feat(harness): meta-harness and PM launching off T3 (#1523, row 41)

Slice 1 S6. packages/harness runs a role session under the pi or claude
adapter behind a tool gate, and packages/seat holds the session and its
process. The bus host gains a launch socket: `mosaic bus start
<business> --pm <harness>:<model>` runs the PM without a window, the PM
launches role sessions through the broker within the business file's
`launch.max`, and every launch, refusal and end is a launch-log line and
a broker event. `mosaic talk`, `mosaic launches off|on|list` and
`mosaic stop <run>` are new CLI verbs. packages/bus gains the IPC ops
identity, authorize, refuse, endLaunch and credentialStatus, plus
Broker.endLaunch (decision 77); no socket verb, event kind or schema
changed. The session environment is an allowlist, and the runner exits
before claiming if a founder credential reaches it.

Filbert built it (agents/filbert/work/s6). Darkwing reviewed on #1523:
round 1 changes (26991/26995), round 2 changes (27004/27010), round 3
changes (27012/27032), round 4 approve (27033/27034) on manifest
08a78972, 42 paths.

Sage's gate on 64b0f9f1 (12:32Z), sequential and teed: node suites
business 60, bus 74, cli 83, control-board 124, conversation 182,
discord 178, harness 56, ledger 78, mosaic 69, queue 149, runs 41,
seat 27, tasks 51, webui 39, every one 0 failed; test-auth 15,
test-conductor 17, test-config 24, test-discord 66,
test-extension-package 18, test-foundation 44, test-queue 27,
test-release 14, test-task 98 and 26 without Docker, all 0 failed.
64b0f9f1..ee7f909b touches none of the 42 paths. It landed after the
Q14 hold ended at 2026-10-11T17:19:23.857Z. The recorded PM-to-coder
run on a scratch data root is still owed before row 41 moves to done.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

docs/TOOLS.md

@@ -196,7 +196,11 @@ config problem · `4` usage or a required file missing. Details:
 scripts/mosaic inbox | tasks | agents [--business <id>] [--json]
 scripts/mosaic decide <decision> <option> [--note <text>] [--yes]
 scripts/mosaic trail <task|decision> [--json]
-scripts/mosaic bus start <business> | stop | status [--json]
+scripts/mosaic bus start <business> [--pm] | stop | status [--json]
+scripts/mosaic talk <role> <text> [--wait SECONDS] [--business <id>]
+scripts/mosaic stop <run>
+scripts/mosaic launches off | on [--business <id>]
+scripts/mosaic launches list [--json]
 scripts/bus-service.sh render | install [--dir DIR] [--no-reload] | uninstall | status <business>
 ```
 
@@ -209,6 +213,19 @@ directory must be 0700: it also holds the notifier's journal `sent.jsonl`
 (0600, never a symlink). On open the notifier copies a torn final line to
 `torn-<UTC stamp>.bin` and truncates the journal to its last newline; a
 malformed complete line refuses with exit 3.
+
+`bus start` also serves the session launcher (slice 1 S6): a PM session's
+`launch` tool starts role sessions through it, each a runner under its own
+PID namespace with a generated bundle, and `--pm` launches the business's
+`launch.by` instance at start. A host that starts ends the launches a
+crashed host left as `host-lost` and refuses with exit 3 on a
+`sessions.json` it can't read. `talk` sends a REQUEST and prints what
+arrives until the reply (polls every 2 s, `--wait` default 900; `0` only
+sends). `stop` sends SIGTERM to a run's runner after checking it in
+`sessions.json`. `launches off|on` revokes and restores `role.launch` for
+the business; running sessions keep running. `launches list` reads
+`sessions.json` and needs no broker. `talk`, `stop` and `launches off|on`
+refuse inside an agent run.
 Exit codes: `0` ok · `1` failed or outcome unknown · `2` invalid input ·
 `3` refused or config problem · `4` usage. Details: `packages/cli/README.md`.