stack-release: the sso-config first step carries --instance NAME on a named instance (row 238, #1744 )

sage: row 42 S7 dates in the run log (sage-1622, mos-1148 C1 C2, Vikunja 442), 10-24 window draft 0 (mos-1145; NEW open), Vikunja scripts and records: 412/424 landing comments, 237 follow-ups 440/441, P19 405-408 and 411 re-plan comments 416-420, read-tasks.mjs (#1524 )
case2: unit render and host precheck, case2-unit.sh and case2-precheck.sh (row 230, #1732 )
2026-10-20 20:19:35 -05:00 · 2026-10-20 20:06:39 -05:00 · 2026-10-20 19:36:22 -05:00 · 2026-10-20 19:29:22 -05:00
27 changed files with 2420 additions and 1902 deletions
@@ -1,256 +0,0 @@
-# Row 232 (I1): stack-release external units and bundle copies
-
-Brief: `docs/plans/2026-10-20_installer-rows.md` section I1, blob `f35e7e57daee` (commit ad6f0be7a). Gitea
-#1734, Vikunja P19 #432. Owner Darkwing, reviewer Filbert, gate owner Sage. Design input: row 195 DESIGN r6,
-`agents/darkwing/work/queue-195/DESIGN.md` at b7239bb66 (approved in duckworth-0055). Where the brief and
-r6 differ, the brief wins. sage-1561 ruled where the stack user's `stack-release.sh` runs: from its own
-clone of the release bundle, so `check_target`, the plan's commit list and status drift are unchanged and
-nothing adds `safe.directory`.
-
-## Files
-
-Base: cb5fdb064 (row 199's landing, on top of row 200's 9e1085816). Branch `darkwing/row232-r1`. The first
-build, 0af0c73c6 on `darkwing/row232`, sat on 00d4cc1f6 (row 190); row 200 landed first, so this one is
-rebased onto it (see D9 and D10).
-
- `scripts/stack-release.sh`: `--units user|external`, the `sc` and `jctl` backend, `confirm`, `revert`,
-  `gate --since`, `rollback --to`, `--plan --expect-from`, the external gate (start floor, PM check from
-  `launches list`), `external-pm`, and the `awaiting units:` status line.
- `scripts/stack-copy.sh`: `check --units external`, `copy --bundle FILE SHA`, `wrapper ID --create`.
- `packages/cli/tests/stack-release-external.test.mjs` (new, 25 tests).
- `packages/cli/tests/stack-release-fixture.mjs` (new): the helpers `stack-release.test.mjs` defined, moved
-  so both files share them. See deviation D1.
- `packages/cli/tests/stack-release.test.mjs`: the helpers leave and one import line comes in. The 74 tests
-  have the same names and the same bodies as on the base.
- `packages/cli/tests/stack-copy.test.mjs`: three new `row 232:` tests and a wider `node:fs` import.
- `docs/TOOLS.md`: the stack-copy usage block and three paragraphs, the stack-release usage block, and a new
-  subsection "Root-owned units (`--units external`, row 232)".
- `packages/cli/README.md`: one paragraph.
- This file.
-
-The worktree's `node_modules` symlink is not part of the candidate.
-
-## User mode is unchanged
-
-Every `systemctl` call goes through `sc` and every `journalctl` call through `jctl`. Under `user` they
-are `systemctl --user "$@"` and `journalctl --user "$@"`. Under `external`, `sc` allows only `show`,
-`is-active` and `list-units`, and `jctl` returns 1, so an external run can't start, stop, install or read
-the journal even through a path the tests miss.
-
-Two tests hold the brief's "every command line and every byte of output":
-
- `user mode: every systemctl call carries --user, and activate, rollback and check make the base's
-  calls`. A fixture repo gets the base's two scripts from `git show cb5fdb064:`. The same activate,
-  rollback and `stack-copy.sh check` run from both trees, and the recorded argv (with the fixture root and
-  port replaced by placeholders) must match line for line. Every call carries `--user`.
- `user mode: a default activate --plan prints the base's bytes`, for four plans.
-
-The base output is produced live from the base blobs, not stored as a fixture file. See deviation D3.
-
-## r6 section 7, test by test
-
-All in `stack-release-external.test.mjs` unless named.
-
-| r6 :742-812 item | Test |
-|---|---|
-| `units-running` (N4), store, log and TAKEN left | `units-running (N4) refuses while a unit is active...`; also checks that `failed` counts as down and that the Console is checked first |
-| activate leaves the pointer, writes `AWAITING-UNITS` and a backup | `activate stages: ...`, which also checks the set's file list, `UNITS.sha256`, no `--user`, no journal call and `status` |
-| `open-activation` with zero, two, the wrong copy, one not open | `confirm and revert refuse open-activation ...` |
-| `confirm` polls: 3 s fails at `--timeout 1`, passes at `--timeout 10` | `confirm polls: bus status good after 3 s fails ...` and `confirm polls to a pass ...` |
-| `stale-start` floor with `started` at .900 | `stale-start: @1792540799 fails ...` and `stale-start is a gate code ...` |
-| `confirm` pass writes pointer, ok, removes marker; timeout writes `FAILED` and exits 1 | the two polling tests |
-| `activation-failed` when `FAILED` exists | `confirm polls: ... FAILED then refuses activation-failed` |
-| lines carry the started op, from, to, activation and backup | `sameAsStarted` in every confirm test, and sequence 7 |
-| `gate` (N2) with and without `--since` | `gate (N2, A2f): ...` and the usage test |
-| `--plan --expect-from` (N5), activate and `rollback --to` | sequence 7 |
-| A3 order: capture-failed, marker-failed, wrapper failure after migrate | `A3 order: ...` and sequence 2 |
-| refusals log no activation; `interrupted` unchanged | `open-activation` test and sequence 5 |
-| PM check: one, none, two, early, not live, other business, other instance; no journal call | `the external PM check reads launches list ...` (modes '', coder, none, twolive, early, dead, other) and `journalCalls` in every external test |
-| `external-pm` | `pm-on and activate --pm-after-harness refuse external-pm` |
-| `revert` restores TAKEN only after a migration | `revert puts the wrapper back and leaves the store ...` and sequences 2 and 8 |
-| `confirm --rollback` per cause, `unrecorded`, `rollback-failed`, mismatch | sequences 1, 2, 3, 5 and 8, and `confirm --rollback refuses rollback-mismatch, and logs rollback-failed ...` |
-| sequences 1-8 | `sequence 1:` to `sequence 8:`, each ending with the `closed` check (one started and one result line, empty `interrupted`, no marker or `FAILED`, a following `--plan` that doesn't refuse `interrupted-run`) |
-| `rollback --to` refuses not-previous; `rollback --restore` finds an external backup | sequence 7, and `confirm --rollback after a --restore swap ...` |
-| `gate` writes nothing | the `gate (N2, A2f)` test and sequence 4 compare the log, the pointer and the state tree |
-| `confirm`, `revert`, `gate`, `--to` refuse without `--units external` | `confirm, revert, gate, --to and --expect-from need --units external ...` |
-| default path: every call carries `--user`; default `--plan` bytes | the two user-mode tests above |
-
-The brief's additions, in `stack-copy.test.mjs`:
-
- `row 232: copy --bundle copies a SHA the bundle's refactor reaches, byte-identical to copy SHA, and
-  refuses the rest`: a short SHA, a missing file, a symlink, a bundle that fails `git bundle verify`, a
-  bundle with no `refs/heads/refactor`, a SHA not in the bundle, and a SHA the bundle carries on another
-  branch that refactor doesn't reach. The bundle copy's tree matches `copy SHA`'s byte for byte, and the
-  `release:` and `bundle sha256:` lines are checked.
- `row 232: wrapper --create writes the first wrapper only, the same bytes wrapper ID writes, and refuses
-  over any file`, a symlink included. Without `--create` a missing wrapper still refuses.
- `row 232: check --units external reads the system units, the default reads the user units`.
-
-## Mutants
-
-`mutants.sh` in my scratch (not committed, it edits the worktree), 17 mutants: r6's re-pin list (:817-838)
-minus the three `case1-repin.sh` ones, plus the brief's two. Each one applies exact replacements after a
-checked backup, runs `bash -n`, runs its named killers, restores the file and checks its sha256. Two
-controls run first with no change: the whole external file, and stack-copy's `row 232:` tests.
-
-| Mutant | Killers |
-|---|---|
-| m01 `confirm` writes the pointer on a gate failure | `confirm polls: bus status` |
-| m02 `gate_once` in place of `gate` | `confirm polls to a pass`, `stale-start is a gate code` |
-| m03 PM check counts any instance | `external PM check` |
-| m04 PM check drops the `startedAt` bound | `external PM check` |
-| m05 `confirm` takes the newest `AWAITING-UNITS` | `open-activation` |
-| m06 `rollback --to` skips the comparison | `sequence 7:` |
-| m07 the default path drops `--user` from one call (`is-active`) | `user mode: every systemctl` |
-| m08 the timeout writes r4's interim `rollback pending` line | `confirm polls: bus status`, `sequence 1:`, `sequence 5:` |
-| m09 `AWAITING-UNITS` last, after the wrapper | `sequence 2:` |
-| m10 a refusal names the open activation | `sequence 5:`, `open-activation` |
-| m11 `stale-start` is a refusal | `stale-start is a gate code` |
-| m12 `revert` restores without `MIGRATING` | `revert puts the wrapper back` |
-| m13 `confirm` logs op `confirm` | `sequence 7:`, `confirm polls to a pass` |
-| m14 `MIGRATING` after the migration | `sequence 8:` |
-| m15 `gate` takes its floor from the log without `--since` | `gate (N2` |
-| m16 `copy --bundle` skips the reachability check | stack-copy `row 232:` |
-| m17 `wrapper --create` overwrites | stack-copy `row 232:` |
-
-## Deviations and choices
-
-D1. The shared helpers moved to a new file, `packages/cli/tests/stack-release-fixture.mjs`. The brief's
-files list names `stack-release.test.mjs` "where a shared helper moves" but not a destination. Importing
-from the other test file would run its 74 tests twice, so the helpers need a module of their own.
-
-D2. The fixture's T17 check (what a run may never remove) now exempts a rollback set's `AWAITING-UNITS` and
-`FAILED`. `confirm` removes both when it closes the activation (r6 A5 and R4). User mode writes neither, so
-user-mode runs check exactly what they did.
-
-D3. The user-mode argv and `--plan` tests read the base's scripts with `git show cb5fdb064:` rather than
-storing their output as a fixture file. A later row that changes user-mode output on purpose moves the
-`BASE` constant in the test to its own base, or the test fails. I chose this over a stored fixture because
-a stored copy can drift from the base without anyone noticing.
-
-D4. `marker-failed` is reached by making `state/stack-rollback` unwritable. r6 says "an existing `$RS`", but
-`next_activation` never picks a taken name, so no test can make the run meet an existing `$RS`. The
-exclusive `mkdir` is still what refuses.
-
-D5. The stale-start polling case turns the enter time to `@1792540800`, not r6's `@1792540805`, with the
-started line at 1792540800.900. That also checks that the floor is the whole second, so .900 doesn't push it
-to 1792540801.
-
-D6. No fake `sudo` or `case2-unit.sh`. r6's sequences ran under them because r6 had `case1-repin.sh` drive
-the steps, and that script is I3's. Here the test plays root: it stops and starts the fake system units and
-installs with the existing `bus-service.sh` and `webui-service.sh` stand-ins, between the real
-`stack-release.sh` calls, on one log.
-
-D7. The fake marker in the `open-activation` test is named `20000101T000000Z-<C1 prefix>` so it sorts
-before the real one. A marker that sorted after it would leave m05 (newest marker) alive.
-
-D8. m10 sets `ACT` inside `open_activation`, where r6's wording ("ACT set before the checks") lands in this
-code. `ACT` is set only after every check in `confirm`.
-
-D9. Row 200's `--sso` is a usage error under `--units external`, with the proof flags, `--no-proof` and
-`--no-send`. It is a Console flag, and root's Console unit carries the Console flags; the script under
-external renders no Console line and never calls `console_for_target`, so `sso_checks` doesn't run there
-either. The usage text, the TOOLS.md bullet and the external usage test name it.
-
-D10. Row 200's `config_checks` runs under `--units external` too, after `plugin_checks`, in both the
-`--plan` and run paths of `activate` and `rollback --to`. It checks the target's loader against the stack
-user's `config.json`, which the bus on a VM still reads, so a `console` key the target refuses would break
-root's bus start the same way. The cost is one more refusal (`config-console-key`) an external run can
-print; I took it over a bus that fails after root's start. The rebase changed no user-mode line: the
-conflicts were the `SSO=0` globals line, the `plan` body (row 200's `SSO_PLAN` line sits in the user
-branch) and the two `--plan` lines that gained `config_checks`. In the tests, row 200's fixture lines
-(the loaders, `sso-config.mjs` and the `--sso` cli.mjs line for C1 and C) moved into
-`stack-release-fixture.mjs` with the rest of the copy setup, and the `ALGS` import stays in
-`stack-release.test.mjs`, which T57 uses.
-
-## duckworth-0055's notes on r6 (brief line 169)
-
-Duckworth's r6 approval (REVIEW-r5.md at 23f5520b5) carried two notes.
-
- N1, A2's stop timeout under `gate --since`. A unit that never stopped keeps its old `ActiveEnterTimestamp`,
-  so `gate --since` fails it with `stale-start`, and the run ends at exit 2 with root stopping the units.
-  That is intended: a unit that won't stop is a fair reason to stop. In I1 this is the gate code and its
-  polling (`stale-start: @1792540799 fails ...`, `gate (N2, A2f)`, m11). The run sheet's A2f line and the
-  re-pin test that points "exits 1 with OLD's gate passing" at an A3 exit 3 belong to I3, which owns
-  `scripts/stack-upgrade.sh` and `docs/guides/host-run-sheet.md`. I'll name both in the I3 build.
- N2, the claude path under `/opt/mosaic-stack` (gosalyn-0058, sage-1522). I1 doesn't touch it. Under
-  `--units external` the script checks no claude pin of its own (`no-claude-pin` applies only to user
-  mode), because root's unit carries it. The `--claude` value, the managed-settings reasoning, F6 and the
-  run sheet's claude step go to I2 and I3.
-
-## Run environment
-
-Worktree `/mnt/storage/scratch/darkwing-r232`, `TMPDIR=/mnt/storage/scratch/tmp/r232`, node from PATH.
-One external file run takes about 94 s.
-
-## Results
-
-Singles on the rebased candidate, before the gate:
-
-| File | Tests | Pass | Fail |
-|---|---|---|---|
-| `packages/cli/tests/stack-release-external.test.mjs` | 25 | 25 | 0 |
-| `packages/cli/tests/stack-copy.test.mjs` | 16 | 16 | 0 |
-| `packages/cli/tests/stack-release.test.mjs` (row 200's T57 included) | 192 | 192 | 0 |
-| `packages/cli/tests/stack-instances.test.mjs` | 23 | 23 | 0 |
-| `packages/webui/tests/pinned-copy.test.mjs` | 10 | 10 | 0 |
-| `packages/cli/tests/channel-recovery.test.mjs` (imports `channel-fixture.mjs`, which names the scripts) | 1 | 1 | 0 |
-| `packages/cli/tests/host.test.mjs` (reads `packages/cli/README.md`) | 42 | 42 | 0 |
-
-These are every test file that reads `stack-release.sh` or `stack-copy.sh` (a grep of `packages/*/tests` and
-`scripts/`). None of them pins a sha256 of a changed file. `packages/cli/tests/host.test.mjs` reads
-`packages/cli/README.md` for a unit file name; this row only adds a paragraph there. The grep and the runs
-were repeated on the rebased tree on 2026-10-21; the reader set is the same. A dry run of `mutants.sh`
-matches each of the 17 replacements once on the rebased scripts.
-
-### Gate, 2026-10-21, Sage's slot (sage-1618)
-
-Candidate a0ffabc3f on `darkwing/row232-r1`, run by `~/darkwing-scratch/r232/gate.sh`: the cli suite, then
-every `scripts/test-*.sh`, one after another, stopping at the first failure. busy.sh passed at 01:07:49Z
-after Launchpad's single `stack-release.test.mjs` run ended. The gate stopped at the first one, so the
-chain waited for that PID to exit and checked again. The EXIT trap removed the compose network; no
-container was left.
-
-| Step | Time (UTC) | Result |
-|---|---|---|
-| `packages/cli`, `node --test tests/*.test.mjs` | 01:07:50 to 01:17:53 | 561 pass, 0 fail, 0 skipped |
-| `scripts/test-auth.sh` | 01:17:53 to 01:17:54 | 15 passed, 0 failed |
-| `scripts/test-conductor.sh` | 01:17:54 to 01:18:00 | 17 passed, 0 failed |
-| `scripts/test-config.sh` | 01:18:00 to 01:18:02 | 31 passed, 0 failed |
-| `scripts/test-discord.sh` | 01:18:02 to 01:18:12 | 78 passed, 0 failed |
-| `scripts/test-extension-package.sh` | 01:18:12 to 01:18:13 | 18 passed, 0 failed |
-| `scripts/test-foundation.sh` | 01:18:13 to 01:19:01 | 44 passed, 0 failed |
-| `scripts/test-land-work.sh` | 01:19:01 to 01:19:14 | 86 passed, 0 failed |
-| `scripts/test-queue.sh` | 01:19:14 to 01:19:37 | 156 node tests pass, queue suite 28 passed, 0 failed |
-| `scripts/test-release.sh` | 01:19:37 to 01:19:51 | 14 passed, 0 failed |
-| `scripts/test-task.sh` | 01:19:51 to 01:20:44 | 98 passed, 0 failed |
-
-### Mutants, 2026-10-21, same slot
-
-`~/darkwing-scratch/r232/mutants.sh`, right after the gate. Both controls (the external file whole, and
-stack-copy's `^row 232: ` tests) exited 0 on the unmutated tree. Each mutant was applied after a checked
-backup and a syntax check, ran its killers from the table above, and was put back with its sha256
-checked. The script stops on any restore mismatch, and it ran to its end.
-
-| Mutant | Killer exit | Result |
-|---|---|---|
-| m01 pointer on gate failure | 1 | killed |
-| m02 gate once | 1 | killed |
-| m03 PM from any instance | 1 | killed |
-| m04 no startedAt check | 1 | killed |
-| m05 newest marker | 1 | killed |
-| m06 --to not compared | 1 | killed |
-| m07 one call without --user | 1 | killed |
-| m08 interim pending line | 1 | killed |
-| m09 marker written last | 1 | killed |
-| m10 refusal names the open activation | 1 | killed |
-| m11 stale-start refuses | 1 | killed |
-| m12 revert always restores | 1 | killed |
-| m13 confirm op | 1 | killed |
-| m14 MIGRATING after migrate | 1 | killed |
-| m15 gate floor from the log | 1 | killed |
-| m16 bundle reachability unchecked | 1 | killed |
-| m17 --create overwrites | 1 | killed |
-
-17 of 17 killed, 01:22:16 to 01:24:32Z. I read the logs for m01 and m09, two of the quick kills: each failed on
-its named test's assertion (m09 on `AWAITING-UNITS` in sequence 2), not on a load error.
@@ -0,0 +1,104 @@
+# Row 230: C2-13a unit render and host precheck
+
+Gitea #1732. Vikunja #416 (track T2). Brief: docs/plans/2026-10-20_case2-rows.md, section "C2-13a",
+blob f6b4933f0f47 (01b40d357, sage-1562). Base: 00d4cc1f6 (row 190). Reviewer: Webby. Gate: the cli
+suite plus every scripts/test-*.sh.
+
+## What ships
+
+`scripts/case2-unit.sh` renders `[email protected]` and `mosaic-webui.service` from the two existing
+templates into the system unit directory, for the default instance only. It writes each unit through
+a temp file at mode 0644, runs `daemon-reload`, enables both units, starts the bus and then the
+Console. If the bus fails to start, the script refuses and leaves the Console unstarted. Both units
+get `WantedBy=multi-user.target`, and neither gets `After=` or `Wants=`. The script never links a unit
+file into place. A re-install refuses unless each installed unit passes the same checks, both units
+name one copy, and each equals the render apart from the copy id.
+
+`--profile library` (the default) refuses `--pm`, `--claude`, `--tester-port` and `--sso`, and needs
+the preview proxy flags plus the proof pair. `--profile factory` refuses the six proxy flags and takes
+`--pm` and `--claude`. Both refuse `--checkout` and `--board`.
+
+`scripts/case2-precheck.sh --business ID [--profile factory|library]` runs as `<user>`. It prints one
+`ok` or `REFUSED` line per check and exits 1 if any check refused. It prints variable names only,
+never values.
+
+`packages/cli/README.md:713` now says nothing creates the session env file, only the Case 2 precheck
+reads it, and the precheck prints only variable names (webby-0034 N2, webby-0035).
+
+## Deviations for review
+
+Sage accepted all six for the build (sage-1570). Webby rules on each.
+
+1. The precheck takes `--business ID`. The brief names no other way to find the business file.
+2. A run root `<dataRoot>/launches/<business>` that doesn't exist passes, with a note that the first
+   launch creates it at 0700 (session.mjs:47 and newRun). A symlink refuses, and so does an existing
+   entry that isn't a 0700 directory.
+3. The claude marker check passes when the reply holds the marker and input plus cache tokens are at
+   most 2000. **The 2000 ceiling is unmeasured.** The tests use fakes at 40 and 9000 tokens. Measuring
+   it on a real claude belongs to row 195's install run, not this row.
+4. A non-root test can't create a root-owned proof file. For the "proof not owned by the user" case,
+   the fake getent reports another uid for the user, so the user's own file reads as someone else's.
+5. The unit script refuses `%h` left in any unit, rendered or installed. A system unit expands `%h`
+   to root's home. The render replaces every `%h`, so the test edits an installed unit to reach it.
+6. With `--auth-header X-Authentik-Uid`, the allowed user must be 64 lower-case hex characters (lead
+   decision 101). The test covers both the refusal and the pass.
+
+## Tests (packages/cli/tests/case2-unit.test.mjs, 30 cases after round 2)
+
+The tests use a scratch unit directory and a scratch home, plus fake systemctl, getent, sudo, id,
+node, bwrap and claude. They never touch /etc/systemd, ~/.mosaic-dev, ~/.config/mosaic-dev or a
+live unit. Every precheck case asserts its output doesn't hold the fixture key.
+
+- Unit: the clean library render, PATH for a node outside the default list and for /usr/bin/node, the
+  systemctl order, a failed bus start, no `systemctl link`, factory `--pm` and `--claude` rendered and
+  absent, re-install to another copy, edits to an installed unit, template restrictions,
+  EnvironmentFile placement, unknown tokens, PermissionsStartOnly and `+`/`-+` Exec prefixes,
+  symlinked unit paths, bad `--node`, re-install drift, a split copy pair, bad copy ids, every library
+  and factory flag refusal, and bad `--claude`.
+- Precheck: a good host, node older than 24, more than one group, sudo succeeding, XDG_DATA_HOME,
+  HOME mismatch, a run root mode, a bad config, bwrap failing, the port floor at or below the Console
+  port, a missing Console unit, bus.tester per profile, profile-library-business, the claude check
+  (no route, replaces, appends, missing, the unit's MOSAIC_CLAUDE_BIN beating PATH), and the session
+  env file (missing, 0644, symlink, empty, emptied by a later line, quoted).
+- Bind (mos-1100): inside `binds()` plus `sandboxArgv()`, a bind on port 980 gets EACCES, and a bind
+  on a free port of 1024 or above succeeds. The test fails if the host's floor is at or below 980.
+
+## Verification
+
+Round 1 singles, run before the gate: case2-unit.test.mjs passes 28/28 with no skips, and host.test.mjs (it
+reads the cli README) passes 42/42. No test pins a hash of the README. No other test reads the two
+scripts.
+
+## Round 2 (webby-0046, sage-1589, sage-1590, sage-1591)
+
+Base: origin/refactor (rebased from 00d4cc1f6; the 15 commits between touch none of the five paths
+or the two unit templates). Branch gosalyn/c2-13a-r2.
+
+B1. The precheck now has a case for each refusal Webby named: the user missing from passwd (:77),
+a business file that is unparsable, missing or fails the schema (:137), a run root that is a symlink
+to a 0700 directory (:151), a Console ExecStart with no --port (:179), an unreadable port floor
+(:180), a claude reply without the marker (:223) and a claude reply that isn't JSON (:224). The fake
+claude gained `nomarker` and `text` kinds. The no-claude-code case and the missing-claude case share
+a PATH without `/usr/bin/claude` (`pathWithoutClaude`), so the no-claude-code case now shows a host
+with no claude passes.
+
+N1 (ruled in for this round). Before writing, `case2-unit.sh` asks `systemctl is-active` for both
+units. For each unit that was running, it prints that the unit is still on its old copy, never
+"started", and then that the bus and Console must restart together to reach the new copy. A unit
+that wasn't running gets "started ... on copy". A fresh install prints the round 1 line. The script
+still restarts nothing. The new test covers both units running and only the Console running.
+
+N4. The README line at :713 is rewrapped.
+
+Mutants, run in Sage's slot on a scratch worktree, one branch each: :77, :137, :151, :179, :180,
+:223, :224, a precheck that refuses with no claude on PATH (for the no-claude-code case), and an
+install that prints "started" for a running unit (sage-1591).
+
+## Carry items for row 195
+
+- N1's restart. Row 195 restarts the bus and Console together after a re-install over running
+  units, as the install line now asks.
+- N2. A system drop-in check like `bus-service.sh:122-145`, so a drop-in under
+  `[email protected]/` or `mosaic-webui.service.d/` can't change what the checked unit runs.
+- N3. The precheck finds claude on the shell PATH. The bus unit's `PATH=` is what a session uses
+  when `MOSAIC_CLAUDE_BIN` is unset, so the check should search that PATH.
@@ -0,0 +1,47 @@
+# Row 238: the sso-config hint names the instance (row 200 follow-up N1)
+
+Launchpad, 2026-10-21. Author Launchpad, reviewer Webby, gate owner Sage. Issue #1744. Brief "Brief: row 200
+follow-up N1, the sso-config hint names the instance" in `docs/plans/2026-10-20_stack-release-sso.md` (76134dfde),
+from Webby's row 200 round 3 note N1 (comment 29772), assigned in sage-1597.
+
+Base 011d41ba6 (`base.txt`), which has row 200's landing 9e1085816 below it. Built on 76134dfde, then rebased
+before the first push onto 011d41ba6, because row 199 (cb5fdb064) added 6 lines to `docs/TOOLS.md`; no
+conflict. Branch `launchpad/row238`.
+`candidate-manifest.sha256` lists the 3 changed paths; the packet files are not in it.
+
+No test touches `~/.mosaic-dev`, `~/.config/mosaic-dev`, `~/.mosaic`, a live unit or a live slot. The new
+subtest runs on row 190's `named()` scratch instance under the test's temp HOME.
+
+## Files
+
+| Path | Change |
+| --- | --- |
+| `scripts/stack-release.sh` | `sso_checks`: the N4 first step puts `${INSTANCE_FLAGS[*]}` after `activate $TO` in both commands. |
+| `packages/cli/tests/stack-release.test.mjs` | T57 subtest "row 238 (#1744)": the sso-config refusal and the `--plan` line on instance `alpha`. |
+| `docs/TOOLS.md` | The `sso-config` paragraph says both commands carry `--instance NAME` on a named instance. |
+
+## What it does
+
+On a named instance the hint now reads `activate ID --instance NAME without --sso first, then write
+console.sso, then run activate ID --instance NAME --sso`. `INSTANCE_FLAGS` is empty for the default instance,
+so `inst` is empty and the default text is unchanged byte for byte. T57's item 2 subtest still asserts the
+default text exactly. The flag goes right after `ID`, the same place the other entry points take it from
+`INSTANCE_FLAGS`. BUSINESS is not in the hint before or after this row.
+
+## Tests run (this tree)
+
+- `node --test tests/stack-release.test.mjs`, the whole file: 193/193 on 76134dfde
+  (`/mnt/storage/scratch/launchpad-r238/sr-whole.log`) and 193/193 again after the rebase onto 011d41ba6
+  (`sr-whole-2.log`), with the new subtest and T57's default-text check.
+- `tests/stack-instances.test.mjs`, whole: 23/23 (`si.log`). It names `stack-release` only in a comment.
+- A grep of `packages/*/tests/` and `scripts/test-*.sh` finds the hint text only in `stack-release.test.mjs`
+  (`:1951` default, `:2102` and `:2104` named) and no 64-hex pin on the 3 paths.
+- The cli suite, every `scripts/test-*.sh` and the mutant go to Sage's slot.
+
+## Mutants (`mutants.py`, run as `python3 mutants.py <tree> [N ...]`, against T57)
+
+| # | Mutant | Result |
+| --- | --- | --- |
+| 1 | the first step drops `--instance NAME` (`inst=""`) | not run, Sage's slot |
+
+The pattern matches once on this tree.
@@ -0,0 +1 @@
+011d41ba6a703be3c6c8d70996aa780223aa3b00
@@ -0,0 +1,3 @@
+868dcf320abcd745aad33a15a3d2ae212902b4dd4f763f8d8fd23cca46c9da74  docs/TOOLS.md
+b169c6c0a8e6fe947669d3f4e161ff200d596fb0a7706ee4d3f81cd742e542ca  packages/cli/tests/stack-release.test.mjs
+8b0193de39ac13c38e5c0e3e96df6d2204acb80c214f5c6d2eb240ae7bd3c33c  scripts/stack-release.sh
@@ -0,0 +1,37 @@
+# Row 238 (#1744) mutant: `python3 mutants.py <tree> [N ...]`. Each applies to the tree's scripts/stack-release.sh,
+# runs T57 in packages/cli/tests/stack-release.test.mjs and restores the file from a saved copy, checked by sha256.
+# Killed = test exit != 0.
+import hashlib, os, subprocess, sys, signal
+R = os.path.abspath(sys.argv[1])
+S = os.path.join(R, 'scripts', 'stack-release.sh')
+if not os.path.isfile(S): sys.exit(f'ABORT no scripts/stack-release.sh under {sys.argv[1]}')
+T, PAT = 'tests/stack-release.test.mjs', '^T57'
+M = [
+ ('the sso-config first step drops --instance NAME (row 238)', [('    local first="" inst="${INSTANCE_FLAGS[*]:+ ${INSTANCE_FLAGS[*]}}"', '    local first="" inst=""')]),
+]
+sha = lambda b: hashlib.sha256(b).hexdigest()
+only = sys.argv[2:]
+os.chdir(os.path.join(R, 'packages', 'cli'))
+survived = []
+for i, (name, pairs) in enumerate(M, 1):
+    if only and str(i) not in only: continue
+    orig = open(S, 'rb').read(); h = sha(orig)
+    src = orig.decode()
+    for a, b in pairs:
+        if src.count(a) != 1: sys.exit(f'ABORT {i} {name}: pattern found {src.count(a)} times')
+        src = src.replace(a, b)
+    try:
+        open(S, 'w').write(src); os.chmod(S, 0o755)
+        p = subprocess.Popen(['node', '--test', f'--test-name-pattern={PAT}', T], stdout=subprocess.PIPE, stderr=subprocess.STDOUT, start_new_session=True)
+        try: out, _ = p.communicate(timeout=300)
+        except subprocess.TimeoutExpired:
+            os.killpg(p.pid, signal.SIGKILL); out, _ = p.communicate(); out += b'\nTIMEOUT'
+        text = out.decode(errors='replace')
+        ran = [l for l in text.splitlines() if l.startswith('ℹ fail ')]
+        verdict = 'KILLED' if p.returncode != 0 else 'SURVIVED'
+        if verdict == 'SURVIVED': survived.append(name)
+        print(f'{i:2} {verdict} {name} [{ran[0] if ran else "no count"}]', flush=True)
+    finally:
+        open(S, 'wb').write(orig); os.chmod(S, 0o755)
+        if sha(open(S, 'rb').read()) != h: sys.exit(f'ABORT restore failed for {S}')
+print('survived:', survived or 'none')
@@ -196,3 +196,23 @@ a piece. It passed, so the "pm doesn't answer" branch does not apply and
 no defect is filed.

 Piece 1 is Jason's next real Mosaic Stack request to pm. It is not open yet.
+
+## 2026-10-21T01:14Z dates (sage-1622, Mos mos-1148, Vikunja #442)
+
+Mos accepted the plan with changes C1 and C2. The dates are latest-by markers (Q111).
+
+1. Pieces 1-5 open by 2026-10-23 23:59Z. Mos gives Jason the plain command after tonight's open items with him
+   (Q13 on PRD 1.8, the 1012 and 1008 boot). I don't ask again.
+2. C1: no piece is pinned to a copy. A piece runs on whatever copy is live when Jason sends it. For each piece
+   this log records the activation id at send. A piece still open across a window gets the new activation id
+   recorded too.
+3. C2: neither the Q175 phase 2 window (10-23) nor the 10-24 re-pin window rolls back or restores while a piece
+   has history, unless that window has failed. If a restore happens anyway, this log names the pieces to redo.
+4. All five closed and reviewed by 2026-10-26 18:00Z. Jason reads the five trails at his gate on 10-26 or
+   10-27. A pass starts merge plan step 1 under decision 146, and step 4 stays his.
+5. Fallback: if fewer than five pieces are open by 10-23, the gate moves to 10-28. No agent opens a piece in
+   Jason's place.
+
+When Jason sends a piece, I tell Mos its message id.
+
+Correction (2026-10-21T01:06Z): the heading above says 01:14Z. The clock read 2026-10-21T01:05:56Z when I wrote that entry, so 01:06Z is the right time.
@@ -0,0 +1,60 @@
+// Sage, 2026-10-21: re-plan comments on P19 405-408 and 411 (due 10-22). Sage's own key (bot user 13); the sync key reads back. Comments only: no task edits.
+// Checks each task's title before posting. Prints no secret.
+// Usage: node comment-p19-405-411-replan.mjs https://tasks.woltje.com SAGE_TOKEN_FILE SYNC_TOKEN_FILE OUT_JSON
+import { readFileSync, writeFileSync, existsSync } from "node:fs";
+const [ORIGIN, KEY, SYNC, OUT] = process.argv.slice(2);
+if (!/^https:\/\/tasks\.woltje\.com$/.test(ORIGIN)) throw new Error("tasks.woltje.com only");
+if (!OUT || existsSync(OUT)) throw new Error("OUT_JSON missing or exists; refusing");
+const PROJECT = 19;
+const PSIG = "Posted by Sage (T3 1ef1e4f8) with Sage's own key (bot user 13).";
+const esc = (s) => s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
+const ps = (xs) => xs.map((x) => `<p>${esc(x)}</p>`).join("") + `<p>${esc(PSIG)}</p>`;
+const POSTS = [
+  { id: 405, title: /^stack-release --plan: no test plans a missing store/, body: [
+    "Re-plan (Sage, 2026-10-21, due 10-22). Tasks 405, 406, 407, 408 and 411 become one queue row, a stack-release follow-up row. All five touch scripts/stack-release.sh, scripts/webui-service.sh or docs/TOOLS.md, and rows 232 (Darkwing) and 238 (Launchpad) are changing stack-release.sh now. So I brief the row after 232 and 238 land, from their landing, which avoids base drift (the row 68 rule). It lands after the 10-24 window, because that window holds the four service scripts at NEW (P5). 411's hold was the Part B window, and Part B is superseded (Q175, mos-0970), so that hold is gone. Each item keeps the test and mutant its task names. I'll name the owner when I brief it, either the seat that frees up first of Darkwing and Launchpad, or me.",
+  ] },
+  { id: 406, title: /^stack-release --plan: backup line printed/, body: [
+    "Re-plan (Sage, 2026-10-21, due 10-22). Tasks 405, 406, 407, 408 and 411 become one queue row, a stack-release follow-up row. All five touch scripts/stack-release.sh, scripts/webui-service.sh or docs/TOOLS.md, and rows 232 (Darkwing) and 238 (Launchpad) are changing stack-release.sh now. So I brief the row after 232 and 238 land, from their landing, which avoids base drift (the row 68 rule). It lands after the 10-24 window, because that window holds the four service scripts at NEW (P5). 411's hold was the Part B window, and Part B is superseded (Q175, mos-0970), so that hold is gone. Each item keeps the test and mutant its task names. I'll name the owner when I brief it, either the seat that frees up first of Darkwing and Launchpad, or me.",
+  ] },
+  { id: 407, title: /^stack-release\.sh: the proof_for_target comment/, body: [
+    "Re-plan (Sage, 2026-10-21, due 10-22). Tasks 405, 406, 407, 408 and 411 become one queue row, a stack-release follow-up row. All five touch scripts/stack-release.sh, scripts/webui-service.sh or docs/TOOLS.md, and rows 232 (Darkwing) and 238 (Launchpad) are changing stack-release.sh now. So I brief the row after 232 and 238 land, from their landing, which avoids base drift (the row 68 rule). It lands after the 10-24 window, because that window holds the four service scripts at NEW (P5). 411's hold was the Part B window, and Part B is superseded (Q175, mos-0970), so that hold is gone. Each item keeps the test and mutant its task names. I'll name the owner when I brief it, either the seat that frees up first of Darkwing and Launchpad, or me.",
+  ] },
+  { id: 408, title: /^docs\/TOOLS\.md: the row 178 paragraph/, body: [
+    "Re-plan (Sage, 2026-10-21, due 10-22). Tasks 405, 406, 407, 408 and 411 become one queue row, a stack-release follow-up row. All five touch scripts/stack-release.sh, scripts/webui-service.sh or docs/TOOLS.md, and rows 232 (Darkwing) and 238 (Launchpad) are changing stack-release.sh now. So I brief the row after 232 and 238 land, from their landing, which avoids base drift (the row 68 rule). It lands after the 10-24 window, because that window holds the four service scripts at NEW (P5). 411's hold was the Part B window, and Part B is superseded (Q175, mos-0970), so that hold is gone. Each item keeps the test and mutant its task names. I'll name the owner when I brief it, either the seat that frees up first of Darkwing and Launchpad, or me.",
+  ] },
+  { id: 411, title: /^stack-release\.sh and webui-service\.sh: the proof file repository check/, body: [
+    "Re-plan (Sage, 2026-10-21, due 10-22). Tasks 405, 406, 407, 408 and 411 become one queue row, a stack-release follow-up row. All five touch scripts/stack-release.sh, scripts/webui-service.sh or docs/TOOLS.md, and rows 232 (Darkwing) and 238 (Launchpad) are changing stack-release.sh now. So I brief the row after 232 and 238 land, from their landing, which avoids base drift (the row 68 rule). It lands after the 10-24 window, because that window holds the four service scripts at NEW (P5). 411's hold was the Part B window, and Part B is superseded (Q175, mos-0970), so that hold is gone. Each item keeps the test and mutant its task names. I'll name the owner when I brief it, either the seat that frees up first of Darkwing and Launchpad, or me.",
+  ] },
+];
+const key = readFileSync(KEY, "utf8").trim(), sync = readFileSync(SYNC, "utf8").trim();
+async function api(method, path, body, auth) {
+  const r = await fetch(ORIGIN + path, { method, headers: { Authorization: `Bearer ${auth}`, "Content-Type": "application/json" }, body: body === undefined ? undefined : JSON.stringify(body), redirect: "error" });
+  const t = await r.text(); let json = null; try { json = JSON.parse(t); } catch {}
+  return { status: r.status, json };
+}
+const list = (j) => j?.items ?? (Array.isArray(j) ? j : []);
+const rec = { at: new Date().toISOString(), comments: [], problems: [] };
+const save = () => {
+  const out = JSON.stringify(rec, null, 1) + "\n";
+  if (out.includes(key) || out.includes(sync)) throw new Error("secret in the record; not written");
+  writeFileSync(OUT, out);
+};
+for (const P of POSTS) {
+  const t = await api("GET", `/api/v2/tasks/${P.id}`, undefined, sync);
+  if (t.status !== 200 || t.json?.project_id !== PROJECT || !P.title.test(t.json?.title ?? "")) throw new Error(`task ${P.id}: ${t.status}, title check failed; nothing posted`);
+}
+writeFileSync(OUT, "", { flag: "wx" });
+for (const P of POSTS) {
+  const c = await api("PUT", `/api/v1/tasks/${P.id}/comments`, { comment: ps(P.body) }, key);
+  const e = { task: P.id, status: c.status, id: c.json?.id ?? null };
+  rec.comments.push(e);
+  if (c.status >= 300 || !Number.isSafeInteger(c.json?.id)) { rec.problems.push(`comment ${P.id}: ${c.status} ${c.json?.message ?? ""}`); save(); continue; }
+  const back = await api("GET", `/api/v2/tasks/${P.id}/comments?per_page=50`, undefined, sync);
+  const found = list(back.json).find((x) => x.id === c.json.id);
+  Object.assign(e, { readBack: back.status, found: Boolean(found) });
+  if (back.status !== 200 || !found) rec.problems.push(`comment ${P.id} read-back: ${back.status}`);
+  save();
+}
+save();
+process.stdout.write(JSON.stringify(rec, null, 1) + "\n");
+if (rec.problems.length) process.exit(2);
@@ -0,0 +1,53 @@
+// Sage, 2026-10-21: landing comments on P19 412 (row 200) and 424 (row 199), per mos-0882. Sage's own key (bot user 13); the sync key reads back. Comments only: no task edits.
+// Checks each task's title before posting. Prints no secret.
+// Usage: node comment-r200-r199-landed.mjs https://tasks.woltje.com SAGE_TOKEN_FILE SYNC_TOKEN_FILE OUT_JSON
+import { readFileSync, writeFileSync, existsSync } from "node:fs";
+const [ORIGIN, KEY, SYNC, OUT] = process.argv.slice(2);
+if (!/^https:\/\/tasks\.woltje\.com$/.test(ORIGIN)) throw new Error("tasks.woltje.com only");
+if (!OUT || existsSync(OUT)) throw new Error("OUT_JSON missing or exists; refusing");
+const PROJECT = 19;
+const PSIG = "Posted by Sage (T3 1ef1e4f8) with Sage's own key (bot user 13).";
+const esc = (s) => s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
+const ps = (xs) => xs.map((x) => `<p>${esc(x)}</p>`).join("") + `<p>${esc(PSIG)}</p>`;
+const POSTS = [
+  { id: 412, title: /^Console SSO: zero-trust OIDC verification/, body: [
+    "Row 200 landed on refactor as 9e1085816 (Gitea #1698, closed): stack-release.sh activate --sso, the phase 2 prerequisite. Launchpad built it and Webby approved r3. Sage's run killed 13 of 14 mutants (M12 is the equivalent ruled in round 2). Gate: 15 package suites and 10 scripts/test-*.sh suites, all green, at 00:07:57Z.",
+    "Follow-up N1 is row 238 (Gitea #1744, Launchpad, Webby). The sso-config hint will carry --instance NAME for a named instance. Nothing is live until a window activates a copy that includes 9e1085816.",
+  ] },
+  { id: 424, title: /^Credential store: per-agent host access/, body: [
+    "Row 199 landed on refactor as cb5fdb064 (Gitea #1697, closed). It adds the per-agent credential store, the agent's own git identity and pushes to a remote. Megavolt built it and Duckworth approved r1 (comment 29779). Gate on 9e1085816 plus the patch: packages 2735/0, scripts 429/0.",
+    "Row 210 (Gizmoduck) now rebases onto cb5fdb064 on a new branch (mos-1135, mos-1137). Rows 234 and 235 follow it. Rows 190, 199 and 210 go live together in the 10-24 window with the 3i-3j migration, backup first, under Q173 (mos-1145).",
+  ] },
+];
+const key = readFileSync(KEY, "utf8").trim(), sync = readFileSync(SYNC, "utf8").trim();
+async function api(method, path, body, auth) {
+  const r = await fetch(ORIGIN + path, { method, headers: { Authorization: `Bearer ${auth}`, "Content-Type": "application/json" }, body: body === undefined ? undefined : JSON.stringify(body), redirect: "error" });
+  const t = await r.text(); let json = null; try { json = JSON.parse(t); } catch {}
+  return { status: r.status, json };
+}
+const list = (j) => j?.items ?? (Array.isArray(j) ? j : []);
+const rec = { at: new Date().toISOString(), comments: [], problems: [] };
+const save = () => {
+  const out = JSON.stringify(rec, null, 1) + "\n";
+  if (out.includes(key) || out.includes(sync)) throw new Error("secret in the record; not written");
+  writeFileSync(OUT, out);
+};
+for (const P of POSTS) {
+  const t = await api("GET", `/api/v2/tasks/${P.id}`, undefined, sync);
+  if (t.status !== 200 || t.json?.project_id !== PROJECT || !P.title.test(t.json?.title ?? "")) throw new Error(`task ${P.id}: ${t.status}, title check failed; nothing posted`);
+}
+writeFileSync(OUT, "", { flag: "wx" });
+for (const P of POSTS) {
+  const c = await api("PUT", `/api/v1/tasks/${P.id}/comments`, { comment: ps(P.body) }, key);
+  const e = { task: P.id, status: c.status, id: c.json?.id ?? null };
+  rec.comments.push(e);
+  if (c.status >= 300 || !Number.isSafeInteger(c.json?.id)) { rec.problems.push(`comment ${P.id}: ${c.status} ${c.json?.message ?? ""}`); save(); continue; }
+  const back = await api("GET", `/api/v2/tasks/${P.id}/comments?per_page=50`, undefined, sync);
+  const found = list(back.json).find((x) => x.id === c.json.id);
+  Object.assign(e, { readBack: back.status, found: Boolean(found) });
+  if (back.status !== 200 || !found) rec.problems.push(`comment ${P.id} read-back: ${back.status}`);
+  save();
+}
+save();
+process.stdout.write(JSON.stringify(rec, null, 1) + "\n");
+if (rec.problems.length) process.exit(2);
@@ -0,0 +1,66 @@
+// Sage, 2026-10-21: files row 237's review follow-ups N1 and N3 (duckworth-0069, #1743 comment 29810) as two P19 tasks.
+// Sage's own key (bot user 13); the sync key reads back. No labels, assignees, due dates or bucket moves. Refuses if
+// the title exists. Prints no secret.
+// Usage: node file-r237-followups.mjs https://tasks.woltje.com SAGE_TOKEN_FILE SYNC_TOKEN_FILE OUT_JSON
+import { readFileSync, writeFileSync, existsSync } from "node:fs";
+const [ORIGIN, KEY, SYNC, OUT] = process.argv.slice(2);
+if (!/^https:\/\/tasks\.woltje\.com$/.test(ORIGIN)) throw new Error("tasks.woltje.com only");
+if (!OUT || existsSync(OUT)) throw new Error("OUT_JSON missing or exists; refusing");
+const PROJECT = 19;
+const SIG = "Created by Sage (T3 1ef1e4f8) with Sage's own key (bot user 13).";
+const esc = (s) => s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
+const ps = (sig, xs) => xs.map((x) => `<p>${esc(x)}</p>`).join("") + `<p>${esc(sig)}</p>`;
+const TASKS = [
+  {
+    title: "Bus publish: a retry after publish-timeout can push a second fork ref while the first push still runs (row 237 N1)",
+    description: ps(SIG, [
+      "Duckworth's row 237 review N1 (#1743 comment 29810, duckworth-0069). Row 237 makes checkPublish refuse publish-busy while an open ticket holds the same business and decision. publishRefused drops the ticket on publish-timeout, but the bus process's push may still be running, so a retry to another branch can push a second ref to the fork.",
+      "The fix belongs in packages/bus/src/runtime.mjs, in `remotes`: either keep the ticket until the push process exits, or kill the push on timeout and wait for it. A test should start a slow push, time it out, retry to another branch, and expect one ref on the fork. Not in row 237's scope. Megavolt's BUILD.md residual 2 (agents/megavolt/work/queue-237/BUILD.md). Needs a queue row once 237 lands.",
+    ]),
+  },
+  {
+    title: "Bus land: check whether checkLand has the same open-ticket race that row 237 fixed in checkPublish (row 237 N3)",
+    description: ps(SIG, [
+      "Row 237 residual 3 (Megavolt's BUILD.md) and Duckworth's N3 (#1743 comment 29810): checkLand has the same ticket shape as checkPublish had before row 237. Two lands on the same decision may both pass the check before either records. Duckworth didn't check it.",
+      "First step: read checkLand and its ticket code in packages/bus/src/broker.mjs against row 237's fix (broker.mjs:1038-1043). If the race exists, file a queue row with a race test like publish-socket.test.mjs's; if not, record why and close this task.",
+    ]),
+  },
+];
+const key = readFileSync(KEY, "utf8").trim(), sync = readFileSync(SYNC, "utf8").trim();
+async function api(method, path, body, auth) {
+  const r = await fetch(ORIGIN + path, { method, headers: { Authorization: `Bearer ${auth}`, "Content-Type": "application/json" }, body: body === undefined ? undefined : JSON.stringify(body), redirect: "error" });
+  const t = await r.text(); let json = null; try { json = JSON.parse(t); } catch {}
+  return { status: r.status, json };
+}
+const list = (j) => j?.items ?? (Array.isArray(j) ? j : []);
+async function existing() {
+  const out = [];
+  for (let page = 1; page < 20; page++) {
+    const r = await api("GET", `/api/v2/projects/${PROJECT}/tasks?per_page=50&page=${page}`, undefined, sync);
+    if (r.status !== 200) throw new Error(`list tasks: ${r.status}`);
+    out.push(...list(r.json));
+    if (list(r.json).length < 50) return out;
+  }
+  throw new Error("more than 19 pages");
+}
+const rec = { at: new Date().toISOString(), project: PROJECT, created: null, problems: [] };
+const save = () => {
+  const out = JSON.stringify(rec, null, 1) + "\n";
+  if (out.includes(key) || out.includes(sync)) throw new Error("secret in the record; not written");
+  writeFileSync(OUT, out);
+};
+const have = await existing();
+for (const T of TASKS) if (have.some((t) => t.title === T.title)) throw new Error("title exists; refusing");
+writeFileSync(OUT, "", { flag: "wx" });
+rec.created = [];
+for (const T of TASKS) {
+  const r = await api("PUT", `/api/v1/projects/${PROJECT}/tasks`, { title: T.title, description: T.description }, key);
+  const c = { status: r.status, id: r.json?.id ?? null };
+  rec.created.push(c);
+  if (r.status >= 300 || !Number.isSafeInteger(r.json?.id)) { rec.problems.push(`create: ${r.status} ${r.json?.message ?? ""}`); continue; }
+  const back = await api("GET", `/api/v2/tasks/${r.json.id}`, undefined, sync);
+  Object.assign(c, { readBack: back.status, done: back.json?.done });
+  if (back.status !== 200 || back.json?.title !== T.title || back.json?.done) rec.problems.push(`read-back differs for ${r.json.id}`);
+}
+save();
+console.log(JSON.stringify(rec));
@@ -0,0 +1,41 @@
+{
+ "at": "2026-10-21T01:06:25.071Z",
+ "comments": [
+  {
+   "task": 405,
+   "status": 201,
+   "id": 416,
+   "readBack": 200,
+   "found": true
+  },
+  {
+   "task": 406,
+   "status": 201,
+   "id": 417,
+   "readBack": 200,
+   "found": true
+  },
+  {
+   "task": 407,
+   "status": 201,
+   "id": 418,
+   "readBack": 200,
+   "found": true
+  },
+  {
+   "task": 408,
+   "status": 201,
+   "id": 419,
+   "readBack": 200,
+   "found": true
+  },
+  {
+   "task": 411,
+   "status": 201,
+   "id": 420,
+   "readBack": 200,
+   "found": true
+  }
+ ],
+ "problems": []
+}
@@ -0,0 +1,20 @@
+{
+ "at": "2026-10-21T00:28:32.038Z",
+ "comments": [
+  {
+   "task": 412,
+   "status": 201,
+   "id": 414,
+   "readBack": 200,
+   "found": true
+  },
+  {
+   "task": 424,
+   "status": 201,
+   "id": 415,
+   "readBack": 200,
+   "found": true
+  }
+ ],
+ "problems": []
+}
@@ -0,0 +1,19 @@
+{
+ "at": "2026-10-21T00:38:47.170Z",
+ "project": 19,
+ "created": [
+  {
+   "status": 201,
+   "id": 440,
+   "readBack": 200,
+   "done": false
+  },
+  {
+   "status": 201,
+   "id": 441,
+   "readBack": 200,
+   "done": false
+  }
+ ],
+ "problems": []
+}
@@ -0,0 +1,16 @@
+// Sage, 2026-10-21: read-only. Prints id, done, title, the last update and the description as plain text for the
+// given P19 tasks, with the sync key. Writes nothing. Prints no secret.
+// Usage: node read-tasks.mjs https://tasks.woltje.com SYNC_TOKEN_FILE ID...
+import { readFileSync } from "node:fs";
+const [ORIGIN, SYNC, ...IDS] = process.argv.slice(2);
+if (!/^https:\/\/tasks\.woltje\.com$/.test(ORIGIN)) throw new Error("tasks.woltje.com only");
+const sync = readFileSync(SYNC, "utf8").trim();
+const text = (h) => (h ?? "").replace(/<\/p>|<br\s*\/?>|<\/li>/g, "\n").replace(/<[^>]+>/g, "").replace(/&lt;/g, "<").replace(/&gt;/g, ">").replace(/&amp;/g, "&").trim();
+for (const id of IDS) {
+  const r = await fetch(`${ORIGIN}/api/v2/tasks/${id}`, { headers: { Authorization: `Bearer ${sync}` }, redirect: "error" });
+  const j = await r.json().catch(() => null);
+  if (r.status !== 200 || j?.project_id !== 19) { console.log(`== ${id}: status ${r.status}, not P19`); continue; }
+  const out = `== ${id} done=${j.done} updated=${j.updated}\n${j.title}\n${text(j.description)}\n`;
+  if (out.includes(sync)) throw new Error("secret in output");
+  console.log(out);
+}
@@ -0,0 +1,73 @@
+# 10-24 window: re-pin 4429a104f to the row 234 landing, with the 3i-3j migration (draft 0)
+
+Sage, 2026-10-21T01:05Z, draft 0, for mos-1145 under DECISIONS Q173. This is the skeleton. NEW isn't fixed yet,
+so Mos doesn't check this draft. Draft 1 names NEW and goes to Mos for the P0 check. The step layout follows
+`repin-4429a104f.md`. Steps that match are named, not copied.
+
+## Scope (mos-1145, mos-1134)
+
+- One window carries the code of rows 190, 199 and 210, plus row 234 (row a) with its schema step 3i to 3j
+  through `activate --migrate`, agent-run under Q173, backup first.
+- Row a lands before the .53 and .54 installs, by 10-25 (mos-1134). If row 234 hasn't landed by 10-24 12:00Z,
+  I ask Mos whether to run the window without it (no migration) or to move it.
+- Jason has no step. Nobody acts as Jason. No pi (P19 383). No Save, no `mosaic name`. Nothing is pruned.
+- `--sso` stays off. Row 200's `activate --sso` is in NEW as a tool. Turning it on changes who reaches the Console
+  from outside, so that's Jason's (Q173 exclusion). It has its own window, the Q175 phase 2 window on 10-23
+  (mos-1148). That window runs first, so this window's OLD may be the phase 2 copy, and P1 reads it from
+  `status`.
+
+## Names
+
+- OLD, live: `4429a104f6d65ccf165f6c83b5d1dce3147dfde0`, schema 3i, pointer `pm: true` (record 99a406ed3).
+  P1 re-reads the activation id and the Console flags from `status`. I don't copy them from the last window.
+- NEW: open. It's the row 234 landing, or a later code landing if Mos rules. Candidates in landing order:
+  210 (r4 due 10-21), 237, 194, 234.
+- REPO, `P`, `WIN=agents/sage/work/window-repin-<NEW12>/`, `SNAP`: as in `repin-4429a104f.md`, with the
+  sha checks at P0 and before S1, S2 and any D3.
+
+## What NEW carries over OLD (so far, refactor c8bc5cf4c)
+
+`git log --first-parent 4429a104f..HEAD`, path-limited to packages, scripts, roles, contracts, adapters, skills
+and the package files:
+
+| Row | Commit | Live effect to check |
+|---|---|---|
+| 201 | afad4993f | business: access.json loader. Check: the live business has no access.json, and load stays LOAD_OK (P1). |
+| 204 | d0bbc5c1c | business: 193a viewer level. Same check. |
+| 190 | 00d4cc1f6 | Several instances per host. Touches `stack-release.sh`, `webui-service.sh`, `bus-service.sh`, `stack-copy.sh`. The default instance must render the same units: P2 diffs the rendered units OLD vs NEW for `mosaic-stack`, and any difference stops the window until it's explained. |
+| 200 | 9e1085816 | Tool: `activate --sso`. Off here. `--plan` must show no `--sso` line. |
+| 199 | cb5fdb064 | Credential store per agent. Check: bus start with no store entries for the live agents changes nothing, and the chief's and pm's launches still pass. The P3 rehearsal covers start. |
+| N3 | 390ea5261 | README only. |
+| 230 | c8bc5cf4c | Case 2 scripts, tools only. Not run live. |
+| 210 | open | Host access. The live business has no `hosts`, so nothing is granted. Bus start runs the host-run sweep (M34d). P3 must show it removes nothing. |
+| 237 | open | Publish busy check (199 N1). |
+| 234 | open | Machine grant row a and the 3i to 3j schema step. `--plan` must say `migration: 3i -> 3j`. |
+
+Service script drift OLD to HEAD is 415+/91- over the four scripts, mostly row 190. P5 holds them at NEW.
+
+## Backups and the migration
+
+- W5: the stopped store backup that every activate takes (row 185), with SHA256SUMS, SCHEMA 3i and STAMP,
+  plus the rollback set. Before `--migrate` writes, I check that SCHEMA reads 3i and the backup SHA256SUMS hash.
+- W0b: the business file copy, as in the last window.
+- Rollback after a migration isn't the plain rollback. OLD is 3i and the store is 3j, so going back needs
+  `--restore <W5 activation>`, and that loses the events written after W5. The row 181 restore guard counts
+  11 tables, and the untimed ones need the D3 snapshot. Mos decides any restore past W5, as before.
+- P3 is the rehearsal with `--migrate` on a copy of the live backup. It must show the 3j step and the row
+  counts before and after.
+
+## Row 42 (S7) interaction
+
+Row 42's pieces may be in flight at window start (sage-1622, mos-1148 C1 and C2). W1 adds: list open pm tasks, and either pm
+finishes or parks them before W5, or I record which piece crosses the window. No restore while a piece has
+history unless the window fails.
+
+## Open before draft 1
+
+- Q1: NEW, once 234 lands. Do 194 and 237 go in if they land first? I recommend yes for 237 (small, bus
+  only) and asking Mos about 194, since 194 changes the lifecycle verbs and roles/chief-of-staff.*.
+- Q2, settled by mos-1148: phase 2 is its own window on 10-23. Draft 1 takes OLD and the Console flags,
+  `--sso` included, from `status` after that window.
+- Q3: who operates. If Darkwing is free, Darkwing operates and I check. Otherwise I operate as in the last
+  window.
+- The P-step evidence list for rows 199 and 210 at bus start, written once both have landed.
@@ -408,9 +408,8 @@ exposure of a named Console waits for Jason after Q175 SSO.

 ```
 scripts/stack-copy.sh copy COMMIT [--copies DIR] [--allow-worktree]
-scripts/stack-copy.sh copy --bundle FILE SHA [--copies DIR]
-scripts/stack-copy.sh wrapper ID [--instance NAME] [--copies DIR] [--bin DIR] [--create]
-scripts/stack-copy.sh check [--instance NAME] [--copies DIR] [--bin DIR] [--business ID] [--units user|external]
+scripts/stack-copy.sh wrapper ID [--instance NAME] [--copies DIR] [--bin DIR]
+scripts/stack-copy.sh check [--instance NAME] [--copies DIR] [--bin DIR] [--business ID]
 ```

 One read-only tree supplies the bus, Console and human CLI (row 85,
@@ -424,14 +423,6 @@ renames beside the target. A published existing copy stays unchanged.
 Dependencies use the exact lock and carry Pi's installed lock record.
 Failure publishes nothing and removes the temporary tree.

-`copy --bundle FILE SHA` (row 232) is for a host with no refactor checkout.
-SHA is a full 40-character id. The bundle must pass `git bundle verify`,
-carry `refs/heads/refactor`, and reach SHA from it; each miss refuses and
-writes nothing. The copy is then made from SHA as `copy` makes it, and the
-script prints `release:` with the RELEASE value at SHA and `bundle sha256:`
-with the bundle's digest. That pair is the release identity on such a host.
-Without `--bundle`, `copy`'s reachability rule is unchanged.
-
 `wrapper` is a live switching step, reserved for Jason or Mos. It accepts
 only an existing copy and a regular non-symlink mosaic wrapper with the
 Q81 marker on line 2 and its exact lease line to mosaic-old. It preserves
@@ -439,16 +430,11 @@ both lines, adds comments naming the copy root and Q81's mosaic-old lease
 probe, and atomically replaces the wrapper's final exec with the
 copy's scripts/mosaic. --bin is a fixture override; the default is
 ~/.npm-global/bin. Neither the Q81 worktree nor mosaic-old is removed.
-`wrapper ID --create` (row 232) writes the first wrapper on a new host, the
-same file `wrapper` writes. It refuses when anything is at the wrapper path,
-a symlink included, and never replaces it. Without `--create`, a missing
-wrapper still refuses.
 `check` changes nothing: it reads effective systemd WorkingDirectory and
 ExecStart (including drop-ins) for the bus and Console, plus the wrapper
 exec. It prints all three paths and succeeds only on the same existing
 copy; absent/failed reads and a mismatched ExecStart fail. Business defaults
-to mosaic-stack. `check --units external` (row 232) reads root's system units
-with `systemctl show`, without `--user`. Queue work continues on the canonical scripts/mosaic.
+to mosaic-stack. Queue work continues on the canonical scripts/mosaic.

 Bus render/install accept --copy ID, --copies DIR, --pm and the unchanged
 --claude pin. Without --copy the rendered unit stays the checkout unit.
@@ -469,10 +455,7 @@ scripts/stack-release.sh activate ID BUSINESS [--pm | --pm-after-harness] [--mig
 scripts/stack-release.sh pm-on BUSINESS [--timeout S]
 scripts/stack-release.sh rollback BUSINESS [--restore ACTIVATION [--events N]] [--timeout S] [--plan]
 scripts/stack-release.sh status BUSINESS
-scripts/stack-release.sh confirm ID BUSINESS --units external [--rollback OLD --cause A3|A4|A5] [--timeout S]
-scripts/stack-release.sh revert ID BUSINESS --units external
-scripts/stack-release.sh gate ID BUSINESS --units external --since EPOCH [--timeout S]
-common options: --copies DIR, --bin DIR, --instance NAME, --units user|external
+common options: --copies DIR, --bin DIR, --instance NAME
 --events N is the total of the per-table counts the post-backup-events refusal prints: events and
 every table in COUNTED.
 ```
@@ -599,7 +582,8 @@ error. Before anything stops, a run whose Console flags hold `--sso` refuses
 `sso-target` for a target Console without it, `sso-config` when the target's own
 `checkConsole` refuses the config's `console` key (or there is none, in which
 case, from another copy, it names the first step: activate the target without
-`--sso`, then write `console.sso`), and `sso-slot` for each provider's slot file
+`--sso`, then write `console.sso`; on a named instance both commands carry
+`--instance NAME`), and `sso-slot` for each provider's slot file
 that is missing, a symlink, not a regular file, not owned by this uid, has group
 or other bits, resolves inside the repository or the copies, or is empty. It
 uses `lstat`, `stat` and `realpath` on the slot and never reads it. `--plan`
@@ -728,57 +712,6 @@ Usage exits 4. Nothing prunes rehearsal directories.
 starts no thread ticker, and leaves an earlier host's `sessions.json` and
 its runs alone. No unit passes it, and `--pm` with it is a usage error.

-#### Root-owned units (`--units external`, row 232)
-
-On a host whose bus and Console are root's system units, the stack user runs
-`stack-release.sh` with `--units external` from its own clone of the release
-bundle (sage-1561). The script then calls `systemctl show`, `is-active` and
-`list-units` without `--user` and reads no journal. It starts, stops and
-installs nothing. Root does those steps, and the I3 driver calls the verbs
-below in order. Without `--units`, every command line and every byte of
-output is what it was before row 232. `confirm`, `revert`, `gate`, `--to`
-and `--expect-from` are usage errors without `--units external`.
-
- `adopt`, `status`, `activate ID` and `rollback --to ID` take the flag.
-  `rollback` then needs `--to`, and `--to` must be the copy `rollback` alone
-  would pick from the log, or it refuses `to-not-previous`.
- `--plan --expect-from OLD` refuses `pointer-differs` when the pointer
-  names a copy other than OLD.
- `pm-on` and `activate --pm-after-harness` refuse `external-pm`; the PM
-  flag is in root's bus unit. `--pm`, `--tester-port`, the proof flags,
-  `--no-proof`, `--no-send` and `--sso` are usage errors; root's Console
-  unit carries the Console flags.
- `activate` and `rollback` refuse `units-running` unless both units read
-  inactive or failed and the store is closed. They make the rollback set
-  with an exclusive `mkdir`, write `AWAITING-UNITS` (the target copy) first,
-  capture the pointer, the wrapper and both units' show output and unit file
-  sums, back up and migrate or restore the store, and write the wrapper.
-  They write no pointer and start nothing. The last line says the run is
-  staged and names `confirm`. A failure after the capture writes `FAILED`
-  with its code, logs nothing more and exits 1; the activation stays open.
- `confirm ID BUSINESS` needs exactly one `AWAITING-UNITS` for copy ID whose
-  activation the log holds open, or it refuses `open-activation`. It gates
-  the start root made and writes the pointer and an `ok` line with the
-  started line's op, from, to and backup.
-  `confirm --rollback OLD --cause A3|A4|A5` gates OLD after root put the old
-  units back and logs `failed` or `gate-failed` with `rollback ok` (exit 1)
-  or `rollback-failed` (exit 2). Either removes `AWAITING-UNITS` and `FAILED`.
- `revert ID BUSINESS` puts the saved wrapper back and, when the run had
-  started a migration, restores the backup taken before it. It writes no log
-  line and can run again.
- `gate ID BUSINESS --since EPOCH` gates a copy with no open activation,
-  takes no lock and writes nothing: 0 on a pass, 1 otherwise. EPOCH is root's
-  clock before root started the units.
-
-The gate under `--units external` replaces the journal read. The bus unit's
-`ActiveEnterTimestamp`, in whole seconds, must be at or after the started
-line's second (`confirm`) or `--since` (`gate`); an older start fails
-`stale-start`, so a unit that never stopped can't pass. With the PM on, the
-gate reads `launches list --json` for exactly one live launch of the PM's
-instance (the business's `launch.by`), for this business, whose run started at
-or after the floor. `status` adds an
-`awaiting units:` line for an open activation.
-
 ## Console service (`scripts/webui-service.sh`)

 ```bash
@@ -50,10 +50,11 @@ in this repository, or `$MOSAIC_ROLES_DIR` if set.
  `withinRole` actions run without asking. `crossRole` actions need the
  arbiter. Any action not listed is gated: it goes to Jason, or to the
  arbiter for its domain when the raise cites the project's current spec
-  commit (PRD 1.5 REQ-DEC-2). The eight hard waits in `GATED_ONLY`
+  commit (PRD 1.5 REQ-DEC-2). The nine hard waits in `GATED_ONLY`
  (REQ-WAIT-1: `spend`, `data.delete`, `network.expose`, `account.create`,
-  `credential.mint`, `message.external`, `git.push.protected`, `deploy`)
-  always go to Jason and can't appear in either list (REQ-WAIT-2).
+  `credential.mint`, `message.external`, `git.push.protected`,
+  `git.push.remote`, `deploy`) always go to Jason and can't appear in
+  either list (REQ-WAIT-2). `git.push.remote` joined in row 199 (#1697).
  `GATED_ONLY` is every action that `ROUTED` doesn't name, so an action
  added to the vocabulary is a hard wait until a PRD says otherwise and the
  commit adds it to `ROUTED` (REQ-WAIT-3). `git.merge.protected`,
@@ -710,8 +710,9 @@ The session credential comes from
 `EnvironmentFile=-%h/.config/mosaic-dev/secrets/claude-session.env`, the
 one place the path is set. The file holds one line, for example
 `CLAUDE_CODE_OAUTH_TOKEN=<token>`, mode 0600. The operator writes it;
-nothing in the repository creates or reads it, and no session sees the
-file itself, only the variable. The leading `-` lets the unit start
+nothing in the repository creates it, and only the Case 2 precheck reads
+it, printing variable names, never values. No session sees the file
+itself, only the variable. The leading `-` lets the unit start
 without it, so Pi sessions still launch and a Claude Code launch refuses
 `no-session-credential`. To change the credential, edit or swap the file
 (or this line and this paragraph), then restart the unit; a running host
@@ -773,16 +774,6 @@ Each live run requires Mos's go; agents build and test fixtures only, and
 so no PM turn may be in flight. Queue writes stay on the canonical
 scripts/mosaic.

-On a host whose units are root's (row 232), `--units external` makes
-stack-release.sh read the system units and start or stop none. `activate`
-and `rollback --to` stage the copy and leave the `AWAITING-UNITS` marker;
-root installs and starts the units, then `confirm` gates the start and
-writes the pointer, `revert` undoes a staged run, and `gate --since` checks
-a copy with no open activation. stack-copy.sh adds `copy --bundle FILE SHA`
-for a host with no refactor checkout, `wrapper ID --create` for the first
-wrapper, and `check --units external`. Details are in
-[TOOLS.md, Root-owned units](../../docs/TOOLS.md#root-owned-units---units-external-row-232).
-
 The human commands and `--tester` run only from the tree the bus runs from
 (row 130, #1625). The broker checks the path of the calling human-cli.mjs or
 tester-cli.mjs against its own. On a host with a pinned copy that tree is
@@ -0,0 +1,683 @@
+// Case 2 row C2-13a (#1732): scripts/case2-unit.sh renders and installs the hub's two system units,
+// and scripts/case2-precheck.sh checks the host before they start. Brief: docs/plans/2026-10-20_case2-rows.md
+// "C2-13a". Every case runs against a scratch unit directory, a scratch home and fake systemctl,
+// getent, sudo, id, node, bwrap and claude. Nothing here reads or writes /etc/systemd,
+// ~/.mosaic-dev or ~/.config/mosaic-dev, and no fixture value is a real credential.
+import { test } from "node:test";
+import assert from "node:assert/strict";
+import { spawnSync } from "node:child_process";
+import { createServer } from "node:net";
+import { chmodSync, existsSync, mkdirSync, readdirSync, readFileSync, realpathSync, rmSync, statSync, symlinkSync, writeFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+import { businessDoc, writeJson } from "../../business/tests/helpers.mjs";
+import { binds, prepareRun, sandboxArgv, sandboxProblem } from "../../seat/src/sandbox.mjs";
+import { tmp } from "./helpers.mjs";
+
+const REPO = fileURLToPath(new URL("../../../", import.meta.url));
+const UNIT = join(REPO, "scripts", "case2-unit.sh");
+const PRECHECK = join(REPO, "scripts", "case2-precheck.sh");
+const BUS_TEMPLATE = join(REPO, "packages", "cli", "systemd", "mosaic-bus.service.in");
+const WEBUI_TEMPLATE = join(REPO, "packages", "webui", "systemd", "mosaic-webui.service.in");
+const COPY_A = "a".repeat(40);
+const COPY_B = "b".repeat(40);
+const UID = process.getuid();
+const GID = process.getgid();
+// A made-up key value; no output may hold it.
+const FIXTURE_KEY = "fixture-zai-key-3c9e51";
+
+// A root-owned executable outside /usr/local/bin, /usr/bin and /bin, for the PATH case.
+function outsideNode() {
+  const dir = "/usr/lib/systemd";
+  for (const name of readdirSync(dir).sort()) {
+    const p = join(dir, name);
+    const s = statSync(p, { throwIfNoEntry: false });
+    if (s?.isFile() && s.uid === 0 && (s.mode & 0o111) && (s.mode & 0o022) === 0 && realpathSync(p) === p) return p;
+  }
+  throw new Error(`no root-owned executable in ${dir}`);
+}
+const USR_NODE = realpathSync("/usr/bin/node");
+const TRUE_BIN = realpathSync("/usr/bin/true");
+
+function script(file, text) {
+  mkdirSync(dirname(file), { recursive: true });
+  writeFileSync(file, `#!/usr/bin/env bash\n${text}\n`);
+  chmodSync(file, 0o755);
+  return file;
+}
+
+// A scratch hub: a home with two copies and a proof file, a unit directory, and fakes.
+function hub(t, { uid = UID } = {}) {
+  const root = tmp(t, "case2-unit-");
+  const home = join(root, "home", "mosaic");
+  for (const id of [COPY_A, COPY_B]) {
+    mkdirSync(join(home, ".local", "share", "mosaic-stack", "copies", id, "scripts"), { recursive: true });
+    writeFileSync(join(home, ".local", "share", "mosaic-stack", "copies", id, "scripts", "mosaic"), "");
+  }
+  const secrets = join(home, ".config", "mosaic-dev", "secrets");
+  mkdirSync(secrets, { recursive: true, mode: 0o700 });
+  const proof = join(secrets, "proxy-proof");
+  writeFileSync(proof, "made-up-proof\n");
+  chmodSync(proof, 0o600);
+  const units = join(root, "units");
+  mkdirSync(units);
+  const bin = join(root, "bin");
+  const log = join(root, "systemctl.log");
+  script(join(bin, "getent"), `case "$1" in
+  passwd) [ "$2" = mosaic ] && echo "mosaic:x:${uid}:${GID}::${home}:/bin/bash" ;;
+  group) [ "$2" = "${GID}" ] && echo "mosaic:x:${GID}:" ;;
+  *) exit 2 ;;
+esac`);
+  // is-active answers yes for each unit named in CASE2_TEST_ACTIVE.
+  script(join(bin, "systemctl"), `echo "$*" >>'${log}'
+if [ "$1" = is-active ]; then case " \${CASE2_TEST_ACTIVE:-} " in *" $3 "*) exit 0 ;; *) exit 3 ;; esac; fi
+[ "$*" != "\${CASE2_TEST_FAIL:-}" ]`);
+  return { root, home, secrets, proof, units, bin, log };
+}
+
+const libraryFlags = (h) => ["--port", "443", "--business", "acme", "--public-host", "books.example", "--auth-header", "X-Auth-User",
+  "--allow-user", "melanie", "--send", "--proof-header", "X-Proxy-Proof", "--proof-file", h.proof];
+const factoryFlags = () => ["--port", "443", "--business", "acme", "--tester-port", "7333"];
+
+function unit(h, { profile = "library", node = USR_NODE, copy = COPY_A, extra = [], flags, env = {} } = {}) {
+  const serve = flags ?? (profile === "factory" ? factoryFlags() : libraryFlags(h));
+  const args = ["--user", "mosaic", "--home", h.home, "--business", "acme", "--copy", copy, "--node", node, "--profile", profile, ...extra, "--", ...serve];
+  const r = spawnSync(UNIT, args, {
+    encoding: "utf8",
+    timeout: 30000,
+    env: { PATH: process.env.PATH, CASE2_UNIT_DIR: h.units, CASE2_SYSTEMCTL: join(h.bin, "systemctl"), CASE2_GETENT: join(h.bin, "getent"), ...env },
+  });
+  return { code: r.status, out: r.stdout, err: r.stderr };
+}
+
+const busFile = (h) => join(h.units, "[email protected]");
+const webuiFile = (h) => join(h.units, "mosaic-webui.service");
+const read = (f) => readFileSync(f, "utf8");
+const lines = (text, key) => text.split("\n").filter((l) => l.startsWith(`${key}=`)).map((l) => l.slice(key.length + 1));
+const copyDir = (h, id = COPY_A) => join(h.home, ".local", "share", "mosaic-stack", "copies", id);
+const HARDENING = (h) => ["ProtectSystem=strict", `ReadWritePaths=${h.home}`, "ProtectHome=yes", "PrivateTmp=yes"];
+
+function refuses(r, pattern) {
+  assert.equal(r.code, 1, `expected a refusal, got ${r.code}: ${r.out}${r.err}`);
+  assert.match(r.err, pattern);
+}
+
+// A template copy with one edit, for the template cases.
+function template(h, from, name, edit) {
+  const file = join(h.root, name);
+  writeFileSync(file, edit(read(from)));
+  return file;
+}
+
+test("a clean library render writes both units 0644 with the fixed lines, and enables both then starts the bus then the Console", (t) => {
+  const h = hub(t);
+  const r = unit(h);
+  assert.equal(r.code, 0, r.err);
+  for (const f of [busFile(h), webuiFile(h)]) assert.equal(statSync(f).mode & 0o777, 0o644);
+  const bus = read(busFile(h));
+  const webui = read(webuiFile(h));
+  assert.deepEqual(lines(bus, "Environment"), ["PATH=/usr/bin:/usr/local/bin:/bin"]);
+  assert.deepEqual(lines(bus, "ExecStart"), [`${copyDir(h)}/scripts/mosaic bus start %i`]);
+  assert.deepEqual(lines(bus, "EnvironmentFile"), [`-${h.home}/.config/mosaic-dev/secrets/claude-session.env`]);
+  assert.deepEqual(lines(webui, "ExecStart"), [`${USR_NODE} ${copyDir(h)}/packages/webui/src/cli.mjs serve ${libraryFlags(h).join(" ")}`]);
+  assert.deepEqual(lines(webui, "EnvironmentFile"), []);
+  for (const text of [bus, webui]) {
+    assert.deepEqual(lines(text, "WantedBy"), ["multi-user.target"]);
+    assert.deepEqual(lines(text, "User"), ["mosaic"]);
+    assert.deepEqual(lines(text, "Group"), ["mosaic"]);
+    assert.deepEqual(lines(text, "NoNewPrivileges"), ["yes"]);
+    const hardening = text.split("\n").filter((l) => /^(ProtectSystem|ReadWritePaths|ProtectHome|PrivateTmp)=/.test(l));
+    assert.deepEqual(hardening, HARDENING(h));
+    assert.doesNotMatch(text, /@[A-Z_]+@|%h|MOSAIC_CONFIG=|MOSAIC_CLAUDE_BIN|After=|Wants=/);
+  }
+  assert.deepEqual(lines(bus, "AmbientCapabilities"), []);
+  assert.deepEqual(lines(bus, "CapabilityBoundingSet"), []);
+  assert.deepEqual(lines(webui, "AmbientCapabilities"), ["CAP_NET_BIND_SERVICE"]);
+  assert.deepEqual(lines(webui, "CapabilityBoundingSet"), ["CAP_NET_BIND_SERVICE"]);
+  assert.match(r.out, /enabled and started mosaic-bus@acme\.service, then mosaic-webui\.service\n$/);
+  assert.deepEqual(read(h.log).trim().split("\n"), [
+    "is-active --quiet [email protected]",
+    "is-active --quiet mosaic-webui.service",
+    "daemon-reload",
+    "enable [email protected] mosaic-webui.service",
+    "start [email protected]",
+    "start mosaic-webui.service",
+  ]);
+});
+
+test("PATH starts with the --node directory, for a node outside the default list and for /usr/bin/node", (t) => {
+  const h = hub(t);
+  const node = outsideNode();
+  assert.equal(unit(h, { node }).code, 0);
+  for (const f of [busFile(h), webuiFile(h)]) assert.deepEqual(lines(read(f), "Environment"), [`PATH=${dirname(node)}:/usr/local/bin:/usr/bin:/bin`]);
+  assert.match(lines(read(webuiFile(h)), "ExecStart")[0], new RegExp(`^${node} `));
+});
+
+test("a failed bus start refuses with the Console not started", (t) => {
+  const h = hub(t);
+  const r = unit(h, { env: { CASE2_TEST_FAIL: "start [email protected]" } });
+  refuses(r, /start mosaic-bus@acme\.service failed; the Console is not started/);
+  assert.deepEqual(read(h.log).trim().split("\n").slice(2), ["daemon-reload", "enable [email protected] mosaic-webui.service", "start [email protected]"]);
+});
+
+test("the script never links a unit file", () => {
+  assert.doesNotMatch(read(UNIT), /systemctl link/);
+});
+
+test("factory renders --pm once and one MOSAIC_CLAUDE_BIN line, and without them both tokens render empty", (t) => {
+  const h = hub(t);
+  assert.equal(unit(h, { profile: "factory", extra: ["--pm", "--claude", TRUE_BIN] }).code, 0);
+  const bus = read(busFile(h));
+  const exec = lines(bus, "ExecStart");
+  assert.equal(exec.length, 1);
+  assert.match(exec[0], / bus start %i --pm$/);
+  assert.equal(exec[0].split("--pm").length, 2);
+  assert.deepEqual(lines(bus, "Environment"), ["PATH=/usr/bin:/usr/local/bin:/bin", `MOSAIC_CLAUDE_BIN=${TRUE_BIN}`]);
+  assert.deepEqual(lines(read(webuiFile(h)), "ExecStart"), [`${USR_NODE} ${copyDir(h)}/packages/webui/src/cli.mjs serve ${factoryFlags().join(" ")}`]);
+
+  const plain = hub(t);
+  assert.equal(unit(plain, { profile: "factory" }).code, 0);
+  const text = read(busFile(plain));
+  assert.deepEqual(lines(text, "ExecStart"), [`${copyDir(plain)}/scripts/mosaic bus start %i`]);
+  assert.doesNotMatch(text, /MOSAIC_CLAUDE_BIN|@PM_FLAGS@|@CLAUDE_ENV@/);
+});
+
+test("a re-install over running units says they are still on the old copy and must restart together, never that it started them", (t) => {
+  const h = hub(t);
+  assert.equal(unit(h).code, 0);
+  const both = unit(h, { copy: COPY_B, env: { CASE2_TEST_ACTIVE: "[email protected] mosaic-webui.service" } });
+  assert.equal(both.code, 0, both.err);
+  assert.doesNotMatch(both.out, /started/);
+  assert.match(both.out, new RegExp(`mosaic-bus@acme\\.service was already running, so it is still on copy ${COPY_A}, not copy ${COPY_B}`));
+  assert.match(both.out, new RegExp(`mosaic-webui\\.service was already running, so it is still on copy ${COPY_A}, not copy ${COPY_B}`));
+  assert.match(both.out, new RegExp(`restart mosaic-bus@acme\\.service and mosaic-webui\\.service together to put both on copy ${COPY_B}`));
+  assert.deepEqual(read(h.log).trim().split("\n").slice(-2), ["start [email protected]", "start mosaic-webui.service"]);
+
+  // Only the Console ran (the bus had stopped): the bus starts on the new copy, the Console stays.
+  const one = unit(h, { copy: COPY_A, env: { CASE2_TEST_ACTIVE: "mosaic-webui.service" } });
+  assert.equal(one.code, 0, one.err);
+  assert.match(one.out, new RegExp(`started mosaic-bus@acme\\.service on copy ${COPY_A}`));
+  assert.match(one.out, new RegExp(`mosaic-webui\\.service was already running, so it is still on copy ${COPY_B}, not copy ${COPY_A}`));
+  assert.doesNotMatch(one.out, /started mosaic-webui/);
+  assert.match(one.out, /restart mosaic-bus@acme\.service and mosaic-webui\.service together/);
+});
+
+test("a re-install to another copy re-renders both units, and an edited installed unit refuses", (t) => {
+  const h = hub(t);
+  assert.equal(unit(h).code, 0);
+  assert.equal(unit(h, { copy: COPY_B }).code, 0);
+  assert.match(read(busFile(h)), new RegExp(`copies/${COPY_B}/scripts/mosaic`));
+  assert.doesNotMatch(read(busFile(h)) + read(webuiFile(h)), new RegExp(COPY_A));
+
+  const edits = [
+    [busFile, (s) => s.replace("User=mosaic", "User=root"), /User= must be exactly once in \[Service\], as User=mosaic/],
+    [webuiFile, (s) => s.replace(/^ExecStart=(.*)$/m, "ExecStart=$1 --board http://127.0.0.1:1"), /ExecStart= must be exactly once/],
+    [busFile, (s) => s.replace("ProtectHome=yes\n", ""), /ProtectHome= must be exactly once/],
+    [webuiFile, (s) => s.replace("PrivateTmp=yes\n", ""), /PrivateTmp= must be exactly once/],
+    [busFile, (s) => s.replace("Type=simple", "Type=simple\nX-Note=%h"), /%h is left/],
+  ];
+  for (const [file, edit, pattern] of edits) {
+    const before = read(file(h));
+    writeFileSync(file(h), edit(before));
+    refuses(unit(h, { copy: COPY_B }), pattern);
+    writeFileSync(file(h), before);
+  }
+  assert.equal(unit(h, { copy: COPY_B }).code, 0);
+});
+
+test("a template with a namespace, user or system call restriction refuses", (t) => {
+  const h = hub(t);
+  for (const line of ["RestrictNamespaces=yes", "PrivateUsers=yes", "SystemCallFilter=@system-service"]) {
+    const key = line.split("=")[0];
+    for (const [from, env] of [[BUS_TEMPLATE, "CASE2_BUS_TEMPLATE"], [WEBUI_TEMPLATE, "CASE2_WEBUI_TEMPLATE"]]) {
+      const file = template(h, from, `t-${key}.in`, (s) => s.replace("NoNewPrivileges=yes", `NoNewPrivileges=yes\n${line}`));
+      refuses(unit(h, { env: { [env]: file } }), new RegExp(`refusing ${key}=`));
+    }
+  }
+  assert.equal(existsSync(busFile(h)), false);
+});
+
+test("the bus template's EnvironmentFile line must be there and point at the session env, and the Console template must have none", (t) => {
+  const h = hub(t);
+  const gone = template(h, BUS_TEMPLATE, "no-env.in", (s) => s.replace(/^EnvironmentFile=.*\n/m, ""));
+  refuses(unit(h, { env: { CASE2_BUS_TEMPLATE: gone } }), /EnvironmentFile= must be exactly once/);
+  const elsewhere = template(h, BUS_TEMPLATE, "env-elsewhere.in", (s) => s.replace("EnvironmentFile=-@SESSION_ENV@", "EnvironmentFile=-/etc/other.env"));
+  refuses(unit(h, { env: { CASE2_BUS_TEMPLATE: elsewhere } }), /EnvironmentFile= must be exactly once/);
+  const added = template(h, WEBUI_TEMPLATE, "webui-env.in", (s) => s.replace("NoNewPrivileges=yes", "NoNewPrivileges=yes\nEnvironmentFile=-/etc/other.env"));
+  refuses(unit(h, { env: { CASE2_WEBUI_TEMPLATE: added } }), /refusing EnvironmentFile=/);
+});
+
+test("a template holding an unknown token, PermissionsStartOnly or a privileged Exec prefix refuses", (t) => {
+  const h = hub(t);
+  const token = template(h, BUS_TEMPLATE, "token.in", (s) => s.replace("Type=simple", "Type=simple\nX-Note=@SECRET@"));
+  refuses(unit(h, { env: { CASE2_BUS_TEMPLATE: token } }), /a token is left after the render: @SECRET@/);
+  const webuiToken = template(h, WEBUI_TEMPLATE, "wtoken.in", (s) => s.replace("Type=simple", "Type=simple\nX-Note=@SECRET@"));
+  refuses(unit(h, { env: { CASE2_WEBUI_TEMPLATE: webuiToken } }), /a token other than one @FLAGS@/);
+  const pso = template(h, BUS_TEMPLATE, "pso.in", (s) => s.replace("Type=simple", "Type=simple\nPermissionsStartOnly=yes"));
+  refuses(unit(h, { env: { CASE2_BUS_TEMPLATE: pso } }), /refusing PermissionsStartOnly=/);
+  for (const pre of ["+/srv/mosaic/x", "-+/srv/mosaic/x"]) {
+    const file = template(h, BUS_TEMPLATE, "pre.in", (s) => s.replace("Type=simple", `Type=simple\nExecStartPre=${pre}`));
+    refuses(unit(h, { env: { CASE2_BUS_TEMPLATE: file } }), /an Exec line that runs with full privileges: ExecStartPre=/);
+  }
+});
+
+test("a symlink at either unit path refuses", (t) => {
+  for (const name of ["[email protected]", "mosaic-webui.service"]) {
+    const h = hub(t);
+    const target = join(h.root, "elsewhere");
+    writeFileSync(target, "");
+    symlinkSync(target, join(h.units, name));
+    refuses(unit(h), new RegExp(`${name.replace(".", "\\.")} is a symlink`));
+  }
+});
+
+test("a --node that is relative, not root-owned or under <home> refuses", (t) => {
+  const h = hub(t);
+  refuses(unit(h, { node: "bin/node" }), /--node must be an absolute path/);
+  const mine = script(join(h.root, "opt", "node"), "exit 0");
+  refuses(unit(h, { node: mine }), /--node: .* is not owned by root/);
+  const inside = script(join(h.home, "bin", "node"), "exit 0");
+  refuses(unit(h, { node: inside }), /--node must be outside/);
+});
+
+test("a re-install with a different --node or different serve flags refuses", (t) => {
+  const h = hub(t);
+  assert.equal(unit(h).code, 0);
+  // A new node moves PATH too, so the installed unit fails its own Environment= check first.
+  refuses(unit(h, { node: outsideNode() }), /installed .*: the Environment= lines must be exactly/);
+  const flags = libraryFlags(h).map((f) => (f === "melanie" ? "someone" : f));
+  refuses(unit(h, { flags }), /installed .*: ExecStart= must be exactly once/);
+  // A line check_unit doesn't fix still has to equal the render.
+  writeFileSync(busFile(h), read(busFile(h)).replace(/^Description=.*$/m, "Description=edited"));
+  refuses(unit(h), /differs from the render in more than the copy id/);
+});
+
+test("an installed pair whose units name different copies refuses", (t) => {
+  const h = hub(t);
+  assert.equal(unit(h).code, 0);
+  writeFileSync(webuiFile(h), read(webuiFile(h)).replaceAll(COPY_A, COPY_B));
+  refuses(unit(h), new RegExp(`the installed units name different copies, ${COPY_A} and ${COPY_B}`));
+});
+
+test("a copy id that is short, uppercase, holds / or .., or names no directory refuses", (t) => {
+  const h = hub(t);
+  for (const copy of ["a".repeat(39), "A".repeat(40), `${"a".repeat(19)}/${"a".repeat(20)}`, `..${"a".repeat(38)}`]) {
+    refuses(unit(h, { copy }), /--copy must be a full 40-character lower-case commit id/);
+  }
+  refuses(unit(h, { copy: "c".repeat(40) }), /no copy directory/);
+});
+
+test("library refuses a privileged-floor miss, a bad proof pair and every flag outside its set", (t) => {
+  const h = hub(t);
+  const base = libraryFlags(h);
+  const without = (...names) => {
+    const out = [];
+    for (let i = 0; i < base.length; i++) {
+      if (names.includes(base[i])) { if (base[i] !== "--send") i++; continue; }
+      out.push(base[i]);
+    }
+    return out;
+  };
+  refuses(unit(h, { flags: base.map((f) => (f === "443" ? "7332" : f)) }), /--port must be 1\.\.1023/);
+  refuses(unit(h, { flags: without("--proof-header", "--proof-file") }), /serve flag --proof-header is required/);
+  refuses(unit(h, { flags: base.map((f) => (f === "X-Auth-User" ? "X-Authentik-Uid" : f)) }), /must be an Authentik uid/);
+  assert.equal(unit(h, { flags: base.map((f) => (f === "X-Auth-User" ? "X-Authentik-Uid" : f === "melanie" ? "0".repeat(64) : f)) }).code, 0);
+  rmSync(busFile(h));
+  rmSync(webuiFile(h));
+  for (const [flag, value, pattern] of [
+    ["--tester-port", "7333", /the library profile refuses --tester-port/],
+    ["--checkout", "/srv/x", /refusing --checkout/],
+    ["--board", "http://127.0.0.1:7331", /refusing --board/],
+    ["--sso", null, /refusing --sso/],
+    ["--nonsense", "1", /unknown serve flag: --nonsense/],
+  ]) {
+    refuses(unit(h, { flags: [...base, flag, ...(value === null ? [] : [value])] }), pattern);
+  }
+  refuses(unit(h, { flags: base.map((f) => (f === "acme" ? "other" : f)) }), /serve --business other is not the unit's business acme/);
+  refuses(unit(h, { extra: ["--pm"] }), /the library profile refuses --pm/);
+  refuses(unit(h, { extra: ["--claude", TRUE_BIN] }), /the library profile refuses --claude/);
+
+  chmodSync(h.proof, 0o644);
+  refuses(unit(h), /mode 0600 or 0400, not 644/);
+  chmodSync(h.proof, 0o600);
+  const link = join(h.secrets, "proof-link");
+  symlinkSync(h.proof, link);
+  refuses(unit(h, { flags: base.map((f) => (f === h.proof ? link : f)) }), /must not be a symlink/);
+  const dataRoot = join(h.home, ".mosaic-dev");
+  mkdirSync(dataRoot);
+  const outside = join(dataRoot, "proof");
+  writeFileSync(outside, "made-up-proof\n");
+  chmodSync(outside, 0o600);
+  refuses(unit(h, { flags: base.map((f) => (f === h.proof ? outside : f)) }), /must be under .*secrets, outside the data root/);
+  assert.equal(existsSync(busFile(h)), false);
+});
+
+// A non-root test can't make a root-owned file under the scratch home, so the
+// owner case names another uid in the passwd database instead.
+test("library refuses a proof file not owned by <user>'s uid", (t) => {
+  const h = hub(t, { uid: UID + 4242 });
+  refuses(unit(h), new RegExp(`proxy proof file must be owned by mosaic \\(uid ${UID + 4242}\\)`));
+});
+
+test("factory refuses a tester port on --port, a missing --port or --business, and each proxy flag", (t) => {
+  const h = hub(t);
+  refuses(unit(h, { profile: "factory", flags: ["--port", "443", "--business", "acme", "--tester-port", "443"] }), /--tester-port must be 1024\.\.65535|--tester-port must differ from --port/);
+  refuses(unit(h, { profile: "factory", flags: ["--port", "443", "--business", "acme", "--tester-port", "1443", "--port", "1443"] }), /given twice/);
+  refuses(unit(h, { profile: "factory", flags: ["--business", "acme"] }), /serve flag --port is required/);
+  refuses(unit(h, { profile: "factory", flags: ["--port", "443"] }), /serve flag --business is required/);
+  for (const [flag, value] of [["--public-host", "x.example"], ["--auth-header", "X-A"], ["--allow-user", "u"], ["--proof-header", "X-P"], ["--proof-file", h.proof], ["--send", null]]) {
+    refuses(unit(h, { profile: "factory", flags: [...factoryFlags(), flag, ...(value === null ? [] : [value])] }), new RegExp(`the factory profile refuses ${flag}`));
+  }
+  for (const [flag, value, pattern] of [["--checkout", "/srv/x", /refusing --checkout/], ["--board", "http://127.0.0.1:7331", /refusing --board/], ["--sso", null, /refusing --sso/], ["--nonsense", "1", /unknown serve flag/]]) {
+    refuses(unit(h, { profile: "factory", flags: [...factoryFlags(), flag, ...(value === null ? [] : [value])] }), pattern);
+  }
+});
+
+test("factory: the tester port equal to --port refuses", (t) => {
+  const h = hub(t);
+  refuses(unit(h, { profile: "factory", flags: ["--port", "443", "--business", "acme", "--tester-port", "443"] }), /--tester-port must be 1024\.\.65535/);
+  // Ports 1024 and up can't be the Console's, so the equality check is reached only through a port below 1024; it stays as a guard.
+  assert.match(read(UNIT), /--tester-port must differ from --port/);
+});
+
+test("factory refuses a --claude that is relative, not root-owned or under <home>, and a re-install with another --pm or --claude", (t) => {
+  const h = hub(t);
+  refuses(unit(h, { profile: "factory", extra: ["--claude", "bin/claude"] }), /--claude must be an absolute path/);
+  const mine = script(join(h.root, "opt", "claude"), "exit 0");
+  refuses(unit(h, { profile: "factory", extra: ["--claude", mine] }), /--claude: .* is not owned by root/);
+  const inside = script(join(h.home, "bin", "claude"), "exit 0");
+  refuses(unit(h, { profile: "factory", extra: ["--claude", inside] }), /--claude must be outside/);
+
+  assert.equal(unit(h, { profile: "factory", extra: ["--pm", "--claude", TRUE_BIN] }).code, 0);
+  refuses(unit(h, { profile: "factory", extra: ["--claude", TRUE_BIN] }), /--pm and --claude must equal the installed ones|ExecStart= must be exactly once/);
+  refuses(unit(h, { profile: "factory", extra: ["--pm"] }), /Environment= lines must be exactly|differs from the render/);
+  refuses(unit(h, { profile: "factory", extra: ["--pm", "--claude", USR_NODE] }), /Environment= lines must be exactly|differs from the render/);
+});
+
+// ---- case2-precheck.sh ----
+
+// A scratch user for the precheck: a config, a business file, an installed Console unit,
+// fakes on PATH and a fake /proc/sys.
+function host(t, { roles = {}, vars = {}, keyFile = `ZAI_API_KEY=${FIXTURE_KEY}\n`, port = "443", busClaude = null } = {}) {
+  const root = tmp(t, "case2-pre-");
+  const home = join(root, "home");
+  const configDir = join(home, ".config", "mosaic-dev");
+  const config = writeJson(join(configDir, "config.json"), {
+    configVersion: 1,
+    environment: "production",
+    dataRoot: join(home, ".mosaic-dev"),
+    execution: { backend: "docker", provider: "zai", model: "glm-5.3-flash", adapter: "pi" },
+  });
+  const doc = businessDoc(root);
+  doc.roles.cto.vars = { harness: "pi" };
+  for (const [name, v] of Object.entries(roles)) doc.roles[name].vars = v;
+  Object.assign(doc.vars, vars);
+  writeJson(join(configDir, "businesses", "acme.json"), doc);
+  const secrets = join(configDir, "secrets");
+  mkdirSync(secrets, { recursive: true, mode: 0o700 });
+  if (keyFile !== null) {
+    writeFileSync(join(secrets, "claude-session.env"), keyFile);
+    chmodSync(join(secrets, "claude-session.env"), 0o600);
+  }
+  const units = join(root, "units");
+  mkdirSync(units);
+  writeFileSync(join(units, "mosaic-webui.service"), `[Service]\nExecStart=/usr/bin/node /x/cli.mjs serve --port ${port} --business acme\n`);
+  writeFileSync(join(units, "[email protected]"), `[Service]\nEnvironment=PATH=/usr/bin\n${busClaude ? `Environment=MOSAIC_CLAUDE_BIN=${busClaude}\n` : ""}`);
+  const sys = join(root, "sys");
+  mkdirSync(join(sys, "net", "ipv4"), { recursive: true });
+  mkdirSync(join(sys, "kernel"), { recursive: true });
+  writeFileSync(join(sys, "net", "ipv4", "ip_unprivileged_port_start"), "1024\n");
+  writeFileSync(join(sys, "kernel", "apparmor_restrict_unprivileged_userns"), "1\n");
+  const bin = join(root, "bin");
+  const me = spawnSync("id", ["-un"], { encoding: "utf8" }).stdout.trim();
+  script(join(bin, "getent"), `[ "$1" = passwd ] && [ "$2" = '${me}' ] && echo '${me}:x:${UID}:${GID}::${home}:/bin/bash'`);
+  script(join(bin, "sudo"), "exit 1");
+  script(join(bin, "id"), `if [ "$1" = -G ]; then echo "\${CASE2_TEST_GROUPS:-${GID}}"; else exec /usr/bin/id "$@"; fi`);
+  script(join(bin, "node"), `if [ "$1" = --version ]; then echo "\${CASE2_TEST_NODE:-v24.3.0}"; exit 0; fi\nexec '${process.execPath}' "$@"`);
+  script(join(bin, "bwrap"), `exit "\${CASE2_TEST_BWRAP:-0}"`);
+  return { root, home, configDir, config, secrets, units, sys, bin, dataRoot: join(home, ".mosaic-dev") };
+}
+
+// A fake claude: replace answers with the marker and a small prompt; append answers with a large one;
+// nomarker answers with a small prompt and no marker; text answers with plain text, not JSON.
+function fakeClaude(dir, kind) {
+  return script(join(dir, "claude"), `[ "$1" = --version ] && { echo "9.9.9 (Claude Code, ${kind} fake)"; exit 0; }
+file=''
+while [ $# -gt 0 ]; do [ "$1" = --system-prompt-file ] && file="$2"; shift; done
+marker="$(awk '{ print $NF }' "$file")"
+${kind === "nomarker" ? "marker=something-else" : ""}
+${kind === "text" ? 'echo "$marker"; exit 0' : ""}
+tokens=${kind === "append" ? 9000 : 40}
+printf '{"result":"%s","usage":{"input_tokens":%s,"cache_read_input_tokens":0}}\\n' "$marker" "$tokens"`);
+}
+
+// This host may have a claude in /usr/bin, so this PATH links every /usr/bin entry but that one.
+function pathWithoutClaude(x) {
+  const usr = join(x.root, "usr-bin");
+  mkdirSync(usr);
+  for (const name of readdirSync("/usr/bin")) if (name !== "claude") symlinkSync(join("/usr/bin", name), join(usr, name));
+  return `${x.bin}:${usr}`;
+}
+
+function precheck(x, { profile = "library", env = {}, path } = {}) {
+  const r = spawnSync(PRECHECK, ["--business", "acme", "--profile", profile], {
+    encoding: "utf8",
+    timeout: 60000,
+    env: {
+      PATH: path ?? `${x.bin}:/usr/bin:/bin`,
+      HOME: x.home,
+      MOSAIC_CONFIG: x.config,
+      CASE2_UNIT_DIR: x.units,
+      CASE2_PROC_SYS: x.sys,
+      CASE2_GETENT: join(x.bin, "getent"),
+      ...env,
+    },
+  });
+  const out = r.stdout + r.stderr;
+  assert.doesNotMatch(out, new RegExp(FIXTURE_KEY), "the precheck printed the fixture key");
+  return { code: r.status, out };
+}
+
+function blocked(r, pattern) {
+  assert.equal(r.code, 1, r.out);
+  assert.match(r.out, pattern);
+}
+
+test("the precheck passes on a good host and prints free memory, without the key", (t) => {
+  const x = host(t);
+  const r = precheck(x);
+  assert.equal(r.code, 0, r.out);
+  assert.match(r.out, /ok {6}config validates/);
+  assert.match(r.out, /ok {6}bus\.tester is off/);
+  assert.match(r.out, /ok {6}net\.ipv4\.ip_unprivileged_port_start 1024 is above the Console's port 443/);
+  assert.match(r.out, /claude-session\.env sets ZAI_API_KEY/);
+  assert.match(r.out, /free memory: \d+ MiB/);
+  assert.doesNotMatch(r.out, /claude .*fake|marker/);
+});
+
+test("the precheck refuses each failed host check", (t) => {
+  blocked(precheck(host(t), { env: { CASE2_TEST_NODE: "v22.22.2" } }), /REFUSED node v22\.22\.2 is older than 24/);
+  blocked(precheck(host(t), { env: { CASE2_TEST_GROUPS: `${GID} 998` } }), /REFUSED id -G prints more than one group/);
+  const sudo = host(t);
+  script(join(sudo.bin, "sudo"), "exit 0");
+  blocked(precheck(sudo), /REFUSED sudo -n true succeeds/);
+  blocked(precheck(host(t), { env: { XDG_DATA_HOME: "/elsewhere" } }), /REFUSED XDG_DATA_HOME is \/elsewhere/);
+  const home = host(t);
+  assert.equal(precheck(home, { env: { XDG_DATA_HOME: `${home.home}/.local/share` } }).code, 0);
+  blocked(precheck(host(t), { env: { HOME: "/tmp" } }), /REFUSED HOME is \/tmp/);
+
+  const runs = host(t);
+  mkdirSync(join(runs.dataRoot, "launches", "acme"), { recursive: true, mode: 0o755 });
+  chmodSync(join(runs.dataRoot, "launches", "acme"), 0o755);
+  blocked(precheck(runs), /REFUSED run root .* is not a 0700 directory \(mode 755\)/);
+  chmodSync(join(runs.dataRoot, "launches", "acme"), 0o700);
+  assert.match(precheck(runs).out, /ok {6}run root .* is 0700/);
+
+  const bad = host(t);
+  writeFileSync(bad.config, "{ not json");
+  blocked(precheck(bad), /REFUSED config:/);
+});
+
+test("the precheck refuses a user missing from passwd, a business file that does not load, and a symlinked run root", (t) => {
+  const nouser = host(t);
+  script(join(nouser.bin, "getent"), "exit 2");
+  blocked(precheck(nouser), /REFUSED user: no .* in the passwd database/);
+
+  const unparsed = host(t);
+  writeFileSync(join(unparsed.configDir, "businesses", "acme.json"), "{ not json");
+  blocked(precheck(unparsed), /REFUSED business file: cannot read .*acme\.json/);
+  const gone = host(t);
+  rmSync(join(gone.configDir, "businesses", "acme.json"));
+  blocked(precheck(gone), /REFUSED business file: cannot read .*acme\.json: ENOENT/);
+  const invalid = host(t);
+  const file = join(invalid.configDir, "businesses", "acme.json");
+  const doc = JSON.parse(read(file));
+  doc.notAField = true;
+  writeJson(file, doc);
+  const r = precheck(invalid);
+  blocked(r, /REFUSED business file: /);
+  assert.doesNotMatch(r.out, /REFUSED business file: cannot read/);
+
+  // stat follows a link, so a link to a 0700 directory would read as 0700.
+  const link = host(t);
+  const target = join(link.root, "elsewhere");
+  mkdirSync(target, { mode: 0o700 });
+  chmodSync(target, 0o700);
+  mkdirSync(join(link.dataRoot, "launches"), { recursive: true });
+  symlinkSync(target, join(link.dataRoot, "launches", "acme"));
+  blocked(precheck(link), /REFUSED run root .* is a symlink/);
+});
+
+test("a bwrap that fails refuses and prints the sysctl and where bwrap is", (t) => {
+  const x = host(t);
+  blocked(precheck(x, { env: { CASE2_TEST_BWRAP: "1" } }), new RegExp(`REFUSED bwrap .* failed; bwrap: ${join(x.bin, "bwrap")}; kernel\\.apparmor_restrict_unprivileged_userns: 1`));
+});
+
+test("an unprivileged port floor at or below the Console's port refuses, and so does a missing Console unit", (t) => {
+  for (const floor of ["443", "80"]) {
+    const x = host(t);
+    writeFileSync(join(x.sys, "net", "ipv4", "ip_unprivileged_port_start"), `${floor}\n`);
+    blocked(precheck(x), new RegExp(`REFUSED net\\.ipv4\\.ip_unprivileged_port_start is ${floor}, at or below the Console's port 443`));
+  }
+  const x = host(t);
+  rmSync(join(x.units, "mosaic-webui.service"));
+  blocked(precheck(x), /REFUSED no installed Console unit/);
+  const noPort = host(t);
+  writeFileSync(join(noPort.units, "mosaic-webui.service"), "[Service]\nExecStart=/usr/bin/node /x/cli.mjs serve --business acme\n");
+  blocked(precheck(noPort), /REFUSED .*mosaic-webui\.service has no --port in its ExecStart/);
+  const noFloor = host(t);
+  rmSync(join(noFloor.sys, "net", "ipv4", "ip_unprivileged_port_start"));
+  blocked(precheck(noFloor), /REFUSED cannot read net\.ipv4\.ip_unprivileged_port_start/);
+});
+
+test("bus.tester: library refuses it on, factory needs it on, and factory refuses a library business", (t) => {
+  blocked(precheck(host(t, { vars: { "bus.tester": true } })), /REFUSED bus\.tester is on; the library profile needs it off/);
+  blocked(precheck(host(t), { profile: "factory" }), /REFUSED bus\.tester is off; the factory profile needs it on/);
+  const on = precheck(host(t, { vars: { "bus.tester": true } }), { profile: "factory" });
+  assert.equal(on.code, 0, on.out);
+  const lib = host(t, { vars: { "bus.tester": true } });
+  const file = join(lib.configDir, "businesses", "acme.json");
+  const doc = JSON.parse(read(file));
+  doc.projects.stack.kind = "library";
+  writeJson(file, doc);
+  blocked(precheck(lib, { profile: "factory" }), /REFUSED profile-library-business: .* projects stack are library projects/);
+});
+
+test("the claude check runs only for a claude-code instance, and refuses a claude that appends or answers wrong", (t) => {
+  // No claude-code instance and no claude anywhere on PATH: the precheck passes.
+  const none = host(t);
+  const r = precheck(none, { path: pathWithoutClaude(none) });
+  assert.equal(r.code, 0, r.out);
+  assert.doesNotMatch(r.out, /--system-prompt-file|claude is installed/);
+
+  const good = host(t, { roles: { cto: { harness: "claude-code" } } });
+  fakeClaude(good.bin, "replace");
+  const pass = precheck(good);
+  assert.equal(pass.code, 0, pass.out);
+  assert.match(pass.out, /claude .*9\.9\.9 \(Claude Code, replace fake\)/);
+  assert.match(pass.out, /ok {6}claude replaces its prompt with --system-prompt-file \(40 input tokens\)/);
+
+  const bad = host(t, { roles: { cto: { harness: "claude-code" } } });
+  fakeClaude(bad.bin, "append");
+  blocked(precheck(bad), /REFUSED claude adds to its own prompt with --system-prompt-file: 9000 input tokens/);
+
+  const nomarker = host(t, { roles: { cto: { harness: "claude-code" } } });
+  fakeClaude(nomarker.bin, "nomarker");
+  blocked(precheck(nomarker), /REFUSED claude's reply to the marker prompt lacks the marker \(40 input tokens\)/);
+
+  const text = host(t, { roles: { cto: { harness: "claude-code" } } });
+  fakeClaude(text.bin, "text");
+  blocked(precheck(text), /REFUSED claude gave no JSON reply to the marker prompt/);
+
+  const missing = host(t, { roles: { cto: { harness: "claude-code" } } });
+  blocked(precheck(missing, { path: pathWithoutClaude(missing) }), /REFUSED an instance runs claude-code and no claude is installed/);
+});
+
+test("the claude check runs the bus unit's MOSAIC_CLAUDE_BIN over claude on PATH", (t) => {
+  const pinned = join(tmp(t, "case2-claude-"), "pinned");
+  const replace = fakeClaude(pinned, "replace");
+  const x = host(t, { roles: { cto: { harness: "claude-code" } }, busClaude: replace });
+  fakeClaude(x.bin, "append");
+  const r = precheck(x);
+  assert.equal(r.code, 0, r.out);
+  assert.match(r.out, /replace fake/);
+
+  const pinnedBad = join(tmp(t, "case2-claude-"), "pinned");
+  const append = fakeClaude(pinnedBad, "append");
+  const y = host(t, { roles: { cto: { harness: "claude-code" } }, busClaude: append });
+  fakeClaude(y.bin, "replace");
+  blocked(precheck(y), /REFUSED claude adds to its own prompt/);
+});
+
+test("the session env file refuses when missing, open to others, a symlink, empty, or emptied by a later line", (t) => {
+  blocked(precheck(host(t, { keyFile: null })), /REFUSED an instance's provider is zai and .*claude-session\.env is missing/);
+  const open = host(t);
+  chmodSync(join(open.secrets, "claude-session.env"), 0o644);
+  blocked(precheck(open), /REFUSED .*claude-session\.env must be owned by .* at 0600 \(mode 644\)/);
+  const link = host(t, { keyFile: null });
+  const real = join(link.root, "real.env");
+  writeFileSync(real, `ZAI_API_KEY=${FIXTURE_KEY}\n`);
+  chmodSync(real, 0o600);
+  symlinkSync(real, join(link.secrets, "claude-session.env"));
+  blocked(precheck(link), /REFUSED .*claude-session\.env is a symlink/);
+  blocked(precheck(host(t, { keyFile: "ZAI_API_KEY=\n" })), /REFUSED .*sets no nonempty ZAI_API_KEY/);
+  blocked(precheck(host(t, { keyFile: `ZAI_API_KEY=${FIXTURE_KEY}\nZAI_API_KEY=\n` })), /REFUSED .*sets no nonempty ZAI_API_KEY/);
+  const quoted = precheck(host(t, { keyFile: `ZAI_API_KEY=\nZAI_API_KEY="${FIXTURE_KEY}"\n` }));
+  assert.equal(quoted.code, 0, quoted.out);
+});
+
+// ---- the bind test (mos-1100) ----
+
+// A session can't take the Console's port: inside the sandbox a real session gets, a bind below
+// 1024 fails with EACCES, and the same bind on a free port of 1024 or above succeeds.
+const sandboxSkip = sandboxProblem() ?? false;
+const LOW_PORT = 980;
+test("inside a session's sandbox a bind below 1024 fails with EACCES, and a bind on a free high port succeeds", { skip: sandboxSkip, timeout: 30000 }, async (t) => {
+  const floor = Number(read("/proc/sys/net/ipv4/ip_unprivileged_port_start").trim());
+  assert.ok(floor > LOW_PORT, `this host's net.ipv4.ip_unprivileged_port_start is ${floor}, at or below the test port ${LOW_PORT}, so the test can't show the sandbox refuses it`);
+  const root = tmp(t, "c2b-");
+  const runDir = join(root, "run");
+  const workspace = join(root, "ws");
+  mkdirSync(runDir);
+  mkdirSync(workspace);
+  mkdirSync(join(runDir, "bundle"));
+  writeFileSync(join(runDir, "session.json"), "{}");
+  const adapter = join(root, "adapter.sh");
+  const brokerSocket = join(root, "broker.sock");
+  writeFileSync(adapter, "");
+  writeFileSync(brokerSocket, "");
+  prepareRun(runDir);
+  const list = binds({ runDir, workspace, adapter, harnessMounts: [], brokerSocket });
+  const high = await new Promise((done) => {
+    const s = createServer().listen(0, "127.0.0.1", () => { const { port } = s.address(); s.close(() => done(port)); });
+  });
+  const bindIn = (port) => {
+    const code = `require("net").createServer().on("error", (e) => { console.log(e.code); process.exit(0); }).listen(${port}, "127.0.0.1", function () { console.log("bound"); this.close(); });`;
+    const argv = sandboxArgv(list, runDir, [process.execPath, "-e", code], { business: "acme", role: "coder" });
+    const r = spawnSync(argv[0], argv.slice(1), { encoding: "utf8", timeout: 10000 });
+    assert.equal(r.status, 0, r.stderr);
+    return r.stdout.trim();
+  };
+  assert.equal(bindIn(LOW_PORT), "EACCES");
+  assert.equal(bindIn(high), "bound");
+});
@@ -1,8 +1,7 @@
 import test from 'node:test';
 import assert from 'node:assert/strict';
 import {execFileSync,spawnSync,spawn} from 'node:child_process';
-import {symlinkSync,unlinkSync,mkdtempSync,mkdirSync,writeFileSync,readFileSync,cpSync,rmSync,chmodSync,existsSync,statSync,readdirSync,lstatSync,readlinkSync} from 'node:fs';
-import {createHash} from 'node:crypto';
+import {symlinkSync,unlinkSync,mkdtempSync,mkdirSync,writeFileSync,readFileSync,cpSync,rmSync,chmodSync,existsSync,statSync} from 'node:fs';
 import {tmpdir} from 'node:os';
 import {join,dirname} from 'node:path';
 import {fileURLToPath} from 'node:url';
@@ -228,108 +227,3 @@ test('inherited drop-in unreadable directory or file refuses before writing',t=>
 unlinkSync(dropdir);mkdirSync(dropdir);const file=join(dropdir,'broken.conf');symlinkSync(join(s.root,'absent-file'),file);
 const broken=s.run('bus-service.sh',['install','--dir',units,'--no-reload']);assert.equal(broken.status,1);assert.ok(broken.stderr.includes(file));assert.equal(readFileSync(target,'utf8'),'previous unit bytes');
 });
-// Row 232: every file of a copy with its mode and bytes, for the byte-identical comparison.
-function tree(dir){
- const out=[];
- const walk=rel=>{for(const e of readdirSync(join(dir,rel),{withFileTypes:true}).sort((a,b)=>a.name<b.name?-1:1)){
-  const r=rel?`${rel}/${e.name}`:e.name,st=lstatSync(join(dir,r));
-  if(e.isDirectory()){out.push(`d ${(st.mode&0o7777).toString(8)} ${r}`);walk(r);}
-  else if(e.isSymbolicLink())out.push(`l ${r} ${readlinkSync(join(dir,r))}`);
-  else out.push(`f ${(st.mode&0o7777).toString(8)} ${r} ${createHash('sha256').update(readFileSync(join(dir,r))).digest('hex')}`);
- }};
- walk('');return out;
-}
-test('row 232: copy --bundle copies a SHA the bundle\'s refactor reaches, byte-identical to copy SHA, and refuses the rest',t=>{
- const s=setup(t),tmp=join(s.root,'t');mkdirSync(tmp);s.env.TMPDIR=tmp;
- const good=join(s.root,'good.bundle');git(s.repo,'bundle','create','-q',good,'refactor');
- const a=join(s.root,'copies-a'),b=join(s.root,'copies-b');
- let r=s.run('stack-copy.sh',['copy',s.id,'--copies',a]);assert.equal(r.status,0,r.stderr);
- r=s.run('stack-copy.sh',['copy','--bundle',good,s.id,'--copies',b]);assert.equal(r.status,0,r.stderr);
- const sum=createHash('sha256').update(readFileSync(good)).digest('hex'),release=git(s.repo,'show',`${s.id}:RELEASE`);
- assert.equal(r.stdout,`copied: ${join(b,s.id)}\nrelease: ${release}\nbundle sha256: ${sum}\n`);
- assert.deepEqual(tree(join(b,s.id)),tree(join(a,s.id)));
- assert.equal(statSync(join(b,s.id)).mode&0o777,0o555);
- const left=()=>readdirSync(tmp).filter(f=>f.startsWith('tmp.'));
- assert.deepEqual(left(),[],'the bundle\'s temporary repository is removed');
- // A second run finds the copy and still names the release.
- r=s.run('stack-copy.sh',['copy','--bundle',good,s.id,'--copies',b]);assert.equal(r.status,0,r.stderr);
- assert.equal(r.stdout,`exists: ${join(b,s.id)}\nrelease: ${release}\nbundle sha256: ${sum}\n`);
- // A relative bundle path works from the caller's directory.
- const c=join(s.root,'copies-c');
- r=spawnSync(join(s.repo,'scripts','stack-copy.sh'),['copy','--bundle','good.bundle',s.id,'--copies',c],{cwd:s.root,env:s.env,encoding:'utf8'});
- assert.equal(r.status,0,r.stderr);assert.deepEqual(tree(join(c,s.id)),tree(join(a,s.id)));
- // A commit on another branch of the bundle: the bundle carries it, refactor does not reach it.
- const side=git(s.repo,'commit-tree','-p',s.id,'-m','side',`${s.id}^{tree}`);git(s.repo,'update-ref','refs/heads/side',side);
- const both=join(s.root,'both.bundle');git(s.repo,'bundle','create','-q',both,'refactor','side');
- const only=join(s.root,'side.bundle');git(s.repo,'bundle','create','-q',only,'side');
- const corrupt=join(s.root,'corrupt.bundle'),bytes=readFileSync(good);bytes[bytes.length-30]^=0xff;writeFileSync(corrupt,bytes);
- const cut=join(s.root,'cut.bundle');writeFileSync(cut,readFileSync(good).subarray(0,200));
- const junk=join(s.root,'junk.bundle');writeFileSync(junk,'# v2 git bundle\nnot a ref line\n\n');
- const d=join(s.root,'copies-d');
- for(const [label,bundle,id,re] of [
-  ['not reachable',both,side,/not reachable from the bundle's refs\/heads\/refactor/],
-  ['no refactor',only,side,/no refs\/heads\/refactor/],
-  // verify reads the header and prerequisites; a damaged pack fails the fetch's own check.
-  ['not a bundle',junk,s.id,/git bundle verify failed/],
-  ['corrupt pack',corrupt,s.id,/cannot fetch/],
-  ['truncated pack',cut,s.id,/cannot fetch/],
-  ['absent',join(s.root,'none.bundle'),s.id,/bundle is absent/],
-  ['short id',good,s.id.slice(0,12),/full 40-character commit id/],
- ]){
-  r=s.run('stack-copy.sh',['copy','--bundle',bundle,id,'--copies',d]);
-  assert.equal(r.status,1,label);assert.match(r.stderr,re,label);assert.equal(r.stdout,'',label);
-  assert.ok(!existsSync(join(d,id)),label);assert.deepEqual(left(),[],label);
-  if(existsSync(d))assert.deepEqual(readdirSync(d),[],label);
- }
- const link=join(s.root,'link.bundle');symlinkSync(good,link);
- r=s.run('stack-copy.sh',['copy','--bundle',link,s.id,'--copies',d]);assert.equal(r.status,1);assert.match(r.stderr,/symlink/);
- for(const args of [['copy','--bundle',good,s.id,'--allow-worktree'],['copy','--bundle',good],['copy','--bundle'],['wrapper','--bundle',good,s.id],['check','--units','system'],['copy',s.id,'--units','external'],['copy',s.id,'--create']])
-  assert.equal(s.run('stack-copy.sh',args).status,4,args.join(' '));
-});
-test('row 232: wrapper --create writes the first wrapper only, the same bytes wrapper ID writes, and refuses over any file',t=>{
- const s=setup(t);assert.equal(s.run('stack-copy.sh',['copy',s.id,'--copies',s.copies]).status,0);
- const wrapper=join(s.bin,'mosaic'),root=join(s.copies,s.id);
- let r=s.run('stack-copy.sh',['wrapper',s.id,'--copies',s.copies,'--bin',s.bin]);
- assert.equal(r.status,1);assert.match(r.stderr,/wrapper is absent/,'no --create keeps the missing-wrapper refusal');assert.ok(!existsSync(wrapper));
- r=s.run('stack-copy.sh',['wrapper',s.id,'--copies',s.copies,'--bin',s.bin,'--create']);assert.equal(r.status,0,r.stderr);
- assert.equal(r.stdout,`wrapper: ${root}\n`);
- const created=readFileSync(wrapper,'utf8');assert.equal(statSync(wrapper).mode&0o777,0o755);
- r=s.run('stack-copy.sh',['wrapper',s.id,'--copies',s.copies,'--bin',s.bin]);assert.equal(r.status,0,r.stderr);
- assert.equal(r.stdout,`wrapper: ${root}\n`);assert.equal(readFileSync(wrapper,'utf8'),created,'wrapper ID writes the same bytes');
- const foreign='#!/bin/sh\n# not ours\n';
- for(const [label,make] of [['own wrapper',()=>{}],['foreign file',()=>writeFileSync(wrapper,foreign)],['symlink',()=>{rmSync(wrapper);symlinkSync(join(s.root,'elsewhere'),wrapper);}]]){
-  make();const before=existsSync(wrapper)||label==='symlink'?(label==='symlink'?readlinkSync(wrapper):readFileSync(wrapper,'utf8')):null;
-  r=s.run('stack-copy.sh',['wrapper',s.id,'--copies',s.copies,'--bin',s.bin,'--create']);
-  assert.equal(r.status,1,label);assert.match(r.stderr,/--create and a wrapper exists/,label);
-  assert.equal(label==='symlink'?readlinkSync(wrapper):readFileSync(wrapper,'utf8'),before,label);
-  assert.deepEqual(readdirSync(s.bin).filter(f=>f.startsWith('.')),[],`${label}: no temporary file left`);
- }
- // A named instance: --create writes mosaic-NAME as wrapper --instance does, once.
- assert.equal(s.run('bootstrap.sh',['--instance','alpha']).status,0);
- const named=join(s.bin,'mosaic-alpha');
- r=s.run('stack-copy.sh',['wrapper',s.id,'--instance','alpha','--copies',s.copies,'--bin',s.bin,'--create']);assert.equal(r.status,0,r.stderr);
- const first=readFileSync(named,'utf8');
- r=s.run('stack-copy.sh',['wrapper',s.id,'--instance','alpha','--copies',s.copies,'--bin',s.bin]);assert.equal(r.status,0,r.stderr);
- assert.equal(readFileSync(named,'utf8'),first);
- r=s.run('stack-copy.sh',['wrapper',s.id,'--instance','alpha','--copies',s.copies,'--bin',s.bin,'--create']);
- assert.equal(r.status,1);assert.match(r.stderr,/--create and a wrapper exists/);assert.equal(readFileSync(named,'utf8'),first);
-});
-test('row 232: check --units external reads the system units, the default reads the user units',t=>{
- const s=setup(t);assert.equal(s.run('stack-copy.sh',['copy',s.id,'--copies',s.copies]).status,0);
- assert.equal(s.run('stack-copy.sh',['wrapper',s.id,'--copies',s.copies,'--bin',s.bin,'--create']).status,0);
- const copy=join(s.copies,s.id),argv=join(s.root,'argv.log');
- s.fake(`echo "$*" >> '${argv}'; echo 'LoadState=loaded'; echo 'WorkingDirectory=${copy}'; case "$*" in *mosaic-bus*) echo 'ExecStart={ path=${copy}/scripts/mosaic ; argv[]=${copy}/scripts/mosaic bus start mosaic-stack --pm ; }';; *) echo 'ExecStart={ path=/usr/bin/node ; argv[]=/usr/bin/node ${copy}/packages/webui/src/cli.mjs serve ; }';; esac\n`);
- const want=`bus: ${copy}\nConsole: ${copy}\nCLI: ${copy}\n`;
- let r=s.run('stack-copy.sh',['check','--copies',s.copies,'--bin',s.bin,'--units','external']);assert.equal(r.status,0,r.stderr);assert.equal(r.stdout,want);
- assert.deepEqual(readFileSync(argv,'utf8').trimEnd().split('\n'),[
-  'show [email protected] -p LoadState -p WorkingDirectory -p ExecStart',
-  'show mosaic-webui.service -p LoadState -p WorkingDirectory -p ExecStart']);
- rmSync(argv);
- for(const args of [[],['--units','user']]){
-  r=s.run('stack-copy.sh',['check','--copies',s.copies,'--bin',s.bin,...args]);assert.equal(r.status,0,r.stderr);assert.equal(r.stdout,want);
-  assert.deepEqual(readFileSync(argv,'utf8').trimEnd().split('\n'),[
-   '--user show [email protected] -p LoadState -p WorkingDirectory -p ExecStart',
-   '--user show mosaic-webui.service -p LoadState -p WorkingDirectory -p ExecStart']);
-  rmSync(argv);
- }
-});
@@ -1,476 +0,0 @@
-// scripts/stack-release.sh --units external (row 232, #1734). Design: r6 section 4 and the section 7
-// test list, agents/darkwing/work/queue-195/DESIGN.md; deviations: agents/darkwing/work/queue-232/BUILD.md.
-// The stand-ins and the module fixture are stack-release.test.mjs's (stack-release-fixture.mjs).
-// Root's part (stop, unit install, start) runs here as the stand-in systemctl and bus-service.sh and
-// webui-service.sh installs; no sudo and no real unit.
-import test from 'node:test';
-import assert from 'node:assert/strict';
-import {execFileSync} from 'node:child_process';
-import {mkdirSync,writeFileSync,readFileSync,existsSync,readdirSync,rmSync,chmodSync,cpSync} from 'node:fs';
-import {DatabaseSync} from 'node:sqlite';
-import {join} from 'node:path';
-import {B,C,C1,COPIES,ROOT,SBIN,base,fault,lines,logLines,mk,pointer,repo,run,seed,sha,storeVersion,sysctl,tree,units} from './stack-release-fixture.mjs';
-
-// The commit row 232 builds on: the user-mode tests compare the candidate's calls and --plan bytes
-// with its scripts. A later row that changes user mode on purpose moves this.
-const BASE='cb5fdb064fb4f12edd045374dd463dfdc25c2b42';
-
-const X=(e)=>({...e,flags:[...e.flags,'--units','external']});
-const sh=(e,name,...a)=>execFileSync('bash',[join(repo,'scripts',name),...a],{env:e.env,encoding:'utf8',stdio:['ignore','pipe','pipe']});
-// Root's steps: R1/A2 stop, A4 install and start. offset is the start's SD_CLOCK_OFFSET.
-const down=(e)=>{sysctl(e,'stop',e.con);sysctl(e,'stop',e.bus)};
-const up=(e,copy,{pm=false,offset=0}={})=>{
- sh(e,'bus-service.sh','install','--copy',copy,'--copies',COPIES,...(pm?['--pm']:[]),'--claude',e.claude);
- sh(e,'webui-service.sh','install','--copy',copy,'--copies',COPIES,'--port',e.port,'--business','acme');
- execFileSync(join(SBIN,'systemctl'),['--user','start',e.bus],{env:{...e.env,SD_CLOCK_OFFSET:String(offset)}});
- sysctl(e,'start',e.con);
-};
-// The stack on B for acme, adopted under --units external, then stopped by root unless live.
-async function xseed(t,{pm=false,live=false}={}){
- const e=await mk(t);await seed(e,{pm,pointer:'none'});const x=X(e);
- const r=await run(x,'adopt','acme');assert.equal(r.code,0,r.err);
- if(!live)down(e);
- return {e,x};
-}
-const lastAct=(e)=>logLines(e).filter((o)=>o.result==='started').at(-1).activation;
-const rs=(e,a)=>join(e.state,'stack-rollback',a);
-const open=(e)=>{const m=new Set();for(const o of logLines(e)){if(!o.activation)continue;if(o.result==='started')m.add(o.activation);else m.delete(o.activation)}return [...m]};
-const mine=(e,a)=>logLines(e).filter((o)=>o.activation===a);
-const journalCalls=(e)=>lines(join(e.sd,'journal-since.log'));
-// A3: stop, stage TO. Returns the activation and the run.
-async function stage(e,x,to,...args){
- const r=await run(x,'activate',to,'acme',...args);
- return {r,a:r.code===0||r.code===1?lastAct(e):null};
-}
-// The started line's from, to and op on the activation's result line, and its backup the set's.
-function sameAsStarted(e,a){
- const [s,f,...more]=mine(e,a);assert.equal(more.length,0,JSON.stringify(mine(e,a)));
- assert.equal(s.result,'started');
- for(const k of ['op','from','to','activation'])assert.equal(f[k],s[k],k);
- assert.ok(['activate','rollback'].includes(f.op),f.op);
- assert.equal(f.units,'external');
- const b=join(rs(e,a),'BACKUP');assert.equal(f.backup,existsSync(b)?readFileSync(b,'utf8').trim():null);
- return f;
-}
-// B1's end state: one started and one result line, nothing open, no marker or FAILED, and a
-// following --plan that doesn't refuse interrupted-run.
-async function closed(e,x,a){
- sameAsStarted(e,a);
- assert.deepEqual(open(e),[]);
- for(const f of ['AWAITING-UNITS','FAILED'])assert.ok(!existsSync(join(rs(e,a),f)),f);
- const s=await run(x,'status','acme');assert.equal(s.code,0,s.err);
- assert.ok(!/interrupted run|awaiting units/.test(s.out),s.out);
- const p=await run(x,'activate',pointer(e).copy===C1?B:C1,'acme','--plan');
- assert.ok(!(p.out+p.err).includes('interrupted-run'),p.out+p.err);
-}
-const storeSha=(e)=>sha(e.store);
-const backupStore=(e,a)=>join(e.data,'backups','stack',a,'bus','bus.sqlite');
-
-test('row 232: confirm, revert, gate, --to and --expect-from need --units external; the user-only flags are usage under it',async(t)=>{
- const {e,x}=await xseed(t);
- const logs=logLines(e).length;
- for(const a of [['confirm',C1,'acme'],['revert',C1,'acme'],['gate',B,'acme','--since','1'],['rollback','acme','--to',B],['activate',C1,'acme','--plan','--expect-from',B]]){
-  const r=await run(e,...a);assert.equal(r.code,4,a.join(' '));assert.match(r.err,/^usage: stack-release.sh adopt BUSINESS\n/);
- }
- for(const a of [['activate',C1,'acme','--pm'],['activate',C1,'acme','--tester-port','7444'],['activate',C1,'acme','--no-proof'],['activate',C1,'acme','--no-send'],['activate',C1,'acme','--sso'],['activate',C1,'acme','--proof-header','X','--proof-file','/p'],['rollback','acme'],['gate',B,'acme'],['activate',C1,'acme','--expect-from',B],['confirm',C1,'acme','--rollback',B],['confirm',C1,'acme','--cause','A5']]){
-  const r=await run(x,...a);assert.equal(r.code,4,a.join(' '));
- }
- assert.equal(logLines(e).length,logs);
-});
-
-test('row 232: pm-on and activate --pm-after-harness refuse external-pm',async(t)=>{
- const {e,x}=await xseed(t);
- const p=await run(x,'pm-on','acme');assert.equal(p.code,3);
- assert.match(p.err,/^stack-release: refusing external-pm: under --units external the PM is a flag in root's bus unit/);
- const a=await run(x,'activate',C1,'acme','--pm-after-harness');assert.equal(a.code,3);
- assert.match(a.err,/^stack-release: refusing external-pm: /);
- const l=logLines(e).slice(-2);assert.deepEqual(l.map((o)=>[o.result,o.code,o.activation]),[['refused','external-pm',null],['refused','external-pm',null]]);
- assert.equal(readdirSync(e.state).includes('stack-rollback'),false);
-});
-
-test('row 232: units-running (N4) refuses while a unit is active and leaves the store, the log and TAKEN; failed counts as down',async(t)=>{
- const {e,x}=await xseed(t,{live:true});
- sysctl(e,'stop',e.con);
- const before=storeSha(e),logs=logLines(e).length;
- const r=await run(x,'activate',C,'acme','--migrate');assert.equal(r.code,3,r.out+r.err);
- assert.equal(r.err,`stack-release: refusing units-running: ${e.bus} is active; root stops the units first\n`);
- assert.equal(storeSha(e),before);assert.equal(storeVersion(e.store,true),'3g');
- const l=logLines(e).slice(logs);assert.deepEqual(l.map((o)=>[o.result,o.code,o.activation,o.units]),[['refused','units-running',null,'external']]);
- assert.ok(!existsSync(join(e.data,'backups')));assert.ok(!existsSync(join(e.state,'stack-rollback')));
- // The Console active and the bus stopped refuses too.
- sysctl(e,'stop',e.bus);sysctl(e,'start',e.con);
- const c=await run(x,'activate',C1,'acme');assert.equal(c.code,3);assert.ok(c.err.startsWith(`stack-release: refusing units-running: ${e.con} is active`),c.err);
- // A bus unit root's stop left failed is down.
- sysctl(e,'stop',e.con);
- const s=units(e);s[e.bus].state='failed';writeFileSync(join(e.sd,'units.json'),JSON.stringify(s));
- const f=await run(x,'activate',C1,'acme');assert.equal(f.code,0,f.out+f.err);
-});
-
-test('row 232: activate stages: the pointer stays, AWAITING-UNITS names TO, a backup of the stopped store, no directory in the set, no --user, no journal',async(t)=>{
- const {e,x}=await xseed(t);
- const p0=readFileSync(e.pointer,'utf8'),w0=sha(join(e.bin,'mosaic')),argv0=lines(join(e.sd,'argv.log')).length;
- const {r,a}=await stage(e,x,C1);assert.equal(r.code,0,r.out+r.err);
- assert.equal(r.out.split('\n').at(-2),`stack-release: activate staged ${C1} for acme as ${a}; root installs and starts the units, then runs confirm ${C1} acme --units external`);
- assert.equal(readFileSync(e.pointer,'utf8'),p0);
- assert.equal(readFileSync(join(rs(e,a),'AWAITING-UNITS'),'utf8'),`${C1}\n`);
- assert.deepEqual(readdirSync(rs(e,a)).sort(),['AWAITING-UNITS','BACKUP','SHA256SUMS','UNITS.sha256','WRAPPER_MODE','pointer',`show-${e.bus}.txt`,`show-${e.con}.txt`,'steps.log','wrapper'].sort());
- assert.equal(readFileSync(join(rs(e,a),'BACKUP'),'utf8'),`${a}\n`);
- assert.equal(sha(backupStore(e,a)),storeSha(e));assert.equal(readFileSync(join(e.data,'backups','stack',a,'SCHEMA'),'utf8'),'3g\n');
- assert.equal(readFileSync(join(rs(e,a),'UNITS.sha256'),'utf8'),`${sha(join(e.units,e.tmpl))}  ${join(e.units,e.tmpl)}\n${sha(join(e.units,e.con))}  ${join(e.units,e.con)}\n`);
- assert.equal(sha(join(rs(e,a),'wrapper')),w0);assert.notEqual(sha(join(e.bin,'mosaic')),w0);
- assert.deepEqual(mine(e,a).map((o)=>o.result),['started']);
- assert.deepEqual([units(e)[e.bus].state,units(e)[e.con].state],['inactive','inactive']);
- const ext=lines(join(e.sd,'argv.log')).slice(argv0);
- assert.ok(ext.length>0);for(const c of ext)assert.match(c,/^(show|is-active|list-units) /,c);
- assert.deepEqual(journalCalls(e),[]);
- const s=await run(x,'status','acme');assert.equal(s.code,0,s.err);
- assert.ok(s.out.includes(`awaiting units: ${a} (copy ${C1})\n`),s.out);assert.ok(s.out.includes(`interrupted run: ${a} `),s.out);
-});
-
-test('row 232: A3 order: capture-failed and marker-failed refuse with exit 3 and leave no marker or FAILED',async(t)=>{
- const {e,x}=await xseed(t);
- fault(e,'no-fragment');
- const r=await run(x,'activate',C1,'acme');assert.equal(r.code,3,r.out+r.err);
- assert.match(r.err,/^stack-release: refusing capture-failed: could not write the rollback set .*; nothing was changed\n$/);
- const a=lastAct(e);
- assert.deepEqual(mine(e,a).map((o)=>[o.result,o.code]),[['started',undefined],['refused','capture-failed']]);
- for(const f of ['AWAITING-UNITS','FAILED'])assert.ok(!existsSync(join(rs(e,a),f)),f);
- assert.deepEqual(open(e),[]);
- rmSync(join(e.sd,'faults','no-fragment'));
- // The set can't be made: marker-failed, for that activation.
- chmodSync(join(e.state,'stack-rollback'),0o555);
- const m=await run(x,'activate',C1,'acme');assert.equal(m.code,3,m.out+m.err);
- assert.match(m.err,/^stack-release: refusing marker-failed: could not make the rollback set .*; nothing was changed\n$/);
- const b=lastAct(e);assert.notEqual(b,a);
- assert.deepEqual(mine(e,b).map((o)=>[o.result,o.code]),[['started',undefined],['refused','marker-failed']]);
- chmodSync(join(e.state,'stack-rollback'),0o755);
- assert.deepEqual(open(e),[]);
-});
-
-test('row 232: confirm and revert refuse open-activation with no marker, two, the wrong copy, or one the log holds closed; refusals name no activation',async(t)=>{
- const {e,x}=await xseed(t);
- const tryBoth=async(id,why)=>{
-  for(const v of ['confirm','revert']){
-   const o=open(e),logs=logLines(e).length;
-   const r=await run(x,v,id,'acme');assert.equal(r.code,3,`${v} ${why}: ${r.out}${r.err}`);
-   assert.match(r.err,/^stack-release: refusing open-activation: /,why);
-   assert.deepEqual(logLines(e).slice(logs).map((l)=>[l.result,l.code,l.activation,l.op]),[['refused','open-activation',null,v]],why);
-   assert.deepEqual(open(e),o,why);
-  }
- };
- await tryBoth(C1,'no marker');
- // One marker whose activation the log never started. It sorts before any real one, so a confirm
- // that took the newest of two markers would take the real one.
- const fake=join(e.state,'stack-rollback','20000101T000000Z-'+C1.slice(0,12));
- mkdirSync(fake,{recursive:true});writeFileSync(join(fake,'AWAITING-UNITS'),`${C1}\n`);
- await tryBoth(C1,'marker not open');
- rmSync(fake,{recursive:true});
- const {r,a}=await stage(e,x,C1);assert.equal(r.code,0,r.out+r.err);
- await tryBoth(B,'wrong copy');
- mkdirSync(fake);writeFileSync(join(fake,'AWAITING-UNITS'),`${C1}\n`);
- await tryBoth(C1,'two markers');
- rmSync(fake,{recursive:true});
- // gate refuses nothing and writes nothing, open or not.
- const logs=readFileSync(e.log,'utf8');
- const g=await run(x,'gate',C1,'acme','--since','1','--timeout','1');assert.equal(g.code,1);
- assert.equal(readFileSync(e.log,'utf8'),logs);assert.deepEqual(open(e),[a]);
-});
-
-test('row 232: confirm polls: bus status good after 3 s fails with --timeout 1, writes FAILED and leaves the rest; FAILED then refuses activation-failed',async(t)=>{
- const {e,x}=await xseed(t);
- const {r,a}=await stage(e,x,C1);assert.equal(r.code,0,r.out+r.err);
- up(e,C1);
- const p0=readFileSync(e.pointer,'utf8'),l0=readFileSync(e.log,'utf8');
- fault(e,`status-until-${C1}`,String(Date.now()+3000));
- const c=await run(x,'confirm',C1,'acme','--timeout','1');assert.equal(c.code,1,c.out+c.err);
- assert.match(c.err,new RegExp(`^stack-release: activate failed with bus-status; ${a} stays open`));
- assert.equal(readFileSync(join(rs(e,a),'FAILED'),'utf8'),'bus-status\n');
- assert.equal(readFileSync(e.pointer,'utf8'),p0);assert.equal(readFileSync(e.log,'utf8'),l0);
- assert.ok(existsSync(join(rs(e,a),'AWAITING-UNITS')));
- const f=await run(x,'confirm',C1,'acme');assert.equal(f.code,3);
- assert.match(f.err,new RegExp(`^stack-release: refusing activation-failed: ${a} has a FAILED file`));
- assert.equal(logLines(e).at(-1).activation,null);assert.deepEqual(open(e),[a]);
-});
-
-test('row 232: confirm polls to a pass with --timeout 10: the pointer, an ok line that reads as the started run, no marker',async(t)=>{
- const {e,x}=await xseed(t);
- const {r,a}=await stage(e,x,C1);assert.equal(r.code,0,r.out+r.err);
- up(e,C1);
- fault(e,`status-until-${C1}`,String(Date.now()+3000));
- const c=await run(x,'confirm',C1,'acme','--timeout','10');assert.equal(c.code,0,c.out+c.err);
- assert.equal(c.out.split('\n').at(-2),`stack-release: activate ok: ${C1} is live for acme`);
- const p=pointer(e);assert.deepEqual([p.copy,p.activation,p.schema,p.pm,p.console],[C1,a,'3g',false,['--port',e.port,'--business','acme']]);
- const f=sameAsStarted(e,a);assert.deepEqual([f.result,f.op,f.from,f.to,f.backup],['ok','activate',B,C1,a]);
- assert.ok(!existsSync(join(rs(e,a),'AWAITING-UNITS')));
- assert.deepEqual(journalCalls(e),[]);
-});
-
-// N4 with the brief's numbers: the started line at 1792540800.900 floors to 1792540800. The host's
-// clock runs so boot status is after that second.
-const T0=1792540800,offsetTo=(s)=>Math.floor(Date.now()/1000)-s;
-function startedAt(e,a,ms){
- const l=readFileSync(e.log,'utf8').split('\n').map((x)=>{if(!x)return x;const o=JSON.parse(x);if(o.activation===a&&o.result==='started')o.at=new Date(ms).toISOString();return JSON.stringify(o)});
- writeFileSync(e.log,l.join('\n'));
-}
-
-test('row 232: stale-start: @1792540799 fails a start floor of 1792540800 with stale-start',async(t)=>{
- const {e,x}=await xseed(t);
- const {r,a}=await stage(e,x,C1);assert.equal(r.code,0,r.out+r.err);
- startedAt(e,a,T0*1000+900);up(e,C1,{offset:offsetTo(T0+100)});
- fault(e,'enter',JSON.stringify({value:T0-1}));
- const c=await run(x,'confirm',C1,'acme','--timeout','1');assert.equal(c.code,1,c.out+c.err);
- assert.ok(c.out.includes(`gate failed on ${C1}: stale-start (the bus started at @${T0-1}, before @${T0})`),c.out);
- assert.equal(readFileSync(join(rs(e,a),'FAILED'),'utf8'),'stale-start\n');
-});
-
-test('row 232: stale-start is a gate code: an enter time that turns to @1792540800 after 2 s passes with --timeout 10',async(t)=>{
- const {e,x}=await xseed(t);
- const {r,a}=await stage(e,x,C1);assert.equal(r.code,0,r.out+r.err);
- startedAt(e,a,T0*1000+900);up(e,C1,{offset:offsetTo(T0+100)});
- fault(e,'enter',JSON.stringify({value:T0-1,at:Date.now()+2000,then:T0}));
- const c=await run(x,'confirm',C1,'acme','--timeout','10');assert.equal(c.code,0,c.out+c.err);
- assert.equal(pointer(e).copy,C1);
-});
-
-test('row 232: gate (N2, A2f): --since 1792540800 passes @1792540800 and fails @1792540799; it writes nothing',async(t)=>{
- const {e,x}=await xseed(t);
- up(e,B,{offset:offsetTo(T0+100)});
- const snap=()=>[readFileSync(e.log,'utf8'),readFileSync(e.pointer,'utf8'),tree(e.state).join('\n')];
- const s0=snap();
- fault(e,'enter',JSON.stringify({value:T0}));
- const g=await run(x,'gate',B,'acme','--since',String(T0));assert.equal(g.code,0,g.out+g.err);
- assert.equal(g.out,`stack-release: gate passed on ${B}\n`);
- fault(e,'enter',JSON.stringify({value:T0-1}));
- const f=await run(x,'gate',B,'acme','--since',String(T0),'--timeout','1');assert.equal(f.code,1,f.out+f.err);
- assert.ok(f.out.includes(`gate failed on ${B}: stale-start (the bus started at @${T0-1}, before @${T0})`),f.out);
- assert.deepEqual(snap(),s0);
- const u=await run(x,'gate',B,'acme');assert.equal(u.code,4);
- assert.deepEqual(journalCalls(e),[]);
-});
-
-test('row 232: the external PM check reads launches list: one live run of launch.by since the start passes',async(t)=>{
- const {e,x}=await xseed(t,{pm:true});
- const cases=[['',0,''],['coder',0,''],['none',1,'no live launch of chief'],['twolive',1,'2 live launches of chief'],['early',1,'started before this start'],['dead',1,'no live launch of chief'],['other',1,'the launch of chief is for other']];
- for(const [mode,code,why] of cases){
-  rmSync(join(e.sd,'launches.json'),{force:true});
-  if(mode)fault(e,`pm-${B}`,mode);else rmSync(join(e.sd,'faults',`pm-${B}`),{force:true});
-  const since=Math.floor(Date.now()/1000);
-  up(e,B,{pm:true});
-  const g=await run(x,'gate',B,'acme','--since',String(since),'--timeout','1');assert.equal(g.code,code,`${mode}: ${g.out}${g.err}`);
-  if(why)assert.ok(g.out.includes(`gate failed on ${B}: pm-launch-unconfirmed (`)&&g.out.includes(why),`${mode}: ${g.out}`);
-  down(e);
- }
- assert.deepEqual(journalCalls(e),[]);
-});
-
-test('row 232: revert puts the wrapper back and leaves the store when nothing migrated',async(t)=>{
- const {e,x}=await xseed(t);
- const w0=sha(join(e.bin,'mosaic'));
- const {r,a}=await stage(e,x,C1);assert.equal(r.code,0,r.out+r.err);
- // A write to the stopped store after A3: revert has no MIGRATING, so it is not its to undo.
- const db=new DatabaseSync(e.store);db.prepare('INSERT INTO events (at) VALUES (?)').run('2001-01-01T00:00:00.000Z');db.close();
- const s1=storeSha(e);assert.notEqual(s1,sha(backupStore(e,a)));
- const v=await run(x,'revert',C1,'acme');assert.equal(v.code,0,v.out+v.err);
- assert.equal(v.out.split('\n').at(-2),`stack-release: revert ok: ${a}'s wrapper is back; root installs the old units next`);
- assert.equal(sha(join(e.bin,'mosaic')),w0);assert.equal(storeSha(e),s1);
- assert.deepEqual(mine(e,a).map((o)=>o.result),['started']);assert.ok(existsSync(join(rs(e,a),'AWAITING-UNITS')));
-});
-
-test('row 232: confirm --rollback refuses rollback-mismatch, and logs rollback-failed with exit 2 when OLD fails its gate',async(t)=>{
- const {e,x}=await xseed(t);
- const {r,a}=await stage(e,x,C1);assert.equal(r.code,0,r.out+r.err);
- const v=await run(x,'revert',C1,'acme');assert.equal(v.code,0,v.out+v.err);
- const m=await run(x,'confirm',C1,'acme','--rollback',C,'--cause','A5');assert.equal(m.code,3);
- assert.equal(m.err,`stack-release: refusing rollback-mismatch: ${C} is not the copy ${a} started from, ${B}\n`);
- assert.equal(logLines(e).at(-1).activation,null);assert.deepEqual(open(e),[a]);
- fault(e,`healthz-${B}`);up(e,B);
- const f=await run(x,'confirm',C1,'acme','--rollback',B,'--cause','A5','--timeout','1');assert.equal(f.code,2,f.out+f.err);
- assert.equal(f.err,`stack-release: rollback-failed: the run failed with unrecorded and the rollback with healthz; root stops the units. Rollback set: ${rs(e,a)}, backup ${join(e.data,'backups','stack',a)}\n`);
- const l=sameAsStarted(e,a);assert.deepEqual([l.result,l.code,l.rollback,l.rollbackCode],['rollback-failed','unrecorded','failed','healthz']);
- for(const n of ['AWAITING-UNITS','FAILED'])assert.ok(!existsSync(join(rs(e,a),n)),n);
- assert.deepEqual(open(e),[]);
-});
-
-test('row 232: confirm --rollback after a --restore swap logs rollbackCode not-attempted; rollback --restore finds an external backup',async(t)=>{
- const {e,x}=await xseed(t);
- const {r,a}=await stage(e,x,C,'--migrate');assert.equal(r.code,0,r.out+r.err);
- up(e,C);assert.equal((await run(x,'confirm',C,'acme')).code,0);
- down(e);
- const b=await run(x,'rollback','acme','--to',B,'--restore',a);assert.equal(b.code,0,b.out+b.err);
- const ra=lastAct(e);
- assert.ok(b.out.includes(`restore: ${join(e.data,'backups','stack',a)}; `),b.out);
- assert.ok(existsSync(join(rs(e,ra),'RESTORED')));assert.equal(readFileSync(join(rs(e,ra),'BACKUP'),'utf8'),`${a}\n`);
- assert.equal(storeSha(e),sha(backupStore(e,a)));
- const f=await run(x,'confirm',B,'acme','--rollback',C,'--cause','A4');assert.equal(f.code,2,f.out+f.err);
- const l=sameAsStarted(e,ra);assert.deepEqual([l.op,l.result,l.code,l.rollbackCode,l.backup],['rollback','rollback-failed','units-start','not-attempted',a]);
-});
-
-// --- B1: real sequences on one log ---
-
-test('row 232: sequence 1: activate, confirm times out, revert, confirm --rollback --cause A5: gate-failed rollback ok',async(t)=>{
- const {e,x}=await xseed(t);
- const w0=sha(join(e.bin,'mosaic')),p0=readFileSync(e.pointer,'utf8');
- const {r,a}=await stage(e,x,C1);assert.equal(r.code,0,r.out+r.err);
- fault(e,`healthz-${C1}`);up(e,C1);
- const c=await run(x,'confirm',C1,'acme','--timeout','1');assert.equal(c.code,1,c.out+c.err);
- assert.deepEqual(mine(e,a).map((o)=>o.result),['started']);
- down(e);
- assert.equal((await run(x,'revert',C1,'acme')).code,0);assert.equal(sha(join(e.bin,'mosaic')),w0);
- up(e,B);
- const k=await run(x,'confirm',C1,'acme','--rollback',B,'--cause','A5');assert.equal(k.code,1,k.out+k.err);
- assert.equal(k.err,`stack-release: healthz; rolled back to ${B}, which passed the gate\n`);
- const l=sameAsStarted(e,a);assert.deepEqual([l.result,l.code,l.rollback],['gate-failed','healthz','ok']);
- assert.equal(readFileSync(e.pointer,'utf8'),p0);
- await closed(e,x,a);
-});
-
-test('row 232: sequence 2: activate --migrate, the wrapper install fails, revert restores TAKEN, confirm --rollback --cause A3',async(t)=>{
- const {e,x}=await xseed(t);
- const s0=storeSha(e);
- chmodSync(e.bin,0o555);
- const {r,a}=await stage(e,x,C,'--migrate');chmodSync(e.bin,0o755);
- assert.equal(r.code,1,r.out+r.err);assert.match(r.err,new RegExp(`^stack-release: activate failed with wrapper; ${a} stays open`));
- assert.deepEqual(mine(e,a).map((o)=>o.result),['started']);
- for(const n of ['AWAITING-UNITS','MIGRATING'])assert.ok(existsSync(join(rs(e,a),n)),n);
- assert.equal(readFileSync(join(rs(e,a),'FAILED'),'utf8'),'wrapper\n');
- assert.equal(storeVersion(e.store,false),'3h');assert.equal(sha(backupStore(e,a)),s0);
- const v=await run(x,'revert',C,'acme');assert.equal(v.code,0,v.out+v.err);
- assert.equal(v.out.split('\n').at(-2),`stack-release: revert ok: ${a}'s wrapper and store are back; root installs the old units next`);
- assert.equal(storeSha(e),s0);
- // revert runs again: the store already matches, and nothing moves.
- const posts=readdirSync(e.data).filter((n)=>n.startsWith('bus.post-attempt-'));
- assert.equal((await run(x,'revert',C,'acme')).code,0);
- assert.deepEqual(readdirSync(e.data).filter((n)=>n.startsWith('bus.post-attempt-')),posts);
- up(e,B);
- const k=await run(x,'confirm',C,'acme','--rollback',B,'--cause','A3');assert.equal(k.code,1,k.out+k.err);
- const l=sameAsStarted(e,a);assert.deepEqual([l.result,l.code,l.rollback],['failed','wrapper','ok']);
- await closed(e,x,a);
-});
-
-test('row 232: sequence 3: activate, root\'s A4 fails, revert, confirm --rollback --cause A4: failed code units-start',async(t)=>{
- const {e,x}=await xseed(t);
- const {r,a}=await stage(e,x,C1);assert.equal(r.code,0,r.out+r.err);
- assert.equal((await run(x,'revert',C1,'acme')).code,0);
- up(e,B);
- const k=await run(x,'confirm',C1,'acme','--rollback',B,'--cause','A4');assert.equal(k.code,1,k.out+k.err);
- assert.equal(k.err,`stack-release: units-start; rolled back to ${B}, which passed the gate\n`);
- const l=sameAsStarted(e,a);assert.deepEqual([l.result,l.code,l.rollback],['failed','units-start','ok']);
- await closed(e,x,a);
-});
-
-test('row 232: sequence 4: a capture failure leaves nothing open, then A2f\'s gate OLD writes nothing',async(t)=>{
- const {e,x}=await xseed(t);
- fault(e,'no-fragment');
- const r=await run(x,'activate',C1,'acme');assert.equal(r.code,3,r.out+r.err);rmSync(join(e.sd,'faults','no-fragment'));
- const a=lastAct(e);assert.deepEqual(mine(e,a).map((o)=>[o.result,o.code]),[['started',undefined],['refused','capture-failed']]);
- assert.deepEqual(open(e),[]);
- const since=Math.floor(Date.now()/1000);up(e,B);
- const s0=[readFileSync(e.log,'utf8'),readFileSync(e.pointer,'utf8'),tree(e.state).join('\n')];
- const g=await run(x,'gate',B,'acme','--since',String(since));assert.equal(g.code,0,g.out+g.err);
- assert.deepEqual([readFileSync(e.log,'utf8'),readFileSync(e.pointer,'utf8'),tree(e.state).join('\n')],s0);
-});
-
-test('row 232: sequence 5: a confirm of the wrong copy is refused, and revert and confirm --rollback still close the activation',async(t)=>{
- const {e,x}=await xseed(t);
- const {r,a}=await stage(e,x,C1);assert.equal(r.code,0,r.out+r.err);
- up(e,C1);
- const w=await run(x,'confirm',B,'acme');assert.equal(w.code,3);assert.match(w.err,/^stack-release: refusing open-activation: /);
- assert.equal(logLines(e).at(-1).activation,null);assert.deepEqual(open(e),[a]);
- down(e);
- assert.equal((await run(x,'revert',C1,'acme')).code,0);
- up(e,B);
- const k=await run(x,'confirm',C1,'acme','--rollback',B,'--cause','A5');assert.equal(k.code,1,k.out+k.err);
- const l=sameAsStarted(e,a);assert.deepEqual([l.result,l.code,l.rollback],['gate-failed','unrecorded','ok']);
- await closed(e,x,a);
-});
-
-test('row 232: sequence 6: a revert that fails leaves the activation open, and the next --plan refuses interrupted-run',async(t)=>{
- const {e,x}=await xseed(t);
- const {r,a}=await stage(e,x,C1);assert.equal(r.code,0,r.out+r.err);
- rmSync(join(rs(e,a),'wrapper'));
- const v=await run(x,'revert',C1,'acme');assert.equal(v.code,1,v.out+v.err);
- assert.equal(v.err,`stack-release: revert failed: the rollback set has no saved wrapper; ${a} stays open. Rollback set: ${rs(e,a)}\n`);
- assert.deepEqual(open(e),[a]);assert.ok(existsSync(join(rs(e,a),'AWAITING-UNITS')));
- const p=await run(x,'activate',C,'acme','--plan','--migrate');assert.equal(p.code,3,p.out+p.err);
- assert.ok(p.out.includes(`refuses interrupted-run: activation ${a} started and has no final line`),p.out);
-});
-
-test('row 232: sequence 7: adopt, two confirmed activates, rollback --to the previous copy, confirmed, logs op rollback',async(t)=>{
- const {e,x}=await xseed(t);
- const one=await stage(e,x,C1);assert.equal(one.r.code,0,one.r.out+one.r.err);
- up(e,C1);assert.equal((await run(x,'confirm',C1,'acme')).code,0);down(e);
- const two=await stage(e,x,C,'--migrate');assert.equal(two.r.code,0,two.r.out+two.r.err);
- up(e,C);assert.equal((await run(x,'confirm',C,'acme')).code,0);down(e);
- const l1=sameAsStarted(e,one.a),l2=sameAsStarted(e,two.a);
- assert.deepEqual([l1.op,l1.result,l1.from,l1.to,l1.backup],['activate','ok',B,C1,one.a]);
- assert.deepEqual([l2.op,l2.result,l2.from,l2.to,l2.backup],['activate','ok',C1,C,two.a]);
- // N5: --expect-from names the copy root read from its units.
- const d1=await run(x,'activate',C1,'acme','--plan','--expect-from',C1);assert.equal(d1.code,3,d1.out+d1.err);
- assert.ok(d1.out.includes(`refuses pointer-differs: the pointer names ${C} and root's units name ${C1}; Jason or Mos settles it`),d1.out);
- const d2=await run(x,'rollback','acme','--to',C1,'--plan','--expect-from',B);assert.equal(d2.code,3,d2.out+d2.err);
- assert.ok(d2.out.includes(`refuses pointer-differs: the pointer names ${C} and root's units name ${B}`),d2.out);
- const ok=await run(x,'rollback','acme','--to',C1,'--restore',two.a,'--plan','--expect-from',C);assert.equal(ok.code,0,ok.out+ok.err);
- const logs=logLines(e).length;
- const no=await run(x,'rollback','acme','--to',B,'--plan');assert.equal(no.code,3);
- assert.equal(no.err,`stack-release: refusing to-not-previous: --to ${B} is not the previous copy; the log names ${C1}\n`);
- assert.equal(logLines(e).length,logs);
- const nr=await run(x,'rollback','acme','--to',B,'--restore',one.a);assert.equal(nr.code,3);assert.match(nr.err,/^stack-release: refusing to-not-previous: /);
- assert.deepEqual(logLines(e).slice(logs).map((o)=>[o.result,o.code,o.activation]),[['refused','to-not-previous',null]]);
- const rb=await run(x,'rollback','acme','--to',C1,'--restore',two.a);assert.equal(rb.code,0,rb.out+rb.err);
- const ra=lastAct(e);
- up(e,C1);
- const k=await run(x,'confirm',C1,'acme');assert.equal(k.code,0,k.out+k.err);
- assert.equal(k.out.split('\n').at(-2),`stack-release: rollback ok: ${C1} is live for acme`);
- const l3=sameAsStarted(e,ra);assert.deepEqual([l3.op,l3.result,l3.from,l3.to,l3.backup],['rollback','ok',C,C1,two.a]);
- assert.deepEqual([pointer(e).copy,pointer(e).schema],[C1,'3g']);
- const prev=await run(x,'rollback','acme','--to',B,'--plan');assert.match(prev.err,new RegExp(`the log names ${C}\\n$`));
- await closed(e,x,ra);
-});
-
-test('row 232: sequence 8: a migration that writes and fails: revert restores the backup byte for byte, confirm --rollback --cause A3',async(t)=>{
- const {e,x}=await xseed(t);
- const s0=storeSha(e);
- fault(e,'migrate-fails');
- const {r,a}=await stage(e,x,C,'--migrate');assert.equal(r.code,1,r.out+r.err);rmSync(join(e.sd,'faults','migrate-fails'));
- assert.equal(readFileSync(join(rs(e,a),'FAILED'),'utf8'),'migrate-failed\n');assert.ok(existsSync(join(rs(e,a),'MIGRATING')));
- assert.equal(storeVersion(e.store,false),'3h-partial');
- assert.equal((await run(x,'revert',C,'acme')).code,0);
- assert.equal(storeSha(e),s0);assert.equal(storeSha(e),sha(backupStore(e,a)));
- assert.deepEqual(readdirSync(join(e.data,'bus')),readdirSync(join(e.data,'backups','stack',a,'bus')));
- up(e,B);
- const k=await run(x,'confirm',C,'acme','--rollback',B,'--cause','A3');assert.equal(k.code,1,k.out+k.err);
- const l=sameAsStarted(e,a);assert.deepEqual([l.result,l.code,l.rollback],['failed','migrate-failed','ok']);
- await closed(e,x,a);
-});
-
-// --- User mode against the base ---
-
-// The fixture repo with the base's two scripts: everything else is the same tree and history.
-const baseRepo=join(base,'base-repo');
-cpSync(repo,baseRepo,{recursive:true});
-for(const f of ['scripts/stack-release.sh','scripts/stack-copy.sh'])writeFileSync(join(baseRepo,f),execFileSync('git',['-C',ROOT,'show',`${BASE}:${f}`]),{mode:0o755});
-const BASE_SR=join(baseRepo,'scripts','stack-release.sh');
-
-test('row 232: user mode: every systemctl call carries --user, and activate, rollback and check make the base\'s calls',async(t)=>{
- const calls=async(sr,dir)=>{
-  const e=await mk(t);e.sr=sr;await seed(e);
-  const n=lines(join(e.sd,'argv.log')).length;
-  const a=await run(e,'activate',C1,'acme');assert.equal(a.code,0,a.out+a.err);
-  const r=await run(e,'rollback','acme');assert.equal(r.code,0,r.out+r.err);
-  execFileSync('bash',[join(dir,'scripts','stack-copy.sh'),'check','--copies',COPIES,'--bin',e.bin,'--business','acme'],{env:e.env,stdio:'ignore'});
-  return lines(join(e.sd,'argv.log')).slice(n).map((l)=>l.split(e.root).join('<root>').split(e.port).join('<port>'));
- };
- const cand=await calls(undefined,repo),old=await calls(BASE_SR,baseRepo);
- assert.ok(cand.length>20);
- for(const c of cand)assert.match(c,/^--user /,c);
- assert.deepEqual(cand,old);
-});
-
-test('row 232: user mode: a default activate --plan prints the base\'s bytes',async(t)=>{
- const e=await mk(t);await seed(e);
- for(const a of [['activate',C1,'acme','--plan'],['activate',C,'acme','--plan','--migrate'],['activate',C,'acme','--plan'],['rollback','acme','--plan']]){
-  const cand=await run(e,...a),old=await run({...e,sr:BASE_SR},...a);
-  assert.deepEqual(cand,old,a.join(' '));
- }
- assert.ok(!existsSync(join(e.state,'stack-rollback')));
-});
@@ -1,451 +0,0 @@
-// The stack-release stand-ins and module fixture, shared by stack-release.test.mjs and
-// stack-release-external.test.mjs (row 232). Moved unchanged from stack-release.test.mjs, plus
-// what the external tests need; each test file runs in its own process, so each gets its own base.
-import test, {after} from 'node:test';
-import assert from 'node:assert/strict';
-import {execFileSync,spawn,spawnSync} from 'node:child_process';
-import {mkdtempSync,mkdirSync,writeFileSync,readFileSync,appendFileSync,cpSync,rmSync,chmodSync,existsSync,statSync,lstatSync,symlinkSync,linkSync,readdirSync,realpathSync} from 'node:fs';
-import {createServer} from 'node:http';
-import {createHash} from 'node:crypto';
-import {DatabaseSync} from 'node:sqlite';
-import {tmpdir} from 'node:os';
-import {join,dirname,basename} from 'node:path';
-import {fileURLToPath,pathToFileURL} from 'node:url';
-import {once} from 'node:events';
-
-export const ROOT=fileURLToPath(new URL('../../..',import.meta.url)).replace(/\/$/,'');
-export const NODE=process.execPath;
-export const MARKER='# mosaic-cli wrapper (Q81, agents/sage/work/q81/mosaic-cli.sh)';
-export const BUS='[email protected]',CON='mosaic-webui.service';
-export const git=(cwd,...args)=>execFileSync('git',['-c','user.name=fixture','-c','user.email=fixture@invalid','-c','commit.gpgsign=false','-c','core.hooksPath=/dev/null','-C',cwd,...args],{encoding:'utf8'}).trim();
-export const script=(fn)=>`#!${NODE}\n(${fn})();\n`;
-
-// --- Stand-ins. Each is serialized into its own file, so it uses only process and its own scope. ---
-
-// systemctl --user: unit state in $SD_STATE/units.json, every call in calls.log. A bus start runs
-// holder.cjs (the store held open in WAL mode, writer.lock, host.json) and, with --pm in the unit's
-// ExecStart, writes the `launched` journal line and the launches entry unless a pm-<copy> fault
-// names another case. Faults are files in $SD_STATE/faults named for the copy they hit. Units of a
-// named instance (row 190) run on their own data root and host files beside the default's.
-export function systemctl(){
- const fs=process.getBuiltinModule('node:fs'),path=process.getBuiltinModule('node:path'),cp=process.getBuiltinModule('node:child_process'),crypto=process.getBuiltinModule('node:crypto');
- const sd=process.env.SD_STATE,data=process.env.SD_DATA,unitDir=path.join(process.env.XDG_CONFIG_HOME,'systemd','user');
- const args=process.argv.slice(2).filter((a)=>a!=='--user'),[verb,...rest]=args;
- fs.appendFileSync(path.join(sd,'calls.log'),args.join(' ')+'\n');
- // Row 232: argv.log keeps each call as given, --user and all, for the user/external argv tests.
- fs.appendFileSync(path.join(sd,'argv.log'),process.argv.slice(2).join(' ')+'\n');
- const faultFile=(n)=>path.join(sd,'faults',n),fault=(n)=>fs.existsSync(faultFile(n));
- const stFile=path.join(sd,'units.json');
- const load=()=>{try{return JSON.parse(fs.readFileSync(stFile,'utf8'))}catch{return {}}};
- const save=(s)=>{fs.writeFileSync(stFile+'.tmp',JSON.stringify(s));fs.renameSync(stFile+'.tmp',stFile)};
- const sleep=(ms)=>Atomics.wait(new Int32Array(new SharedArrayBuffer(4)),0,0,ms);
- const alive=(pid)=>{try{const s=fs.readFileSync(`/proc/${pid}/stat`,'utf8');return s[s.lastIndexOf(')')+2]!=='Z'}catch{return false}};
- // Row 190: a bus unit is the default's mosaic-bus@B or instance NAME's mosaic-bus-NAME@B; %i is B.
- const isBus=(u)=>/^mosaic-bus(-[a-z][a-z0-9]{1,15})?@[a-z0-9-]+\.service$/.test(u),inst=(u)=>u.slice(u.indexOf('@')+1,-'.service'.length);
- const unitFile=(u)=>{
-  const main=isBus(u)?u.replace(/@[^@]*$/,'@.service'):u,file=path.join(unitDir,main);
-  if(!fs.existsSync(file))return null;
-  // The drop-in directories in systemd's order: service.d, the name cut after each hyphen, then
-  // the template's and the unit's own.
-  const stem=main.slice(0,main.search(/@?\.service$/)),dirs=['service.d'],drops=[];
-  for(let i=0;i<stem.length;i++)if(stem[i]==='-')dirs.push(stem.slice(0,i+1)+'.service.d');
-  for(const d of [...dirs,...(isBus(u)?[main+'.d',u+'.d']:[u+'.d'])]){const dir=path.join(unitDir,d);if(fs.existsSync(dir))for(const f of fs.readdirSync(dir).sort())if(f.endsWith('.conf'))drops.push(path.join(dir,f))}
-  const r={file,wd:'',exec:'',env:[],drops};
-  for(const f of [file,...drops])for(let line of fs.readFileSync(f,'utf8').split('\n')){
-   line=line.replace(/%i/g,isBus(u)?inst(u):'').replace(/%h/g,process.env.HOME);
-   const m=/^(WorkingDirectory|ExecStart|Environment)=(.*)$/.exec(line);if(!m)continue;
-   if(m[1]==='WorkingDirectory')r.wd=m[2];else if(m[1]==='ExecStart'){if(m[2])r.exec=m[2]}else r.env.push(m[2]);
-  }
-  return r;
- };
- // A named instance's unit sets MOSAIC_CONFIG, and its bus works on that config's data root. A unit
- // without it is the default's, on $SD_DATA. Each data root has its own host and launches files.
- const dataOf=(f)=>{const c=f&&f.env.find((v)=>v.startsWith('MOSAIC_CONFIG='));return c?JSON.parse(fs.readFileSync(c.slice('MOSAIC_CONFIG='.length),'utf8')).dataRoot:data};
- const perData=(d,n)=>path.join(sd,d===data?`${n}.json`:`${n}-${path.basename(d)}.json`);
- const snap=(ev,d)=>{
-  const dir=path.join(d,'bus'),files={};
-  try{for(const n of fs.readdirSync(dir).sort()){const p=path.join(dir,n),st=fs.statSync(p);if(st.isFile())files[n]=[st.size,st.mtimeMs,crypto.createHash('sha256').update(fs.readFileSync(p)).digest('hex')]}}catch{}
-  fs.appendFileSync(path.join(sd,'snap.jsonl'),JSON.stringify({ev,files})+'\n');
- };
- const pm=(unit,d,id,pid,off)=>{
-  let mode='';try{mode=fs.readFileSync(faultFile(`pm-${id}`),'utf8').trim()}catch{}
-  const b=inst(unit),now=Date.now()-off*1000,epoch=Math.floor(now/1000),at=new Date(now).toISOString(),run=`run-${pid}`;
-  const line=(text)=>fs.appendFileSync(path.join(sd,'journal.jsonl'),JSON.stringify({epoch,unit,text})+'\n');
-  const ok=()=>line(`launched pm-${b}: run ${run}, claude opus`);
-  const lf=perData(d,'launches');let list=[];try{list=JSON.parse(fs.readFileSync(lf,'utf8'))}catch{}
-  // instance is launch.by's, chief in the example business, as the external PM check reads (row 232).
-  const entry=(o)=>list.push({run,instance:'chief',business:b,live:true,startedAt:at,...o});
-  line(`bus host up: business ${b}, socket /fixture/bus.sock, notifier off`);
-  switch(mode){
-   case 'none':break;
-   case 'two':ok();line(`launched pm-${b}: run ${run}b, claude opus`);entry({});break;
-   case 'badword':line(`launched pm-${b}: job ${run}, claude opus`);entry({});break;
-   case 'notlisted':ok();break;
-   case 'early':ok();entry({startedAt:new Date(now-3600e3).toISOString()});break;
-   case 'human':entry({run:`human-${pid}`});break;
-   case 'other':ok();entry({business:'other'});break;
-   case 'dead':ok();entry({live:false});break;
-   // Row 232: two live entries for the PM's instance, and one for it beside a live coder run.
-   case 'twolive':ok();entry({});entry({run:`${run}b`});break;
-   case 'coder':ok();entry({});entry({run:`${run}c`,instance:'coder'});break;
-   default:ok();entry({});
-  }
-  fs.writeFileSync(lf,JSON.stringify(list));
- };
- if(verb==='show'){
-  // `show [--timestamp=unix] UNIT -p P...` and `show -p P UNIT`, as the external path calls it.
-  let u='';const props=[];for(let i=0;i<rest.length;i++){if(rest[i]==='-p')props.push(rest[++i]);else if(!rest[i].startsWith('--'))u=rest[i]}
-  const f=unitFile(u),st=load()[u]||{},id=f?path.basename(f.wd):'';
-  // ActiveEnterTimestamp (row 232) is the start's second, or what the enter fault says: a JSON
-  // {value} or {value,at,then}, which answers then from epoch ms at on.
-  const enter=()=>{
-   if(!fault('enter'))return st.enter;
-   const o=JSON.parse(fs.readFileSync(faultFile('enter'),'utf8'));return o.at!==undefined&&Date.now()>=o.at?o.then:o.value;
-  };
-  for(const p of props){
-   if(p==='LoadState')console.log(`LoadState=${f?'loaded':'not-found'}`);
-   else if(p==='WorkingDirectory')console.log(`WorkingDirectory=${f?f.wd+(!isBus(u)&&fault(`check-${id}`)?'-moved':''):''}`);
-   else if(p==='ExecStart')console.log(f&&f.exec?`ExecStart={ path=${f.exec.split(' ')[0]} ; argv[]=${f.exec} ; ignore_errors=no ; start_time=[n/a] ; stop_time=[n/a] ; pid=0 ; code=(null) ; status=0/0 }`:'ExecStart=');
-   else if(p==='Environment')console.log(`Environment=${f?f.env.join(' '):''}`);
-   else if(p==='MainPID')console.log(`MainPID=${st.pid||0}`);
-   else if(p==='DropInPaths')console.log(`DropInPaths=${f?f.drops.join(' '):''}`);
-   else if(p==='FragmentPath')console.log(`FragmentPath=${f&&!fault('no-fragment')?f.file:''}`);
-   else if(p==='ActiveEnterTimestamp'){const v=st.state==='active'?enter():undefined;console.log(`ActiveEnterTimestamp=${v===undefined?'':'@'+v}`)}
-  }
-  process.exit(0);
- }
- if(verb==='is-active'){
-  const q=rest[0]==='--quiet',u=q?rest[1]:rest[0];let s=(load()[u]||{}).state||'inactive';
-  // bus-stops-after N (T29): the next N bus checks answer the real state, every later one answers
-  // inactive, and units.json stays as it is, as if the bus stopped between two checks.
-  if(isBus(u)&&fault('bus-stops-after')){const n=Number(fs.readFileSync(faultFile('bus-stops-after'),'utf8'));if(n>0)fs.writeFileSync(faultFile('bus-stops-after'),String(n-1));else s='inactive'}
-  if(!q)console.log(s);process.exit(s==='active'?0:3);
- }
- if(verb==='is-enabled'){console.log('disabled');process.exit(1)}
- if(verb==='daemon-reload')process.exit(0);
- if(verb==='list-units'){
-  if(fault('list-fails'))process.exit(1);
-  const pats=rest.filter((a)=>!a.startsWith('--')).map((p)=>new RegExp('^'+p.replace(/\./g,'\\.').replace(/\*/g,'.*')+'$'));
-  for(const [u,s] of Object.entries(load()))if(pats.some((re)=>re.test(u)))console.log(`${u} loaded ${s.state} ${s.state==='active'?'running':'dead'} fixture`);
-  process.exit(0);
- }
- if(verb==='start'){
-  const u=rest[0],f=unitFile(u);if(!f){console.error(`Unit ${u} not found.`);process.exit(5)}
-  const s=load(),id=path.basename(f.wd),d=dataOf(f);
-  const enter=Math.floor((Date.now()-Number(process.env.SD_CLOCK_OFFSET||'0')*1000)/1000);
-  if(!isBus(u)){s[u]={state:'active',pid:null,wd:f.wd,enter};save(s);process.exit(0)}
-  if(fault(`start-dies-${id}`)){s[u]={state:'failed',pid:null,wd:f.wd};save(s);process.exit(0)}
-  // Row 185 (T48): the copy's start writes one event before the holder opens the store, so the
-  // store differs from a backup the run took before the start. The close leaves no -wal.
-  if(fault(`start-writes-row-${id}`)){
-   const db=new (process.getBuiltinModule('node:sqlite').DatabaseSync)(path.join(d,'bus','bus.sqlite'));
-   db.prepare('INSERT INTO events (at) VALUES (?)').run('2999-01-01T00:00:00.000Z');db.close();
-  }
-  snap('start',d);
-  const off=process.env.SD_CLOCK_OFFSET||'0';
-  // The holder must not inherit stack-release.sh's lock (fd 9) or any other fd above 2.
-  const close='for fd in /proc/self/fd/*; do n=${fd##*/}; [ "$n" -gt 2 ] && eval "exec $n>&-" 2>/dev/null; done; exec "$@"';
-  const ch=cp.spawn('bash',['-c',close,'holder',process.execPath,path.join(__dirname,'..','holder.cjs'),d,inst(u),sd,off,perData(d,'host')],{detached:true,stdio:'ignore'});
-  ch.unref();
-  fs.appendFileSync(path.join(sd,'pids.log'),ch.pid+'\n');
-  const ready=path.join(sd,`ready-${ch.pid}`),end=Date.now()+10000;
-  while(!fs.existsSync(ready)){if(Date.now()>end){console.error('fixture holder did not start');process.exit(1)}sleep(20)}
-  s[u]={state:'active',pid:ch.pid,wd:f.wd,enter};save(s);
-  if(f.exec.split(' ').slice(1).includes('--pm'))pm(u,d,id,ch.pid,Number(off));
-  process.exit(0);
- }
- if(verb==='stop'){
-  const u=rest[0],s=load(),st=s[u];
-  if(st&&st.pid){
-   try{process.kill(st.pid,'SIGTERM')}catch{}
-   const end=Date.now()+10000;while(alive(st.pid)&&Date.now()<end)sleep(20);
-   if(alive(st.pid))try{process.kill(st.pid,'SIGKILL')}catch{}
-  }
-  if(st){s[u]={...st,state:'inactive',pid:null};save(s)}
-  if(isBus(u)){
-   const d=dataOf(unitFile(u));
-   // One-shot: the stop leaves an empty -wal or -shm beside the store, as an unclean close would.
-   for(const [name,ext] of [['stop-leaves-wal','-wal'],['stop-leaves-shm','-shm']])if(fault(name)){fs.rmSync(faultFile(name));fs.writeFileSync(path.join(d,'bus','bus.sqlite'+ext),'')}
-   // One-shot (T45): the stop writes one row after any STAMP into the table the fault names, as a
-   // write the bus made between rollback's count and its stop would. The close leaves no -wal.
-   if(fault('stop-writes-row')){
-    const t=fs.readFileSync(faultFile('stop-writes-row'),'utf8');fs.rmSync(faultFile('stop-writes-row'));
-    const db=new (process.getBuiltinModule('node:sqlite').DatabaseSync)(path.join(d,'bus','bus.sqlite'));
-    db.exec(`CREATE TABLE IF NOT EXISTS ${t} (seq INTEGER PRIMARY KEY, at TEXT NOT NULL)`);
-    db.prepare(`INSERT INTO ${t} (at) VALUES (?)`).run('2999-01-01T00:00:00.000Z');db.close();
-   }
-   snap('stop',d);
-  }
-  process.exit(0);
- }
- console.error(`fixture systemctl: unsupported: ${args.join(' ')}`);process.exit(1);
-}
-
-// journalctl --user -u UNIT --since @EPOCH -o cat. A bare local time gets exit 1, as M35 needs.
-export function journalctl(){
- const fs=process.getBuiltinModule('node:fs'),path=process.getBuiltinModule('node:path');
- const sd=process.env.SD_STATE,a=process.argv.slice(2);let unit='',since='';
- for(let i=0;i<a.length;i++){if(a[i]==='-u')unit=a[++i];else if(a[i]==='--since')since=a[++i]}
- fs.appendFileSync(path.join(sd,'journal-since.log'),since+'\n');
- if(fs.existsSync(path.join(sd,'faults','journal-fails')))process.exit(1);
- let from;
- if(/^@\d+$/.test(since))from=Number(since.slice(1));
- else{const m=/^(\d{4}-\d\d-\d\d) (\d\d:\d\d:\d\d) UTC$/.exec(since);if(!m)process.exit(1);from=Date.parse(`${m[1]}T${m[2]}Z`)/1000}
- let lines=[];try{lines=fs.readFileSync(path.join(sd,'journal.jsonl'),'utf8').split('\n').filter(Boolean).map((l)=>JSON.parse(l))}catch{}
- for(const o of lines)if(o.unit===unit&&o.epoch>=from)console.log(o.text);
-}
-
-export function systemdAnalyze(){
- const fs=process.getBuiltinModule('node:fs'),path=process.getBuiltinModule('node:path');
- if(process.argv[2]!=='--user'||process.argv[3]!=='unit-paths')process.exit(1);
- console.log(path.join(process.env.XDG_CONFIG_HOME,'systemd','user'));
- // The unit-path fault adds its text as one more path, as T28's relative path needs.
- const extra=path.join(process.env.SD_STATE,'faults','unit-path');
- if(fs.existsSync(extra))console.log(fs.readFileSync(extra,'utf8'));
-}
-
-// The bus host: holds the store open in WAL mode until SIGTERM, as the broker does. It writes its
-// status to the host file systemctl names for its data root.
-export function holder(){
- const fs=process.getBuiltinModule('node:fs'),path=process.getBuiltinModule('node:path'),{DatabaseSync}=process.getBuiltinModule('node:sqlite');
- const [data,business,sd,offset,host]=process.argv.slice(2),bus=path.join(data,'bus');
- fs.mkdirSync(bus,{recursive:true,mode:0o700});
- const db=new DatabaseSync(path.join(bus,'bus.sqlite'));
- if(!db.prepare("SELECT count(*) AS n FROM sqlite_master WHERE name='meta'").get().n){
-  db.exec('PRAGMA journal_mode=WAL');
-  db.exec('CREATE TABLE meta (key TEXT PRIMARY KEY, value TEXT NOT NULL)');
-  db.exec('CREATE TABLE events (id INTEGER PRIMARY KEY, at TEXT NOT NULL)');
-  db.prepare("INSERT INTO meta VALUES ('schema_version', '3g')").run();
- }
- fs.writeFileSync(path.join(bus,'writer.lock'),String(process.pid));
- const at=new Date(Date.now()-Number(offset||0)*1000).toISOString();
- fs.writeFileSync(host+'.tmp',JSON.stringify({host:{business,pid:process.pid,live:true,startedAt:at,notifier:'ok'},boot:{ok:true,business,at}}));
- fs.renameSync(host+'.tmp',host);
- process.on('SIGTERM',()=>{db.close();fs.rmSync(path.join(bus,'writer.lock'),{force:true});process.exit(0)});
- fs.writeFileSync(path.join(sd,`ready-${process.pid}`),'');
- setInterval(()=>{},1<<30);
-}
-
-// A copy's scripts/mosaic: bus status and launches list from what the holder and systemctl wrote
-// for the data root of the config it runs under (row 190), the default's being $SD_DATA.
-export function mosaicStub(){
- const fs=process.getBuiltinModule('node:fs'),path=process.getBuiltinModule('node:path');
- const id=path.basename(path.resolve(__dirname,'..')),sd=process.env.SD_STATE,a=process.argv.slice(2).join(' ');
- const fault=(n)=>fs.existsSync(path.join(sd,'faults',n));
- let d=process.env.SD_DATA;try{d=JSON.parse(fs.readFileSync(process.env.MOSAIC_CONFIG,'utf8')).dataRoot}catch{}
- const perData=(n)=>path.join(sd,d===process.env.SD_DATA?`${n}.json`:`${n}-${path.basename(d)}.json`);
- const alive=(pid)=>{try{const s=fs.readFileSync(`/proc/${pid}/stat`,'utf8');return s[s.lastIndexOf(')')+2]!=='Z'}catch{return false}};
- if(a==='bus status --json'){
-  if(fault(`status-${id}`))process.exit(1);
-  // Row 232: status-until-<copy> fails bus status until the epoch ms it holds.
-  const until=path.join(sd,'faults',`status-until-${id}`);
-  if(fs.existsSync(until)&&Date.now()<Number(fs.readFileSync(until,'utf8')))process.exit(1);
-  let s={host:null,boot:null};
-  try{s=JSON.parse(fs.readFileSync(perData('host'),'utf8'));s.host.live=alive(s.host.pid)}catch{}
-  console.log(JSON.stringify(s));
- }else if(a==='bus status')console.log(`bus: fixture status for ${id}`);
- else if(a==='launches list --json'){
-  if(fault(`launches-${id}`))process.exit(1);
-  let l=[];try{l=JSON.parse(fs.readFileSync(perData('launches'),'utf8'))}catch{}
-  console.log(JSON.stringify(l));
- }else{console.error(`fixture mosaic: ${a}`);process.exit(4)}
-}
-
-// A copy's migrate-schema.mjs: records the backups it saw, then sets 3h, or 3h-partial and exit 1.
-export function migrateStub(){
- const fs=process.getBuiltinModule('node:fs'),path=process.getBuiltinModule('node:path'),{DatabaseSync}=process.getBuiltinModule('node:sqlite');
- const data=process.argv[2],sd=process.env.SD_STATE,dir=path.join(data,'backups','stack');
- const backups=fs.existsSync(dir)?fs.readdirSync(dir).sort().map((name)=>({name,sums:fs.existsSync(path.join(dir,name,'SHA256SUMS'))})):[];
- fs.writeFileSync(path.join(sd,'migrate.json'),JSON.stringify({backups}));
- const fail=fs.existsSync(path.join(sd,'faults','migrate-fails'));
- const db=new DatabaseSync(path.join(data,'bus','bus.sqlite'));
- db.prepare("UPDATE meta SET value=? WHERE key='schema_version'").run(fail?'3h-partial':'3h');db.close();
- if(fail)process.exit(1);
- console.log('fixture migrate: 3h');
-}
-
-// --- The module fixture: one repo, its copies and the stand-ins, shared by every test. ---
-
-export const base=realpathSync(mkdtempSync(join(tmpdir(),'stack-release-')));
-after(()=>{execFileSync('chmod',['-R','u+w',base]);rmSync(base,{recursive:true,force:true})});
-export const repo=join(base,'repo'),COPIES=join(base,'copies'),SBIN=join(base,'sbin');
-mkdirSync(repo);mkdirSync(COPIES);mkdirSync(SBIN);
-writeFileSync(join(base,'package.json'),'{"type":"commonjs"}\n');
-export const tracked=execFileSync('git',['-C',ROOT,'ls-files','-co','--exclude-standard','--','scripts','packages','adapters','roles','RELEASE','package.json','package-lock.json',':!packages/*/tests',':!scripts/foundation'],{encoding:'utf8'}).trim().split('\n');
-for(const f of tracked)if(existsSync(join(ROOT,f)))cpSync(join(ROOT,f),join(repo,f));
-export const pkg={name:'copy-fixture',version:'1.0.0'};
-writeFileSync(join(repo,'package.json'),JSON.stringify(pkg));
-writeFileSync(join(repo,'package-lock.json'),JSON.stringify({name:pkg.name,version:pkg.version,lockfileVersion:3,packages:{'':pkg}}));
-git(repo,'init','-q','-b','refactor');git(repo,'config','gc.auto','0');git(repo,'add','.');git(repo,'commit','-qm','fixture');
-export const commit=(msg)=>{git(repo,'commit','-q','--allow-empty','-m',msg);return git(repo,'rev-parse','HEAD')};
-// refactor: F A B C1 C, then M merging side branch S (from A). U sits on a branch nothing reaches.
-export const F=git(repo,'rev-parse','HEAD'),A=commit('row 901: A'),B=commit('row 902: B'),C1=commit('row 903: C1'),C=commit('row 904: C');
-git(repo,'checkout','-q','-b','side',A);export const S=commit('row 905: S');
-git(repo,'checkout','-q','-b','unreached',A);export const U=commit('row 906: U');
-git(repo,'checkout','-q','refactor');git(repo,'merge','-q','--no-ff','-m','merge side','side');
-export const M=git(repo,'rev-parse','HEAD');git(repo,'update-ref','refs/remotes/origin/refactor',M);
-// `to` false leaves out the `to:` lines (C1); a string puts that value in each one (A). The --plan
-// steps line can't be read from either (T27).
-export const storeText=(v,froms,to=true)=>`export const SCHEMA_VERSION = '${v}';\nexport const MIGRATIONS = [\n${froms.map((f,i)=>`  {\n    from: '${f}',\n${to===false?'':`    to: '${to===true?froms[i+1]??v:to}',\n`}    run() {},\n  },\n`).join('')}];\n`;
-// Plug-in kinds (row 169): C1 and C know the harness kind, as a copy at or past c216f47db does. The
-// rest have it under another name, as ca15d73e9 has no harness kind. Every copy has the real business
-// loader and roles, which the tool imports to read the business file.
-export const KINDS_NEW=readFileSync(join(repo,'packages','plugins','src','kinds.mjs'),'utf8');
-export const KINDS_OLD=KINDS_NEW.replace('\n  harness: Object.freeze({','\n  "harness-before-c216f47db": Object.freeze({');
-assert.notEqual(KINDS_OLD,KINDS_NEW);
-// Row 200 (#1698): C1 and C take --sso and have the row 192 loader and checkConsole; C's checker
-// refuses RS256, a stand-in for a target whose rules differ from the repository's. B has the loader
-// from before row 192, which refuses a `console` key. The other copies have no loader.
-const LOADER=readFileSync(join(repo,'scripts','mosaic-config.mjs'),'utf8'),SSO_CONFIG=readFileSync(join(repo,'packages','webui','src','sso-config.mjs'),'utf8');
-const LOADER_OLD=LOADER.replace('["configVersion", "environment", "dataRoot", "execution", "console"]','["configVersion", "environment", "dataRoot", "execution"]');
-const SSO_CONFIG_C=SSO_CONFIG.replace("'ES256', 'RS256',","'ES256',");
-assert.notEqual(LOADER_OLD,LOADER);assert.notEqual(SSO_CONFIG_C,SSO_CONFIG);
-const ssoFiles=(id)=>id===B?[['scripts/mosaic-config.mjs',LOADER_OLD]]:[C1,C].includes(id)?[['scripts/mosaic-config.mjs',LOADER],['packages/webui/src/sso-config.mjs',id===C?SSO_CONFIG_C:SSO_CONFIG]]:[];
-for(const [id,store] of [[F,'// a copy from before SCHEMA_VERSION\n'],[A,storeText('3g',['3f'],'3x')],[B,storeText('3g',['3f'])],[C1,storeText('3g',['3f'],false)],[C,storeText('3h',['3f','3g'])],[S,storeText('3g',['3f'])],[U,storeText('3g',['3f'])]]){
- const d=join(COPIES,id);
- for(const [f,text,mode] of [['scripts/mosaic',script(mosaicStub),0o755],['packages/webui/src/cli.mjs',[B,C1,C].includes(id)?`// fixture Console, never run\n// serve accepts '--tester-port'\n// serve accepts '--proof-header' (row 178)\n${[C1,C].includes(id)?"// serve accepts '--sso' (row 192)\n":''}`:'// fixture Console before tester listener, never run\n',0o644],['packages/bus/src/store.mjs',store,0o644],['packages/bus/src/migrate-schema.mjs',`(${migrateStub})();\n`,0o644],['packages/plugins/src/kinds.mjs',[C1,C].includes(id)?KINDS_NEW:KINDS_OLD,0o644],...ssoFiles(id).map(([f,text])=>[f,text,0o644])]){
-  mkdirSync(dirname(join(d,f)),{recursive:true});writeFileSync(join(d,f),text,{mode});
- }
- for(const p of ['packages/business/src','roles'])cpSync(join(repo,p),join(d,p),{recursive:true});
- execFileSync('chmod',['-R','a-w',d]);
-}
-for(const [name,fn] of [['systemctl',systemctl],['journalctl',journalctl],['systemd-analyze',systemdAnalyze]])writeFileSync(join(SBIN,name),script(fn),{mode:0o755});
-writeFileSync(join(base,'holder.cjs'),`(${holder})();\n`);
-export const SR=join(repo,'scripts','stack-release.sh');
-
-// --- Per-test roots and helpers ---
-
-export const sha=(f)=>createHash('sha256').update(readFileSync(f)).digest('hex');
-export const lines=(f)=>existsSync(f)?readFileSync(f,'utf8').split('\n').filter(Boolean):[];
-export const calls=(e)=>lines(join(e.sd,'calls.log'));
-export const startsStops=(e,from)=>calls(e).slice(from).filter((c)=>/^(start|stop) /.test(c));
-export const logLines=(e)=>lines(e.log).map((l)=>JSON.parse(l));
-export const pointer=(e)=>existsSync(e.pointer)?JSON.parse(readFileSync(e.pointer,'utf8')):null;
-export const units=(e)=>JSON.parse(readFileSync(join(e.sd,'units.json'),'utf8'));
-export const snaps=(e)=>lines(join(e.sd,'snap.jsonl')).map((l)=>JSON.parse(l));
-export const fault=(e,name,text='')=>writeFileSync(join(e.sd,'faults',name),text);
-export const sysctl=(e,...a)=>execFileSync(join(SBIN,'systemctl'),['--user',...a],{env:e.env,encoding:'utf8'});
-export const edit=(f,from,to)=>{const s=readFileSync(f,'utf8');assert.ok(s.includes(from),`${f} has no ${from}`);writeFileSync(f,s.replace(from,to))};
-export const posts=(e)=>readdirSync(e.data).filter((n)=>n.startsWith('bus.post-attempt-'));
-export const backupSum=(e,act)=>readFileSync(join(e.data,'backups','stack',act,'SHA256SUMS'),'utf8').split(' ')[0];
-export const commitLines=(range)=>git(repo,'log','--oneline','--no-merges','--max-count=200',range).split('\n').map((l)=>`  ${l}`);
-// The units, the wrapper, the pointer and the store, by sha256.
-export const fp=(e)=>({bus:sha(join(e.units,e.tmpl)),console:sha(join(e.units,e.con)),wrapper:sha(join(e.bin,e.wrapper)),pointer:existsSync(e.pointer)?sha(e.pointer):null,store:sha(e.store)});
-// The schema version: readOnly while the holder has the store open, immutable when it is stopped.
-export function storeVersion(file,held){
- const db=held?new DatabaseSync(file,{readOnly:true}):new DatabaseSync(pathToFileURL(file).href+'?immutable=1',{readOnly:true});
- try{return db.prepare("SELECT value FROM meta WHERE key='schema_version'").get().value}finally{db.close()}
-}
-// Every file and directory under p with size and mtime: T23 and T16 compare it before and after.
-export function tree(p){
- const out=[];
- const walk=(q)=>{let st;try{st=statSync(q)}catch{return}out.push(st.isDirectory()?`${q}/`:`${q} ${st.size} ${st.mtimeMs}`);if(st.isDirectory())for(const n of readdirSync(q).sort())walk(join(q,n))};
- walk(p);return out;
-}
-// T17: what a run may never remove. Under --units external confirm removes a set's AWAITING-UNITS
-// and FAILED when it closes the activation (row 232, r6 A5 and R4); user mode writes neither.
-const markers=/\/(AWAITING-UNITS|FAILED) /;
-export const kept=(e)=>[...tree(join(e.data,'backups','stack')),...tree(join(e.state,'stack-rollback')).filter((l)=>!markers.test(l)),...posts(e).flatMap((n)=>tree(join(e.data,n))),...tree(COPIES)].map((l)=>l.replace(/ .*/,''));
-
-// The business file (row 169): the committed example made loadable, as acme, with `plugins` when given.
-export const EXAMPLE=readFileSync(join(repo,'packages','business','examples','mosaic-stack.example.json'),'utf8');
-export function biz(e,plugins){
- const b=JSON.parse(EXAMPLE);let n=0;
- const walk=(o)=>{for(const [k,v] of Object.entries(o)){if(k==='botId')o[k]=++n;else if(v==='YYYY-MM-DD')o[k]='2027-01-01';else if(v&&typeof v==='object')walk(v)}};
- walk(b);b.id='acme';if(plugins!==undefined)b.plugins=plugins;
- const f=join(dirname(e.cfg),'businesses','acme.json');mkdirSync(dirname(f),{recursive:true});
- writeFileSync(f,JSON.stringify(b,null,2)+'\n',{mode:0o600});chmodSync(f,0o600);
-}
-
-export async function mk(t){
- const root=realpathSync(mkdtempSync(join(tmpdir(),'sr-')));
- const e={root,data:join(root,'data'),bin:join(root,'bin'),sd:join(root,'sd'),units:join(root,'xcfg','systemd','user'),cfg:join(root,'cfg','config.json'),claude:join(root,'claude-bin','claude')};
- // The default instance's names; named() sets NAME's (row 190).
- Object.assign(e,{flags:[],bus:BUS,tmpl:'[email protected]',con:CON,wrapper:'mosaic'});
- Object.assign(e,{state:join(e.data,'state'),pointer:join(e.data,'state','stack-active.json'),log:join(e.data,'state','stack-activation-log.jsonl'),store:join(e.data,'bus','bus.sqlite'),lock:join(e.data,'state','stack-release.lock')});
- for(const d of [join(root,'home'),dirname(e.cfg),join(e.data,'bus'),e.bin,dirname(e.claude),join(e.sd,'faults'),e.units,join(root,'xdata')])mkdirSync(d,{recursive:true});
- chmodSync(join(e.data,'bus'),0o700);
- writeFileSync(e.cfg,JSON.stringify({configVersion:1,environment:'development',dataRoot:e.data,execution:{backend:'docker',provider:'zai',model:'glm-5.3-flash',adapter:'mock'}}));
- biz(e);
- writeFileSync(join(e.bin,'mosaic'),`#!/usr/bin/env bash\n${MARKER}\n[ "\${1:-}" = __lease-capability ] && exec "${e.bin}/mosaic-old" "$@"\nexec "/old/scripts/mosaic" "$@"\n`,{mode:0o755});
- writeFileSync(join(e.bin,'mosaic-old'),'#!/bin/sh\nexit 0\n',{mode:0o755});
- writeFileSync(e.claude,'#!/bin/sh\necho "9.9.9 (Claude Code fixture)"\n',{mode:0o755});
- e.env={PATH:`${SBIN}:${dirname(NODE)}:/usr/bin:/bin`,HOME:join(root,'home'),XDG_CONFIG_HOME:join(root,'xcfg'),XDG_DATA_HOME:join(root,'xdata'),MOSAIC_CONFIG:e.cfg,SD_STATE:e.sd,SD_DATA:e.data,TMPDIR:tmpdir()};
- const server=await healthz(e);
- t.after(()=>{
-  for(const pid of lines(join(e.sd,'pids.log')).map(Number)){
-   try{if(readFileSync(`/proc/${pid}/cmdline`,'utf8').includes(join(base,'holder.cjs')))process.kill(pid,'SIGKILL')}catch{}
-  }
-  for(const s of [server,...(e.servers??[])])s.close();
-  execFileSync('chmod',['-R','u+w',root]);rmSync(root,{recursive:true,force:true});
- });
- return e;
-}
-
-// The Console's /healthz on e.port: 200 while the stand-in has e.con active and no healthz-<copy>
-// fault names its copy.
-export async function healthz(e){
- const server=createServer((q,r)=>{
-  let st={};try{st=units(e)[e.con]||{}}catch{}
-  const ok=q.url==='/healthz'&&st.state==='active'&&!existsSync(join(e.sd,'faults',`healthz-${basename(st.wd||'')}`));
-  r.writeHead(ok?200:500);r.end();
- });
- server.listen(0,'127.0.0.1');await once(server,'listening');e.port=String(server.address().port);
- return server;
-}
-
-// Row 190: stack instance NAME on e's host. It shares e's stand-ins, unit directory and $BIN, and has
-// its own config and data root from bootstrap --instance, its own Console port and business acme.
-// Its runs pass --instance NAME and no MOSAIC_CONFIG.
-export async function named(e,name){
- const env={...e.env};delete env.MOSAIC_CONFIG;
- execFileSync('bash',[join(repo,'scripts','bootstrap.sh'),'--instance',name],{env,stdio:'ignore'});
- const data=join(env.HOME,`.mosaic-${name}`);
- const n={...e,env,data,cfg:join(env.HOME,'.config',`mosaic-${name}`,'config.json'),flags:['--instance',name],bus:`mosaic-bus-${name}@acme.service`,tmpl:`mosaic-bus-${name}@.service`,con:`mosaic-webui-${name}.service`,wrapper:`mosaic-${name}`,name};
- Object.assign(n,{state:join(data,'state'),pointer:join(data,'state','stack-active.json'),log:join(data,'state','stack-activation-log.jsonl'),store:join(data,'bus','bus.sqlite'),lock:join(data,'state','stack-release.lock')});
- mkdirSync(join(data,'bus'),{mode:0o700});
- biz(n);
- (e.servers??=[]).push(await healthz(n));
- return n;
-}
-
-export async function run(e,...args){
- const before=existsSync(e.data)?kept(e):[];
- const ch=spawn('bash',[e.sr??SR,...args,...e.flags,'--copies',COPIES,'--bin',e.bin],{env:e.env,stdio:['ignore','pipe','pipe']});
- let out='',err='';ch.stdout.on('data',(d)=>{out+=d});ch.stderr.on('data',(d)=>{err+=d});
- const timer=setTimeout(()=>ch.kill('SIGKILL'),120000);
- const [code]=await once(ch,'close');clearTimeout(timer);
- const now=new Set(kept(e));
- for(const p of before)assert.ok(now.has(p),`T17: ${args.join(' ')} removed ${p}`);
- return {code,out,err};
-}
-
-// The stack on copy `copy` for business acme, both units active. pointer: adopt (a real adopt and
-// its log line), hand (written here, no log) or none. Snapshots start after the seed.
-export async function seed(e,{copy=B,pm=false,store='3g',pointer:how='adopt'}={}){
- const db=new DatabaseSync(e.store);
- db.exec('PRAGMA journal_mode=WAL');
- db.exec('CREATE TABLE meta (key TEXT PRIMARY KEY, value TEXT NOT NULL)');
- db.exec('CREATE TABLE events (id INTEGER PRIMARY KEY, at TEXT NOT NULL)');
- db.prepare("INSERT INTO meta VALUES ('schema_version', ?)").run(store);
- for(let i=0;i<3;i++)db.prepare('INSERT INTO events (at) VALUES (?)').run(`2000-01-01T00:00:0${i}.000Z`);
- db.close();
- const sh=(name,...a)=>execFileSync('bash',[join(repo,'scripts',name),...a],{env:e.env,encoding:'utf8',stdio:['ignore','pipe','pipe']});
- sh('bus-service.sh','install',...e.flags,'--copy',copy,'--copies',COPIES,...(pm?['--pm']:[]),'--claude',e.claude);
- sh('webui-service.sh','install',...e.flags,'--copy',copy,'--copies',COPIES,'--port',e.port,'--business','acme');
- sh('stack-copy.sh','wrapper',copy,...e.flags,'--copies',COPIES,'--bin',e.bin);
- // The seeded host started two minutes ago, so its boot status and PM run predate any run's start.
- execFileSync(join(SBIN,'systemctl'),['--user','start',e.bus],{env:{...e.env,SD_CLOCK_OFFSET:'120'}});
- sysctl(e,'start',e.con);
- if(how==='adopt'){const r=await run(e,'adopt','acme');assert.equal(r.code,0,r.err)}
- else if(how==='hand'){
-  mkdirSync(e.state,{recursive:true});
-  writeFileSync(e.pointer,JSON.stringify({copy,business:'acme',pm,claude:e.claude,console:['--port',e.port,'--business','acme'],schema:'3g',activation:'manual',at:'2026-10-18T00:00:00Z'})+'\n');
- }
- writeFileSync(join(e.sd,'snap.jsonl'),'');
-}
-
-export const rolledBack=(code,to=B)=>`stack-release: ${code}; rolled back to ${to}, which passed the gate\n`;
-export const planBackup=(e)=>`backup: the run backs up the stopped store to ${e.data}/backups/stack/<activation>/ before any migration`;
-export const planNoBackup='backup: none; the run rolls back before the backup';
-export const planTail=(e,to,pm=false)=>[`bus: scripts/bus-service.sh install --copy ${to} --copies ${COPIES}${pm?' --pm':''} --claude ${e.claude}`,'proof: off','send: off',`Console: scripts/webui-service.sh install --copy ${to} --copies ${COPIES} --port ${e.port} --business acme`,`CLI: scripts/stack-copy.sh wrapper ${to} --copies ${COPIES} --bin ${e.bin}`];
@@ -13,7 +13,422 @@ import {join,dirname,basename} from 'node:path';
 import {fileURLToPath,pathToFileURL} from 'node:url';
 import {once} from 'node:events';
 import {ALGS} from '../../webui/src/sso-config.mjs';
-import {A,B,BUS,C,C1,CON,COPIES,EXAMPLE,F,KINDS_NEW,KINDS_OLD,M,MARKER,NODE,ROOT,S,SBIN,SR,backupSum,base,biz,calls,commit,commitLines,edit,fault,fp,git,healthz,holder,journalctl,kept,lines,logLines,migrateStub,mk,mosaicStub,named,pkg,planBackup,planNoBackup,planTail,pointer,posts,repo,rolledBack,run,script,seed,sha,snaps,startsStops,storeText,storeVersion,sysctl,systemctl,systemdAnalyze,tracked,tree,U,units} from './stack-release-fixture.mjs';
+
+const ROOT=fileURLToPath(new URL('../../..',import.meta.url)).replace(/\/$/,'');
+const NODE=process.execPath;
+const MARKER='# mosaic-cli wrapper (Q81, agents/sage/work/q81/mosaic-cli.sh)';
+const BUS='[email protected]',CON='mosaic-webui.service';
+const git=(cwd,...args)=>execFileSync('git',['-c','user.name=fixture','-c','user.email=fixture@invalid','-c','commit.gpgsign=false','-c','core.hooksPath=/dev/null','-C',cwd,...args],{encoding:'utf8'}).trim();
+const script=(fn)=>`#!${NODE}\n(${fn})();\n`;
+
+// --- Stand-ins. Each is serialized into its own file, so it uses only process and its own scope. ---
+
+// systemctl --user: unit state in $SD_STATE/units.json, every call in calls.log. A bus start runs
+// holder.cjs (the store held open in WAL mode, writer.lock, host.json) and, with --pm in the unit's
+// ExecStart, writes the `launched` journal line and the launches entry unless a pm-<copy> fault
+// names another case. Faults are files in $SD_STATE/faults named for the copy they hit. Units of a
+// named instance (row 190) run on their own data root and host files beside the default's.
+function systemctl(){
+ const fs=process.getBuiltinModule('node:fs'),path=process.getBuiltinModule('node:path'),cp=process.getBuiltinModule('node:child_process'),crypto=process.getBuiltinModule('node:crypto');
+ const sd=process.env.SD_STATE,data=process.env.SD_DATA,unitDir=path.join(process.env.XDG_CONFIG_HOME,'systemd','user');
+ const args=process.argv.slice(2).filter((a)=>a!=='--user'),[verb,...rest]=args;
+ fs.appendFileSync(path.join(sd,'calls.log'),args.join(' ')+'\n');
+ const faultFile=(n)=>path.join(sd,'faults',n),fault=(n)=>fs.existsSync(faultFile(n));
+ const stFile=path.join(sd,'units.json');
+ const load=()=>{try{return JSON.parse(fs.readFileSync(stFile,'utf8'))}catch{return {}}};
+ const save=(s)=>{fs.writeFileSync(stFile+'.tmp',JSON.stringify(s));fs.renameSync(stFile+'.tmp',stFile)};
+ const sleep=(ms)=>Atomics.wait(new Int32Array(new SharedArrayBuffer(4)),0,0,ms);
+ const alive=(pid)=>{try{const s=fs.readFileSync(`/proc/${pid}/stat`,'utf8');return s[s.lastIndexOf(')')+2]!=='Z'}catch{return false}};
+ // Row 190: a bus unit is the default's mosaic-bus@B or instance NAME's mosaic-bus-NAME@B; %i is B.
+ const isBus=(u)=>/^mosaic-bus(-[a-z][a-z0-9]{1,15})?@[a-z0-9-]+\.service$/.test(u),inst=(u)=>u.slice(u.indexOf('@')+1,-'.service'.length);
+ const unitFile=(u)=>{
+  const main=isBus(u)?u.replace(/@[^@]*$/,'@.service'):u,file=path.join(unitDir,main);
+  if(!fs.existsSync(file))return null;
+  // The drop-in directories in systemd's order: service.d, the name cut after each hyphen, then
+  // the template's and the unit's own.
+  const stem=main.slice(0,main.search(/@?\.service$/)),dirs=['service.d'],drops=[];
+  for(let i=0;i<stem.length;i++)if(stem[i]==='-')dirs.push(stem.slice(0,i+1)+'.service.d');
+  for(const d of [...dirs,...(isBus(u)?[main+'.d',u+'.d']:[u+'.d'])]){const dir=path.join(unitDir,d);if(fs.existsSync(dir))for(const f of fs.readdirSync(dir).sort())if(f.endsWith('.conf'))drops.push(path.join(dir,f))}
+  const r={wd:'',exec:'',env:[],drops};
+  for(const f of [file,...drops])for(let line of fs.readFileSync(f,'utf8').split('\n')){
+   line=line.replace(/%i/g,isBus(u)?inst(u):'').replace(/%h/g,process.env.HOME);
+   const m=/^(WorkingDirectory|ExecStart|Environment)=(.*)$/.exec(line);if(!m)continue;
+   if(m[1]==='WorkingDirectory')r.wd=m[2];else if(m[1]==='ExecStart'){if(m[2])r.exec=m[2]}else r.env.push(m[2]);
+  }
+  return r;
+ };
+ // A named instance's unit sets MOSAIC_CONFIG, and its bus works on that config's data root. A unit
+ // without it is the default's, on $SD_DATA. Each data root has its own host and launches files.
+ const dataOf=(f)=>{const c=f&&f.env.find((v)=>v.startsWith('MOSAIC_CONFIG='));return c?JSON.parse(fs.readFileSync(c.slice('MOSAIC_CONFIG='.length),'utf8')).dataRoot:data};
+ const perData=(d,n)=>path.join(sd,d===data?`${n}.json`:`${n}-${path.basename(d)}.json`);
+ const snap=(ev,d)=>{
+  const dir=path.join(d,'bus'),files={};
+  try{for(const n of fs.readdirSync(dir).sort()){const p=path.join(dir,n),st=fs.statSync(p);if(st.isFile())files[n]=[st.size,st.mtimeMs,crypto.createHash('sha256').update(fs.readFileSync(p)).digest('hex')]}}catch{}
+  fs.appendFileSync(path.join(sd,'snap.jsonl'),JSON.stringify({ev,files})+'\n');
+ };
+ const pm=(unit,d,id,pid,off)=>{
+  let mode='';try{mode=fs.readFileSync(faultFile(`pm-${id}`),'utf8').trim()}catch{}
+  const b=inst(unit),now=Date.now()-off*1000,epoch=Math.floor(now/1000),at=new Date(now).toISOString(),run=`run-${pid}`;
+  const line=(text)=>fs.appendFileSync(path.join(sd,'journal.jsonl'),JSON.stringify({epoch,unit,text})+'\n');
+  const ok=()=>line(`launched pm-${b}: run ${run}, claude opus`);
+  const lf=perData(d,'launches');let list=[];try{list=JSON.parse(fs.readFileSync(lf,'utf8'))}catch{}
+  const entry=(o)=>list.push({run,business:b,live:true,startedAt:at,...o});
+  line(`bus host up: business ${b}, socket /fixture/bus.sock, notifier off`);
+  switch(mode){
+   case 'none':break;
+   case 'two':ok();line(`launched pm-${b}: run ${run}b, claude opus`);entry({});break;
+   case 'badword':line(`launched pm-${b}: job ${run}, claude opus`);entry({});break;
+   case 'notlisted':ok();break;
+   case 'early':ok();entry({startedAt:new Date(now-3600e3).toISOString()});break;
+   case 'human':entry({run:`human-${pid}`});break;
+   case 'other':ok();entry({business:'other'});break;
+   case 'dead':ok();entry({live:false});break;
+   default:ok();entry({});
+  }
+  fs.writeFileSync(lf,JSON.stringify(list));
+ };
+ if(verb==='show'){
+  const u=rest[0],props=[];for(let i=1;i<rest.length;i++)if(rest[i]==='-p')props.push(rest[++i]);
+  const f=unitFile(u),st=load()[u]||{},id=f?path.basename(f.wd):'';
+  for(const p of props){
+   if(p==='LoadState')console.log(`LoadState=${f?'loaded':'not-found'}`);
+   else if(p==='WorkingDirectory')console.log(`WorkingDirectory=${f?f.wd+(!isBus(u)&&fault(`check-${id}`)?'-moved':''):''}`);
+   else if(p==='ExecStart')console.log(f&&f.exec?`ExecStart={ path=${f.exec.split(' ')[0]} ; argv[]=${f.exec} ; ignore_errors=no ; start_time=[n/a] ; stop_time=[n/a] ; pid=0 ; code=(null) ; status=0/0 }`:'ExecStart=');
+   else if(p==='Environment')console.log(`Environment=${f?f.env.join(' '):''}`);
+   else if(p==='MainPID')console.log(`MainPID=${st.pid||0}`);
+   else if(p==='DropInPaths')console.log(`DropInPaths=${f?f.drops.join(' '):''}`);
+  }
+  process.exit(0);
+ }
+ if(verb==='is-active'){
+  const q=rest[0]==='--quiet',u=q?rest[1]:rest[0];let s=(load()[u]||{}).state||'inactive';
+  // bus-stops-after N (T29): the next N bus checks answer the real state, every later one answers
+  // inactive, and units.json stays as it is, as if the bus stopped between two checks.
+  if(isBus(u)&&fault('bus-stops-after')){const n=Number(fs.readFileSync(faultFile('bus-stops-after'),'utf8'));if(n>0)fs.writeFileSync(faultFile('bus-stops-after'),String(n-1));else s='inactive'}
+  if(!q)console.log(s);process.exit(s==='active'?0:3);
+ }
+ if(verb==='is-enabled'){console.log('disabled');process.exit(1)}
+ if(verb==='daemon-reload')process.exit(0);
+ if(verb==='list-units'){
+  if(fault('list-fails'))process.exit(1);
+  const pats=rest.filter((a)=>!a.startsWith('--')).map((p)=>new RegExp('^'+p.replace(/\./g,'\\.').replace(/\*/g,'.*')+'$'));
+  for(const [u,s] of Object.entries(load()))if(pats.some((re)=>re.test(u)))console.log(`${u} loaded ${s.state} ${s.state==='active'?'running':'dead'} fixture`);
+  process.exit(0);
+ }
+ if(verb==='start'){
+  const u=rest[0],f=unitFile(u);if(!f){console.error(`Unit ${u} not found.`);process.exit(5)}
+  const s=load(),id=path.basename(f.wd),d=dataOf(f);
+  if(!isBus(u)){s[u]={state:'active',pid:null,wd:f.wd};save(s);process.exit(0)}
+  if(fault(`start-dies-${id}`)){s[u]={state:'failed',pid:null,wd:f.wd};save(s);process.exit(0)}
+  // Row 185 (T48): the copy's start writes one event before the holder opens the store, so the
+  // store differs from a backup the run took before the start. The close leaves no -wal.
+  if(fault(`start-writes-row-${id}`)){
+   const db=new (process.getBuiltinModule('node:sqlite').DatabaseSync)(path.join(d,'bus','bus.sqlite'));
+   db.prepare('INSERT INTO events (at) VALUES (?)').run('2999-01-01T00:00:00.000Z');db.close();
+  }
+  snap('start',d);
+  const off=process.env.SD_CLOCK_OFFSET||'0';
+  // The holder must not inherit stack-release.sh's lock (fd 9) or any other fd above 2.
+  const close='for fd in /proc/self/fd/*; do n=${fd##*/}; [ "$n" -gt 2 ] && eval "exec $n>&-" 2>/dev/null; done; exec "$@"';
+  const ch=cp.spawn('bash',['-c',close,'holder',process.execPath,path.join(__dirname,'..','holder.cjs'),d,inst(u),sd,off,perData(d,'host')],{detached:true,stdio:'ignore'});
+  ch.unref();
+  fs.appendFileSync(path.join(sd,'pids.log'),ch.pid+'\n');
+  const ready=path.join(sd,`ready-${ch.pid}`),end=Date.now()+10000;
+  while(!fs.existsSync(ready)){if(Date.now()>end){console.error('fixture holder did not start');process.exit(1)}sleep(20)}
+  s[u]={state:'active',pid:ch.pid,wd:f.wd};save(s);
+  if(f.exec.split(' ').slice(1).includes('--pm'))pm(u,d,id,ch.pid,Number(off));
+  process.exit(0);
+ }
+ if(verb==='stop'){
+  const u=rest[0],s=load(),st=s[u];
+  if(st&&st.pid){
+   try{process.kill(st.pid,'SIGTERM')}catch{}
+   const end=Date.now()+10000;while(alive(st.pid)&&Date.now()<end)sleep(20);
+   if(alive(st.pid))try{process.kill(st.pid,'SIGKILL')}catch{}
+  }
+  if(st){s[u]={...st,state:'inactive',pid:null};save(s)}
+  if(isBus(u)){
+   const d=dataOf(unitFile(u));
+   // One-shot: the stop leaves an empty -wal or -shm beside the store, as an unclean close would.
+   for(const [name,ext] of [['stop-leaves-wal','-wal'],['stop-leaves-shm','-shm']])if(fault(name)){fs.rmSync(faultFile(name));fs.writeFileSync(path.join(d,'bus','bus.sqlite'+ext),'')}
+   // One-shot (T45): the stop writes one row after any STAMP into the table the fault names, as a
+   // write the bus made between rollback's count and its stop would. The close leaves no -wal.
+   if(fault('stop-writes-row')){
+    const t=fs.readFileSync(faultFile('stop-writes-row'),'utf8');fs.rmSync(faultFile('stop-writes-row'));
+    const db=new (process.getBuiltinModule('node:sqlite').DatabaseSync)(path.join(d,'bus','bus.sqlite'));
+    db.exec(`CREATE TABLE IF NOT EXISTS ${t} (seq INTEGER PRIMARY KEY, at TEXT NOT NULL)`);
+    db.prepare(`INSERT INTO ${t} (at) VALUES (?)`).run('2999-01-01T00:00:00.000Z');db.close();
+   }
+   snap('stop',d);
+  }
+  process.exit(0);
+ }
+ console.error(`fixture systemctl: unsupported: ${args.join(' ')}`);process.exit(1);
+}
+
+// journalctl --user -u UNIT --since @EPOCH -o cat. A bare local time gets exit 1, as M35 needs.
+function journalctl(){
+ const fs=process.getBuiltinModule('node:fs'),path=process.getBuiltinModule('node:path');
+ const sd=process.env.SD_STATE,a=process.argv.slice(2);let unit='',since='';
+ for(let i=0;i<a.length;i++){if(a[i]==='-u')unit=a[++i];else if(a[i]==='--since')since=a[++i]}
+ fs.appendFileSync(path.join(sd,'journal-since.log'),since+'\n');
+ if(fs.existsSync(path.join(sd,'faults','journal-fails')))process.exit(1);
+ let from;
+ if(/^@\d+$/.test(since))from=Number(since.slice(1));
+ else{const m=/^(\d{4}-\d\d-\d\d) (\d\d:\d\d:\d\d) UTC$/.exec(since);if(!m)process.exit(1);from=Date.parse(`${m[1]}T${m[2]}Z`)/1000}
+ let lines=[];try{lines=fs.readFileSync(path.join(sd,'journal.jsonl'),'utf8').split('\n').filter(Boolean).map((l)=>JSON.parse(l))}catch{}
+ for(const o of lines)if(o.unit===unit&&o.epoch>=from)console.log(o.text);
+}
+
+function systemdAnalyze(){
+ const fs=process.getBuiltinModule('node:fs'),path=process.getBuiltinModule('node:path');
+ if(process.argv[2]!=='--user'||process.argv[3]!=='unit-paths')process.exit(1);
+ console.log(path.join(process.env.XDG_CONFIG_HOME,'systemd','user'));
+ // The unit-path fault adds its text as one more path, as T28's relative path needs.
+ const extra=path.join(process.env.SD_STATE,'faults','unit-path');
+ if(fs.existsSync(extra))console.log(fs.readFileSync(extra,'utf8'));
+}
+
+// The bus host: holds the store open in WAL mode until SIGTERM, as the broker does. It writes its
+// status to the host file systemctl names for its data root.
+function holder(){
+ const fs=process.getBuiltinModule('node:fs'),path=process.getBuiltinModule('node:path'),{DatabaseSync}=process.getBuiltinModule('node:sqlite');
+ const [data,business,sd,offset,host]=process.argv.slice(2),bus=path.join(data,'bus');
+ fs.mkdirSync(bus,{recursive:true,mode:0o700});
+ const db=new DatabaseSync(path.join(bus,'bus.sqlite'));
+ if(!db.prepare("SELECT count(*) AS n FROM sqlite_master WHERE name='meta'").get().n){
+  db.exec('PRAGMA journal_mode=WAL');
+  db.exec('CREATE TABLE meta (key TEXT PRIMARY KEY, value TEXT NOT NULL)');
+  db.exec('CREATE TABLE events (id INTEGER PRIMARY KEY, at TEXT NOT NULL)');
+  db.prepare("INSERT INTO meta VALUES ('schema_version', '3g')").run();
+ }
+ fs.writeFileSync(path.join(bus,'writer.lock'),String(process.pid));
+ const at=new Date(Date.now()-Number(offset||0)*1000).toISOString();
+ fs.writeFileSync(host+'.tmp',JSON.stringify({host:{business,pid:process.pid,live:true,startedAt:at,notifier:'ok'},boot:{ok:true,business,at}}));
+ fs.renameSync(host+'.tmp',host);
+ process.on('SIGTERM',()=>{db.close();fs.rmSync(path.join(bus,'writer.lock'),{force:true});process.exit(0)});
+ fs.writeFileSync(path.join(sd,`ready-${process.pid}`),'');
+ setInterval(()=>{},1<<30);
+}
+
+// A copy's scripts/mosaic: bus status and launches list from what the holder and systemctl wrote
+// for the data root of the config it runs under (row 190), the default's being $SD_DATA.
+function mosaicStub(){
+ const fs=process.getBuiltinModule('node:fs'),path=process.getBuiltinModule('node:path');
+ const id=path.basename(path.resolve(__dirname,'..')),sd=process.env.SD_STATE,a=process.argv.slice(2).join(' ');
+ const fault=(n)=>fs.existsSync(path.join(sd,'faults',n));
+ let d=process.env.SD_DATA;try{d=JSON.parse(fs.readFileSync(process.env.MOSAIC_CONFIG,'utf8')).dataRoot}catch{}
+ const perData=(n)=>path.join(sd,d===process.env.SD_DATA?`${n}.json`:`${n}-${path.basename(d)}.json`);
+ const alive=(pid)=>{try{const s=fs.readFileSync(`/proc/${pid}/stat`,'utf8');return s[s.lastIndexOf(')')+2]!=='Z'}catch{return false}};
+ if(a==='bus status --json'){
+  if(fault(`status-${id}`))process.exit(1);
+  let s={host:null,boot:null};
+  try{s=JSON.parse(fs.readFileSync(perData('host'),'utf8'));s.host.live=alive(s.host.pid)}catch{}
+  console.log(JSON.stringify(s));
+ }else if(a==='bus status')console.log(`bus: fixture status for ${id}`);
+ else if(a==='launches list --json'){
+  if(fault(`launches-${id}`))process.exit(1);
+  let l=[];try{l=JSON.parse(fs.readFileSync(perData('launches'),'utf8'))}catch{}
+  console.log(JSON.stringify(l));
+ }else{console.error(`fixture mosaic: ${a}`);process.exit(4)}
+}
+
+// A copy's migrate-schema.mjs: records the backups it saw, then sets 3h, or 3h-partial and exit 1.
+function migrateStub(){
+ const fs=process.getBuiltinModule('node:fs'),path=process.getBuiltinModule('node:path'),{DatabaseSync}=process.getBuiltinModule('node:sqlite');
+ const data=process.argv[2],sd=process.env.SD_STATE,dir=path.join(data,'backups','stack');
+ const backups=fs.existsSync(dir)?fs.readdirSync(dir).sort().map((name)=>({name,sums:fs.existsSync(path.join(dir,name,'SHA256SUMS'))})):[];
+ fs.writeFileSync(path.join(sd,'migrate.json'),JSON.stringify({backups}));
+ const fail=fs.existsSync(path.join(sd,'faults','migrate-fails'));
+ const db=new DatabaseSync(path.join(data,'bus','bus.sqlite'));
+ db.prepare("UPDATE meta SET value=? WHERE key='schema_version'").run(fail?'3h-partial':'3h');db.close();
+ if(fail)process.exit(1);
+ console.log('fixture migrate: 3h');
+}
+
+// --- The module fixture: one repo, its copies and the stand-ins, shared by every test. ---
+
+const base=realpathSync(mkdtempSync(join(tmpdir(),'stack-release-')));
+after(()=>{execFileSync('chmod',['-R','u+w',base]);rmSync(base,{recursive:true,force:true})});
+const repo=join(base,'repo'),COPIES=join(base,'copies'),SBIN=join(base,'sbin');
+mkdirSync(repo);mkdirSync(COPIES);mkdirSync(SBIN);
+writeFileSync(join(base,'package.json'),'{"type":"commonjs"}\n');
+const tracked=execFileSync('git',['-C',ROOT,'ls-files','-co','--exclude-standard','--','scripts','packages','adapters','roles','RELEASE','package.json','package-lock.json',':!packages/*/tests',':!scripts/foundation'],{encoding:'utf8'}).trim().split('\n');
+for(const f of tracked)if(existsSync(join(ROOT,f)))cpSync(join(ROOT,f),join(repo,f));
+const pkg={name:'copy-fixture',version:'1.0.0'};
+writeFileSync(join(repo,'package.json'),JSON.stringify(pkg));
+writeFileSync(join(repo,'package-lock.json'),JSON.stringify({name:pkg.name,version:pkg.version,lockfileVersion:3,packages:{'':pkg}}));
+git(repo,'init','-q','-b','refactor');git(repo,'config','gc.auto','0');git(repo,'add','.');git(repo,'commit','-qm','fixture');
+const commit=(msg)=>{git(repo,'commit','-q','--allow-empty','-m',msg);return git(repo,'rev-parse','HEAD')};
+// refactor: F A B C1 C, then M merging side branch S (from A). U sits on a branch nothing reaches.
+const F=git(repo,'rev-parse','HEAD'),A=commit('row 901: A'),B=commit('row 902: B'),C1=commit('row 903: C1'),C=commit('row 904: C');
+git(repo,'checkout','-q','-b','side',A);const S=commit('row 905: S');
+git(repo,'checkout','-q','-b','unreached',A);const U=commit('row 906: U');
+git(repo,'checkout','-q','refactor');git(repo,'merge','-q','--no-ff','-m','merge side','side');
+const M=git(repo,'rev-parse','HEAD');git(repo,'update-ref','refs/remotes/origin/refactor',M);
+// `to` false leaves out the `to:` lines (C1); a string puts that value in each one (A). The --plan
+// steps line can't be read from either (T27).
+const storeText=(v,froms,to=true)=>`export const SCHEMA_VERSION = '${v}';\nexport const MIGRATIONS = [\n${froms.map((f,i)=>`  {\n    from: '${f}',\n${to===false?'':`    to: '${to===true?froms[i+1]??v:to}',\n`}    run() {},\n  },\n`).join('')}];\n`;
+// Plug-in kinds (row 169): C1 and C know the harness kind, as a copy at or past c216f47db does. The
+// rest have it under another name, as ca15d73e9 has no harness kind. Every copy has the real business
+// loader and roles, which the tool imports to read the business file.
+const KINDS_NEW=readFileSync(join(repo,'packages','plugins','src','kinds.mjs'),'utf8');
+const KINDS_OLD=KINDS_NEW.replace('\n  harness: Object.freeze({','\n  "harness-before-c216f47db": Object.freeze({');
+assert.notEqual(KINDS_OLD,KINDS_NEW);
+// Row 200 (#1698): C1 and C take --sso and have the row 192 loader and checkConsole; C's checker
+// refuses RS256, a stand-in for a target whose rules differ from the repository's. B has the loader
+// from before row 192, which refuses a `console` key. The other copies have no loader.
+const LOADER=readFileSync(join(repo,'scripts','mosaic-config.mjs'),'utf8'),SSO_CONFIG=readFileSync(join(repo,'packages','webui','src','sso-config.mjs'),'utf8');
+const LOADER_OLD=LOADER.replace('["configVersion", "environment", "dataRoot", "execution", "console"]','["configVersion", "environment", "dataRoot", "execution"]');
+const SSO_CONFIG_C=SSO_CONFIG.replace("'ES256', 'RS256',","'ES256',");
+assert.notEqual(LOADER_OLD,LOADER);assert.notEqual(SSO_CONFIG_C,SSO_CONFIG);
+const ssoFiles=(id)=>id===B?[['scripts/mosaic-config.mjs',LOADER_OLD]]:[C1,C].includes(id)?[['scripts/mosaic-config.mjs',LOADER],['packages/webui/src/sso-config.mjs',id===C?SSO_CONFIG_C:SSO_CONFIG]]:[];
+for(const [id,store] of [[F,'// a copy from before SCHEMA_VERSION\n'],[A,storeText('3g',['3f'],'3x')],[B,storeText('3g',['3f'])],[C1,storeText('3g',['3f'],false)],[C,storeText('3h',['3f','3g'])],[S,storeText('3g',['3f'])],[U,storeText('3g',['3f'])]]){
+ const d=join(COPIES,id);
+ for(const [f,text,mode] of [['scripts/mosaic',script(mosaicStub),0o755],['packages/webui/src/cli.mjs',[B,C1,C].includes(id)?`// fixture Console, never run\n// serve accepts '--tester-port'\n// serve accepts '--proof-header' (row 178)\n${[C1,C].includes(id)?"// serve accepts '--sso' (row 192)\n":''}`:'// fixture Console before tester listener, never run\n',0o644],['packages/bus/src/store.mjs',store,0o644],['packages/bus/src/migrate-schema.mjs',`(${migrateStub})();\n`,0o644],['packages/plugins/src/kinds.mjs',[C1,C].includes(id)?KINDS_NEW:KINDS_OLD,0o644],...ssoFiles(id).map(([f,text])=>[f,text,0o644])]){
+  mkdirSync(dirname(join(d,f)),{recursive:true});writeFileSync(join(d,f),text,{mode});
+ }
+ for(const p of ['packages/business/src','roles'])cpSync(join(repo,p),join(d,p),{recursive:true});
+ execFileSync('chmod',['-R','a-w',d]);
+}
+for(const [name,fn] of [['systemctl',systemctl],['journalctl',journalctl],['systemd-analyze',systemdAnalyze]])writeFileSync(join(SBIN,name),script(fn),{mode:0o755});
+writeFileSync(join(base,'holder.cjs'),`(${holder})();\n`);
+const SR=join(repo,'scripts','stack-release.sh');
+
+// --- Per-test roots and helpers ---
+
+const sha=(f)=>createHash('sha256').update(readFileSync(f)).digest('hex');
+const lines=(f)=>existsSync(f)?readFileSync(f,'utf8').split('\n').filter(Boolean):[];
+const calls=(e)=>lines(join(e.sd,'calls.log'));
+const startsStops=(e,from)=>calls(e).slice(from).filter((c)=>/^(start|stop) /.test(c));
+const logLines=(e)=>lines(e.log).map((l)=>JSON.parse(l));
+const pointer=(e)=>existsSync(e.pointer)?JSON.parse(readFileSync(e.pointer,'utf8')):null;
+const units=(e)=>JSON.parse(readFileSync(join(e.sd,'units.json'),'utf8'));
+const snaps=(e)=>lines(join(e.sd,'snap.jsonl')).map((l)=>JSON.parse(l));
+const fault=(e,name,text='')=>writeFileSync(join(e.sd,'faults',name),text);
+const sysctl=(e,...a)=>execFileSync(join(SBIN,'systemctl'),['--user',...a],{env:e.env,encoding:'utf8'});
+const edit=(f,from,to)=>{const s=readFileSync(f,'utf8');assert.ok(s.includes(from),`${f} has no ${from}`);writeFileSync(f,s.replace(from,to))};
+const posts=(e)=>readdirSync(e.data).filter((n)=>n.startsWith('bus.post-attempt-'));
+const backupSum=(e,act)=>readFileSync(join(e.data,'backups','stack',act,'SHA256SUMS'),'utf8').split(' ')[0];
+const commitLines=(range)=>git(repo,'log','--oneline','--no-merges','--max-count=200',range).split('\n').map((l)=>`  ${l}`);
+// The units, the wrapper, the pointer and the store, by sha256.
+const fp=(e)=>({bus:sha(join(e.units,e.tmpl)),console:sha(join(e.units,e.con)),wrapper:sha(join(e.bin,e.wrapper)),pointer:existsSync(e.pointer)?sha(e.pointer):null,store:sha(e.store)});
+// The schema version: readOnly while the holder has the store open, immutable when it is stopped.
+function storeVersion(file,held){
+ const db=held?new DatabaseSync(file,{readOnly:true}):new DatabaseSync(pathToFileURL(file).href+'?immutable=1',{readOnly:true});
+ try{return db.prepare("SELECT value FROM meta WHERE key='schema_version'").get().value}finally{db.close()}
+}
+// Every file and directory under p with size and mtime: T23 and T16 compare it before and after.
+function tree(p){
+ const out=[];
+ const walk=(q)=>{let st;try{st=statSync(q)}catch{return}out.push(st.isDirectory()?`${q}/`:`${q} ${st.size} ${st.mtimeMs}`);if(st.isDirectory())for(const n of readdirSync(q).sort())walk(join(q,n))};
+ walk(p);return out;
+}
+// T17: what a run may never remove.
+const kept=(e)=>[...tree(join(e.data,'backups','stack')),...tree(join(e.state,'stack-rollback')),...posts(e).flatMap((n)=>tree(join(e.data,n))),...tree(COPIES)].map((l)=>l.replace(/ .*/,''));
+
+// The business file (row 169): the committed example made loadable, as acme, with `plugins` when given.
+const EXAMPLE=readFileSync(join(repo,'packages','business','examples','mosaic-stack.example.json'),'utf8');
+function biz(e,plugins){
+ const b=JSON.parse(EXAMPLE);let n=0;
+ const walk=(o)=>{for(const [k,v] of Object.entries(o)){if(k==='botId')o[k]=++n;else if(v==='YYYY-MM-DD')o[k]='2027-01-01';else if(v&&typeof v==='object')walk(v)}};
+ walk(b);b.id='acme';if(plugins!==undefined)b.plugins=plugins;
+ const f=join(dirname(e.cfg),'businesses','acme.json');mkdirSync(dirname(f),{recursive:true});
+ writeFileSync(f,JSON.stringify(b,null,2)+'\n',{mode:0o600});chmodSync(f,0o600);
+}
+
+async function mk(t){
+ const root=realpathSync(mkdtempSync(join(tmpdir(),'sr-')));
+ const e={root,data:join(root,'data'),bin:join(root,'bin'),sd:join(root,'sd'),units:join(root,'xcfg','systemd','user'),cfg:join(root,'cfg','config.json'),claude:join(root,'claude-bin','claude')};
+ // The default instance's names; named() sets NAME's (row 190).
+ Object.assign(e,{flags:[],bus:BUS,tmpl:'[email protected]',con:CON,wrapper:'mosaic'});
+ Object.assign(e,{state:join(e.data,'state'),pointer:join(e.data,'state','stack-active.json'),log:join(e.data,'state','stack-activation-log.jsonl'),store:join(e.data,'bus','bus.sqlite'),lock:join(e.data,'state','stack-release.lock')});
+ for(const d of [join(root,'home'),dirname(e.cfg),join(e.data,'bus'),e.bin,dirname(e.claude),join(e.sd,'faults'),e.units,join(root,'xdata')])mkdirSync(d,{recursive:true});
+ chmodSync(join(e.data,'bus'),0o700);
+ writeFileSync(e.cfg,JSON.stringify({configVersion:1,environment:'development',dataRoot:e.data,execution:{backend:'docker',provider:'zai',model:'glm-5.3-flash',adapter:'mock'}}));
+ biz(e);
+ writeFileSync(join(e.bin,'mosaic'),`#!/usr/bin/env bash\n${MARKER}\n[ "\${1:-}" = __lease-capability ] && exec "${e.bin}/mosaic-old" "$@"\nexec "/old/scripts/mosaic" "$@"\n`,{mode:0o755});
+ writeFileSync(join(e.bin,'mosaic-old'),'#!/bin/sh\nexit 0\n',{mode:0o755});
+ writeFileSync(e.claude,'#!/bin/sh\necho "9.9.9 (Claude Code fixture)"\n',{mode:0o755});
+ e.env={PATH:`${SBIN}:${dirname(NODE)}:/usr/bin:/bin`,HOME:join(root,'home'),XDG_CONFIG_HOME:join(root,'xcfg'),XDG_DATA_HOME:join(root,'xdata'),MOSAIC_CONFIG:e.cfg,SD_STATE:e.sd,SD_DATA:e.data,TMPDIR:tmpdir()};
+ const server=await healthz(e);
+ t.after(()=>{
+  for(const pid of lines(join(e.sd,'pids.log')).map(Number)){
+   try{if(readFileSync(`/proc/${pid}/cmdline`,'utf8').includes(join(base,'holder.cjs')))process.kill(pid,'SIGKILL')}catch{}
+  }
+  for(const s of [server,...(e.servers??[])])s.close();
+  execFileSync('chmod',['-R','u+w',root]);rmSync(root,{recursive:true,force:true});
+ });
+ return e;
+}
+
+// The Console's /healthz on e.port: 200 while the stand-in has e.con active and no healthz-<copy>
+// fault names its copy.
+async function healthz(e){
+ const server=createServer((q,r)=>{
+  let st={};try{st=units(e)[e.con]||{}}catch{}
+  const ok=q.url==='/healthz'&&st.state==='active'&&!existsSync(join(e.sd,'faults',`healthz-${basename(st.wd||'')}`));
+  r.writeHead(ok?200:500);r.end();
+ });
+ server.listen(0,'127.0.0.1');await once(server,'listening');e.port=String(server.address().port);
+ return server;
+}
+
+// Row 190: stack instance NAME on e's host. It shares e's stand-ins, unit directory and $BIN, and has
+// its own config and data root from bootstrap --instance, its own Console port and business acme.
+// Its runs pass --instance NAME and no MOSAIC_CONFIG.
+async function named(e,name){
+ const env={...e.env};delete env.MOSAIC_CONFIG;
+ execFileSync('bash',[join(repo,'scripts','bootstrap.sh'),'--instance',name],{env,stdio:'ignore'});
+ const data=join(env.HOME,`.mosaic-${name}`);
+ const n={...e,env,data,cfg:join(env.HOME,'.config',`mosaic-${name}`,'config.json'),flags:['--instance',name],bus:`mosaic-bus-${name}@acme.service`,tmpl:`mosaic-bus-${name}@.service`,con:`mosaic-webui-${name}.service`,wrapper:`mosaic-${name}`,name};
+ Object.assign(n,{state:join(data,'state'),pointer:join(data,'state','stack-active.json'),log:join(data,'state','stack-activation-log.jsonl'),store:join(data,'bus','bus.sqlite'),lock:join(data,'state','stack-release.lock')});
+ mkdirSync(join(data,'bus'),{mode:0o700});
+ biz(n);
+ (e.servers??=[]).push(await healthz(n));
+ return n;
+}
+
+async function run(e,...args){
+ const before=existsSync(e.data)?kept(e):[];
+ const ch=spawn('bash',[e.sr??SR,...args,...e.flags,'--copies',COPIES,'--bin',e.bin],{env:e.env,stdio:['ignore','pipe','pipe']});
+ let out='',err='';ch.stdout.on('data',(d)=>{out+=d});ch.stderr.on('data',(d)=>{err+=d});
+ const timer=setTimeout(()=>ch.kill('SIGKILL'),120000);
+ const [code]=await once(ch,'close');clearTimeout(timer);
+ const now=new Set(kept(e));
+ for(const p of before)assert.ok(now.has(p),`T17: ${args.join(' ')} removed ${p}`);
+ return {code,out,err};
+}
+
+// The stack on copy `copy` for business acme, both units active. pointer: adopt (a real adopt and
+// its log line), hand (written here, no log) or none. Snapshots start after the seed.
+async function seed(e,{copy=B,pm=false,store='3g',pointer:how='adopt'}={}){
+ const db=new DatabaseSync(e.store);
+ db.exec('PRAGMA journal_mode=WAL');
+ db.exec('CREATE TABLE meta (key TEXT PRIMARY KEY, value TEXT NOT NULL)');
+ db.exec('CREATE TABLE events (id INTEGER PRIMARY KEY, at TEXT NOT NULL)');
+ db.prepare("INSERT INTO meta VALUES ('schema_version', ?)").run(store);
+ for(let i=0;i<3;i++)db.prepare('INSERT INTO events (at) VALUES (?)').run(`2000-01-01T00:00:0${i}.000Z`);
+ db.close();
+ const sh=(name,...a)=>execFileSync('bash',[join(repo,'scripts',name),...a],{env:e.env,encoding:'utf8',stdio:['ignore','pipe','pipe']});
+ sh('bus-service.sh','install',...e.flags,'--copy',copy,'--copies',COPIES,...(pm?['--pm']:[]),'--claude',e.claude);
+ sh('webui-service.sh','install',...e.flags,'--copy',copy,'--copies',COPIES,'--port',e.port,'--business','acme');
+ sh('stack-copy.sh','wrapper',copy,...e.flags,'--copies',COPIES,'--bin',e.bin);
+ // The seeded host started two minutes ago, so its boot status and PM run predate any run's start.
+ execFileSync(join(SBIN,'systemctl'),['--user','start',e.bus],{env:{...e.env,SD_CLOCK_OFFSET:'120'}});
+ sysctl(e,'start',e.con);
+ if(how==='adopt'){const r=await run(e,'adopt','acme');assert.equal(r.code,0,r.err)}
+ else if(how==='hand'){
+  mkdirSync(e.state,{recursive:true});
+  writeFileSync(e.pointer,JSON.stringify({copy,business:'acme',pm,claude:e.claude,console:['--port',e.port,'--business','acme'],schema:'3g',activation:'manual',at:'2026-10-18T00:00:00Z'})+'\n');
+ }
+ writeFileSync(join(e.sd,'snap.jsonl'),'');
+}
+
+const rolledBack=(code,to=B)=>`stack-release: ${code}; rolled back to ${to}, which passed the gate\n`;
+const planBackup=(e)=>`backup: the run backs up the stopped store to ${e.data}/backups/stack/<activation>/ before any migration`;
+const planNoBackup='backup: none; the run rolls back before the backup';
+const planTail=(e,to,pm=false)=>[`bus: scripts/bus-service.sh install --copy ${to} --copies ${COPIES}${pm?' --pm':''} --claude ${e.claude}`,'proof: off','send: off',`Console: scripts/webui-service.sh install --copy ${to} --copies ${COPIES} --port ${e.port} --business acme`,`CLI: scripts/stack-copy.sh wrapper ${to} --copies ${COPIES} --bin ${e.bin}`];

 // --- The T table ---

@@ -1681,6 +2096,14 @@ test('T57 row 200: activate --sso, its refusals before any stop, and the rollbac
  assert.ok(stepText(a).includes(`Z drop --sso; ${B}'s Console does not support it, so the Console flags come from ${set}/${show}\n`));
  await noLeak(a);
 });
+ await t.test('row 238 (#1744): on a named instance the sso-config first step names --instance NAME in both commands',async(t)=>{
+  const e=await mk(t),a=await named(e,'alpha');await seed(a);
+  assert.equal(JSON.parse(readFileSync(a.cfg,'utf8')).console,undefined);
+  await refused(a,['activate',C1,'acme','--sso'],'sso-config',`${C1}'s Console would refuse its --sso start: there is no console.sso in the system config; activate ${C1} --instance alpha without --sso first, then write console.sso, then run activate ${C1} --instance alpha --sso`);
+  const out=await planOnly(a,3,'activate',C1,'acme','--sso');
+  assert.ok(out.includes(`refuses sso-config: ${C1}'s Console would refuse its --sso start: there is no console.sso in the system config; activate ${C1} --instance alpha without --sso first, then write console.sso, then run activate ${C1} --instance alpha --sso`),out.join('\n'));
+  await noLeak(a);
+ });
 });

 // --- rehearse (D2, row 163; the brief's "Stack rehearsal on a scratch root") ---
@@ -0,0 +1,241 @@
+#!/usr/bin/env bash
+# Case 2 row C2-13a (design 10 step 8): the host checks a hub needs before
+# its units start. It runs as <user>, after root's 2c step, and changes
+# nothing. It runs every check, prints one line for each, and refuses if
+# any one failed.
+#
+#   case2-precheck.sh --business ID [--profile factory|library]
+#
+# Checks: the config and business file validate; `sudo -n true` fails and
+# `id -G` prints one group; bus.tester is off for library and on for factory,
+# and factory refuses a business file with a library project
+# (profile-library-business); the run root is 0700; XDG_DATA_HOME is unset or
+# <home>/.local/share; node is 24 or later; bwrap runs; the unprivileged port
+# floor is above the installed Console unit's --port; the host's claude
+# replaces its default prompt with --system-prompt-file, when some instance
+# runs claude-code; and claude-session.env sets ZAI_API_KEY, when some
+# instance's provider is zai. It prints free memory and checks that HOME is
+# <home>. It never prints a value from claude-session.env.
+#
+# Test seams, for packages/cli/tests/case2-unit.test.mjs only:
+#   CASE2_UNIT_DIR   the installed units, default /etc/systemd/system
+#   CASE2_PROC_SYS   default /proc/sys
+#   CASE2_GETENT     the getent command, default getent
+#
+# Exit 0 every check passed, 1 refused, 4 usage.
+set -uo pipefail
+REPO="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+UNIT_DIR="${CASE2_UNIT_DIR:-/etc/systemd/system}"
+PROC_SYS="${CASE2_PROC_SYS:-/proc/sys}"
+GETENT="${CASE2_GETENT:-getent}"
+BUS_UNIT="$UNIT_DIR/[email protected]"
+WEBUI_UNIT="$UNIT_DIR/mosaic-webui.service"
+# The most input tokens a marker run may report with its prompt replaced.
+# Claude Code's own prompt is many times this.
+MARKER_TOKEN_CEILING=2000
+
+usage() { echo 'usage: case2-precheck.sh --business ID [--profile factory|library]' >&2; exit 4; }
+PROFILE=library BUSINESS=''
+while [ $# -gt 0 ]; do
+    case "$1" in
+        --profile) [ $# -ge 2 ] || usage; PROFILE="$2"; shift 2 ;;
+        --business) [ $# -ge 2 ] || usage; BUSINESS="$2"; shift 2 ;;
+        *) usage ;;
+    esac
+done
+[ -n "$BUSINESS" ] || usage
+case "$PROFILE" in factory|library) ;; *) echo "case2-precheck: --profile must be factory or library: $PROFILE" >&2; exit 4 ;; esac
+[[ "$BUSINESS" =~ ^[a-z0-9][a-z0-9._-]{0,63}$ ]] || { echo "case2-precheck: --business must be a business id: $BUSINESS" >&2; exit 4; }
+
+FAILED=0
+ok() { echo "ok      $1"; }
+refuse() { echo "REFUSED $1"; FAILED=1; }
+
+# One setting's value from an installed unit: the last KEY= line in the file.
+unit_value() { [ -f "$1" ] && sed -n "s/^[[:space:]]*$2[[:space:]]*=[[:space:]]*//p" -- "$1" | tail -n 1; }
+
+# The last assignment of NAME in an EnvironmentFile, quotes removed, as
+# systemd reads it. Prints the value; the callers never echo it.
+env_value() {
+    awk -v name="$2" '
+        { sub(/^[ \t]+/, "") }
+        /^[#;]/ || $0 == "" { next }
+        {
+            i = index($0, "="); if (i == 0) next
+            k = substr($0, 1, i - 1); sub(/[ \t]+$/, "", k)
+            if (k != name) next
+            v = substr($0, i + 1); sub(/^[ \t]+/, "", v); sub(/[ \t]+$/, "", v)
+            if (v ~ /^".*"$/ || v ~ /^\x27.*\x27$/) v = substr(v, 2, length(v) - 2)
+            last = v; found = 1
+        }
+        END { if (found) printf "%s", last }' "$1"
+}
+
+# The user and its home from the passwd database.
+ME="$(id -un)"
+ME_UID="$(id -u)"
+PW="$("$GETENT" passwd "$ME")" || { refuse "user: no $ME in the passwd database"; PW=''; }
+IFS=: read -r _ _ _ _ _ PW_HOME _ <<<"$PW"
+if [ -n "${PW_HOME:-}" ] && [ "${HOME:-}" = "$PW_HOME" ]; then ok "HOME is $PW_HOME"
+else refuse "HOME is ${HOME:-unset}, not $ME's home ${PW_HOME:-unknown}"; fi
+HOME_DIR="${PW_HOME:-$HOME}"
+
+# The config, then the business file through the same loaders the bus uses.
+# The helper prints tab-separated facts and never a credential.
+facts="$(cd "$REPO" && node --input-type=module -e '
+import { readFileSync } from "node:fs";
+const [repo, id] = process.argv.slice(1);
+const { loadSystem, rolesDir } = await import(`${repo}/packages/cli/src/config.mjs`);
+const { businessFilePath, configDir, loadBusiness, resolveInstance, systemVars } = await import(`${repo}/packages/business/src/index.mjs`);
+const say = (...f) => console.log(f.join("\t"));
+let system;
+try { system = loadSystem(); } catch (e) { say("CONFIG", "bad", e.message.split("\n")[0]); process.exit(0); }
+say("CONFIG", "ok", system.dataRoot, configDir());
+const file = businessFilePath(id);
+let raw;
+try { raw = JSON.parse(readFileSync(file, "utf8")); } catch (e) { say("BUSINESS", "bad", `cannot read ${file}: ${e.code ?? e.message}`); process.exit(0); }
+const library = Object.entries(raw?.projects ?? {}).filter(([, p]) => p && p.kind === "library").map(([k]) => k);
+if (library.length) say("LIBRARY", library.join(","));
+let b;
+try { b = loadBusiness(id, { rolesDir: rolesDir() }); } catch (e) { say("BUSINESS", "bad", e.message.split("\n")[0]); process.exit(0); }
+say("BUSINESS", "ok", file);
+say("TESTER", b.vars["bus.tester"] === true ? "on" : "off");
+const vars = systemVars(system);
+const models = b.launch?.models ?? null;
+for (const instance of Object.keys(b.roles)) {
+  const v = resolveInstance({ system: vars, business: b, instance }).vars;
+  for (const [h, m] of [["harness", "model"], ["fallback.harness", "fallback.model"]]) {
+    if (typeof v[h] !== "string") continue;
+    const provider = models && Object.hasOwn(models, v[m]) ? models[v[m]].provider : "";
+    say("ROUTE", instance, v[h], provider);
+  }
+}
+' "$REPO" "$BUSINESS" 2>&1)" || true
+
+line() { printf '%s\n' "$facts" | awk -F'\t' -v k="$1" '$1 == k' ; }
+cfg="$(line CONFIG)"
+DATA_ROOT='' CONFIG_DIR=''
+case "$cfg" in
+    "CONFIG	ok	"*) IFS=$'\t' read -r _ _ DATA_ROOT CONFIG_DIR <<<"$cfg"; ok "config validates (data root $DATA_ROOT)" ;;
+    "CONFIG	bad	"*) refuse "config: ${cfg#CONFIG	bad	}" ;;
+    *) refuse "config: the check did not run: $(printf '%s' "$facts" | head -n 1)" ;;
+esac
+
+# Tester and profile.
+library="$(line LIBRARY | cut -f2)"
+biz="$(line BUSINESS)"
+if [ "$PROFILE" = factory ] && [ -n "$library" ]; then
+    refuse "profile-library-business: the factory profile refuses business $BUSINESS, whose projects $library are library projects"
+elif [ -n "$cfg" ] && [ "${cfg#CONFIG	ok}" != "$cfg" ]; then
+    case "$biz" in
+        "BUSINESS	ok	"*)
+            ok "business file ${biz#BUSINESS	ok	} validates"
+            tester="$(line TESTER | cut -f2)"
+            if [ "$PROFILE" = library ] && [ "$tester" = on ]; then refuse "bus.tester is on; the library profile needs it off"
+            elif [ "$PROFILE" = factory ] && [ "$tester" != on ]; then refuse "bus.tester is off; the factory profile needs it on"
+            else ok "bus.tester is $tester"; fi ;;
+        *) refuse "business file: ${biz#BUSINESS	bad	}" ;;
+    esac
+fi
+
+# No sudo, and one group.
+if sudo -n true >/dev/null 2>&1; then refuse "sudo -n true succeeds as $ME"; else ok "sudo -n true fails as $ME"; fi
+groups="$(id -G)"
+if [ "$(printf '%s\n' "$groups" | wc -w)" -eq 1 ]; then ok "id -G prints one group ($groups)"
+else refuse "id -G prints more than one group: $groups"; fi
+
+# The run root (packages/seat/src/session.mjs runsDir). newRun makes it
+# 0700, so before the first launch it may not exist yet.
+if [ -n "$DATA_ROOT" ]; then
+    runs="$DATA_ROOT/launches/$BUSINESS"
+    if [ -L "$runs" ]; then refuse "run root $runs is a symlink"
+    elif [ ! -e "$runs" ]; then ok "run root $runs does not exist yet; the first launch makes it 0700"
+    elif [ "$(stat -c '%a' -- "$runs")" = 700 ] && [ -d "$runs" ]; then ok "run root $runs is 0700"
+    else refuse "run root $runs is not a 0700 directory (mode $(stat -c '%a' -- "$runs"))"; fi
+fi
+
+# XDG_DATA_HOME, which copy_root reads (scripts/stack-copy.sh:8).
+if [ -z "${XDG_DATA_HOME+x}" ] || [ "$XDG_DATA_HOME" = "$HOME_DIR/.local/share" ]; then ok "XDG_DATA_HOME is ${XDG_DATA_HOME:-unset}"
+else refuse "XDG_DATA_HOME is $XDG_DATA_HOME; the unit runs the copy under $HOME_DIR/.local/share"; fi
+
+# node 24 or later, every package's engines field.
+nv="$(node --version 2>/dev/null)" || nv=''
+major="${nv#v}"; major="${major%%.*}"
+if [[ "$major" =~ ^[0-9]+$ ]] && [ "$major" -ge 24 ]; then ok "node $nv"
+else refuse "node ${nv:-not found} is older than 24"; fi
+
+# bwrap, as a session needs it.
+if bwrap --unshare-all --ro-bind / / true >/dev/null 2>&1; then ok "bwrap --unshare-all runs"
+else
+    userns="$(cat "$PROC_SYS/kernel/apparmor_restrict_unprivileged_userns" 2>/dev/null || echo absent)"
+    where="$(command -v bwrap || echo 'not on PATH')"
+    refuse "bwrap --unshare-all --ro-bind / / true failed; bwrap: $where; kernel.apparmor_restrict_unprivileged_userns: $userns"
+fi
+
+# The port floor, against the installed Console unit's --port (design 9.3).
+floor="$(cat "$PROC_SYS/net/ipv4/ip_unprivileged_port_start" 2>/dev/null)" || floor=''
+port="$(unit_value "$WEBUI_UNIT" ExecStart | awk '{ for (i = 1; i < NF; i++) if ($i == "--port") p = $(i + 1) } END { print p }')"
+if [ ! -f "$WEBUI_UNIT" ]; then refuse "no installed Console unit $WEBUI_UNIT"
+elif ! [[ "$port" =~ ^[0-9]+$ ]]; then refuse "$WEBUI_UNIT has no --port in its ExecStart"
+elif ! [[ "$floor" =~ ^[0-9]+$ ]]; then refuse "cannot read net.ipv4.ip_unprivileged_port_start"
+elif [ "$floor" -le "$port" ]; then refuse "net.ipv4.ip_unprivileged_port_start is $floor, at or below the Console's port $port, so any $ME process can bind it"
+else ok "net.ipv4.ip_unprivileged_port_start $floor is above the Console's port $port"; fi
+
+routes="$(line ROUTE)"
+SESSION_ENV="${CONFIG_DIR:-$HOME_DIR/.config/mosaic-dev}/secrets/claude-session.env"
+# The session env file, checked as the bus unit's EnvironmentFile.
+env_file_ok() {
+    [ ! -L "$SESSION_ENV" ] && [ -f "$SESSION_ENV" ] && [ "$(stat -c '%u' -- "$SESSION_ENV")" = "$ME_UID" ] && [ "$(stat -c '%a' -- "$SESSION_ENV")" = 600 ]
+}
+
+# Claude Code replaces its prompt with --system-prompt-file.
+if printf '%s\n' "$routes" | awk -F'\t' '$3 == "claude-code" { f = 1 } END { exit !f }'; then
+    claude="$(unit_value "$BUS_UNIT" Environment | sed -n 's/^MOSAIC_CLAUDE_BIN=//p')"
+    claude="${claude:-$(command -v claude || true)}"
+    if [ -z "$claude" ] || [ ! -x "$claude" ]; then refuse "an instance runs claude-code and no claude is installed"
+    else
+        echo "        claude $claude: $("$claude" --version 2>/dev/null | head -n 1)"
+        work="$(mktemp -d)"
+        marker="case2-marker-$(od -An -N6 -tx1 /dev/urandom | tr -d ' \n')"
+        printf 'Reply with exactly this text and nothing else: %s\n' "$marker" >"$work/prompt.md"
+        out="$(cd "$work" && (
+            if env_file_ok; then
+                while IFS= read -r l; do
+                    case "$l" in [A-Za-z_]*=*) k="${l%%=*}"; [[ "$k" =~ ^[A-Za-z_][A-Za-z0-9_]*$ ]] && export "$k=$(env_value "$SESSION_ENV" "$k")" ;; esac
+                done <"$SESSION_ENV"
+            fi
+            timeout 180 "$claude" -p --system-prompt-file "$work/prompt.md" --tools "" --setting-sources "" \
+                --no-session-persistence --output-format json "Reply now." 2>/dev/null
+        ))" || out=''
+        rm -rf -- "$work"
+        verdict="$(printf '%s' "$out" | node -e '
+            let s = ""; process.stdin.on("data", (d) => (s += d)).on("end", () => {
+              const [marker, ceiling] = process.argv.slice(1);
+              let r; try { r = JSON.parse(s); } catch { console.log("noreply"); return; }
+              const u = r.usage ?? {};
+              const n = (u.input_tokens ?? 0) + (u.cache_creation_input_tokens ?? 0) + (u.cache_read_input_tokens ?? 0);
+              if (!String(r.result ?? "").includes(marker)) console.log(`nomarker ${n}`);
+              else console.log(`${n <= Number(ceiling) ? "replaced" : "appended"} ${n}`);
+            });' "$marker" "$MARKER_TOKEN_CEILING")"
+        case "$verdict" in
+            replaced\ *) ok "claude replaces its prompt with --system-prompt-file (${verdict#replaced } input tokens)" ;;
+            appended\ *) refuse "claude adds to its own prompt with --system-prompt-file: ${verdict#appended } input tokens, more than $MARKER_TOKEN_CEILING" ;;
+            nomarker\ *) refuse "claude's reply to the marker prompt lacks the marker (${verdict#nomarker } input tokens)" ;;
+            *) refuse "claude gave no JSON reply to the marker prompt" ;;
+        esac
+    fi
+fi
+
+# ZAI_API_KEY, when some instance's provider is zai (design 10 step 2d).
+if printf '%s\n' "$routes" | awk -F'\t' '$4 == "zai" { f = 1 } END { exit !f }'; then
+    if [ -L "$SESSION_ENV" ]; then refuse "$SESSION_ENV is a symlink"
+    elif [ ! -f "$SESSION_ENV" ]; then refuse "an instance's provider is zai and $SESSION_ENV is missing"
+    elif ! env_file_ok; then refuse "$SESSION_ENV must be owned by $ME at 0600 (mode $(stat -c '%a' -- "$SESSION_ENV"))"
+    elif [ -z "$(env_value "$SESSION_ENV" ZAI_API_KEY)" ]; then refuse "$SESSION_ENV sets no nonempty ZAI_API_KEY"
+    else ok "$SESSION_ENV sets ZAI_API_KEY"; fi
+fi
+
+echo "        free memory: $(awk '$1 == "MemAvailable:" { printf "%d MiB", $2 / 1024 }' /proc/meminfo)"
+if [ "$FAILED" = 0 ]; then echo "case2-precheck: every check passed"; exit 0; fi
+echo "case2-precheck: refused"
+exit 1
@@ -0,0 +1,425 @@
+#!/usr/bin/env bash
+# Case 2 row C2-13a (design 9.3, 10 step 2c): render and install the two
+# system units a hub runs as, [email protected] (enabled as
+# mosaic-bus@<business>.service) and mosaic-webui.service, from the existing
+# templates, which it doesn't change.
+#
+#   case2-unit.sh --user NAME --home DIR --business ID --copy ID --node PATH
+#                 [--profile factory|library] [--pm] [--claude PATH]
+#                 -- SERVE FLAGS
+#
+# Root runs it from a root-owned checkout of the reviewed commit outside
+# <home>, never from the release, because <user> can write the release. It
+# writes both units under /etc/systemd/system as root:root 0644, runs
+# `systemctl daemon-reload`, enables both, then starts the bus and then the
+# Console (Q189). Both come back after a boot on their own. It never links
+# a unit file into place, and it opens no file under <home>: it only stats the
+# copy, its scripts/mosaic and the proof file. It renders the default
+# instance only.
+#
+# The library profile takes exactly these serve flags, each once:
+#   --port N (1..1023)  --business ID (the unit's)  --public-host NAME
+#   --auth-header HEADER  --allow-user ID  --send
+#   --proof-header NAME  --proof-file PATH
+# The factory profile takes --port N (1..1023) and --business ID, and an
+# optional --tester-port N (1024..65535, never --port). Only factory takes
+# --pm and --claude.
+#
+# On a re-install the installed units must equal the render in everything
+# but the copy id, and both must name one copy, so a re-pin or rollback
+# re-renders the pair together. A unit that was already running stays on its
+# old copy, since `systemctl start` leaves it alone; the script says so and
+# that the bus and Console must restart together, and restarts nothing.
+#
+# Test seams, for packages/cli/tests/case2-unit.test.mjs only:
+#   CASE2_UNIT_DIR        the unit directory, default /etc/systemd/system;
+#                         the root and root-owned checks apply only there
+#   CASE2_SYSTEMCTL       the systemctl command, default systemctl
+#   CASE2_GETENT          the getent command, default getent
+#   CASE2_BUS_TEMPLATE    default packages/cli/systemd/mosaic-bus.service.in
+#   CASE2_WEBUI_TEMPLATE  default packages/webui/systemd/mosaic-webui.service.in
+#
+# Exit 0 done, 1 refused, 4 usage.
+set -euo pipefail
+REPO="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+DEFAULT_UNIT_DIR=/etc/systemd/system
+UNIT_DIR="${CASE2_UNIT_DIR:-$DEFAULT_UNIT_DIR}"
+SYSTEMCTL="${CASE2_SYSTEMCTL:-systemctl}"
+GETENT="${CASE2_GETENT:-getent}"
+BUS_TEMPLATE="${CASE2_BUS_TEMPLATE:-$REPO/packages/cli/systemd/mosaic-bus.service.in}"
+WEBUI_TEMPLATE="${CASE2_WEBUI_TEMPLATE:-$REPO/packages/webui/systemd/mosaic-webui.service.in}"
+BUS_UNIT=[email protected]
+WEBUI_UNIT=mosaic-webui.service
+
+usage() { echo 'usage: case2-unit.sh --user NAME --home DIR --business ID --copy ID --node PATH [--profile factory|library] [--pm] [--claude PATH] -- SERVE FLAGS' >&2; exit 4; }
+die() { echo "case2-unit: $*" >&2; exit 1; }
+# A value the unit carries as itself: no space, %, $, quote, backslash, & or |.
+plain() { case "$1" in *[!A-Za-z0-9/._+-]*) return 1 ;; esac; }
+abs_plain() {
+    case "$1" in /*) ;; *) die "$2 must be an absolute path: $1" ;; esac
+    plain "$1" || die "$2 contains a character the unit cannot carry: $1"
+    case "$1/" in */./*|*/../*|?*//*) die "$2 must be a normalized path: $1" ;; esac
+    [ "$1" = / ] || [ "${1%/}" = "$1" ] || die "$2 must not end in /: $1"
+}
+
+PROFILE=library USER_NAME='' HOME_DIR='' BUSINESS='' COPY_ID='' NODE='' PM=0 CLAUDE='' CLAUDE_SET=0
+while [ $# -gt 0 ]; do
+    case "$1" in
+        --profile|--user|--home|--business|--copy|--node|--claude)
+            [ $# -ge 2 ] || usage
+            case "$1" in
+                --profile) PROFILE="$2" ;; --user) USER_NAME="$2" ;; --home) HOME_DIR="$2" ;;
+                --business) BUSINESS="$2" ;; --copy) COPY_ID="$2" ;; --node) NODE="$2" ;;
+                --claude) CLAUDE="$2"; CLAUDE_SET=1 ;;
+            esac
+            shift 2 ;;
+        --pm) PM=1; shift ;;
+        --) shift; break ;;
+        *) usage ;;
+    esac
+done
+SERVE=("$@")
+[ -n "$USER_NAME" ] && [ -n "$HOME_DIR" ] && [ -n "$BUSINESS" ] && [ -n "$COPY_ID" ] && [ -n "$NODE" ] || usage
+case "$PROFILE" in factory|library) ;; *) die "--profile must be factory or library: $PROFILE" ;; esac
+if [ "$PROFILE" = library ]; then
+    [ "$PM" = 0 ] || die "the library profile refuses --pm"
+    [ "$CLAUDE_SET" = 0 ] || die "the library profile refuses --claude"
+fi
+
+if [ "$UNIT_DIR" = "$DEFAULT_UNIT_DIR" ]; then
+    [ "$(id -u)" = 0 ] || die "writing $DEFAULT_UNIT_DIR needs root"
+fi
+
+# The user, its uid, primary group and home, from the passwd database.
+[[ "$USER_NAME" =~ ^[a-z_][a-z0-9_-]{0,31}$ ]] || die "--user must be a user name: $USER_NAME"
+PW="$("$GETENT" passwd "$USER_NAME")" || die "no user $USER_NAME in the passwd database"
+IFS=: read -r _ _ USER_UID USER_GID _ PW_HOME _ <<<"$PW"
+[[ "$USER_UID" =~ ^[0-9]+$ ]] && [ "$USER_UID" -ne 0 ] || die "--user must not be root: $USER_NAME"
+abs_plain "$HOME_DIR" '--home'
+[ "$HOME_DIR" = "$PW_HOME" ] || die "--home $HOME_DIR is not $USER_NAME's home in the passwd database ($PW_HOME)"
+GR="$("$GETENT" group "$USER_GID")" || die "no group $USER_GID in the group database"
+GROUP="${GR%%:*}"
+[[ "$GROUP" =~ ^[a-z_][a-z0-9_-]{0,31}$ ]] || die "the primary group of $USER_NAME is not a group name: $GROUP"
+
+case "$BUSINESS" in [a-z0-9]*) ;; *) die "--business must be a business id: $BUSINESS" ;; esac
+case "$BUSINESS" in *[!a-z0-9._-]*) die "--business must be a business id: $BUSINESS" ;; esac
+[ "${#BUSINESS}" -le 64 ] || die "--business must be a business id: $BUSINESS"
+
+# The copy: copy_root's rule (scripts/stack-copy.sh:8, :22), under <home>.
+COPIES="$HOME_DIR/.local/share/mosaic-stack/copies"
+[[ "$COPY_ID" =~ ^[0-9a-f]{40}$ ]] || die "--copy must be a full 40-character lower-case commit id: $COPY_ID"
+COPY="$COPIES/$COPY_ID"
+[ -d "$COPY" ] && [ ! -L "$COPY" ] || die "no copy directory $COPY"
+[ -f "$COPY/scripts/mosaic" ] || die "no copy $COPY_ID in $COPIES: $COPY/scripts/mosaic is missing"
+
+# Owned by root and writable by no one else, the file and every directory above it.
+root_only() {
+    local p="$1" what="$2" owner mode
+    while :; do
+        owner="$(stat -c '%u' -- "$p")" || die "cannot stat $p"
+        mode="$(stat -c '%a' -- "$p")" || die "cannot stat $p"
+        [ "$owner" = 0 ] || die "$what: $p is not owned by root"
+        (( (8#$mode & 8#022) == 0 )) || die "$what: $p is writable by its group or others"
+        [ "$p" = / ] && break
+        p="$(dirname -- "$p")"
+    done
+}
+
+# --node: an absolute path to a root-owned regular file outside <home>.
+abs_plain "$NODE" '--node'
+case "$NODE/" in "$HOME_DIR"/*) die "--node must be outside $HOME_DIR: $NODE" ;; esac
+[ ! -L "$NODE" ] || die "--node must not be a symlink; pass its target: $NODE"
+[ -f "$NODE" ] && [ -x "$NODE" ] || die "--node must be an executable regular file: $NODE"
+root_only "$NODE" '--node'
+
+# --claude follows the --node rule, so nothing running as <user> can replace
+# the binary the bus runs.
+if [ "$CLAUDE_SET" = 1 ]; then
+    abs_plain "$CLAUDE" '--claude'
+    case "$CLAUDE/" in "$HOME_DIR"/*) die "--claude must be outside $HOME_DIR: $CLAUDE" ;; esac
+    [ ! -L "$CLAUDE" ] || die "--claude must not be a symlink; pass its target: $CLAUDE"
+    [ -f "$CLAUDE" ] && [ -x "$CLAUDE" ] || die "--claude must be an executable regular file: $CLAUDE"
+    root_only "$CLAUDE" '--claude'
+fi
+
+# The checkout the templates come from, when installing for real.
+if [ "$UNIT_DIR" = "$DEFAULT_UNIT_DIR" ]; then
+    case "$REPO/" in "$HOME_DIR"/*) die "run this from a root-owned checkout outside $HOME_DIR, not $REPO" ;; esac
+    root_only "$BUS_TEMPLATE" 'bus template'
+    root_only "$WEBUI_TEMPLATE" 'Console template'
+fi
+
+# The serve flags, checked as scripts/webui-service.sh serve_flags checks
+# them (:201-264), and kept in the order given. That script compares the
+# proof file's owner to `id -u`, which is root here, so this copy has its own.
+serve_flags() {
+    local -A seen=()
+    local flags='' name value
+    local port='' public_host='' auth_header='' allow_user='' proof_header='' proof_file='' tester_port=''
+    local i=0 n=${#SERVE[@]}
+    while [ "$i" -lt "$n" ]; do
+        name="${SERVE[$i]}"
+        case "$name" in
+            --tester-port) [ "$PROFILE" = factory ] || die "the library profile refuses --tester-port: the tester listener takes writes from loopback with no sign-in" ;;
+            --checkout) die "refusing --checkout: Case 2 has no queue panel" ;;
+            --board) die "refusing --board: Case 2 runs no control board" ;;
+            --sso) die "refusing --sso: the Console signs people in through the proxy, with the preview set and the proof pair (Q175 phase 2 is a follow-up)" ;;
+            --port|--business) ;;
+            --public-host|--auth-header|--allow-user|--proof-header|--proof-file|--send)
+                [ "$PROFILE" = library ] || die "the factory profile refuses $name: its host has no proxy" ;;
+            *) die "unknown serve flag: $name" ;;
+        esac
+        [ -z "${seen[$name]:-}" ] || die "serve flag $name given twice"
+        seen[$name]=1
+        if [ "$name" = --send ]; then flags="$flags --send"; i=$((i + 1)); continue; fi
+        [ $((i + 1)) -lt "$n" ] || die "serve flag $name needs a value"
+        value="${SERVE[$((i + 1))]}"
+        case "$name" in
+            --port) port="$value"
+                [[ "$port" =~ ^[1-9][0-9]{0,3}$ ]] && [ "$port" -le 1023 ] || die "--port must be 1..1023, so only the unit's capability can bind it: $port" ;;
+            --business) [ "$value" = "$BUSINESS" ] || die "serve --business $value is not the unit's business $BUSINESS" ;;
+            --public-host) public_host="$value"
+                case "$value" in [A-Za-z0-9]*) ;; *) die "public host must be a hostname, no port or scheme: $value" ;; esac
+                case "$value" in *[!A-Za-z0-9.-]*) die "public host must be a hostname, no port or scheme: $value" ;; esac ;;
+            --auth-header) auth_header="$value"
+                case "$value" in [A-Za-z0-9]*) ;; *) die "auth header must be a header name: $value" ;; esac
+                case "$value" in *[!A-Za-z0-9-]*) die "auth header must be a header name: $value" ;; esac ;;
+            --allow-user) allow_user="$value"
+                case "$value" in [A-Za-z0-9]*) ;; *) die "allowed user must start with a letter or digit: $value" ;; esac
+                case "$value" in *[!A-Za-z0-9._@+-]*) die "allowed user contains a character the unit cannot carry: $value" ;; esac ;;
+            --proof-header) proof_header="$value"
+                [[ "$value" =~ ^[A-Za-z0-9][A-Za-z0-9-]{0,63}$ ]] || die "invalid proxy proof header" ;;
+            --proof-file) proof_file="$value" ;;
+            --tester-port) tester_port="$value"
+                [[ "$value" =~ ^[1-9][0-9]{3,4}$ ]] && [ "$value" -ge 1024 ] && [ "$value" -le 65535 ] || die "--tester-port must be 1024..65535: $value" ;;
+        esac
+        flags="$flags $name $value"
+        i=$((i + 2))
+    done
+    local required=(--port --business)
+    [ "$PROFILE" = factory ] || required+=(--public-host --auth-header --allow-user --send --proof-header --proof-file)
+    for name in "${required[@]}"; do
+        [ -n "${seen[$name]:-}" ] || die "serve flag $name is required"
+    done
+    [ -z "$tester_port" ] || [ "$tester_port" -ne "$port" ] || die "--tester-port must differ from --port"
+    if [ "$PROFILE" = factory ]; then echo "${flags# }"; return 0; fi
+    # Lead decision 101: the uid header carries the Authentik uid.
+    if [ "${auth_header,,}" = x-authentik-uid ] && ! [[ "$allow_user" =~ ^[0-9a-f]{64}$ ]]; then
+        die "with --auth-header $auth_header the allowed user must be an Authentik uid, 64 lower-case hex characters (lead decision 101): $allow_user"
+    fi
+    case "${proof_header,,}" in host|origin|x-mosaic-tester|"${auth_header,,}") die "proxy proof header must differ from Host, Origin, tester and auth headers" ;; esac
+    # The proof file: metadata only, never opened (design 9.3).
+    local secrets="$HOME_DIR/.config/mosaic-dev/secrets" real owner mode
+    abs_plain "$proof_file" 'proxy proof file'
+    [ ! -L "$proof_file" ] || die "proxy proof file must not be a symlink: $proof_file"
+    [ -f "$proof_file" ] || die "proxy proof file must be a regular file: $proof_file"
+    real="$(realpath -e -- "$proof_file")" || die "cannot resolve proxy proof file: $proof_file"
+    [ "$real" = "$proof_file" ] || die "proxy proof file path must have no symlink in it: $proof_file"
+    case "$proof_file" in "$secrets"/*) ;; *) die "proxy proof file must be under $secrets, outside the data root: $proof_file" ;; esac
+    owner="$(stat -c '%u' -- "$proof_file")" || die "cannot stat proxy proof file"
+    mode="$(stat -c '%a' -- "$proof_file")" || die "cannot stat proxy proof file"
+    [ "$owner" = "$USER_UID" ] || die "proxy proof file must be owned by $USER_NAME (uid $USER_UID): $proof_file"
+    [ "$mode" = 600 ] || [ "$mode" = 400 ] || die "proxy proof file must be mode 0600 or 0400, not $mode: $proof_file"
+    echo "${flags# }"
+}
+FLAGS="$(serve_flags)" || exit 1
+
+# PATH: the node's directory first, then the default list without it. Unlike
+# scripts/webui-service.sh:303-305 this always puts node's directory first,
+# so the bus's `exec node` (scripts/mosaic) finds the same node.
+NODE_DIR="$(dirname -- "$NODE")"
+UNIT_PATH="$NODE_DIR"
+for d in /usr/local/bin /usr/bin /bin; do [ "$d" = "$NODE_DIR" ] || UNIT_PATH="$UNIT_PATH:$d"; done
+
+HARDENING="ProtectSystem=strict
+ReadWritePaths=$HOME_DIR
+ProtectHome=yes
+PrivateTmp=yes"
+CAPS="AmbientCapabilities=CAP_NET_BIND_SERVICE
+CapabilityBoundingSet=CAP_NET_BIND_SERVICE"
+# The default instance, as scripts/instance.sh:85-107 renders it: no
+# MOSAIC_CONFIG line, and the session env under %h, which becomes <home>.
+SESSION_ENV='%h/.config/mosaic-dev/secrets/claude-session.env'
+ENV_FILE="-$HOME_DIR/.config/mosaic-dev/secrets/claude-session.env"
+PM_FLAGS=''
+[ "$PM" = 0 ] || PM_FLAGS=' --pm'
+CLAUDE_ENV=''
+[ "$CLAUDE_SET" = 0 ] || CLAUDE_ENV="Environment=MOSAIC_CLAUDE_BIN=$CLAUDE"
+
+# One unit from its template. kind is bus or webui.
+render() {
+    local kind="$1" template="$2" text tokens
+    [ -f "$template" ] && [ ! -L "$template" ] || die "template missing or not a regular file: $template"
+    text="$(sed -e "s|@REPO@|$COPY|g" -e "s|@PATH@|$UNIT_PATH|g" -e "s|@NODE@|$NODE|g" \
+        -e "s|@PM_FLAGS@|$PM_FLAGS|g" -e "s|^@CLAUDE_ENV@\$|$CLAUDE_ENV|" \
+        -e '/^@CONFIG_ENV@$/d' -e "s|@SESSION_ENV@|$SESSION_ENV|g" \
+        -e "s|%h|$HOME_DIR|g" -- "$template")"
+    # Checked before @FLAGS@ goes in, since an allowed user may hold @.
+    tokens="$(printf '%s\n' "$text" | grep -oE '@[A-Z_]+@' || true)"
+    if [ "$kind" = webui ]; then
+        [ "$tokens" = @FLAGS@ ] || die "$template: a token other than one @FLAGS@ is left after the render: $(echo $tokens)"
+        text="${text//@FLAGS@/$FLAGS}"
+    else
+        [ -z "$tokens" ] || die "$template: a token is left after the render: $(echo $tokens)"
+    fi
+    if printf '%s\n' "$text" | grep -q '%h'; then die "$template: %h is left after the render"; fi
+    local add="User=$USER_NAME\nGroup=$GROUP\n${HARDENING//$'\n'/\\n}\n"
+    [ "$kind" = bus ] || add="$add${CAPS//$'\n'/\\n}\n"
+    # The added lines go at the end of [Service], before its trailing blank
+    # lines. In [Install], WantedBy=multi-user.target replaces
+    # WantedBy=default.target in both units, so both start at boot (Q189).
+    printf '%s\n' "$text" | awk -v add="$add" '
+        function blanks_out() { for (; blanks > 0; blanks--) print "" }
+        /^\[.*\]$/ {
+            if (sec == "[Service]") printf "%s", add
+            sec = $0
+            blanks_out(); print; next
+        }
+        $0 == "" { blanks++; next }
+        { blanks_out() }
+        sec == "[Install]" && $0 == "WantedBy=default.target" { $0 = "WantedBy=multi-user.target" }
+        { print }
+        END { if (sec == "[Service]") printf "%s", add; blanks_out() }'
+}
+
+# The unit's settings as section<TAB>key<TAB>value, one per line, keys
+# trimmed as systemd trims them. A continued line refuses, so no setting
+# hides in one.
+settings() {
+    awk '
+        { sub(/^[ \t]+/, ""); sub(/[ \t]+$/, "") }
+        $0 == "" || /^[#;]/ { next }
+        /\\$/ { print "CONTINUED"; exit }
+        /^\[.*\]$/ { sec = $0; next }
+        {
+            i = index($0, "="); if (i == 0) { print "NOKEY\t" $0; next }
+            k = substr($0, 1, i - 1); v = substr($0, i + 1)
+            sub(/[ \t]+$/, "", k); sub(/^[ \t]+/, "", v)
+            print sec "\t" k "\t" v
+        }'
+}
+
+# Refuses unless one unit's fixed lines hold. what names the unit in messages,
+# copy is the copy directory it should run from.
+check_unit() {
+    local kind="$1" text="$2" what="$3" copy="$4" s
+    s="$(printf '%s\n' "$text" | settings)"
+    ! printf '%s\n' "$s" | grep -qx CONTINUED || die "$what: a line continues onto the next"
+    ! printf '%s\n' "$s" | grep -q '^NOKEY' || die "$what: a line is neither a section, a comment nor a setting"
+    # %h in a system unit is root's home, not <user>'s.
+    ! printf '%s\n' "$text" | grep -q '%h' || die "$what: %h is left; a system unit reads it as root's home"
+    local key
+    for key in RestrictNamespaces PrivateUsers SystemCallFilter PermissionsStartOnly; do
+        ! printf '%s\n' "$s" | awk -F'\t' -v k="$key" '$2 == k { found = 1 } END { exit !found }' \
+            || die "$what: refusing $key=, which the hub's units must not hold"
+    done
+    # An Exec*= value whose leading prefix characters hold + or ! runs with
+    # full privileges, whatever User= says.
+    local bad
+    bad="$(printf '%s\n' "$s" | awk -F'\t' '$2 ~ /^Exec/ { p = $3; sub(/[^-@:+!].*$/, "", p); if (p ~ /[+!]/) print $2 "=" $3 }')"
+    [ -z "$bad" ] || die "$what: refusing an Exec line that runs with full privileges: $bad"
+    # The fixed lines, each exactly once, in [Service].
+    one() {
+        local k="$1" v="$2" got
+        got="$(printf '%s\n' "$s" | awk -F'\t' -v k="$k" '$2 == k { print $1 "\t" $3 }')"
+        [ "$got" = "[Service]	$v" ] || die "$what: $k= must be exactly once in [Service], as $k=$v"
+    }
+    none() {
+        ! printf '%s\n' "$s" | awk -F'\t' -v k="$1" '$2 == k { found = 1 } END { exit !found }' || die "$what: refusing $1=, which this unit must not hold"
+    }
+    one User "$USER_NAME"
+    one Group "$GROUP"
+    one WorkingDirectory "$copy"
+    # Environment= lines: PATH, and MOSAIC_CLAUDE_BIN only with --claude.
+    local envs want_envs="[Service]	PATH=$UNIT_PATH"
+    [ "$kind" = webui ] || [ -z "$CLAUDE_ENV" ] || want_envs="$want_envs
+[Service]	MOSAIC_CLAUDE_BIN=$CLAUDE"
+    envs="$(printf '%s\n' "$s" | awk -F'\t' '$2 == "Environment" { print $1 "\t" $3 }')"
+    [ "$envs" = "$want_envs" ] || die "$what: the Environment= lines must be exactly: $(printf '%s' "$want_envs" | cut -f2 | tr '\n' ' ')"
+    one NoNewPrivileges yes
+    one ProtectSystem strict
+    one ReadWritePaths "$HOME_DIR"
+    one ProtectHome yes
+    one PrivateTmp yes
+    local order
+    order="$(printf '%s\n' "$s" | awk -F'\t' '$2 ~ /^(ProtectSystem|ReadWritePaths|ProtectHome|PrivateTmp)$/ { printf "%s ", $2 }')"
+    [ "$order" = "ProtectSystem ReadWritePaths ProtectHome PrivateTmp " ] || die "$what: the hardening lines must be in the order ProtectSystem, ReadWritePaths, ProtectHome, PrivateTmp"
+    local wanted
+    wanted="$(printf '%s\n' "$s" | awk -F'\t' '$2 == "WantedBy" { print $1 "\t" $3 }')"
+    [ "$wanted" = "[Install]	multi-user.target" ] || die "$what: WantedBy= must be exactly once, as WantedBy=multi-user.target"
+    if [ "$kind" = bus ]; then
+        one ExecStart "$copy/scripts/mosaic bus start %i$PM_FLAGS"
+        one EnvironmentFile "$ENV_FILE"
+        none AmbientCapabilities
+        none CapabilityBoundingSet
+    else
+        one ExecStart "$NODE $copy/packages/webui/src/cli.mjs serve $FLAGS"
+        none EnvironmentFile
+        one AmbientCapabilities CAP_NET_BIND_SERVICE
+        one CapabilityBoundingSet CAP_NET_BIND_SERVICE
+    fi
+}
+
+BUS_TEXT="$(render bus "$BUS_TEMPLATE")" || exit 1
+WEBUI_TEXT="$(render webui "$WEBUI_TEMPLATE")" || exit 1
+check_unit bus "$BUS_TEXT" "rendered $BUS_UNIT" "$COPY"
+check_unit webui "$WEBUI_TEXT" "rendered $WEBUI_UNIT" "$COPY"
+
+# A re-install: each installed unit passes the same checks, both name one
+# copy, and each equals the render once its copy id is the new one.
+[ -d "$UNIT_DIR" ] && [ ! -L "$UNIT_DIR" ] || die "no unit directory $UNIT_DIR"
+installed_ids=''
+for pair in "bus:$BUS_UNIT:BUS_TEXT" "webui:$WEBUI_UNIT:WEBUI_TEXT"; do
+    IFS=: read -r kind name var <<<"$pair"
+    path="$UNIT_DIR/$name"
+    [ ! -L "$path" ] || die "refusing: $path is a symlink"
+    [ -e "$path" ] || continue
+    [ -f "$path" ] || die "refusing: $path is not a regular file"
+    text="$(cat -- "$path")"
+    old="$(printf '%s\n' "$text" | settings | awk -F'\t' -v c="$COPIES/" '$2 == "WorkingDirectory" && index($3, c) == 1 { print substr($3, length(c) + 1) }')"
+    [[ "$old" =~ ^[0-9a-f]{40}$ ]] || die "installed $path names no copy under $COPIES"
+    check_unit "$kind" "$text" "installed $path" "$COPIES/$old"
+    [ "$text" = "$(printf '%s\n' "${!var}" | sed "s|$COPY|$COPIES/$old|g")" ] \
+        || die "installed $path differs from the render in more than the copy id; the node path, serve flags, --pm and --claude must equal the installed ones"
+    installed_ids="$installed_ids $old"
+done
+read -r -a ids <<<"$installed_ids"
+[ "${#ids[@]}" -lt 2 ] || [ "${ids[0]}" = "${ids[1]}" ] || die "the installed units name different copies, ${ids[0]} and ${ids[1]}"
+
+# `systemctl start` leaves a running unit on the copy it started from, so
+# note which units run before the write (row 195 owns the restart).
+BUS_NAME="mosaic-bus@$BUSINESS.service"
+running=''
+for name in "$BUS_NAME" "$WEBUI_UNIT"; do
+    if "$SYSTEMCTL" is-active --quiet "$name"; then running="$running $name"; fi
+done
+
+# Write each unit to a temp file in the unit directory, then rename.
+write_unit() {
+    local name="$1" text="$2" tmp
+    tmp="$(mktemp "$UNIT_DIR/.case2-unit.XXXXXX")"
+    printf '%s\n' "$text" >"$tmp"
+    chmod 0644 "$tmp"
+    [ "$(id -u)" != 0 ] || chown root:root "$tmp"
+    mv -fT -- "$tmp" "$UNIT_DIR/$name"
+}
+write_unit "$BUS_UNIT" "$BUS_TEXT"
+write_unit "$WEBUI_UNIT" "$WEBUI_TEXT"
+# Enable both, then start the bus, then the Console (design 10 step 2c).
+# serve calls the bus per request, so the units carry no After= or Wants=.
+"$SYSTEMCTL" daemon-reload || die "systemctl daemon-reload failed; the units are written, nothing is enabled or started"
+"$SYSTEMCTL" enable "$BUS_NAME" "$WEBUI_UNIT" || die "systemctl enable $BUS_NAME $WEBUI_UNIT failed; nothing is started"
+"$SYSTEMCTL" start "$BUS_NAME" || die "systemctl start $BUS_NAME failed; the Console is not started"
+"$SYSTEMCTL" start "$WEBUI_UNIT" || die "systemctl start $WEBUI_UNIT failed; the bus is running"
+if [ -z "$running" ]; then
+    echo "case2-unit: wrote $UNIT_DIR/$BUS_UNIT and $UNIT_DIR/$WEBUI_UNIT from copy $COPY_ID; enabled and started $BUS_NAME, then $WEBUI_UNIT"
+    exit 0
+fi
+echo "case2-unit: wrote $UNIT_DIR/$BUS_UNIT and $UNIT_DIR/$WEBUI_UNIT from copy $COPY_ID and enabled both"
+for name in "$BUS_NAME" "$WEBUI_UNIT"; do
+    case " $running " in
+        *" $name "*) echo "case2-unit: $name was already running, so it is still on ${ids[0]:+copy }${ids[0]:-the copy it started from}, not copy $COPY_ID" ;;
+        *) echo "case2-unit: started $name on copy $COPY_ID" ;;
+    esac
+done
+echo "case2-unit: restart $BUS_NAME and $WEBUI_UNIT together to put both on copy $COPY_ID; until then they may run different copies"
@@ -3,25 +3,21 @@
 # copy creates files only; wrapper is a separately Mos-gated live step.
 # wrapper and check take --instance NAME (row 190): the units mosaic-bus-NAME@ and mosaic-webui-NAME
 # and the wrapper $BIN/mosaic-NAME, which sets NAME's MOSAIC_CONFIG. check needs --business for NAME.
-# Row 232: check --units external reads root's system units. copy --bundle makes the copy from a git
-# bundle on a host with no checkout, and wrapper --create writes the first wrapper on a new host.
 set -euo pipefail
 REPO="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
 COPIES="${XDG_DATA_HOME:-$HOME/.local/share}/mosaic-stack/copies"
 BIN="$HOME/.npm-global/bin"
 BUSINESS=mosaic-stack BUSINESS_SET=0
-ALLOW_WORKTREE=0 UNITS=user BUNDLE="" CREATE=0 CLEAN=""
+ALLOW_WORKTREE=0
 MARKER='# mosaic-cli wrapper (Q81, agents/sage/work/q81/mosaic-cli.sh)'
-usage() { echo 'usage: stack-copy.sh copy COMMIT [--copies DIR] [--allow-worktree] | copy --bundle FILE SHA [--copies DIR] | wrapper ID [--instance NAME] [--copies DIR] [--bin DIR] [--create] | check [--instance NAME] [--copies DIR] [--bin DIR] [--business ID] [--units user|external]' >&2; exit "${1:-4}"; }
+usage() { echo 'usage: stack-copy.sh copy COMMIT [--copies DIR] [--allow-worktree] | wrapper ID [--instance NAME] [--copies DIR] [--bin DIR] | check [--instance NAME] [--copies DIR] [--bin DIR] [--business ID]' >&2; exit "${1:-4}"; }
 die() { echo "stack-copy: $*" >&2; exit 1; }
 plain_path() { case "$1" in /*) ;; *) die "$2 must be an absolute path: $1" ;; esac; case "$1" in *[!A-Za-z0-9/._+-]*) die "$2 contains a character the unit cannot carry: $1" ;; esac; }
 parse() { while [ $# -gt 0 ]; do case "$1" in
 --copies) [ $# -ge 2 ] || usage; COPIES="$2"; shift 2;;
 --bin) [ "$CMD" != copy ] && [ $# -ge 2 ] || usage; BIN="$2";shift 2;;
 --business) [ "$CMD" = check ] && [ $# -ge 2 ] || usage; BUSINESS="$2";BUSINESS_SET=1;shift 2;;
- --allow-worktree) [ "$CMD" = copy ] && [ -z "$BUNDLE" ] || usage; ALLOW_WORKTREE=1;shift;;
- --units) [ "$CMD" = check ] && [ $# -ge 2 ] || usage; case "$2" in user|external) UNITS="$2";; *) usage;; esac; shift 2;;
- --create) [ "$CMD" = wrapper ] || usage; CREATE=1;shift;;
+ --allow-worktree) [ "$CMD" = copy ] || usage; ALLOW_WORKTREE=1;shift;;
 *) usage;; esac; done; plain_path "$COPIES" 'copies directory'; }
 copy_root() { [[ "$ID" =~ ^[0-9a-f]{40}$ ]] || die '--copy must be a full 40-character commit id'; [ -f "$COPIES/$ID/scripts/mosaic" ] || die "no copy $ID in $COPIES"; echo "$COPIES/$ID"; }
 # Closure of scripts/mosaic, bus process/notifier/launcher, Console serve,
@@ -48,22 +44,16 @@ reachable() {
 copy_commit() {
 [ -d "$REPO/.git" ] || [ "$ALLOW_WORKTREE" = 1 ] || die "refusing: $REPO is not the canonical checkout (its .git is not a directory); run copy from the canonical checkout"
 [[ "$ID" =~ ^[A-Za-z0-9][A-Za-z0-9._/-]*$ ]] || die "commit must be a commit id or branch name: $ID"
- local full
+ local full target tmp
 full="$(git -C "$REPO" rev-parse --verify --quiet "$ID^{commit}")" || die "not a commit: $ID"
 reachable "$full"
- copy_tree "$REPO" "$full"
-}
-# The copy of commit $2 from repository $1. CLEAN names a bundle's temporary repository, which the
-# trap removes with the temporary copy.
-copy_tree() {
- local full="$2" target tmp
 target="$COPIES/$full"
 [ ! -L "$target" ] || die "refusing: copy target is a symlink: $target"
 if [ -e "$target" ]; then echo "exists: $target"; return; fi
 mkdir -p "$COPIES"
 tmp="$(mktemp -d "$COPIES/.$full.XXXXXX")"
- trap "chmod -R u+w '$tmp' 2>/dev/null || true; rm -rf '$tmp'$CLEAN" EXIT
- git -C "$1" archive --format=tar "$full" -- "${COPY_PATHS[@]}" | tar -xf - -C "$tmp" || die "git archive failed; no copy written"
+ trap "chmod -R u+w '$tmp' 2>/dev/null || true; rm -rf '$tmp'" EXIT
+ git -C "$REPO" archive --format=tar "$full" -- "${COPY_PATHS[@]}" | tar -xf - -C "$tmp" || die "git archive failed; no copy written"
 [ -f "$tmp/package.json" ] && [ -f "$tmp/package-lock.json" ] || die 'package.json or package-lock.json missing in temp copy; npm ci not run'
 (cd "$tmp" && npm ci --no-audit --no-fund) >&2 || die 'npm ci failed; no copy written'
 find "$tmp" -type f -exec chmod a-w {} +
@@ -75,53 +65,19 @@ copy_tree() {
 trap - EXIT
 echo "copied: $target"
 }
-# Row 232: the copy of SHA from a git bundle, for a host with no refactor checkout. The bundle must
-# verify, carry refs/heads/refactor, and reach SHA from it, as reachable asks of a checkout. Prints
-# the RELEASE value at SHA and the bundle's sha256, the release identity on such a host.
-copy_bundle() {
- [[ "$ID" =~ ^[0-9a-f]{40}$ ]] || die "--bundle needs a full 40-character commit id: $ID"
- [ -f "$BUNDLE" ] && [ ! -L "$BUNDLE" ] || die "refusing: bundle is absent, not regular, or a symlink: $BUNDLE"
- local g sum release heads
- case "$BUNDLE" in /*) ;; *) BUNDLE="$PWD/$BUNDLE";; esac
- g="$(mktemp -d)"
- CLEAN=" '$g'"
- trap "rm -rf '$g'" EXIT
- git init -q --bare "$g" || die 'git init failed; no copy written'
- git -C "$g" bundle verify -q "$BUNDLE" >/dev/null 2>&1 || die "refusing: git bundle verify failed: $BUNDLE"
- heads="$(git -C "$g" bundle list-heads "$BUNDLE" refs/heads/refactor)" || die "refusing: cannot list the bundle's heads: $BUNDLE"
- grep -qx '[0-9a-f]\{40\} refs/heads/refactor' <<< "$heads" || die "refusing: the bundle has no refs/heads/refactor: $BUNDLE"
- # Every ref, so a SHA the bundle carries on another branch reaches the reachability check.
- git -C "$g" fetch -q "$BUNDLE" 'refs/*:refs/*' 2>/dev/null || die "refusing: cannot fetch from $BUNDLE"
- git -C "$g" cat-file -e "$ID^{commit}" 2>/dev/null || die "refusing: $ID is not in the bundle"
- git -C "$g" merge-base --is-ancestor "$ID" refs/heads/refactor || die "refusing: $ID is not reachable from the bundle's refs/heads/refactor"
- release="$(git -C "$g" show "$ID:RELEASE")" || die "no RELEASE at $ID"
- sum="$(sha256sum < "$BUNDLE" | cut -d' ' -f1)"
- copy_tree "$g" "$ID"
- rm -rf "$g"; trap - EXIT
- echo "release: $release"
- echo "bundle sha256: $sum"
-}
-# Row 232: --create writes the wrapper only where none is. ln refuses any existing path, a symlink
-# included, so this is the one check, and a wrapper that appears mid-run is never replaced.
-place() {
- if [ "$CREATE" = 1 ]; then ln "$1" "$2" 2>/dev/null || die "refusing: --create and a wrapper exists: $2"; rm -f "$1"
- else mv -f "$1" "$2"; fi
-}
 wrapper() {
 [ -z "$MOSAIC_UNIT_SUFFIX" ] || { wrapper_instance; return; }
 plain_path "$BIN" 'bin directory'
 local root file lease tmp
 root="$(copy_root)";file="$BIN/mosaic"
+ [ -f "$file" ] && [ ! -L "$file" ] || die "refusing: wrapper is absent, not regular, or a symlink: $file"
+ [ "$(sed -n '2p' "$file")" = "$MARKER" ] || die "refusing: foreign wrapper (missing Q81 marker on line 2): $file"
 lease='[ "${1:-}" = __lease-capability ] && exec "'"$BIN"'/mosaic-old" "$@"'
- if [ "$CREATE" = 0 ]; then
-  [ -f "$file" ] && [ ! -L "$file" ] || die "refusing: wrapper is absent, not regular, or a symlink: $file"
-  [ "$(sed -n '2p' "$file")" = "$MARKER" ] || die "refusing: foreign wrapper (missing Q81 marker on line 2): $file"
-  [ "$(grep -Fxc "$lease" "$file" || true)" = 1 ] || die 'refusing: Q81 lease line missing or ambiguous'
- fi
+ [ "$(grep -Fxc "$lease" "$file" || true)" = 1 ] || die 'refusing: Q81 lease line missing or ambiguous'
 tmp="$(mktemp "$BIN/.mosaic.XXXXXX")"
 trap 'rm -f "$tmp"' EXIT
 printf '#!/usr/bin/env bash\n%s\n# CLI runs from pinned copy: %s\n# The Q81 lease probe still answers at mosaic-old.\n%s\nexec "%s/scripts/mosaic" "$@"\n' "$MARKER" "$root" "$lease" "$root" > "$tmp"
- chmod 0755 "$tmp";place "$tmp" "$file";trap - EXIT
+ chmod 0755 "$tmp";mv -f "$tmp" "$file";trap - EXIT
 echo "wrapper: $root"
 }
 # Row 190: $BIN/mosaic-NAME. It creates the file or replaces one with its own marker, never another.
@@ -137,14 +93,12 @@ wrapper_instance() {
 tmp="$(mktemp "$BIN/.$WRAPPER_NAME.XXXXXX")"
 trap 'rm -f "$tmp"' EXIT
 printf '#!/usr/bin/env bash\n%s\n# CLI runs from pinned copy: %s\nexport MOSAIC_CONFIG='"'"'%s'"'"'\nexec "%s/scripts/mosaic" "$@"\n' "$INSTANCE_MARKER" "$root" "$MOSAIC_INSTANCE_CONFIG" "$root" > "$tmp"
- chmod 0755 "$tmp";place "$tmp" "$file";trap - EXIT
+ chmod 0755 "$tmp";mv -f "$tmp" "$file";trap - EXIT
 echo "wrapper: $root"
 }
-# --units external reads root's system units, which the stack user can read and not change.
-units_show() { if [ "$UNITS" = external ]; then systemctl show "$@"; else systemctl --user show "$@"; fi; }
 unit_root() {
 local out load root exec_start
- out="$(units_show "$1" -p LoadState -p WorkingDirectory -p ExecStart 2>/dev/null)" || { echo 'absent (systemctl read failed)';return; }
+ out="$(systemctl --user show "$1" -p LoadState -p WorkingDirectory -p ExecStart 2>/dev/null)" || { echo 'absent (systemctl read failed)';return; }
 load="$(sed -n 's/^LoadState=//p' <<< "$out")"; root="$(sed -n 's/^WorkingDirectory=//p' <<< "$out")"
 exec_start="$(sed -n 's/^ExecStart=//p' <<< "$out")"
 if [ "$load" != loaded ] || [ -z "$root" ];then echo absent;return;fi
@@ -179,10 +133,7 @@ CMD="$1";shift
 case "$CMD" in check|wrapper) instance_select;; *) [ -z "$INSTANCE_FLAG" ] || usage;; esac
 INSTANCE_MARKER="# mosaic-cli wrapper, instance ${MOSAIC_INSTANCE:-dev} (row 190)"
 case "$CMD" in
- copy|wrapper) [ $# -gt 0 ] || usage
-  if [ "$CMD" = copy ] && [ "$1" = --bundle ];then [ $# -ge 3 ] && [ -n "$2" ] || usage;BUNDLE="$2";shift 2;fi
-  ID="$1";shift;case "$ID" in -*)usage;;esac;parse "$@"
-  if [ -n "$BUNDLE" ];then copy_bundle;elif [ "$CMD" = copy ];then copy_commit;else wrapper;fi;;
+ copy|wrapper) [ $# -gt 0 ] || usage;ID="$1";shift;case "$ID" in -*)usage;;esac;parse "$@";if [ "$CMD" = copy ];then copy_commit;else wrapper;fi;;
 check) parse "$@";[ -z "$MOSAIC_UNIT_SUFFIX" ] || [ "$BUSINESS_SET" = 1 ] || usage;check;;
 -h|--help) usage 0;;
 *) usage;;esac
@@ -19,13 +19,6 @@
 # rehearse (D2, row 163) stops and starts no unit and writes only its own rehearsal directory, but
 # it reads the live config and a backup of the live store, so Jason or Mos runs it.
 #
-# --units external (row 232, #1734; r6 section 4 at agents/darkwing/work/queue-195/DESIGN.md) is
-# for a host whose units are root's system units. This script then reads those units and never
-# starts or stops one: root stops them, activate or rollback stages the copy (A3), root installs
-# and starts them, and confirm gates them and writes the pointer (A5). revert and confirm
-# --rollback put the old copy back when a step fails (R2, R4), and gate checks a copy root
-# restarted with no activation open (A2f). Without it, everything runs as before.
-#
 # Most functions below run as `f || handler`, and bash ignores set -e inside such a call, so
 # every step that can fail carries its own `|| return 1`.
 set -euo pipefail
@@ -39,7 +32,6 @@ BIN="$HOME/.npm-global/bin"
 UNIT_DIR="${XDG_CONFIG_HOME:-$HOME/.config}/systemd/user"
 TIMEOUT=60 WANT_PM=0 AFTER_HARNESS=0 MIGRATE=0 PLAN=0 RESTORE="" EVENTS="" TESTER_PORT=""
 PROOF_HEADER="" PROOF_FILE="" NO_PROOF=0 NO_SEND=0 SSO=0 R_BACKUP="" R_PORT=""
-UNITS=user TO_FLAG="" EXPECT_FROM="" SINCE="" ROLLBACK_OLD="" CAUSE=""

 usage() {
    cat >&2 <<'USAGE'
@@ -50,18 +42,11 @@ usage: stack-release.sh adopt BUSINESS
       stack-release.sh rollback BUSINESS [--restore ACTIVATION [--events N]] [--timeout S] [--plan]
       stack-release.sh status BUSINESS
       stack-release.sh rehearse ID BUSINESS --backup ACTIVATION|PATH --port N [--timeout S]
-       stack-release.sh confirm ID BUSINESS --units external [--rollback OLD --cause A3|A4|A5] [--timeout S]
-       stack-release.sh revert ID BUSINESS --units external
-       stack-release.sh gate ID BUSINESS --units external --since EPOCH [--timeout S]
-common options: --copies DIR, --bin DIR, --instance NAME, --units user|external
+common options: --copies DIR, --bin DIR, --instance NAME
 --instance NAME (row 190) runs on stack instance NAME: its config, data root, units and the wrapper
 mosaic-NAME. Without it, the default instance, as before.
 --events N is the total of the per-table counts the post-backup-events refusal prints: events and
 every table in COUNTED.
--units external (row 232) reads root's system units and starts or stops none. adopt, activate,
-rollback, status, confirm, revert and gate take it; rollback then needs --to ID, the previous copy.
-activate and rollback --plan take --expect-from OLD. --pm, --pm-after-harness, --tester-port, the
-proof flags, --no-proof, --no-send, --sso and pm-on are not for it.
 USAGE
    exit "${1:-4}"
 }
@@ -73,27 +58,7 @@ now_ms() { date -u +%Y-%m-%dT%H:%M:%S.%3NZ; }
 jline() {
    node -e 'const a=process.argv.slice(1),o={};for(let i=0;i<a.length;i+=2)o[a[i]]=a[i+1]==="@null"?null:a[i+1];process.stdout.write(JSON.stringify(o)+"\n")' -- "$@"
 }
-log_line() {
-    [ "$UNITS" = user ] || set -- "$@" units external
-    jline at "$(now)" op "$OP" from "${FROM:-@null}" to "${TO:-@null}" backup "${BACKUP:-@null}" activation "${ACT:-@null}" "$@" >> "$LOG"
-}
-
-# --- The units backend (row 232) ---
-
-# Every systemctl, journalctl and systemd-analyze call goes through these three. user is the
-# systemd user manager, as before. external reads root's system units, which needs no privilege,
-# and refuses any verb that would change one.
-sc() {
-    if [ "$UNITS" = user ]; then systemctl --user "$@"; return; fi
-    case "$1" in
-        show|is-active|list-units) systemctl "$@" ;;
-        *) echo "stack-release: --units external never runs systemctl $1; root does" >&2; return 1 ;;
-    esac
-}
-# The bus unit's journal is a user journal only: under external it lands in the system journal,
-# which the stack's user can't read (r6 section 4), so the external PM check reads launches list.
-jctl() { [ "$UNITS" = user ] || return 1; journalctl --user "$@"; }
-analyze() { [ "$UNITS" = user ] || return 1; systemd-analyze --user "$@"; }
+log_line() { jline at "$(now)" op "$OP" from "${FROM:-@null}" to "${TO:-@null}" backup "${BACKUP:-@null}" activation "${ACT:-@null}" "$@" >> "$LOG"; }

 # A refusal before anything stopped: exit 3, and one log line with the code, except for
 # run-locked (the lock holder may be writing the log) and in --plan, which writes nothing.
@@ -118,7 +83,7 @@ parse_opts() {
        case "$1" in
            --copies) [ $# -ge 2 ] || usage; COPIES="$2"; shift 2 ;;
            --bin) [ $# -ge 2 ] || usage; BIN="$2"; shift 2 ;;
-            --timeout) [ "$OP" != status ] && [ "$OP" != adopt ] && [ "$OP" != revert ] && [ $# -ge 2 ] && [[ "$2" =~ ^[1-9][0-9]{0,4}$ ]] || usage; TIMEOUT="$2"; shift 2 ;;
+            --timeout) [ "$OP" != status ] && [ "$OP" != adopt ] && [ $# -ge 2 ] && [[ "$2" =~ ^[1-9][0-9]{0,4}$ ]] || usage; TIMEOUT="$2"; shift 2 ;;
            --plan) [ "$OP" = activate ] || [ "$OP" = rollback ] || usage; PLAN=1; shift ;;
            --pm) [ "$OP" = activate ] || usage; WANT_PM=1; shift ;;
            --pm-after-harness) [ "$OP" = activate ] || usage; AFTER_HARNESS=1; shift ;;
@@ -133,27 +98,9 @@ parse_opts() {
            --backup) [ "$OP" = rehearse ] && [ $# -ge 2 ] && { [[ "$2" =~ ^[0-9]{8}T[0-9]{6}Z-[0-9a-f]{12}(-[1-9])?$ ]] || [[ "$2" =~ ^/[A-Za-z0-9/._+-]*$ ]]; } || usage; R_BACKUP="$2"; shift 2 ;;
            --port) [ "$OP" = rehearse ] && [ $# -ge 2 ] && [[ "$2" =~ ^[0-9]{1,5}$ ]] && [ "$((10#$2))" -ge 1024 ] && [ "$((10#$2))" -le 65535 ] || usage; R_PORT="$((10#$2))"; shift 2 ;;
            --events) [ "$OP" = rollback ] && [ $# -ge 2 ] && [[ "$2" =~ ^(0|[1-9][0-9]*)$ ]] || usage; EVENTS="$2"; shift 2 ;;
-            --units) [ "$OP" != rehearse ] && [ $# -ge 2 ] && { [ "$2" = user ] || [ "$2" = external ]; } || usage; UNITS="$2"; shift 2 ;;
-            --to) [ "$OP" = rollback ] && [ $# -ge 2 ] && [[ "$2" =~ ^[0-9a-f]{40}$ ]] || usage; TO_FLAG="$2"; shift 2 ;;
-            --expect-from) { [ "$OP" = activate ] || [ "$OP" = rollback ]; } && [ $# -ge 2 ] && [[ "$2" =~ ^[0-9a-f]{40}$ ]] || usage; EXPECT_FROM="$2"; shift 2 ;;
-            --since) [ "$OP" = gate ] && [ $# -ge 2 ] && [[ "$2" =~ ^(0|[1-9][0-9]{0,11})$ ]] || usage; SINCE="$2"; shift 2 ;;
-            --rollback) [ "$OP" = confirm ] && [ $# -ge 2 ] && [[ "$2" =~ ^[0-9a-f]{40}$ ]] || usage; ROLLBACK_OLD="$2"; shift 2 ;;
-            --cause) [ "$OP" = confirm ] && [ $# -ge 2 ] && [[ "$2" =~ ^A[345]$ ]] || usage; CAUSE="$2"; shift 2 ;;
            *) usage ;;
        esac
    done
-    # Row 232: confirm, revert, gate, --to and --expect-from are external only, and an external
-    # rollback names its target. gate needs --since, its start floor (r6 N2), and --expect-from
-    # goes with --plan. The flags that change a unit's render or the PM are root's under external.
-    if [ "$UNITS" = user ]; then
-        [ "$OP" != confirm ] && [ "$OP" != revert ] && [ "$OP" != gate ] && [ -z "$TO_FLAG" ] && [ -z "$EXPECT_FROM" ] || usage
-    else
-        [ "$OP" != rollback ] || [ -n "$TO_FLAG" ] || usage
-        [ "$WANT_PM" = 0 ] && [ -z "$TESTER_PORT" ] && [ -z "$PROOF_HEADER" ] && [ -z "$PROOF_FILE" ] && [ "$NO_PROOF" = 0 ] && [ "$NO_SEND" = 0 ] && [ "$SSO" = 0 ] || usage
-    fi
-    [ "$OP" != gate ] || [ -n "$SINCE" ] || usage
-    [ -z "$EXPECT_FROM" ] || [ "$PLAN" = 1 ] || usage
-    [ "${ROLLBACK_OLD:+1}" = "${CAUSE:+1}" ] || usage
    [ -z "$EVENTS" ] || [ -n "$RESTORE" ] || usage
    [ "$OP" != rehearse ] || { [ -n "$R_BACKUP" ] && [ -n "$R_PORT" ]; } || usage
    # A bad tester port is a usage error; --plan lists it as tester-port-invalid instead (row 180).
@@ -240,7 +187,7 @@ process.exit(1);' -- "$LOG" "$1" "$P_COPY"

 # --- Reading the units ---

-show() { sc show "$1" -p LoadState -p WorkingDirectory -p ExecStart -p Environment -p MainPID -p DropInPaths 2>/dev/null; }
+show() { systemctl --user show "$1" -p LoadState -p WorkingDirectory -p ExecStart -p Environment -p MainPID -p DropInPaths 2>/dev/null; }
 argv_of() { sed -n 's/^ExecStart=.*argv\[\]=\([^;]*\) ;.*/\1/p' <<< "$1"; }
 # systemctl show quotes a value that holds a space and escapes with a backslash, and the read -a
 # split below can't undo either, so such a line is unreadable rather than read wrong (row 166 item 4).
@@ -339,20 +286,12 @@ check_target() {
 #   has KIND  exits 0 when the copy's KINDS has KIND
 #   unknown   prints the business file's plugins keys the copy's KINDS lacks, from a plain JSON read
 #   harness   prints plugins.harness as JSON, or `none`, from the copy's loader
-#   launchby  prints launch.by, the PM's instance, from a plain JSON read (row 232); it imports
-#             only business.mjs, for the business file's path
 # A failure exits 1 and prints its first line.
 PLUGINS_JS='
 const {readFileSync}=require("node:fs");const {pathToFileURL}=require("node:url");
 const [mode,copy,id,kind]=process.argv.slice(1);
 const imp=(p)=>import(pathToFileURL(`${copy}/packages/${p}`).href);
 (async()=>{
-  if(mode==="launchby"){
-    const {businessFilePath}=await imp("business/src/business.mjs");
-    const by=JSON.parse(readFileSync(businessFilePath(id),"utf8")).launch?.by;
-    if(typeof by!=="string"||!by)throw new Error("the business file has no launch.by");
-    return process.stdout.write(by);
-  }
  const {KINDS}=await imp("plugins/src/kinds.mjs");
  if(mode==="has")process.exit(Object.hasOwn(KINDS,kind)?0:1);
  const b=await imp("business/src/business.mjs");
@@ -516,13 +455,13 @@ capture() {

 # Stops the Console, then the bus, and waits for both and the stopped check, within --timeout.
 stop_both() {
-    sc stop "$CONSOLE_UNIT" || return 1
-    sc stop "$BUS_UNIT" || return 1
+    systemctl --user stop "$CONSOLE_UNIT" || return 1
+    systemctl --user stop "$BUS_UNIT" || return 1
    local deadline=$((SECONDS + TIMEOUT)) u s down
    while :; do
        down=1
        for u in "$CONSOLE_UNIT" "$BUS_UNIT"; do
-            s="$(sc is-active "$u" 2>/dev/null || true)"
+            s="$(systemctl --user is-active "$u" 2>/dev/null || true)"
            case "$s" in inactive|failed) ;; *) down=0 ;; esac
        done
        if [ "$down" = 1 ] && stopped; then say "stopped both units"; return 0; fi
@@ -533,7 +472,7 @@ stop_both() {

 start_both() {
    START_EPOCH="$(date +%s)" && START_MS="$(date +%s%3N)" || return 1
-    sc start "$BUS_UNIT" && sc start "$CONSOLE_UNIT"
+    systemctl --user start "$BUS_UNIT" && systemctl --user start "$CONSOLE_UNIT"
 }

 # Step 4: installs copy $1 with pm $2, claude $3 and the Console flags after them. Sets FAIL.
@@ -554,19 +493,9 @@ install_stack() {
 gate_once() {
    local copy="$COPIES/$1" pm="$2" main out
    GATE=units-inactive GATE_WHY=""
-    sc is-active --quiet "$BUS_UNIT" && sc is-active --quiet "$CONSOLE_UNIT" || return 1
-    if [ "$UNITS" = external ]; then
-        # r6 N4: root started the units, so this start's time is the bus unit's, in whole seconds,
-        # at or after FLOOR. It is a gate code, so polling goes on: Restart=on-failure can bring a
-        # fresh start.
-        GATE=stale-start
-        out="$(sc show --timestamp=unix -p ActiveEnterTimestamp "$BUS_UNIT" 2>/dev/null | sed -n 's/^ActiveEnterTimestamp=@//p')" || return 1
-        [[ "$out" =~ ^[0-9]{1,12}$ ]] || { GATE_WHY="ActiveEnterTimestamp is unreadable"; return 1; }
-        [ "$out" -ge "$FLOOR" ] || { GATE_WHY="the bus started at @$out, before @$FLOOR"; return 1; }
-        START_MS=$((out * 1000))
-    fi
+    systemctl --user is-active --quiet "$BUS_UNIT" && systemctl --user is-active --quiet "$CONSOLE_UNIT" || return 1
    GATE=bus-status
-    main="$(sc show "$BUS_UNIT" -p MainPID | sed -n 's/^MainPID=//p')" || return 1
+    main="$(systemctl --user show "$BUS_UNIT" -p MainPID | sed -n 's/^MainPID=//p')" || return 1
    out="$("$copy/scripts/mosaic" bus status --json 2>/dev/null)" || { GATE_WHY="bus status failed"; return 1; }
    # Every `bus start` writes boot.at (packages/cli/src/boot-status.mjs), so a value from before
    # this start means the host on the socket is not the one this run started.
@@ -579,13 +508,13 @@ process.stdout.write(why);' -- "$out" "$BUSINESS" "$main" "$START_MS" 2>&1)" ||
    node -e '
 fetch(`http://127.0.0.1:${process.argv[1]}/healthz`,{signal:AbortSignal.timeout(5000)}).then((r)=>process.exit(r.status===200?0:1),()=>process.exit(1));' -- "$(console_port)" || return 1
    GATE=copy-check
-    out="$(scripts/stack-copy.sh check "${INSTANCE_FLAGS[@]}" "${UNITS_FLAGS[@]}" --copies "$COPIES" --bin "$BIN" --business "$BUSINESS" 2>/dev/null)" || return 1
+    out="$(scripts/stack-copy.sh check "${INSTANCE_FLAGS[@]}" --copies "$COPIES" --bin "$BIN" --business "$BUSINESS" 2>/dev/null)" || return 1
    # check passes when the three agree on one copy; this run needs it to be the target (row 166 item 3).
    out="$(sed -n 's/^bus: //p' <<< "$out")"
    [ "$out" = "$copy" ] || { GATE_WHY="the bus, Console and CLI agree on $out, not $copy"; return 1; }
    if [ "$pm" = 1 ]; then
        GATE=pm-launch-unconfirmed
-        if [ "$UNITS" = user ]; then pm_launched "$copy" || return 1; else pm_external "$1" || return 1; fi
+        pm_launched "$copy" || return 1
    fi
    GATE=""
 }
@@ -597,7 +526,7 @@ fetch(`http://127.0.0.1:${process.argv[1]}/healthz`,{signal:AbortSignal.timeout(
 # because this host's journalctl reads a bare time as local time.
 pm_launched() {
    local journal run list
-    journal="$(jctl -u "$BUS_UNIT" --since "@$START_EPOCH" -o cat 2>/dev/null)" || { GATE_WHY="journal read failed"; return 1; }
+    journal="$(journalctl --user -u "$BUS_UNIT" --since "@$START_EPOCH" -o cat 2>/dev/null)" || { GATE_WHY="journal read failed"; return 1; }
    local -a lines=()
    mapfile -t lines < <(grep '^launched ' <<< "$journal" || true)
    [ "${#lines[@]}" -gt 0 ] || { GATE_WHY="no launched line since the start"; return 1; }
@@ -611,20 +540,6 @@ process.stdout.write(!s?`run ${run} is not in launches list`:s.business!==b?`run
    [ -z "$GATE_WHY" ]
 }

-# r6 section 4: the PM check under --units external, where the bus unit's journal is the system
-# journal and unreadable here. It passes when exactly one live launches list entry is for the
-# PM's instance (launch.by, packages/cli/src/launcher.mjs:675), and that entry is for BUSINESS and
-# started at or after this start. A run the PM starts for another role has another instance.
-pm_external() {
-    local by list
-    by="$(plugins launchby "$1" 2>&1)" || { GATE_WHY="cannot read launch.by: $by"; return 1; }
-    list="$("$COPIES/$1/scripts/mosaic" launches list --json 2>/dev/null)" || { GATE_WHY="launches list failed"; return 1; }
-    GATE_WHY="$(node -e '
-const [list,by,b,since]=process.argv.slice(1),l=JSON.parse(list).filter((x)=>x.instance===by&&x.live===true),s=l[0];
-process.stdout.write(l.length===0?`no live launch of ${by}`:l.length>1?`${l.length} live launches of ${by}`:s.business!==b?`the launch of ${by} is for ${s.business}`:!(Date.parse(s.startedAt)>=Number(since))?`run ${s.run} started before this start`:"");' -- "$list" "$by" "$BUSINESS" "$START_MS" 2>&1)" || { GATE_WHY="launches list unreadable"; return 1; }
-    [ -z "$GATE_WHY" ]
-}
-
 # Polls every second until every check passes or --timeout runs out.
 gate() {
    local deadline=$((SECONDS + TIMEOUT))
@@ -658,7 +573,7 @@ put_back() {
    done
    [ "$(sha256sum < "$BIN/$WRAPPER_NAME" | cut -d' ' -f1)" = "$(sum_of "$RS" wrapper)" ] || return 1
    [ "$(stat -c %a "$BIN/$WRAPPER_NAME")" = "$(cat "$RS/WRAPPER_MODE")" ] || return 1
-    sc daemon-reload || return 1
+    systemctl --user daemon-reload || return 1
    say "put back the unit files and the wrapper from $RS"
 }

@@ -693,8 +608,8 @@ after_fail() {
 # Stop both units, print both results, log rollback-failed, exit 2. No retry.
 rollback_failed() {
    trap - INT TERM HUP
-    sc stop "$CONSOLE_UNIT" || true
-    sc stop "$BUS_UNIT" || true
+    systemctl --user stop "$CONSOLE_UNIT" || true
+    systemctl --user stop "$BUS_UNIT" || true
    say "rollback-failed: run $1, rollback $2"
    log_line result rollback-failed code "$1" rollback failed rollbackCode "$2"
    echo "stack-release: rollback-failed: the run failed with $1 and the rollback with $2; both units are stopped. Rollback set: $RS${BACKUP:+, backup $DATA/backups/stack/$BACKUP}${RESTORED:+, post-attempt store $POST}" >&2
@@ -703,15 +618,10 @@ rollback_failed() {

 # --- Refusals (item 3) ---

-# confirm and revert act on the open activation by design, so they take the lock alone (r6 section 4).
-lock_only() {
+lock() {
    mkdir -p "$STATE"
    exec 9> "$STATE/stack-release.lock"
    flock -n 9 || refuse run-locked "another stack-release run holds $STATE/stack-release.lock"
-}
-
-lock() {
-    lock_only
    local open
    open="$(interrupted | paste -sd' ' -)"
    [ -z "$open" ] || refuse interrupted-run "activation $open started and has no final line; Jason or Mos settles it (status shows it)"
@@ -719,7 +629,7 @@ lock() {

 instance_busy() {
    local out unit load state rest
-    out="$(sc list-units --all --no-legend --plain "$BUS_GLOB" 2>/dev/null)" || refuse instance-busy "$SC_NAME list-units failed, so the bus state is unknown"
+    out="$(systemctl --user list-units --all --no-legend --plain "$BUS_GLOB" 2>/dev/null)" || refuse instance-busy "systemctl --user list-units failed, so the bus state is unknown"
    while read -r unit load state rest; do
        [[ "$unit" == $BUS_GLOB ]] || continue
        if [ "$unit" = "$BUS_UNIT" ]; then
@@ -735,7 +645,7 @@ instance_busy() {
 drop_in_override() {
    local paths directory dropdir file content glob
    local -a dropdirs
-    paths="$(analyze unit-paths 2>/dev/null)" && [ -n "$paths" ] || refuse drop-in-override "systemd unit paths are unknown"
+    paths="$(systemd-analyze --user unit-paths 2>/dev/null)" && [ -n "$paths" ] || refuse drop-in-override "systemd unit paths are unknown"
    while IFS= read -r directory; do
        [ -n "$directory" ] || continue
        case "$directory" in /*) ;; *) refuse drop-in-override "invalid systemd unit path $directory" ;; esac
@@ -769,8 +679,7 @@ flags_drift() {
    if [ "$AFTER_HARNESS" = 1 ]; then
        [ "$P_PM" = 1 ] || d+=$'\n'"  pm: pointer $P_PM, --pm-after-harness needs a pointer with pm 1"
    else
-        # Under --units external the PM is a flag in root's unit, so there is no --pm to compare.
-        [ "$UNITS" != user ] || [ "$OP" != activate ] || [ "$WANT_PM" = "$P_PM" ] || d+=$'\n'"  pm: pointer $P_PM, --pm given $WANT_PM"
+        [ "$OP" != activate ] || [ "$WANT_PM" = "$P_PM" ] || d+=$'\n'"  pm: pointer $P_PM, --pm given $WANT_PM"
    fi
    [ -z "$d" ] || refuse unit-flags-drift "the units differ from the pointer; settle it first:$d"
 }
@@ -927,12 +836,13 @@ sso_checks() {
    sso_supported || { check_refuse sso-target "$TO's Console does not support --sso"; return 0; }
    local cfg="${MOSAIC_CONFIG:-$HOME/.config/mosaic-dev/config.json}" out id slot path why
    # N4 (webby-0019, sage-1403): a pre-phase-1 loader refuses a console key, so with the key not yet
-    # written and the stack on another copy, the first step is the re-pin without --sso.
-    local first=""
+    # written and the stack on another copy, the first step is the re-pin without --sso. On a named
+    # instance both commands carry --instance NAME (row 238).
+    local first="" inst="${INSTANCE_FLAGS[*]:+ ${INSTANCE_FLAGS[*]}}"
    if ! out="$(node -e "$SSO_JS" -- "$COPIES/$TO" "$cfg" 2>&1)"; then
        out="${out%%$'\n'*}"
        [ "$out" != "there is no console.sso in the system config" ] || [ "$P_COPY" = "$TO" ] ||
-            first="; activate $TO without --sso first, then write console.sso, then run activate $TO --sso"
+            first="; activate $TO$inst without --sso first, then write console.sso, then run activate $TO$inst --sso"
        check_refuse sso-config "$TO's Console would refuse its --sso start: $out$first"
        return 0
    fi
@@ -1166,12 +1076,11 @@ do_adopt() {
    lock
    [ ! -f "$POINTER" ] || { read_pointer; FROM="$P_COPY"; refuse already-adopted "$POINTER exists (copy $P_COPY)"; }
    local out
-    out="$(scripts/stack-copy.sh check "${INSTANCE_FLAGS[@]}" "${UNITS_FLAGS[@]}" --copies "$COPIES" --bin "$BIN" --business "$BUSINESS" 2>&1)" || refuse check-failed "stack-copy.sh check did not pass:"$'\n'"$out"
+    out="$(scripts/stack-copy.sh check "${INSTANCE_FLAGS[@]}" --copies "$COPIES" --bin "$BIN" --business "$BUSINESS" 2>&1)" || refuse check-failed "stack-copy.sh check did not pass:"$'\n'"$out"
    TO="$(sed -n 's/^bus: //p' <<< "$out")"
    TO="${TO#"$COPIES/"}"
    read_units || refuse check-failed "cannot read $BUS_UNIT or $CONSOLE_UNIT"
-    # Under --units external the claude pin is root's render, so adopt records what the unit has.
-    [ "$UNITS" = external ] || [ -n "$U_CLAUDE" ] || refuse no-claude-pin "$BUS_UNIT has no MOSAIC_CLAUDE_BIN"
+    [ -n "$U_CLAUDE" ] || refuse no-claude-pin "$BUS_UNIT has no MOSAIC_CLAUDE_BIN"
    target_schema "$TO" || refuse copy-schema-unknown "cannot read SCHEMA_VERSION from $COPIES/$TO/packages/bus/src/store.mjs"
    next_activation
    write_pointer "$TO" "$U_PM" 0 "$U_CLAUDE" "$T_SCHEMA" "${U_CONSOLE[@]}"
@@ -1186,12 +1095,12 @@ plan_store() {
    local src="" why=""
    S_SCHEMA="" S_FROM="" S_CHANGED=""
    if [ ! -e "$STORE" ]; then why="there is no store file"
-    elif sc is-active --quiet "$BUS_UNIT"; then
+    elif systemctl --user is-active --quiet "$BUS_UNIT"; then
        src="the store the running bus holds"
        S_SCHEMA="$(node -e "$STORE_JS" -- heldversion "$STORE" 2>/dev/null)" || S_SCHEMA=""
        # A bus that stops during the readOnly open can leave -wal or -shm beside the stopped
        # store, so the version read can't be planned on (row 166 item 2).
-        sc is-active --quiet "$BUS_UNIT" || S_CHANGED=1
+        systemctl --user is-active --quiet "$BUS_UNIT" || S_CHANGED=1
    elif store_unclean; then why="the store was not read: $UNCLEAN is present"
    else
        src="the stopped store"
@@ -1278,19 +1187,15 @@ plan() {
        echo "backup: the run backs up the stopped store to $DATA/backups/stack/<activation>/ before any migration"
    fi
    plan_commits
+    [ "$P_PENDING" = 0 ] || echo "pm: the pointer is pending (activate --pm-after-harness); the bus runs without its PM"
+    [ "$RUN_PENDING" = 0 ] || echo "pm: the bus starts without --pm and the PM stays pending; next: Jason's plugins set of harness, then pm-on"
    local flags="${INSTANCE_FLAGS[*]:+${INSTANCE_FLAGS[*]} }"
-    if [ "$UNITS" = external ]; then
-        echo "units: external; root installs the units for $TO and starts them, then confirm gates them"
-    else
-        [ "$P_PENDING" = 0 ] || echo "pm: the pointer is pending (activate --pm-after-harness); the bus runs without its PM"
-        [ "$RUN_PENDING" = 0 ] || echo "pm: the bus starts without --pm and the PM stays pending; next: Jason's plugins set of harness, then pm-on"
-        echo "bus: scripts/bus-service.sh install $flags--copy $TO --copies $COPIES$([ "$RUN_PM" = 0 ] || echo ' --pm') --claude $P_CLAUDE"
-        [ -z "$DROP_TESTER" ] || echo "drop $DROP_TESTER; the target Console does not support it"
-        echo "$PROOF_PLAN"
-        echo "$SEND_PLAN"
-        [ -z "$SSO_PLAN" ] || echo "$SSO_PLAN"
-        echo "Console: scripts/webui-service.sh install $flags--copy $TO --copies $COPIES${RUN_CONSOLE[*]:+ ${RUN_CONSOLE[*]}}"
-    fi
+    echo "bus: scripts/bus-service.sh install $flags--copy $TO --copies $COPIES$([ "$RUN_PM" = 0 ] || echo ' --pm') --claude $P_CLAUDE"
+    [ -z "$DROP_TESTER" ] || echo "drop $DROP_TESTER; the target Console does not support it"
+    echo "$PROOF_PLAN"
+    echo "$SEND_PLAN"
+    [ -z "$SSO_PLAN" ] || echo "$SSO_PLAN"
+    echo "Console: scripts/webui-service.sh install $flags--copy $TO --copies $COPIES${RUN_CONSOLE[*]:+ ${RUN_CONSOLE[*]}}"
    echo "CLI: scripts/stack-copy.sh wrapper $TO $flags--copies $COPIES --bin $BIN"
    local r
    for r in "${PLAN_REFUSE[@]}"; do echo "refuses $r"; done
@@ -1364,16 +1269,6 @@ do_activate() {
    pointer_for_business
    run_pm
    [ "$P_PENDING" = 0 ] || check_refuse pm-pending "the pointer is pending (activate --pm-after-harness); run pm-on or rollback first"
-    if [ "$UNITS" = external ]; then
-        ext_pointer_checks
-        if [ "$PLAN" = 1 ]; then check_target; plugin_checks; config_checks; plan; exit 0; fi
-        ext_precheck
-        plugin_checks
-        config_checks
-        new_activation
-        run_external migrate
-        return
-    fi
    if [ "$PLAN" = 1 ]; then check_target; console_for_target; ports_unclaimed; plugin_checks; config_checks; plan; exit 0; fi
    precheck
    plugin_checks
@@ -1387,321 +1282,43 @@ do_rollback() {
    pointer_for_business
    TO="$(from_log previous)" || refuse no-previous "the log names no earlier copy than $P_COPY"
    run_pm
-    if [ "$UNITS" = external ]; then
-        # r6: root names the target from the go, and it must be the one rollback reads from the log.
-        [ "$TO_FLAG" = "$TO" ] || refuse to-not-previous "--to $TO_FLAG is not the previous copy; the log names $TO"
-        ext_pointer_checks
-        if [ "$PLAN" = 1 ]; then
-            check_target; plugin_checks; config_checks
-            [ -z "$RESTORE" ] || { next_activation; restore_checks; }
-            plan; exit 0
-        fi
-        ext_precheck
-        plugin_checks
-        config_checks
-        [ "$P_SCHEMA" = "$T_SCHEMA" ] || [ -n "$RESTORE" ] || refuse schema-differs "the store is at $P_SCHEMA and $TO expects $T_SCHEMA; pass --restore ACTIVATION"
-        new_activation
-        [ -z "$RESTORE" ] || restore_checks
-        run_external restore
-        return
-    fi
    if [ "$PLAN" = 1 ]; then check_target; console_for_target; ports_unclaimed; plugin_checks; config_checks; plan; exit 0; fi
    precheck
    plugin_checks
    config_checks
    [ "$P_SCHEMA" = "$T_SCHEMA" ] || [ -n "$RESTORE" ] || refuse schema-differs "the store is at $P_SCHEMA and $TO expects $T_SCHEMA; pass --restore ACTIVATION"
    new_activation
-    [ -z "$RESTORE" ] || restore_checks
-    run_steps restore
-}
-
-# rollback --restore's checks on the backup and the rows written after it, before anything stops.
-# Sets COUNT and BACKUP; POST comes from new_activation.
-restore_checks() {
-    local o="$DATA/backups/stack/$RESTORE" rc=0 c="" text
-    [ -f "$o/SHA256SUMS" ] && [ "$(cat "$o/DATA_ROOT" 2>/dev/null)" = "$DATA" ] && [ "$(cat "$o/SCHEMA" 2>/dev/null)" = "$T_SCHEMA" ] && [ -f "$o/STAMP" ] \
-        || refuse restore-mismatch "$o is not a backup of this root at $T_SCHEMA"
-    # Before anything stops. A store the running bus holds is read with readOnly, which adds
-    # no file (the probe); a stopped one falls under the store_unclean rule.
-    if sc is-active --quiet "$BUS_UNIT"; then
-        c="$(node -e "$STORE_JS" -- heldcount "$STORE" "$(cat "$o/STAMP")" "$COUNTED")" || rc=1
-        # plan_store's recheck (row 166 item 2), before anything stops.
-        sc is-active --quiet "$BUS_UNIT" || refuse restore-mismatch "the bus stopped while the events after $(cat "$o/STAMP") were counted, so the store state changed; nothing was stopped"
-    else
-        ! store_unclean || refuse store-unclean "$UNCLEAN is present; the bus did not close the store cleanly"
-        c="$(store_read count "$(cat "$o/STAMP")" "$COUNTED")" || rc=1
-    fi
-    [ "$rc" = 0 ] || refuse restore-mismatch "cannot count the rows after $(cat "$o/STAMP")"
-    COUNT="${c%%$'\t'*}" text="${c#*$'\t'}"
-    echo "restore: $o; the store now in place moves to $POST and is kept; $text were written after the backup"
-    [ "$COUNT" = 0 ] || [ "$EVENTS" = "$COUNT" ] || refuse post-backup-events "$text were written after the backup; Jason decides, then --events $COUNT"
-    BACKUP="$RESTORE"
-}
-
-# --- --units external (row 232, r6 section 4) ---
-
-# After the pointer, for activate and rollback, in --plan and in the run. OLD is the copy root read
-# from the unit files it installed (r6 A1, N5), so a pointer that names another copy stops the
-# re-pin before root stops anything. The PM is a flag in root's unit, so --pm-after-harness has
-# nothing to wait on. The run's own lock refuses an open activation; --plan takes no lock, so it
-# lists one here.
-ext_pointer_checks() {
-    [ -z "$EXPECT_FROM" ] || [ "$EXPECT_FROM" = "$P_COPY" ] || check_refuse pointer-differs "the pointer names $P_COPY and root's units name $EXPECT_FROM; Jason or Mos settles it"
-    [ "$AFTER_HARNESS" = 0 ] || check_refuse external-pm "under --units external the PM is a flag in root's bus unit; changing it is a re-install with its own go"
-    [ "$PLAN" = 1 ] || return 0
-    local open
-    open="$(interrupted | paste -sd' ' -)"
-    [ -z "$open" ] || check_refuse interrupted-run "activation $open started and has no final line; Jason or Mos settles it (status shows it)"
-}
-
-# A3's checks before `started`. Root has stopped the units and installs them after this run, so
-# there is no Console flag, port, drop-in or claude pin of this script's to check.
-ext_precheck() {
-    check_target
-    instance_busy
-    read_units || refuse unit-flags-drift "cannot read $BUS_UNIT or $CONSOLE_UNIT"
-    flags_drift
-    units_down
-}
-
-# r6 A3 (N4): each unit reads inactive, or failed as stop_both accepts, and the store is closed,
-# so nothing below runs against a store a live bus holds.
-units_down() {
-    local u s
-    for u in "$CONSOLE_UNIT" "$BUS_UNIT"; do
-        s="$(sc is-active "$u" 2>/dev/null || true)"
-        case "$s" in inactive|failed) ;; *) refuse units-running "$u is ${s:-unknown}; root stops the units first" ;; esac
-    done
-    stopped || refuse units-running "the store under $DATA/bus is still open (writer.lock or an open file)"
-}
-
-# A3's capture into $RS, which run_external made: the pointer, the wrapper and its mode, and for each
-# unit its show output and the sha256 of its unit file. It reads root's units and makes no directory.
-capture_units() {
-    local u frag
-    [ ! -f "$POINTER" ] || cp -p "$POINTER" "$RS/pointer" || return 1
-    [ -f "$BIN/$WRAPPER_NAME" ] || { say "capture: no wrapper $BIN/$WRAPPER_NAME"; return 1; }
-    cp -p "$BIN/$WRAPPER_NAME" "$RS/wrapper" || return 1
-    stat -c %a "$BIN/$WRAPPER_NAME" > "$RS/WRAPPER_MODE" || return 1
-    : > "$RS/UNITS.sha256" || return 1
-    for u in "$BUS_UNIT" "$CONSOLE_UNIT"; do
-        show "$u" > "$RS/show-$u.txt" || return 1
-        frag="$(sc show "$u" -p FragmentPath 2>/dev/null | sed -n 's/^FragmentPath=//p')" && [ -n "$frag" ] || { say "capture: no FragmentPath for $u"; return 1; }
-        sha256sum "$frag" >> "$RS/UNITS.sha256" || return 1
-    done
-    sums "$RS" > "$RS/SHA256SUMS" || return 1
-    say "captured the rollback set: $RS"
-}
-
-# A failure after the capture: FAILED holds the code, nothing is logged or cleaned up, exit 1.
-# Root runs R1-R4, and revert is the one cleanup path (r6 A3).
-ext_fail() {
-    trap - INT TERM HUP
-    { echo "$1" > "$RS/FAILED"; } 2>/dev/null || true
-    say "failed: $1"
-    echo "stack-release: $OP failed with $1; $ACT stays open for root's revert and confirm --rollback. Rollback set: $RS" >&2
-    exit 1
-}
-
-# A3 for target $TO. $1 is the store step: migrate or restore. The marker goes in first, so every
-# failure after it leaves what revert needs. Writes no pointer and starts nothing.
-run_external() {
-    log_line result started
-    { mkdir -p -m 0700 "$STATE/stack-rollback" && mkdir -m 0700 "$RS"; } 2>/dev/null || refuse marker-failed "could not make the rollback set $RS; nothing was changed"
-    { echo "$TO" > "$RS/AWAITING-UNITS"; } 2>/dev/null || { rm -f "$RS/AWAITING-UNITS"; refuse marker-failed "could not write $RS/AWAITING-UNITS; nothing was changed"; }
-    STEPS="$RS/steps.log"
-    capture_units || { rm -f "$RS/AWAITING-UNITS"; refuse capture-failed "could not write the rollback set $RS; nothing was changed"; }
-    trap 'ext_fail signal' INT TERM HUP
-    if [ -e "$STORE" ]; then
-        if store_unclean; then say "$UNCLEAN is present; the store is left as it is for Jason or Mos"; ext_fail store-unclean; fi
-        STORE_SCHEMA="$(store_read version)" && [ -n "$STORE_SCHEMA" ] || ext_fail schema-unreadable
-        say "stopped store schema: $STORE_SCHEMA"
-        if [ "$1" = migrate ]; then
-            if [ "$STORE_SCHEMA" != "$T_SCHEMA" ]; then
-                in_chain "$STORE_SCHEMA" || ext_fail store-newer
-                [ "$MIGRATE" = 1 ] || ext_fail migration-needs-flag
-            fi
-            backup_store || ext_fail backup
-            echo "$BACKUP" > "$RS/BACKUP" || ext_fail backup
-            if [ "$STORE_SCHEMA" != "$T_SCHEMA" ]; then
-                # MIGRATING and TAKEN before the migration, so revert restores a partial one (r6 B2).
-                : > "$RS/MIGRATING" || ext_fail migrate-failed
-                TAKEN="$ACT"
-                node "$COPIES/$TO/packages/bus/src/migrate-schema.mjs" "$DATA" >> "$STEPS" 2>&1 || ext_fail migrate-failed
-                say "migrated the store to $T_SCHEMA"
-            fi
+    if [ -n "$RESTORE" ]; then
+        local o="$DATA/backups/stack/$RESTORE" rc=0 c="" text
+        [ -f "$o/SHA256SUMS" ] && [ "$(cat "$o/DATA_ROOT" 2>/dev/null)" = "$DATA" ] && [ "$(cat "$o/SCHEMA" 2>/dev/null)" = "$T_SCHEMA" ] && [ -f "$o/STAMP" ] \
+            || refuse restore-mismatch "$o is not a backup of this root at $T_SCHEMA"
+        # Before anything stops. A store the running bus holds is read with readOnly, which adds
+        # no file (the probe); a stopped one falls under the store_unclean rule.
+        if systemctl --user is-active --quiet "$BUS_UNIT"; then
+            c="$(node -e "$STORE_JS" -- heldcount "$STORE" "$(cat "$o/STAMP")" "$COUNTED")" || rc=1
+            # plan_store's recheck (row 166 item 2), before anything stops.
+            systemctl --user is-active --quiet "$BUS_UNIT" || refuse restore-mismatch "the bus stopped while the events after $(cat "$o/STAMP") were counted, so the store state changed; nothing was stopped"
        else
-            [ "$STORE_SCHEMA" = "$P_SCHEMA" ] || ext_fail store-differs
-            if [ -n "$RESTORE" ]; then
-                local n
-                n="$(store_read count "$(cat "$DATA/backups/stack/$RESTORE/STAMP")" "$COUNTED")" || ext_fail schema-unreadable
-                [ "${n%%$'\t'*}" = "$COUNT" ] || ext_fail post-backup-events
-                echo "$RESTORE" > "$RS/BACKUP" || ext_fail restore
-                # RESTORED tells confirm --rollback the store was swapped, so it skips OLD's gate
-                # and logs rollbackCode not-attempted (ruling 4, T14b).
-                if ! restore_store "$RESTORE"; then
-                    [ -z "$RESTORED" ] || : > "$RS/RESTORED" || true
-                    ext_fail restore
-                fi
-                : > "$RS/RESTORED" || ext_fail restore
-            fi
+            ! store_unclean || refuse store-unclean "$UNCLEAN is present; the bus did not close the store cleanly"
+            c="$(store_read count "$(cat "$o/STAMP")" "$COUNTED")" || rc=1
        fi
-    elif [ -n "$RESTORE" ]; then
-        ext_fail store-differs
+        [ "$rc" = 0 ] || refuse restore-mismatch "cannot count the rows after $(cat "$o/STAMP")"
+        COUNT="${c%%$'\t'*}" text="${c#*$'\t'}"
+        echo "restore: $o; the store now in place moves to $POST and is kept; $text were written after the backup"
+        [ "$COUNT" = 0 ] || [ "$EVENTS" = "$COUNT" ] || refuse post-backup-events "$text were written after the backup; Jason decides, then --events $COUNT"
+        BACKUP="$RESTORE"
    fi
-    scripts/stack-copy.sh wrapper "$TO" "${INSTANCE_FLAGS[@]}" --copies "$COPIES" --bin "$BIN" >> "$STEPS" 2>&1 || ext_fail wrapper
-    trap - INT TERM HUP
-    say "staged $TO"
-    echo "stack-release: $OP staged $TO for $BUSINESS as $ACT; root installs and starts the units, then runs confirm $TO $BUSINESS --units external"
-}
-
-# r6 "The open activation": exactly one AWAITING-UNITS file, its activation the one the log holds
-# open, holding the copy root passed. Sets O_ACT. Anything else refuses open-activation, and ACT
-# stays unset, so the refused line names no activation and the open one stays open.
-open_activation() {
-    local -a markers open
-    local m found="" seen=""
-    mapfile -t markers < <(compgen -G "$STATE/stack-rollback/*/AWAITING-UNITS" || true)
-    mapfile -t open < <(interrupted)
-    for m in "${markers[@]}"; do
-        seen+=" $(basename "$(dirname "$m")") (copy $(cat "$m" 2>/dev/null || echo unreadable))"
-    done
-    if [ "${#markers[@]}" = 1 ] && [ "${#open[@]}" = 1 ]; then
-        m="$(basename "$(dirname "${markers[0]}")")"
-        [ "$m" != "${open[0]}" ] || [ "$(cat "${markers[0]}" 2>/dev/null)" != "$ID" ] || found="$m"
-    fi
-    [ -n "$found" ] || refuse open-activation "need one AWAITING-UNITS for copy $ID whose activation the log holds open; markers:${seen:- none}; open: ${open[*]:-none}"
-    O_ACT="$found"
-}
-
-# The op, from, to and start second of O_ACT's `started` line, one per line.
-started_of() {
-    node -e '
-const [file,act]=process.argv.slice(1);
-let s;
-for(const l of require("fs").readFileSync(file,"utf8").split("\n")){
-  if(!l.trim())continue;
-  let o;try{o=JSON.parse(l)}catch{continue}
-  if(o.activation===act&&o.result==="started")s=o;
-}
-const at=s&&Math.floor(Date.parse(s.at)/1000);
-if(!s||!["activate","rollback"].includes(s.op)||!Number.isFinite(at))process.exit(1);
-process.stdout.write([s.op,s.from??"",s.to??"",at].join("\n")+"\n");' -- "$LOG" "$O_ACT"
-}
-
-# A5, and R4 with --rollback. The lines it writes carry the open activation's op, from, to and
-# activation, and the backup A3 recorded, so from_log reads them as a dragon-lin run's. Every check
-# runs before ACT is set.
-do_confirm() {
-    lock_only
-    open_activation
-    local s
-    local -a f
-    s="$(started_of)" || refuse open-activation "the log's started line for $O_ACT is unreadable"
-    mapfile -t f <<< "$s"
-    [ "${f[2]}" = "$ID" ] || refuse open-activation "$O_ACT started for ${f[2]}, not $ID"
-    if read_pointer; then [ "$P_BUSINESS" = "$BUSINESS" ] || refuse business-mismatch "the pointer is for $P_BUSINESS"; fi
-    if [ -n "$ROLLBACK_OLD" ]; then
-        [ "$ROLLBACK_OLD" = "${f[1]}" ] || refuse rollback-mismatch "$ROLLBACK_OLD is not the copy $O_ACT started from, ${f[1]:-none}"
-    else
-        [ ! -e "$STATE/stack-rollback/$O_ACT/FAILED" ] || refuse activation-failed "$O_ACT has a FAILED file; root runs revert and confirm --rollback"
-        target_schema "$ID" || refuse copy-schema-unknown "cannot read SCHEMA_VERSION from $COPIES/$ID/packages/bus/src/store.mjs"
-    fi
-    OP="${f[0]}" FROM="${f[1]}" TO="${f[2]}" FLOOR="${f[3]}" ACT="$O_ACT" RS="$STATE/stack-rollback/$O_ACT"
-    STEPS="$RS/steps.log"
-    BACKUP="$(cat "$RS/BACKUP" 2>/dev/null || true)"
-    if [ -z "$ROLLBACK_OLD" ]; then
-        read_units || ext_fail units-unreadable
-        P_CONSOLE=("${U_CONSOLE[@]}")
-        gate "$TO" "$U_PM" || ext_fail "$GATE"
-        write_pointer "$TO" "$U_PM" 0 "$U_CLAUDE" "$T_SCHEMA" "${U_CONSOLE[@]}"
-        log_line result ok
-        rm -f "$RS/AWAITING-UNITS"
-        echo "stack-release: $OP ok: $TO is live for $BUSINESS"
-        return
-    fi
-    local code rcode=""
-    if [ "$CAUSE" = A4 ]; then code=units-start
-    else code="$(head -n 1 "$RS/FAILED" 2>/dev/null || true)"; [ -n "$code" ] || code=unrecorded
-    fi
-    if [ -e "$RS/RESTORED" ]; then rcode=not-attempted
-    elif ! read_units; then rcode=units-unreadable
-    else
-        P_CONSOLE=("${U_CONSOLE[@]}")
-        gate "$ROLLBACK_OLD" "$U_PM" || rcode="$GATE"
-    fi
-    if [ -z "$rcode" ]; then
-        local r=failed
-        [ "$CAUSE" != A5 ] || r=gate-failed
-        log_line result "$r" code "$code" rollback ok
-        rm -f "$RS/AWAITING-UNITS" "$RS/FAILED"
-        echo "stack-release: $code; rolled back to $ROLLBACK_OLD, which passed the gate" >&2
-        exit 1
-    fi
-    say "rollback-failed: run $code, rollback $rcode"
-    log_line result rollback-failed code "$code" rollback failed rollbackCode "$rcode"
-    rm -f "$RS/AWAITING-UNITS" "$RS/FAILED"
-    echo "stack-release: rollback-failed: the run failed with $code and the rollback with $rcode; root stops the units. Rollback set: $RS${BACKUP:+, backup $DATA/backups/stack/$BACKUP}" >&2
-    exit 2
-}
-
-revert_fail() {
-    say "revert failed: $1"
-    echo "stack-release: revert failed: $1; $O_ACT stays open. Rollback set: $RS" >&2
-    exit 1
-}
-
-# The store already holds backup $1 when every file checks against its SHA256SUMS and the listing
-# matches, as after a revert that restored it.
-store_matches() {
-    local o="$DATA/backups/stack/$1"
-    [ -d "$DATA/bus" ] && (cd "$DATA/bus" && sha256sum -c --quiet "$o/SHA256SUMS") >/dev/null 2>&1 &&
-        [ "$(ls -1A "$DATA/bus")" = "$(ls -1A "$o/bus")" ]
-}
-
-# R2: puts the wrapper back and, after a migration, the backup taken before it. Each part can run
-# again, so it serves an A3 that stopped partway. A rollback's --restore swap is confirm's to
-# report, not revert's to undo. Writes no log line.
-do_revert() {
-    lock_only
-    open_activation
-    RS="$STATE/stack-rollback/$O_ACT" STEPS="$STATE/stack-rollback/$O_ACT/steps.log"
-    [[ "$O_ACT" =~ ^([0-9]{8}T[0-9]{6}Z)-[0-9a-f]{12}(-[1-9])?$ ]] || revert_fail "$O_ACT is not an activation id"
-    POST="$DATA/bus.post-attempt-${BASH_REMATCH[1]}${BASH_REMATCH[2]}"
-    [ -f "$RS/wrapper" ] && [ -f "$RS/WRAPPER_MODE" ] || revert_fail "the rollback set has no saved wrapper"
-    local tmp
-    tmp="$(mktemp "$BIN/.$WRAPPER_NAME.XXXXXX")" && cp -p "$RS/wrapper" "$tmp" && chmod "$(cat "$RS/WRAPPER_MODE")" "$tmp" && mv -f "$tmp" "$BIN/$WRAPPER_NAME" ||
-        revert_fail "could not put the wrapper back"
-    [ "$(sha256sum < "$BIN/$WRAPPER_NAME" | cut -d' ' -f1)" = "$(sum_of "$RS" wrapper)" ] &&
-        [ "$(stat -c %a "$BIN/$WRAPPER_NAME")" = "$(cat "$RS/WRAPPER_MODE")" ] || revert_fail "the wrapper does not match the rollback set"
-    say "put back the wrapper from $RS"
-    if [ -e "$RS/MIGRATING" ]; then
-        TAKEN="$(cat "$RS/BACKUP" 2>/dev/null || true)"
-        [ -n "$TAKEN" ] || revert_fail "MIGRATING is set and BACKUP names no backup"
-        if store_matches "$TAKEN"; then say "the store already matches backup $TAKEN"
-        else restore_store "$TAKEN" || revert_fail "could not restore backup $TAKEN"
-        fi
-    fi
-    echo "stack-release: revert ok: $O_ACT's wrapper$([ -e "$RS/MIGRATING" ] && echo ' and store are' || echo ' is') back; root installs the old units next"
-}
-
-# A2f: gates copy ID with no open activation, on a start at or after --since. Takes no lock and
-# writes nothing, so it refuses nothing: 0 on a pass, 1 otherwise.
-do_gate() {
-    FLOOR="$SINCE"
-    read_units || { echo "stack-release: gate: cannot read $BUS_UNIT or $CONSOLE_UNIT" >&2; exit 1; }
-    P_CONSOLE=("${U_CONSOLE[@]}")
-    gate "$ID" "$U_PM" || exit 1
+    run_steps restore
 }

 # --- pm-on (row 169 item 3) ---

 # Stops the bus alone and waits for it and the stopped check, within --timeout. The Console runs on.
 stop_bus() {
-    sc stop "$BUS_UNIT" || return 1
+    systemctl --user stop "$BUS_UNIT" || return 1
    local deadline=$((SECONDS + TIMEOUT)) s
    while :; do
-        s="$(sc is-active "$BUS_UNIT" 2>/dev/null || true)"
+        s="$(systemctl --user is-active "$BUS_UNIT" 2>/dev/null || true)"
        case "$s" in inactive|failed) if stopped; then say "stopped $BUS_UNIT"; return 0; fi ;; esac
        [ "$SECONDS" -lt "$deadline" ] || return 1
        sleep 1
@@ -1710,7 +1327,7 @@ stop_bus() {

 start_bus() {
    START_EPOCH="$(date +%s)" && START_MS="$(date +%s%3N)" || return 1
-    sc start "$BUS_UNIT"
+    systemctl --user start "$BUS_UNIT"
 }

 # mos-0848 point 3: put the phase-1 bus unit back (no --pm), restart it and rerun the phase-1 gate.
@@ -1732,8 +1349,8 @@ pm_on_fail() {
        exit 1
    fi
    local pwhy="$GATE_WHY"
-    sc stop "$CONSOLE_UNIT" || true
-    sc stop "$BUS_UNIT" || true
+    systemctl --user stop "$CONSOLE_UNIT" || true
+    systemctl --user stop "$BUS_UNIT" || true
    say "pm-on-down: pm-on $code, phase 1 $pcode"
    log_line result pm-on-down code "$code" why "${why:-@null}" phase1 "$pcode" phase1Why "${pwhy:-@null}"
    echo "stack-release: pm-on-down: pm-on failed with $code${why:+ ($why)} and the phase-1 bus with $pcode${pwhy:+ ($pwhy)}; both units are stopped. Rollback set: $RS" >&2
@@ -1743,7 +1360,6 @@ pm_on_fail() {
 # Phase 2: the bus unit alone, on the pointer's copy with --pm, gated with pm_launched.
 do_pm_on() {
    lock
-    [ "$UNITS" = user ] || refuse external-pm "under --units external the PM is a flag in root's bus unit; changing it is a re-install with its own go"
    pointer_for_business
    [ "$P_PENDING" = 1 ] || refuse not-pending "the pointer is not pending; pm-on follows activate --pm-after-harness"
    local out
@@ -1780,16 +1396,8 @@ do_status() {
    local open
    open="$(interrupted | paste -sd' ' -)"
    [ -z "$open" ] || echo "interrupted run: $open (started, no final line; Jason or Mos settles it)"
-    if [ "$UNITS" = external ]; then
-        local m
-        local -a markers
-        mapfile -t markers < <(compgen -G "$STATE/stack-rollback/*/AWAITING-UNITS" || true)
-        for m in "${markers[@]}"; do
-            echo "awaiting units: $(basename "$(dirname "$m")") (copy $(cat "$m" 2>/dev/null || echo unreadable))"
-        done
-    fi
    echo "check:"
-    if scripts/stack-copy.sh check "${INSTANCE_FLAGS[@]}" "${UNITS_FLAGS[@]}" --copies "$COPIES" --bin "$BIN" --business "$BUSINESS" 2>&1 | sed 's/^/  /'; then echo "  result: pass"; else echo "  result: FAIL"; fi
+    if scripts/stack-copy.sh check "${INSTANCE_FLAGS[@]}" --copies "$COPIES" --bin "$BIN" --business "$BUSINESS" 2>&1 | sed 's/^/  /'; then echo "  result: pass"; else echo "  result: FAIL"; fi
    [ -n "$P_COPY" ] || return 0
    echo "bus status:"
    "$COPIES/$P_COPY/scripts/mosaic" bus status 2>&1 | sed 's/^/  /' || true
@@ -2115,16 +1723,11 @@ ID=""
 case "$OP" in
    activate|rehearse) [ $# -ge 2 ] || usage; ID="$1"; BUSINESS="$2"; shift 2; [[ "$ID" =~ ^[0-9a-f]{40}$ ]] || usage ;;
    adopt|pm-on|rollback|status) [ $# -ge 1 ] || usage; BUSINESS="$1"; shift ;;
-    confirm|revert|gate) [ $# -ge 2 ] || usage; ID="$1"; BUSINESS="$2"; shift 2; [[ "$ID" =~ ^[0-9a-f]{40}$ ]] || usage ;;
    -h|--help) usage 0 ;;
    *) usage ;;
 esac
 [[ "$BUSINESS" =~ ^[a-z0-9][a-z0-9-]*$ ]] || usage
 parse_opts "$@"
-# Row 232: the stack-copy.sh check flags and the systemctl the instance-busy message names.
-UNITS_FLAGS=()
-SC_NAME="systemctl --user"
-if [ "$UNITS" = external ]; then UNITS_FLAGS=(--units external); SC_NAME=systemctl; fi
 COPIES_DIR="$COPIES"
 instance_select
 load_config
@@ -2139,7 +1742,6 @@ STORE_SCHEMA="" START_EPOCH="" START_MS=0 GATE="" GATE_WHY="" S_CHANGED=""
 P_COPY="" P_PM=0 P_PENDING=0 P_SCHEMA="" P_CLAUDE="" P_CONSOLE=() RUN_PM=0 RUN_PENDING=0 RUN_CONSOLE=() DROP_TESTER="" PROOF_PLAN="" PROOF_STEP="" SEND_PLAN="" SEND_STEP="" PLAN_REFUSE=()
 BASE_CONSOLE=() SERVE_FLAGS=() SSO_PLAN="" SSO_STEP="" SSO_DROP="" SSO_NO_TARGET=""
 R="" R_RC=0 R_EARLY=() R_BK="" R_HOST_PID="" R_CONSOLE_PID="" R_STARTED="" LIVE_CFG="" LIVE_BIZ=""
-O_ACT="" FLOOR=0
 case "$OP" in
    adopt) do_adopt ;;
    activate) do_activate ;;
@@ -2147,7 +1749,4 @@ case "$OP" in
    rollback) do_rollback ;;
    status) do_status ;;
    rehearse) do_rehearse ;;
-    confirm) do_confirm ;;
-    revert) do_revert ;;
-    gate) do_gate ;;
 esac
Author	SHA1	Message	Date
jason.woltje	bec7e499ec	stack-release: the sso-config first step carries --instance NAME on a named instance (row 238, #1744 )	2026-10-20 20:19:35 -05:00
jason.woltje	011d41ba6a	sage: row 42 S7 dates in the run log (sage-1622, mos-1148 C1 C2, Vikunja 442), 10-24 window draft 0 (mos-1145; NEW open), Vikunja scripts and records: 412/424 landing comments, 237 follow-ups 440/441, P19 405-408 and 411 re-plan comments 416-420, read-tasks.mjs (#1524 )	2026-10-20 20:06:39 -05:00
jason.woltje	c8bc5cf4cb	case2: unit render and host precheck, case2-unit.sh and case2-precheck.sh (row 230, #1732 ) Squash of Gosalyn's `96768766c` on gosalyn/c2-13a-r2 (base `722136772`), the 5 manifest paths, build.patch 56649f9a, manifest fbb0d7e42c67 (Webby approve round 2, rev 2563). Gosalyn's gate on `96768766c`: cli 541 pass 0 fail; scripts/test-*.sh 429 pass 0 fail (summed by script); mutants 10 of 10 killed. packages/cli/README.md is a 3-way merge with row 199 (`cb5fdb064`): the hunks don't overlap (line 710 vs 1022). host.test.mjs:855 is the only test that reads that file. On `cb5fdb064` plus the patch, case2-unit.test.mjs 30/0 and host.test.mjs 42/0. Refactor moved to `390ea5261` since, a README fix touching no manifest path. The script runs on a host only in a separate window with Jason's go.	2026-10-20 19:36:22 -05:00
jason.woltje	390ea5261c	business: README names nine hard waits, git.push.remote included; row 199 added it to GATED_ONLY (row 199 review N3, duckworth-0068, #1697 ) Megavolt's `5d7e4d26e` on megavolt/n3-readme, from `cb5fdb064`. Doc-only: no test or scripts/test-*.sh reads packages/business/README.md. The text matches packages/business/src/vocabulary.mjs, where GATED_ONLY has nine actions.	2026-10-20 19:29:22 -05:00