docs: briefs for the activate --send/--no-sso row, FED R3 and the 193b1 split; phase 2 plan F39 fixes

- docs/plans/2026-10-22_activate-send-nosso.md: the row Mos approved in mos-1246. Darkwing builds,
  Filbert reviews. --no-sso drops --send, --send refuses without --sso (F39), test-release.sh cases.
- docs/plans/2026-10-22_federation-r3.md: FED R3, the broker user principal, on 193b1a's candidate.
  Owner Morgana, reviewer Dewey. Its parents R1 and row 196 have landed, and the filing was owed.
- human-users-build.md: 193b1 split into 193b1a (message filter, chained on 196) and 193b1b (viewer
  verbs and board refusals, after FED R3 and R4). Mutant 3 moves to 193b2 (sage-2288, morgana-0063).
- sso-phase2-window.md draft 2: the tool gap paragraph names the approved row, and rollback step 1
  drops "--send follows the pointer", since --no-sso drops --send (mos-1246 items 2 and 3).

docs/plans/2026-10-20_human-users-build.md

@@ -12,7 +12,7 @@ Single test files run freely, and suites and mutant batches need Sage's slot.
 
 Boundaries for every row: no change to `~/.mosaic-dev`, `~/.config/mosaic-dev`, the live units, slot files, any
 live access.json or `~/.mosaic`. No request to the live Console, mosaic.woltje.com or auth.diversecanvas.com.
-No user thread goes live before 193b1's message filter has landed (mos-1021 B2, FED R8).
+No user thread goes live before 193b1a's message filter has landed (mos-1021 B2, FED R8).
 
 The owner-visible records are fixed by Mos (mos-1023 item 2) and named in one user sentence, which FED R6
 reuses word for word: "The business owner sees your thread's agent's decisions, inbox entries, claims, tasks
@@ -34,20 +34,39 @@ gate, and the mutants are killed.
 
 ## Brief: 193b1, viewer verbs, board refusals and the message filter
 
-Chained on FED R3, FED R4 and row 196's verifier. The bus gets the viewer verb list, per-grant level
-checks, board reads refused to users, and the section 5.7 `trail` and `replies` filter with `#readable`
-owner-only. No schema change. The governance pin test names each item in the user sentence above. Bus tests
-and mutants 1, 3, 6, 10, 11 and 12 from section 8.
+Split on 2026-10-22 (sage-2288, after morgana-0063) into 193b1a and 193b1b below. The text that stood here
+chained the whole row on FED R3 and R4, which weren't filed. Only the viewer half needs them.
+
+## Brief: 193b1a, the message filter
+
+Chained on row 196's verifier (done). The bus gets the section 5.7 `trail` and `replies` filter over owner,
+reader and tester sessions, with `#readable` owner-only. No schema change. A hidden `trail` subject returns
+`[]`, exactly as an unknown id does, and `replies` returns `message-not-found` for both. One test per verb
+compares the hidden response with the unknown-id response byte for byte. The owner-side governance pin test
+names each item in the user sentence above. Bus tests and mutants 11 and 12 from section 8, plus mutant 1
+as "`#readable` returns true" (the pin test kills it) and a mutant that makes a hidden subject
+distinguishable from an unknown id. FED R3 builds on this row's candidate and extends the filter to user
+sessions.
+
+Gate: Duckworth approves the manifest. The bus suite and every `scripts/test-*.sh` are green on Sage's gate,
+and the mutants are killed.
+
+## Brief: 193b1b, viewer verbs and board refusals
+
+Chained on 193b1a, FED R3 and FED R4. The bus gets the viewer verb list, per-grant `covers` level checks,
+board reads refused to users, and the user-side governance pin test. Bus tests and mutants 6 and 10 from
+section 8.
 
 Gate: Duckworth approves the manifest. The bus suite and every `scripts/test-*.sh` are green on Sage's gate,
 and the mutants are killed.
 
 ## Brief: 193b2, thread shares (schema 3l)
 
-Chained on 193b1. `thread_shares`, the share verbs, the share rules of `#readable` and `#threadRead`, and the
+Chained on 193b1a and 193b1b. `thread_shares`, the share verbs, the share rules of `#readable` and `#threadRead`, and the
 section 5.5 share filters. Schema 3k to 3l (Sage, 2026-10-20: machine grant row a owns 3i to 3j and
 the #436b build owns 3j to 3k, so this row builds on #436b's landing). The table is append-only, and row 181's restore guard and
-`COUNTED` include it. Bus tests for shares and the migration, and mutants 2, 4, 7, 8 and 9 from section 8.
+`COUNTED` include it. Bus tests for shares and the migration, and mutants 2, 4, 7, 8 and 9 from section 8,
+plus mutant 3 (rule 3 dropped), moved here from 193b1 because only shares can kill it (sage-2288).
 Going live needs a `--migrate` window with Jason. Sage takes it to Mos when this row is near.
 
 Gate: Duckworth approves the manifest. The bus suite, the cli suite and every `scripts/test-*.sh` are green on

docs/plans/2026-10-22_activate-send-nosso.md

@@ -0,0 +1,54 @@
+# Row: stack-release.sh activate --send and --no-sso, for the Q175 phase 2 window
+
+Sage, 2026-10-22, for Mos's go mos-1246 (re sage-2285). Gitea #385, Vikunja #412. The window plan is
+`docs/plans/2026-10-22_sso-phase2-window.md` (draft 2, 92be0db02).
+
+## Brief: activate --send and --no-sso
+
+Owner Darkwing. Reviewer Filbert (not Sage or Darkwing, mos-1246 item 1). Gate owner Sage. Base: origin/refactor
+at this brief's commit. It lands and is re-pinned before the phase 2 window. That re-pin is Q173 work on Mos's
+go, run by Jason or Mos. If the target copy's schema differs from 3j and needs `--migrate`, it waits for Jason.
+
+Why: at 02da6a2ae, `scripts/stack-release.sh activate` has `--no-send` but no `--send`, and nothing turns
+`--sso` off. Without `--sso`, `sso_base` carries it from the pointer, and `check_target` refuses the
+pointer's copy as `already-active`. So the window can't turn send on with `--sso` (mos-1195), and its
+same-copy rollback (mos-1245 R1) can't run.
+
+Send and forward auth (mos-1246 F39): send went off on 10-20 (mos-0972) because, under forward auth, any
+same-uid process can send as Jason through 127.0.0.1:7332. So send goes only with `--sso`.
+
+What to build, in `scripts/stack-release.sh` only:
+1. `activate --send` puts `--send` into RUN_CONSOLE where `webui-service.sh` renders it. It refuses unless
+   the run's Console flags hold `--sso`, given or carried. With `--no-send` it is a usage error. The plan's
+   send line reads `send: on; --send was given`, or `send: carried` when the pointer already holds it.
+   `check_target` lets `--send` name the pointer's copy when the pointer holds no `--send`.
+2. `activate --no-sso` is allowed only when the pointer's Console flags hold `--sso`. Otherwise it refuses
+   with a named reason. It takes the Console flags from the rollback set of the activation that turned
+   `--sso` on (that set's `show-$CONSOLE_UNIT.txt`, checked against its SHA256SUMS), the way `sso_base`
+   already does for a rollback to a copy without `--sso`. It drops `--send`, and its plan line says so
+   (F39 a). The tester follows the pointer. A set it can't read, or a set whose Console already ran with
+   `--sso`, refuses before anything stops. `check_target` lets `--no-sso` name the pointer's copy. With
+   `--sso`, `--send`, a proof pair or `--no-proof`, it is a usage error. The plan prints
+   `sso: off; Console flags from <set>/<file>` and lists every flag it restores.
+3. Both flags are refused under `--units external`, like the other unit-render flags (row 232).
+4. The usage text and the header comment name both flags. No other behavior changes.
+
+Tests, whole files on Sage's slot: `packages/cli/tests/stack-release.test.mjs`,
+`packages/cli/tests/stack-release-external.test.mjs` for item 3, and `scripts/test-release.sh`.
+- T1: `--sso --send` on a pointer without send. The plan shows `send: on`, and the unit and the pointer
+  gain `--send`.
+- T2: `--send` without `--sso`, given or carried, refuses (F39 b). `--send --no-send` is a usage error.
+  `--send` on the same copy when the pointer already has send refuses as `already-active`.
+- T3: from an `--sso --send` pointer, `--no-sso` on the same copy returns the unit and the pointer to the
+  pre-`--sso` flags byte for byte, with no `--send` (F39 a and c). The tester stays as the pointer had it.
+- T4: `--no-sso` refusals, each before any unit stops: a pointer without `--sso`; a tampered set
+  (SHA256SUMS mismatch); a set whose Console ran with `--sso`; `--no-sso` combined with `--sso`, `--send`
+  or a proof flag.
+- T5: `--units external` refuses both flags.
+
+Mutants, each killed: drop the SHA256SUMS check in the `--no-sso` path; let `--no-sso` run with no `--sso`
+in the pointer; let `--no-sso` keep `--send`; let `--send` run without `--sso`; let `--send` and
+`--no-send` combine.
+
+Gate: Filbert approves the manifest. The two touched test files run whole plus test-release.sh, and the
+mutants are killed. No live activation in this row. The window uses it.

docs/plans/2026-10-22_federation-r3.md

@@ -0,0 +1,39 @@
+# Federation build row R3, the broker user principal (#414)
+
+Sage, 2026-10-22. The design is Gizmoduck's `agents/gizmoduck/work/federation/DESIGN.md` at b93f098f0 on
+`gizmoduck/federation-design` (r4.11, sha256 1bcee8df0a3a8628a6646535b756c936ca6d9e7bcfa7e1dd2bf1d3f01715c8e6).
+Sections 3.5, 3.6 and 7 set R3's scope and test gate. Vikunja P19 #414. R3's parents, R1 (row 201) and row 196,
+have landed. I owed this filing when they did and missed it (morgana-0063). Row 205 (193b1a) and 193b1b wait
+on it.
+
+## Brief: FED R3, the broker user principal
+
+Owner Morgana, after 193b1a's candidate goes to review. Reviewer Dewey (section 7: Filbert or Dewey). Gate
+owner Sage. Base: 193b1a's candidate (row 205), so R3 extends that row's `trail` and `replies` filter to user
+sessions instead of re-cutting it. If 193b1a changes in review, R3 rebases onto a new branch name.
+
+What to build, in `packages/bus/src/` (broker.mjs and a new `user-cli.mjs`) plus `packages/harness/src/runner.mjs`
+for the header line:
+1. The user proof: a path-bound `packages/bus/src/user-cli.mjs` with its own nonce variable
+   (`MOSAIC_BUS_USER_NONCE`), checked with the `user` kind of row 196's `verifyPrincipal` (section 3.6 checks
+   1-3). R3 consumes that kind. It doesn't re-implement the parent walk.
+2. `bindUser({ business, user })` and the broker changes 1-7 in section 3.6, including the reply path (B6),
+   `#userThread`, `user-thread-human`, `#waiting` returning null for `to: 'user'`, and the runner header line
+   for `from_role` `user`, word for word.
+3. The collaborator verb list from section 3.5, exact, with its filters. Every other verb fails
+   `access-refused` before its own checks. The grant is read per request through R1's loader and `covers`
+   with `level: 'collaborator'`.
+4. The section 3.6 item 5 audit: every `s.human` and `s.tester` branch in broker.mjs, listed in the packet as
+   user refused, user treated as human, or not reachable for a user.
+5. No revocation timer, `access.reload` or launcher change. Those are R4. No Console change. That is R6.
+
+Tests, in `packages/bus/tests/` and the runner's tests: the R3 test gate in section 7, item by item. Mutants:
+the five in section 7's R3 row, plus one that drops the 193b1a filter for user sessions (a user's `trail` of
+a hidden subject differs from an unknown id's). The agent-parent, non-Console-parent and kind-confusion
+mutants are row 196's and stay there.
+
+Boundaries: no change to `~/.mosaic-dev`, `~/.config/mosaic-dev`, the live units or any live access.json. Tests
+use scratch roots. Single test files run freely, and suites need Sage's slot.
+
+Gate: Dewey approves the manifest. The bus and harness suites and every `scripts/test-*.sh` are green on
+Sage's gate, and the mutants are killed.

docs/plans/2026-10-22_sso-phase2-window.md

@@ -17,11 +17,13 @@ Two steps need `scripts/stack-release.sh` flags that don't exist at 02da6a2ae:
   flags (`--public-host`, `--auth-header`, `--allow-user`) have no activate option either. So R1's
   same-copy rollback can't run.
 
-The fix is one small row: `activate --send` and `activate --no-sso`. `--no-sso` takes the Console flags
-from the rollback set of the activation that turned `--sso` on, the way `sso_base` already does for a
-rollback to a copy without `--sso`, and it keeps `--send` and the tester as the pointer has them.
-test-release.sh gets cases for both, and the reviewer is a seat other than Sage. It lands and is re-pinned
-before the window. The steps below assume it.
+The fix is one small row, approved in mos-1246: `activate --send` and `activate --no-sso`. `--no-sso`
+takes the Console flags from the rollback set of the activation that turned `--sso` on, the way `sso_base`
+already does for a rollback to a copy without `--sso`. It drops `--send`, and its plan line says so. `--send`
+refuses unless the run's Console flags hold `--sso`, given or carried (F39). test-release.sh gets cases for
+both. Darkwing builds it, and a seat other than Sage and Darkwing reviews it. Brief:
+`docs/plans/2026-10-22_activate-send-nosso.md`. It lands and is re-pinned before the window, on Mos's go,
+run by Jason or Mos. The steps below assume it, and draft 3 names the new copy.
 
 ## When
 
@@ -109,8 +111,8 @@ Jason starts, the plan names the copy live at that point, and step 3 runs agains
    --plan`, then the same without `--plan`. R1 asked for `--expect-from 7247d80c7`, but `--expect-from` is
    for `--units external` only and the live units are user units, so the plan's from line must name
    7247d80c7 instead. The `--plan` output must show the pre-window Console flags from the step 1 pointer backup: `--port 7332 --public-host
-   mosaic.woltje.com --auth-header X-authentik-username --allow-user jason.woltje --tester-socket`. `--send`
-   follows the pointer. A plan that differs is a stop. Mos or Jason restarts the Console.
+   mosaic.woltje.com --auth-header X-authentik-username --allow-user jason.woltje --tester-socket`, exactly.
+   `--no-sso` drops `--send` (mos-1246 F39), so there's no `--send`. A plan that differs is a stop. Mos or Jason restarts the Console.
 2. Restore config.json from the step 1 backup, which removes `console`. 7247d80c7 loads config with or
    without the key, so the order of 1 and 2 doesn't matter on this copy.
 3. STATE after the rollback reads config.json, the unit's Console flags and the pointer.