deferred: N7 lane image base inspect; brief for two gate environment rows (mos-1162)

N7: lane-image.mjs:41 inspects a base BuildKit never tagged (row 197 proof try 1).
Brief: the process.test.mjs mode chmod row and the fixture PI_AUTH_FILE row, both after row 197.

docs/plans/2026-10-21_gate-env-rows.md

@@ -0,0 +1,35 @@
+# Gate environment rows (2026-10-21)
+
+Sage, from the row 197 lane proof that stopped on 2026-10-21 (sage-1881, mos-1162). Two small rows.
+Each lands after row 197.
+
+## The startup token refusal test sets its file mode
+
+`packages/bus/tests/process.test.mjs:76` writes the "too open" token file with
+`writeFileSync(file, secret, { mode: 0o644 })`, and `:82` expects the broker to refuse it.
+`writeFileSync` applies the process umask to that mode. Under `umask 077` the file is 0600,
+`packages/bus/src/credentials.mjs:205` accepts it, and the test fails. That happened in the row 197 lane
+proof, where `scripts/testing/gate-lane.sh:3` set 077 for the test steps.
+
+- Change: the test calls `chmodSync(file, 0o644)` after the write, so its result no longer depends on the
+  umask.
+- Sweep: look in `packages/*/tests` for other tests that expect a refusal of a too-open mode set
+  through `writeFileSync` or `mkdirSync`, and fix those the same way. List what the sweep found in
+  BUILD.md, including when it found none.
+- Test: run the file whole twice, once under `umask 022` and once under `umask 077`. Both runs pass.
+- Order: Mos ruled (mos-1162) that this lands after row 197 r6. Then r6's proof runs on the unchanged
+  test, so it shows the umask fix itself works.
+
+## Gate runs use a fixture pi auth file
+
+The `docs/plans/DEFERRED.md` entry "Gate runs mount the host's pi auth file" (059577886, Webby N4 on the
+row 197 proof driver, traced by Herb in herb-0051) gets its own row here.
+
+- Change: every gate step that reaches Compose gets a fixture `PI_AUTH_FILE`. That covers the
+  `test-task.sh` cases that call `scripts/run-task.sh`, `test-release.sh` through `release.sh`
+  `health_check`, and row 197's lane `cleanEnv` in `scripts/testing/gate-lane.mjs`. Either the suites
+  or the lane's `cleanEnv` can set it.
+- Test: no gate step mounts the host default `/home/jwoltje/.pi/agent/auth.json`. The test reads
+  the Compose arguments or the environment that each step passes. It does not read the host file.
+- Not in scope: `compose.yaml`'s default for real runs stays as it is.
+- At landing, the DEFERRED entry moves to Done with the landing commit.

docs/plans/DEFERRED.md

@@ -284,6 +284,22 @@ at every gate. Started 2026-09-12 during the control board MVP.
   the lane's `cleanEnv`, and a test that no gate step mounts the host
   default. It needs its own row. Webby N4 on the row 197 proof driver
   (bba870ee9), traced by Herb (herb-0051). (2026-10-21)
+- **Lane image prep inspects a base that BuildKit never tagged.**
+  (N7 of the row 197 proof.) After the Compose build,
+  `scripts/testing/lane-image.mjs:41` (`prepareImage`) runs
+  `docker image inspect node:24-bookworm-slim` to put the base digest
+  in the receipt. BuildKit resolves the base from the registry
+  without tagging it in the local store, so on a host without the tag
+  the inspect throws "No such image" after a good build. That
+  happened in Sage's proof try 1 (2026-10-21 09:03Z, run cf48efccf083).
+  The throw fails closed: the run's terminal record is unclean, both
+  lanes quarantine, and `gate-lane.sh recover` clears them. Pulling the
+  base first fixes it, and the receipt digest then matches what the
+  build used (91acba91 both ways). The fix: before the build, inspect
+  the base and refuse with a named reason if it's missing, or pull it.
+  After the build, refuse if the base digest changed. Add a test with a
+  fake Docker that has no base tag. Kept out of row 197 r6 by Sage
+  (sage-1883). Mos asked for this record in mos-1162. (2026-10-21)
 
 ## Queue