remove only + ` || role.definition === STAFF_TO` from #giteaRole. Control1/1, + mutant0/1 exit1 with ERR_ASSERTION at gitea-grant.test.mjs:270, + restored1/1. Target full SHA256 restored: + 9e16ff6225cf5e438b0694e2f2b5831c2750f2d0dfc43c7f2f257d8cdacf9ffd. + This repeats Magica's M1 for the rebase's newly inherited chief refusal. + Runtime.mjs and library/index.mjs match r4 byte-for-byte; no new hunk there. + +Whole package suites ran on the restored candidate source before mutations; +all package bytes afterward match 045eec61a (git diff --quiet -- packages), and +each mutant's restored positive control passed. No product or old assertion edit +was made during the gate. Existing T7/T9 revoke/fire helpers still byte-identical +to r4. No shell suites here: Sage's full landing gate remains authoritative. + +All captured gate and control/mutant/restored outputs have zero exact matches for +six fixture-token values and zero generic fixture-token pattern matches. Full +plain text outputs and count-only search receipts are under gate-r5/. T9 also +checks every issued fake token against captured runtime lines. No fixture values +are printed in the search receipts. Prior pre-CLEAR static-output slip remains +honestly recorded earlier and is separate from these clean gate outputs. + +Gate complete; final bookkeeping commit updates only evidence, append-only logs +and manifest. The candidate manifest covers the nine package paths and plain text +receipts, excluding shared append logs and itself. Round2 reviews must examine +sage-4100's reversal of mint setup as well as the base delta. + +Scratch gate directory retained: /mnt/storage/scratch/tmp/ZMiVek diff --git a/agents/rockerduck/work/queue-286/candidate-manifest.sha256 b/agents/rockerduck/work/queue-286/candidate-manifest.sha256 index 82abb4368..c2b94a207 100644 --- a/agents/rockerduck/work/queue-286/candidate-manifest.sha256 +++ b/agents/rockerduck/work/queue-286/candidate-manifest.sha256 @@ -1,9 +1,24 @@ 7fab157be380502b726c4a84772bfb667850766062e4952b73f172f5ada363ed agents/ludwig/work/queue-286/BUILD.md -4de1780a7dbfdedfb8606fd12e4d4122735d3bca9308b6b2288690f5fffa2b9f agents/rockerduck/work/queue-286/BUILD.md +3b19f4e6e569fabe701e2068bbded1e2e52cd1451fe98e198530c86d046df91b agents/rockerduck/work/queue-286/BUILD.md 1698321de2b17251ae3dd55bf3b79e03770d20d932fb60d514ee58700f80fb3b agents/rockerduck/work/queue-286/candidate-r3.sha256 647776d3f75e00023ce1a1b286ff67a0f7a4958165dcebe24216fb6bde27e610 agents/rockerduck/work/queue-286/candidate-r4.sha256 e5026111e3c84f1294c80631fc5d5dad6dc77166209acdfd07c6ea8755469e19 agents/rockerduck/work/queue-286/gate-bus.txt 4e191637baa4d8683679fd6e84d81e29ec6fe64faf38b4b33f9b5965fce1dfcf agents/rockerduck/work/queue-286/gate-library.txt +bb60e11b8d74da9eda11f838d99713871c55af43857811941bc1f98a3bc54ed8 agents/rockerduck/work/queue-286/gate-r5/B285-M1-chief-write-control.txt +1b659445b779b6ba0ccbddc9f1c4c20d6dad7aeee8b59ee6c4dad97beec067c6 agents/rockerduck/work/queue-286/gate-r5/B285-M1-chief-write-mutant.txt +bb60e11b8d74da9eda11f838d99713871c55af43857811941bc1f98a3bc54ed8 agents/rockerduck/work/queue-286/gate-r5/B285-M1-chief-write-restored.txt +a6e9e05ee925068c53bd22ad0dac905f1d4855f81d54943b6b44fe8beb934deb agents/rockerduck/work/queue-286/gate-r5/P1-force-push-control.txt +1253e62d913b8b2ef60a63149c0c1dbcd94ca348011d0a59aca11810ead1c13f agents/rockerduck/work/queue-286/gate-r5/P1-force-push-mutant.txt +a6e9e05ee925068c53bd22ad0dac905f1d4855f81d54943b6b44fe8beb934deb agents/rockerduck/work/queue-286/gate-r5/P1-force-push-restored.txt +bb60e11b8d74da9eda11f838d99713871c55af43857811941bc1f98a3bc54ed8 agents/rockerduck/work/queue-286/gate-r5/P2-drop-inode-control.txt +b0d2c28880856007400440f6158fd9ed2032a33de44540d419c8eb303e32fbf5 agents/rockerduck/work/queue-286/gate-r5/P2-drop-inode-mutant.txt +bb60e11b8d74da9eda11f838d99713871c55af43857811941bc1f98a3bc54ed8 agents/rockerduck/work/queue-286/gate-r5/P2-drop-inode-restored.txt +154bb3d6772186ec889e54b546929b799bf31648db7d3590f097aba4c539dde1 agents/rockerduck/work/queue-286/gate-r5/bus-r5.txt +909bf1e6bd694275bb2555956673a330689d5acaaa9702eb2c040a5938900d60 agents/rockerduck/work/queue-286/gate-r5/library-r5.txt +2d8a4f70e4a59dcccf147060af9c21930499a14de209889fec59e22244b0ba4e agents/rockerduck/work/queue-286/gate-r5/mutants-summary.txt +95f0d339495713d55a98fba6336a23e37023cdac429725647f71b30774f622a6 agents/rockerduck/work/queue-286/gate-r5/token-search.txt +33b7f339b6d8e45fa049f19cc07d9a21ec8d9294ae74e7fa0201d5a2c777897f agents/rockerduck/work/queue-286/gate-r5/touched-credential.txt +f08f55c5d326acb1dfa5e91f1e3a7c33ec1f1a7044e3e9829f59bd1306e6d584 agents/rockerduck/work/queue-286/gate-r5/touched-sync.txt 50291819572752733a1c33e846e1e1e8d66e89b677a6a6d0cc7d2402e8fa82ea agents/rockerduck/work/queue-286/mutant-M1.txt ade72e9641ac5ee97b1ceaa266d54b48d28d0d613f415a030547963664a04646 agents/rockerduck/work/queue-286/mutant-M2.txt f640bc30c0e07dad11d57f8f00397a76638f5fbc4c71fc56e748f9cb6f4e30e1 agents/rockerduck/work/queue-286/range-diff-r4.txt diff --git a/agents/rockerduck/work/queue-286/gate-r5/B285-M1-chief-write-control.txt b/agents/rockerduck/work/queue-286/gate-r5/B285-M1-chief-write-control.txt new file mode 100644 index 000000000..10b1331a0 --- /dev/null +++ b/agents/rockerduck/work/queue-286/gate-r5/B285-M1-chief-write-control.txt @@ -0,0 +1,2 @@ +SUMMARY {"tests":1,"failed":0,"passed":1,"cancelled":0,"skipped":0,"todo":0,"topLevel":1,"suites":0} +SUMMARY {"tests":1,"failed":0,"passed":1,"cancelled":0,"skipped":0,"todo":0,"topLevel":1,"suites":0} diff --git a/agents/rockerduck/work/queue-286/gate-r5/B285-M1-chief-write-mutant.txt b/agents/rockerduck/work/queue-286/gate-r5/B285-M1-chief-write-mutant.txt new file mode 100644 index 000000000..b6c15b494 --- /dev/null +++ b/agents/rockerduck/work/queue-286/gate-r5/B285-M1-chief-write-mutant.txt @@ -0,0 +1,4 @@ +FAIL X-G1: the chief of staff refuses at raise, whatever its definition, identity and publish declare ERR_ASSERTION + at async TestContext. (file:///home/jwoltje/.t3/worktrees/mosaic-stack/rockerduck-row286-r3/packages/bus/tests/gitea-grant.test.mjs:270:3) +SUMMARY {"tests":1,"failed":1,"passed":0,"cancelled":0,"skipped":0,"todo":0,"topLevel":1,"suites":0} +SUMMARY {"tests":1,"failed":1,"passed":0,"cancelled":0,"skipped":0,"todo":0,"topLevel":1,"suites":0} diff --git a/agents/rockerduck/work/queue-286/gate-r5/B285-M1-chief-write-restored.txt b/agents/rockerduck/work/queue-286/gate-r5/B285-M1-chief-write-restored.txt new file mode 100644 index 000000000..10b1331a0 --- /dev/null +++ b/agents/rockerduck/work/queue-286/gate-r5/B285-M1-chief-write-restored.txt @@ -0,0 +1,2 @@ +SUMMARY {"tests":1,"failed":0,"passed":1,"cancelled":0,"skipped":0,"todo":0,"topLevel":1,"suites":0} +SUMMARY {"tests":1,"failed":0,"passed":1,"cancelled":0,"skipped":0,"todo":0,"topLevel":1,"suites":0} diff --git a/agents/rockerduck/work/queue-286/gate-r5/P1-force-push-control.txt b/agents/rockerduck/work/queue-286/gate-r5/P1-force-push-control.txt new file mode 100644 index 000000000..ba200c9f5 --- /dev/null +++ b/agents/rockerduck/work/queue-286/gate-r5/P1-force-push-control.txt @@ -0,0 +1,2 @@ +SUMMARY {"tests":2,"failed":0,"passed":2,"cancelled":0,"skipped":0,"todo":0,"topLevel":2,"suites":0} +SUMMARY {"tests":2,"failed":0,"passed":2,"cancelled":0,"skipped":0,"todo":0,"topLevel":2,"suites":0} diff --git a/agents/rockerduck/work/queue-286/gate-r5/P1-force-push-mutant.txt b/agents/rockerduck/work/queue-286/gate-r5/P1-force-push-mutant.txt new file mode 100644 index 000000000..a57229f9a --- /dev/null +++ b/agents/rockerduck/work/queue-286/gate-r5/P1-force-push-mutant.txt @@ -0,0 +1,6 @@ +FAIL C2-03b argv: a push sends one full commit to the branch, fast-forward only, with the fetch prefix ERR_ASSERTION + at TestContext. (file:///home/jwoltje/.t3/worktrees/mosaic-stack/rockerduck-row286-r3/packages/library/tests/sync.test.mjs:331:10) +FAIL C2-03b T2 and T3: a moved tip reports the race after one fetch, and a second race refuses stale-base ERR_ASSERTION + at TestContext. (file:///home/jwoltje/.t3/worktrees/mosaic-stack/rockerduck-row286-r3/packages/library/tests/sync.test.mjs:365:10) +SUMMARY {"tests":2,"failed":2,"passed":0,"cancelled":0,"skipped":0,"todo":0,"topLevel":2,"suites":0} +SUMMARY {"tests":2,"failed":2,"passed":0,"cancelled":0,"skipped":0,"todo":0,"topLevel":2,"suites":0} diff --git a/agents/rockerduck/work/queue-286/gate-r5/P1-force-push-restored.txt b/agents/rockerduck/work/queue-286/gate-r5/P1-force-push-restored.txt new file mode 100644 index 000000000..ba200c9f5 --- /dev/null +++ b/agents/rockerduck/work/queue-286/gate-r5/P1-force-push-restored.txt @@ -0,0 +1,2 @@ +SUMMARY {"tests":2,"failed":0,"passed":2,"cancelled":0,"skipped":0,"todo":0,"topLevel":2,"suites":0} +SUMMARY {"tests":2,"failed":0,"passed":2,"cancelled":0,"skipped":0,"todo":0,"topLevel":2,"suites":0} diff --git a/agents/rockerduck/work/queue-286/gate-r5/P2-drop-inode-control.txt b/agents/rockerduck/work/queue-286/gate-r5/P2-drop-inode-control.txt new file mode 100644 index 000000000..10b1331a0 --- /dev/null +++ b/agents/rockerduck/work/queue-286/gate-r5/P2-drop-inode-control.txt @@ -0,0 +1,2 @@ +SUMMARY {"tests":1,"failed":0,"passed":1,"cancelled":0,"skipped":0,"todo":0,"topLevel":1,"suites":0} +SUMMARY {"tests":1,"failed":0,"passed":1,"cancelled":0,"skipped":0,"todo":0,"topLevel":1,"suites":0} diff --git a/agents/rockerduck/work/queue-286/gate-r5/P2-drop-inode-mutant.txt b/agents/rockerduck/work/queue-286/gate-r5/P2-drop-inode-mutant.txt new file mode 100644 index 000000000..fc6471248 --- /dev/null +++ b/agents/rockerduck/work/queue-286/gate-r5/P2-drop-inode-mutant.txt @@ -0,0 +1,5 @@ +FAIL C2-03b T5 helper: the named seat's user and file, never a link, 0644, another uid, or a swapped file ERR_ASSERTION + at refused (file:///home/jwoltje/.t3/worktrees/mosaic-stack/rockerduck-row286-r3/packages/library/tests/sync.test.mjs:510:40) + at TestContext. (file:///home/jwoltje/.t3/worktrees/mosaic-stack/rockerduck-row286-r3/packages/library/tests/sync.test.mjs:526:3) +SUMMARY {"tests":1,"failed":1,"passed":0,"cancelled":0,"skipped":0,"todo":0,"topLevel":1,"suites":0} +SUMMARY {"tests":1,"failed":1,"passed":0,"cancelled":0,"skipped":0,"todo":0,"topLevel":1,"suites":0} diff --git a/agents/rockerduck/work/queue-286/gate-r5/P2-drop-inode-restored.txt b/agents/rockerduck/work/queue-286/gate-r5/P2-drop-inode-restored.txt new file mode 100644 index 000000000..10b1331a0 --- /dev/null +++ b/agents/rockerduck/work/queue-286/gate-r5/P2-drop-inode-restored.txt @@ -0,0 +1,2 @@ +SUMMARY {"tests":1,"failed":0,"passed":1,"cancelled":0,"skipped":0,"todo":0,"topLevel":1,"suites":0} +SUMMARY {"tests":1,"failed":0,"passed":1,"cancelled":0,"skipped":0,"todo":0,"topLevel":1,"suites":0} diff --git a/agents/rockerduck/work/queue-286/gate-r5/bus-r5.txt b/agents/rockerduck/work/queue-286/gate-r5/bus-r5.txt new file mode 100644 index 000000000..6dc097fa5 --- /dev/null +++ b/agents/rockerduck/work/queue-286/gate-r5/bus-r5.txt @@ -0,0 +1,1035 @@ +✔ R4: the timer sweep after a hand edit ends only the lost user's run; its next call refuses thread-revoked (68.519328ms) +✔ R4: an expiry with no write and no request ends the run at the next timer sweep (56.248465ms) +✔ R4: a downgrade to viewer is a loss (48.199304ms) +✔ R4: another user's request after a hand edit ends the lost user's run, and its own run stays (49.702575ms) +✔ R4: a request reads the access file only when its stamp changed, once per change (46.764646ms) +✔ R4: access.reload ends the lost runs at once for the human; the tester, a reader, an agent and a user are refused (63.679854ms) +✔ R4: threadsState marks revoked: true on the lost user's thread only, a pending message included (39.531504ms) +✔ R4: threadsState after an expiry with no write and no sweep ends the claim before it marks the row revoked (45.92936ms) +✔ R4: a new run of a revoked thread refuses thread-revoked at bind and at claim; a rebind is allowed (45.675842ms) +✔ R4 runtime: a hand edit ends the run at the first timer period, intervalMs is checked, and close stops the timer (107.463043ms) +✔ REQ-LIMIT-4 3h copy migrates to 3i: every row keeps its seq, the sequence carries over, and only the account CHECK changes (217.711813ms) +✔ REQ-LIMIT-4 a 3h→3i step that fails partway leaves the store at 3h with every row, the sequence and the schema intact (214.621399ms) +✔ REQ-LIMIT-4 the 3h engine refuses a migrated store, migrating or not, and leaves it as it was (193.26607ms) +✔ parseAddress: one (1.984909ms) +✔ parseAddress: many (0.193095ms) +✔ parseAddress: repeat (0.155663ms) +✔ parseAddress: plain (0.155844ms) +✔ parseAddress: stop (0.164186ms) +✔ parseAddress: EOF tag (0.146791ms) +✔ parseAddress: EOF last tag (0.134944ms) +✔ parseAddress: leading whitespace (0.43819ms) +✔ parseAddress: tags only (0.145444ms) +✔ parseAddress: empty (0.242554ms) +✔ parseAddress: whitespace (0.152788ms) +✔ parseAddress: bare at (0.10911ms) +✔ parseAddress: punctuation is a name (0.106756ms) +✔ parseAddress rejects non-text without coercion (0.507651ms) +✔ the mounted address parser has no import dependency (0.314877ms) +✔ agents: a held role with nothing on the bus is idle; a role session gets the claim rows unchanged (47.577097ms) +✔ agents: working counts what the holder received and has not read; routed alone is not working (51.528562ms) +✔ agents: input needed is the role's open decisions routed to the human, gated first, then oldest (83.654282ms) +✔ agents: working wins over waiting, and Input needed still shows (37.663491ms) +✔ agents: a new holder doesn't inherit what the last one left unread; decisions stay with the role (36.876186ms) +✔ agents: state reads only its own business, even for a run name both use (35.225931ms) +✔ agents: a message the holder released unread is stranded; the next holder gets nothing and cannot read it (41.918185ms) +✔ agents: a message the holder read is not stranded; one the current holder has not read is not listed (47.166812ms) +✔ agents: stranded is oldest first and capped at 50 for a role (181.784528ms) +✔ agents: stranded is per role and per business (70.250957ms) +✔ agents: a message routed to a held role and not yet received is not stranded (32.172404ms) +✔ REQ-DEC an approval outlives its run and a broker restart; a new run of the instance consumes it once (74.077356ms) +✔ REQ-DEC another instance of the same definition cannot consume an approval, and its refusal consumes nothing (44.261426ms) +✔ REQ-DEC REQ-THREAD-1 a thread approval is consumed only by a run holding the same thread (63.012228ms) +✔ REQ-DEC a later run of the same instance supersedes an open decision; another instance cannot (52.729261ms) +✔ REQ-DEC REQ-THREAD-1 a thread decision is superseded only from the same thread (47.076182ms) +✔ REQ-DEC REQ-THREAD-1 a thread instance decision raised before row 121 is not consumed or superseded by any thread run (63.708719ms) +✔ launch identity is stamped, payload identity is refused and stale holder cannot send (45.120751ms) +✔ decision classes route from policy; gated resolution is human-only, choice and target must match (53.144991ms) +✔ claim exclusion, holder release, gated revoke and rerouting to a new holder are atomic (67.53799ms) +✔ launch events require a human CLI capability; generic emit cannot forge authority events (37.087248ms) +✔ within-role decisions close atomically and invalid options or blocking omissions refuse (34.503182ms) +✔ a recommendation that is not exactly one option key refuses invalid-recommendation after the options (51.497884ms) +✔ observer capabilities read human inbox but cannot mutate or forge launch identity (33.907753ms) +✔ task action subjects and linked decision trail are complete and ordered (57.283314ms) +✔ launch binding is durable and reconnecting requires the identical trusted record (29.354994ms) +✔ business isolation includes inherited object names and cross-business message references (38.012511ms) +✔ authority never transfers between action, target, unresolved or replaced role holder; a later run of the instance keeps it (54.760998ms) +✔ task projection uses schema current view, skipping earlier and equal-start polls (33.517651ms) +✔ revocation permanently bars the old run from reclaiming first, including after broker restart (48.224151ms) +✔ empty message references refuse before storage; refusal-evidence failure stays a typed error (30.950323ms) +✔ both arbiters require human resolution when their cross-role route is themselves (50.935677ms) +✔ the shipped coder role raises task.reassign as gated to the human; task.scope.change stays cross-role (44.248924ms) +✔ S1 adapter takes resolved limits and refs, rejects mismatched instance, never mutates input (2.461459ms) +✔ channel conversion preserves the four proof/transport byte baselines and modules cannot import a proof caller (6.926388ms) +✔ channel recovery still requires the same shim path and rejects an absent or forged proof (649.984075ms) +organization: {"event":"reload-needs-restart","business":"demo"} +organization: {"event":"reload-needs-restart","business":"demo"} +organization: {"event":"reload-needs-restart","business":"demo"} +organization: {"event":"reload-needs-restart","business":"demo"} +organization: {"event":"reload-needs-restart","business":"demo"} +organization: {"event":"reload-needs-restart","business":"demo"} +organization: {"event":"reload-needs-restart","business":"demo"} +organization: {"event":"reload-needs-restart","business":"demo"} +organization: {"event":"reload-needs-restart","business":"demo"} +✔ REQ-COS-1, REQ-ROLE-2: the chief of staff ends a run with a reason and no decision, and the reason is logged (67.164684ms) +✔ REQ-ROLE-2: a role without role.end still needs a resolved decision to revoke (70.257584ms) +✔ REQ-ROLE-2: storage accepts a revoke with a reason or a decision and aborts one with neither (45.81914ms) +✔ REQ-ROLE-2: the chief of staff may still cite a decision, and a decision alone is the old path (43.689128ms) +✔ REQ-ROLE-2: a role without role.end still ends a run through a resolved decision, which is recorded and has no reason (52.229233ms) +✔ REQ-ROLE-2: a reason is required, bounded, and never sent with a decision (52.534827ms) +✔ REQ-COS-1: the chief of staff cannot end its own run; its end of the assistant stops the assistant's thread run (55.995354ms) +✔ REQ-LIMIT-1, REQ-COS-1: organization.set from the chief of staff reaches the shared writer, named as the actor (47.76799ms) +✔ REQ-LIMIT-1, REQ-COS-1: a refused organization.set logs action.refused and no action.allowed, like a refused limits.set (67.530577ms) +✔ REQ-LIMIT-1: organization.set is refused for every caller whose role file lacks organization.change (70.359547ms) +✔ REQ-LIMIT-1: the chief of staff is logged as allowed, and organization.set takes only the human's keys (68.037858ms) +✔ REQ-COS-1: organization.revision answers the revision alone to the chief of staff and spends nothing (52.968796ms) +✔ REQ-COS-1, REQ-LIMIT-1: organization.revision is refused for every caller whose role file lacks organization.change (60.953763ms) +✔ REQ-ROLE-3, REQ-LIMIT-1: a chief-of-staff change is validated, written and logged like a human's; an invalid one is refused (169.417055ms) +✔ REQ-COS-1: the chief of staff reads the revision, changes the file with it, and reads again after a stale one is refused (179.792378ms) +✔ Q169: the chief of staff's change of the assistant is validated, written and logged; a stale or protection-stripping one is refused (158.127281ms) +✔ row 65, Q169: the chief's change of the assistant's route runs the routing checks, and a valid one saves as the chief (120.940658ms) +✔ REQ-ROLE-2, REQ-COS-1: the 3c→3d migration lets the chief of staff end a held role with a reason; neither is still refused (168.018337ms) +✔ row 194 T10: the chief's reason end of a kept instance refuses instance-kept, holds the claim and spends nothing (42.172909ms) +✔ row 194 T10 (Q2): a role.revoke citing a decision the human resolved still ends a kept run (46.484052ms) +✔ row 194 T10 (B7): the chief's organization.set of a kept instance's model refuses before the writer; the human's limits.set does not (38.601464ms) +✔ row 194 T13: organization.set and limits.set refuse the launch, retired, keep and noHire keys before the writer (45.240446ms) +✔ row 194 T18 (D2.4): from a chief session veto.set and instances.set refuse, and nothing reaches the writer (49.173515ms) +✔ row 194 T8: the chief hires with a reason and no decision, the writer gets the reason as context, and the log names it (42.221929ms) +✔ row 194 T11: on a bus with two businesses, the chief of one hires and fires only in its own (35.067822ms) +✔ row 194 T8: hire and fire need a reason of 1 to 500 characters and refuse a decision key (61.413377ms) +✔ row 194 T8 (sage-1471): only the chief hires or fires; every other role refuses role-not-chief, even one granted the actions (55.404975ms) +✔ row 194 T8 (sage-1471): a chief whose authority lacks role.hire or role.fire refuses decision-required before the writer (96.859945ms) +✔ row 194 T8a: a re-hire of a fired name goes to the writer like a hire, and the writer's refusals pass through by name (53.236004ms) +✔ row 194 T8b: a definition is hireable only when every action is on HIRE_ALLOWED, it is version 2, the chief lists it and noHire doesn't (1422.215909ms) +✔ row 194 T8b: a hire without the role files configured refuses not-configured (40.645147ms) +✔ row 194 T9: a fire revokes the claim, cancels open requests, asks the launcher to kill the runs, then delists and logs (48.116023ms) +✔ row 194 T9a (bus): a fire end's done writes lifecycle.end.killed and lifecycle.end.alive with run and pid, and an unknown stop's reason; a terminate's done or a bad stop refuses (53.514641ms) +✔ row 194 T9: fire refusals come before step A and leave the claim, the requests and the file alone (44.76614ms) +✔ row 194 T9c: a writer failure at B leaves the instance firing, and the repeat delists and logs once (49.46022ms) +✔ row 194 T9c: a failure at C leaves the fire unlogged and the instance firing, and the repeat logs it (54.893793ms) +✔ row 194 W-N1: a fire.done before a later fire.stopped of the same instance leaves it firing; another instance's done does not end it (45.700943ms) +✔ row 194 T10: a hire or fire of a kept name refuses instance-kept before the writer (38.72981ms) +✔ row 194 T10: a fire the writer's check refuses from the file stops nothing and leaves the instance launchable (38.896059ms) +✔ row 194 T18: hire and fire take only their own keys, and a refused call writes nothing (55.384395ms) +✔ row 194 T8, T9, T18: through the runtime the chief hires and fires with the real writer, the receipt carries the reason, and a refusal leaves the file alone (115.422976ms) +✔ row 194 W-N1: the launcher's take of a launch or regenerate of a firing instance closes it as instance-firing (44.764613ms) +✔ C2-06 held library lock gives the agent citation-unavailable and its retry reason (5268.414134ms) +✔ C2-06 malformed sync state is availability failure, never a fabricated invalid cite (60.357766ms) +✔ C2-06 no mirror or freshly initialized empty mirror still means no served citation (63.050928ms) +✔ C2-06 coder send_message guard covers every table refusal; inserts nothing (231.436126ms) +✔ C2-06 research send_message guard covers every table refusal; inserts nothing (185.415725ms) +✔ C2-06 stored check carries the file author trailer at an unrelated cited tip (124.685245ms) +✔ C2-06 supporting cite cannot state canon, including a folder also marked playground (94.118057ms) +✔ C2-06 supporting file stores supporting scope and its real agent trailer (94.616665ms) +✔ C2-06 check evidence and insert are atomic when storing evidence fails (81.987043ms) +✔ C2-06 live limits change both directions; unreadable file keeps checks and exact fixed texts (104.33274ms) +✔ C2-06 page store is session-local, caps 20 fetches and 200 KiB, drops at disconnect (203.025494ms) +✔ C2-06 transport passes safe capped guard reason; ordinary refusal envelope is byte-identical (108.969643ms) +✔ C2-06 non-library businesses retain role.claim shape and unguarded free sends (55.183762ms) +✔ C2-06 thread messages carry file/last evidence with one read per distinct path (186.864051ms) +✔ C2-06 guarded request snapshot cannot change between check and insert (54.390208ms) +✔ C2-06 library.limits.set is human-only and invalid settings leave file and receipts unchanged (83.65792ms) +✔ C2-06 runtime reads changed and unreadable reply limits without restarting (221.989272ms) +✔ comment cursors isolate businesses, move only forward and remain append-only (33.711618ms) +✔ only trusted sync writes validated cursors; events and cursor share rollback (26.876142ms) +✔ explicit 3b copy migration preserves evidence and opens as 3g; normal startup never migrates (159.70865ms) +✔ migration refuses active writers and drifted legacy schemas, with no partial upgrade (187.871851ms) +✔ named migration registry chains 3b through 3g to a fixture-only future version in order (172.697959ms) +✔ migration refuses mismatched source metadata without changing schema or evidence (80.791021ms) +✔ offline command migrates only the supplied fixture root and reports usage errors (297.093289ms) +✔ N4: the console verbs are exactly the preview and the console resolve, and decision.resolve is not one (1.514068ms) +✔ bindConsole takes only the business human and a three-string owner subject (59.118075ms) +✔ J1, Q188: only a console cap reaches the console verbs, and a console cap reaches nothing else (94.379986ms) +✔ preview: the two real answers, a grant summary and the digest, for an open grant request only (54.243334ms) +✔ J1, J2: a decision that is not an eligible grant request refuses both console verbs (65.487246ms) +✔ N2, J13: a Console approve records via console and the owner, before the executor starts, and the grant runs once (137.838102ms) +✔ J15: a Console deny closes with the other key and starts nothing (153.379961ms) +✔ J2: approve and deny come from approvalChoice and the options, not a fixed yes and no (186.350451ms) +✔ J11: a stale digest or a key outside the two refuses decision-stale and writes nothing (66.292868ms) +✔ J14: a via console close with no matching human.input approves nothing (76.7326ms) +✔ recordEvent keeps human.input reserved, so no agent forges a console answer (54.196618ms) +✔ J7: a console proof over the socket binds a cap for its one call and the reply releases it (171.11324ms) +organization: {"event":"reload-needs-restart","business":"demo"} +organization: {"event":"reload-needs-restart","business":"demo"} +✔ M6: a creative raise refuses decision-not-allowed, cited or not, and no decision row appears; the assistant still raises (79.336993ms) +✔ a creative instance sends only to the user and hears only from the user (90.557482ms) +✔ M10 through the broker: the chief and the tester are refused on bean, the human's limits.set of its models key works (155.652306ms) +✔ row 256 T6 the human deletes a creative instance through the broker; the chief and the tester are refused at the verb (126.033789ms) +✔ X4: register adds a store reference to the running bus, and issue then writes the key (34.436446ms) +✔ X4: register runs the constructor's reference checks (1.484364ms) +✔ X4: register reads no file, so a key file left at the path stays unused, and a live token refuses (18.677844ms) +✔ X3, X4: unregister drops an entry with no token and refuses one with a live token (20.393938ms) +✔ X5: a claim holds the slot, so a second claim and a host.run refuse host-busy until release (11.737131ms) +✔ X5: a claim made while a host.run is in flight refuses host-busy (12.424473ms) +✔ X5: a stale release leaves a later claim in place (0.89238ms) +✔ X5: abortClaim aborts a live claim and says pending, and revoke's abort reaches a claim too (11.470207ms) +✔ credentials gives human and reader sessions service, account, role, date and state, and nothing else (32.882164ms) +✔ credentials refuses a role session and any argument (34.118746ms) +✔ credentials reads the status on each request, and a broker without one lists none (43.731937ms) +✔ the broker process answers credentials without a token, path or variable in its output, log or store (269.544686ms) +✔ T1: a store reference with no file yet starts, and the agent is not-issued until issue (8.461362ms) +✔ T1: a store path the reference does not own, or no store root, refuses the reference (0.804348ms) +✔ T1: a wrong mode on the store root, a business dir, an agent dir or the file refuses start (3.244395ms) +✔ T1: a missing store root refuses start; a missing {file} reference still refuses start (0.737875ms) +✔ T1: a store file that is a directory or a symlink refuses start (1.437532ms) +✔ T2: useFor keys from the session only (3.187249ms) +✔ T5: issue, rotate, revoke and delete are live with no restart, and revoke holds across one (7.969687ms) +✔ T5: a failed commit leaves the token on disk but not in memory, and a bad token or date writes nothing (2.609445ms) +✔ T5: revoke drops the token from memory before the unlink, so a failed unlink still leaves it revoked (3.16957ms) +✔ T5: revoke of a {file} reference forgets the token and never unlinks the file (1.063827ms) +✔ T5: delete refuses an agent dir holding anything but tokens (3.115728ms) +✔ D5: every credentials use( call site is on the allowlist (63.126021ms) +✔ row 199: the lifecycle verbs refuse every session but the human, and the tester revokes only (76.727675ms) +✔ T5: issue, rotate, revoke and delete are live, rewrite the business file and leave one receipt each, with no value anywhere (179.455459ms) +✔ only validated broker references load; returned data and exceptions cannot expose a known token (4.050517ms) +✔ bad file modes, symlinks, repository/data paths, malformed tokens and missing dates refuse (2.49792ms) +✔ expiry refuses use and env references never become client data (0.910087ms) +✔ S1 parsed service refs work, service mismatch refuses, Gitea rotation due is a warning state (1.768619ms) +✔ opaque tokens shorter than 16 characters refuse before use (0.394162ms) +✔ each C-suite role file carries the same two lists: human, chief-of-staff, pm, cto (2.457969ms) +✔ chief-executive-officer: messages to and from the user, chief of staff, pm and cto pass (102.113677ms) +✔ chief-executive-officer: a message to or from the coder, reviewer or assistant is refused and logged, and nothing is stored (91.188206ms) +✔ chief-executive-officer: another C-suite role isn't on the lists either (67.131696ms) +✔ chief-financial-officer: messages to and from the user, chief of staff, pm and cto pass (81.269787ms) +✔ chief-financial-officer: a message to or from the coder, reviewer or assistant is refused and logged, and nothing is stored (77.230498ms) +✔ chief-financial-officer: another C-suite role isn't on the lists either (66.711138ms) +✔ chief-information-officer: messages to and from the user, chief of staff, pm and cto pass (88.192774ms) +✔ chief-information-officer: a message to or from the coder, reviewer or assistant is refused and logged, and nothing is stored (93.729041ms) +✔ chief-information-officer: another C-suite role isn't on the lists either (74.485279ms) +✔ chief-information-security-officer: messages to and from the user, chief of staff, pm and cto pass (86.363174ms) +✔ chief-information-security-officer: a message to or from the coder, reviewer or assistant is refused and logged, and nothing is stored (85.13545ms) +✔ chief-information-security-officer: another C-suite role isn't on the lists either (77.735665ms) +✔ chief-marketing-officer: messages to and from the user, chief of staff, pm and cto pass (94.983704ms) +✔ chief-marketing-officer: a message to or from the coder, reviewer or assistant is refused and logged, and nothing is stored (76.411052ms) +✔ chief-marketing-officer: another C-suite role isn't on the lists either (63.826822ms) +limits: {"event":"limit-reached","business":"demo","check":"daily-quota","export":"mayLaunch","subject":{"instance":"coder","provider":"anthropic","model":"opus","account":"jason-max"},"path":["tokens","daily","jason-max"],"limit":0,"count":0,"unknownTurns":0} +usage: {"event":"usage-unknown","business":"demo","run":"run1","instance":"coder","turn":"9a7ba5e4-6d46-4631-b4b6-8b826372dcb3","source":"@none","code":"baseline-unknown"} +limits: {"event":"limit-reached","business":"demo","check":"daily-quota","export":"mustStop","subject":{"instance":"coder","provider":"anthropic","model":"opus","account":"jason-max"},"path":["tokens","daily","jason-max"],"limit":0,"count":0,"unknownTurns":1} +usage: {"event":"usage-unknown","business":"demo","run":"run1","instance":"coder","turn":"f2f72d84-2a6f-4fd3-a506-59504a3e3587","source":"@none","code":"baseline-unknown"} +✔ REQ-LIMIT-2 runtime: limits counts the daily quota, and mayLaunch refuses only the account at it (217.013493ms) +✔ REQ-LIMIT-4 runtime: a run bound with the account writes it on its usage records and stops at the quota (93.564976ms) +✔ REQ-LIMIT-4 runtime: a run bound without an account records null and the daily quota never stops it (76.353392ms) +✔ REQ-LIMIT-4 bindLaunch keeps the account off session.launched, refuses one that is not an identifier, and takes null as none (26.262196ms) +✔ a human resolve sends the raising role one message from the human, and its request is the answer (60.112198ms) +✔ a cross-role decision resolved by its arbiter comes from that role and run, with no request (39.733806ms) +✔ a human withdraw sends one message with the note (43.578735ms) +✔ a human seen before the close leaves the request on the close's answer, not the seen (54.914468ms) +✔ the raising run's withdraw, a supersede, a within-role raise and seen send nothing (54.159662ms) +✔ refused closes send nothing: invalid-choice, decision-closed, not-resolver (61.841569ms) +✔ a raising role nobody holds at the close gets the message on the next claim (56.173541ms) +✔ a human DECISION send keeps its own instruction as the request, not a close's answer (56.766403ms) +✔ a cross-role raise whose arbiter the raiser does not hear from is refused and stores nothing (59.954081ms) +✔ a gated raise by a role that does not hear from the human is refused and stores nothing (52.90695ms) +✔ a route the raiser hears from is allowed, checked from the route to the raiser (59.397407ms) +✔ a refused supersede withdraws nothing (53.364692ms) +✔ the assistant's within-role and gated raises still work (60.013122ms) +✔ roles lists open decisions routed to a role, and never the human inbox (55.063211ms) +✔ recent lists closed decisions of every route, newest close first, with how each closed (54.131039ms) +✔ recent gives the closing event as closed when the decision was seen first (51.140795ms) +✔ recent stops at RECENT rows (170.545714ms) +✔ every row is what trail already gives the same session for that id (96.965755ms) +✔ a role session can't list decisions, so it can't read another role's open decisions (81.792484ms) +✔ decisions is a read: one business, strict arguments, nothing written (77.729421ms) +✔ endLaunch writes session.ended, releases the run claim and kills its capabilities (38.050496ms) +✔ endLaunch refuses an unknown run, a second end and a rebind of the ended run (23.167216ms) +✔ a restarted broker refuses to rebind an ended run; a refused rebind leaves the run unbound (30.824625ms) +✔ endLaunch leaves a claim another run took alone (31.073345ms) +✔ refuse records action.refused against the caller with the code only (24.106807ms) +✔ launches off refuses role.launch with launch-revoked until launches on (35.975568ms) +✔ broker process: launch ops authorize role.launch, record refusals and end runs (298.65765ms) +✔ row 281 T2: a fire with host grants on two hosts and a Gitea grant answers with a job, then revokes all three (454.990924ms) +✔ row 281 T3 (sage-2575): a delete with grants takes two requests: the first starts the job, the next completes (427.880079ms) +✔ row 281 T3b (Q2): a delete whose job refuses on host B; the retry refuses grant-revoke-failed and revokes only B and Gitea (382.302519ms) +✔ row 281 T3b: B cleared by hand with hosts.revoke; the next delete starts a job for Gitea and the leftover line only (429.377397ms) +✔ row 281 T3c (sage-2575 condition 4): a delete of an instance with no grant completes in one request (99.350732ms) +✔ row 281 T4: host B unreachable in a fire: the job refuses, A stays revoked, B and Gitea untouched; a repeat completes (364.733277ms) +✔ row 281 T4b (Q1): a line a manual hosts.revoke left on C is removed by the fire, with its close (154.611966ms) +✔ row 281 T4b (Q1): with C unreachable, the fire completes and names the line in grantsLeft (152.116085ms) +✔ row 281 T5: Gitea's admin token can't be checked: the job refuses with the Gitea grant intact (193.740588ms) +✔ row 281 T5b (N1): a failed token DELETE refuses gitea-left; the repeat retries only this agent's entries (518.503543ms) +✔ row 281 T6 (sage-2574): a host decision approved before the fire and run after it ends revoked, with nothing applied (116.588968ms) +✔ row 281 T6b (sage-2574): a Gitea decision approved before the fire and run after it ends revoked before any Gitea write (139.999576ms) +✔ row 281 T6c: a host executor in flight aborts and ends revoked; a Gitea executor in flight is awaited and leaves no token (359.069624ms) +✔ row 281 T6d (B1): undecided host and Gitea decisions are in the set, and approved after the fire both end revoked (156.215205ms) +✔ row 281 T6e (B1): a grant raise refuses instance-fired while firing and after the fire, goes through after a rehire, and refuses grant-revoke-running during a delete job (200.585851ms) +✔ row 281 T7: an instance with no grant fires as today, synchronously, with the same events (88.709712ms) +✔ row 281 T9 (B3): one step G per agent; the manual verbs refuse while it runs, and sweep names it running (405.788141ms) +✔ row 281 T10 (B2): the fire and the delete answer while their jobs are held, and the broker answers other verbs (380.295104ms) +✔ row 281 T11 (C1): a fire's job completes after the chief's run ends and processing halts (152.297846ms) +✔ row 281 T12 (C1, N7): a step B refusal in the job is fire.failed, and the repeat runs B and C synchronously (141.824242ms) +✔ row 281 T13 (N4): a restart records each held job interrupted once, with one message each; an ended job gets none (277.496698ms) +✔ row 281 T14 (N1, sage-2653): a host removed under an undecided decision stops the fire on host-unknown; the human's no closes it, and the repeat fire has no job (111.000981ms) +✔ row 239 T4: a refusal after the writer's revoke is named -revoked, in the job's fire.failed and notice, a synchronous fire and a delete (153.839292ms) +✔ row 239 T4b: an unmarked step B refusal keeps its code, and the notice says nothing of the tokens (130.396994ms) +✔ X-G3: on scratch 1.27.1, a grant makes the user, mints, forks, checks reach, writes the file, and revoke deletes the token (12931.740247ms) +✔ versionAtLeast compares numbers and refuses a prerelease of 1.27.0 (2.173521ms) +✔ X-G1: a raise that fails a check refuses and stores nothing (108.944597ms) +✔ X-G1: a creative role, a role without identity and a missing or due slot refuse at raise (382.59725ms) +✔ X-G1: the chief of staff refuses at raise, whatever its definition, identity and publish declare (79.338131ms) +✔ X-G2: admin set refuses each failed check and writes nothing, then writes the slot once (308.738312ms) +✔ X-G3 to X-G8: an approve makes the user, mints the token, forks, checks reach and writes the file, record and grant.applied (177.198019ms) +✔ X-G4: a user this stack did not make, an admin, a disabled user and a remade user each refuse (559.851305ms) +✔ X-G6 and X-G8: the user and mint steps are written before their calls, and each result after its call (182.615319ms) +✔ X-G4: a fork by the seat user of another repository than the project refuses fork-foreign (160.454077ms) +✔ X-G5: a failure after the mint deletes the token, unloads nothing it did not load and leaves no file (250.925552ms) +✔ X-G5: a token delete that fails is left at Gitea, shown by status and taken by sweep (203.574348ms) +✔ X-G5: a mint that fails deletes by name, and a refusal at step 0 leaves the decision unspent (283.11036ms) +✔ X-G5: an agent held for an unknown token is refused at step 0 with no Gitea call (104.071419ms) +✔ X-G5 and X-G9 (step 7): a rotation whose old-token delete fails stays applied with the old id left (285.928235ms) +✔ X-G10: in a rotation the store file holds the new token before the old one is deleted (248.122631ms) +✔ X-G6: a rotation cut before the rename settles back at once, and the old token stays live (265.270515ms) +✔ X-G6: a rotation whose step 8 write fails is settle-pending, and a restart settles it forward (317.437711ms) +✔ X-G6: a restart settles an open rotation back when the file still holds the old token (223.844605ms) +✔ X-G6: a restart settles an open rotation forward when the file holds the new token (242.930922ms) +✔ X-G6: a 401 on the file token loses the grant: both tokens go, the record goes and memory unloads (268.687441ms) +✔ X-G6: a 403, 404, 500, a hang and a dropped socket each leave the rotation settle-pending with nothing deleted (1582.536308ms) +✔ X-G6: a file token no grant minted is held; the next restart says so again; a revoke clears it and takes both ids (290.187804ms) +✔ N9: a revoke of an open rotation, then a restart: no settle, no Gitea call and no message (237.322475ms) +✔ N9: a 404 on a delete by id counts as done (218.083885ms) +✔ X-G6: a restart undoes each step a killed child left, and spends an approved unspent decision (766.228292ms) +✔ X-G6: a restart with no admin slot leaves the user an orphan and the token left (106.419982ms) +✔ X-G7: a change to the definition, identity, publish remotes or admin slot after the raise ends decision-mismatch (204.683446ms) +✔ X-G7 and X-G9: an admin rotate voids open decisions, and rotate --finish deletes what was left (163.531672ms) +✔ X-G9: a rotate whose name is taken refuses and writes nothing; remove takes the slot away (88.8837ms) +✔ X-G9: a slot past its rotate-by date refuses a run at step 0, leaving the decision unspent (67.033519ms) +✔ X-G11: run refuses every caller but the human, an unapproved, a spent and a busy decision (130.470831ms) +✔ kill switch (plan :16): while halted the chief still reads grants.status, and an agent grants.revoke refuses (113.062236ms) +✔ X-G11: a revoke while the executor runs aborts it and the grant ends revoked (114.957416ms) +✔ X-G11: a revoke unloads memory and removes the file before its Gitea delete (142.268896ms) +✔ X-G11: a revoke during a rotation step 7 ends it revoked, and step 8 writes no record back (194.497363ms) +✔ X-G11: a revoke while a sweep settles a rotation, forward or back, ends it revoked with no record (388.102702ms) +✔ X-G11: a revoke during a settle whoami that finds a foreign token ends it revoked, not held (194.553187ms) +✔ X-G11: a revoke during a settle whoami that gets a 401 ends it revoked, not lost (197.302477ms) +✔ X-G12: a token that reaches wider than its forks fails with the repository named (445.474356ms) +✔ X-G12: reach is paged by X-Total-Count and a count that does not add up refuses (245.243532ms) +✔ X-G13: an agent cannot record a grant event, and the trigger refuses one from any writer but the grant writer (40.879054ms) +✔ X-G14: credentials delete fires the user: tokens go, login is prohibited, and grant.revoke.closed records it (301.968161ms) +✔ X-G14: a fire whose token delete or login PATCH fails lands it in serviceLeft (153.10946ms) +✔ X-G14: a fire whose user is gone or remade skips the fire steps and says why (255.604876ms) +✔ X-G14: a sweep retries a fire only for the user it fired: a remade or gone user is skipped and named (300.836868ms) +✔ X-G14: a revoke Gitea cannot reach stays open, and a restart closes it (131.808466ms) +✔ row 281 T8: a tester grants.revoke refuses tester-dev-only once bus.tester is off; the human revoke keeps its records and starts no job (111.609583ms) +✔ X-G15: look-alike commit steps outside the grant writer are ignored at start, by revoke and by status (112.609446ms) +✔ X-G15: a look-alike spend under another kind with the grant writer pair is not an open grant (44.528019ms) +✔ status lists the slot, users, grants and nothing secret, and every grants verb needs service gitea (111.91565ms) +✔ 3j copy migrates to 3k: every row kept, and sqlite_master gains only the two tables and their keys (172.829326ms) +✔ a 3j→3k step that fails partway leaves the store at 3j with every row and the schema intact (226.719838ms) +✔ the 3j engine refuses a migrated store, migrating or not, and leaves it as it was (196.218048ms) +✔ gitea_users: one user per business and agent, an id above 0, a 16-hex nonce and a real decision (27.193059ms) +✔ gitea_grants: one grant per agent, a projects array, a token id above 0, and only for a recorded user (38.873626ms) +✔ G1, A1: only the chief raises a grant, and a refused raise stores nothing and runs no keyscan (74.532109ms) +✔ G1: grant goes only with credential.mint, row a takes only host-enroll, and E1 refuses each bad field (108.142965ms) +✔ G5, A5, A6: the scanned key set must equal the requested set, or host-key-mismatch and nothing stored (63.481501ms) +✔ G4 (host-enroll block, M1): the broker appends the keys, fingerprints and sudo line, and the cap counts the block (60.085033ms) +✔ G6, X1: the human's cli yes starts enrollment, which writes the record, the key file and the events in order (83.323967ms) +✔ A2, A4: a credential.mint without grant, and a no, start nothing (268.789608ms) +✔ A3, X1: a resolve by the tester or an agent starts nothing (245.774998ms) +✔ G6 (duckworth-0081 B3): a withdraw by the chief or the human, and an arbiter resolve, start nothing (261.176221ms) +✔ G10 (duckworth-0081 B1): a second start for a spent decision refuses decision-consumed, and an unresolved or agent-resolved one not-authorized (87.386998ms) +✔ A8, S1: two approved enrollments for one host: the second ends host-enrolled and the pin stays (105.10293ms) +✔ A9: the hosts primary key refuses a second record for (business, host) (46.766225ms) +✔ X3: a failure at step 2 deletes the record again and ends grant.failed, with no key file (72.295916ms) +✔ A10, X3: at start a resolved, unspent enrollment is spent and ends interrupted, and never runs late (49.861729ms) +✔ X3: at start an enrollment that stopped after its registry step loses its record and key file (71.643283ms) +✔ G24 first sentence, M2, A12: tags are mosaic- and 32 hex, and differ by business, agent and host (0.375048ms) +✔ E4: hosts.check sets the record ready and records grant.host.checked; a non-zero list leaves it pending (79.464072ms) +✔ G20 (duckworth-0081 B3): the human's hosts.check marks the host ready, and the reader refuses (73.188203ms) +✔ G18 (duckworth-0081 B2), broker half: a check refused host-key-mismatch leaves the host pending-install with no grant.host.checked (66.910996ms) +✔ E4: a check whose installer fingerprint differs from the record refuses host-changed (72.076322ms) +✔ E4, G21: hosts.remove is the human's or the tester's, deletes the key and the record, and records grant.host.removed (74.010009ms) +✔ G21, F1, F2, M4, A22: hosts.remove refuses host-line-left on a guarded hostLineLeft, and ignores look-alikes (74.584515ms) +✔ hosts.remove refuses host-in-use while a grant record names the host (71.089004ms) +✔ the grant writer refuses a body outside section 7's shape (38.468348ms) +✔ recordEvent refuses reserved-event for a grant.* action or operation (38.799727ms) +✔ row 280: an occupied TCP port is attempted, refused, and retried with our sshd (110.957066ms) +✔ row 280: every injected picker sample is unprivileged and outside the ephemeral range (2.782722ms) +✔ G7: an Approve installs the tagged line, logs in with the new key, and writes the key file, record and grant.applied (776.515338ms) +✔ G7: a commands change on a live grant updates the record in one transaction and keeps the key and line (638.392133ms) +✔ G8: a failure at install or verify removes the line and leaves no record, key file or reference (1747.651815ms) +✔ G8: a failed remove adds hostLineLeft and tells the human to sweep (720.030158ms) +✔ G8: a failure in step 5 before commit unlinks the key file, drops the reference and removes the line (763.457688ms) +✔ G8: a store fault in the commit transaction ends host-failed with no record, key file, reference or line (769.883937ms) +✔ G8: a failed step 1 check spends the decision and runs nothing remote (107.702002ms) +✔ G9: a registry, definition or commands change between raise and Approve ends decision-mismatch before any remote step (623.241455ms) +✔ G9: an agent no longer a role or no longer declaring host ends with its code, spent (107.732506ms) +✔ G10: a second start refuses decision-consumed, and an unresolved or agent-resolved decision not-authorized, writing nothing (590.244657ms) +✔ G15: no event, message or decision holds the private key (595.877816ms) +✔ G23: a revoke during install ends grant.failed revoked with no key file, no grant and no line (576.987227ms) +✔ G23 (row 249): an add that writes after an abort's remove leaves hostLineLeft until the sweep (899.458591ms) +✔ G23 (row 249): an add that writes after a timed-out install's remove leaves hostLineLeft until the sweep (863.989039ms) +✔ G23: a revoke recorded after the raise and before the start ends step 1 revoked, and a held slot ends host-busy (519.711128ms) +✔ G24: names at 64 characters with . and _ give distinct tags of the fixed length (0.395838ms) +✔ G11: a restart after install removes the line, then ends interrupted with the tag, holding the slot until then (215.209534ms) +✔ G11: a restart after a new key's commit, with the key file written, ends with no key file, record, reference or line (219.285919ms) +✔ G11: a restart after a commands change's commit leaves the record as it was and asks nothing of the host (514.645514ms) +✔ G11 (B2): a restart before step 1, spent or not yet spent, ends interrupted and nothing runs later (71.266633ms) +✔ G11: a remote undo that fails ends interrupted with hostLineLeft and the sweep hint (280.979697ms) +✔ G11: a restart leaves a finished grant alone, and the reconcile adds nothing for it (530.980354ms) +✔ N1 (G27): the start sweep unlinks host. files with no record in loaded businesses only, and refuses a store dir that is not private (6.663382ms) +✔ G12: the human's hosts.revoke deletes the record, the key file, the reference and the line, with a closed marker (644.991413ms) +✔ G12 (N4): a revoke with no record still removes the computed tag's line, with granted false; bad args refuse (226.156141ms) +✔ G13: a revoke during install aborts the executor, which ends revoked, and the line goes (588.285541ms) +✔ G26: the human, the assistant and the tester revoke; the chief and a pm refuse; sweep is the human's or the tester's (584.620036ms) +✔ row 281 T8: a tester hosts.revoke refuses tester-dev-only once bus.tester is off, and a human revoke writes no job records (665.046688ms) +✔ G27: a restart after step 1 sweeps the key file and runs step 3 once the bus is up; status shows the revoke until then (683.362224ms) +✔ G27: after step 2 with the host down, the restart closes the marker with hostLineLeft; a marker without a revoke id is not reopened (963.492458ms) +✔ G27: a key file a revoke could not unlink is reported left and goes at the next start (662.490941ms) +✔ G28: a commands change, then a revoke, then a restart leave no record, key, reference or line (702.244463ms) +✔ G24 (B4): hosts.sweep removes only this business's recorded tags no live grant holds, and records what it left (962.687599ms) +✔ G12: the local steps finish before the host step, so a host that hangs leaves the agent no access (696.701744ms) +✔ G23 (X5): a revoke right after the spend reaches the executor's claim, so the grant ends revoked (224.152191ms) +✔ G23 (X5): a revoke that lands as verify returns ends revoked with no record, key file or line (672.925553ms) +✔ G13: a revoke whose host remove fails still drops the record and key, and reports the line left for a sweep (672.565183ms) +✔ G22: enroll, check, grant, host.run, a commands change the next host.run uses, and a revoke that kills a run in flight (1222.296148ms) +✔ mos-1163: a grant whose agent became a creative role after the raise ends host-creative-role at step 1, spent, with nothing remote (64.170363ms) +✔ sage-1908: once the agent of an applied grant is a creative role, host.run refuses host-creative-role, runs nothing remote and keeps the record (515.911871ms) +✔ G1 (host): only the chief raises a host grant, a grant on any other action refuses, and nothing is stored (62.862139ms) +✔ G1, R4: the grant takes exactly method, agent, host, commands and rotateBy, and an unknown method refuses (75.182695ms) +✔ row 236 (#1742): a gitea grant on a broker with no Gitea path refuses gitea-not-configured, and nothing is stored (43.200895ms) +✔ G2: an agent whose definition lacks host refuses host-not-declared, and an unknown agent unknown-role (57.58647ms) +✔ mos-1163: a grant whose agent is a creative role refuses host-creative-role, even when its definition declares host (48.076942ms) +✔ G3: wildcard, shell, empty and other 210 D6 argv prefixes refuse invalid-request (102.564318ms) +✔ R4 rotateBy (sage-1782): a real calendar day after today UTC, or invalid-request (71.221017ms) +✔ G19: a grant naming a host that is pending-install refuses host-not-ready, and an unknown host host-unknown (50.060901ms) +✔ R4, G5: the raise routes to the human and its event body binds the eight fields with their hashes (43.800335ms) +✔ G4 (host block): the broker appends the host, each prefix, the rotate date and new key or change (71.753096ms) +✔ 3i copy migrates to 3j: every row kept, and sqlite_master gains only the two tables, their keys and the guard (174.583913ms) +✔ a 3i→3j step that fails partway leaves the store at 3i with every row and the schema intact (208.810803ms) +✔ the 3i engine refuses a migrated store, migrating or not, and leaves it as it was (159.237742ms) +✔ A22b, sage-1703: a session-written grant.* row from before the step survives it, and the grant readers ignore it (130.737903ms) +✔ the guard: a grant.* action or operation on action.allowed needs the (NULL, grant) actor (28.177251ms) +✔ hosts: one record per business and host, a ready host has its installer and check, grants need the host (29.054555ms) +organization: {"event":"reload-needs-restart","business":"demo"} +✔ row 298 runtime: human scope approval writes the file and organization history at the supplied revision (144.274034ms) +✔ row 298 (Q3): only the human at the cli reads or sets the scope; agents, the tester, a reader and the Console refuse (154.900931ms) +✔ row 298 (Q1): organization.set and limits.set refuse a grantScope key, and nothing is written (97.440259ms) +✔ row 298 (Q3): the human verb writes the scope and a grant.scope record with the human proof and both sha256 (95.042623ms) +✔ row 298 (Q4): an in-scope Gitea grant is issued with no inbox item, logged with 236 records, and revocable (242.064689ms) +✔ row 298: an out-of-scope Gitea grant waits for the human, whose Approve still issues it (204.928993ms) +✔ row 298: with no scope, a bad scope or an unreadable file, an in-scope-looking grant waits (290.662159ms) +✔ row 298 (Q6): a chief-of-staff instance that is not launch.by never raises in scope (89.201416ms) +✔ row 298 (Q5): a scope narrowed between the raise and the spend ends the grant scope-changed (128.178173ms) +✔ row 298 (Q2): an in-scope host grant is spent with no Approve; ls never covers lsblk, nor a scope command extra arguments (124.149793ms) +✔ row 298 (Q5): a host scope narrowed before the spend ends scope-changed (100.085343ms) +✔ row 298 Q4: missing scope evidence or a bad scope digest cannot authorize execution (161.745982ms) +✔ row 298 T4/T8: an in-scope host grant issues, records and revokes through the existing executor (126.356757ms) +✔ row 298 T6: host enrollment stays open for human Approve even with both methods in scope (86.649629ms) +✔ row 298: scope without an organization revision never closes automatically (82.289041ms) +✔ REQ-WAIT-1: the broker hard waits are exactly the list, and match the business vocabulary (2.037858ms) +✔ REQ-WAIT-2: a business granting a hard wait at either class is refused; the actions that left are grantable (42.069432ms) +✔ REQ-DEC-2: every hard wait goes to the human, cited or not, and the arbiter cannot resolve it (818.222528ms) +✔ REQ-DEC-2: a gated raise citing the current spec goes to the arbiter for its domain; uncited, to the human (351.578337ms) +✔ REQ-DEC-2: an arbiter-approved cited gated decision authorizes the raiser, and the human cannot resolve it (95.667218ms) +✔ REQ-DEC-2: a cited merge raised by merge-gate goes to the technical arbiter; a merge raised without the grant routes by citation (111.301805ms) +✔ REQ-DEC-2: a stale or unconfirmed citation refuses without a decision; an arbiter raising its own goes to the human (176.790972ms) +✔ Q169: the chief of staff's end of the assistant stops every thread run; its own run and another ender's are refused (95.309855ms) +✔ Q169: a revoke of the assistant the chief of staff raises goes to the human, cited or not, and no arbiter resolves it (209.811279ms) +✔ Q169: another role's cited revoke of the assistant, resolved by an arbiter, is refused (113.703139ms) +✔ Q169: a revoke of the assistant citing a decision the human resolved stops its thread run (108.461649ms) +✔ Q169: a cited revoke of a role not in END_PROTECTED still goes to the arbiter, and executes (101.723183ms) +✔ Q169: a role granted role.revoke at either class still sends a revoke of the assistant to the human (112.21735ms) +✔ row 280: an occupied TCP port is attempted, refused, and retried with our sshd (107.117525ms) +✔ row 280: every injected picker sample is unprivileged and outside the ephemeral range (0.454453ms) +✔ the executor tests need sshd, ssh, ssh-agent, ssh-add, ssh-keygen and setpriv: a missing one fails, never skips (0.216486ms) +✔ T3: organization.set, limits.set and instances.set refuse hosts, and the writer never runs (40.780253ms) +✔ T4: the value check takes one unencrypted ed25519 key and nothing else (240.58332ms) +✔ T5 to T8: registry, grant, argv shape and allowlist refusals (678.331952ms) +✔ T9: under 1.7 every call needs a decision bound to its host, argv and stdin, spent once (390.858328ms) +✔ T10, T11: argv reaches sudo unchanged after sudo -n -- (338.015786ms) +✔ T12, T13: exit code passes through, the timeout kills the group, output is capped (1642.180902ms) +✔ T14: a host key not in the registry refuses and nothing runs (253.363702ms) +✔ G18: hosts.check with a wrong pin refuses host-key-mismatch and runs nothing on the host (428.915244ms) +✔ N3: a remote exit 255 that prints the pin refusal text is the command result, and an ssh failure keeps its message (395.024105ms) +✔ T15: ssh reads no config file and no user known_hosts (345.634536ms) +✔ T16, T17: key material in output or stdin refuses credential-leak, and no event holds it (768.293186ms) +✔ T18, T19, T20: one call at a time, no key in any argv or env, and nothing left after (4742.405147ms) +✔ T21: revoke kills the call in flight, and the next call refuses (289.862857ms) +✔ T22: events carry host, address, user and argv in clear, and sizes and hashes only (259.277599ms) +✔ T24: no literal gitea and vikunja kind list outside vocabulary.mjs, and the credential use sites are known (16.04396ms) +✔ T25: no role definition lists host.sudo while it is a hard wait (0.443769ms) +✔ T27: the bus child dying takes ssh and ssh-agent with it (331.990706ms) +✔ T27: ssh-add -t drops the key from an agent the test keeps alive (3548.526385ms) +✔ N2: a hung ssh-add is killed at its limit or on abort, and nothing is left running (426.768049ms) +✔ T27: the start sweep keeps a live bus dir and kills only a matching live process (25.607285ms) +✔ T27: the bus start sweeps /secrets/run before it listens, and a stray entry stops the start (62.352326ms) +✔ M3: host.run refuses host-not-granted unless the grant record has an approved, spent host grant (146.216999ms) +✔ M3: a host_grants record gives Credentials a store reference at start, and a restart reads its key (96.105142ms) +✔ G16: the writer refuses each user, tag and key the design names, before any key file (6790.742854ms) +✔ G16: from= comes from the host file, a privileged user skips the group and sudo checks, and the line is exact (1333.806619ms) +✔ G16: list shows tagged lines only, and add and remove never touch a line outside the tag pattern (556.816164ms) +✔ G25: the writer refuses a symlinked dir or user file, a group-writable dir and an odd tmp, and writes 0644 (802.533756ms) +✔ G16: mosaic-keys passes the three requests to the writer through sudo and refuses anything else without it (68.918659ms) +✔ E3: the sudoers line and the sshd drop-in are the design lines and parse (13.275264ms) +✔ human proof binds CLI entry, process start and nonce; agents and incomplete ancestry refuse (2.463856ms) +✔ process reader gets own kernel identity without exposing environment values (0.637615ms) +✔ EACCES ancestor environments skip only markers; commands and registered launches still refuse (0.754571ms) +✔ real pid 1 remains inspectable when its environment is protected (0.32603ms) +organization: {"event":"reload-needs-restart","business":"demo"} +organization: {"event":"reload-needs-restart","business":"demo"} +✔ row 165: instances and instances.set refuse every non-human session but the tester, the chief of staff included, and pass the verified actor (57.728933ms) +✔ row 165 runtime: an add and a change reach the organization file with the human as actor; each refusal keeps the bytes and logs nothing (224.193008ms) +✔ row 194 T12: agent and reader sessions refuse veto.set; the tester gets add and change but not delete or veto.set; the human passes the hook for each listed verb (46.168013ms) +✔ system Python is a resolved root-owned ELF, never a shim or home interpreter (3.928866ms) +✔ real system interpreter is available and safely inspected (34.227968ms) +✔ restart receipt appends actual replacement identity and refuses unsafe files (3.844891ms) +✔ activation gate compares fresh startup receipt to the current interpreter identity (1.713252ms) +✔ non-regular startup receipt refuses promptly without waiting on a FIFO peer (43.577942ms) +✔ REQ-DEC-2: a merge-gate raise its arbiter resolved lands through the host op: checkLand answers the facts and a ticket, records nothing, and recordLand spends the decision once (60.404381ms) +✔ checkLand refuses on the decision and the review (65.769182ms) +✔ REQ-LAND-1: a gated merge decision refuses not-authorized, cited and approved by the arbiter or uncited and approved by the human (162.399114ms) +✔ REQ-LAND-1: a within-role merge grant refuses not-authorized at the land (47.983195ms) +✔ a cross-role merge that routes to the human, because merge-gate is its own arbiter, lands on the human's CLI answer (58.274436ms) +✔ a merge option with no first line refuses no-subject, as land-work does (50.783411ms) +✔ checkLand refuses with land-work's codes past the authority check, and a decision raised for refactor never lands (125.526939ms) +✔ a ticket outlives the run that asked, and recordLand checks the task again (54.517584ms) +✔ two tickets on one decision: the first recordLand lands, the second refuses decision-consumed and records nothing (54.8801ms) +✔ landRefused files the code on the task, tells the role only with notify, and ends the ticket (58.424472ms) +✔ landHeld is true only for an approved, unspent cross-role merge decision this role raised for a task in this thread (52.844535ms) +✔ landHolders lists a merge decision exactly while landHeld is true for its non-thread instance, in decision order (70.590809ms) +✔ landHolders leaves out a thread instance's decision, even one raised before its role became one (42.450912ms) +✔ landRelease releases the holding run by land-relaunch once it has asked message.receive and nothing delivered to it is unread, and waiting messages go to the next holder (64.289699ms) +✔ a landing run started after the resolution passes checkLand for its held decision before any message.receive, and lands it (55.116914ms) +✔ the bus process answers landHolders and landRelease from their own lines, not as credentialStatus (216.711631ms) +✔ usage.begin with a decision id needs it held for the run's instance, usage.end needs the begin, and the limit checks see the landing turn (66.255485ms) +✔ no run may write the action.allowed for git.merge.protected itself (31.886822ms) +✔ a message to a stopped role sends launch.by one notice, and the result says so (50.650448ms) +✔ a message to a role outside launch.instances says so in its result and in the notice (31.449838ms) +✔ a message to a running role sends no notice and its result is unchanged (34.566272ms) +✔ a re-route at a claim, a release and claim, and a broker restart send no second notice (42.684145ms) +✔ a run launched but not yet claimed counts as no holder (23.098047ms) +✔ no notice for a message to launch.by, from it, a refused one from a tester, to the human, or in a thread to a thread instance (51.614346ms) +✔ a business with no launch block tells nobody and says there is no launcher (23.367877ms) +✔ the notice sender stays internal: no role is named _bus and no caller can send as it or to it (75.639873ms) +✔ row 302 a run threadIdle released answers launcher-released on receive, state, read and send, logs each, and claims nothing again (81.434963ms) +✔ row 302 with a run launcher-released, a run that lost its claim another way still answers not-holder (72.88233ms) +✔ row 302 a run landRelease released answers launcher-released, and claims nothing again (72.435435ms) +✔ C2-03b T6: the slot before any chief evidence, then the listed chief's live grant (53.462079ms) +✔ C2-03b T7: a chief revoked through grants.revoke or fired through instance.fire refuses, and the fallback stays ended (346.738793ms) +✔ C2-03b T7 choice checks: delisted, a fire under way and held each refuse; a rehire lists the chief again (59.984061ms) +✔ C2-03b T8: a chief grant on another project ends the fallback, and two listed chiefs refuse library-fetch-no-grant (54.930484ms) +✔ C2-03b departure (sage-2928): with no chief entry, any Gitea grant evidence refuses (28.030984ms) +✔ C2-03b T9 runtime: the chief's store file and user, then a real revoke that runs no git with the slot at 0000 (1419.870065ms) +✔ C2-03a library.sync: every agent, the tester and a reader are refused before the adapter runs (34.263214ms) +✔ C2-03a library.sync: the human fetches, accept passes through, and a held sync is a recorded refusal (34.092404ms) +✔ C2-03a library.sync: a LibraryError keeps its code and a host without sync is not configured (51.050248ms) +✔ C2-03a runtime: a librarySync from a boot config, with no function, is refused (2.067461ms) +✔ C2-03a runtime: the timer syncs each entry with a user at start and on each tick, logs codes only, and stops on close (799.284388ms) +✔ row 254 human-cli: library.sync outlasts the 5 s client default, and library.status does not (6125.553907ms) +✔ C2-04 M4: both verbs reject every agent before arguments or adapter access (66.225354ms) +✔ C2-04 bus: human reads validate keys and return adapter results without path leakage (27.087287ms) +✔ C2-04 socket: each async library verb resolves its result rather than serializing {} (122.66208ms) +✔ C2-04 runtime: protectedRoots skips library but retains real code-root credential protection (166.663319ms) +✔ C2-04 runtime: unsafe existing mirror refuses boot and never publishes a socket (43.600329ms) +✔ C2-04 runtime: real library adapters reach the socket and lock waits leave other bus reads responsive (336.916454ms) +organization: {"event":"reload-needs-restart","business":"demo"} +✔ T20 fire: a revoke that fails stops the fire with the file unchanged; one that succeeds revokes, keeps the directory and names the services outside the store (170.927823ms) +✔ T20 fire: an instance already delisted still has its tokens revoked and the file is left alone (102.504103ms) +✔ T20 fire: with no entry in the running bus, a token on disk refuses and an empty store goes on (92.417739ms) +✔ T20 delete: a revoke that fails keeps the file; one that succeeds clears the store, deletes, and names the tracker bot (125.530692ms) +✔ T20 delete: with no entry in the running bus, a token file is cleared and the delete goes on; a file reference refuses (96.288776ms) +✔ T21 delete: a write between the raise and the take makes the delete refuse revision-conflict before it revokes anything (102.865633ms) +✔ row 281 T1 fire: a host. or granted gitea file in the store refuses step B credential-revoke-failed, file unchanged (94.929174ms) +✔ row 281 T1 start: a host grant record whose key file is gone starts and reads not-issued (83.669758ms) +✔ row 194 T12: agent and reader sessions refuse the lifecycle verbs before any effect; the tester gets launch, end and the request read, never regenerate (64.209907ms) +✔ row 194 V2 and V4 at the verb: the request is open, by the human, with a human.input; thread, retired, unknown and revoked refuse with no event (41.757222ms) +✔ row 194 D1.1 take: a request is taken once, closes once, and lifecycleRequests lists only what is not closed (32.148929ms) +✔ row 194 D1.1 take: a launch.revoke after the request closes it launch-revoked, and a request past 60 s closes request-expired (41.525708ms) +✔ row 194 T15 (bus): while halted, launch and regenerate refuse processing-halted at the verb and at the take, hire and fire refuse, terminate goes; an unreadable switch refuses with its code (72.967122ms) +✔ row 194 T12a: the tester launches and ends on its own business with actor tester; bus.tester off in the file refuses the call and the take tester-off (44.355363ms) +✔ row 194 V3 terminate: claims revoked, open requests cancelled, bound runs named, taken requests listed; nothing at all answers not-held (51.401329ms) +✔ row 194 V3 terminate of a thread instance: the human ends every thread, the tester only its own (36.604669ms) +✔ row 194 T6 V5 order at the verb: the writer's named refusals, then instance-running, instance-starting, the last-listed refusal and the revision (55.246738ms) +✔ row 194 V5: an open launch past its 60 s is not starting, as it can only close request-expired (21.118518ms) +✔ row 194 V5 after the take: lifecycleDelete re-checks running and starting, then commits through the writer with the human as actor (40.715283ms) +✔ row 194 V5 retry: a retired name deletes again only after workspace-rename-failed, and that request commits nothing (34.034773ms) +✔ row 194 V5 runtime: a delete request, the take and lifecycleDelete commit the file with retired, log the human and reload so the name no longer binds (221.343447ms) +✔ REQ-LIMIT-3 limitLeaves finds every limit object and skips the agent numbers (1.791902ms) +✔ REQ-LIMIT-3 limitLeaves takes token limits at schema depth only, whatever their names (0.279813ms) +✔ REQ-LIMIT-3 with no check switched on a launch is allowed, a turn never stops, and every limit is not enforced (25.049161ms) +✔ REQ-LIMIT-3 a fixture check that refuses refuses the launch and stops the turn, logged with the limit and the count (27.252534ms) +✔ REQ-LIMIT-3 a report that omits a limit shows it not enforced; a counted entry and a reason come through (23.776357ms) +✔ REQ-LIMIT-4 each check gets the business, a copy of the limits, the subject, the records and the time (32.057118ms) +✔ REQ-LIMIT-4 fail closed: a throw refuses, stops and fails the report, naming the check and the code (29.818483ms) +✔ REQ-LIMIT-4 fail closed: a malformed answer, a promise, a rejected promise, a non-boolean or a bad hit is malformed-answer (30.659962ms) +✔ REQ-LIMIT-4 fail closed: a check switched on but not loaded refuses, stops and fails every limit as not-loaded (34.526412ms) +✔ REQ-LIMIT-4 state(), never-loaded case: before any load the report shows not enforced, or not-loaded for a switched-on check (20.095344ms) +✔ REQ-LIMIT-4 state(), first-load-refused case: a check refused on its first load is not-loaded in mayLaunch, mustStop and report (21.279843ms) +✔ REQ-LIMIT-4 fail closed: an unreadable organization file refuses and stops with check null; the report throws (19.924441ms) +✔ REQ-LIMIT-4 fail closed: unreadable records refuse and stop with check null and fail the report (1.040824ms) +✔ REQ-LIMIT-3 the shipped token-limit, through the real loader, counts known records only since the limit was set (31.95084ms) +✔ REQ-LIMIT-3 a token limit for a provider named limit is counted and refuses, beside an agent limit of the same name (18.312864ms) +✔ REQ-LIMIT-3 core reaches limit checks only through the plug-in loader (1.369832ms) +✔ REQ-LIMIT-4 a role run at its limit stops at the end of its turn: RESULT and read land first, the claim is revoked by limit-check (64.078376ms) +✔ REQ-LIMIT-4 the stop also lands on state; a run with no stop ends without a limit (79.478043ms) +✔ REQ-LIMIT-4 fail closed: a mustStop throw or a malformed answer stops the run, naming the bus and the code (150.495831ms) +✔ REQ-LIMIT-4 a thread run at its limit is released with the reason, and its end record names the limit (35.727466ms) +✔ REQ-LIMIT-4 a broker with no limit checks configured never stops a run (29.894095ms) +limits: {"event":"limit-reached","business":"demo","check":"token-limit","export":"mayLaunch","subject":{"instance":"coder","provider":"zai","model":"glm-5.3-flash","account":null},"path":["tokens","instances","coder"],"limit":0,"count":0,"unknownTurns":0} +organization: {"event":"reload-needs-restart","business":"demo"} +usage: {"event":"usage-unknown","business":"demo","run":"run1","instance":"coder","turn":"33091280-20f3-491b-80b4-1ce7da3c4cde","source":"@none","code":"baseline-unknown"} +limits: {"event":"limit-reached","business":"demo","check":"token-limit","export":"mustStop","subject":{"instance":"coder","provider":"zai","model":"glm-5.3-flash","account":null},"path":["tokens","instances","coder"],"limit":0,"count":0,"unknownTurns":1} +usage: {"event":"usage-unknown","business":"demo","run":"run1","instance":"coder","turn":"4e9aa97a-6b5b-47f6-9546-c7162d5634f7","source":"@none","code":"baseline-unknown"} +organization: {"event":"reload-needs-restart","business":"demo"} +✔ REQ-LIMIT-3 REQ-LIMIT-4 runtime: limits carries the token count, mayLaunch refuses at the limit, a reset moves since (226.805132ms) +✔ REQ-LIMIT-3 runtime: with no limit check switched on, the limit shows not enforced and every launch is allowed (58.143967ms) +✔ REQ-LIMIT-4 runtime: the broker asks the shipped token-limit after a turn, and the run at its limit stops on its next receive (87.274138ms) +✔ REQ-LIMIT-4 runtime: with no usage source a turn is unknown, counts zero and stops nothing under a limit of 1 (73.881741ms) +✔ REQ-LIMIT-3 runtime: switching a limit check on with plugins.set loads it without a launch or a turn (98.158997ms) +organization: {"event":"reload-needs-restart","business":"demo"} +organization: {"event":"reload-needs-restart","business":"demo"} +✔ limits binds actor from human proof and rejects role, reader, a tester set and forged actor (32.990204ms) +✔ runtime wires verified human settings to the actual shared file writer and actor receipt (168.290405ms) +✔ uncertain organization receipts leave bus startup and reads alone but refuse writes until reconciled (95.922504ms) +✔ within-role sends cite an open gated launch decision without spending it or naming it in grants (45.178447ms) +✔ missing and foreign-business citations refuse and roll back message and grant (32.741285ms) +✔ cross-role sends still need a matching resolved decision and consume it once (39.977721ms) +✔ trail on a hidden message id answers exactly as on an unknown id, for the owner, a reader and the tester (40.896591ms) +✔ replies on a hidden message id answers exactly as on an unknown id, for the owner, a reader and the tester (43.699832ms) +✔ trail on a decision keeps the decision and drops the user thread messages, their deliveries and their events (52.513173ms) +✔ replies leaves out other users thread messages and still fills a page (298.247224ms) +✔ messages in the business human and tester threads are not hidden (row 177 unchanged) (69.052289ms) +✔ governance pin: the owner sees decisions, inbox entries, claims, tasks and project files, but not the user messages (195.073749ms) +✔ messages pages all human messages newest first without writes; read state is history (528.296419ms) +✔ messages refuses role callers, invalid paging and cursors outside this human feed (44.08017ms) +✔ views messages passes only its paging arguments through (0.450289ms) +✔ messages isolates businesses even with a valid foreign cursor (29.100555ms) +✔ the assistant sends to the user and to the chief of staff only (54.280605ms) +✔ an assistant send to any other role, or to the tester, is refused and logged (53.421262ms) +✔ only the user and the chief of staff may send to the assistant; the tester is refused by default (58.254301ms) +✔ REQ-ASSIST-2 REQ-THREAD-1 thread.send to an instance that does not hear from the user is refused and stores nothing (43.751614ms) +✔ a sender-side list alone refuses a send to a role that has no list (52.554091ms) +✔ a target-side list alone refuses a send from a role that has no list (49.318056ms) +✔ the sender list is checked before the target list (46.966436ms) +✔ roles without the field behave exactly as before (64.265274ms) +✔ a business with no role definitions at all is unlimited (86.631404ms) +✔ a malformed messaging field refuses at boot (22.022778ms) +✔ the assistant's review.request to a reviewer is refused and logged, even with an approved decision (55.09022ms) +✔ a review.verdict to the assistant from a role outside its receiveFrom is refused and logged (60.641569ms) +✔ review requests and verdicts between roles without the field are unchanged (47.960276ms) +✔ 3f copy migrates to 3g preserving every old column/row, with an empty instance_names and null to_name (143.64339ms) +✔ REQ-MSG-2: the chief of staff names an instance under its within-role grant, and the write is logged (38.201107ms) +✔ REQ-MSG-2: the human names an instance through the CLI (28.465379ms) +✔ REQ-MSG-2: a role without the grant, or holding it cross-role, is refused not-authorized (31.351023ms) +✔ REQ-MSG-2: a name is unique in the business and is never an instance key or a role name (57.292851ms) +✔ REQ-MSG-2: a send by name reaches the instance and records both; a send by instance key is unchanged (45.651113ms) +✔ REQ-MSG-2: an instance key beats a name that equals it, as when a later instance takes the key (31.465277ms) +✔ REQ-MSG-2: a role name beats a name that equals it, as when a later definition takes the word (sage-0590) (39.834285ms) +✔ proof receives actual peer, cap traffic never invokes helper and transient cap disconnects (8.269644ms) +✔ proof helper error and disconnect during verification never dispatch or bind (2.336706ms) +✔ Client receives explicit proof refusal codes without dispatch, not outcome-unknown (48.969136ms) +✔ asynchronous proof calls release their transient session on success, failure and timeout (28.134497ms) +✔ T2 eight proof callers and a racing copier bind the exact accepted socket, which survives helper exit (376.346077ms) +✔ helper output and failures fail closed including unsafe gid (2.70893ms) +✔ helper timeout, capacity and shutdown refuse without leaving children (26.561218ms) +✔ missing or non-regular peer helper refuses at construction before opening the bus (0.50595ms) +✔ shutdown waits for killed helper close before returning (6.190583ms) +organization: {"event":"reload-needs-restart","business":"demo"} +organization: {"event":"reload-needs-restart","business":"demo"} +organization: {"event":"reload-needs-restart","business":"demo"} +organization: {"event":"reload-needs-restart","business":"demo"} +✔ plugins and plugins.set refuse every non-human session and a forged actor, and pass only the patch with the verified actor (36.030953ms) +✔ runtime: the switch changes the organization file, the receipt carries the actor, and a bad shape, an unknown module and a stale revision are refused with nothing written (211.708422ms) +✔ vikunja:19/309 through the broker, a patch switches the kinds it names and keeps the rest; null removes one kind and is trailed (90.396449ms) +✔ principal binds kernel peer PID and uid, maps owner, and never takes identity or role from body (1.944626ms) +✔ user requires its own nonce and full walk plus immediate same-tree Console parent (0.569874ms) +✔ tester deliberately admits agent parents but rejects managed runs and another nonce (0.36365ms) +✔ human leaf identity is reread after walking the parents (0.174945ms) +✔ console requires its own wrapper, nonce and serve parent, and a configured owner from the spawn env (2.109327ms) +✔ broker process binds trusted launches, offers reader capabilities, refuses human mutation, closes cleanly (295.686647ms) +✔ startup token refusal returns safe code without value or partial listening broker (175.565996ms) +✔ loaded fixture token is absent from socket replies and SQLite, including refusal evidence (257.314805ms) +✔ killed broker leaves an explicit stale lock; another process cannot silently reclaim it (409.999079ms) +✔ trusted host registers later launches; socket clients never have a registration verb (253.304344ms) +✔ REQ-LIMIT-4 the broker process answers the launcher's mayLaunch op with the limits' awaited decision (242.177331ms) +✔ runtime excludes declared project roots even when host supplies no repoRoots (190.404726ms) +✔ a refused launch binding leaves the broker and existing capabilities alive; bad protocol stops it (219.977454ms) +✔ real runtime injects the coordinator, stops its workload and mirrors stable stop events across restart (268.978786ms) +✔ invalid state still starts the control bus and human halt then resume repairs it (116.618085ms) +✔ processing halt and resume extend only the socket timeout while ordinary status retains the explicit timeout (186.417794ms) +✔ a root halt aborts the active search-source signal before the normal web deadline (34.747447ms) +✔ processing.halt refuses agent reader and tester before any transition (36.30649ms) +✔ processing.resume refuses agent reader and tester before any transition (27.788825ms) +✔ human halt and clear each have one event with verified actor; launch.restore cannot clear (35.090797ms) +✔ all ordinary work verbs refuse before dispatch while pure reads remain available (62.155056ms) +✔ task web authorization and bind paths refuse before external work (33.02576ms) +✔ recordEvent cannot forge processing.halt (24.266741ms) +✔ recordEvent cannot forge processing.resume (24.385094ms) +✔ recordEvent cannot forge processing.stop (25.085707ms) +✔ recordTask poll cannot forge a processing action through its kinds filter (27.030364ms) +✔ recordTask self cannot forge a processing action through its kinds filter (22.320775ms) +✔ spec read remains a read but cannot release new write work after an await (32.653682ms) +✔ the real socket awaits halt and resume beyond the ordinary idle deadline (76.942841ms) +✔ a malformed processing reader never silently admits agent work (41.659024ms) +✔ halt refuses the newly landed host executor path before credentials or effects (32.111489ms) +✔ D1: committed write with a failed receipt refuses outcome-unknown without action.allowed (38.82285ms) +✔ D2: spec.read refuses without content if its role is released during the read (27.678082ms) +✔ D3: spec.read secret check refuses flagged content without content (27.746931ms) +✔ D3: spec.read secret check refuses flagged subject without content (28.963956ms) +✔ a human lists, opens and saves; the save is one commit by the business human (213.61234ms) +✔ an agent and a reader refuse every file verb and nothing is written (79.926754ms) +✔ a stale base refuses stale-base and writes nothing (146.595207ms) +✔ paths outside the spec and docs refuse, as do unknown projects, missing files and odd arguments (131.294097ms) +✔ without a project adapter the file verbs refuse project-not-configured (56.061538ms) +✔ on the socket a save may carry 1 MiB of text; every other request keeps the 64 KiB limit (411.698528ms) +✔ a request that names the save verb first and another verb last is refused at 64 KiB (114.959921ms) +✔ two saves racing for one repository make one commit (261.722302ms) +✔ Broker keeps the sandbox client import closure: only the listed imports, no lazy project import (3.749233ms) +✔ without a trusted project adapter all three async paths refuse project-not-configured (78.562975ms) +✔ real startBroker injects the project adapter for socket reads and bound-author record writes (336.90737ms) +✔ a raise with no recorded push refuses no-push; a raise binds the latest push and shows it (56.377066ms) +✔ happy path: the fork is the upstream repo under the agent's own user, the destination is host-built (46.509456ms) +✔ a hard wait: no decision refuses, and a decision for another task refuses (43.679673ms) +✔ r4 B4: approve while the latest push is A, push B, publish refuses decision-mismatch (95.301147ms) +✔ grant and fork refusals (96.19996ms) +✔ remote-not-fork, compared without case, and remote-host-mismatch, at push (183.873297ms) +✔ two agents granted one project each get their own fork (74.105339ms) +✔ the request cannot name the fork, the user or the destination (41.487861ms) +✔ one decision, one open publish: a second ticket refuses publish-busy, whatever its branch (102.93073ms) +✔ publishRefused files the code on the task's trail and drops the ticket (43.396883ms) +✔ git.push.remote is in neither ROUTED list and no shipped role grants it (1.127391ms) +✔ runtime: withGitea keys from the open ticket only, and the store root is the organization dir (171.758127ms) +✔ the bus process answers the publish ops from their own lines, not launch-op-refused (249.486283ms) +organization: {"event":"reload-needs-restart","business":"demo"} +organization: {"event":"reload-needs-restart","business":"demo"} +✔ T14 a create goes live with no restart: the new instance binds at once and the answer says restart false (144.607973ms) +organization: {"event":"reload-needs-restart","business":"demo"} +organization: {"event":"reload-needs-restart","business":"demo"} +organization: {"event":"reload-needs-restart","business":"demo"} +organization: {"event":"reload-needs-restart","business":"demo"} +organization: {"event":"reload-needs-restart","business":"demo"} +organization: {"event":"reload-needs-restart","business":"demo"} +✔ T14 every committed verb reloads once, limits.set, routes.set, plugins.set and veto.set included, and a refused one does not (180.424737ms) +✔ T14 a definition change on a running instance refuses instance-running; a vars change still goes live (124.215429ms) +✔ T14 a file whose credential references differ from the boot copy is not reloaded and the write answers restart true (92.416931ms) +✔ T14 a date-only change to a credential reference still reloads: row 199 issue rewrites the date outside the reload (90.995411ms) +✔ T19 a credentialed create answers restart true; issue works only after a restart, and a later vars change goes live (180.966389ms) +✔ T14 after a refused reload veto.set, instance.hire and instance.fire answer restart true, and a fire of a name kept since refuses before step A (215.016229ms) +✔ T14 a file whose project root differs from the boot copy is not reloaded, because the Credentials store protects the boot roots (77.323605ms) +organization: {"event":"reload-needs-restart","business":"demo"} +✔ T14 a file whose library mapping differs from the boot copy is not reloaded, because the mirror is ensured at start (304.629194ms) +✔ T14 reloadBusiness refuses an unknown business, a changed human and a document the boot check refuses (19.894774ms) +✔ a reply is listed for human and reader sessions, and its delivery rows are unchanged (69.449006ms) +✔ the reply still reaches the human message.receive (mosaic talk) after the Console showed it (49.29323ms) +✔ a message with no reply gives an empty list (31.198574ms) +✔ replies come oldest first and stop at REPLIES (158.952604ms) +✔ an id that names no message in the business refuses message-not-found, and the refusal is recorded (53.524813ms) +✔ strict arguments; a role session gets human-required (60.718382ms) +✔ views passes replies through as one call with the id (0.446118ms) +✔ requirements returns the committed list to a holding role session, and no one else (62.742096ms) +✔ the PM's prd.approve with no task, when no id fits, reaches the human's Inbox (36.227169ms) +✔ the PM's non-blocking role.revoke with no task reaches the human's Inbox (35.299249ms) +✔ a push is recorded as the action.allowed for git.push.working on the task, and only the host records one (55.981478ms) +✔ review.request names the latest pushed commit and sends the reviewer a REVIEW-REQUEST (46.457029ms) +✔ review.request says which run holds the reviewer role, or null, and a null request waits for a claim (50.040199ms) +✔ review.request refuses a commit that isn't the latest push, a non-reviewer and a role without the action (64.730288ms) +✔ reviewFetch answers only the addressed reviewer, for the request it cites (49.685078ms) +✔ review.verdict answers one request once, to the role that asked (58.496586ms) +✔ task.close on a pushed task needs an approve verdict for the latest push (75.389685ms) +✔ a refusal the host decided is filed on the task it names, and only a task ref counts (41.781907ms) +✔ row 306 T1: a run the timer sweep ended answers thread-revoked on every claim-needing call, logged, and its claim still refuses run-revoked (63.101857ms) +✔ row 306 T1: a user's request and access.reload end the run the same way, and it answers thread-revoked (89.903276ms) +✔ row 306 T2: after the sweep, a run the human stopped and a run the limit stop ended still answer not-holder (64.277244ms) +✔ room.open sorts all threaded instances, creates defaults, and reuses caller-owned threads (47.251822ms) +✔ room.open preflights instance collisions atomically (35.085461ms) +✔ room.open preflights owner collisions atomically (30.968088ms) +✔ room verbs require the human, and none is a tester verb (45.447987ms) +✔ room verbs refuse missing projects and zero member businesses (60.060584ms) +✔ send/read refuse a missing canonical member without effects (32.727587ms) +✔ send/read refuse a foreign-owner canonical member without effects (36.329245ms) +✔ send/read refuse a wrong-instance canonical member without effects (37.12821ms) +✔ room.send targets a key, broadcasts without tags, and preserves original text and ordinary route/input rows (36.727408ms) +✔ current display names and repeated tags resolve once; a replaced display name is unknown (44.930949ms) +✔ a legacy name colliding with another member key is ambiguous; its own key resolves once (35.402289ms) +✔ unknown or non-member addressees and tags-only bodies leave no message effects (52.268828ms) +✔ messaging denial on the last target rolls back the entire broadcast; allowed subset still works (34.601686ms) +✔ a clearing last member fences the whole send; another active target still accepts (43.281361ms) +✔ room.read groups one send, pages by the last grouped id, and rejects foreign or absent cursors (57.087629ms) +✔ room.read keeps identical sends at the same timestamp separate and includes every session (53.996618ms) +✔ room.read defaults and caps the number of merged entries, not recipient rows (839.915912ms) +✔ room.read includes an agent reply with its thread and instance without merging it with human rows (45.624277ms) +organization: {"event":"reload-needs-restart","business":"demo"} +✔ row 65: routes and routes.set refuse every non-human session, the chief of staff included, the tester may read and set, and each passes the verified actor (62.372193ms) +✔ row 65: a new launch binds only on a switched-on harness with a module name, and a run an earlier broker bound binds again after its harness is switched off (51.068938ms) +✔ row 65 runtime: harnessLevels answers each module in the tree, and null for a name with no module (69.359199ms) +✔ row 65 runtime: routes and routes.set reach the organization file with the human as actor, a new bind reads plugins.harness, and each refusal keeps the bytes and logs nothing (154.834428ms) +✔ v3b prototype refusals, views and append-only mutations (170.527317ms) +✔ T4 D7: a clear of a held default session fences it, drains at the next receive, retires at the exit proof and moves the default (88.261409ms) +✔ T4 D7: an unheld session drains at accept, its proof is run null, and a non-default clear leaves the default (44.319684ms) +✔ T4 D7: a run that ends before its next receive drains at its end, with its generation (37.760621ms) +✔ T4 D7: a run whose turn is running (delivered, unread) stays clearing; uncertain is recorded once and nothing more (46.455506ms) +✔ T4 D7 B1: undelivered inputs are cancelled with receipts at accept, never delivered to the successor, and a routed reply is cancelled at arrival (53.309671ms) +✔ T4 D7: repeat, conflict, a second op, a stale revision, confirm and a halt (49.281617ms) +✔ T4 Q4: the successor takes -N, the next N free, and a bound name stays taken (37.31891ms) +✔ T4 D8: the successor start is held, refused or started, each report on its own counter (38.647526ms) +✔ T4 D7 N4: a halt at retirement waits and writes nothing; retirement goes once processing resumes (31.742103ms) +✔ T4 sage-2828: a cancel before retirement makes the session active again, keeps the claim and the cancelled messages, and never makes the successor (47.773191ms) +✔ T4 sage-2828 sage-2830: a cancel after retirement ends the startup only, and a later thread-only send makes the successor pending as new input (39.721697ms) +✔ T4 N4: a user's thread whose grant is gone by retirement ends the clear failed, writes no successor, and leaves the session as it was (40.62918ms) +✔ T4 N4: a user's thread whose grant is live at retirement retires the session and makes its successor (37.81798ms) +✔ T4 sage-2828: a cancel after the successor started refuses session-clear-complete (34.145777ms) +✔ T4 B2: a run bound to a clearing session refuses its claim, and claims again once the clear is cancelled (52.228545ms) +✔ T4 mos-1325: the tester clears its own thread; its clear, cancel and operation on a human-owned thread refuse thread-not-owned and write nothing (54.787305ms) +✔ T4 schema: session_ops and message_cancels are append-only, and a second open clear of a session is refused below the broker (34.893058ms) +✔ T4 schema: a 3m store migrates to 3n, session_ops and message_cancels are new and empty, and every other row stays as it was (190.071546ms) +✔ T4 schema: the 3m engine refuses a 3n store, migrating or not, and leaves it as it was (307.278465ms) +✔ session.list rows carry the reader count for each session, with its store identity (38.698659ms) +✔ a legacy session is asked for with legacy true (28.280572ms) +✔ without a reader the count is unknown, never 0; a reader that throws is store-unreadable (43.791112ms) +✔ compactions must be a function (18.786625ms) +✔ T1 REQ-ROLE-2: two sessions of one thread keep their own history, delivery and replies (79.840786ms) +✔ T2 REQ-ROLE-2: one holder per session, generations count its claims, and a sibling session's message never reaches the other holder (66.085497ms) +✔ T2 sage-2257: a released or revoked run's retired generation refuses its approval, delivery and read, and writes nothing (80.958391ms) +✔ session.create is idempotent on its op, refuses a reused op or a taken name, and reaches only the owner's threads (56.968738ms) +✔ the 3l triggers keep sessions in their thread and session ids apart from thread ids (122.24413ms) +✔ T7: a 3k store migrates to 3l, each thread's default session has the thread's id, and old rows keep their seqs (216.717701ms) +✔ T7 D9: the 3k engine refuses a 3l store, migrating or not, and leaves it as it was (286.732818ms) +✔ gated approval authorizes once, survives store reopen, and fresh approval works (50.551933ms) +✔ another run of the same instance consumes an approval once; a failed check leaves it usable (36.698084ms) +✔ two scheduled callers have exactly one grant and one consumed refusal (27.501573ms) +✔ failed commit rolls consumption back; cross-role consumes and within-role stays reusable (54.214227ms) +✔ class drift gated to cross-role refuses before consumption (38.056569ms) +✔ class drift cross-role to gated refuses before consumption (44.966655ms) +✔ class drift gated to within-role refuses before consumption (37.92715ms) +✔ class drift cross-role to within-role refuses before consumption (50.422847ms) +✔ class drift within-role to gated refuses before consumption (51.425222ms) +✔ class drift within-role to cross-role refuses before consumption (46.151262ms) +✔ message.send consumes approval and prevents a later send or authorize (43.718221ms) +✔ role.revoke consumes approval and prevents a later revoke or authorize (46.482033ms) +✔ 3e copy migrates through 3f to 3g preserving every old column/row and adding null spec citations (148.09492ms) +✔ a human spec save sends one notice to each pm and cto, naming the commit, and each commit sends its own (206.204757ms) +✔ no notice for a docs save, an agent record commit, a git commit outside the Console, or a refused save (280.181923ms) +✔ a notice to a role no run holds waits for a claim, and launches nobody and tells nobody (124.70978ms) +✔ a business without a pm or a cto saves the spec and sends nothing (109.626695ms) +✔ a notice that cannot be stored answers outcome-unknown, and the commit stands (139.466739ms) +✔ a BLOCK reaches the chief of staff, the chief relays it to the assistant in the user's thread, and the commit stands (158.03827ms) +✔ with no thread a BLOCK still reaches the chief of staff, and the relay to the assistant is refused (124.8012ms) +✔ within the notice's project the relay lands in the user's most recently opened thread (126.22297ms) +✔ a more recently opened thread in another project does not take the relay (130.021308ms) +✔ a BLOCK is refused from anyone but a pm or cto, to anyone but the chief of staff, and outside a reply to its own notice (153.131301ms) +✔ a role cannot forge a spec notice: its text opens neither a BLOCK nor the assistant's thread (144.50856ms) +✔ the bus receives nothing: a reply to a notice addressed to _bus is refused (140.840427ms) +✔ real socket awaits spec reads, record writes and cited raises; other requests still return normally (210.033097ms) +✔ real socket preserves asynchronous refusal codes and disconnects its transient proof (117.128247ms) +✔ two real socket writes to one repository yield one commit and one project-busy refusal (107.358191ms) +✔ client disconnect during await tolerates late reply (105.589501ms) +✔ client disconnect during await tolerates late refusal (83.842084ms) +✔ N-a: slow admitted record.write returns its committed result after the idle deadline (267.308701ms) +✔ current citation is recorded; docs commits do not stale it and a new spec never reopens settlement (202.613316ms) +✔ stale, unconfirmed, missing and partial spec citations refuse without inserting a decision (182.332828ms) +✔ uncited raises retain their synchronous path and spec read is available to any held role in its business (74.850814ms) +✔ record writes bind the session author, require authority and refuse spec and impersonation paths (93.313868ms) +✔ REQ-COS-1: the pm asks the chief of staff for roles and counts; the chief receives a STAFF-REQUEST and answers it (63.36524ms) +✔ REQ-COS-1: only the pm can send a staff request; every other session is refused and the chief of staff hears nothing (55.547556ms) +✔ REQ-COS-1: a pm without message.send is refused like any other gated action (28.169154ms) +✔ REQ-COS-1: the request goes to the business launcher, and only when that is a chief of staff (80.158563ms) +✔ REQ-COS-1: the sender is judged by definition: an instance `lead` of the pm definition can ask, an instance `pm` of the coder definition can't (73.738703ms) +✔ REQ-COS-1: the launcher is judged by definition: an instance `boss` of the chief-of-staff definition receives, a `chief` of the coder definition gives no-chief-of-staff (65.623187ms) +✔ REQ-COS-1: a refused staff request leaves no staff.request action.allowed event (37.872199ms) +✔ REQ-ASSIST-2: the role definitions' messaging lists hold for a staff request, sender and recipient (107.955968ms) +✔ a staff request names a task, 1 to 10 distinct roles and counts of 1 to 20; nothing else is accepted (80.508874ms) +✔ REQ-COS-1: a staff request grants nothing: the pm still can't launch and the chief of staff launches as before (39.039813ms) +✔ a business that never switched launches reads allowed with no time and no event (35.510257ms) +✔ launches revoked and then restored read allowed, with the restore time and event id (29.522278ms) +✔ a task closed on the tracker leaves the open list, and total counts the open ones (29.775791ms) +✔ a tombstone is not open (27.145533ms) +✔ the open list stops at the cap and says so; total still counts every open task (35.531496ms) +✔ a role and a reader session read state; arguments, and an unbound cap, refuse (31.66758ms) +✔ a human session reads the same state, with the same cap (33.220213ms) +✔ reading state writes nothing: every table keeps its row count (31.812659ms) +✔ creates private WAL store and excludes a second writer until explicit close (23.162782ms) +✔ rollback is atomic and schema metadata is checked against trusted DDL, not just itself (24.07149ms) +✔ existing empty database and symlink runtime directory refuse, never initialize over damage (25.58454ms) +✔ crash during a transaction recovers no partial event after explicit fixture-only lock removal (107.574018ms) +✔ writer refuses mixed at/read_at forms atomically, even through trusted SQL helpers (17.501717ms) +✔ async transactions refuse before invoking their function (15.124527ms) +✔ usage_records refuses non-canonical timestamps atomically (17.589596ms) +✔ the session default fits under the reply cap and pages to the end with next (221.01915ms) +✔ the short form: no description, assignees by role, every listed key (137.225911ms) +✔ each filter, alone and together, and total counts every match (242.275335ms) +✔ task_ref reads one task in full, as the whole board has it (152.572255ms) +✔ no arguments is the read the Console and mosaic make, unchanged (124.875348ms) +✔ an unknown argument or a bad value refuses invalid-request (599.954218ms) +✔ tasks rows carry priority and requirement for every session that reads tasks (74.263113ms) +✔ the read model rebuilds from the ledger: a reopened bus and each trail give the same values (72.292285ms) +✔ an empty business and one with snapshots but no task.created read cleanly (23.994779ms) +✔ recordTask keeps sync reads and a role write apart (40.133625ms) +✔ read_at must be one canonical UTC format, so the projection compares strings safely (18.137866ms) +✔ a bad entry refuses the whole record (23.357687ms) +✔ taskView reads the projection for one business (28.228419ms) +✔ requestTask hands only a holder and a task verb to the handler, and records refusals (42.883484ms) +✔ the server sends task verbs to the adapter with its own timeout; other verbs stay synchronous (320.460323ms) +✔ without an adapter the server refuses every task verb (72.182947ms) +✔ the runtime refuses an invalid adapter and closes a valid one (100.131509ms) +✔ the process loads the S3 adapter from plain-data trackers (446.946035ms) +✔ row 177 T1: a tester thread is owned by tester, and neither side reaches or lists the other (47.904994ms) +✔ row 177 T2: the tester thread.send is from tester-cli with no human.input; its open is by tester (31.259855ms) +✔ row 177 T3: the lists read the tester as the human in its own thread, and nowhere else (24.012193ms) +✔ row 177 T3: an assistant that would not hear the human refuses the tester too (31.787125ms) +✔ row 177 T4: the tester thread run answers the tester, never the human (54.635057ms) +✔ row 177 T5: each stop revokes only its own threads, recorded by its own actor (39.380391ms) +✔ row 177 T5: the human stop never ends a tester run (31.651655ms) +✔ row 177 T6: a business whose human is tester refuses invalid-business (18.91688ms) +✔ row 177 T7: the human trail shows a tester thread message as the tester (37.932704ms) +✔ row 177 T8: a tester-thread run never raises a decision to the human; a human-thread run still does (39.098422ms) +✔ row 177 T8: a tester-thread raise routed to the arbiter stays allowed (30.792724ms) +✔ row 182 T9: a tester reply into the human's thread refuses thread-not-owned and stores nothing (34.941983ms) +✔ row 182 T9: a tester reply into its own thread lands there (35.498512ms) +✔ row 182 T9: the chief's reply up a chain into a tester's thread lands there (41.755097ms) +✔ row 182 T9: a tester reply to a spec notice refuses thread-not-owned; the chief's relay still lands (40.366015ms) +organization: {"event":"reload-needs-restart","business":"demo"} +organization: {"event":"reload-needs-restart","business":"demo"} +organization: {"event":"reload-needs-restart","business":"demo"} +organization: {"event":"reload-needs-restart","business":"demo"} +organization: {"event":"reload-needs-restart","business":"demo"} +✔ row 175: TESTER_VERBS and the organization branch tester set are pinned (1.455897ms) +✔ row 175: each of the six reads as the tester deep-equals the human read (129.153424ms) +✔ row 175: W1-W3 as the tester land with receipt actor tester; the human still logs the human (116.822448ms) +✔ row 175: W2 as the tester refuses credentials, protected definitions, human, tester and bus.tester, and changes nothing (104.169155ms) +✔ row 175: the human-only actions refuse a tester tester-refused, and the file and store stay as they were (95.863225ms) +✔ row 175: W4 as the tester writes by tester and keeps every name check (35.768321ms) +✔ row 175: W6 as the tester records created_by tester; the human records the human (26.655216ms) +✔ row 175: with bus.tester unset or not exactly true no tester binds, so no read or write runs (97.98692ms) +✔ the tester binds only when the business sets bus.tester to exactly true (142.672844ms) +✔ a business may not name a role tester, so the tester address is never a role (44.575715ms) +✔ every verb outside the tester list refuses tester-refused and is recorded against the tester (79.307697ms) +✔ a tester message is from tester, needs no prefix, and writes no human.input or authority (33.558536ms) +✔ a tester message to a role no run holds refuses tester-target-not-running and stores nothing (23.722818ms) +✔ a tester message is refused while the run is only launched, and routes once it claims (26.159861ms) +✔ a human message to a role no run holds still waits and tells launch.by (27.583947ms) +✔ a role answers a tester only in reply to a tester message, and the answer never reaches the human (49.556907ms) +✔ the tester reads the human views a reader reads (55.17384ms) +✔ tester proof binds its own CLI, start time and nonce, refuses a managed run and allows an agent (1.757059ms) +✔ neither CLI's nonce proves the other: each proof is bound to its own CLI and nonce variable (0.55335ms) +✔ testerNonce reads only the tester's variable and gives null on any read error (0.316684ms) +✔ an envelope carries exactly one of cap, human and tester; no tester authenticator refuses (162.317032ms) +✔ tester-cli.mjs binds through the runtime when the switch is on, and refuses off or under a run marker (1344.932189ms) +✔ T1: the human and the reader see a held thread claim; agents still lists the role only (46.922382ms) +✔ T2: a released or revoked thread claim is not listed, though its thread has an earlier claim row (41.137166ms) +✔ T3: a role session refuses human-required and the tester refuses tester-refused (37.545134ms) +✔ T4: agents answers each session the same before and after a thread run claims (34.820063ms) +✔ T5: the result carries neither the thread name a user wrote nor a message body (36.808641ms) +✔ T6: two held sessions of one thread list as two rows, each its session's latest claim (38.109345ms) +✔ REQ-THREAD-1 REQ-ORG-2: the 3d→3e migration adds the thread tables and leaves messages from before threads as written (150.732889ms) +✔ REQ-THREAD-1: a 3d bus with a changed schema is refused and keeps its version and tables (71.597639ms) +✔ REQ-THREAD-1: the offline command prints the kept-message counts before the ready line (189.771171ms) +✔ a share lets the sharee read the thread and nothing else: every write verb stays the owner's (mutants 7, 9) (66.955492ms) +✔ the business human shares too, and a `*` share reaches every covered principal but the tester (43.030108ms) +✔ mutant 2: a share never widens a grant; when the sharee's grant stops covering the thread, its reads end (41.768882ms) +✔ mutant 3: a thread whose user owner has lost coverage is hidden from its sharees, the owner's board included (58.451184ms) +✔ mutant 4: a share's state is its latest row, so an unshare ends it and a share after it starts it again (56.989654ms) +✔ mutant 8: a user target needs a live grant of any level covering the thread, else share-not-covered (43.361928ms) +✔ a viewer reads a thread shared with it, and share, unshare and shares refuse a viewer access-refused (design 4.3) (48.146077ms) +✔ a share target is `user:`, the business human or `*`, and never the sharer (73.121267ms) +✔ a user whose collaborator grant no longer covers its own thread can't share, unshare or list its shares (38.37435ms) +✔ the tester and a reader session never share: each verb refuses and writes nothing (69.036976ms) +✔ the owner's trail and replies show a user's message only while that user's thread is shared with the owner (53.724822ms) +✔ a share covers every session of the thread (43.707213ms) +✔ a sharee can't list the thread's sessions: session.list stays owner-only (Q7, sage-2818 Q1) (41.233153ms) +✔ only a human principal matches a share: an agent bound to the thread and the tester match none (sage-2818 Q2) (68.782302ms) +✔ a 3l store migrates to 3m: thread_shares is new and empty, and every other row stays as it was (169.499205ms) +✔ the 3l engine refuses a 3m store, migrating or not, and leaves it as it was (276.925346ms) +✔ REQ-ROLE-2 REQ-THREAD-1: one holder per thread, through the broker and the trigger (67.130074ms) +✔ REQ-ROLE-2 REQ-THREAD-1: the 3e triggers refuse writes that skip the broker (131.122032ms) +✔ REQ-MSG-1: a message to or from the assistant names its thread, or is refused (60.181748ms) +✔ REQ-MSG-1: the chief of staff's reply comes back to the thread that sent the work (985.690774ms) +✔ REQ-MSG-1: a reply can't carry one thread instance's thread to another thread instance (33.146274ms) +✔ REQ-THREAD-1 REQ-USER-2: one thread's messages never reach another thread's holder (38.546104ms) +✔ REQ-LAUNCH-1: a message to a thread with no holder waits, and the next holder gets it (39.611836ms) +✔ REQ-THREAD-2 REQ-LAUNCH-1: threadIdle releases only a thread with nothing waiting, and only for its holder (38.090302ms) +✔ REQ-THREAD-2 REQ-LAUNCH-1: a message delivered to a run that ended unread doesn't hold up the next holder (32.477545ms) +✔ REQ-ROLE-2 REQ-THREAD-1 Q169: a role.revoke the human approved ends every thread run of the assistant (31.38386ms) +✔ Q169 REQ-USER-2: assistant.stop ends the human's own assistant thread runs, and only the human's (43.11236ms) +✔ REQ-USER-2: the human verbs refuse another owner's thread (31.868967ms) +✔ REQ-THREAD-1: thread.create refuses when the business has no thread instance or more than one (27.372887ms) +✔ REQ-ORG-2: projects and threads are named once, and the repo names a business project (29.644577ms) +✔ REQ-THREAD-2: thread.messages returns the thread's history in pages and writes nothing (102.556859ms) +✔ project.create refuses a repository name without its matching repo before any write (16.42055ms) +✔ project.create keeps unrelated names with and without a repository (14.729852ms) +✔ C2-09a: explicit creative instances bind independent threads, default sessions and holders (53.088737ms) +✔ C2-09a: explicit missing, non-thread and malformed selectors create no thread or session (32.202174ms) +✔ C2-09a: creative bindLaunch without a thread refuses thread-required (13.657737ms) +✔ socket capability stamps launch identity; shared views use wire, no SQL client (74.04916ms) +✔ two wire claims serialize; a lost reply never automatically retries (63.690629ms) +✔ malformed, oversized and identity-forging envelopes refuse without echoing input (52.100046ms) +✔ client preserves UTF-8 when a response divides a multibyte character (12.757027ms) +✔ committed mutation followed by dropped reply reports unknown and is never retried (57.077236ms) +✔ REQ-LIMIT-4 usage protocol binds run identity, requires a delivered turn and isolates businesses (45.790158ms) +✔ REQ-LIMIT-4 3g copy migrates through 3h, 3i, 3j and 3k to 3l preserving every old column, row and sequence; new usage table is empty (154.890506ms) +✔ REQ-PLUG-1 runtime reaches transcript only through loader, over the real bus socket (110.811143ms) +✔ REQ-LIMIT-4 loader source records new turn kinds, excludes history and retries exactly once (29.302838ms) +✔ REQ-LIMIT-4 cut: unknown is durable and logged next to every total (20.50176ms) +✔ REQ-LIMIT-4 disabled: unknown is durable and logged next to every total (23.185864ms) +✔ REQ-LIMIT-4 missing-begin: unknown is durable and logged next to every total (16.730189ms) +✔ REQ-LIMIT-4 no-new-usage: unknown is durable and logged next to every total (20.281138ms) +✔ REQ-LIMIT-4 rewrite: unknown is durable and logged next to every total (17.749554ms) +✔ REQ-LIMIT-4 unfinished turn remains visibly unknown after accounting restarts (17.955876ms) +✔ usage records are append-only (17.826395ms) +✔ REQ-LIMIT-4 parse failure logs its safe code, never transcript content (18.174746ms) +✔ REQ-LIMIT-4 resumed run baselines history and exact totals do not overflow (23.018239ms) +✔ REQ-PLUG-1 core has no transcript import and disabled sources do not read any transcript (18.268346ms) +✔ REQ-LIMIT-4 a resumed thread bills only new assistant messages to its next run (18.839356ms) +✔ REQ-LIMIT-4 every enabled source is called; failure is unknown and a partial total stays labelled (25.929406ms) +✔ REQ-LIMIT-4 a turn whose reported sum exceeds safe precision is unknown, not rounded (17.110341ms) +✔ row 65 a run bound without a transcript directory records no-transcript (17.518984ms) +✔ R3: bindUser binds a granted user and refuses one with no live grant (30.537368ms) +✔ R3: a user named like the business human, the tester or a principal word is refused, whatever the grants say (22.610912ms) +✔ R3: each collaborator verb is allowed to a granted user (37.816564ms) +✔ R3: every verb off the collaborator list refuses a user access-refused before its own checks (199.509531ms) +✔ R3: task, web and host verbs refuse a user access-refused (40.616767ms) +✔ R3 leak: project.list shows granted projects only (21.378456ms) +✔ R3 leak: thread.create needs the project and the thread instance granted, and an ungranted id reads as one that does not exist (27.725899ms) +✔ R3 leak: thread.list shows the user its own threads that are still granted, never others (55.595497ms) +✔ R3 leak: names shows granted instances only (23.154764ms) +✔ R3: thread.send is from user: and writes no human.input (20.100854ms) +✔ R3: a reply-chain message.send into another user thread is refused (22.940609ms) +✔ R3: the run reply to a user message reaches that user thread.messages, with no waiting and no notice (25.617742ms) +✔ R3: a reply to: user without a matching in_reply_to is refused user-reply-required (37.549234ms) +✔ R3: a non-thread run, the human and the tester cannot send to: user (23.310673ms) +✔ R3: a user thread run cannot message the owner, while its uncited gated raise reaches only the owner inbox, B9 (26.310188ms) +✔ R3: a removed or expired grant refuses the next request access-revoked, and the file is read per request (28.010587ms) +✔ R3: a user refusal is recorded as action.refused by user: (17.289181ms) +✔ R3: a business with a role keyed user refuses invalid-business (14.500979ms) +✔ R3: name.set refuses the name user (16.803177ms) +✔ R3 r4: while halted, a granted user's thread.send refuses processing-halted and thread.messages still answers (20.928446ms) +✔ R3 r4: the chief's hire refuses an instance named user with the code it gives human and tester (20.967776ms) +✔ R3 r4: a non-function access throws before the store is read (0.15584ms) +✔ C2-09a: naming an instance cannot bypass its collaborator grant or disclose an ungranted project (24.886151ms) +✔ 264e deferred B6: a reply cannot cite the same user in a sibling session (24.398333ms) +✔ 275: VIEWER_VERBS is the ruled read list, inside USER_VERBS (1.45878ms) +✔ 275: a viewer binds, and each viewer verb answers with what its grant covers (52.692037ms) +✔ 275: a viewer is refused thread.create, thread.open and thread.send access-refused, and nothing is stored (35.28733ms) +✔ 275: every verb off the user list refuses a viewer access-refused before its own checks (175.383816ms) +✔ 275: mixed grants, collaborator on one project and viewer on another, take the level per project (43.020563ms) +✔ 275: board reads refuse users and viewers access-refused (118.449344ms) +✔ governance pin, user side: decisions, inbox entries, claims, tasks and project files are the owner's, the user reads its messages (55.695204ms) +✔ web.search: a granted role gets labelled results, and the call is trailed with role, run, verb and query (40.212968ms) +✔ web.fetch: a granted role gets the page as labelled text, and the call is trailed with the url (36.527739ms) +✔ a role without the grant is refused, the refusal is logged with the verb, and nothing is fetched (32.886079ms) +✔ a broker with no web service refuses a granted role (24.404251ms) +✔ bad requests are refused: unknown verb, extra or missing argument, not a string, a human or reader session (29.96117ms) +✔ a session that is not the role holder is refused (20.689244ms) +✔ web.mjs's fences hold on the broker side: refusals are normal results with the fixed reason (64.980191ms) +✔ web.search with no search source configured is a refused result, not an error (25.040807ms) +✔ a search source that fails with its own refusal, or that throws, is handled (29.553714ms) +✔ a slow search source ends in a refusal at the deadline (70.451643ms) +✔ a secret in the arguments is refused before anything is trailed or fetched (17.419925ms) +✔ over the socket: the server routes web verbs to the service; other roles are refused; no service is web-not-configured (82.417869ms) +✔ busBusiness: the web grant comes from "web" in the resolved tool limit (0.331568ms) +✔ webServices: the business's search-source plug-in and web.searxng var make web.search work; without either it is refused as not configured (62.683847ms) +✔ an ungranted call is refused at once: no admission, no wait, nothing touched (23.828134ms) +✔ over the socket an ungranted caller is dropped by the server timeout and a granted one gets the longer wait (349.320627ms) +✔ a search that never answers is aborted at the deadline, the module sees the signal, and the call is trailed as refused (timeout) (77.992754ms) +✔ a fetch that stalls is cut off at the deadline: the request is destroyed, not left running (99.261361ms) +✔ one query limit: over SEARCH_MAX_QUERY_CHARS or empty is refused with the same reason before any backend, and the tool schema carries the same number (22.966781ms) +✔ merge-gate's technical raise is cross-role, goes to the cto, and only merge-gate can use the approval (63.45816ms) +✔ merge-gate has no message.send, and without a domain its raise goes to the delivery arbiter (42.302728ms) +✔ the cto must be able to message merge-gate, or the technical raise is refused (row 133) (33.939969ms) +✔ security-reviewer answers a review with its verdict alone; it holds no message.send (42.975901ms) +ℹ tests 981 +ℹ suites 0 +ℹ pass 981 +ℹ fail 0 +ℹ cancelled 0 +ℹ skipped 0 +ℹ todo 0 +ℹ duration_ms 24247.389342 diff --git a/agents/rockerduck/work/queue-286/gate-r5/library-r5.txt b/agents/rockerduck/work/queue-286/gate-r5/library-r5.txt new file mode 100644 index 000000000..1312ad570 --- /dev/null +++ b/agents/rockerduck/work/queue-286/gate-r5/library-r5.txt @@ -0,0 +1,160 @@ +✔ C2-06 reply schema: free bodies, exact objects and safe refusal reasons (33.314657ms) +✔ C2-06 citation setting and all four exact fixed texts (21.835423ms) +✔ C2-06 default citation cap passes 20 and refuses 21, even with optional citations (152.366676ms) +✔ C2-06 real Git citation scope, reachability, lines and normalized quotes (69.941057ms) +✔ C2-06 playground cites pass but cannot state canon (39.428971ms) +✔ C2-06 independent universes refuse; a hybrid and only its sources pass (68.325051ms) +✔ C2-06 web cites require allowed definition, this session fetch and kept quote (17.447414ms) +✔ C2-06 file origin is the path commit and trailer, while last follows served changes (51.608372ms) +✔ C2-06 origin uses literal paths even when a filename contains a glob (30.364536ms) +✔ C2-06 cited-commit guard reads exactly the C2-05a indexed file set with supporting scope (76.530249ms) +✔ C2-06 reply limits fall back independently without coercion or inherited keys (0.650423ms) +✔ the same commit, repo path and mapping return the same index, and only mapped files are in it (54.986891ms) +✔ a different repo path, mapping or commit gets its own index (69.187504ms) +✔ the cache holds at most eight indexes and evicts the least recently used (104.028712ms) +✔ a failed read is not kept in the cache (17.496977ms) +✔ a missing or unchecked mapping is refused before any read (14.429727ms) +✔ a 3,000-file rebuild completes and its time is reported (3069.109382ms) +ℹ 3,000-file index rebuild: 2828 ms +✔ resolver step 1: a path from the repo root, with or without .md (1.823375ms) +✔ resolver step 2: the same path with vaultPrefix/ stripped (0.371558ms) +✔ resolver step 3: a path relative to the linking file, never above the repo root (0.325094ms) +✔ resolver step 4: a base name that matches exactly one indexed file (0.376028ms) +✔ a link into another of her repos resolves to nothing (0.212705ms) +✔ wikilink forms, embeds, and links skipped inside code (1.388524ms) +✔ only a body embed whose target has an extension other than .md, in any case, is an attachment (0.449806ms) +✔ the fixture mapping checks and comes back frozen (3.268417ms) +✔ C2-01c: a prefix inside or holding another entry's book refuses library-playground-other-universe (1.521134ms) +✔ C2-01c: a prefix equal to a book folder, or holding its own, refuses library-mapping-invalid (0.813158ms) +✔ C2-01c: universe-level prefixes lie outside every book, in a plain universe and in a hybrid with no books (1.25639ms) +✔ C2-01c: a draft takes kind, name and playground only, and comes back frozen with books [] (2.052664ms) +✔ C2-01d: supporting prefixes at book level, universe level, in a hybrid and in a draft, [] when absent (0.631545ms) +✔ C2-01d: each supporting prefix rule refuses with its code (2.650859ms) +✔ C2-01d: between the lists, a supporting prefix may equal its own playground, and a playground may hold its own supporting (1.192951ms) +✔ C2-01d: editor is optional, kept when given, and refuses anything but a plain name and email (7.949132ms) +✔ C2-01d: an accepted editor round-trips through a real git commit unchanged (17.215259ms) +✔ no playground prefix holds another, and no book folder holds another (1.034693ms) +✔ shape refusals: kind, remote, branch, unknown keys, types, manuscript, folder names (1.256404ms) +✔ C2-03a sage-2021: user is optional, kept when given, and must be a plain account name (0.801411ms) +✔ a hybrid universe is a shape the query code can take (1.4), with sources that must exist (1.046199ms) +✔ a caller-supplied fail receives the code, as business file loading will pass it (C2-04) (0.377005ms) +✔ scope comes from the path alone (design 1.2) (0.73665ms) +✔ C2-04 mirror: exact default path, bare without checkout or remote, and idempotent initialization (75.239758ms) +✔ C2-04 mirror: simultaneous creators publish one intact mirror and leave no staging paths (53.088037ms) +✔ C2-04 mirror: skipped publication accepts both coreutils statuses without removing the winner (176.797837ms) +✔ C2-04 mirror: preserve occupied directories and reject symlink ancestors and code overlaps (18.365788ms) +✔ C2-04 mirror: existing metadata accepts only bare Git plus state and the precreated lock (37.082282ms) +✔ C2-04 state: missing state is empty only while the served ref is absent (53.369586ms) +✔ C2-04 state: valid problems and sync metadata return no content and change no state bytes (53.916094ms) +✔ C2-04 state: strict keys, types, times, branch, commit and fixed R messages fail closed (158.54358ms) +✔ C2-04 state: symlink, hardlink, non-private state and missing lock refuse without replacement (43.176748ms) +✔ C2-04 file: served commit, not HEAD or a caller commit, owns the exact returned text (122.579251ms) +✔ C2-04 file: R1, R2 and R7 exclusions and never-synced mirrors cannot return file bodies (116.237919ms) +✔ C2-04 lock: a first-sync and fast-forward reader wait for a consistent pair across processes (263.203405ms) +✔ C2-04 lock: same-process waits, timeout code, callback expiry and throw release (5032.914717ms) +✔ C2-04 lock: owner death releases the kernel lock without replacing its file (53.90776ms) +✔ C2-04 lock: a missing flock binary becomes a handled refusal (52.06452ms) +✔ C2-04 lock: an unawaited scoped read drains before the lock is released (20.928211ms) +✔ the query reply cap equals the harness reply cap (1.374042ms) +✔ find is bound to its universe and refuses a call without one (69.298537ms) +✔ every result carries its scope, and playground appears only when asked for (39.588069ms) +✔ unmapped files never appear in any reply (41.725677ms) +✔ a hybrid sees its sources canon, minus exclusions, and no playground (39.745104ms) +✔ a hybrid gets a source file it can see, and not an excluded or foreign one (54.569795ms) +✔ get lists visible links both ways and drops a target another universe cannot see (49.741944ms) +✔ a long list pages by position, never cuts an item, and returns 50 per page (195.288972ms) +✔ a page stays under the reply cap when items are large (91.308887ms) +✔ a search line too long to fit alone comes back marked, with no excerpt, and the other hits still return (32.741226ms) +✔ a find item that cannot fit alone is refused, not cut (30.177027ms) +✔ get pages its lines, and the next line picks up where the page stopped (34.036647ms) +✔ get refuses a file whose front matter alone is over the cap, and a line alone is over the cap (32.225032ms) +✔ get pages the links of a hub note, every page carries the front matter, and the pages add up (937.453899ms) +✔ get rejects a bad links_from (30.579713ms) +✔ search returns scoped line hits, case-insensitively, and refuses empty text (27.317402ms) +✔ a manuscript call returns one chapter, at most 400 lines, and names its next line (45.067736ms) +✔ a manuscript call without a chapter returns the first chapter in path order and names the next (25.249972ms) +✔ a chapter name that matches two visible files is refused (26.105768ms) +✔ a hybrid reads a source chapter through its declared sources only (35.611261ms) +✔ universe info reports a hybrid sources, constraints and notes, and refuses an unknown universe (13.375232ms) +✔ an exclusion hides what it names from a hybrid and from nothing else (34.737212ms) +✔ PRD 1.14: a lookup that names a book leaves book-null files out (30.351312ms) +✔ PRD 1.14: library_manuscript never reads a book-null file (28.779537ms) +✔ PRD 1.14: a draft universe has no canon, so its lookups return files only with scope playground (33.850331ms) +✔ PRD 1.14: library_universe on a draft returns its kind, name and prefixes (13.005683ms) +✔ a hybrid gets a source playground file as null, while the source gets it with scope playground (37.428538ms) +✔ the fixture reads clean: every resolver step, appears_in and relationships wikilinks indexed (57.451116ms) +✔ R1: executables, symlinks, gitlinks, blobs over 1 MiB and non-UTF-8 text are not indexed (97.059247ms) +✔ R2: unmapped paths are reported and not indexed (34.657525ms) +✔ R3: front matter not fully parsed stays raw, with the line where parsing stopped (37.636787ms) +✔ front matter forms the reader accepts and refuses (0.684877ms) +✔ R4: a link to no file, to more than one, or into another repo is reported and not followed (34.990314ms) +✔ a block list link carries its item line, a scalar or flow link its key line, and problems follow (31.586964ms) +✔ an unresolved attachment embed gives no problem; a link or front matter value to one is R4; a note embed resolves (31.279174ms) +✔ an indexed Dr.Quinn.md resolves as a body link, a block list link and an embed (34.982445ms) +✔ R5: a canon file that refers into the playground is reported, and the link still goes by path (31.831603ms) +✔ R6: a canon file that refers into another universe is reported; a hybrid may refer into its sources (32.879568ms) +✔ R7: two paths that differ only in case are both left out (39.929801ms) +✔ the reader reads the commit, never the working tree, and refuses a bad commit id (37.264602ms) +✔ a bare mirror reads the same as the clone (53.600446ms) +✔ renderItems snapshot: fact (1.507608ms) +✔ renderItems snapshot: finding (0.280328ms) +✔ renderItems snapshot: correction (0.191449ms) +✔ renderItems snapshot: question (0.161498ms) +✔ renderItems snapshot: idea (0.221962ms) +✔ renderItems numbers several items and takes a parsed body as well as a string (0.972903ms) +✔ without options a path cite has no badge and is never marked changed (0.23437ms) +✔ renderItems snapshot: notice no-cited-answer (0.204262ms) +✔ renderItems snapshot: notice no-answer (0.172786ms) +✔ renderItems snapshot: notice turn-failed (0.246359ms) +✔ a body without the reply shape shows a fixed line and none of its text (0.577884ms) +✔ C2-01c: each level gives its universe, and its book or null (4.098282ms) +✔ C2-01c: prefixes come first: in a book that holds a prefix, a file outside it is canon and one under it playground (0.825776ms) +✔ C2-01c: a canon file linking into a draft gives R6, and into its own universe-level prefix gives R5 (58.413682ms) +✔ C2-01d: each supporting level gives its universe, and its book or null (0.934055ms) +✔ C2-01d: supporting comes before playground; a folder in both lists is supporting, one in the playground only stays playground (0.61729ms) +✔ C2-01d: only .md files are supporting; a .canvas or .base under a supporting prefix is unmapped (0.336669ms) +✔ C2-01d: a path passes at book level, universe level, in a draft and in a folder in both lists (2.456474ms) +✔ C2-01d: a path of exactly 1024 bytes passes, and 1025 bytes made of multi-byte characters refuses (1.088754ms) +✔ C2-01d: a path outside the universe's supporting folders refuses (0.796025ms) +✔ C2-01d: malformed paths refuse by class, in order (1.131483ms) +✔ C2-01d: a symlink or gitlink on the way, or at the path itself, refuses (0.405651ms) +✔ C2-01d: a name that differs from a tree name only in case or Unicode form refuses, at the file or any folder (1.45266ms) +✔ the survey prints folder names, counts, key sets and link-form counts, and never text (56.424684ms) +✔ folder names print DEL, C1 and bidi controls, U+061C among them, as escapes (37.540391ms) +✔ an embed of an attachment counts as an embed and as an attachment; a plain link to one does not (26.309473ms) +✔ with --mapping the survey adds scope, resolver step and problem counts (50.591633ms) +✔ C2-01d: with --mapping the survey counts supporting files (46.72286ms) +✔ survey exit codes: usage 4, bad mapping 3, unreadable repo 2 (18.657409ms) +✔ scripts/mosaic library survey reaches the survey (108.500394ms) +✔ C2-03a argv: the fixed sequence, one https allow, no other protocol key (2.650389ms) +✔ C2-03a argv: only an https URL with a plain host, no userinfo, and a plain user (1.080581ms) +✔ C2-03a helper: answers only the exact prompts for the configured host and user (dewey-0765) (52.239114ms) +✔ C2-03a first sync: served is the fetched tip, HEAD is served, the survey reads it, and the token stays in the slot (194.31246ms) +✔ C2-03a fast-forward: served moves, problems are rebuilt, and a repeat changes only lastFetch (290.730738ms) +✔ C2-03a Filbert N2: a read that took served before a sync still finds its objects after served moves (256.998332ms) +✔ C2-03a overlap: a reader during a sync sees the old pair or the new one, never a mix (194.224747ms) +✔ C2-03a diverged: a non-fast-forward keeps serving and holds until a human accepts the tip (428.940099ms) +✔ C2-03a accept starts the record over, so a changed branch gets a fresh state (173.492714ms) +✔ C2-03a fetch failure: a wrong token keeps serving and records the error, lastFetch unchanged (199.807249ms) +✔ C2-03a a failed first fetch records the error with nothing served (58.387134ms) +✔ C2-03a a 302 to another host fails the fetch and the other host sees nothing (61.485514ms) +✔ C2-03a the slot: missing or unsafe refuses before git, and sync never opens it (58.368256ms) +✔ C2-03a sage-2021: an entry with no user refuses library-remote-invalid and runs no git (36.536617ms) +✔ C2-03a one sync per mirror: an overlapping call refuses library-sync-busy (126.434304ms) +✔ C2-03b argv: a push sends one full commit to the branch, fast-forward only, with the fetch prefix (0.466275ms) +✔ C2-03b T1 push: a fast-forward lands with the seat's own user and file, and moves no local ref (110.989514ms) +✔ C2-03b T2 and T3: a moved tip reports the race after one fetch, and a second race refuses stale-base (186.414291ms) +✔ C2-03b race fetch: while a sync of the mirror runs, the race refuses library-sync-busy (218.556818ms) +✔ C2-03b T4: a dead remote, a hook refusal and a wrong token each refuse library-push-failed (185.158633ms) +✔ C2-03b push: a refused, missing or unsafe credential runs no git (94.141925ms) +✔ C2-03b T10 humanCredential: her login and a 0600 slot library-human, or library-human-missing (0.97279ms) +✔ C2-03b fetch credential: the state names the kind and user, a refusal runs no git, and a pre-286 state still reads (143.838791ms) +✔ C2-03b T5 helper: the named seat's user and file, never a link, 0644, another uid, or a swapped file (30.403362ms) +ℹ tests 151 +ℹ suites 0 +ℹ pass 151 +ℹ fail 0 +ℹ cancelled 0 +ℹ skipped 0 +ℹ todo 0 +ℹ duration_ms 6420.610698 diff --git a/agents/rockerduck/work/queue-286/gate-r5/mutants-summary.txt b/agents/rockerduck/work/queue-286/gate-r5/mutants-summary.txt new file mode 100644 index 000000000..0cbb983ba --- /dev/null +++ b/agents/rockerduck/work/queue-286/gate-r5/mutants-summary.txt @@ -0,0 +1,3 @@ +P1-force-push: control exit0; mutant exit1 at ERR_ASSERTION; restored exit0; SHA256 restored 784af63a417b547b195ca835878daeba5b696b42a83a4c95de6728a0efa75e38 +P2-drop-inode: control exit0; mutant exit1 at ERR_ASSERTION; restored exit0; SHA256 restored 5c9b528fd69a2493f04933fc84f352b1101d276d69d9982806975def614fd740 +B285-M1-chief-write: control exit0; mutant exit1 at ERR_ASSERTION; restored exit0; SHA256 restored 9e16ff6225cf5e438b0694e2f2b5831c2750f2d0dfc43c7f2f257d8cdacf9ffd diff --git a/agents/rockerduck/work/queue-286/gate-r5/token-search.txt b/agents/rockerduck/work/queue-286/gate-r5/token-search.txt new file mode 100644 index 000000000..59e2e2ca0 --- /dev/null +++ b/agents/rockerduck/work/queue-286/gate-r5/token-search.txt @@ -0,0 +1,14 @@ +Six exact fixture strings checked in memory; values omitted. +B285-M1-chief-write-control.log: exact=0, pattern=0 +B285-M1-chief-write-mutant.log: exact=0, pattern=0 +B285-M1-chief-write-restored.log: exact=0, pattern=0 +P1-force-push-control.log: exact=0, pattern=0 +P1-force-push-mutant.log: exact=0, pattern=0 +P1-force-push-restored.log: exact=0, pattern=0 +P2-drop-inode-control.log: exact=0, pattern=0 +P2-drop-inode-mutant.log: exact=0, pattern=0 +P2-drop-inode-restored.log: exact=0, pattern=0 +bus-r5.log: exact=0, pattern=0 +library-r5.log: exact=0, pattern=0 +touched-credential.log: exact=0, pattern=0 +touched-sync.log: exact=0, pattern=0 diff --git a/agents/rockerduck/work/queue-286/gate-r5/touched-credential.txt b/agents/rockerduck/work/queue-286/gate-r5/touched-credential.txt new file mode 100644 index 000000000..04c6a4c7f --- /dev/null +++ b/agents/rockerduck/work/queue-286/gate-r5/touched-credential.txt @@ -0,0 +1,46 @@ +TAP version 13 +# Subtest: C2-03b T6: the slot before any chief evidence, then the listed chief's live grant +ok 1 - C2-03b T6: the slot before any chief evidence, then the listed chief's live grant + --- + duration_ms: 28.04537 + type: 'test' + ... +# Subtest: C2-03b T7: a chief revoked through grants.revoke or fired through instance.fire refuses, and the fallback stays ended +ok 2 - C2-03b T7: a chief revoked through grants.revoke or fired through instance.fire refuses, and the fallback stays ended + --- + duration_ms: 185.110205 + type: 'test' + ... +# Subtest: C2-03b T7 choice checks: delisted, a fire under way and held each refuse; a rehire lists the chief again +ok 3 - C2-03b T7 choice checks: delisted, a fire under way and held each refuse; a rehire lists the chief again + --- + duration_ms: 31.316624 + type: 'test' + ... +# Subtest: C2-03b T8: a chief grant on another project ends the fallback, and two listed chiefs refuse library-fetch-no-grant +ok 4 - C2-03b T8: a chief grant on another project ends the fallback, and two listed chiefs refuse library-fetch-no-grant + --- + duration_ms: 28.252007 + type: 'test' + ... +# Subtest: C2-03b departure (sage-2928): with no chief entry, any Gitea grant evidence refuses +ok 5 - C2-03b departure (sage-2928): with no chief entry, any Gitea grant evidence refuses + --- + duration_ms: 15.562886 + type: 'test' + ... +# Subtest: C2-03b T9 runtime: the chief's store file and user, then a real revoke that runs no git with the slot at 0000 +ok 6 - C2-03b T9 runtime: the chief's store file and user, then a real revoke that runs no git with the slot at 0000 + --- + duration_ms: 687.423158 + type: 'test' + ... +1..6 +# tests 6 +# suites 0 +# pass 6 +# fail 0 +# cancelled 0 +# skipped 0 +# todo 0 +# duration_ms 1106.366032 diff --git a/agents/rockerduck/work/queue-286/gate-r5/touched-sync.txt b/agents/rockerduck/work/queue-286/gate-r5/touched-sync.txt new file mode 100644 index 000000000..51bc31137 --- /dev/null +++ b/agents/rockerduck/work/queue-286/gate-r5/touched-sync.txt @@ -0,0 +1,32 @@ +✔ C2-03a argv: the fixed sequence, one https allow, no other protocol key (1.436517ms) +✔ C2-03a argv: only an https URL with a plain host, no userinfo, and a plain user (0.577916ms) +✔ C2-03a helper: answers only the exact prompts for the configured host and user (dewey-0765) (28.778404ms) +✔ C2-03a first sync: served is the fetched tip, HEAD is served, the survey reads it, and the token stays in the slot (116.672712ms) +✔ C2-03a fast-forward: served moves, problems are rebuilt, and a repeat changes only lastFetch (173.590792ms) +✔ C2-03a Filbert N2: a read that took served before a sync still finds its objects after served moves (164.95977ms) +✔ C2-03a overlap: a reader during a sync sees the old pair or the new one, never a mix (147.534112ms) +✔ C2-03a diverged: a non-fast-forward keeps serving and holds until a human accepts the tip (342.519699ms) +✔ C2-03a accept starts the record over, so a changed branch gets a fresh state (151.126155ms) +✔ C2-03a fetch failure: a wrong token keeps serving and records the error, lastFetch unchanged (172.845823ms) +✔ C2-03a a failed first fetch records the error with nothing served (50.837991ms) +✔ C2-03a a 302 to another host fails the fetch and the other host sees nothing (54.065385ms) +✔ C2-03a the slot: missing or unsafe refuses before git, and sync never opens it (50.518432ms) +✔ C2-03a sage-2021: an entry with no user refuses library-remote-invalid and runs no git (26.632778ms) +✔ C2-03a one sync per mirror: an overlapping call refuses library-sync-busy (117.10529ms) +✔ C2-03b argv: a push sends one full commit to the branch, fast-forward only, with the fetch prefix (0.426418ms) +✔ C2-03b T1 push: a fast-forward lands with the seat's own user and file, and moves no local ref (104.388134ms) +✔ C2-03b T2 and T3: a moved tip reports the race after one fetch, and a second race refuses stale-base (173.932457ms) +✔ C2-03b race fetch: while a sync of the mirror runs, the race refuses library-sync-busy (207.439119ms) +✔ C2-03b T4: a dead remote, a hook refusal and a wrong token each refuse library-push-failed (147.860105ms) +✔ C2-03b push: a refused, missing or unsafe credential runs no git (86.487812ms) +✔ C2-03b T10 humanCredential: her login and a 0600 slot library-human, or library-human-missing (0.854697ms) +✔ C2-03b fetch credential: the state names the kind and user, a refusal runs no git, and a pre-286 state still reads (135.189846ms) +✔ C2-03b T5 helper: the named seat's user and file, never a link, 0644, another uid, or a swapped file (27.416758ms) +ℹ tests 24 +ℹ suites 0 +ℹ pass 24 +ℹ fail 0 +ℹ cancelled 0 +ℹ skipped 0 +ℹ todo 0 +ℹ duration_ms 2558.280321 diff --git a/docs/SESSIONS.md b/docs/SESSIONS.md index f126fe6a1..5e48f32b0 100644 --- a/docs/SESSIONS.md +++ b/docs/SESSIONS.md @@ -1660,3 +1660,5 @@ are never rewritten or removed; corrections are new entries. - 2026-10-24 — rockerduck (a403aa78-b550-4bab-a613-7ea3fd75ec79), row286 / #1791 r4 under sage-4079: new branch from d0a6a87cd, 15 r3 commits transplanted, both append histories retained, product/test patch unchanged apart from newer base context; evidence/manifest regenerated; no setup/tests run, CLEAR pending. - 2026-10-24 — rockerduck (a403aa78-b550-4bab-a613-7ea3fd75ec79), row286 / #1791 r5: rebase onto row285 landing 1f3d0350f, both logs preserved, chief refs and ruled read-mint fixtures prepared; real revoke/fire checks preserved, no product change; pre-gate push next under sage-4097/4100. + +- 2026-10-24 — rockerduck (a403aa78-b550-4bab-a613-7ea3fd75ec79), row286 / #1791 r5 gate: touched6/6+24/24, library151/151, bus981/981; three semantic mutants killed/restored with green controls; no normal red; all output fixture searches zero; sage-4100 read seed verified, ready for round2 Boyd/Dewey checks and Sage landing gate.