row 273: T53 test 6 pins the usage line with --no-sso

The usage line gained --no-sso in the proof and sso bracket. T53 test 6 still matched the old bracket and failed the whole run on 978143bf4.
row 273 notes: name the changed T57 item 3 assertion for review (sage-2321)
2026-10-21 22:15:36 -05:00 · 2026-10-21 22:15:36 -05:00 · 2026-10-21 22:15:36 -05:00 · 2026-10-21 22:15:36 -05:00 · 2026-10-21 22:15:36 -05:00 · 2026-10-21 22:15:36 -05:00
14 changed files with 1498 additions and 58 deletions
@@ -0,0 +1,113 @@
+# Row 273 (#1778): activate --send and --no-sso
+
+Darkwing, 2026-10-22. Brief: `docs/plans/2026-10-22_activate-send-nosso.md` (blob in f0d0b31e9), approved by
+Mos in mos-1246 (F39). Base: origin/refactor 0042f713d. Reviewer: Filbert. Gate owner: Sage.
+
+## What changed
+
+Only `scripts/stack-release.sh` and its two node test files.
+
+- `activate --send` puts `--send` into the run's Console flags after `--sso` and before the tester
+  flags, where webui-service.sh renders it. It refuses `send-needs-sso` unless those flags hold `--sso`,
+  given or carried. The plan line is `send: on; --send was given`, or `send: carried` when the pointer
+  already holds it. `check_target` lets it name the pointer's copy only when the pointer holds no `--send`,
+  so a second `--send` on the same copy refuses `already-active`.
+- `activate --no-sso` refuses `sso-not-on` when the pointer holds no `--sso`. Otherwise it takes the
+  Console flags from a rollback set (below) and keeps the pointer's tester flags. `send_for_target`
+  drops `--send`, whether it came from the set or the pointer. It is the only place that does, so one
+  mutant there (M3) shows the drop is tested. The plan prints `sso: off; Console flags from <set>/<file>; restores <flags>`
+  and a send line, `send: dropped; --no-sso drops --send (F39)` or `send: off; --no-sso was given and the
+  pointer holds no --send`. The steps log gets `drop --send; --no-sso was given` and
+  `turn off --sso; the Console flags come from <set>/<file>`.
+- Usage errors: `--send` with `--no-send`; `--no-sso` with `--sso`, `--send`, a proof pair or
+  `--no-proof`; either flag on any verb but activate; either flag under `--units external`.
+  `--no-sso --no-send` is allowed, since the brief doesn't forbid it and both drop the same flag.
+- The set read that `sso_base` did inline for a rollback to a Console without `--sso` moved into
+  `set_flags`, which both paths call. Its three messages are unchanged, and T57 still pins them.
+- `from_log` has a new mode, `sets`: the activation of each ok activate and rollback line, newest first,
+  stopping at the adopt line, which took no rollback set.
+
+## The consequential choice: which set --no-sso reads
+
+The brief says the flags come from "the rollback set of the activation that turned `--sso` on", and that
+"a set whose Console already ran with `--sso`" refuses. Each set holds the Console unit from before its
+run. So the activation that turned `--sso` on is the newest one whose set holds a Console without
+`--sso`: every activation after it ran with `--sso`, and so did every set it left.
+
+`no_sso_base` walks the log's sets newest first and stops at the first set whose Console has no `--sso`.
+It refuses `sso-off-flags` at the first set it can't read (missing, failing its SHA256SUMS, or with no
+argv the script can parse), since it can't tell whether that set was the one. If every set ran with
+`--sso`, it refuses with `the Console in <set>/<file> already ran with --sso, and the log names no
+earlier activation`. A log with no set at all refuses with `the log names no activation with a rollback
+set`.
+
+The tradeoff: a later same-copy re-pin that carried `--sso` (a `--no-send`, or a re-pin onto a newer
+copy) doesn't break `--no-sso`, which the phase 2 window needs if a re-pin lands between step 5 and a
+rollback. The cost is that "a set that ran with `--sso` refuses" now applies only when no older set
+without `--sso` exists. A tampered set on the walk still refuses, even one newer than the set the walk
+would have used. Filbert, please rule on this reading.
+
+## Filbert's early look: B1 and N1 (sage-2315)
+
+Filbert accepted the walk. Sage ruled both findings into this row.
+
+- B1: row 200's rollback to a copy whose Console has no `--sso` took the flags from the set and kept
+  the pointer's `--send`. From an `--sso --send` pointer, which this row's `--send` can now make, that
+  gave a Console with `--send` and no `--sso`, which F39 b forbids. `send_for_target` now drops `--send`
+  whenever the run drops the pointer's `--sso`, so it is still the one place that drops it. The plan
+  line reads `send: dropped; the run drops --sso, and --send needs it (F39)`, and the steps log gets
+  `drop --send; the run drops --sso`. Row 200's sso line now names only the tester as following the
+  pointer.
+- Changed existing assertion, for the review to approve by name: T57 item 3 (sage-1389), "the
+  plain case", ends with `assert.deepEqual(pointer(g).console,[...noSend(gbase),...pair(f)])`. It
+  used to expect `'--send'` at the end. The case seeds a legacy `--send` pointer, turns `--sso` on
+  (which carries `--send`), then rolls back to B, whose Console has no `--sso`. A carried `--send`
+  that ends without `--sso` breaks F39 b whatever its source, so the old pin asserted the wrong
+  outcome (Sage accepted this in sage-2321). Row 200's two sso plan strings also lose "--send and"
+  (`ROLLBACK_PLAN` and the round 3 named-instance case), since `--send` no longer follows the pointer
+  on that path.
+- N1: the walk skipped an ok line with no activation. Skipping it could land on an older set that
+  isn't the right one, so it now refuses `sso-off-flags` with `an ok line in the log names no
+  activation`. The walk reads the log through `mapfile`. That gives no entry for an empty log, so a
+  log with no set still gets its own message.
+
+## test-release.sh
+
+The window plan says test-release.sh "gets cases for both". The brief lists it only as a file to run
+whole. test-release.sh is release.sh's Docker selftest and doesn't call stack-release.sh, so the cases
+live in the node tests and test-release.sh runs unchanged.
+
+## Tests (T58 in stack-release.test.mjs)
+
+- T1: `--sso --send` from B onto C1 with a tester port: plan, pointer, unit and steps. `--send` beside a
+  carried `--sso` re-pins C1 once; a second `--send` refuses `already-active`; C carries it.
+- T2: `--send` without `--sso` refuses on another copy and on the pointer's copy, also when the pointer
+  carries `--send` alone; `--plan` lists the refusal.
+- T2 (sage-2315 B1): `--sso --send` onto C1, then a rollback to B, whose Console has no `--sso`. The
+  pointer and the unit end with neither flag, and the plan and steps name the drop.
+- T2 and T4 usage: every forbidden pairing and verb, checked against the full usage text.
+- T3: from an `--sso --send` pointer, `--no-sso` on the same copy gives back the pre-`--sso` ExecStart
+  line byte for byte, without `--send`. A second case walks past a `--no-send` re-pin that ran with
+  `--sso` and keeps the pointer's tester port (7334), which differs from the set's (7333). A third
+  (sage-2305 a) turns `--sso` on, then re-pins twice with `--send` and `--no-send`, so the two newest
+  sets both hold `--sso`. `--no-sso` then gives back the arrival's ExecStart line byte for byte.
+- T4 (sage-2305 b): two sets, both edited or written to hold `--sso` with sums intact, refuse
+  `sso-off-flags` through `refused()`.
+- T4: `sso-not-on`; an ok line with no activation; a set that fails its sums, ran with `--sso`, has no
+  argv or is missing; a log with no set. Each runs through `refused()`, so nothing stops and nothing else changes.
+- T5: stack-release-external.test.mjs adds `--send` and `--no-sso` to the row 232 usage list.
+- T55 test 5 and the T57 usage test match the new usage line.
+
+## Mutants
+
+| # | Change | Expected killer |
+|---|---|---|
+| M1 | `set_flags` skips the SHA256SUMS comparison when `--no-sso` is given | T4 tampered set |
+| M2 | `no_sso_base` skips the `sso-not-on` refusal | T4 `sso-not-on` |
+| M3 | the `--no-sso` branch of `send_for_target` keeps `--send` | T3 |
+| M4 | `--send` skips the `send-needs-sso` refusal | T2 |
+| M5 | parse_opts drops the `--send`/`--no-send` rule | T2 and T4 usage |
+| M6 | a rollback to a Console without `--sso` keeps `--send` (B1) | T2 (sage-2315 B1) |
+| M7 | the walk skips an ok line with no activation (N1) | T4 no-activation line |
+
+Runs and results go in the round's notes once Sage clears the slot.
@@ -0,0 +1,127 @@
+# Row 202 BUILD: FED R5, `mosaic access list|grant|revoke`
+
+Quackerjack, 2026-10-20. Plan: `PLAN.md` (commit 2d0aa2937). Manifest: `MANIFEST.md` in this directory.
+Brief: `docs/plans/2026-10-20_federation-r1-r2-r5.md`, "Brief: FED R5". Reviewer Duckworth. Gate owner Sage.
+Review record: round 2 approved as duckworth-0041 (commit 2a1d17da7) on 48a3fb96e; viewer carry c204bef73 after it.
+
+## What was built
+
+- `packages/cli/src/access.mjs`: the three verbs, the human proof, the context (`accessContextFor`), the
+  atomic write, the lock and the receipt.
+- `packages/cli/src/cli.mjs`: routes `access` to `accessCommand`.
+- `scripts/mosaic`: sends `access` to the CLI.
+- `packages/cli/README.md`: the verbs, the human proof, the lock, the `instances` limit, the removal order,
+  and the limits on peers and subjects.
+- `packages/cli/tests/access.test.mjs`: 21 tests (round 2; 18 in round 1). Single file, green on this branch.
+
+R1 (`packages/business/src/access.mjs`) is merged in unchanged at 80fe31071, the Duckworth-approved
+candidate. 44e36fc4c, the next commit on that branch, only removes a stray pyc file.
+
+## The lock file (not in PLAN.md; added at Sage's request)
+
+- Path: `<configDir>/access.json.lock`, the access file's path plus `.lock`. Mode 0600.
+- Created with `O_EXCL` (`wx`). The holder writes its pid and a newline into it, then holds it for the
+  read, the check, the temp write and the rename. It is removed in a `finally`.
+- A second writer that finds the lock reads the pid. If the pid is alive (or the pid is reused by a live
+  process), it refuses with `refused: ... being written by another command; try again` (exit 3). Nothing
+  is written.
+- A lock whose pid is gone (`kill(pid, 0)` returns ESRCH) also refuses, and nothing reclaims it. The
+  refusal names the path and the pid. A human checks that no write is running and removes the file. This
+  is the crash case: the holder died mid-write, and a human clears it.
+- An empty lock, or one that is not a pid, refuses. Its holder may still be between create and write. A
+  holder that died in that gap leaves an empty lock; a human removes it.
+
+Reclaim was removed at Sage's ruling (sage-1429, 10-20). It was the one design with a race, so the
+race below is gone, not accepted.
+
+Former limit, now removed: reclaim race. The old design let a writer take a stale lock by unlinking it
+and retaking it. The case that lost: writers A and B both read the same dead pid N. A unlinks the lock
+and takes it. B then unlinks A's live lock and takes its own. Both read the same revision, both write
+it, and the second rename silently replaces the first. The revision check did not catch it, because both
+had read the old revision before either wrote.
+
+Known limits, stated plainly:
+1. A dead holder's lock blocks every write until a human removes it. That is the fail-closed price of
+   no reclaim. The refusal says which pid and which path.
+2. A reused pid reads as alive, so a stale lock refuses. The fix is to remove the file by hand.
+3. The lock is per access file. It does not cover the bus's own reads.
+4. Crash-safety of the write path: the temp file is removed on any failure before or at the rename. The
+   directory is not fsynced after the rename, so a power loss right after a rename can lose the rename.
+   The bytes are never mixed.
+
+Tests for the lock (all in `access.test.mjs`):
+- "a live holder's lock refuses and leaves the file and the lock alone": pid = this process.
+- "an empty or unreadable lock refuses": empty file, and `not-a-pid`.
+- "a lock left by a dead pid refuses, names the pid, and is not reclaimed": a child that has exited. The
+  file, the lock and the receipt are unchanged.
+- "the lock is mode 0600 while held and removed after a refused write".
+
+Tests for the write path and the refusals (added in this round):
+- "a failed rename leaves the old bytes, removes the temp file, and writes no receipt": the fs seam
+  (`deps.fs`) makes `renameSync` throw. Checks the old bytes, no `.access-*.tmp`, no lock, no receipt.
+- "a group-writable access file refuses with exit 3, names the file, and changes nothing": a 0664 file.
+  Exit 3, the file path in the message, nothing written.
+- "an agent or tester caller is refused before the context or the access file is read": `contextFor`
+  throws if called, and the file is 0664. The refusal must come first.
+
+## The human proof, and the bus behavior behind test 10
+
+The proof is one `project.list` call through `humanTransport`. The bus gates it with `#human`
+(`packages/bus/src/broker.mjs`, the `project.list` case at :2319, and `#human` at :377). The call is in
+one function, `proveHuman` in `access.mjs`, for R4 to swap.
+
+Test 10 runs the real `human-cli.mjs` on a scratch bus from agent ancestry (`CLAUDECODE=1` in the child's
+env). The bus refuses. The client reports `outcome-unknown`, not `human-required`, because the bus closes
+the socket on a failed proof and `packages/bus/src/client.mjs:32-33` maps a closed socket to
+`outcome-unknown`. Exit 1 (`busExit`). The test pins that code and asserts the access file and the
+receipt are unchanged.
+
+This is a bus behavior outside R5. It is not changed here. Gizmoduck and Gander own the verifier (row 196).
+Until it changes, a human who hits the agent refusal sees `outcome-unknown`.
+
+## Context
+
+`accessContextFor(system, env)`:
+- `providers`: `system.console.sso.providers[].id`. Row 192's shape (packages/webui/src/sso-config.mjs on
+  row 192's candidate).
+- `ssoSubjects`: each provider's `subjects[].sub`, paired with the provider id. Gizmoduck's design says
+  `console.sso.subjects`; Sage ruled that is shorthand for this (erratum).
+- `peers`: `[]` until row 203 adds the federation key. A grant that names a peer home refuses.
+- `businesses`: `loadBusiness` for each `<configDir>/businesses/*.json`; `human` and the role names as
+  `instances`. A business file that fails to load fails the command.
+
+No `console` key gives empty providers and subjects, so every grant naming a subject refuses. The
+`checkConsole` check from row 192 is not on this branch yet. R5 rebases onto row 192's landing, and then
+reads `console` through `checkConsole`.
+
+## Mutant list (one per refusal; run on Sage's go, before review)
+
+| # | Mutant | Expected kill |
+|---|---|---|
+| M1 | remove the `refuseInsideAgent` call | "an agent caller is refused before the bus is asked" |
+| M2 | remove the `--tester` check | "--tester is refused on every verb" |
+| M3 | the proof's error is swallowed | "a bus that refuses the human proof blocks the write" |
+| M4 | the revision compare is removed | "a stale revision refuses with revision-conflict" |
+| M5 | `takeLock` unlinks a dead-pid lock and retakes it (the reclaim this round removed) | "a lock left by a dead pid refuses, names the pid, and is not reclaimed" |
+| M6 | `pidAlive` always returns true (a dead pid reads as live) | "a lock left by a dead pid refuses, names the pid, and is not reclaimed" |
+| M11 | `writeAtomic` writes straight to access.json, no temp file or rename | "a failed rename leaves the old bytes, removes the temp file, and writes no receipt" |
+| M12 | the BusinessError catch in `accessCommand` is removed | "a group-writable access file refuses with exit 3, names the file, and changes nothing" |
+| M13 | `contextFor()` is called before the agent and tester refusals | "an agent or tester caller is refused before the context or the access file is read" |
+| M7 | `checkAccess` is skipped before the write | "a grant naming an unknown instance is refused before any write" |
+| M8 | the receipt append is removed | "grant writes ... a receipt line" |
+| M9 | a project name is written as given (no lookup) | "a project name resolves to its id" |
+| M10 | the lock is not taken | "a live holder's lock refuses" |
+
+Round 2 closed the direct-write gap: `writeAtomic` takes the fs calls through `deps.fs` (default: the real
+`node:fs` functions), and a rename that throws is tested (M11 is the direct-write mutant). Not yet run:
+the mutant batch, the cli suite and `scripts/test-*.sh`. All wait on Sage's slot.
+
+Round 2 also changed the file's refusal path: a `BusinessError` from `loadAccess` or `loadBusiness` now
+exits 3 with the file path and key path on stderr, no stack trace (Duckworth B1, Sage sage-1437).
+
+## Not done in this row
+
+- `--peers` and the federation key: row 203.
+- `access.reload`: row R4.
+- Gizmoduck's `console.sso.subjects` name: erratum, the flattened shape is used.
+- The suite (`packages/cli` and every `scripts/test-*.sh`) and the mutant batch: on Sage's gate.
@@ -0,0 +1,29 @@
+# Brief: row 253 F5 follow-up, supervised legacy AS_USER calls in the case scripts
+
+Sage, 2026-10-22. Source: row 253's DESIGN-C4 addendum (Gander 968db0bcd, :111-124) and Duckworth's
+addendum ruling (duckworth-0111, RULING-c4-addendum.md at 45288e584, F5 and C4).
+
+## Brief: supervised legacy AS_USER calls
+
+Owner Gander. Reviewer Duckworth. Gate owner Sage. Starts after row 253 lands.
+
+Why: when a terminal is present, sudo runs the command in a new session (use_pty), and it can't relay
+SIGKILL. Row 253 puts its new config query and peer probe under an inline supervisor that scans the
+session it owns. It leaves the older calls in `case1-accept.sh` as they are. These are the `timeout 330 ...
+talk` path (case1-accept.sh.txt:305 in Gander's frozen snapshot) and the other AS_USER diagnostics (:326,
+:335, :355, :396). Each of these wraps sudo in a GNU timeout outside the uid drop. That has the same gap:
+when it fires, it kills timeout's process group, and the command keeps running in its separate session.
+
+What to build:
+1. Every remaining AS_USER call in the case scripts runs under row 253's supervisor text. That's the same
+   bytes, pinned by row 253's C5 test, with its own inner and outer bounds and reasons. The talk path
+   keeps its 300 s conversation and its stdout and stderr diagnostics.
+2. Or, for any call that can't take the supervisor, the header says it isn't supervised and why, and the
+   DEFERRED entry stays open for that call by name.
+
+Tests: extend case-sudo-fixture.mjs cases in both fake modes (exec and session hop) to each changed call.
+Each one needs a no-leftover assertion and its exact reason. Mutants: drop the supervisor from the talk path,
+and drop the outer bound from one diagnostic. Each must be killed.
+
+Gate: Duckworth approves the manifest, the touched test files run whole, every scripts/test-*.sh runs,
+and the mutants are killed.
@@ -20,8 +20,9 @@ Two steps need `scripts/stack-release.sh` flags that don't exist at 02da6a2ae:
 The fix is one small row, approved in mos-1246: `activate --send` and `activate --no-sso`. `--no-sso`
 takes the Console flags from the rollback set of the activation that turned `--sso` on, the way `sso_base`
 already does for a rollback to a copy without `--sso`. It drops `--send`, and its plan line says so. `--send`
-refuses unless the run's Console flags hold `--sso`, given or carried (F39). test-release.sh gets cases for
-both. Darkwing builds it, and a seat other than Sage and Darkwing reviews it. Brief:
+refuses unless the run's Console flags hold `--sso`, given or carried (F39). The cases for both go in
+`packages/cli/tests/stack-release.test.mjs`. F39 named test-release.sh, but that suite tests `release.sh`
+and never calls `stack-release.sh`, so it runs whole and unchanged. Darkwing builds it, and a seat other than Sage and Darkwing reviews it. Brief:
 `docs/plans/2026-10-22_activate-send-nosso.md`. It lands and is re-pinned before the window, on Mos's go,
 run by Jason or Mos. The steps below assume it, and draft 3 names the new copy.

@@ -33,7 +33,7 @@ Gaps found while working go to `docs/plans/DEFERRED.md`, not here.

 <!-- mosaic-queue:begin -->

-Generated from `docs/plans/queue.json` revision 3102 by `queue render`. Do not edit between the markers; change the queue with `scripts/mosaic queue`.
+Generated from `docs/plans/queue.json` revision 3108 by `queue render`. Do not edit between the markers; change the queue with `scripts/mosaic queue`.

 | # | Piece | Owner | Issues | State | After | Gate | Brief | Note |
 |---|---|---|---|---|---|---|---|---|
@@ -238,10 +238,10 @@ Generated from `docs/plans/queue.json` revision 3102 by `queue render`. Do not e
 | 199 | MVP T1 item 6: a credential store per agent, own git identity, pushes to a remote (G11, G13; mos-0974) | megavolt; reviewers duckworth | #1697 | done | — | Duckworth approves DESIGN.md; Mos rules on the authority model; Duckworth approves the manifest; bus, business, cli and tasks suites and every scripts/test-*.sh green on Sage's gate; the mutants killed (sage) | `docs/plans/2026-10-20_agent-credentials.md` § Brief: a credential store per agent, own git identity, pushes to a remote | Landed cb5fdb064 on refactor (base 76134dfde), pushed. Patch-id 828fa21a matches git diff 00d4cc1f6..86963d281 on the 37 manifest paths; docs/TOOLS.md 3-way with row 200, hunk unchanged. Manifest 35f900fd, Duckworth approve r1 29779. Gate on 9e1085816+patch: packages 2735/0, scripts 429/0; landed blobs equal the gate tree. |
 | 200 | stack-release.sh activate --sso for the Q175 phase 2 window (row 192 F3; chained on 192) | launchpad; reviewers webby | #1698 | done | — | Webby approves the manifest; cli suite and every scripts/test-*.sh green on Sage's gate; the mutants killed (sage) | `docs/plans/2026-10-20_stack-release-sso.md` § Brief: stack-release.sh activates a Console with --sso (Q175 phase 2 prerequisite) | Landed 9e1085816 on refactor (base 722136772), pushed. Patch-id 7ebfa6a5 matches git diff 00d4cc1f6..9df40878f on the 3 manifest paths. Manifest b3ead55c, Webby approve r3 29772. Gate on 9df40878f: packages 2675/0, scripts 429/0. Mutants 13/14, M12 ruled equivalent (sage-1446). |
 | 201 | FED R1: access.json loader and validator, and covers (#414) | gizmoduck; reviewers duckworth | #1699 | done | — | Duckworth approves the manifest; business suite and every scripts/test-*.sh green on Sage's gate; the mutants killed (sage) | `docs/plans/2026-10-20_federation-r1-r2-r5.md` § Brief: FED R1, the access.json loader and validator | Landed afad4993f on refactor (squash of gizmoduck ae3c36f24..44e36fc4c, manifest 225597146daf...0c520). patch-id ba604ad5e matches the reviewed diff on all 3 paths. Gate on 44e36fc4c in the slot (gizmoduck-0060): business 173/0, 10 scripts 422/0, mutants 44/44. Duckworth approve 29581. |
-| 202 | FED R5: mosaic access list, grant and revoke (#414) | quackerjack; reviewers duckworth | #1700 | in-review, round 2, request posted | — | Duckworth approves the manifest; cli suite and every scripts/test-*.sh green on Sage's gate; the mutants killed (sage) | `docs/plans/2026-10-20_federation-r1-r2-r5.md` § Brief: FED R5, mosaic access list, grant and revoke | Chained on row 201's candidate (Q177), not its done: claimable now, lands after 201 and rebases onto its landing (Sage) |
+| 202 | FED R5: mosaic access list, grant and revoke (#414) | quackerjack; reviewers duckworth | #1700 | done | — | Duckworth approves the manifest; cli suite and every scripts/test-*.sh green on Sage's gate; the mutants killed (sage) | `docs/plans/2026-10-20_federation-r1-r2-r5.md` § Brief: FED R5, mosaic access list, grant and revoke | Chained on row 201's candidate (Q177), not its done: claimable now, lands after 201 and rebases onto its landing (Sage) |
 | 203 | FED R2: the federation key in the system config (#414) | quackerjack; reviewers webby | #1701 | briefed | — | Webby approves the manifest; cli suite and every scripts/test-*.sh green on Sage's gate; the mutants killed (sage) | `docs/plans/2026-10-20_federation-r1-r2-r5.md` § Brief: FED R2, the federation key in the system config | Chained on row 192's candidate (Q177): starts on 192's candidate, lands after 192 (Sage) |
 | 204 | 193a: access level check widened to viewer (#1691) | morgana; reviewers duckworth | #1702 | done | — | Duckworth approves the manifest; business suite and every scripts/test-*.sh green on Sage's gate; the mutants killed (sage) | `docs/plans/2026-10-20_human-users-build.md` § Brief: 193a, the access level check widened to viewer | Landed d0bbc5c1c on refactor (base c9f374284). Patch-id 92c18aea matches git diff 44e36fc4c..f869fd062 on the 3 manifest paths. Manifest d38de8c9, Duckworth approve 29595. Gate 2789/0 on 4385b9ec1, mutants 7/7. Unpushed. |
-| 205 | 193b1a: the message filter (#1703; FED R3 and 193b1b build on it) | morgana; reviewers duckworth | #1703 | briefed | 196 done | Duckworth approves the manifest; bus suite and every scripts/test-*.sh green on Sage's gate; the mutants killed (sage) | `docs/plans/2026-10-20_human-users-build.md` § Brief: 193b1a, the message filter | — |
+| 205 | 193b1a: the message filter (#1703; FED R3 and 193b1b build on it) | morgana; reviewers duckworth | #1703 | in-progress | 196 done | Duckworth approves the manifest; bus suite and every scripts/test-*.sh green on Sage's gate; the mutants killed (sage) | `docs/plans/2026-10-20_human-users-build.md` § Brief: 193b1a, the message filter | — |
 | 206 | 193b2: thread shares, schema 3k-3l after the #436b build (#1691; live needs a --migrate window with Jason) | morgana; reviewers duckworth | #1704 | queued | 205 done, 234 done, 236 done, 275 done | Duckworth approves the manifest; bus suite, cli suite and every scripts/test-*.sh green on Sage's gate; the mutants killed (sage) | `docs/plans/2026-10-20_human-users-build.md` § Brief: 193b2, thread shares (schema 3l) | — |
 | 207 | 193c: mosaic access user verbs and --level viewer (#1691) | morgana; reviewers duckworth | #1705 | queued | 202 done | Duckworth approves the manifest; cli suite and every scripts/test-*.sh green on Sage's gate; the mutants killed (sage) | `docs/plans/2026-10-20_human-users-build.md` § Brief: 193c, mosaic access user verbs and --level viewer | — |
 | 208 | 193d: Console shared list, share controls and viewer read-only (#1691; also after FED R6 when filed) | morgana; reviewers duckworth | #1706 | queued | 192 done, 206 done | Duckworth approves the manifest; webui suite and every scripts/test-*.sh green on Sage's gate; the mutants killed (sage) | `docs/plans/2026-10-20_human-users-build.md` § Brief: 193d, the Console's shared list, share controls and viewer read-only | — |
@@ -309,9 +309,10 @@ Generated from `docs/plans/queue.json` revision 3102 by `queue render`. Do not e
 | 270 | 264c T1 item 7: compaction count, exact for Pi | gizmoduck; reviewers duckworth | #1775 | briefed | 269 done | Duckworth approves this slice's manifest. Its design tests run whole plus every touched suite on Sage's slot, and its mutants are killed (RULINGS Q1). Test T3 Pi half; Claude shows unknown with the Vikunja 466 reason (Q6). (sage) | `docs/plans/2026-10-21_t1-sessions.md` § T1 item 7: independent sessions, compaction counts and clear context | — |
 | 271 | 264d T1 item 7: clear context through row 194's lifecycle stop | gizmoduck; reviewers duckworth | #1776 | briefed | 194 done, 269 done | Duckworth approves this slice's manifest. Its design tests run whole plus every touched suite on Sage's slot, and its mutants are killed (RULINGS Q1). Tests T4 and T6; rebased onto 194's landing with no 194 code copied (Q4). (sage) | `docs/plans/2026-10-21_t1-sessions.md` § T1 item 7: independent sessions, compaction counts and clear context | — |
 | 272 | 264e T1 item 7: mosaic session CLI and Console chooser | gizmoduck; reviewers duckworth | #1777 | briefed | 264 done | Duckworth approves this slice's manifest. Its design tests run whole plus every touched suite on Sage's slot, and its mutants are killed (RULINGS Q1). Tests T5 legacy single human and T7 Console half; controls for unlanded verbs refuse with a reason (Q1, Q7). (sage) | `docs/plans/2026-10-21_t1-sessions.md` § T1 item 7: independent sessions, compaction counts and clear context | — |
-| 273 | Q175 phase 2: stack-release.sh activate --send and --no-sso (F39, mos-1246) | darkwing; reviewers filbert | #1778 | briefed | — | Filbert approves the manifest. stack-release.test.mjs and stack-release-external.test.mjs run whole plus scripts/test-release.sh on Sage's slot, and the brief's mutants are killed. (sage) | `docs/plans/2026-10-22_activate-send-nosso.md` § Brief: activate --send and --no-sso | — |
-| 274 | FED R3: broker user principal (#414) | morgana; reviewers dewey | #1779 | briefed | — | Dewey approves the manifest. The bus and harness suites and every scripts/test-*.sh are green on Sage's gate, and the mutants are killed. (sage) | `docs/plans/2026-10-22_federation-r3.md` § Brief: FED R3, the broker user principal | — |
+| 273 | Q175 phase 2: stack-release.sh activate --send and --no-sso (F39, mos-1246) | darkwing; reviewers filbert | #1778 | in-progress | — | Filbert approves the manifest. stack-release.test.mjs and stack-release-external.test.mjs run whole plus scripts/test-release.sh on Sage's slot, and the brief's mutants are killed. (sage) | `docs/plans/2026-10-22_activate-send-nosso.md` § Brief: activate --send and --no-sso | — |
+| 274 | FED R3: broker user principal (#414) | morgana; reviewers dewey | #1779 | in-progress | — | Dewey approves the manifest. The bus and harness suites and every scripts/test-*.sh are green on Sage's gate, and the mutants are killed. (sage) | `docs/plans/2026-10-22_federation-r3.md` § Brief: FED R3, the broker user principal | — |
 | 275 | 193b1b: viewer verbs and board refusals (also after FED R4 when filed) | morgana; reviewers duckworth | #1780 | briefed | 205 done, 274 done | Duckworth approves the manifest. The bus suite and every scripts/test-*.sh are green on Sage's gate, and the mutants are killed. (sage) | `docs/plans/2026-10-20_human-users-build.md` § Brief: 193b1b, viewer verbs and board refusals | — |
+| 276 | Row 253 F5: supervise the legacy AS_USER talk and diagnostics in the case scripts | gander; reviewers duckworth | #1781 | briefed | 253 done | Duckworth approves the manifest. The touched test files run whole, every scripts/test-*.sh is green on Sage's gate, and the mutants are killed. (sage) | `docs/plans/2026-10-22_case-sudo-legacy-followup.md` § Brief: supervised legacy AS_USER calls | — |

 <!-- mosaic-queue:end -->

@@ -1,7 +1,7 @@
 {
  "version": 1,
  "canonicalRoot": "/mnt/storage/src/mosaic-stack",
-  "revision": 3102,
+  "revision": 3108,
  "rows": [
    {
      "id": 1,
@@ -21441,7 +21441,7 @@
      "closes": [
        1700
      ],
-      "state": "in-review",
+      "state": "done",
      "previousState": null,
      "required": false,
      "requiredSince": null,
@@ -21568,15 +21568,12 @@
          }
        ]
      },
-      "claim": {
-        "seat": "quackerjack",
-        "op": "quackerjack-202-start"
-      },
+      "claim": null,
      "note": "Chained on row 201's candidate (Q177), not its done: claimable now, lands after 201 and rebases onto its landing (Sage)",
      "blockedReason": null,
      "createdAt": "2026-10-20T19:42:59.570Z",
-      "updatedAt": "2026-10-21T22:09:50.722Z",
-      "updatedBy": "duckworth"
+      "updatedAt": "2026-10-22T02:01:48.311Z",
+      "updatedBy": "sage"
    },
    {
      "id": 203,
@@ -21711,7 +21708,7 @@
      "closes": [
        1703
      ],
-      "state": "briefed",
+      "state": "in-progress",
      "previousState": null,
      "required": false,
      "requiredSince": null,
@@ -21732,12 +21729,15 @@
        "duckworth"
      ],
      "review": null,
-      "claim": null,
+      "claim": {
+        "seat": "morgana",
+        "op": "morgana-205-start-1"
+      },
      "note": null,
      "blockedReason": null,
      "createdAt": "2026-10-20T19:44:12.910Z",
-      "updatedAt": "2026-10-22T00:50:24.817Z",
-      "updatedBy": "sage"
+      "updatedAt": "2026-10-22T01:24:48.298Z",
+      "updatedBy": "morgana"
    },
    {
      "id": 206,
@@ -27031,7 +27031,7 @@
      "closes": [
        1778
      ],
-      "state": "briefed",
+      "state": "in-progress",
      "previousState": null,
      "required": false,
      "requiredSince": null,
@@ -27047,12 +27047,15 @@
        "filbert"
      ],
      "review": null,
-      "claim": null,
+      "claim": {
+        "seat": "darkwing",
+        "op": "darkwing-273-claim-1"
+      },
      "note": null,
      "blockedReason": null,
      "createdAt": "2026-10-22T00:49:02.640Z",
-      "updatedAt": "2026-10-22T00:54:21.474Z",
-      "updatedBy": "sage"
+      "updatedAt": "2026-10-22T01:26:14.459Z",
+      "updatedBy": "darkwing"
    },
    {
      "id": 274,
@@ -27064,7 +27067,7 @@
      "closes": [
        1779
      ],
-      "state": "briefed",
+      "state": "in-progress",
      "previousState": null,
      "required": false,
      "requiredSince": null,
@@ -27080,12 +27083,15 @@
        "dewey"
      ],
      "review": null,
-      "claim": null,
+      "claim": {
+        "seat": "morgana",
+        "op": "morgana-274-start-1"
+      },
      "note": null,
      "blockedReason": null,
      "createdAt": "2026-10-22T00:51:10.987Z",
-      "updatedAt": "2026-10-22T00:55:05.247Z",
-      "updatedBy": "sage"
+      "updatedAt": "2026-10-22T01:25:32.568Z",
+      "updatedBy": "morgana"
    },
    {
      "id": 275,
@@ -27128,6 +27134,44 @@
      "createdAt": "2026-10-22T00:51:54.534Z",
      "updatedAt": "2026-10-22T00:55:47.065Z",
      "updatedBy": "sage"
+    },
+    {
+      "id": 276,
+      "piece": "Row 253 F5: supervise the legacy AS_USER talk and diagnostics in the case scripts",
+      "owner": "gander",
+      "issues": [
+        1781
+      ],
+      "closes": [
+        1781
+      ],
+      "state": "briefed",
+      "previousState": null,
+      "required": false,
+      "requiredSince": null,
+      "gate": "Duckworth approves the manifest. The touched test files run whole, every scripts/test-*.sh is green on Sage's gate, and the mutants are killed.",
+      "gateOwner": "sage",
+      "brief": {
+        "path": "docs/plans/2026-10-22_case-sudo-legacy-followup.md",
+        "anchor": "Brief: supervised legacy AS_USER calls",
+        "blob": "b0d0b7f76ef1933b70d7c0ff9ceef58bb3fe5c6b"
+      },
+      "after": [
+        {
+          "id": 253,
+          "when": "done"
+        }
+      ],
+      "reviewers": [
+        "duckworth"
+      ],
+      "review": null,
+      "claim": null,
+      "note": null,
+      "blockedReason": null,
+      "createdAt": "2026-10-22T01:58:23.353Z",
+      "updatedAt": "2026-10-22T01:59:07.003Z",
+      "updatedBy": "sage"
    }
  ],
  "log": [
@@ -109069,6 +109113,177 @@
        "receipt": "ok sage-275-briefed-0022 rev 3102 row 275 queued→briefed"
      },
      "viewSha": "f25628bc6b477edaff12ba424225bf82f3cff21bdf45e678496e5f2e3a862893"
+    },
+    {
+      "rev": 3103,
+      "op": "morgana-205-start-1",
+      "verb": "move",
+      "args": {
+        "id": 205,
+        "to": "in-progress",
+        "reason": null,
+        "candidate": null,
+        "evidence": null,
+        "issue": null
+      },
+      "by": "morgana",
+      "at": "2026-10-22T01:24:48.298Z",
+      "semantics": 2,
+      "result": {
+        "row": 205,
+        "from": "briefed",
+        "to": "in-progress",
+        "round": null,
+        "issue": null,
+        "candidate": null,
+        "receipt": "ok morgana-205-start-1 rev 3103 row 205 briefed→in-progress"
+      },
+      "viewSha": "db811f7752ed36459fb361eee1062815639e8439688c28eb38ed656fbf949d26"
+    },
+    {
+      "rev": 3104,
+      "op": "morgana-274-start-1",
+      "verb": "move",
+      "args": {
+        "id": 274,
+        "to": "in-progress",
+        "reason": null,
+        "candidate": null,
+        "evidence": null,
+        "issue": null
+      },
+      "by": "morgana",
+      "at": "2026-10-22T01:25:32.568Z",
+      "semantics": 2,
+      "result": {
+        "row": 274,
+        "from": "briefed",
+        "to": "in-progress",
+        "round": null,
+        "issue": null,
+        "candidate": null,
+        "receipt": "ok morgana-274-start-1 rev 3104 row 274 briefed→in-progress"
+      },
+      "viewSha": "9de6fc1f247f1ed4b392596dc98d8e16fdd3c113ab28eea4adf73e25e5547a56"
+    },
+    {
+      "rev": 3105,
+      "op": "darkwing-273-claim-1",
+      "verb": "move",
+      "args": {
+        "id": 273,
+        "to": "in-progress",
+        "reason": null,
+        "candidate": null,
+        "evidence": null,
+        "issue": null
+      },
+      "by": "darkwing",
+      "at": "2026-10-22T01:26:14.459Z",
+      "semantics": 2,
+      "result": {
+        "row": 273,
+        "from": "briefed",
+        "to": "in-progress",
+        "round": null,
+        "issue": null,
+        "candidate": null,
+        "receipt": "ok darkwing-273-claim-1 rev 3105 row 273 briefed→in-progress"
+      },
+      "viewSha": "bef4326bf903ca8059c300f8e52189af85d82879ca600066e7f8f211f8f19d85"
+    },
+    {
+      "rev": 3106,
+      "op": "sage-253f5-add-b",
+      "verb": "add",
+      "args": {
+        "piece": "Row 253 F5: supervise the legacy AS_USER talk and diagnostics in the case scripts",
+        "gate": "Duckworth approves the manifest. The touched test files run whole, every scripts/test-*.sh is green on Sage's gate, and the mutants are killed.",
+        "brief": "docs/plans/2026-10-22_case-sudo-legacy-followup.md#Brief: supervised legacy AS_USER calls",
+        "issues": [
+          1781
+        ],
+        "note": null,
+        "owner": "gander",
+        "gateOwner": "sage",
+        "after": [
+          {
+            "id": 253,
+            "when": "done"
+          }
+        ],
+        "reviewers": [
+          "duckworth"
+        ],
+        "required": null
+      },
+      "by": "sage",
+      "at": "2026-10-22T01:58:23.353Z",
+      "semantics": 2,
+      "result": {
+        "row": 276,
+        "from": null,
+        "to": "queued",
+        "brief": {
+          "path": "docs/plans/2026-10-22_case-sudo-legacy-followup.md",
+          "anchor": "Brief: supervised legacy AS_USER calls",
+          "blob": "b0d0b7f76ef1933b70d7c0ff9ceef58bb3fe5c6b"
+        },
+        "receipt": "ok sage-253f5-add-b rev 3106 row 276 none→queued"
+      },
+      "viewSha": "60688f2cadd887471133a79bf1ce84416dbe2d9afa7322302f290933be5450ab"
+    },
+    {
+      "rev": 3107,
+      "op": "sage-276-briefed-0022",
+      "verb": "move",
+      "args": {
+        "id": 276,
+        "to": "briefed",
+        "reason": null,
+        "candidate": null,
+        "evidence": null,
+        "issue": null
+      },
+      "by": "sage",
+      "at": "2026-10-22T01:59:07.003Z",
+      "semantics": 2,
+      "result": {
+        "row": 276,
+        "from": "queued",
+        "to": "briefed",
+        "round": null,
+        "issue": null,
+        "candidate": null,
+        "receipt": "ok sage-276-briefed-0022 rev 3107 row 276 queued→briefed"
+      },
+      "viewSha": "c81c29470cb5a4f2b391ffbbc222f1ebeae863c181ddf124049e396929b03ceb"
+    },
+    {
+      "rev": 3108,
+      "op": "sage-202-done-0022",
+      "verb": "move",
+      "args": {
+        "id": 202,
+        "to": "done",
+        "reason": null,
+        "candidate": null,
+        "evidence": null,
+        "issue": null
+      },
+      "by": "sage",
+      "at": "2026-10-22T02:01:48.311Z",
+      "semantics": 2,
+      "result": {
+        "row": 202,
+        "from": "in-review",
+        "to": "done",
+        "round": 2,
+        "issue": null,
+        "candidate": null,
+        "receipt": "ok sage-202-done-0022 rev 3108 row 202 in-review→done round 2"
+      },
+      "viewSha": "8d8d0082fe3209698c9c2feb86bad94df7539447e233c9c6dc26e627a5f17f60"
    }
  ]
 }
@@ -1061,6 +1061,35 @@ A status line shows `revoking:` with the tags of a revoke still in progress.
 Enrollment itself is a `host-enroll` grant the chief raises and the human approves, not a CLI
 command. A usage error exits 4 and a bus refusal 2.

+## Access (FED R5, #414)
+
+```
+mosaic access list --business ID [--json]
+mosaic access grant --business ID --user ID --projects UUID|NAME,...|* --instances NAME,...|* --level collaborator|viewer [--expires ISO] --revision N
+mosaic access revoke --business ID --user ID [--grant GID] --revision N
+```
+
+These edit `<configDir>/access.json` (design section 3.5). The human proof is one `project.list`
+call through the human transport: the bus gates it with `#human` (`packages/bus/src/broker.mjs`,
+the `project.list` case and `#human`). An agent, or `--tester`, is refused before any write. Each
+write runs the file's checks on the new document first, bumps the revision by one, and renames
+atomically. A `--revision` that is not the file's current revision refuses with `revision-conflict`.
+A writer that finds the lock refuses at once. A lock whose pid is gone, or that is empty or
+unreadable, also refuses, and nothing reclaims it: check that no write is running, then remove
+`<configDir>/access.json.lock` by hand. Each write appends one receipt line to
+`<dataRoot>/state/access-log.jsonl`.
+
+The command runs as the instance's uid. `access.json` must belong to that uid and must not be
+writable by group or other. If it is not, or a business file fails to load, the command refuses
+with exit 3, names the file and the key path, and writes nothing.
+
+A grant's `instances` is the real limit. The granted instance runs with the owner's role, so a
+collaborator's message drives it with that authority. To cut a user off, revoke first: it acts at
+once. Removing a provider from `console.sso` takes effect only after a Console restart.
+
+Peer homes are not read yet, so a grant that names a peer home refuses until row 203 adds the
+federation key. A grant that names a sign-in subject needs `console.sso` in the system config.
+
 ## Token usage

 `mosaic usage [--business ID] [--json] [--tester]` reads the bus's accounting, without
@@ -0,0 +1,288 @@
+// `mosaic access list|grant|revoke` (federation design section 3.5, FED R5, #414).
+// The human edits <configDir>/access.json here. Each write is checked against the
+// instance's context before it lands, bumps the revision by one, and appends one
+// receipt line to <dataRoot>/state/access-log.jsonl. The human proof is one call
+// through humanTransport: a bus that does not see a human shell refuses it, so
+// no agent and no tester can write. The context (providers, peers, businesses,
+// ssoSubjects) comes in as a function; the caller decides where it comes from.
+
+import { appendFileSync, mkdirSync, readdirSync, readFileSync, renameSync, openSync, writeSync, fsyncSync, closeSync, existsSync, unlinkSync } from "node:fs";
+import { randomBytes } from "node:crypto";
+import { join, dirname } from "node:path";
+import { BusinessError, accessFilePath, checkAccess, configDir, loadAccess, loadBusiness, LEVELS } from "../../business/src/index.mjs";
+import { rolesDir } from "./config.mjs";
+import { CliError } from "./errors.mjs";
+import { refuseInsideAgent } from "./transport.mjs";
+
+export const ACCESS_USAGE = [
+  "mosaic access list --business ID [--json]",
+  "mosaic access grant --business ID --user ID --projects UUID|NAME,...|* --instances NAME,...|* --level collaborator|viewer [--expires ISO] --revision N",
+  "mosaic access revoke --business ID --user ID [--grant GID] --revision N",
+].join("\n");
+
+// The help text. A grant's `instances` is the real limit: the granted instance
+// runs with the owner's role, so a collaborator drives it with that authority.
+// Removing a user acts at once. Removing a provider from console.sso waits for a
+// Console restart, so take the users out of access.json first. Peer homes are
+// empty until the federation key lands (row 203), so a grant naming a peer
+// home refuses until then. A grant naming a subject needs console.sso.
+export const ACCESS_HELP = `${ACCESS_USAGE}
+
+A grant gives a user exactly what the granted instances can do. The instances
+list is the real limit: a collaborator's message drives a granted instance with
+the owner's role.
+To cut a user off, revoke them here first. It acts at once. Removing a provider
+from console.sso takes effect only after a Console restart, so do that second.
+Peer homes are not read yet (row 203 adds the federation key), so a grant that
+names a peer home refuses. A grant that names a sign-in subject needs console.sso
+in the system config; without it every such grant refuses.
+The command runs as the instance's uid: access.json must belong to it and must
+not be writable by group or other, or the command refuses (exit 3) and writes nothing.`;
+
+// The instance's context for checkAccess, read from the system config and the business
+// files. providers and ssoSubjects come from console.sso (row 192's shape: each provider
+// has an id and a subjects list). peers is empty until row 203. A business file that
+// fails to load fails the whole command.
+export function accessContextFor(system, env) {
+  const providers = system.console?.sso?.providers ?? [];
+  const ssoSubjects = providers.flatMap((p) => p.subjects.map((s) => ({ provider: p.id, sub: s.sub })));
+  const dir = join(configDir(env), "businesses");
+  const businesses = {};
+  if (existsSync(dir)) {
+    for (const file of readdirSync(dir).filter((f) => f.endsWith(".json")).sort()) {
+      const id = file.slice(0, -".json".length);
+      const doc = loadBusiness(id, { dir: configDir(env), rolesDir: rolesDir(env) });
+      businesses[id] = { human: doc.human, instances: Object.keys(doc.roles) };
+    }
+  }
+  return { providers: providers.map((p) => p.id), peers: [], businesses, ssoSubjects };
+}
+
+// Every verb needs --business: the human proof runs through that business's bus.
+// --tester is refused outright on every verb, before any bus call.
+function parse(args) {
+  const out = { positional: [], flags: new Set(), values: {} };
+  for (let i = 0; i < args.length; i++) {
+    const a = args[i];
+    if (a === "--json" || a === "--tester") out.flags.add(a);
+    else if (a.startsWith("--")) {
+      if (i + 1 >= args.length || args[i + 1].startsWith("--")) throw new CliError(`${a} needs one value\n${ACCESS_USAGE}`, 4);
+      out.values[a] = args[++i];
+    } else out.positional.push(a);
+  }
+  return out;
+}
+
+const list = (value) => (value === "*" ? ["*"] : value.split(",").filter(Boolean));
+
+function readCurrent(file, context) {
+  if (!existsSync(file)) return { document: { accessVersion: 1, revision: null, users: [], grants: [] }, revision: 0 };
+  const document = loadAccess(file, context);
+  return { document, revision: document.revision };
+}
+
+// The file calls the write path makes. A test passes a stand-in through deps.fs.
+const realFs = { openSync, writeSync, fsyncSync, closeSync, renameSync, unlinkSync };
+
+// Atomic write: a temp file in the same directory, 0600, fsynced, then renamed over
+// the old file. A reader sees the old bytes or the new bytes, never a mix. A failure
+// before or at the rename removes the temp file and leaves the old bytes in place.
+function writeAtomic(file, text, fs = realFs) {
+  const tmp = join(dirname(file), `.access-${randomBytes(8).toString("hex")}.tmp`);
+  try {
+    const fd = fs.openSync(tmp, "wx", 0o600);
+    try {
+      fs.writeSync(fd, text);
+      fs.fsyncSync(fd);
+    } finally {
+      fs.closeSync(fd);
+    }
+    fs.renameSync(tmp, file);
+  } catch (error) {
+    try {
+      fs.unlinkSync(tmp);
+    } catch {
+      // Already gone: the temp file was never created.
+    }
+    throw error;
+  }
+}
+
+function receipt(dataRoot, line) {
+  const dir = join(dataRoot, "state");
+  mkdirSync(dir, { recursive: true });
+  appendFileSync(join(dir, "access-log.jsonl"), `${JSON.stringify(line)}\n`, { mode: 0o600 });
+}
+
+// Two writers never interleave: the read, the check and the rename happen under an
+// exclusive lock file, `<access.json>.lock`, mode 0600. The file holds the holder's
+// pid and a newline. A lock whose holder is alive refuses. A lock that is empty,
+// unreadable, or whose pid is gone also refuses, and nothing reclaims it: a human
+// removes it once no write is running. Fail closed, with no reclaim race.
+const BUSY = "refused: the access file is being written by another command; try again";
+
+function lockPid(lock) {
+  let text;
+  try {
+    text = readFileSync(lock, "utf8");
+  } catch {
+    return null;
+  }
+  const pid = Number(text.trim());
+  return Number.isSafeInteger(pid) && pid >= 1 ? pid : null;
+}
+
+function pidAlive(pid) {
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch (error) {
+    return error.code !== "ESRCH";
+  }
+}
+
+function lockRefusal(lock) {
+  const pid = lockPid(lock);
+  if (pid !== null && pidAlive(pid)) return BUSY;
+  if (pid === null) return `refused: lock ${lock} is unreadable or not a pid; if no write is running, remove it by hand and try again`;
+  return `refused: lock ${lock} is left by pid ${pid}, which is not running; if no write is running, remove it by hand and try again`;
+}
+
+function takeLock(lock, fs) {
+  try {
+    return fs.openSync(lock, "wx", 0o600);
+  } catch (error) {
+    if (error.code !== "EEXIST") throw error;
+  }
+  throw new CliError(lockRefusal(lock), 3);
+}
+
+export function withLock(file, fn, fs = realFs) {
+  const lock = `${file}.lock`;
+  const fd = takeLock(lock, fs);
+  try {
+    fs.writeSync(fd, `${process.pid}\n`);
+  } finally {
+    fs.closeSync(fd);
+  }
+  try {
+    return fn();
+  } finally {
+    fs.unlinkSync(lock);
+  }
+}
+
+// The one human-proof call: project.list, which the bus gates with #human
+// (broker.mjs:2319, and #human at :377). It also returns the rows that resolve
+// project names. Row R4 swaps this call for access.reload.
+async function proveHuman(transport, business) {
+  return transport(business)("project.list", {});
+}
+
+// Resolve a --projects item: "*" and UUIDs pass through, anything else is a project
+// name looked up in project.list at grant time (the id is what gets written).
+function resolveProjects(items, rows) {
+  return items.map((item) => {
+    if (item === "*" || /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/.test(item)) return item;
+    const hits = rows.filter((r) => r.name === item);
+    if (hits.length !== 1) throw new CliError(`refused: project-not-found: no project named ${item} in this business (or the name is ambiguous)`, 2);
+    return hits[0].id;
+  });
+}
+
+// deps: { system: { dataRoot }, transport(business) -> call(verb, args), contextFor() -> context, configDir?, now?, fs? }
+export async function accessCommand(args, io, deps) {
+  refuseInsideAgent(io.env);
+  try {
+    return await accessVerb(args, io, deps);
+  } catch (error) {
+    // A file or business doc the checks refuse to load (group-writable, a wrong uid, a
+    // hand edit) is a refusal with exit 3 and the file and key path, not a crash.
+    if (error instanceof BusinessError) throw new CliError(`refused: ${error.message}`, 3);
+    throw error;
+  }
+}
+
+async function accessVerb(args, io, deps) {
+  const parsed = parse(args);
+  const sub = parsed.positional[0];
+  if (!["list", "grant", "revoke"].includes(sub) || parsed.positional.length !== 1) throw new CliError(ACCESS_HELP, 4);
+  if (parsed.flags.has("--tester")) throw new CliError("refused: access writes take the human's shell, not --tester", 3);
+  const business = parsed.values["--business"];
+  if (!business) throw new CliError(`--business is required\n${ACCESS_USAGE}`, 4);
+
+  const rows = await proveHuman(deps.transport, business);
+  const file = deps.file ?? accessFilePath(deps.configDir ?? configDir(io.env));
+  // Built after the human proof, so a refused caller never reads the business files.
+  const context = deps.contextFor();
+
+  if (sub === "list") {
+    const { document } = readCurrent(file, context);
+    io.stdout.write(parsed.flags.has("--json") ? `${JSON.stringify(document, null, 2)}\n` : formatList(document));
+    return;
+  }
+
+  const expected = parsed.values["--revision"];
+  if (!/^\d+$/.test(expected ?? "")) throw new CliError(`--revision takes the revision you read\n${ACCESS_USAGE}`, 4);
+  const user = parsed.values["--user"];
+  if (!user) throw new CliError(`${sub} needs --user\n${ACCESS_USAGE}`, 4);
+
+  const result = withLock(file, () => {
+    const { document, revision } = readCurrent(file, context);
+    if (Number(expected) !== revision) {
+      throw new CliError(`refused: revision-conflict: the access file is at revision ${revision}, not ${expected}; run list again`, 3);
+    }
+    let next;
+    let touched;
+    if (sub === "grant") {
+      const level = parsed.values["--level"];
+      if (!parsed.values["--projects"] || !parsed.values["--instances"] || level === undefined) {
+        throw new CliError(`grant needs --projects, --instances and --level\n${ACCESS_USAGE}`, 4);
+      }
+      if (!LEVELS.includes(level)) throw new CliError(`--level takes ${LEVELS.join(", ")}`, 2);
+      const id = `g-${randomBytes(4).toString("hex")}`;
+      const grant = {
+        id,
+        user,
+        business,
+        projects: resolveProjects(list(parsed.values["--projects"]), rows),
+        instances: list(parsed.values["--instances"]),
+        level,
+      };
+      if (parsed.values["--expires"] !== undefined) grant.expires = parsed.values["--expires"];
+      touched = [id];
+      next = { ...document, revision: revision + 1, grants: [...document.grants, grant] };
+    } else {
+      const only = parsed.values["--grant"];
+      const drop = (g) => g.user === user && g.business === business && (only === undefined || g.id === only);
+      touched = document.grants.filter(drop).map((g) => g.id);
+      if (touched.length === 0) throw new CliError(`refused: no grant for ${user} at ${business} to revoke`, 2);
+      next = { ...document, revision: revision + 1, grants: document.grants.filter((g) => !drop(g)) };
+    }
+    // Every check runs on the new document before a byte is written.
+    const checked = checkAccess(next, context);
+    writeAtomic(file, `${JSON.stringify(checked, null, 2)}\n`, deps.fs);
+    return { checked, revision, touched };
+  }, deps.fs);
+
+  receipt(deps.system.dataRoot, {
+    at: (deps.now ?? (() => new Date()))().toISOString(),
+    verb: sub,
+    business,
+    user,
+    actor: "human",
+    revisionBefore: result.revision,
+    revisionAfter: result.checked.revision,
+    grants: result.touched,
+  });
+  io.stdout.write(`access ${sub}: ${result.touched.join(", ")} at ${business}, revision ${result.checked.revision}\n`);
+}
+
+function formatList(doc) {
+  const lines = [`access file revision ${doc.revision ?? "none"}`];
+  for (const u of doc.users) lines.push(`user ${u.id} home ${u.home}`);
+  for (const g of doc.grants) {
+    lines.push(`grant ${g.id} user ${g.user} business ${g.business} projects ${g.projects.join(",")} instances ${g.instances.join(",")} level ${g.level}${g.expires ? ` expires ${g.expires}` : ""}`);
+  }
+  return `${lines.join("\n")}\n`;
+}
@@ -20,6 +20,7 @@ import { pluginsCommand, PLUGINS_USAGE } from "./plugins.mjs";
 import { credentialsCommand, CREDENTIALS_USAGE } from "./credentials.mjs";
 import { hostsCommand, HOSTS_USAGE } from "./hosts.mjs";
 import { instancesCommand, INSTANCES_USAGE } from "./instances.mjs";
+import { accessCommand, accessContextFor } from "./access.mjs";
 import { createChannelCaller } from "../../plugins/src/channel.mjs";
 import { PluginError } from "../../plugins/src/kinds.mjs";
 import { CliError } from "./errors.mjs";
@@ -577,6 +578,15 @@ export async function main(argv, io = { env: process.env, stdin: process.stdin,
  if (verb === "project") return ["create", "list"].includes(rest[0]) ? projectBusCommand(rest, io, (p) => channelCallFor(p, io, deps)) : projectCommand(rest, io, deps, (p) => callFor(p, io, deps));
  if (verb === "threads") return threadsCommand(rest, io, (p) => channelCallFor(p, io, deps));
  if (verb === "thread") return threadCommand(rest, io, (p) => channelCallFor(p, io, deps), formatMessage);
+  if (verb === "access") {
+    const system = deps.system ?? loadSystem({ env: io.env });
+    return accessCommand(rest, io, {
+      system,
+      transport: (b) => humanTransport({ socket: socketPath(system.dataRoot), business: b, env: io.env }),
+      contextFor: () => deps.accessContext ?? accessContextFor(system, io.env),
+      now: deps.now,
+    });
+  }
  if (verb === "limits") return limitsCommand(rest,io,p=>callFor(p,io,deps));
  if (verb === "usage") return usageCommand(rest, io, p => callFor(p, io, deps));
  if (verb === "plugins") return pluginsCommand(rest, io, (p) => callFor(p, io, deps));
@@ -0,0 +1,314 @@
+// `mosaic access` (FED R5, #414). Every write goes to a scratch config dir and a
+// scratch data root. The success paths run on a stand-in human CLI (fakeCli).
+// The one test that runs the real human-cli.mjs does it on a scratch bus from
+// agent ancestry, so the bus must refuse, and nothing is written.
+import test from "node:test";
+import assert from "node:assert/strict";
+import { spawnSync } from "node:child_process";
+import * as nodeFs from "node:fs";
+import { chmodSync, existsSync, mkdirSync, readFileSync, readdirSync, statSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+import { startBroker } from "../../bus/src/runtime.mjs";
+import { accessCommand, accessContextFor, withLock } from "../src/access.mjs";
+import { CliError } from "../src/errors.mjs";
+import { socketPath } from "../src/config.mjs";
+import { HUMAN_CLI, humanTransport } from "../src/transport.mjs";
+import { fakeCli, humanEnv, io, tmp, fixture } from "./helpers.mjs";
+import { systemFor, writeJson } from "../../business/tests/helpers.mjs";
+
+const PROJECT = "3f1c2a64-0d8e-4b7a-9c55-1a2b3c4d5e6f";
+const ROWS = [{ id: PROJECT, name: "hub", repo: null }];
+const CONTEXT = {
+  providers: ["authentik"],
+  peers: [],
+  businesses: { acme: { human: "jason", instances: ["coder"] } },
+  ssoSubjects: [{ provider: "authentik", sub: "jason-sub" }],
+};
+const DOC = {
+  accessVersion: 1,
+  revision: 1,
+  users: [{ id: "alice", home: "local", subjects: [{ provider: "authentik", sub: "alice-sub" }] }],
+  grants: [],
+};
+
+// The stand-in human CLI. It answers project.list with ROWS, or refuses like a bus
+// that sees no human shell when FAKE_MODE is "refuse".
+const BODY = `
+import { readFileSync, writeFileSync } from "node:fs";
+const input = JSON.parse(readFileSync(0, "utf8"));
+writeFileSync(process.env.FAKE_LOG, JSON.stringify(input));
+if (process.env.FAKE_MODE === "refuse") { process.stderr.write("human-required\\n"); process.exit(3); }
+process.stdout.write(JSON.stringify(${JSON.stringify(ROWS)}));
+`;
+
+function setup(t, { mode = "ok", doc = DOC } = {}) {
+  const root = tmp(t, "mosaic-access-");
+  const config = join(root, "config");
+  mkdirSync(config, { recursive: true });
+  const dataRoot = join(root, "data");
+  const log = join(root, "fake.log");
+  const cli = fakeCli(root, BODY);
+  const env = humanEnv({ FAKE_LOG: log, FAKE_MODE: mode });
+  const file = join(config, "access.json");
+  if (doc) writeFileSync(file, JSON.stringify(doc, null, 2), { mode: 0o600 });
+  const deps = {
+    system: { dataRoot },
+    configDir: config,
+    contextFor: () => CONTEXT,
+    now: () => new Date("2026-10-20T20:00:00Z"),
+    transport: (business) => humanTransport({ socket: join(root, "bus.sock"), business, env, cli, timeoutMs: 5000 }),
+  };
+  const receipts = () => (existsSync(join(dataRoot, "state", "access-log.jsonl")) ? readFileSync(join(dataRoot, "state", "access-log.jsonl"), "utf8") : "");
+  return { root, config, file, deps, env, log, receipts, read: () => JSON.parse(readFileSync(file, "utf8")) };
+}
+
+const GRANT_BASE = ["grant", "--business", "acme", "--user", "alice"];
+const GRANT = [...GRANT_BASE, "--projects", PROJECT, "--instances", "coder", "--level", "collaborator"];
+
+async function run(args, deps, env = humanEnv()) {
+  const i = io(env);
+  await accessCommand(args, i, deps);
+  return i.out.text;
+}
+
+async function refusal(promise, pattern) {
+  await assert.rejects(promise, (e) => e instanceof CliError && pattern.test(e.message));
+  return promise.catch((e) => e);
+}
+
+test("list prints the revision and the users", async (t) => {
+  const s = setup(t);
+  const out = await run(["list", "--business", "acme"], s.deps);
+  assert.match(out, /access file revision 1/);
+  assert.match(out, /user alice home local/);
+});
+
+test("grant writes one revision up, a receipt line, and the id in the file", async (t) => {
+  const s = setup(t);
+  const out = await run([...GRANT, "--revision", "1"], s.deps);
+  assert.match(out, /access grant: g-[0-9a-f]{8} at acme, revision 2/);
+  const doc = s.read();
+  assert.equal(doc.revision, 2);
+  assert.equal(doc.grants.length, 1);
+  assert.deepEqual(doc.grants[0].projects, [PROJECT]);
+  const [line] = s.receipts().trim().split("\n").map((l) => JSON.parse(l));
+  assert.equal(line.verb, "grant");
+  assert.equal(line.revisionBefore, 1);
+  assert.equal(line.revisionAfter, 2);
+  assert.equal(line.actor, "human");
+});
+
+test("a viewer grant writes the viewer level, one revision up", async (t) => {
+  const s = setup(t);
+  await run([...GRANT_BASE, "--projects", PROJECT, "--instances", "coder", "--level", "viewer", "--revision", "1"], s.deps);
+  const doc = s.read();
+  assert.equal(doc.revision, 2);
+  assert.equal(doc.grants[0].level, "viewer");
+});
+
+test("a second write appends a second receipt and leaves the first intact", async (t) => {
+  const s = setup(t);
+  await run([...GRANT, "--revision", "1"], s.deps);
+  await run(["revoke", "--business", "acme", "--user", "alice", "--revision", "2"], s.deps);
+  const lines = s.receipts().trim().split("\n").map((l) => JSON.parse(l));
+  assert.deepEqual(lines.map((l) => l.verb), ["grant", "revoke"]);
+  assert.equal(lines[0].revisionAfter, 2);
+});
+
+test("a stale revision refuses with revision-conflict and writes nothing", async (t) => {
+  const s = setup(t);
+  await run([...GRANT, "--revision", "1"], s.deps);
+  const before = readFileSync(s.file, "utf8");
+  await refusal(run([...GRANT, "--revision", "1"], s.deps), /revision-conflict/);
+  assert.equal(readFileSync(s.file, "utf8"), before);
+  assert.equal(s.receipts().trim().split("\n").length, 1);
+});
+
+test("a live holder's lock refuses and leaves the file and the lock alone", async (t) => {
+  const s = setup(t);
+  writeFileSync(`${s.file}.lock`, `${process.pid}\n`, { mode: 0o600 });
+  const before = readFileSync(s.file, "utf8");
+  await refusal(run([...GRANT, "--revision", "1"], s.deps), /being written by another command/);
+  assert.equal(readFileSync(s.file, "utf8"), before);
+  assert.equal(readFileSync(`${s.file}.lock`, "utf8"), `${process.pid}\n`);
+  assert.equal(readdirSync(s.config).filter((f) => f.startsWith(".access-")).length, 0);
+});
+
+test("an empty or unreadable lock refuses, since its holder may still be writing", async (t) => {
+  const s = setup(t);
+  writeFileSync(`${s.file}.lock`, "");
+  await refusal(run([...GRANT, "--revision", "1"], s.deps), /is unreadable or not a pid/);
+  writeFileSync(`${s.file}.lock`, "not-a-pid\n");
+  await refusal(run([...GRANT, "--revision", "1"], s.deps), /is unreadable or not a pid/);
+  assert.equal(existsSync(`${s.file}.lock`), true);
+});
+
+test("a lock left by a dead pid refuses, names the pid, and is not reclaimed", async (t) => {
+  const s = setup(t);
+  const dead = spawnSync(process.execPath, ["-e", ""]);
+  writeFileSync(`${s.file}.lock`, `${dead.pid}\n`, { mode: 0o600 });
+  const before = readFileSync(s.file, "utf8");
+  await refusal(run([...GRANT, "--revision", "1"], s.deps), new RegExp(`${s.file}\\.lock is left by pid ${dead.pid}, which is not running`));
+  assert.equal(readFileSync(s.file, "utf8"), before);
+  assert.equal(readFileSync(`${s.file}.lock`, "utf8"), `${dead.pid}\n`);
+  assert.equal(s.receipts(), "");
+});
+
+test("a failed rename leaves the old bytes, removes the temp file, and writes no receipt", async (t) => {
+  const s = setup(t);
+  const before = readFileSync(s.file, "utf8");
+  const fs = { ...nodeFs, renameSync: () => { throw Object.assign(new Error("injected rename failure"), { code: "EXDEV" }); } };
+  await assert.rejects(run([...GRANT, "--revision", "1"], { ...s.deps, fs }), /injected rename failure/);
+  assert.equal(readFileSync(s.file, "utf8"), before);
+  assert.deepEqual(readdirSync(s.config).filter((f) => f.startsWith(".access-")), []);
+  assert.equal(existsSync(`${s.file}.lock`), false);
+  assert.equal(s.receipts(), "");
+});
+
+test("a group-writable access file refuses with exit 3, names the file, and changes nothing", async (t) => {
+  const s = setup(t);
+  chmodSync(s.file, 0o664);
+  const before = readFileSync(s.file, "utf8");
+  const err = await refusal(run([...GRANT, "--revision", "1"], s.deps), /must not be writable by group or other/);
+  assert.equal(err.exitCode, 3);
+  assert.match(err.message, new RegExp(s.file.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")));
+  assert.equal(readFileSync(s.file, "utf8"), before);
+  assert.equal(s.receipts(), "");
+  assert.equal(existsSync(`${s.file}.lock`), false);
+});
+
+test("an agent or tester caller is refused before the context or the access file is read", async (t) => {
+  const s = setup(t);
+  chmodSync(s.file, 0o664);
+  const deps = { ...s.deps, contextFor: () => { throw new Error("context was read"); } };
+  const env = { ...humanEnv(), MOSAIC_RUN_ID: "run-1" };
+  await refusal(run([...GRANT, "--revision", "1"], deps, env), /human shell/);
+  await refusal(run(["list", "--business", "acme", "--tester"], deps), /not --tester/);
+});
+
+test("the lock is mode 0600 while held and removed after a refused write", async (t) => {
+  const s = setup(t);
+  let mode;
+  withLock(s.file, () => {
+    mode = statSync(`${s.file}.lock`).mode & 0o777;
+  });
+  assert.equal(mode, 0o600);
+  assert.equal(existsSync(`${s.file}.lock`), false);
+  await refusal(run([...GRANT, "--revision", "9"], s.deps), /revision-conflict/);
+  assert.equal(existsSync(`${s.file}.lock`), false);
+});
+
+test("a grant naming an unknown instance is refused before any write", async (t) => {
+  const s = setup(t);
+  const before = readFileSync(s.file, "utf8");
+  const bad = [...GRANT_BASE, "--projects", PROJECT, "--instances", "nobody", "--level", "collaborator", "--revision", "1"];
+  await refusal(run(bad, s.deps), /refused: /);
+  assert.equal(readFileSync(s.file, "utf8"), before);
+  assert.equal(s.receipts(), "");
+});
+
+test("a project name resolves to its id at grant time", async (t) => {
+  const s = setup(t);
+  const args = [...GRANT_BASE, "--projects", "hub", "--instances", "coder", "--level", "collaborator", "--revision", "1"];
+  await run(args, s.deps);
+  assert.deepEqual(s.read().grants[0].projects, [PROJECT]);
+});
+
+test("an unknown project name refuses before any write", async (t) => {
+  const s = setup(t);
+  const before = readFileSync(s.file, "utf8");
+  const args = [...GRANT_BASE, "--projects", "nope", "--instances", "coder", "--level", "collaborator", "--revision", "1"];
+  await refusal(run(args, s.deps), /project-not-found/);
+  assert.equal(readFileSync(s.file, "utf8"), before);
+});
+
+test("revoke removes the user's grants and leaves a revision behind", async (t) => {
+  const s = setup(t);
+  await run([...GRANT, "--revision", "1"], s.deps);
+  await run(["revoke", "--business", "acme", "--user", "alice", "--revision", "2"], s.deps);
+  const doc = s.read();
+  assert.equal(doc.revision, 3);
+  assert.deepEqual(doc.grants, []);
+});
+
+test("revoke of a user with no grant refuses and writes nothing", async (t) => {
+  const s = setup(t);
+  const before = readFileSync(s.file, "utf8");
+  await refusal(run(["revoke", "--business", "acme", "--user", "alice", "--revision", "1"], s.deps), /no grant/);
+  assert.equal(readFileSync(s.file, "utf8"), before);
+});
+
+test("an agent caller is refused before the bus is asked", async (t) => {
+  const s = setup(t);
+  const before = readFileSync(s.file, "utf8");
+  const env = { ...humanEnv(), MOSAIC_RUN_ID: "run-1" };
+  const err = await refusal(run([...GRANT, "--revision", "1"], s.deps, env), /human shell/);
+  assert.equal(err.exitCode, 3);
+  assert.equal(existsSync(s.log), false);
+  assert.equal(readFileSync(s.file, "utf8"), before);
+});
+
+test("--tester is refused on every verb before the bus is asked", async (t) => {
+  const s = setup(t);
+  for (const verb of [["list"], [...GRANT, "--revision", "1"], ["revoke", "--user", "alice", "--revision", "1"]]) {
+    const args = [...verb, "--business", "acme", "--tester"];
+    const err = await refusal(run(args, s.deps), /not --tester/);
+    assert.equal(err.exitCode, 3);
+  }
+  assert.equal(existsSync(s.log), false);
+});
+
+test("a bus that refuses the human proof blocks the write", async (t) => {
+  const s = setup(t, { mode: "refuse" });
+  const before = readFileSync(s.file, "utf8");
+  const err = await refusal(run([...GRANT, "--revision", "1"], s.deps), /human-required/);
+  assert.equal(err.exitCode, 3);
+  assert.equal(readFileSync(s.file, "utf8"), before);
+  assert.equal(s.receipts(), "");
+});
+
+test("the context reads console.sso subjects and the business files, and peers stay empty", async (t) => {
+  const root = tmp(t, "mosaic-access-ctx-");
+  const f = fixture(root, "acme");
+  const system = { console: { sso: { providers: [{ id: "authentik", subjects: [{ sub: "jason-sub" }] }] } } };
+  const ctx = accessContextFor(system, { MOSAIC_CONFIG: join(root, "config", "config.json") });
+  assert.deepEqual(ctx.providers, ["authentik"]);
+  assert.deepEqual(ctx.ssoSubjects, [{ provider: "authentik", sub: "jason-sub" }]);
+  assert.deepEqual(ctx.peers, []);
+  assert.equal(ctx.businesses.acme.human, "jason");
+  assert.ok(Array.isArray(ctx.businesses.acme.instances) && ctx.businesses.acme.instances.length > 0);
+  const bare = accessContextFor({}, { MOSAIC_CONFIG: join(root, "config", "config.json") });
+  assert.deepEqual(bare.ssoSubjects, []);
+  assert.deepEqual(bare.providers, []);
+});
+
+// Real human-cli.mjs on a scratch bus, run from agent ancestry. The proof must fail.
+test("the real human-cli, run from agent ancestry, refuses and writes nothing", async (t) => {
+  const root = tmp(t, "mosaic-access-real-");
+  const f = fixture(root, "acme");
+  const config = join(root, "config");
+  const bus = await startBroker({
+    dataRoot: f.dataRoot,
+    businesses: { acme: { id: "acme", human: "jason", arbiters: { technical: "coder", delivery: "coder" }, roles: { coder: { authority: { withinRole: [], crossRole: [] } } } } },
+    organization: { dir: config, rolesDir: f.roles, system: systemFor(root) },
+  });
+  t.after(() => bus.close());
+  writeJson(join(config, "access.json"), DOC);
+  const file = join(config, "access.json");
+  const before = readFileSync(file, "utf8");
+  const agentEnv = { ...humanEnv(), CLAUDECODE: "1" };
+  const deps = {
+    system: { dataRoot: f.dataRoot },
+    configDir: config,
+    contextFor: () => CONTEXT,
+    transport: (business) => humanTransport({ socket: socketPath(f.dataRoot), business, env: agentEnv, cli: HUMAN_CLI, timeoutMs: 10000 }),
+  };
+  // The bus closes the socket on a failed human proof, so the client reports
+  // outcome-unknown (client.mjs:32-33), not human-required. That is a bus behavior
+  // outside R5 (BUILD.md). The test pins it, and nothing is written.
+  const err = await refusal(run([...GRANT, "--revision", "1"], deps), /^outcome-unknown/);
+  assert.equal(err.code, "outcome-unknown");
+  assert.equal(err.exitCode, 1);
+  assert.equal(readFileSync(file, "utf8"), before);
+  assert.equal(existsSync(join(f.dataRoot, "state", "access-log.jsonl")), false);
+});
@@ -66,13 +66,13 @@ async function closed(e,x,a){
 const storeSha=(e)=>sha(e.store);
 const backupStore=(e,a)=>join(e.data,'backups','stack',a,'bus','bus.sqlite');

-test('row 232: confirm, revert, gate, --to and --expect-from need --units external; the user-only flags are usage under it',async(t)=>{
+test('row 232: confirm, revert, gate, --to and --expect-from need --units external; the user-only flags are usage under it, and so are row 273\'s --send and --no-sso',async(t)=>{
 const {e,x}=await xseed(t);
 const logs=logLines(e).length;
 for(const a of [['confirm',C1,'acme'],['revert',C1,'acme'],['gate',B,'acme','--since','1'],['rollback','acme','--to',B],['activate',C1,'acme','--plan','--expect-from',B]]){
  const r=await run(e,...a);assert.equal(r.code,4,a.join(' '));assert.match(r.err,/^usage: stack-release.sh adopt BUSINESS\n/);
 }
- for(const a of [['activate',C1,'acme','--pm'],['activate',C1,'acme','--tester-port','7444'],['activate',C1,'acme','--no-proof'],['activate',C1,'acme','--no-send'],['activate',C1,'acme','--sso'],['activate',C1,'acme','--proof-header','X','--proof-file','/p'],['rollback','acme'],['gate',B,'acme'],['activate',C1,'acme','--expect-from',B],['confirm',C1,'acme','--rollback',B],['confirm',C1,'acme','--cause','A5']]){
+ for(const a of [['activate',C1,'acme','--pm'],['activate',C1,'acme','--tester-port','7444'],['activate',C1,'acme','--no-proof'],['activate',C1,'acme','--no-send'],['activate',C1,'acme','--sso'],['activate',C1,'acme','--send'],['activate',C1,'acme','--no-sso'],['activate',C1,'acme','--proof-header','X','--proof-file','/p'],['rollback','acme'],['gate',B,'acme'],['activate',C1,'acme','--expect-from',B],['confirm',C1,'acme','--rollback',B],['confirm',C1,'acme','--cause','A5']]){
  const r=await run(x,...a);assert.equal(r.code,4,a.join(' '));
 }
 assert.equal(logLines(e).length,logs);
@@ -1258,7 +1258,7 @@ test('T53 row 187: activate sets, carries and drops the proof pair',async(t)=>{
   ['activate',C1,'acme','--plan','--proof-file',f]]){
   const r=await prun(e,...args);assert.equal(r.code,4,args.join(' '));assert.equal(r.out,'');assert.equal(r.err,usageText);
  }
-  assert.match(usageText,/\[--proof-header NAME --proof-file PATH \| --no-proof \| --sso\]/);
+  assert.match(usageText,/\[--proof-header NAME --proof-file PATH \| --no-proof \| --sso \| --no-sso\]/);
  assert.deepEqual(fp(e),before);assert.deepEqual(startsStops(e,n),[]);assert.equal(logLines(e).length,logs);
  await noLeak(e);
 });
@@ -1417,7 +1417,7 @@ test('T55 row 189: activate --no-send drops --send, and rollback and pm-on carry
   ['rehearse','acme','--backup','/tmp/x','--port','7400','--no-send']]){
   const r=await prun(e,...args);assert.equal(r.code,4,args.join(' '));assert.equal(r.out,'');assert.equal(r.err,usageText);
  }
-  assert.match(usageText,/\| --no-proof \| --sso\] \[--no-send\]/);
+  assert.match(usageText,/\| --no-proof \| --sso \| --no-sso\] \[--send \| --no-send\]/);
  assert.deepEqual(fp(e),before);assert.deepEqual(startsStops(e,n),[]);assert.equal(logLines(e).length,logs);
  await noLeak(e);
 });
@@ -1465,7 +1465,7 @@ const DROPS='--public-host console.example --auth-header x-user --allow-user jas
 const SHOW=`show-${CON}.txt`;
 const setOf=(e,act)=>join(e.state,'stack-rollback',act);
 const arrivalSet=(e,to)=>setOf(e,logLines(e).findLast((l)=>l.result==='ok'&&l.to===to&&l.from!==to).activation);
-const ROLLBACK_PLAN=(set)=>`sso: dropped; ${B}'s Console does not support --sso, so the rollback takes the Console flags from ${set}/${SHOW}, with --send and --tester-port as the pointer has them`;
+const ROLLBACK_PLAN=(set)=>`sso: dropped; ${B}'s Console does not support --sso, so the rollback takes the Console flags from ${set}/${SHOW}, with --tester-port as the pointer has it`;
 const KEY_MSG=(e,to,op,why)=>`${e.cfg} holds a console key, and ${to}'s loader refuses it (${why}); remove the key first (restore the config.json backup from the window's step 1), then run the ${op} again`;
 const RB_MSG=(why)=>`${B}'s Console does not support --sso, and the Console flags it ran with cannot be read: ${why}`;
 // Rewrites a file in a rollback set (0700, files kept by cp -p) and, unless sums is false, its SHA256SUMS line.
@@ -1526,7 +1526,7 @@ test('T57 row 200: activate --sso, its refusals before any stop, and the rollbac
   ['rollback','acme','--sso'],['pm-on','acme','--sso'],['status','acme','--sso'],['adopt','acme','--sso']]){
   const r=await prun(e,...args);assert.equal(r.code,4,args.join(' '));assert.equal(r.out,'');assert.equal(r.err,usageText);
  }
-  assert.match(usageText,/\[--proof-header NAME --proof-file PATH \| --no-proof \| --sso\] \[--no-send\]/);
+  assert.match(usageText,/\[--proof-header NAME --proof-file PATH \| --no-proof \| --sso \| --no-sso\] \[--send \| --no-send\]/);
  assert.deepEqual(fp(e),before);assert.deepEqual(startsStops(e,n),[]);assert.equal(logLines(e).length,logs);
  await noLeak(e);
 });
@@ -1600,14 +1600,14 @@ test('T57 row 200: activate --sso, its refusals before any stop, and the rollbac
  assert.ok(conExec(e).endsWith(` --checkout ${repo} ${want.join(' ')}`),conExec(e));
  assert.ok(stepText(e).includes(`Z drop --sso; ${B}'s Console does not support it, so the Console flags come from ${set}/${SHOW}\n`));
  r=await prun(e,'status','acme');assert.equal(r.code,0,r.err);assert.match(r.out,/unit flags: match the pointer/);
-  // The plain case: --send and the preview set and pair come back as they were.
+  // The plain case: the preview set and pair come back as they were. --send lost its --sso, so it goes (row 273, F39 b).
  const g=await mk(t),gbase=await seedPreview(g,undefined,['--send']),f=await proofFile(g);
  r=await prun(g,'activate',B,'acme',...pair(f));assert.equal(r.code,0,r.out+r.err);
  await ssoConfig(g);
  r=await prun(g,'activate',C1,'acme','--sso');assert.equal(r.code,0,r.out+r.err);
  setKey(g,undefined);
  r=await prun(g,'rollback','acme');assert.equal(r.code,0,r.out+r.err);
-  assert.deepEqual(pointer(g).console,[...noSend(gbase),...pair(f),'--send']);
+  assert.deepEqual(pointer(g).console,[...noSend(gbase),...pair(f)]);
  for(const x of [e,g])await noLeak(x);
 });
 await t.test('item 3: a rollback set that is missing, fails its sums, holds no argv or already ran --sso refuses sso-rollback-flags',async(t)=>{
@@ -1679,7 +1679,7 @@ test('T57 row 200: activate --sso, its refusals before any stop, and the rollbac
  r=await prun(a,'status','acme');assert.equal(r.code,0,r.err);assert.match(r.out,/unit flags: match the pointer/);
  setKey(a,undefined);
  const set=arrivalSet(a,C1);assert.ok(existsSync(join(set,show)),show);
-  assert.deepEqual(ssoLines(await planOnly(a,0,'rollback','acme')),[`sso: dropped; ${B}'s Console does not support --sso, so the rollback takes the Console flags from ${set}/${show}, with --send and --tester-port as the pointer has them`]);
+  assert.deepEqual(ssoLines(await planOnly(a,0,'rollback','acme')),[`sso: dropped; ${B}'s Console does not support --sso, so the rollback takes the Console flags from ${set}/${show}, with --tester-port as the pointer has it`]);
  r=await prun(a,'rollback','acme');assert.equal(r.code,0,r.out+r.err);
  assert.equal(pointer(a).copy,B);assert.deepEqual(pointer(a).console,want.slice(0,-1));
  assert.ok(stepText(a).includes(`Z drop --sso; ${B}'s Console does not support it, so the Console flags come from ${set}/${show}\n`));
@@ -1695,6 +1695,198 @@ test('T57 row 200: activate --sso, its refusals before any stop, and the rollbac
 });
 });

+// Row 273 (#1778, mos-1246 F39): activate --send turns send on only beside --sso, given or carried, and
+// activate --no-sso turns --sso off with the Console flags from the set of the activation that turned
+// it on, dropping --send. The tester follows the pointer.
+const SEND_MSG="--send needs --sso in the run's Console flags, given or carried; under forward auth any same-uid process could send (F39)";
+const NOT_ON_MSG="the pointer's Console flags hold no --sso, so --no-sso has nothing to turn off";
+const OFF_MSG=(why)=>`the Console flags from before --sso cannot be read: ${why}`;
+const OFF_PLAN=(set,restores)=>`sso: off; Console flags from ${set}/${SHOW}; restores ${restores}`;
+const NOTE=(to)=>`note: ${to} is the pointer's copy; the run re-pins it and only the Console flags change`;
+test('T58 row 273: activate --send and --no-sso',async(t)=>{
+ await t.test('T1: --sso --send turns send on after --sso and before the tester port, and the plan says so',async(t)=>{
+  const e=await mk(t);await seedPreview(e,undefined,['--tester-port','7333']);await ssoConfig(e);
+  const want=['--port',e.port,'--business','acme','--sso','--send','--tester-port','7333'];
+  const out=await planOnly(e,0,'activate',C1,'acme','--sso','--send');
+  assert.deepEqual([...sendLines(out),...ssoLines(out)],['send: on; --send was given',`sso: on; drops ${DROPS}; carries --port ${e.port} --business acme --send --tester-port 7333`]);
+  assert.equal(out.find((l)=>l.startsWith('Console: ')),`Console: scripts/webui-service.sh install --copy ${C1} --copies ${COPIES} ${want.join(' ')}`);
+  let r=await prun(e,'activate',C1,'acme','--sso','--send');assert.equal(r.code,0,r.out+r.err);
+  assert.equal(pointer(e).copy,C1);assert.deepEqual(pointer(e).console,want);
+  assert.ok(conExec(e).endsWith(` --checkout ${repo} ${want.join(' ')}`),conExec(e));
+  const steps=stepText(e);
+  assert.ok(steps.includes('Z turn on --send; --send was given\n'),steps);assert.ok(steps.includes(`Z turn on --sso; drop ${DROPS}\n`),steps);
+  r=await prun(e,'status','acme');assert.equal(r.code,0,r.err);assert.match(r.out,/unit flags: match the pointer/);
+  // The same copy with send on again is already active.
+  await refused(e,['activate',C1,'acme','--send'],'already-active',`${C1} is the pointer's copy`);
+  await noLeak(e);
+ });
+ await t.test('T1: --send beside a carried --sso re-pins the live copy once, and the plan names the carried --sso',async(t)=>{
+  const e=await mk(t);await seedPreview(e);await ssoConfig(e);
+  let r=await prun(e,'activate',C1,'acme','--sso');assert.equal(r.code,0,r.out+r.err);
+  assert.deepEqual(pointer(e).console,['--port',e.port,'--business','acme','--sso']);
+  const out=await planOnly(e,0,'activate',C1,'acme','--send');
+  assert.deepEqual([...sendLines(out),...ssoLines(out)],['send: on; --send was given','sso: carried']);
+  assert.ok(out.includes(NOTE(C1)),out.join('\n'));
+  r=await prun(e,'activate',C1,'acme','--send');assert.equal(r.code,0,r.out+r.err);
+  const l=logLines(e).at(-1);assert.deepEqual([l.op,l.from,l.to,l.result],['activate',C1,C1,'ok']);
+  const want=['--port',e.port,'--business','acme','--sso','--send'];
+  assert.deepEqual(pointer(e).console,want);assert.ok(conExec(e).endsWith(` --checkout ${repo} ${want.join(' ')}`),conExec(e));
+  assert.ok(stepText(e).includes('Z turn on --send; --send was given\n'));assert.doesNotMatch(stepText(e),/^\S+Z .*sso/m);
+  await refused(e,['activate',C1,'acme','--send'],'already-active',`${C1} is the pointer's copy`);
+  // Another copy carries both.
+  assert.deepEqual(sendLines(await planOnly(e,0,'activate',C,'acme','--send')),['send: carried']);
+  r=await prun(e,'status','acme');assert.equal(r.code,0,r.err);assert.match(r.out,/unit flags: match the pointer/);
+  await noLeak(e);
+ });
+ await t.test('T2: --send without --sso, given or carried, refuses before any stop, and --plan lists it',async(t)=>{
+  const e=await mk(t);await seedPreview(e);
+  await refused(e,['activate',C1,'acme','--send'],'send-needs-sso',SEND_MSG);
+  await refused(e,['activate',B,'acme','--send'],'send-needs-sso',SEND_MSG);
+  const out=await planOnly(e,3,'activate',C1,'acme','--send');
+  assert.deepEqual(sendLines(out),['send: off']);
+  assert.deepEqual(out.filter((l)=>l.startsWith('refuses ')),[`refuses send-needs-sso: ${SEND_MSG}`]);
+  // A pointer that already holds --send without --sso still refuses a --send.
+  const g=await mk(t);await seedPreview(g,undefined,['--send']);
+  await refused(g,['activate',C1,'acme','--send'],'send-needs-sso',SEND_MSG);
+  await refused(g,['activate',B,'acme','--send'],'already-active',`${B} is the pointer's copy`);
+  for(const x of [e,g])await noLeak(x);
+ });
+ await t.test('T2 (sage-2315 B1): a rollback from an --sso --send pointer to a Console without --sso ends with neither flag',async(t)=>{
+  const e=await mk(t),base=await seedPreview(e);await ssoConfig(e);
+  let r=await prun(e,'activate',C1,'acme','--sso','--send');assert.equal(r.code,0,r.out+r.err);
+  assert.deepEqual(pointer(e).console,['--port',e.port,'--business','acme','--sso','--send']);
+  const set=arrivalSet(e,C1);
+  setKey(e,undefined);
+  const out=await planOnly(e,0,'rollback','acme');
+  assert.deepEqual([...sendLines(out),...ssoLines(out)],['send: dropped; the run drops --sso, and --send needs it (F39)',ROLLBACK_PLAN(set)]);
+  assert.equal(out.find((l)=>l.startsWith('Console: ')),`Console: scripts/webui-service.sh install --copy ${B} --copies ${COPIES} ${base.join(' ')}`);
+  r=await prun(e,'rollback','acme');assert.equal(r.code,0,r.out+r.err);
+  assert.equal(pointer(e).copy,B);assert.deepEqual(pointer(e).console,base);
+  assert.doesNotMatch(conExec(e),/ --sso( |$)| --send( |$)/);assert.ok(conExec(e).endsWith(` --checkout ${repo} ${base.join(' ')}`),conExec(e));
+  assert.ok(stepText(e).includes('Z drop --send; the run drops --sso\n'),stepText(e));
+  r=await prun(e,'status','acme');assert.equal(r.code,0,r.err);assert.match(r.out,/unit flags: match the pointer/);
+  await noLeak(e);
+ });
+ await t.test('T2 and T4: --send with --no-send, --no-sso with --sso, --send, a pair or --no-proof, and either flag on another verb, is a usage error',async(t)=>{
+  const e=await mk(t);await seedPreview(e);await ssoConfig(e);const f=await proofFile(e);
+  let r=await prun(e,'activate',C1,'acme','--sso','--send');assert.equal(r.code,0,r.out+r.err);
+  const usageText=(await prun(e,'--help')).err,n=calls(e).length,logs=logLines(e).length,before=fp(e);
+  for(const args of [['activate',C1,'acme','--send','--no-send'],['activate',C1,'acme','--no-send','--send','--plan'],['activate',C1,'acme','--sso','--send','--no-send'],
+   ['activate',C1,'acme','--no-sso','--sso'],['activate',C1,'acme','--sso','--no-sso','--plan'],['activate',C1,'acme','--no-sso','--send'],
+   ['activate',C1,'acme','--no-sso',...pair(f)],['activate',C1,'acme','--no-sso','--no-proof'],
+   ['rollback','acme','--send'],['rollback','acme','--no-sso'],['pm-on','acme','--send'],['pm-on','acme','--no-sso'],['status','acme','--no-sso'],['adopt','acme','--send']]){
+   r=await prun(e,...args);assert.equal(r.code,4,args.join(' '));assert.equal(r.out,'');assert.equal(r.err,usageText);
+  }
+  assert.match(usageText,/\[--proof-header NAME --proof-file PATH \| --no-proof \| --sso \| --no-sso\] \[--send \| --no-send\]/);
+  assert.match(usageText,/\n--send needs --sso in the run's Console flags, given or carried\. --no-sso needs --sso in the\n/);
+  assert.deepEqual(fp(e),before);assert.deepEqual(startsStops(e,n),[]);assert.equal(logLines(e).length,logs);
+  await noLeak(e);
+ });
+ await t.test('T3: --no-sso on the same copy returns the unit and the pointer to the flags from before --sso, without --send',async(t)=>{
+  const e=await mk(t),base=await seedPreview(e,undefined,['--send','--tester-port','7333']);await ssoConfig(e);
+  let r=await prun(e,'activate',C1,'acme');assert.equal(r.code,0,r.out+r.err);
+  const pre=conExec(e),want=noSend(base);
+  assert.ok(pre.endsWith(` ${base.join(' ')}`),pre);
+  r=await prun(e,'activate',C1,'acme','--sso');assert.equal(r.code,0,r.out+r.err);
+  const set=setOf(e,pointer(e).activation);
+  assert.deepEqual(pointer(e).console,['--port',e.port,'--business','acme','--sso','--send','--tester-port','7333']);
+  const out=await planOnly(e,0,'activate',C1,'acme','--no-sso');
+  assert.deepEqual([...proofLines(out),...sendLines(out),...ssoLines(out)],['proof: off','send: dropped; --no-sso drops --send (F39)',OFF_PLAN(set,want.slice(0,-2).join(' '))]);
+  assert.ok(out.includes(NOTE(C1)),out.join('\n'));
+  assert.equal(out[out.findIndex((l)=>l.startsWith('sso:'))+1],`Console: scripts/webui-service.sh install --copy ${C1} --copies ${COPIES} ${want.join(' ')}`);
+  r=await prun(e,'activate',C1,'acme','--no-sso');assert.equal(r.code,0,r.out+r.err);
+  const l=logLines(e).at(-1);assert.deepEqual([l.op,l.from,l.to,l.result],['activate',C1,C1,'ok']);
+  assert.equal(pointer(e).copy,C1);assert.deepEqual(pointer(e).console,want);
+  assert.equal(conExec(e),pre.replace(' --send --tester-port 7333',' --tester-port 7333'));
+  const steps=stepText(e);
+  assert.ok(steps.includes('Z drop --send; --no-sso was given\n'),steps);
+  assert.ok(steps.includes(`Z turn off --sso; the Console flags come from ${set}/${SHOW}\n`),steps);
+  r=await prun(e,'status','acme');assert.equal(r.code,0,r.err);assert.match(r.out,/unit flags: match the pointer/);
+  // --sso is off now, so a second --no-sso has nothing to turn off.
+  await refused(e,['activate',C1,'acme','--no-sso'],'sso-not-on',NOT_ON_MSG);
+  await noLeak(e);
+ });
+ await t.test('T3: the set walk passes later re-pins that ran with --sso, and the tester follows the pointer',async(t)=>{
+  const e=await mk(t),base=await seedPreview(e,undefined,['--send','--tester-port','7333']);await ssoConfig(e);
+  // The activation that turns --sso on also moves the tester to 7334, so the set and the pointer differ.
+  let r=await prun(e,'activate',C1,'acme','--sso','--tester-port','7334');assert.equal(r.code,0,r.out+r.err);
+  const set=setOf(e,pointer(e).activation);
+  r=await prun(e,'activate',C1,'acme','--no-send');assert.equal(r.code,0,r.out+r.err);
+  assert.match(readFileSync(join(setOf(e,pointer(e).activation),SHOW),'utf8'),/ --sso /);
+  assert.deepEqual(pointer(e).console,['--port',e.port,'--business','acme','--sso','--tester-port','7334']);
+  const restores=base.slice(0,-3),want=[...restores,'--tester-port','7334'];
+  const out=await planOnly(e,0,'activate',C1,'acme','--no-sso');
+  assert.deepEqual([...sendLines(out),...ssoLines(out)],['send: off; --no-sso was given and the pointer holds no --send',OFF_PLAN(set,restores.join(' '))]);
+  r=await prun(e,'activate',C1,'acme','--no-sso');assert.equal(r.code,0,r.out+r.err);
+  assert.deepEqual(pointer(e).console,want);assert.ok(conExec(e).endsWith(` --checkout ${repo} ${want.join(' ')}`),conExec(e));
+  assert.doesNotMatch(stepText(e),/drop --send/);
+  r=await prun(e,'status','acme');assert.equal(r.code,0,r.err);assert.match(r.out,/unit flags: match the pointer/);
+  await noLeak(e);
+ });
+ await t.test('T3 (sage-2305 a): after --sso, two later re-pins that carry it, then --no-sso restores the flags from before --sso byte for byte',async(t)=>{
+  const e=await mk(t),base=await seedPreview(e,undefined,['--tester-port','7333']);await ssoConfig(e);
+  let r=await prun(e,'activate',C1,'acme');assert.equal(r.code,0,r.out+r.err);
+  const pre=conExec(e);assert.ok(pre.endsWith(` ${base.join(' ')}`),pre);
+  r=await prun(e,'activate',C1,'acme','--sso');assert.equal(r.code,0,r.out+r.err);
+  const set=setOf(e,pointer(e).activation);
+  // Two same-copy re-pins carry --sso, so the two newest sets both hold a Console with it.
+  r=await prun(e,'activate',C1,'acme','--send');assert.equal(r.code,0,r.out+r.err);
+  r=await prun(e,'activate',C1,'acme','--no-send');assert.equal(r.code,0,r.out+r.err);
+  const acts=logLines(e).filter((l)=>l.result==='ok'&&l.op==='activate').map((l)=>l.activation).slice(-2);
+  for(const a of acts)assert.match(readFileSync(join(setOf(e,a),SHOW),'utf8'),/ --sso /);
+  const out=await planOnly(e,0,'activate',C1,'acme','--no-sso');
+  assert.deepEqual(ssoLines(out),[OFF_PLAN(set,base.slice(0,-2).join(' '))]);
+  r=await prun(e,'activate',C1,'acme','--no-sso');assert.equal(r.code,0,r.out+r.err);
+  assert.deepEqual(pointer(e).console,base);assert.equal(conExec(e),pre);
+  r=await prun(e,'status','acme');assert.equal(r.code,0,r.err);assert.match(r.out,/unit flags: match the pointer/);
+  await noLeak(e);
+ });
+ await t.test('T4 (sage-2305 b): a log in which every set holds a Console with --sso refuses before any unit stops',async(t)=>{
+  const e=await mk(t);await seedPreview(e,undefined,['--send']);await ssoConfig(e);
+  let r=await prun(e,'activate',C1,'acme','--sso');assert.equal(r.code,0,r.out+r.err);
+  const first=setOf(e,pointer(e).activation);
+  r=await prun(e,'activate',C1,'acme','--no-send');assert.equal(r.code,0,r.out+r.err);
+  assert.match(readFileSync(join(setOf(e,pointer(e).activation),SHOW),'utf8'),/ --sso /);
+  // The set of the activation that turned --sso on now claims its Console ran with it too, sums intact.
+  setEdit(first,SHOW,' --public-host ',' --sso --public-host ');
+  const why=OFF_MSG(`the Console in ${join(first,SHOW)} already ran with --sso, and the log names no earlier activation`);
+  await refused(e,['activate',C1,'acme','--no-sso'],'sso-off-flags',why);
+  assert.deepEqual((await planOnly(e,3,'activate',C1,'acme','--no-sso')).filter((l)=>l.startsWith('refuses ')),[`refuses sso-off-flags: ${why}`]);
+  await noLeak(e);
+ });
+ await t.test('T4: --no-sso refuses before any stop on a pointer without --sso, a tampered or missing set, a set that ran with --sso, an ok line with no activation, and a log with no set',async(t)=>{
+  const e=await mk(t);await seedPreview(e,undefined,['--send']);
+  await refused(e,['activate',B,'acme','--no-sso'],'sso-not-on',NOT_ON_MSG);
+  await refused(e,['activate',C1,'acme','--no-sso'],'sso-not-on',NOT_ON_MSG);
+  assert.deepEqual((await planOnly(e,3,'activate',C1,'acme','--no-sso')).filter((l)=>l.startsWith('refuses ')),[`refuses sso-not-on: ${NOT_ON_MSG}`]);
+  // One set, from the activation that turned --sso on.
+  await ssoConfig(e);
+  let r=await prun(e,'activate',C1,'acme','--sso');assert.equal(r.code,0,r.out+r.err);
+  const set=setOf(e,pointer(e).activation),show=join(set,SHOW),text=readFileSync(show,'utf8');
+  // An ok line with no activation stops the walk (sage-2315 N1); skipping it would reach the set above.
+  const logText=readFileSync(e.log,'utf8');
+  appendFileSync(e.log,JSON.stringify({at:'2026-10-22T00:00:00Z',op:'activate',from:C1,to:C1,backup:null,activation:null,result:'ok'})+'\n');
+  await refused(e,['activate',C1,'acme','--no-sso'],'sso-off-flags',OFF_MSG('an ok line in the log names no activation'));
+  writeFileSync(e.log,logText);
+  setEdit(set,SHOW,' --allow-user jason',' --allow-user mallory',false);
+  await refused(e,['activate',C1,'acme','--no-sso'],'sso-off-flags',OFF_MSG(`${show} does not match the set's SHA256SUMS`));
+  assert.deepEqual((await planOnly(e,3,'activate',C1,'acme','--no-sso')).filter((l)=>l.startsWith('refuses ')),[`refuses sso-off-flags: ${OFF_MSG(`${show} does not match the set's SHA256SUMS`)}`]);
+  setEdit(set,SHOW,' --allow-user mallory',' --sso --allow-user jason');
+  await refused(e,['activate',C1,'acme','--no-sso'],'sso-off-flags',OFF_MSG(`the Console in ${show} already ran with --sso, and the log names no earlier activation`));
+  setEdit(set,SHOW,' serve ',' ');
+  await refused(e,['activate',C1,'acme','--no-sso'],'sso-off-flags',OFF_MSG(`${show} holds no Console argv this script can read`));
+  rmSync(show);
+  await refused(e,['activate',C1,'acme','--no-sso'],'sso-off-flags',OFF_MSG(`${set} has no ${SHOW} and SHA256SUMS`));
+  writeFileSync(show,text);setEdit(set,SHOW,'\n','\n');
+  r=await prun(e,'activate',C1,'acme','--no-sso');assert.equal(r.code,0,r.out+r.err);
+  assert.doesNotMatch(conExec(e),/ --sso( |$)| --send( |$)/);
+  // A pointer with --sso and only the adopt line: no activation took a set.
+  const g=await mk(t);await seedPreview(g,undefined,['--sso']);
+  await refused(g,['activate',C1,'acme','--no-sso'],'sso-off-flags',OFF_MSG('the log names no activation with a rollback set'));
+  for(const x of [e,g])await noLeak(x);
+ });
+});
+
 // --- rehearse (D2, row 163; the brief's "Stack rehearsal on a scratch root") ---
 // Copies of their own in RCOPIES: the real scripts/mosaic, config loader, business loader, roles and
 // mosaic-config.mjs, with stand-ins for the bus host (cli.mjs), the Console, the Store and
@@ -41,6 +41,6 @@ if [ "${1:-}" = library ] && [ "${2:-}" = survey ]; then
  exec node "$REPO/packages/library/src/survey.mjs" "$@"
 fi
 case "${1:-}" in
-  usage|project|limits|inbox|decide|tasks|agents|trail|talk|stop|launches|bus|plugins|credentials|hosts|name|names|follow|threads|thread) exec node "$REPO/packages/cli/src/cli.mjs" "$@" ;;
+  usage|project|limits|inbox|decide|tasks|agents|trail|talk|stop|launches|bus|plugins|credentials|hosts|name|names|follow|threads|thread|access) exec node "$REPO/packages/cli/src/cli.mjs" "$@" ;;
 esac
 exec node "$REPO/packages/seat/src/cli.mjs" "$@"
@@ -5,6 +5,8 @@
 # Console tester listener flags follow target support (row 176, #1674); so does the row 178 proof
 # pair, which activate sets or drops (row 187, #1685). activate --no-send drops --send (row 189, #1687).
 # activate --sso swaps the preview set and the pair for the Console's own sign-in (row 200, #1698).
+# activate --send turns send on, only beside --sso, and activate --no-sso turns --sso off with the
+# Console flags from before it, dropping --send (row 273, #1778, mos-1246 F39).
 # Design and tests: agents/darkwing/work/queue-162/BUILD.md.
 #
 # Who runs it. Decision 96 (Mos, mos-0716) lets this script stop and start the live units under
@@ -38,14 +40,14 @@ COPIES="${XDG_DATA_HOME:-$HOME/.local/share}/mosaic-stack/copies"
 BIN="$HOME/.npm-global/bin"
 UNIT_DIR="${XDG_CONFIG_HOME:-$HOME/.config}/systemd/user"
 TIMEOUT=60 WANT_PM=0 AFTER_HARNESS=0 MIGRATE=0 PLAN=0 RESTORE="" EVENTS="" TESTER_PORT="" TESTER_SOCKET=0 EXPECTED_INTERPRETER=""
-PROOF_HEADER="" PROOF_FILE="" NO_PROOF=0 NO_SEND=0 SSO=0 R_BACKUP="" R_PORT=""
+PROOF_HEADER="" PROOF_FILE="" NO_PROOF=0 NO_SEND=0 SEND=0 SSO=0 NO_SSO=0 R_BACKUP="" R_PORT=""
 UNITS=user TO_FLAG="" EXPECT_FROM="" SINCE="" ROLLBACK_OLD="" CAUSE=""

 usage() {
    cat >&2 <<'USAGE'
 usage: stack-release.sh adopt BUSINESS
       stack-release.sh activate ID BUSINESS [--pm | --pm-after-harness] [--migrate] [--tester-socket | --tester-port N (legacy copies)]
-           [--proof-header NAME --proof-file PATH | --no-proof | --sso] [--no-send] [--timeout S] [--plan]
+           [--proof-header NAME --proof-file PATH | --no-proof | --sso | --no-sso] [--send | --no-send] [--timeout S] [--plan]
       stack-release.sh pm-on BUSINESS [--timeout S]
       stack-release.sh rollback BUSINESS [--restore ACTIVATION [--events N]] [--timeout S] [--plan]
       stack-release.sh status BUSINESS
@@ -61,7 +63,9 @@ every table in COUNTED.
 --units external (row 232) reads root's system units and starts or stops none. adopt, activate,
 rollback, status, confirm, revert and gate take it; rollback then needs --to ID, the previous copy.
 activate and rollback --plan take --expect-from OLD. --pm, --pm-after-harness, --tester-port, the
-proof flags, --no-proof, --no-send, --sso and pm-on are not for it.
+proof flags, --no-proof, --send, --no-send, --sso, --no-sso and pm-on are not for it.
+--send needs --sso in the run's Console flags, given or carried. --no-sso needs --sso in the
+pointer's, and takes the Console flags from the rollback set of the activation that turned it on.
 USAGE
    exit "${1:-4}"
 }
@@ -128,7 +132,9 @@ parse_opts() {
            --proof-file) [ "$OP" = activate ] && [ $# -ge 2 ] && [ -n "$2" ] || usage; PROOF_FILE="$2"; shift 2 ;;
            --no-proof) [ "$OP" = activate ] || usage; NO_PROOF=1; shift ;;
            --no-send) [ "$OP" = activate ] || usage; NO_SEND=1; shift ;;
+            --send) [ "$OP" = activate ] || usage; SEND=1; shift ;;
            --sso) [ "$OP" = activate ] || usage; SSO=1; shift ;;
+            --no-sso) [ "$OP" = activate ] || usage; NO_SSO=1; shift ;;
            --migrate) [ "$OP" = activate ] || usage; MIGRATE=1; shift ;;
            --restore) [ "$OP" = rollback ] && [ $# -ge 2 ] && [[ "$2" =~ ^[0-9]{8}T[0-9]{6}Z-[0-9a-f]{12}(-[1-9])?$ ]] || usage; RESTORE="$2"; shift 2 ;;
            --backup) [ "$OP" = rehearse ] && [ $# -ge 2 ] && { [ "$2" = last ] || [[ "$2" =~ ^[0-9]{8}T[0-9]{6}Z-[0-9a-f]{12}(-[1-9])?$ ]] || [[ "$2" =~ ^/[A-Za-z0-9/._+-]*$ ]]; } || usage; R_BACKUP="$2"; shift 2 ;;
@@ -150,7 +156,8 @@ parse_opts() {
        [ "$OP" != confirm ] && [ "$OP" != revert ] && [ "$OP" != gate ] && [ -z "$TO_FLAG" ] && [ -z "$EXPECT_FROM" ] || usage
    else
        [ "$OP" != rollback ] || [ -n "$TO_FLAG" ] || usage
-        [ "$TESTER_SOCKET" = 0 ] && [ "$WANT_PM" = 0 ] && [ -z "$TESTER_PORT" ] && [ -z "$PROOF_HEADER" ] && [ -z "$PROOF_FILE" ] && [ "$NO_PROOF" = 0 ] && [ "$NO_SEND" = 0 ] && [ "$SSO" = 0 ] || usage
+        [ "$TESTER_SOCKET" = 0 ] && [ "$WANT_PM" = 0 ] && [ -z "$TESTER_PORT" ] && [ -z "$PROOF_HEADER" ] && [ -z "$PROOF_FILE" ] && [ "$NO_PROOF" = 0 ] && [ "$NO_SEND" = 0 ] && [ "$SSO" = 0 ] &&
+            [ "$SEND" = 0 ] && [ "$NO_SSO" = 0 ] || usage
    fi
    [ "$OP" != gate ] || [ -n "$SINCE" ] || usage
    [ -z "$EXPECT_FROM" ] || [ "$PLAN" = 1 ] || usage
@@ -167,6 +174,10 @@ parse_opts() {
    [ "$NO_PROOF" = 0 ] || [ -z "$PROOF_HEADER" ] || usage
    # --sso drops the pair itself, so it takes neither a pair nor --no-proof (row 200).
    [ "$SSO" = 0 ] || { [ -z "$PROOF_HEADER" ] && [ "$NO_PROOF" = 0 ]; } || usage
+    # Row 273: --send and --no-send contradict. --no-sso takes its Console flags from a rollback set
+    # and drops --send, so it goes with no --sso, --send, pair or --no-proof.
+    [ "$SEND" = 0 ] || [ "$NO_SEND" = 0 ] || usage
+    [ "$NO_SSO" = 0 ] || { [ "$SSO" = 0 ] && [ "$SEND" = 0 ] && [ -z "$PROOF_HEADER" ] && [ "$NO_PROOF" = 0 ]; } || usage
    local d
    for d in "$COPIES" "$BIN"; do
        case "$d" in /*) ;; *) usage ;; esac
@@ -225,7 +236,8 @@ for(const k of open.keys())process.stdout.write(k+"\n");' -- "$LOG"
 # line that made the pointer's copy live, the backup a rollback would restore. `newest` prints the
 # backup field of the newest line that has one, rehearse's --backup last (row 233). `arrival` prints the
 # activation and `from` of the line that moved the stack onto the pointer's copy from another one,
-# past any same-copy re-pin after it (row 200, sage-1389).
+# past any same-copy re-pin after it (row 200, sage-1389). `sets` prints the activation of each
+# activate and rollback, newest first, back to the adopt line, whose run took no rollback set (row 273).
 from_log() {
    [ -f "$LOG" ] || return 1
    node -e '
@@ -234,12 +246,13 @@ const lines=require("fs").readFileSync(file,"utf8").split("\n").filter((l)=>l.tr
 for(const l of lines.reverse()){
  let o;try{o=JSON.parse(l)}catch{continue}
  if(o.result!=="ok"||!["adopt","activate","rollback"].includes(o.op)||!o.to)continue;
+  if(mode==="sets"){if(o.op==="adopt")process.exit(0);process.stdout.write(`${o.activation??""}\n`);continue}
  if(mode==="previous"&&o.to!==current){process.stdout.write(o.to+"\n");process.exit(0)}
  if(mode==="backup"&&o.to===current){if(o.backup)process.stdout.write(o.backup+"\n");process.exit(o.backup?0:1)}
  if(mode==="newest"&&o.backup){process.stdout.write(o.backup+"\n");process.exit(0)}
  if(mode==="arrival"&&o.to===current&&o.from!==current){process.stdout.write(`${o.activation??""} ${o.from??""}\n`);process.exit(0)}
 }
-process.exit(1);' -- "$LOG" "$1" "$P_COPY"
+process.exit(mode==="sets"?0:1);' -- "$LOG" "$1" "$P_COPY"
 }

 # --- Reading the units ---
@@ -323,15 +336,18 @@ in_chain() { local v; for v in "${T_CHAIN[@]}"; do [ "$v" != "$1" ] || return 0;

 # The item 3 checks on the target copy, in order: copy, schema, already-active. An activate that
 # sets a proof pair, drops the pointer's pair with --no-proof, drops the pointer's --send with
-# --no-send, or turns on --sso, may name the pointer's copy: it re-pins the live copy with new
-# Console flags (row 187, Part B's B3 and B-R1; row 189, mos-0972; row 200, the phase 2 window).
+# --no-send, turns on --sso, turns on --send, or turns off --sso may name the pointer's copy: it
+# re-pins the live copy with new Console flags (row 187, Part B's B3 and B-R1; row 189, mos-0972;
+# row 200, the phase 2 window; row 273). --no-sso on a pointer without --sso gets past here and
+# refuses sso-not-on in no_sso_base, which names the reason.
 check_target() {
    copy_exists "$TO" 2>/dev/null || refuse copy-missing "no copy $TO in $COPIES"
    copy_ok "$TO" 2>/dev/null || refuse copy-unreachable "$TO is not reachable from refactor and origin/refactor"
    target_schema "$TO" || refuse copy-schema-unknown "cannot read SCHEMA_VERSION and its chain from $COPIES/$TO/packages/bus/src/store.mjs"
-    [ "$TO" != "$P_COPY" ] || [ -n "$PROOF_HEADER" ] ||
+    [ "$TO" != "$P_COPY" ] || [ -n "$PROOF_HEADER" ] || [ "$NO_SSO" = 1 ] ||
        { [ "$NO_PROOF" = 1 ] && [[ " ${P_CONSOLE[*]} " == *" --proof-header "* ]]; } ||
        { [ "$NO_SEND" = 1 ] && [[ " ${P_CONSOLE[*]} " == *" --send "* ]]; } ||
+        { [ "$SEND" = 1 ] && [[ " ${P_CONSOLE[*]} " != *" --send "* ]]; } ||
        { [ "$SSO" = 1 ] && [[ " ${P_CONSOLE[*]} " != *" --sso "* ]]; } ||
        refuse already-active "$TO is the pointer's copy"
 }
@@ -854,21 +870,17 @@ has_flag() { local f="$1"; shift; [[ " $* " == *" $f "* ]]; }
 # skips sso_checks after a refusal here, so --plan lists that refusal alone.
 sso_base() {
    BASE_CONSOLE=("${P_CONSOLE[@]}") SSO_PLAN="" SSO_STEP="" SSO_NO_TARGET=""
+    if [ "$NO_SSO" = 1 ]; then no_sso_base; return 0; fi
    has_flag --sso "${P_CONSOLE[@]}" || return 0
    [ "$SSO" = 1 ] || SSO_PLAN="sso: carried"
    [ "$OP" = rollback ] && ! sso_supported || return 0
-    local f="show-$CONSOLE_UNIT.txt" argv="" why="" act="" from="" set
+    local f="show-$CONSOLE_UNIT.txt" why="" act="" from="" set
    read -r act from <<< "$(from_log arrival || true)"
    set="$STATE/stack-rollback/$act"
    if [ "$from" != "$TO" ]; then why="the log names no activation that moved the stack from $TO onto $P_COPY"
    elif ! [[ "$act" =~ ^[0-9]{8}T[0-9]{6}Z-[0-9a-f]{12}(-[1-9])?$ ]]; then why="the activation $act that moved the stack onto $P_COPY names no rollback set"
-    elif [ ! -f "$set/$f" ] || [ ! -f "$set/SHA256SUMS" ]; then why="$set has no $f and SHA256SUMS"
-    elif [ "$(sum_of "$set" "$f")" != "$(sha256sum < "$set/$f" | cut -d' ' -f1)" ]; then why="$set/$f does not match the set's SHA256SUMS"
-    else
-        argv="$(argv_of "$(cat "$set/$f")")"
-        if ! unquoted "$argv" || ! serve_flags "$argv"; then why="$set/$f holds no Console argv this script can read"
-        elif has_flag --sso "${SERVE_FLAGS[@]}"; then why="the Console in $set/$f already ran with --sso"
-        fi
+    elif ! set_flags "$set"; then why="$SET_WHY"
+    elif has_flag --sso "${SERVE_FLAGS[@]}"; then why="the Console in $set/$f already ran with --sso"
    fi
    if [ -n "$why" ]; then
        SSO_NO_TARGET=1
@@ -876,7 +888,8 @@ sso_base() {
        return 0
    fi
    # --send and --tester-port follow the pointer, so a --no-send or a tester port set after that
-    # activation stays (row 189's rule that rollback carries --send off).
+    # activation stays (row 189's rule that rollback carries --send off). A --send carried here has
+    # lost its --sso, so send_for_target drops it (row 273, F39 b).
    local i
    BASE_CONSOLE=()
    for ((i = 0; i < ${#SERVE_FLAGS[@]}; i++)); do
@@ -894,10 +907,79 @@ sso_base() {
            --tester-socket) BASE_CONSOLE+=(--tester-socket) ;;
        esac
    done
-    SSO_PLAN="sso: dropped; $TO's Console does not support --sso, so the rollback takes the Console flags from $set/$f, with --send and --tester-port as the pointer has them"
+    SSO_PLAN="sso: dropped; $TO's Console does not support --sso, so the rollback takes the Console flags from $set/$f, with --tester-port as the pointer has it"
    SSO_STEP="drop --sso; $TO's Console does not support it, so the Console flags come from $set/$f"
 }

+# Sets SERVE_FLAGS to the Console flags in rollback set $1's show-$CONSOLE_UNIT.txt, the Console
+# unit as it was before that set's run, checked against the set's SHA256SUMS. Returns 1 with
+# SET_WHY when the file is missing, fails its sum or holds no argv this script can read.
+set_flags() {
+    local set="$1" f="show-$CONSOLE_UNIT.txt" argv
+    SET_WHY=""
+    if [ ! -f "$set/$f" ] || [ ! -f "$set/SHA256SUMS" ]; then SET_WHY="$set has no $f and SHA256SUMS"
+    elif [ "$(sum_of "$set" "$f")" != "$(sha256sum < "$set/$f" | cut -d' ' -f1)" ]; then SET_WHY="$set/$f does not match the set's SHA256SUMS"
+    else
+        argv="$(argv_of "$(cat "$set/$f")")"
+        unquoted "$argv" && serve_flags "$argv" && return 0
+        SET_WHY="$set/$f holds no Console argv this script can read"
+    fi
+    return 1
+}
+
+# Row 273 (#1778, mos-1246 F39 a): activate --no-sso turns --sso off. The Console flags come from the
+# rollback set of the activation that turned --sso on. Each set holds the Console from before its
+# run, so that activation is the newest one whose set holds a Console without --sso: every newer
+# set ran with it. The walk reads the log's activations newest first, back to the adopt line, and
+# refuses at the first set it can't read, since it can't tell whether that set is the one. --send
+# is dropped (F39 a) and the tester follows the pointer. Sets BASE_CONSOLE, SSO_PLAN and SSO_STEP.
+no_sso_base() {
+    local f="show-$CONSOLE_UNIT.txt" why="" act set="" found=0 i restored=""
+    local -a acts=()
+    if ! has_flag --sso "${P_CONSOLE[@]}"; then
+        check_refuse sso-not-on "the pointer's Console flags hold no --sso, so --no-sso has nothing to turn off"
+        return 0
+    fi
+    # An empty entry is an ok line with no activation; skipping it could land on an older set.
+    mapfile -t acts < <(from_log sets || true)
+    for act in "${acts[@]}"; do
+        set="$STATE/stack-rollback/$act"
+        if [ -z "$act" ]; then why="an ok line in the log names no activation"; break; fi
+        if ! [[ "$act" =~ ^[0-9]{8}T[0-9]{6}Z-[0-9a-f]{12}(-[1-9])?$ ]]; then why="the activation $act names no rollback set"; break; fi
+        set_flags "$set" || { why="$SET_WHY"; break; }
+        has_flag --sso "${SERVE_FLAGS[@]}" || { found=1; break; }
+    done
+    if [ -z "$why" ] && [ "$found" = 0 ]; then
+        if [ -z "$set" ]; then why="the log names no activation with a rollback set"
+        else why="the Console in $set/$f already ran with --sso, and the log names no earlier activation"
+        fi
+    fi
+    if [ -n "$why" ]; then
+        SSO_NO_TARGET=1
+        check_refuse sso-off-flags "the Console flags from before --sso cannot be read: $why"
+        return 0
+    fi
+    # A --send in the set stays here: send_for_target is the one place that drops it, so the
+    # restores list leaves it out.
+    BASE_CONSOLE=()
+    for ((i = 0; i < ${#SERVE_FLAGS[@]}; i++)); do
+        case "${SERVE_FLAGS[i]}" in
+            --tester-port) i=$((i + 1)) ;;
+            --tester-socket) ;;
+            *) BASE_CONSOLE+=("${SERVE_FLAGS[i]}")
+               [ "${SERVE_FLAGS[i]}" = --send ] || restored+="${restored:+ }${SERVE_FLAGS[i]}" ;;
+        esac
+    done
+    for ((i = 0; i < ${#P_CONSOLE[@]}; i++)); do
+        case "${P_CONSOLE[i]}" in
+            --tester-port) i=$((i + 1)); BASE_CONSOLE+=(--tester-port "${P_CONSOLE[i]:-}") ;;
+            --tester-socket) BASE_CONSOLE+=(--tester-socket) ;;
+        esac
+    done
+    SSO_PLAN="sso: off; Console flags from $set/$f; restores ${restored:-nothing}"
+    SSO_STEP="turn off --sso; the Console flags come from $set/$f"
+}
+
 # Row 200 (#1698): activate --sso drops the preview set and the proof pair, which serve refuses beside
 # it, and puts --sso where webui-service.sh renders it: after the other flags, before --send and
 # --tester-port. Sets SSO_DROP (the plan's dropped preview flags), PROOF_PLAN and PROOF_STEP.
@@ -1017,14 +1099,53 @@ process.exit(d!==null&&typeof d==="object"&&Object.hasOwn(d,"console")?0:1)' --
 # Row 189 (mos-0972): --no-send drops --send from RUN_CONSOLE, so the unit and the pointer both lose
 # it; without the flag the pointer's --send goes on unchanged. Rollback and pm-on never take it, so
 # they carry the pointer as it is. Sets SEND_PLAN (the plan's send: line) and SEND_STEP.
+# Row 273 (mos-1246 F39): under forward auth any same-uid process can send as the signed-in user
+# through the Console's port, so --send turns send on only when the run's Console flags hold --sso,
+# given or carried. --no-sso drops the pointer's --send, and so does a rollback to a Console without
+# --sso.
 send_for_target() {
    local had=0 i
-    local -a without_send=()
+    local -a without_send=() with_send=()
    for ((i = 0; i < ${#RUN_CONSOLE[@]}; i++)); do
        if [ "${RUN_CONSOLE[i]}" = --send ]; then had=1; else without_send+=("${RUN_CONSOLE[i]}"); fi
    done
    SEND_STEP=""
-    if [ "$NO_SEND" = 1 ]; then
+    if [ "$NO_SSO" = 1 ]; then
+        RUN_CONSOLE=("${without_send[@]}")
+        if has_flag --send "${P_CONSOLE[@]}"; then
+            SEND_PLAN="send: dropped; --no-sso drops --send (F39)"
+            SEND_STEP="drop --send; --no-sso was given"
+        else
+            SEND_PLAN="send: off; --no-sso was given and the pointer holds no --send"
+        fi
+    elif has_flag --sso "${P_CONSOLE[@]}" && ! has_flag --sso "${RUN_CONSOLE[@]}"; then
+        # Row 273 (F39 b): a rollback to a Console without --sso drops it, and --send goes with it.
+        RUN_CONSOLE=("${without_send[@]}")
+        if [ "$had" = 1 ]; then
+            SEND_PLAN="send: dropped; the run drops --sso, and --send needs it (F39)"
+            SEND_STEP="drop --send; the run drops --sso"
+        else
+            SEND_PLAN="send: off"
+        fi
+    elif [ "$SEND" = 1 ]; then
+        if ! has_flag --sso "${RUN_CONSOLE[@]}"; then
+            SEND_PLAN="send: off"
+            check_refuse send-needs-sso "--send needs --sso in the run's Console flags, given or carried; under forward auth any same-uid process could send (F39)"
+            return 0
+        fi
+        if [ "$had" = 1 ]; then
+            SEND_PLAN="send: carried"
+            return 0
+        fi
+        # webui-service.sh renders --send after --sso, before the tester flags.
+        for ((i = 0; i < ${#RUN_CONSOLE[@]}; i++)); do
+            case "${RUN_CONSOLE[i]}" in --tester-port | --tester-socket) break ;; esac
+            with_send+=("${RUN_CONSOLE[i]}")
+        done
+        RUN_CONSOLE=("${with_send[@]}" --send "${RUN_CONSOLE[@]:i}")
+        SEND_PLAN="send: on; --send was given"
+        SEND_STEP="turn on --send; --send was given"
+    elif [ "$NO_SEND" = 1 ]; then
        RUN_CONSOLE=("${without_send[@]}")
        if [ "$had" = 1 ]; then
            SEND_PLAN="send: dropped; --no-send was given"
Author	SHA1	Message	Date
jason.woltje	0bbf0f6d18	row 273: T53 test 6 pins the usage line with --no-sso The usage line gained --no-sso in the proof and sso bracket. T53 test 6 still matched the old bracket and failed the whole run on `978143bf4`.	2026-10-21 22:15:36 -05:00
jason.woltje	95f4bd8fdc	row 273 notes: name the changed T57 item 3 assertion for review (sage-2321)	2026-10-21 22:15:36 -05:00
jason.woltje	d8034c51bc	stack-release: a rollback that drops --sso drops --send; the --no-sso walk refuses an ok line with no activation (row 273, sage-2315) B1: row 200's rollback to a Console without --sso kept the pointer's --send, which F39 b forbids once --send can sit beside --sso. send_for_target drops it whenever the run drops the pointer's --sso, and the plan and steps say so. N1: an ok line with no activation refuses sso-off-flags instead of being skipped.	2026-10-21 22:15:36 -05:00
jason.woltje	b28baf7ee8	stack-release tests: T58 adds sage-2305 cases a and b (row 273) (a) --sso on, then two re-pins that carry it, then --no-sso gives back the arrival's ExecStart byte for byte. (b) every set in the log holds --sso, so --no-sso refuses sso-off-flags before any unit stops.	2026-10-21 22:15:36 -05:00
jason.woltje	3673463182	stack-release: --no-sso drops --send in one place, send_for_target (row 273)	2026-10-21 22:15:36 -05:00
jason.woltje	7991662dc0	stack-release: activate --send and --no-sso (row 273, #1778 ) activate --send turns send on only when the run's Console flags hold --sso, given or carried (F39 b), and puts it after --sso and before the tester flags. activate --no-sso turns --sso off with the Console flags from the set of the activation that turned it on, drops --send (F39 a) and keeps the pointer's tester. Both are usage errors under --units external. T58 covers the brief's T1-T4; the external test covers T5. Design and the set-walk choice: agents/darkwing/work/queue-273/BUILD.md.	2026-10-21 22:15:36 -05:00
jason.woltje	378a76b854	queue: revs 3103-3108 (morgana: rows 205 and 274 claims; darkwing: row 273 claim; sage: row 276 F5 follow-up added and briefed (#1781 , duckworth-0111 C4), row 202 done after `ddfb29af7` (#1700 closed))	2026-10-21 21:17:02 -05:00
jason.woltje	ddfb29af7c	row 202: FED R5, mosaic access list, grant and revoke (#1700 ) Candidate quackerjack/fed-r5-r5 `a74cd9f87` on `c3d88840c`, manifest of 6 paths (CANDIDATE.sha256). Duckworth APPROVE round 5, rev 3026 (#1700 c30184). C1 gate on Sage's slot by Quackerjack on the merge of `a74cd9f87` onto `a849d89b7` (3b86180b9), finished 01:56:24Z: cli suite 771/771, skip 0 (run 2; run 1 red on a too-long gate TMPDIR, harness only), every scripts/test-*.sh rc 0 with Docker up, mutants M1-M13 killed by their named tests. Landed onto `9c9732983` with the candidate's blobs and modes for the 6 paths; c3d88840c..9c9732983 touches none of them.	2026-10-21 21:00:28 -05:00
jason.woltje	9c97329833	docs: brief for the row 253 F5 follow-up, supervised legacy AS_USER calls (duckworth-0111 C4)	2026-10-21 20:58:00 -05:00
jason.woltje	a849d89b73	docs: phase 2 plan, row 273 cases go in stack-release.test.mjs (mos-1247; test-release.sh never calls stack-release.sh)	2026-10-21 20:23:38 -05:00