sage: window plan repin-8e7ea89a1 on row 162's verbs, de352dfaf superseded (mos-0814, mos-0815)

W2 adopt on Mos's go with Jason present, W2b pointer check (copy 52f35e7a0,
schema 3f) before W3, W3 plan line-by-line match against Darkwing's scratch
rerun, and the W2 undo: remove the pointer only. Landing commit 7e7f8e208.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
This commit is contained in:
jason.woltjeandClaude Opus 5.5 committed 2026-10-18 15:39:38 -05:00
1 parent d132b369ea
commit f5b5aa509f
2 files changed
+193

No files matched your search

@@ -0,0 +1,191 @@
# Re-pin to 8e7ea89a1, rows 148, 141, 143, 128, 124 and 149, bus 3f to 3g to 3h
Sage, 2026-10-18, on Mos's approval of D4 (mos-0814). It replaces
`repin-de352dfaf.md`, which stays as the record. Mos runs every live step,
with Jason present for the whole window. Sage ran none of the window steps.
The tool is row 162's `scripts/stack-release.sh` (D1), not plan-local
scripts. Its `activate` does the stop, the stopped-store check, the backup,
the migration, the installs, the start and the health gate in one run, and
rolls back inside the same run when the gate fails. The decision 96
conditions (mos-0716, `docs/plans/2026-10-18_stack-release.md:189-201`)
apply: Mos gives the go for adopt and for activate, Jason or Mos runs them,
the `activate --migrate` runs with Jason present, a `rollback --restore`
with post-backup events waits for Jason, and nothing is pruned.
- OLD, live: `52f35e7a0933e9fa845f59860a5de1709f9e5756`. Bus schema 3f.
Bus WorkingDirectory read by Darkwing at 19:32:16Z and 19:51:55Z
(`agents/darkwing/work/queue-162/live-reads.md`).
- NEW: `8e7ea89a1e86447d26ec335e4b138acfd5130cbc`, on origin `refactor`.
Bus schema 3h. No copy yet; W0 makes it.
- REPO: the canonical checkout `/mnt/storage/src/mosaic-stack` at or after
row 162's landing commit `7e7f8e208`. `stack-release.sh` runs from REPO,
not from a copy. The target stays 8e7ea89a1: the window installs that
commit's copy, not REPO's HEAD.
- Data root: `/home/jwoltje/.mosaic-dev`.
- Hand-run checks reused from the de352dfaf window, unchanged:
`P=/mnt/storage/scratch/sage-pin-de352dfaf`, checked against
`repin-de352dfaf/SCRIPTS.sha256`. Only `business-check.mjs` and
`console-check.sh` are used. No script was updated for 3h (mos-0814).
## What NEW carries over OLD
`git rev-list 52f35e7a0..8e7ea89a1` lists 92 commits. Six touch code;
the rest are docs, queue, packets and SESSIONS. A path-limited log over
`packages scripts roles adapters contracts tools package.json
package-lock.json` lists exactly these six:
| Row | Commit | Live effect |
|---|---|---|
| 148 | d4ea7e5a6 | Console spec and docs editor: `GET /api/project-files`, `GET /api/project-file`, `markdown-preview.js`, Save only under `--send` to the signed-in public name. No schema change. |
| 141 | de352dfaf | Messages by agent name. Schema 3f to 3g (`messages.to_name`, append-only `instance_names`). `mosaic name` (human write) and `mosaic names` (read). The chief holds `instance.name`, listed as untyped. |
| 143 | 0278b9e0b | A human save of `spec/north-star.md` sends one notice per pm and cto instance; their answers route through the chief. Contracts in `roles/pm.md`, `cto.md`, `chief-of-staff.md`, `assistant.md`. No schema change. |
| 128 | ade628c8b | CLI: `mosaic project create|list`, `mosaic threads`, `mosaic thread create|open|read`, `talk --thread`, `follow --thread`. No schema change. |
| 124 | 70504d23a | Schema 3g to 3h (`usage_records`, append-only). `mosaic usage` and a read-only Token usage section in Settings. |
| 149 | 03bbd2c98 | New `roles/security-reviewer` and `roles/merge-gate`, the proactive line in every role contract, `raise_decision` takes a domain. The business file declares no instance of the new roles, so nothing launches them. |
Row 129 (assistant chat) and row 164 (plug-ins) are not in this range.
Their activate is a second window with its own `--plan` and Jason's
`mosaic plugins set` (mos-0812). Rows 125 and later are not in it either.
## Order, and one change from mos-0814
mos-0814 asked for "the real --plan against the live pointer, then adopt,
then activate --migrate". In row 162's script, `--plan` needs the pointer:
with no `state/stack-active.json` it refuses `no-pointer` ("run adopt
first"), and only `adopt` writes the pointer. So the order here is adopt,
then the real `--plan`, then activate. Mos approved this order in mos-0815,
on the conditions in W2, W2b, W3 and "Undoing W2" below. With the pointer in
place, `--plan` reads the store schema from the store the running bus holds,
not from the pointer.
`adopt` (`stack-release.sh` `do_adopt`) refuses `already-adopted` if a
pointer exists, runs `stack-copy.sh check` (read-only; the bus, Console and
CLI must all be on one copy), reads the effective units and writes the
pointer and one log line. It stops nothing and changes no unit. Mos read the
live units at about 20:24Z: the bus and Console WorkingDirectory are both
`copies/52f35e7a0…`, and `~/.npm-global/bin/mosaic` runs that copy's
`scripts/mosaic`. So adopt should record copy 52f35e7a0 and schema 3f.
## Before the window (nothing stopped)
| # | Who | Step |
|---|-----|------|
| P0 | Mos | `cd $P && grep -E ' (business-check.mjs\|console-check.sh)$' $REPO/agents/sage/work/window-plan/repin-de352dfaf/SCRIPTS.sha256 \| sha256sum -c`: two OK lines. |
| P1 | Mos | `node $P/business-check.mjs $OLD` and, after W0, `node $P/business-check.mjs $NEW`. Both LOAD_OK. NEW: `HOLDS chief instance.name yes`, `HOLDS pm instance.name no`. NEW loads the row 149 role files; REFUSED stops the window. |
| P2 | Sage | `console-check.sh $NEW` against a stub Console of NEW on a scratch port, as in the de352dfaf window. CONSOLE_PASS before the window is put to Jason. |
## The window, Jason present
| # | Who | Step |
|---|-----|------|
| W0 | Mos | `cd $REPO && scripts/stack-copy.sh copy 8e7ea89a1e86447d26ec335e4b138acfd5130cbc`. Note the full id it prints. Then P1 for NEW. |
| W1 | Jason, then Mos | PM-idle check. Jason: `mosaic agents --business mosaic-stack`; chief and pm not `working`. Mos: `mosaic launches list`. Nobody talks to chief or pm until W6 passes. Record `date -u +%FT%TZ` as the start stamp. |
| W2 | Mos, on Mos's go, Jason present | `scripts/stack-release.sh adopt mosaic-stack`. Exit 0 and one line, `adopted 52f35e7a0933e9fa845f59860a5de1709f9e5756 for mosaic-stack (pm 1, schema 3f)`. Any refusal (`already-adopted`, `check-failed`, `no-claude-pin`, `copy-schema-unknown`) ends the window. A refusal writes no pointer, only one `refused` log line. |
| W2b | Mos | `scripts/stack-release.sh status mosaic-stack` and show its pointer block. It must show copy `52f35e7a0933e9fa845f59860a5de1709f9e5756`, `pm` true, `claude` `/home/jwoltje/.local/bin/claude`, schema `3f`, and the Console flags `--port 7332 --public-host mosaic.woltje.com --auth-header X-authentik-username --allow-user jason.woltje --send` (the flags `repin-de352dfaf.md` step 6 lists). A copy other than 52f35e7a0 or a schema other than 3f stops the window before W3; undo W2 as below. Any other difference goes to Mos before W3. |
| W3 | Mos | `scripts/stack-release.sh activate 8e7ea89a1e86447d26ec335e4b138acfd5130cbc mosaic-stack --plan`. `--plan` writes nothing, not even a log line. It must match Darkwing's scratch rerun (`agents/darkwing/work/queue-162/scratch-plan-8e7ea89a1.txt`) on these lines: `from: 52f35e7a0933e9fa845f59860a5de1709f9e5756`, `to: 8e7ea89a1e86447d26ec335e4b138acfd5130cbc`, `store schema: 3f (read from the store the running bus holds)`, `target schema: 3h`, `migration steps: 3f to 3g, 3g to 3h`, `needs: --migrate`, `needs: Jason present for this run`, `commits: the run adds 92`. The scratch rerun's store schema line says `(from the pointer; there is no store file)`, because the scratch root had no store; that wording is the one expected difference, and the value must still be 3f. The bus, Console and CLI lines carry W2b's flags; beyond those, only copy paths differ from the scratch plan. Any other difference stops the window before W5 and goes to Mos. |
| W4 | Mos | Drop-ins: `systemctl --user show [email protected] -p DropInPaths`. A drop-in that sets ExecStart or WorkingDirectory makes activate refuse `drop-in-override` before it stops anything; Mos removes it per TOOLS.md step 4 or ends the window. |
| W5 | Mos, on Mos's go, Jason present | `scripts/stack-release.sh activate 8e7ea89a1e86447d26ec335e4b138acfd5130cbc mosaic-stack --pm --migrate`. Exit 0 and a final log line `result` `ok`. Record the activation id and the backup path it prints. Exit 1 means the gate failed and the run rolled back to OLD; exit 2 means the rollback failed too, and the stack is stopped: see Stop conditions. |
| W6 | Mos | The checks below. |
| W7 | Mos, then Jason | Smoke and the browser check below. |
What W5's gate already covers: both units active, a live bus host for this
start whose pid is the bus unit's MainPID with boot ok (so the store opened
at 3h under NEW), Console `/healthz`, `stack-copy.sh check` on NEW for bus,
Console and CLI, and exactly one `launched` journal line for this start.
### W6 checks, where the gate doesn't reach
```
scripts/stack-release.sh status mosaic-stack # pointer on 8e7ea89a1, schema 3h, last line ok
bash $P/console-check.sh $NEW # row 148: CONSOLE_PASS
mosaic names --business mosaic-stack --json # row 141: []
mosaic usage --business mosaic-stack --json # row 124: exit 0
mosaic project list --json # row 128: exit 0
mosaic threads --project stack --json # row 128: exit 0
mosaic launches list # one running chief from this start
```
All of these read. None writes to the store. `mosaic names` printing
anything but `[]` means a name row exists that nobody should have written;
stop and report. Rows 143 and 149 have no read to check beyond P1's load
and the launch: 143 acts only on a Save, and 149's roles have no instance.
### W7, smoke and the browser check
```
mosaic talk chief "[mos test] re-pin 8e7ea89a1: reply with one line, no staffing request" --tester
mosaic talk pm "[mos test] re-pin 8e7ea89a1: reply with one line, no staffing request" --tester
```
Every `talk` starts with `[mos test]` and runs with `--tester`. Jason's
browser check, signed in at `https://mosaic.woltje.com`: `#/docs` lists the
files and `spec/north-star.md` opens with its preview and a Save button;
Settings shows the Token usage section. **Nobody presses Save.** A save
commits to Jason's project repo and, with row 143, sends review notices to
pm and cto. That is row 143's smoke, a separate go.
Not done in the window: `mosaic name` (Jason's live write, after the
window, mos-0641), any thread create, the row 143, 139 and 137 smokes, and
row 129 and 164's activate.
## Stop conditions
Before W5, any refusal or mismatch ends the window with nothing stopped.
If W2 wrote the pointer, undo it as below.
### Undoing W2
The undo for `adopt` is removing the pointer it wrote,
`/home/jwoltje/.mosaic-dev/state/stack-active.json`, and nothing else
(mos-0815). The units, the copies and the store were never touched. The
adopt line in `state/stack-activation-log.jsonl` stays: the log is
append-only. A later `adopt` works again, because it refuses only when the
pointer file exists.
With no pointer:
- `activate` and `rollback` refuse `no-pointer` ("run adopt first") with
exit 3 before they check or stop anything. Without `--plan` that refusal
appends one `refused` log line; with `--plan` it writes nothing.
- `status` prints `pointer: … none`, the last five log lines and a
`stack-copy.sh check` result, and reads no bus status.
Between W2 and W5, with the pointer in place, `rollback mosaic-stack`
refuses `no-previous`: the log's only ok line names 52f35e7a0, the
pointer's own copy, so there is no earlier copy to go back to.
From W5 on:
- Exit 1: the gate failed and the run rolled back inside itself. It put
back the units and wrapper, restored the backup, kept the attempted
store as `bus.post-attempt-<stamp>` and started OLD. Report the log line
and the failing check to Mos. Nothing is retried.
- Exit 2, `rollback-failed`: both units stay stopped. Jason or Mos settles
it from the rollback set the message names. Nobody opens the backup or
the post-attempt directory to look.
- W6 or W7 failure after an exit 0: a finding for Mos, who decides between
a fix forward and `rollback mosaic-stack`. That rollback needs
`--restore <activation id>`, because OLD is 3f and the store is 3h. It
prints the bus events written after the backup; above zero, it needs
`--events N`, and Jason decides first. Run `rollback mosaic-stack --plan`
first. `console-check.sh` FAIL alone is not an automatic rollback.
## Rollback copies
Keep 3190ad762 and 52f35e7a0. Don't touch 66ea40580. The script prunes
nothing: the rollback set under `state/stack-rollback/<activation>/`, the
backup under `backups/stack/<activation>/` and any post-attempt store stay.
## What Sage ran for this plan
- `git rev-list --count 52f35e7a0..8e7ea89a1` = 92, and the path-limited
log above, which lists the six commits, each once. 850484a7d and
008746b6e are not in the range.
- Read Darkwing's scratch `--plan` for 8e7ea89a1 (sha256
99ff5d5480d0…6f77) and its live reads. Nothing live was read for this
plan.
- Read row 162's r1 `build.patch` for `do_adopt`, `refuse`,
`read_pointer`, `pointer_for_business`, `do_activate`, `do_rollback`,
`do_status` and `from_log`, for the adopt, no-pointer and undo lines
above. The 20:24Z unit reads are Mos's (mos-0815), not mine.
@@ -1,5 +1,7 @@
# Re-pin for rows 148 and 141, with the bus 3f to 3g migration
Superseded 2026-10-18 by `repin-8e7ea89a1.md` (mos-0814): this window never ran. The rest stays as the record.
Sage, 2026-10-16. One shared window for rows 148 and 141, per mos-0638.
Mos runs every step, with Jason present (A4). Sage ran none of the window
steps. P1 and P2 are done; the controls and fixture tests Sage ran are listed