morgana: row 205a build (sage-2288): trail and replies hide other users' thread messages from owner, reader and tester; hidden answers as unknown; #readable owner-only; design d2 rulings

agents/darkwing/work/queue-273/BUILD.md

@@ -1,113 +0,0 @@
-# Row 273 (#1778): activate --send and --no-sso
-
-Darkwing, 2026-10-22. Brief: `docs/plans/2026-10-22_activate-send-nosso.md` (blob in f0d0b31e9), approved by
-Mos in mos-1246 (F39). Base: origin/refactor 0042f713d. Reviewer: Filbert. Gate owner: Sage.
-
-## What changed
-
-Only `scripts/stack-release.sh` and its two node test files.
-
-- `activate --send` puts `--send` into the run's Console flags after `--sso` and before the tester
-  flags, where webui-service.sh renders it. It refuses `send-needs-sso` unless those flags hold `--sso`,
-  given or carried. The plan line is `send: on; --send was given`, or `send: carried` when the pointer
-  already holds it. `check_target` lets it name the pointer's copy only when the pointer holds no `--send`,
-  so a second `--send` on the same copy refuses `already-active`.
-- `activate --no-sso` refuses `sso-not-on` when the pointer holds no `--sso`. Otherwise it takes the
-  Console flags from a rollback set (below) and keeps the pointer's tester flags. `send_for_target`
-  drops `--send`, whether it came from the set or the pointer. It is the only place that does, so one
-  mutant there (M3) shows the drop is tested. The plan prints `sso: off; Console flags from <set>/<file>; restores <flags>`
-  and a send line, `send: dropped; --no-sso drops --send (F39)` or `send: off; --no-sso was given and the
-  pointer holds no --send`. The steps log gets `drop --send; --no-sso was given` and
-  `turn off --sso; the Console flags come from <set>/<file>`.
-- Usage errors: `--send` with `--no-send`; `--no-sso` with `--sso`, `--send`, a proof pair or
-  `--no-proof`; either flag on any verb but activate; either flag under `--units external`.
-  `--no-sso --no-send` is allowed, since the brief doesn't forbid it and both drop the same flag.
-- The set read that `sso_base` did inline for a rollback to a Console without `--sso` moved into
-  `set_flags`, which both paths call. Its three messages are unchanged, and T57 still pins them.
-- `from_log` has a new mode, `sets`: the activation of each ok activate and rollback line, newest first,
-  stopping at the adopt line, which took no rollback set.
-
-## The consequential choice: which set --no-sso reads
-
-The brief says the flags come from "the rollback set of the activation that turned `--sso` on", and that
-"a set whose Console already ran with `--sso`" refuses. Each set holds the Console unit from before its
-run. So the activation that turned `--sso` on is the newest one whose set holds a Console without
-`--sso`: every activation after it ran with `--sso`, and so did every set it left.
-
-`no_sso_base` walks the log's sets newest first and stops at the first set whose Console has no `--sso`.
-It refuses `sso-off-flags` at the first set it can't read (missing, failing its SHA256SUMS, or with no
-argv the script can parse), since it can't tell whether that set was the one. If every set ran with
-`--sso`, it refuses with `the Console in <set>/<file> already ran with --sso, and the log names no
-earlier activation`. A log with no set at all refuses with `the log names no activation with a rollback
-set`.
-
-The tradeoff: a later same-copy re-pin that carried `--sso` (a `--no-send`, or a re-pin onto a newer
-copy) doesn't break `--no-sso`, which the phase 2 window needs if a re-pin lands between step 5 and a
-rollback. The cost is that "a set that ran with `--sso` refuses" now applies only when no older set
-without `--sso` exists. A tampered set on the walk still refuses, even one newer than the set the walk
-would have used. Filbert, please rule on this reading.
-
-## Filbert's early look: B1 and N1 (sage-2315)
-
-Filbert accepted the walk. Sage ruled both findings into this row.
-
-- B1: row 200's rollback to a copy whose Console has no `--sso` took the flags from the set and kept
-  the pointer's `--send`. From an `--sso --send` pointer, which this row's `--send` can now make, that
-  gave a Console with `--send` and no `--sso`, which F39 b forbids. `send_for_target` now drops `--send`
-  whenever the run drops the pointer's `--sso`, so it is still the one place that drops it. The plan
-  line reads `send: dropped; the run drops --sso, and --send needs it (F39)`, and the steps log gets
-  `drop --send; the run drops --sso`. Row 200's sso line now names only the tester as following the
-  pointer.
-- Changed existing assertion, for the review to approve by name: T57 item 3 (sage-1389), "the
-  plain case", ends with `assert.deepEqual(pointer(g).console,[...noSend(gbase),...pair(f)])`. It
-  used to expect `'--send'` at the end. The case seeds a legacy `--send` pointer, turns `--sso` on
-  (which carries `--send`), then rolls back to B, whose Console has no `--sso`. A carried `--send`
-  that ends without `--sso` breaks F39 b whatever its source, so the old pin asserted the wrong
-  outcome (Sage accepted this in sage-2321). Row 200's two sso plan strings also lose "--send and"
-  (`ROLLBACK_PLAN` and the round 3 named-instance case), since `--send` no longer follows the pointer
-  on that path.
-- N1: the walk skipped an ok line with no activation. Skipping it could land on an older set that
-  isn't the right one, so it now refuses `sso-off-flags` with `an ok line in the log names no
-  activation`. The walk reads the log through `mapfile`. That gives no entry for an empty log, so a
-  log with no set still gets its own message.
-
-## test-release.sh
-
-The window plan says test-release.sh "gets cases for both". The brief lists it only as a file to run
-whole. test-release.sh is release.sh's Docker selftest and doesn't call stack-release.sh, so the cases
-live in the node tests and test-release.sh runs unchanged.
-
-## Tests (T58 in stack-release.test.mjs)
-
-- T1: `--sso --send` from B onto C1 with a tester port: plan, pointer, unit and steps. `--send` beside a
-  carried `--sso` re-pins C1 once; a second `--send` refuses `already-active`; C carries it.
-- T2: `--send` without `--sso` refuses on another copy and on the pointer's copy, also when the pointer
-  carries `--send` alone; `--plan` lists the refusal.
-- T2 (sage-2315 B1): `--sso --send` onto C1, then a rollback to B, whose Console has no `--sso`. The
-  pointer and the unit end with neither flag, and the plan and steps name the drop.
-- T2 and T4 usage: every forbidden pairing and verb, checked against the full usage text.
-- T3: from an `--sso --send` pointer, `--no-sso` on the same copy gives back the pre-`--sso` ExecStart
-  line byte for byte, without `--send`. A second case walks past a `--no-send` re-pin that ran with
-  `--sso` and keeps the pointer's tester port (7334), which differs from the set's (7333). A third
-  (sage-2305 a) turns `--sso` on, then re-pins twice with `--send` and `--no-send`, so the two newest
-  sets both hold `--sso`. `--no-sso` then gives back the arrival's ExecStart line byte for byte.
-- T4 (sage-2305 b): two sets, both edited or written to hold `--sso` with sums intact, refuse
-  `sso-off-flags` through `refused()`.
-- T4: `sso-not-on`; an ok line with no activation; a set that fails its sums, ran with `--sso`, has no
-  argv or is missing; a log with no set. Each runs through `refused()`, so nothing stops and nothing else changes.
-- T5: stack-release-external.test.mjs adds `--send` and `--no-sso` to the row 232 usage list.
-- T55 test 5 and the T57 usage test match the new usage line.
-
-## Mutants
-
-| # | Change | Expected killer |
-|---|---|---|
-| M1 | `set_flags` skips the SHA256SUMS comparison when `--no-sso` is given | T4 tampered set |
-| M2 | `no_sso_base` skips the `sso-not-on` refusal | T4 `sso-not-on` |
-| M3 | the `--no-sso` branch of `send_for_target` keeps `--send` | T3 |
-| M4 | `--send` skips the `send-needs-sso` refusal | T2 |
-| M5 | parse_opts drops the `--send`/`--no-send` rule | T2 and T4 usage |
-| M6 | a rollback to a Console without `--sso` keeps `--send` (B1) | T2 (sage-2315 B1) |
-| M7 | the walk skips an ok line with no activation (N1) | T4 no-activation line |
-
-Runs and results go in the round's notes once Sage clears the slot.

agents/morgana/work/queue-205/BUILD.md

@@ -0,0 +1,63 @@
+# Row 205a (193b1a, #1703): the trail and replies message filter
+
+Design: DESIGN.md d2 in this directory, with rulings in section 7 (sage-2288). Base: refactor 02da6a2ae. No schema
+change. Nothing has run yet: every test run waits for Sage's CLEAR.
+
+## Changes
+
+`packages/bus/src/broker.mjs`:
+- `#hiddenMessage(s, id)`: the message's thread (`message_threads` joined to `threads`) is owned by a `user:`
+  other than `#owner(s)`, and `#readable(s, t)` is false. A message with no thread, or in the business human's
+  or the tester's thread, is never hidden. A reader session owns nothing, so every user thread is hidden from it.
+  The tester reads through its reader view, and `#owner` still gives `tester`.
+- `#readable(s, t)` returns false. Rule 1 (a share in force) can't hold before 193b2's schema 3j, so nobody
+  reads another's thread. 193b2 adds the share rule and rules 2-4 here.
+- `#trail`: a hidden subject returns `[]` before anything is read, exactly as an unknown id does (ruling 3).
+  After the rows are collected, it drops hidden `messages` rows, `deliveries` rows of a hidden message, and
+  `events` rows whose subject is a hidden message. Decisions, decision events, task snapshots, run events and
+  claims stay.
+- `replies`: a hidden id fails `message-not-found`, as an unknown id does. Hidden replies are left out in SQL
+  (`NOT EXISTS` a thread whose owner starts with `user:` and isn't the caller), so the `REPLIES` limit counts
+  only visible rows.
+  - The SQL clause doesn't call `#readable`. That is exact while `#readable` is false. 193b2 must add the share
+    exception to the clause and to `#readable` together.
+
+`packages/bus/tests/message-filter.test.mjs` (new). It writes a `user:alice` thread and its messages
+straight to the store, as R3's `thread.send` and the run's `to: 'user'` reply will write them, because nothing
+makes a user session before R3.
+- `trail` on a hidden id equals `trail` on an unknown id, byte for byte, for the owner, a reader and the tester.
+- `replies` on a hidden id equals `replies` on an unknown id (code and message), for all three.
+- `trail` on a user-thread run's decision shows the decision and the owner's message, and drops the user
+  thread message, its delivery and its event.
+- `replies` with `REPLIES` hidden replies ahead of a visible one returns the visible one.
+- Messages in the business human's and the tester's threads stay visible on both verbs (row 177 control).
+- The governance pin, one assertion per item in the user sentence: inbox entry, claim, task, project file and
+  the closed decision in `decisions {list: 'recent'}` show to the owner. `trail` and `replies` hide the user
+  message, and the decision's trail carries no user body.
+
+## Mutants (each must fail its named test in message-filter.test.mjs)
+
+| Mutant | Edit | Named test |
+|---|---|---|
+| M1 | `#readable` returns true | governance pin: the owner sees decisions, inbox entries, claims, tasks and project files, but not the user messages |
+| M11 | the trail drop loop iterates nothing | trail on a decision keeps the decision and drops the user thread messages, their deliveries and their events |
+| M12 | the replies `NOT EXISTS` clause removed | replies leaves out other users thread messages and still fills a page |
+| M13 | trail fails `message-not-found` for a hidden subject | trail on a hidden message id answers exactly as on an unknown id, for the owner, a reader and the tester |
+| M14 | replies returns `[]` for a hidden id | replies on a hidden message id answers exactly as on an unknown id, for the owner, a reader and the tester |
+
+## Gate
+
+The kit is /mnt/storage/scratch/morgana-r205 (`slot205.sh`, `mutate.py`, `busy.sh`), run as
+`bash busy.sh && CAND=<sha> bash slot205.sh` on Sage's CLEAR. It runs these files whole:
+- message-filter;
+- the bus files that call trail or replies: replies, tester, tester-threads, tester-writes, broker, decisions,
+  decision-close, end-launch and task-read.
+
+Then it runs the bus suite, then M1 and M11-M14, each on its named test and restored after each. It uses umask
+022 and TMPDIR from `mktemp -d /mnt/storage/scratch/tmp/g205XXXX`. It refuses unless HEAD is the candidate
+and the tree is clean, and it stops after two unexpected failures (mos-0823).
+
+Sage's gate adds every `scripts/test-*.sh`. The webui tests that read trail or replies run there.
+
+Static check: `node --check` on broker.mjs and the new test, run from `/`. Both parse. All five mutant anchors
+match exactly once.

agents/morgana/work/queue-205/DESIGN.md

@@ -0,0 +1,173 @@
+# Row 205 (193b1, #1703): viewer verbs, board refusals and the message filter
+
+Owner Morgana, reviewer Duckworth, gate owner Sage (sage-2280). Brief: `docs/plans/2026-10-20_human-users-build.md`,
+"Brief: 193b1, viewer verbs, board refusals and the message filter" (blob a73e1bba0, rev 3088). Design:
+row 193 DESIGN.md r5 (e2d161e2e, Duckworth approved), sections 4.3, 5.4, 5.5, 5.7, 8 and 9. Base: refactor
+02da6a2ae. Draft 2: Sage's rulings (sage-2288) are in section 7. Sections 1-6 are d1 as sent (morgana-0063).
+
+## 1. The dependency gap
+
+The brief chains 193b1 on FED R3, FED R4 and row 196's verifier. Only row 196 exists (7247d80c7). On 02da6a2ae:
+
+- R3 and R4 aren't filed. The FED brief (`docs/plans/2026-10-20_federation-r1-r2-r5.md`:12-13) files R3 "after
+  R1 and row 196" and R4 after R3, R5 and 193a. No `*/fed-r3` branch is on origin.
+- Row 196's `verifyPrincipal` returns the `user` kind, and server.mjs accepts the `user` envelope, but
+  runtime.mjs wires only `authenticateHuman` and `authenticateTester`. The broker has no `bindUser`, no
+  `s.user`, no per-request grant read and no collaborator verb list. FED 3.6 and row R3 own all of these.
+- So nothing makes a user session today, and no thread is owned by `user:<id>` except through a direct
+  store write.
+
+193b1 has two halves that depend on R3 in different ways.
+
+| Item | Needs a user session (R3) | Testable on 02da6a2ae |
+|---|---|---|
+| Viewer verb list (4.3) | yes: it extends R3's collaborator list | no |
+| Per-grant level checks via `covers(..., {level})` | yes: R3's grant read | no |
+| Board reads refused to users (5.5) | yes | no |
+| `trail` and `replies` filter (5.7) | no: it filters owner, reader and tester sessions | yes, with seeded `user:<id>` threads |
+| `#readable` owner-only | no | yes |
+| Governance pin test (owner side) | no: the owner reads decisions, inbox, agents, tasks and `project.file` | yes, with a seeded user-thread run |
+| Mutants 6 (viewer `thread.send`), 10 (user allowed `trail`) | yes | no |
+| Mutants 11, 12 (trail, replies filter removed) | no | yes |
+| Mutants 1, 3 (`#readable` rules 1 and 3 dropped) | see 4 | see 4 |
+
+## 2. Recommendation: split 205 into 205a now and 205b after R3
+
+- **205a, the message filter.** `trail` and `replies` hide messages in other users' threads from the owner,
+  reader sessions and the tester, with `#readable` owner-only. Plus the owner-side governance pin test and
+  mutants 11 and 12. No R3 dependency, no schema change.
+- **205b, viewer verbs and board refusals.** Built on R3's candidate, as Q177 chains a row on its parent's
+  candidate. The viewer list, the level checks, users refused on board reads, the user-session half of the
+  pin test, mutants 6 and 10.
+
+Why split. The filter is the item the boundary orders first: "No user thread goes live before 193b1's
+message filter has landed" (mos-1021 B2, FED R8). Landing it before R3 means R3 and every later row can't
+create a user thread that the owner can read on `trail`. Waiting for R3 holds the filter behind a row that
+isn't filed. The other option, building all of 193b1 against R3's named interface as 193a did with R1,
+doesn't work here: 193a only called R1's exported `covers`, while 193b1 would have to write `bindUser`, the
+grant read and the collaborator list itself, which is R3's scope and owner.
+
+Tradeoff: two rows and two reviews in place of one, and 205b rebases onto R3. The split is a brief change,
+so it's Sage's to rule.
+
+## 3. 205a design
+
+### 3.1 The hidden-message check
+
+One broker method, `#hiddenMessage(s, id)`:
+
+```
+SELECT t.owner FROM message_threads mt JOIN threads t ON t.id = mt.thread
+WHERE mt.message = ? AND t.business = ?
+```
+
+A message is hidden when that owner starts with `user:`, isn't `#owner(s)`, and `#readable(s, t)` is false.
+A message with no thread row, or in a thread owned by the business human or `tester`, is never hidden, so
+row 177's behaviour is unchanged. A reader session has no `#owner`, so every user thread's messages are
+hidden from it.
+
+`#readable(s, t)` in 205a returns false. Before 193b2's schema 3j there is no `thread_shares` table, so rule 1
+(a share in force) can't hold, and the function is false for anyone but the thread's owner (5.7: "b1 hides
+every message in another user's thread"). It is written as its own method so 193b2 adds the share rule and
+rules 2-4 in one place.
+
+### 3.2 `trail`
+
+- If `subject` is a hidden message id, return `[]`. Design 5.7 says `message-not-found`, "as an unknown id
+  does", but `trail` on an unknown id returns `[]` today (it has no not-found check). A different code for a
+  hidden id would confirm the id exists, which is what 5.7 wants to prevent, so I follow its reason over its
+  code. Question 3.
+- After `#trail` collects its rows, drop: `messages` rows that are hidden, `deliveries` rows whose `message`
+  is hidden, and `events` rows whose `subject` is a hidden message id. This covers each way `#trail` reaches
+  a message: by id, by `decision`, and through `task.created` → `human.input` → `body.message`.
+- Decision rows, decision events, task snapshots, run events and role claims stay. 5.7 puts them on the
+  governance side.
+
+### 3.3 `replies`
+
+A hidden `id` fails `message-not-found`, and hidden messages are dropped from the result. The `LIMIT`
+applies before the filter today; the filter moves into the SQL (`AND NOT EXISTS` a thread owned by another
+`user:`) so a page of hidden replies doesn't return short. For 205a that SQL form is exact because
+`#readable` is false; 193b2 adds the share exception to the same clause.
+
+### 3.4 Tests (packages/bus/tests/message-filter.test.mjs, new)
+
+Fixtures seed a project, a thread owned by `user:alice` with messages in `message_threads`, a delivery and an
+event on one of them, and a decision raised by that thread's run that cites the message. Sessions: the
+business human, a reader session and the tester.
+
+- `trail` on a hidden message id: `[]` for all three sessions, the same as an unknown id.
+- `trail` on the decision: the decision row and its events show; the user's message, its delivery and its
+  events don't.
+- `trail` on a human-owned thread's message: unchanged (row 177 control).
+- `replies` on a hidden id: `message-not-found`. `replies` on a visible id with hidden and visible replies:
+  only the visible ones, and a full page when hidden replies come first.
+- Governance pin, owner side: for the user-thread run, `decisions {list: 'recent'}`, `inbox`, `agents`,
+  `tasks` and `project.file` each show its item, and `trail` and `replies` hide the user's message body.
+  Each item in the user sentence is one named assertion.
+
+### 3.5 Mutants
+
+| Mutant | Edit | Named test |
+|---|---|---|
+| 11 | the `trail` filter removed | trail on the decision hides the user's message, delivery and events |
+| 12 | the `replies` filter removed | replies hides other users' thread messages |
+| 11b | the hidden-subject early return removed | trail on a hidden message id returns [] |
+| 1 | `#readable` returns true | governance pin: trail and replies hide the user body |
+
+## 4. Mutants 1 and 3
+
+Design section 8 lists mutants 1 (rule 1 dropped) and 3 (rule 3 dropped) for b1. With no shares table,
+rule 1 is always false, so `#readable` is false whatever rules 2-4 say. Dropping rule 3 changes nothing a
+test can see until 193b2 adds shares, and rules 2 and 3 need R3's grant read. So:
+
+- Mutant 1 in 205a is "`#readable` returns true", killed by the pin test above.
+- Mutant 3 moves to 193b2, where rule 1 can hold and rule 3 decides.
+
+This is a second brief change for Sage to rule on.
+
+## 5. Gate (Sage's slot, on CLEAR only)
+
+The brief's gate: Duckworth approves the manifest; the bus suite and every `scripts/test-*.sh` green on
+Sage's gate; the mutants killed. The new test file whole, the touched existing files whole, then the bus
+suite, then each mutant on its named test with a restore check. umask 022, TMPDIR from
+`mktemp -d /mnt/storage/scratch/tmp/gXXXXXX`. No test touches the live data root, config, units, slot
+files, any live access.json or `~/.mosaic`.
+
+## 6. Questions for Sage
+
+1. Split 205 into 205a (filter, now) and 205b (viewer verbs and board refusals, after R3's candidate)?
+2. Mutant 1 as "`#readable` returns true" in 205a, and mutant 3 moved to 193b2?
+3. A hidden `trail` subject returns `[]`, the same as an unknown id, in place of 5.7's `message-not-found`
+   (3.2)? `replies` already fails `message-not-found` on an unknown id, so there the code stays.
+
+## 7. Rulings (sage-2288, re morgana-0063)
+
+1. **Split approved.** 205a is built now: the 5.7 `trail` and `replies` filter over owner, reader and tester
+   sessions, `#readable` owner-only, the owner-side governance pin test, and mutants 11 and 12. 205b comes
+   after R3's candidate and R4: viewer verbs, `covers` level checks, board reads refused to users, the
+   user-side pin, and mutants 6 and 10. 205a's base is origin/refactor 02da6a2ae or later. R3 builds on
+   205a's candidate and extends the filter to user sessions, so the filter isn't written twice.
+2. **Mutant 1** in 205a is "`#readable` returns true", killed by the pin test. **Mutant 3** moves to 193b2
+   (row 206). Sage changes the brief to match.
+3. **Hidden equals unknown.** A hidden `trail` subject returns `[]`, exactly as an unknown id does. `replies`
+   keeps `message-not-found` for both. The point of 5.7 is that a caller can't tell hidden from unknown.
+   So 205a adds:
+   - one test per verb comparing the hidden response with the unknown-id response byte for byte
+     (`JSON.stringify` of the result, or of the error's code and message), for each of the three sessions;
+   - a mutant M13 that makes the hidden path distinguishable: `trail` fails `message-not-found` for a
+     hidden subject. The `trail` equality test must kill it. M14 does the same for `replies`: a hidden id
+     returns `[]` instead of failing. The `replies` equality test must kill it.
+
+### 7.1 205a mutant table (replaces 3.5)
+
+| Mutant | Edit | Named test |
+|---|---|---|
+| M1 (design 1) | `#readable` returns true | governance pin: the owner sees decisions, inbox entries, claims, tasks and project files, but not the user's messages |
+| M11 (design 11) | the `trail` filter of hidden rows removed | trail on the decision hides the user's message, its delivery and its events |
+| M12 (design 12) | the `replies` filter removed | replies drops other users' thread messages and still fills a page |
+| M13 | `trail` fails `message-not-found` for a hidden subject | trail on a hidden id answers exactly as on an unknown id |
+| M14 | `replies` returns `[]` for a hidden id | replies on a hidden id answers exactly as on an unknown id |
+
+Queue: Sage re-pins 205 to the split brief and adds 205b and the R3 row at the next gap. I claim after
+that. No run before Sage's CLEAR.

docs/plans/2026-10-20_human-users-build.md

@@ -12,7 +12,7 @@ Single test files run freely, and suites and mutant batches need Sage's slot.
 
 Boundaries for every row: no change to `~/.mosaic-dev`, `~/.config/mosaic-dev`, the live units, slot files, any
 live access.json or `~/.mosaic`. No request to the live Console, mosaic.woltje.com or auth.diversecanvas.com.
-No user thread goes live before 193b1a's message filter has landed (mos-1021 B2, FED R8).
+No user thread goes live before 193b1's message filter has landed (mos-1021 B2, FED R8).
 
 The owner-visible records are fixed by Mos (mos-1023 item 2) and named in one user sentence, which FED R6
 reuses word for word: "The business owner sees your thread's agent's decisions, inbox entries, claims, tasks
@@ -34,39 +34,20 @@ gate, and the mutants are killed.
 
 ## Brief: 193b1, viewer verbs, board refusals and the message filter
 
-Split on 2026-10-22 (sage-2288, after morgana-0063) into 193b1a and 193b1b below. The text that stood here
-chained the whole row on FED R3 and R4, which weren't filed. Only the viewer half needs them.
-
-## Brief: 193b1a, the message filter
-
-Chained on row 196's verifier (done). The bus gets the section 5.7 `trail` and `replies` filter over owner,
-reader and tester sessions, with `#readable` owner-only. No schema change. A hidden `trail` subject returns
-`[]`, exactly as an unknown id does, and `replies` returns `message-not-found` for both. One test per verb
-compares the hidden response with the unknown-id response byte for byte. The owner-side governance pin test
-names each item in the user sentence above. Bus tests and mutants 11 and 12 from section 8, plus mutant 1
-as "`#readable` returns true" (the pin test kills it) and a mutant that makes a hidden subject
-distinguishable from an unknown id. FED R3 builds on this row's candidate and extends the filter to user
-sessions.
-
-Gate: Duckworth approves the manifest. The bus suite and every `scripts/test-*.sh` are green on Sage's gate,
-and the mutants are killed.
-
-## Brief: 193b1b, viewer verbs and board refusals
-
-Chained on 193b1a, FED R3 and FED R4. The bus gets the viewer verb list, per-grant `covers` level checks,
-board reads refused to users, and the user-side governance pin test. Bus tests and mutants 6 and 10 from
-section 8.
+Chained on FED R3, FED R4 and row 196's verifier. The bus gets the viewer verb list, per-grant level
+checks, board reads refused to users, and the section 5.7 `trail` and `replies` filter with `#readable`
+owner-only. No schema change. The governance pin test names each item in the user sentence above. Bus tests
+and mutants 1, 3, 6, 10, 11 and 12 from section 8.
 
 Gate: Duckworth approves the manifest. The bus suite and every `scripts/test-*.sh` are green on Sage's gate,
 and the mutants are killed.
 
 ## Brief: 193b2, thread shares (schema 3l)
 
-Chained on 193b1a and 193b1b. `thread_shares`, the share verbs, the share rules of `#readable` and `#threadRead`, and the
+Chained on 193b1. `thread_shares`, the share verbs, the share rules of `#readable` and `#threadRead`, and the
 section 5.5 share filters. Schema 3k to 3l (Sage, 2026-10-20: machine grant row a owns 3i to 3j and
 the #436b build owns 3j to 3k, so this row builds on #436b's landing). The table is append-only, and row 181's restore guard and
-`COUNTED` include it. Bus tests for shares and the migration, and mutants 2, 4, 7, 8 and 9 from section 8,
-plus mutant 3 (rule 3 dropped), moved here from 193b1 because only shares can kill it (sage-2288).
+`COUNTED` include it. Bus tests for shares and the migration, and mutants 2, 4, 7, 8 and 9 from section 8.
 Going live needs a `--migrate` window with Jason. Sage takes it to Mos when this row is near.
 
 Gate: Duckworth approves the manifest. The bus suite, the cli suite and every `scripts/test-*.sh` are green on

docs/plans/2026-10-22_activate-send-nosso.md

@@ -1,54 +0,0 @@
-# Row: stack-release.sh activate --send and --no-sso, for the Q175 phase 2 window
-
-Sage, 2026-10-22, for Mos's go mos-1246 (re sage-2285). Gitea #385, Vikunja #412. The window plan is
-`docs/plans/2026-10-22_sso-phase2-window.md` (draft 2, 92be0db02).
-
-## Brief: activate --send and --no-sso
-
-Owner Darkwing. Reviewer Filbert (not Sage or Darkwing, mos-1246 item 1). Gate owner Sage. Base: origin/refactor
-at this brief's commit. It lands and is re-pinned before the phase 2 window. That re-pin is Q173 work on Mos's
-go, run by Jason or Mos. If the target copy's schema differs from 3j and needs `--migrate`, it waits for Jason.
-
-Why: at 02da6a2ae, `scripts/stack-release.sh activate` has `--no-send` but no `--send`, and nothing turns
-`--sso` off. Without `--sso`, `sso_base` carries it from the pointer, and `check_target` refuses the
-pointer's copy as `already-active`. So the window can't turn send on with `--sso` (mos-1195), and its
-same-copy rollback (mos-1245 R1) can't run.
-
-Send and forward auth (mos-1246 F39): send went off on 10-20 (mos-0972) because, under forward auth, any
-same-uid process can send as Jason through 127.0.0.1:7332. So send goes only with `--sso`.
-
-What to build, in `scripts/stack-release.sh` only:
-1. `activate --send` puts `--send` into RUN_CONSOLE where `webui-service.sh` renders it. It refuses unless
-   the run's Console flags hold `--sso`, given or carried. With `--no-send` it is a usage error. The plan's
-   send line reads `send: on; --send was given`, or `send: carried` when the pointer already holds it.
-   `check_target` lets `--send` name the pointer's copy when the pointer holds no `--send`.
-2. `activate --no-sso` is allowed only when the pointer's Console flags hold `--sso`. Otherwise it refuses
-   with a named reason. It takes the Console flags from the rollback set of the activation that turned
-   `--sso` on (that set's `show-$CONSOLE_UNIT.txt`, checked against its SHA256SUMS), the way `sso_base`
-   already does for a rollback to a copy without `--sso`. It drops `--send`, and its plan line says so
-   (F39 a). The tester follows the pointer. A set it can't read, or a set whose Console already ran with
-   `--sso`, refuses before anything stops. `check_target` lets `--no-sso` name the pointer's copy. With
-   `--sso`, `--send`, a proof pair or `--no-proof`, it is a usage error. The plan prints
-   `sso: off; Console flags from <set>/<file>` and lists every flag it restores.
-3. Both flags are refused under `--units external`, like the other unit-render flags (row 232).
-4. The usage text and the header comment name both flags. No other behavior changes.
-
-Tests, whole files on Sage's slot: `packages/cli/tests/stack-release.test.mjs`,
-`packages/cli/tests/stack-release-external.test.mjs` for item 3, and `scripts/test-release.sh`.
-- T1: `--sso --send` on a pointer without send. The plan shows `send: on`, and the unit and the pointer
-  gain `--send`.
-- T2: `--send` without `--sso`, given or carried, refuses (F39 b). `--send --no-send` is a usage error.
-  `--send` on the same copy when the pointer already has send refuses as `already-active`.
-- T3: from an `--sso --send` pointer, `--no-sso` on the same copy returns the unit and the pointer to the
-  pre-`--sso` flags byte for byte, with no `--send` (F39 a and c). The tester stays as the pointer had it.
-- T4: `--no-sso` refusals, each before any unit stops: a pointer without `--sso`; a tampered set
-  (SHA256SUMS mismatch); a set whose Console ran with `--sso`; `--no-sso` combined with `--sso`, `--send`
-  or a proof flag.
-- T5: `--units external` refuses both flags.
-
-Mutants, each killed: drop the SHA256SUMS check in the `--no-sso` path; let `--no-sso` run with no `--sso`
-in the pointer; let `--no-sso` keep `--send`; let `--send` run without `--sso`; let `--send` and
-`--no-send` combine.
-
-Gate: Filbert approves the manifest. The two touched test files run whole plus test-release.sh, and the
-mutants are killed. No live activation in this row. The window uses it.

docs/plans/2026-10-22_federation-r3.md

@@ -1,39 +0,0 @@
-# Federation build row R3, the broker user principal (#414)
-
-Sage, 2026-10-22. The design is Gizmoduck's `agents/gizmoduck/work/federation/DESIGN.md` at b93f098f0 on
-`gizmoduck/federation-design` (r4.11, sha256 1bcee8df0a3a8628a6646535b756c936ca6d9e7bcfa7e1dd2bf1d3f01715c8e6).
-Sections 3.5, 3.6 and 7 set R3's scope and test gate. Vikunja P19 #414. R3's parents, R1 (row 201) and row 196,
-have landed. I owed this filing when they did and missed it (morgana-0063). Row 205 (193b1a) and 193b1b wait
-on it.
-
-## Brief: FED R3, the broker user principal
-
-Owner Morgana, after 193b1a's candidate goes to review. Reviewer Dewey (section 7: Filbert or Dewey). Gate
-owner Sage. Base: 193b1a's candidate (row 205), so R3 extends that row's `trail` and `replies` filter to user
-sessions instead of re-cutting it. If 193b1a changes in review, R3 rebases onto a new branch name.
-
-What to build, in `packages/bus/src/` (broker.mjs and a new `user-cli.mjs`) plus `packages/harness/src/runner.mjs`
-for the header line:
-1. The user proof: a path-bound `packages/bus/src/user-cli.mjs` with its own nonce variable
-   (`MOSAIC_BUS_USER_NONCE`), checked with the `user` kind of row 196's `verifyPrincipal` (section 3.6 checks
-   1-3). R3 consumes that kind. It doesn't re-implement the parent walk.
-2. `bindUser({ business, user })` and the broker changes 1-7 in section 3.6, including the reply path (B6),
-   `#userThread`, `user-thread-human`, `#waiting` returning null for `to: 'user'`, and the runner header line
-   for `from_role` `user`, word for word.
-3. The collaborator verb list from section 3.5, exact, with its filters. Every other verb fails
-   `access-refused` before its own checks. The grant is read per request through R1's loader and `covers`
-   with `level: 'collaborator'`.
-4. The section 3.6 item 5 audit: every `s.human` and `s.tester` branch in broker.mjs, listed in the packet as
-   user refused, user treated as human, or not reachable for a user.
-5. No revocation timer, `access.reload` or launcher change. Those are R4. No Console change. That is R6.
-
-Tests, in `packages/bus/tests/` and the runner's tests: the R3 test gate in section 7, item by item. Mutants:
-the five in section 7's R3 row, plus one that drops the 193b1a filter for user sessions (a user's `trail` of
-a hidden subject differs from an unknown id's). The agent-parent, non-Console-parent and kind-confusion
-mutants are row 196's and stay there.
-
-Boundaries: no change to `~/.mosaic-dev`, `~/.config/mosaic-dev`, the live units or any live access.json. Tests
-use scratch roots. Single test files run freely, and suites need Sage's slot.
-
-Gate: Dewey approves the manifest. The bus and harness suites and every `scripts/test-*.sh` are green on
-Sage's gate, and the mutants are killed.

docs/plans/2026-10-22_sso-phase2-window.md

@@ -1,45 +1,24 @@
 # Plan: Q175 phase 2 window, the live Console switches to --sso
 
-Sage, 2026-10-22. Draft 2 for Mos, after mos-1245. Sources: `agents/sage/work/q175-sso/DESIGN.md` sections 5
-and 10 (phase 2 order, rollback, Jason-gated steps), Mos's C1 condition (mos-0977, b416d2ede), Jason's phase 2
-answers (Q209, mos-1216, mos-1217), mos-1195, mos-1197 and mos-1245. Rows 192 (phase 1), 200 (`activate --sso`)
-and its N1 follow-up have landed. Vikunja #412, Gitea #385.
-
-## Blocked on a tool gap
-
-Two steps need `scripts/stack-release.sh` flags that don't exist at 02da6a2ae:
-
-- `activate` has `--no-send` but no `--send`. The live pointer holds no `--send`: the 10-20 19:29:56Z
-  re-pin of 490e2771d gave `--no-send`, and every activation since has carried it off. So step 5 can't turn
-  `--send` on (mos-1195).
-- `activate` has no way to turn `--sso` off. Without `--sso`, `sso_base` carries it from the pointer
-  (`sso: carried`), and `check_target` refuses the pointer's own copy as `already-active`. The pre-window
-  flags (`--public-host`, `--auth-header`, `--allow-user`) have no activate option either. So R1's
-  same-copy rollback can't run.
-
-The fix is one small row, approved in mos-1246: `activate --send` and `activate --no-sso`. `--no-sso`
-takes the Console flags from the rollback set of the activation that turned `--sso` on, the way `sso_base`
-already does for a rollback to a copy without `--sso`. It drops `--send`, and its plan line says so. `--send`
-refuses unless the run's Console flags hold `--sso`, given or carried (F39). test-release.sh gets cases for
-both. Darkwing builds it, and a seat other than Sage and Darkwing reviews it. Brief:
-`docs/plans/2026-10-22_activate-send-nosso.md`. It lands and is re-pinned before the window, on Mos's go,
-run by Jason or Mos. The steps below assume it, and draft 3 names the new copy.
+Sage, 2026-10-22. Draft 1 for Mos. Sources: `agents/sage/work/q175-sso/DESIGN.md` sections 5 and 10
+(phase 2 order, rollback, Jason-gated steps), Mos's C1 condition (mos-0977, b416d2ede), Jason's phase 2
+answers (Q209, mos-1216, mos-1217), mos-1195 and mos-1197. Rows 192 (phase 1), 200 (`activate --sso`) and
+its N1 follow-up have landed. Vikunja #412, Gitea #385.
 
 ## When
 
-Only when Jason starts the window (mos-1197). Nothing below runs before his start. The 10-24 re-pin
-condition is met: W12 passed on 7247d80c7 at 22:27:13Z (mos-1245). This plan names 7247d80c7, which already
-carries phase 1, so its loader accepts a config with or without `console`. If another re-pin lands before
-Jason starts, the plan names the copy live at that point, and step 3 runs against it.
+After the 10-24 re-pin is verified, and only when Jason starts the window (mos-1197). Nothing below runs
+before his start. The copy pinned at 10-24 already carries phase 1, so its loader accepts a config with or
+without `console`.
 
 ## Who
 
 - Sage or Darkwing runs the agent steps under Q173: backup first, STATE report after.
-- Mos or Jason starts and restarts the Console (decision 102).
+- Mos or Jason starts and restarts the Console.
 - Jason signs in, sends and signs out.
-- Config writes 1 and 2 (steps 4 and 8) are an agent's, `console` key only, each with a backup first and
-  a validate after. Mos's message to Jason at the window start names them. If Jason says he'll write them
-  himself, steps 4 and 8 become his and nothing else changes (mos-1245 (a)).
+- The config.json writes are Jason's or, on his window start, an agent's for the `console` key only
+  (design section 10 step 4). config.json is user-authored, so Q173 doesn't cover these writes. Jason's go
+  has to name them, and the window doesn't start without it.
 
 ## Values
 
@@ -57,35 +36,31 @@ Jason starts, the plan names the copy live at that point, and step 3 runs agains
 ## Steps
 
 1. Backups: the bus store, the release pointer, the Console unit and config.json, each copied 0600 into
-   a new dated directory, with sha256 recorded. The pointer backup records the pre-window Console flags
-   the rollback restores.
+   a new dated directory, with sha256 recorded.
 2. Slot shape check (A6), without printing or copying the value: `stat` shows mode 0600 and the owner;
    `wc -l` is 1; `tr -cd '\r' <slot | wc -c` is 0; the last byte is a newline (`tail -c1 | od -An -c`).
 3. Straggler check (C1): list every running process, unit and timer that reads config.json, with the
    copy it runs from (`/proc/<pid>/exe` and cwd links, `systemctl --user list-units`, `list-timers`). Each one
-   must run from 7247d80c7, or be shown never to re-read config. Step 4 waits until the list is clean.
-4. Config write 1 (agent, backup from step 1): add `console.sso` with the values above and one subject
+   must run from the 10-24 copy, or be shown never to re-read config. Step 4 waits until the list is clean.
+4. Config write 1 (backup from step 1): add `console.sso` with the values above and one subject
    `{ "sub": "pending-first-sign-in", "name": "jason.woltje" }`. `scripts/mosaic-config.mjs validate`
    reads it back before anything starts.
-5. First `scripts/stack-release.sh activate 7247d80c7 mosaic-stack --sso --send --plan`. Its from line must
-   name 7247d80c7 (`--expect-from` is for `--units external` only, so the live user units refuse it as a
-   usage error). Then the same command without `--plan`, the same way earlier re-pins handled the
-   Console. The tester stays the private socket from row 196 (`--tester-socket`). The `--plan` output
-   names every flag it drops (`--public-host`, `--auth-header`, `--allow-user`) and every flag it carries.
-   The run stops if `--sso` or `--send` is missing or a forward-auth flag remains. Mos or Jason starts the
-   Console. No agent starts it.
+5. First `scripts/stack-release.sh activate <10-24 copy> mosaic-stack --sso --plan --expect-from <10-24 copy>`.
+   Then the same command without `--plan`, the same way earlier re-pins handled the Console. `--send`
+   carries over from the pointer, since nothing passes `--no-send` (mos-1195). The tester is the private
+   socket from row 196 (`--tester-socket`), not design section 5's `--tester-port 7333`. The `--plan` output
+   names every flag it drops (`--auth-header`, `--allow-user`, any proof pair) and every flag it carries. The
+   run stops if `--sso` or `--send` is missing or a forward-auth flag remains. Mos or Jason starts the Console
+   (decision 102). No agent starts it.
 6. The start line shows one provider, the issuer and `subjects 1`. No secret value, no sub.
-7. Jason's first sign-in (A8). It refuses `subject-unknown`. An agent reads `sub=` from that one log line,
-   checks that `iss=` is the issuer above, and records that the refused sub is not the placeholder. The sub
-   goes into the window record, not into any message.
-8. Config write 2 (agent, new backup first): replace the placeholder with Jason's sub, so the list holds
-   that one subject only. Validate. Mos or Jason restarts the Console. The start line shows `subjects 1`.
+7. Jason's first sign-in (A8). It refuses `subject-unknown`. An agent reads `sub=` from that one log line
+   and checks that `iss=` is the issuer above. The sub goes into the window record, not into any message.
+8. Config write 2 (new backup first): replace the placeholder with Jason's sub, so the list holds that one
+   subject only. Validate. Mos or Jason restarts the Console. The start line shows `subjects 1`.
 9. Jason signs in, sends one message and signs out.
-10. Unsigned write refused (mos-1195), within Q173 (mos-1245 (c)): an agent acts as an anonymous client,
-    not as Jason. It POSTs one Console write to `127.0.0.1:7332` with no cookie and no auth header, and
-    the body names a tester-owned thread, so a wrong 2xx reaches no live seat. It expects 401
-    `sign-in required` with the bus event count unchanged, and it writes nothing else. No agent sends
-    `X-authentik-username` to the live Console (design section 8).
+10. Unsigned write refused (mos-1195): an agent POSTs one Console write to `127.0.0.1:7332` with no cookie
+    and no auth header. Expect 401 `sign-in required`, and the bus event count stays unchanged. No agent
+    sends `X-authentik-username` to the live Console (design section 8).
 11. Forged header refused: on a scratch Console from the same copy (`serve --sso --port <scratch>`,
     `MOSAIC_CONFIG` at a scratch config with a scratch dataRoot and a dummy slot, issuer an unreachable
     loopback host, no `--send` and no tester), a request with `X-authentik-username` and no cookie
@@ -100,22 +75,19 @@ Jason starts, the plan names the copy live at that point, and step 3 runs agains
 ## Stops
 
 - Any refusal in steps 2-6 or 8: stop, keep the backups, and roll back as below. Never edit around it.
-- While the placeholder is the only subject, any sign-in that creates a session is a stop and a
-  rollback (mos-1245 (b)).
-- Step 10: any result other than 401 with the event count unchanged is a stop, and it goes to Mos.
 - Two failures in the window: stop and report to Mos (mos-0823).
 
 ## Rollback
 
-1. Same-copy re-activate (mos-1245 R1): `scripts/stack-release.sh activate 7247d80c7 mosaic-stack --no-sso
-   --plan`, then the same without `--plan`. R1 asked for `--expect-from 7247d80c7`, but `--expect-from` is
-   for `--units external` only and the live units are user units, so the plan's from line must name
-   7247d80c7 instead. The `--plan` output must show the pre-window Console flags from the step 1 pointer backup: `--port 7332 --public-host
-   mosaic.woltje.com --auth-header X-authentik-username --allow-user jason.woltje --tester-socket`, exactly.
-   `--no-sso` drops `--send` (mos-1246 F39), so there's no `--send`. A plan that differs is a stop. Mos or Jason restarts the Console.
-2. Restore config.json from the step 1 backup, which removes `console`. 7247d80c7 loads config with or
-   without the key, so the order of 1 and 2 doesn't matter on this copy.
-3. STATE after the rollback reads config.json, the unit's Console flags and the pointer.
-4. Last resort only, and it waits for Jason: `scripts/stack-release.sh rollback` goes to the previous
-   distinct copy, 4429a104f at schema 3i. The store has been at 3j since 21:59Z on 10-21, so that rollback
-   needs `--restore`, and any events after the backup make it Jason's call (header condition 3).
+1. Restore config.json from the latest backup, which removes `console` (or holds the placeholder state).
+2. Then roll the pointer back with `scripts/stack-release.sh rollback` (previous distinct copy). An older
+   loader refuses a config that holds the key, so rolling back in the other order stops the bus and seats.
+3. STATE after a rollback reads config.json and confirms the key is absent when the target copy predates
+   phase 1.
+
+## Open for Mos
+
+- Does Jason's window start cover both config writes (steps 4 and 8) by an agent, or does he write them?
+- Does the placeholder sub in step 4 work for Mos? The only alternative is Jason giving his sub before
+  the window, and A8 chose the log line instead.
+- Under step 10, is a loopback POST with no cookie to the live Console within Q173?

docs/plans/QUEUE.md

@@ -33,7 +33,7 @@ Gaps found while working go to `docs/plans/DEFERRED.md`, not here.
 
 <!-- mosaic-queue:begin -->
 
-Generated from `docs/plans/queue.json` revision 3102 by `queue render`. Do not edit between the markers; change the queue with `scripts/mosaic queue`.
+Generated from `docs/plans/queue.json` revision 3091 by `queue render`. Do not edit between the markers; change the queue with `scripts/mosaic queue`.
 
 | # | Piece | Owner | Issues | State | After | Gate | Brief | Note |
 |---|---|---|---|---|---|---|---|---|
@@ -241,8 +241,8 @@ Generated from `docs/plans/queue.json` revision 3102 by `queue render`. Do not e
 | 202 | FED R5: mosaic access list, grant and revoke (#414) | quackerjack; reviewers duckworth | #1700 | in-review, round 2, request posted | — | Duckworth approves the manifest; cli suite and every scripts/test-*.sh green on Sage's gate; the mutants killed (sage) | `docs/plans/2026-10-20_federation-r1-r2-r5.md` § Brief: FED R5, mosaic access list, grant and revoke | Chained on row 201's candidate (Q177), not its done: claimable now, lands after 201 and rebases onto its landing (Sage) |
 | 203 | FED R2: the federation key in the system config (#414) | quackerjack; reviewers webby | #1701 | briefed | — | Webby approves the manifest; cli suite and every scripts/test-*.sh green on Sage's gate; the mutants killed (sage) | `docs/plans/2026-10-20_federation-r1-r2-r5.md` § Brief: FED R2, the federation key in the system config | Chained on row 192's candidate (Q177): starts on 192's candidate, lands after 192 (Sage) |
 | 204 | 193a: access level check widened to viewer (#1691) | morgana; reviewers duckworth | #1702 | done | — | Duckworth approves the manifest; business suite and every scripts/test-*.sh green on Sage's gate; the mutants killed (sage) | `docs/plans/2026-10-20_human-users-build.md` § Brief: 193a, the access level check widened to viewer | Landed d0bbc5c1c on refactor (base c9f374284). Patch-id 92c18aea matches git diff 44e36fc4c..f869fd062 on the 3 manifest paths. Manifest d38de8c9, Duckworth approve 29595. Gate 2789/0 on 4385b9ec1, mutants 7/7. Unpushed. |
-| 205 | 193b1a: the message filter (#1703; FED R3 and 193b1b build on it) | morgana; reviewers duckworth | #1703 | briefed | 196 done | Duckworth approves the manifest; bus suite and every scripts/test-*.sh green on Sage's gate; the mutants killed (sage) | `docs/plans/2026-10-20_human-users-build.md` § Brief: 193b1a, the message filter | — |
-| 206 | 193b2: thread shares, schema 3k-3l after the #436b build (#1691; live needs a --migrate window with Jason) | morgana; reviewers duckworth | #1704 | queued | 205 done, 234 done, 236 done, 275 done | Duckworth approves the manifest; bus suite, cli suite and every scripts/test-*.sh green on Sage's gate; the mutants killed (sage) | `docs/plans/2026-10-20_human-users-build.md` § Brief: 193b2, thread shares (schema 3l) | — |
+| 205 | 193b1: viewer verbs, board refusals and the message filter (#1691; also after FED R3 and R4 when filed) | morgana; reviewers duckworth | #1703 | briefed | 196 done | Duckworth approves the manifest; bus suite and every scripts/test-*.sh green on Sage's gate; the mutants killed (sage) | `docs/plans/2026-10-20_human-users-build.md` § Brief: 193b1, viewer verbs, board refusals and the message filter | — |
+| 206 | 193b2: thread shares, schema 3k-3l after the #436b build (#1691; live needs a --migrate window with Jason) | morgana; reviewers duckworth | #1704 | queued | 205 done, 234 done, 236 done | Duckworth approves the manifest; bus suite, cli suite and every scripts/test-*.sh green on Sage's gate; the mutants killed (sage) | `docs/plans/2026-10-20_human-users-build.md` § Brief: 193b2, thread shares (schema 3l) | — |
 | 207 | 193c: mosaic access user verbs and --level viewer (#1691) | morgana; reviewers duckworth | #1705 | queued | 202 done | Duckworth approves the manifest; cli suite and every scripts/test-*.sh green on Sage's gate; the mutants killed (sage) | `docs/plans/2026-10-20_human-users-build.md` § Brief: 193c, mosaic access user verbs and --level viewer | — |
 | 208 | 193d: Console shared list, share controls and viewer read-only (#1691; also after FED R6 when filed) | morgana; reviewers duckworth | #1706 | queued | 192 done, 206 done | Duckworth approves the manifest; webui suite and every scripts/test-*.sh green on Sage's gate; the mutants killed (sage) | `docs/plans/2026-10-20_human-users-build.md` § Brief: 193d, the Console's shared list, share controls and viewer read-only | — |
 | 209 | FED R8: the hub window on 10.1.1.54, a recorded acceptance (#414, r4.11 b93f098f0; live window run by Jason and Mos, after the Case 2 install #416, Bean and Chet live and both Hermes gateways stopped) | sage; reviewers duckworth | — | queued | — | Every entry check's output is in the R8 record with who ran it; Jason signs in to the hub and sends one message, Melanie revokes, his next request is refused; Duckworth checks the record (sage) | `docs/plans/2026-10-20_federation-r1-r2-r5.md` § Brief: FED R8, the hub window on 10.1.1.54 | Stays queued until its entry gates near: Case 2 install on .54 (#416, by 2026-10-27), Bean and Chet live, both Hermes gateways on .54 stopped, R7, #412 phase 2, #419 answer. Filed per mos-1073 after duckworth-0034 (Sage) |
@@ -272,7 +272,7 @@ Generated from `docs/plans/queue.json` revision 3102 by `queue render`. Do not e
 | 233 | Installer I3: stack-upgrade.sh root driver and the ops-01 host run sheet (MVP, Q187, Vikunja #432) | darkwing; reviewers filbert | #1735 | done | 232 done | Filbert approves the manifest. The test file, the cli suite and every scripts/test-*.sh are green on Sage's gate, with the mutants killed. (sage) | `docs/plans/2026-10-20_installer-rows.md` § I3 the upgrade command and the host run sheet | Landed 57f59e0c3 on 5465fd52d (pushed 05:39Z). verify-commit matches the manifest (7 paths). Patch-id b16ac924 equals the candidate's (1a1dc80ca vs e65a3ab4d). Modes match. Sage's gate on the landing tree: cli 617/0, scripts/test-*.sh 585/0. Filbert N1, N4 and N5 go to row 240, N2 and N3 to DEFERRED. |
 | 234 | Machine grant row a: host enrollment, store records and migration 3i-3j (#436a, design r6 f9039682e, lands by 10-25 before the .53/.54 installs) | gizmoduck; reviewers duckworth | #1740 | done | 210 done | Duckworth approves the manifest. The bus, business and cli suites and every scripts/test-*.sh are green on Sage's gate. The design's section 10 row a tests and mutants pass, the migration test included. (sage) (sage) | `docs/plans/2026-10-20_host-credentials.md` § Machine grant row a: enrollment, store records and migration 3i-3j | LANDED c771a36f4 (pushed 06:16Z 10-21) on caa4b5944: r3 c783d5e39 41 paths via temp index, modes from ls-tree. patch-id 32bbbea2bd6f equals the candidate's; verify-commit ok 41 paths. Gate on the c783d5e39 tree 06:02:12Z-06:15:26Z: 15 packages 2890/0, ten scripts/test-*.sh 585/0. Duckworth r3 approve 29935 rev 2683. N10, N12 to row 235. |
 | 235 | Machine grant row b: raise binding, executor, reconcile and revoke (#436, design r6 f9039682e, C1, N1, G27, G28) | gizmoduck; reviewers duckworth | #1741 | done | 234 done | Duckworth approves the manifest. The bus, business and cli suites and every scripts/test-*.sh are green on Sage's gate. Section 10's row b tests and mutants pass, G27, G28 and the upsert mutant included. (sage) (sage) | `docs/plans/2026-10-20_host-credentials.md` § Machine grant row b: raise binding, executor, reconcile and revoke | LANDED b1fece6f0, pushed (rode Darkwing SESSIONS aa19a2464). Cand ed4193316, manifest dad377ca8fe4, 13 paths, verify-commit ok, patch-id c355d2fc457d. Gate 10:30:55-10:42:43Z: bus 596/0, business 200/0, cli 666/0, all scripts green. Brief Gate met: duckworth-0089 approve, upsert mutant equivalent, row b and creative tests and mutants on Gizmoduck slot runs (38 of 39 killed, B17 equivalent). |
-| 236 | #436b Gitea grant path build: seat accounts and tokens through an approved grant, schema 3j-3k (design r5 1be535aca, due 10-27 at risk; live waits for Jason's section 8 approval and bootstrap step) | megavolt; reviewers dewey | #1742 | in-progress | 210 done, 234 done | Dewey approves the manifest. The bus, business and cli suites and every scripts/test-*.sh are green on Sage's gate. Section 9's mutants are killed, N9's restart test included. (sage) (sage) | `docs/plans/2026-10-20_agent-credentials.md` § Brief: #436b Gitea grant path, build (schema 3j-3k) | — |
+| 236 | #436b Gitea grant path build: seat accounts and tokens through an approved grant, schema 3j-3k (design r5 1be535aca, due 10-27 at risk; live waits for Jason's section 8 approval and bootstrap step) | megavolt; reviewers dewey | #1742 | briefed | 210 done, 234 done | Dewey approves the manifest. The bus, business and cli suites and every scripts/test-*.sh are green on Sage's gate. Section 9's mutants are killed, N9's restart test included. (sage) (sage) | `docs/plans/2026-10-20_agent-credentials.md` § Brief: #436b Gitea grant path, build (schema 3j-3k) | — |
 | 237 | Row 199 follow-up N1: one decision publishes once (publish-busy or #spent recheck) | megavolt; reviewers duckworth | #1743 | done | 199 done | Duckworth approves the manifest. The bus suite and every scripts/test-*.sh are green on Sage's gate, and the mutant is killed. (sage) (sage) | `docs/plans/2026-10-20_agent-credentials.md` § Brief: row 199 follow-up N1, one decision publishes once | Landed d7d943199 on refactor (local, push pending), patch-id c5f4beb4 = e42415935, manifest bb777cb0 blobs checked. Sage gate 01:31-01:44Z on 816d48b03+4 paths: M1 killed (bus 1/13, cli 1/8), every package suite and scripts/test-*.sh green (bus 478, cli 564). |
 | 238 | row 200 follow-up N1: the sso-config hint carries --instance NAME (#1744) | launchpad; reviewers webby | #1744 | done | 200 done | Webby approves the manifest; stack-release.test.mjs whole, cli suite and every scripts/test-*.sh green on Sage's gate; the mutant killed (sage) | `docs/plans/2026-10-20_stack-release-sso.md` § Brief: row 200 follow-up N1, the sso-config hint names the instance | Landed d49b1f2bd (pushed 07:25Z) on 86249ac55: the 3 manifest paths from 4c90099ea. Patch-id b9d0bb0ee3c7 equals the candidate's; modes and blobs match; verify-commit ok (3 paths). Sage's combined 228+238 gate on c515273db plus both rows' 6 paths, 07:11:30Z to 07:23:34Z: seat 165/0, cli 640/0, all ten scripts/test-*.sh 585/0. Mutant (sso-config drops --instance) killed, survived none. Round 1 N1 stays on the #1744 carry list. |
 | 239 | Row 194 follow-up: the credential revoke runs under the writer's lock, refusals after a revoke say so, and a stale-revision fire test (duckworth-0074, mos-1158) | honker; reviewers duckworth | #1745 | queued | 194 done | Duckworth approves the manifest. The bus, business, cli and webui suites and every scripts/test-*.sh are green on Sage's gate, and the mutants are killed. (sage) (sage) | `docs/plans/2026-10-20_agent-lifecycle.md` § Brief: row 194 follow-up, the revoke under the writer's lock and a fire test | — |
@@ -309,9 +309,6 @@ Generated from `docs/plans/queue.json` revision 3102 by `queue render`. Do not e
 | 270 | 264c T1 item 7: compaction count, exact for Pi | gizmoduck; reviewers duckworth | #1775 | briefed | 269 done | Duckworth approves this slice's manifest. Its design tests run whole plus every touched suite on Sage's slot, and its mutants are killed (RULINGS Q1). Test T3 Pi half; Claude shows unknown with the Vikunja 466 reason (Q6). (sage) | `docs/plans/2026-10-21_t1-sessions.md` § T1 item 7: independent sessions, compaction counts and clear context | — |
 | 271 | 264d T1 item 7: clear context through row 194's lifecycle stop | gizmoduck; reviewers duckworth | #1776 | briefed | 194 done, 269 done | Duckworth approves this slice's manifest. Its design tests run whole plus every touched suite on Sage's slot, and its mutants are killed (RULINGS Q1). Tests T4 and T6; rebased onto 194's landing with no 194 code copied (Q4). (sage) | `docs/plans/2026-10-21_t1-sessions.md` § T1 item 7: independent sessions, compaction counts and clear context | — |
 | 272 | 264e T1 item 7: mosaic session CLI and Console chooser | gizmoduck; reviewers duckworth | #1777 | briefed | 264 done | Duckworth approves this slice's manifest. Its design tests run whole plus every touched suite on Sage's slot, and its mutants are killed (RULINGS Q1). Tests T5 legacy single human and T7 Console half; controls for unlanded verbs refuse with a reason (Q1, Q7). (sage) | `docs/plans/2026-10-21_t1-sessions.md` § T1 item 7: independent sessions, compaction counts and clear context | — |
-| 273 | Q175 phase 2: stack-release.sh activate --send and --no-sso (F39, mos-1246) | darkwing; reviewers filbert | #1778 | briefed | — | Filbert approves the manifest. stack-release.test.mjs and stack-release-external.test.mjs run whole plus scripts/test-release.sh on Sage's slot, and the brief's mutants are killed. (sage) | `docs/plans/2026-10-22_activate-send-nosso.md` § Brief: activate --send and --no-sso | — |
-| 274 | FED R3: broker user principal (#414) | morgana; reviewers dewey | #1779 | briefed | — | Dewey approves the manifest. The bus and harness suites and every scripts/test-*.sh are green on Sage's gate, and the mutants are killed. (sage) | `docs/plans/2026-10-22_federation-r3.md` § Brief: FED R3, the broker user principal | — |
-| 275 | 193b1b: viewer verbs and board refusals (also after FED R4 when filed) | morgana; reviewers duckworth | #1780 | briefed | 205 done, 274 done | Duckworth approves the manifest. The bus suite and every scripts/test-*.sh are green on Sage's gate, and the mutants are killed. (sage) | `docs/plans/2026-10-20_human-users-build.md` § Brief: 193b1b, viewer verbs and board refusals | — |
 
 <!-- mosaic-queue:end -->
 

docs/plans/queue.json

@@ -1,7 +1,7 @@
 {
   "version": 1,
   "canonicalRoot": "/mnt/storage/src/mosaic-stack",
-  "revision": 3102,
+  "revision": 3091,
   "rows": [
     {
       "id": 1,
@@ -21703,7 +21703,7 @@
     },
     {
       "id": 205,
-      "piece": "193b1a: the message filter (#1703; FED R3 and 193b1b build on it)",
+      "piece": "193b1: viewer verbs, board refusals and the message filter (#1691; also after FED R3 and R4 when filed)",
       "owner": "morgana",
       "issues": [
         1703
@@ -21719,8 +21719,8 @@
       "gateOwner": "sage",
       "brief": {
         "path": "docs/plans/2026-10-20_human-users-build.md",
-        "anchor": "Brief: 193b1a, the message filter",
-        "blob": "de3a6310bf4ba8c1ffacd7c18ef8c60854af4563"
+        "anchor": "Brief: 193b1, viewer verbs, board refusals and the message filter",
+        "blob": "a73e1bba0957e39f8a998efb7df69a36e3fb2914"
       },
       "after": [
         {
@@ -21736,7 +21736,7 @@
       "note": null,
       "blockedReason": null,
       "createdAt": "2026-10-20T19:44:12.910Z",
-      "updatedAt": "2026-10-22T00:50:24.817Z",
+      "updatedAt": "2026-10-22T00:28:08.860Z",
       "updatedBy": "sage"
     },
     {
@@ -21758,7 +21758,7 @@
       "brief": {
         "path": "docs/plans/2026-10-20_human-users-build.md",
         "anchor": "Brief: 193b2, thread shares (schema 3l)",
-        "blob": "de3a6310bf4ba8c1ffacd7c18ef8c60854af4563"
+        "blob": "a73e1bba0957e39f8a998efb7df69a36e3fb2914"
       },
       "after": [
         {
@@ -21772,10 +21772,6 @@
         {
           "id": 236,
           "when": "done"
-        },
-        {
-          "id": 275,
-          "when": "done"
         }
       ],
       "reviewers": [
@@ -21786,7 +21782,7 @@
       "note": null,
       "blockedReason": null,
       "createdAt": "2026-10-20T19:44:46.533Z",
-      "updatedAt": "2026-10-22T00:53:17.472Z",
+      "updatedAt": "2026-10-20T23:41:30.826Z",
       "updatedBy": "sage"
     },
     {
@@ -24455,7 +24451,7 @@
       "closes": [
         1742
       ],
-      "state": "in-progress",
+      "state": "briefed",
       "previousState": null,
       "required": false,
       "requiredSince": null,
@@ -24480,15 +24476,12 @@
         "dewey"
       ],
       "review": null,
-      "claim": {
-        "seat": "megavolt",
-        "op": "megavolt-236-claim"
-      },
+      "claim": null,
       "note": null,
       "blockedReason": null,
       "createdAt": "2026-10-20T23:39:42.567Z",
-      "updatedAt": "2026-10-22T00:32:54.651Z",
-      "updatedBy": "megavolt"
+      "updatedAt": "2026-10-22T00:28:49.638Z",
+      "updatedBy": "sage"
     },
     {
       "id": 237,
@@ -27020,114 +27013,6 @@
       "createdAt": "2026-10-22T00:11:15.380Z",
       "updatedAt": "2026-10-22T00:13:50.814Z",
       "updatedBy": "sage"
-    },
-    {
-      "id": 273,
-      "piece": "Q175 phase 2: stack-release.sh activate --send and --no-sso (F39, mos-1246)",
-      "owner": "darkwing",
-      "issues": [
-        1778
-      ],
-      "closes": [
-        1778
-      ],
-      "state": "briefed",
-      "previousState": null,
-      "required": false,
-      "requiredSince": null,
-      "gate": "Filbert approves the manifest. stack-release.test.mjs and stack-release-external.test.mjs run whole plus scripts/test-release.sh on Sage's slot, and the brief's mutants are killed.",
-      "gateOwner": "sage",
-      "brief": {
-        "path": "docs/plans/2026-10-22_activate-send-nosso.md",
-        "anchor": "Brief: activate --send and --no-sso",
-        "blob": "9d6d7b13ea7225a3700ccdaba9bb6cbc575ab04e"
-      },
-      "after": [],
-      "reviewers": [
-        "filbert"
-      ],
-      "review": null,
-      "claim": null,
-      "note": null,
-      "blockedReason": null,
-      "createdAt": "2026-10-22T00:49:02.640Z",
-      "updatedAt": "2026-10-22T00:54:21.474Z",
-      "updatedBy": "sage"
-    },
-    {
-      "id": 274,
-      "piece": "FED R3: broker user principal (#414)",
-      "owner": "morgana",
-      "issues": [
-        1779
-      ],
-      "closes": [
-        1779
-      ],
-      "state": "briefed",
-      "previousState": null,
-      "required": false,
-      "requiredSince": null,
-      "gate": "Dewey approves the manifest. The bus and harness suites and every scripts/test-*.sh are green on Sage's gate, and the mutants are killed.",
-      "gateOwner": "sage",
-      "brief": {
-        "path": "docs/plans/2026-10-22_federation-r3.md",
-        "anchor": "Brief: FED R3, the broker user principal",
-        "blob": "cfa04474c47920177b16c6090af789fce3583966"
-      },
-      "after": [],
-      "reviewers": [
-        "dewey"
-      ],
-      "review": null,
-      "claim": null,
-      "note": null,
-      "blockedReason": null,
-      "createdAt": "2026-10-22T00:51:10.987Z",
-      "updatedAt": "2026-10-22T00:55:05.247Z",
-      "updatedBy": "sage"
-    },
-    {
-      "id": 275,
-      "piece": "193b1b: viewer verbs and board refusals (also after FED R4 when filed)",
-      "owner": "morgana",
-      "issues": [
-        1780
-      ],
-      "closes": [
-        1780
-      ],
-      "state": "briefed",
-      "previousState": null,
-      "required": false,
-      "requiredSince": null,
-      "gate": "Duckworth approves the manifest. The bus suite and every scripts/test-*.sh are green on Sage's gate, and the mutants are killed.",
-      "gateOwner": "sage",
-      "brief": {
-        "path": "docs/plans/2026-10-20_human-users-build.md",
-        "anchor": "Brief: 193b1b, viewer verbs and board refusals",
-        "blob": "de3a6310bf4ba8c1ffacd7c18ef8c60854af4563"
-      },
-      "after": [
-        {
-          "id": 205,
-          "when": "done"
-        },
-        {
-          "id": 274,
-          "when": "done"
-        }
-      ],
-      "reviewers": [
-        "duckworth"
-      ],
-      "review": null,
-      "claim": null,
-      "note": null,
-      "blockedReason": null,
-      "createdAt": "2026-10-22T00:51:54.534Z",
-      "updatedAt": "2026-10-22T00:55:47.065Z",
-      "updatedBy": "sage"
     }
   ],
   "log": [
@@ -108697,378 +108582,6 @@
         "receipt": "ok sage-236-briefed-1022 rev 3091 row 236 queued→briefed"
       },
       "viewSha": "c615b8eb3878871baf34b433052f6ee1199071adc61315560cf4332f8fd62db0"
-    },
-    {
-      "rev": 3092,
-      "op": "megavolt-236-claim",
-      "verb": "move",
-      "args": {
-        "id": 236,
-        "to": "in-progress",
-        "reason": null,
-        "candidate": null,
-        "evidence": null,
-        "issue": null
-      },
-      "by": "megavolt",
-      "at": "2026-10-22T00:32:54.651Z",
-      "semantics": 2,
-      "result": {
-        "row": 236,
-        "from": "briefed",
-        "to": "in-progress",
-        "round": null,
-        "issue": null,
-        "candidate": null,
-        "receipt": "ok megavolt-236-claim rev 3092 row 236 briefed→in-progress"
-      },
-      "viewSha": "de8608e4fe843a794b9f6744eba6a7424115d60bddc69572b855c44eebd4c61d"
-    },
-    {
-      "rev": 3093,
-      "op": "sage-act-sendnosso-add",
-      "verb": "add",
-      "args": {
-        "piece": "Q175 phase 2: stack-release.sh activate --send and --no-sso (F39, mos-1246)",
-        "gate": "Filbert approves the manifest. stack-release.test.mjs and stack-release-external.test.mjs run whole plus scripts/test-release.sh on Sage's slot, and the brief's mutants are killed.",
-        "brief": "docs/plans/2026-10-22_activate-send-nosso.md#Brief: activate --send and --no-sso",
-        "issues": [
-          1778
-        ],
-        "note": null,
-        "owner": "darkwing",
-        "gateOwner": "sage",
-        "after": null,
-        "reviewers": [
-          "filbert"
-        ],
-        "required": null
-      },
-      "by": "sage",
-      "at": "2026-10-22T00:49:02.640Z",
-      "semantics": 2,
-      "result": {
-        "row": 273,
-        "from": null,
-        "to": "queued",
-        "brief": {
-          "path": "docs/plans/2026-10-22_activate-send-nosso.md",
-          "anchor": "Brief: activate --send and --no-sso",
-          "blob": "9d6d7b13ea7225a3700ccdaba9bb6cbc575ab04e"
-        },
-        "receipt": "ok sage-act-sendnosso-add rev 3093 row 273 none→queued"
-      },
-      "viewSha": "d2f817029569421c2ef3753ef7f85c4e98c03c441e79cbde88bad53f270e3372"
-    },
-    {
-      "rev": 3094,
-      "op": "sage-205-repin-193b1a",
-      "verb": "set",
-      "args": {
-        "id": 205,
-        "field": "brief",
-        "value": "docs/plans/2026-10-20_human-users-build.md#Brief: 193b1a, the message filter",
-        "reason": null
-      },
-      "by": "sage",
-      "at": "2026-10-22T00:49:43.457Z",
-      "semantics": 2,
-      "result": {
-        "row": 205,
-        "field": "brief",
-        "from": {
-          "path": "docs/plans/2026-10-20_human-users-build.md",
-          "anchor": "Brief: 193b1, viewer verbs, board refusals and the message filter",
-          "blob": "a73e1bba0957e39f8a998efb7df69a36e3fb2914"
-        },
-        "to": {
-          "path": "docs/plans/2026-10-20_human-users-build.md",
-          "anchor": "Brief: 193b1a, the message filter",
-          "blob": "de3a6310bf4ba8c1ffacd7c18ef8c60854af4563"
-        },
-        "receipt": "ok sage-205-repin-193b1a rev 3094 row 205 brief: docs/plans/2026-10-20_human-users-build.md § Brief: 193b1, viewer verbs, board refusals and the message filter @a73e1bba0957→docs/plans/2026-10-20_human-users-build.md § Brief: 193b1a, the message filter @de3a6310bf4b"
-      },
-      "viewSha": "81078934ef21d22f3c5b716265fd38ab399c061db2e8490a7f3fc8f0328bd9e0"
-    },
-    {
-      "rev": 3095,
-      "op": "sage-205-piece-193b1a",
-      "verb": "set",
-      "args": {
-        "id": 205,
-        "field": "piece",
-        "value": "193b1a: the message filter (#1703; FED R3 and 193b1b build on it)",
-        "reason": null
-      },
-      "by": "sage",
-      "at": "2026-10-22T00:50:24.817Z",
-      "semantics": 2,
-      "result": {
-        "row": 205,
-        "field": "piece",
-        "from": "193b1: viewer verbs, board refusals and the message filter (#1691; also after FED R3 and R4 when filed)",
-        "to": "193b1a: the message filter (#1703; FED R3 and 193b1b build on it)",
-        "receipt": "ok sage-205-piece-193b1a rev 3095 row 205 piece: 193b1: viewer verbs, board refusals and the message filter (#1691; also after FED R3 and R4 when filed)→193b1a: the message filter (#1703; FED R3 and 193b1b build on it)"
-      },
-      "viewSha": "33947b5cd3343fe2e7bb5683ac17522187f75ecfe51c71a510a970c222514acc"
-    },
-    {
-      "rev": 3096,
-      "op": "sage-fedr3-add",
-      "verb": "add",
-      "args": {
-        "piece": "FED R3: broker user principal (#414)",
-        "gate": "Dewey approves the manifest. The bus and harness suites and every scripts/test-*.sh are green on Sage's gate, and the mutants are killed.",
-        "brief": "docs/plans/2026-10-22_federation-r3.md#Brief: FED R3, the broker user principal",
-        "issues": [
-          1779
-        ],
-        "note": null,
-        "owner": "morgana",
-        "gateOwner": "sage",
-        "after": null,
-        "reviewers": [
-          "dewey"
-        ],
-        "required": null
-      },
-      "by": "sage",
-      "at": "2026-10-22T00:51:10.987Z",
-      "semantics": 2,
-      "result": {
-        "row": 274,
-        "from": null,
-        "to": "queued",
-        "brief": {
-          "path": "docs/plans/2026-10-22_federation-r3.md",
-          "anchor": "Brief: FED R3, the broker user principal",
-          "blob": "cfa04474c47920177b16c6090af789fce3583966"
-        },
-        "receipt": "ok sage-fedr3-add rev 3096 row 274 none→queued"
-      },
-      "viewSha": "d0d673cfbbddd84697929e22f7c45715b7519682a46644678a8dbcd942f5137f"
-    },
-    {
-      "rev": 3097,
-      "op": "sage-193b1b-add",
-      "verb": "add",
-      "args": {
-        "piece": "193b1b: viewer verbs and board refusals (also after FED R4 when filed)",
-        "gate": "Duckworth approves the manifest. The bus suite and every scripts/test-*.sh are green on Sage's gate, and the mutants are killed.",
-        "brief": "docs/plans/2026-10-20_human-users-build.md#Brief: 193b1b, viewer verbs and board refusals",
-        "issues": [
-          1780
-        ],
-        "note": null,
-        "owner": "morgana",
-        "gateOwner": "sage",
-        "after": [
-          {
-            "id": 205,
-            "when": "done"
-          },
-          {
-            "id": 274,
-            "when": "done"
-          }
-        ],
-        "reviewers": [
-          "duckworth"
-        ],
-        "required": null
-      },
-      "by": "sage",
-      "at": "2026-10-22T00:51:54.534Z",
-      "semantics": 2,
-      "result": {
-        "row": 275,
-        "from": null,
-        "to": "queued",
-        "brief": {
-          "path": "docs/plans/2026-10-20_human-users-build.md",
-          "anchor": "Brief: 193b1b, viewer verbs and board refusals",
-          "blob": "de3a6310bf4ba8c1ffacd7c18ef8c60854af4563"
-        },
-        "receipt": "ok sage-193b1b-add rev 3097 row 275 none→queued"
-      },
-      "viewSha": "9f57bbf08dbb8ad2262dc71bc112421931cc369516ce4d6cbeaf0f47d061e273"
-    },
-    {
-      "rev": 3098,
-      "op": "sage-206-repin-0022",
-      "verb": "set",
-      "args": {
-        "id": 206,
-        "field": "brief",
-        "value": "docs/plans/2026-10-20_human-users-build.md#Brief: 193b2, thread shares (schema 3l)",
-        "reason": null
-      },
-      "by": "sage",
-      "at": "2026-10-22T00:52:37.009Z",
-      "semantics": 2,
-      "result": {
-        "row": 206,
-        "field": "brief",
-        "from": {
-          "path": "docs/plans/2026-10-20_human-users-build.md",
-          "anchor": "Brief: 193b2, thread shares (schema 3l)",
-          "blob": "a73e1bba0957e39f8a998efb7df69a36e3fb2914"
-        },
-        "to": {
-          "path": "docs/plans/2026-10-20_human-users-build.md",
-          "anchor": "Brief: 193b2, thread shares (schema 3l)",
-          "blob": "de3a6310bf4ba8c1ffacd7c18ef8c60854af4563"
-        },
-        "receipt": "ok sage-206-repin-0022 rev 3098 row 206 brief: docs/plans/2026-10-20_human-users-build.md § Brief: 193b2, thread shares (schema 3l) @a73e1bba0957→docs/plans/2026-10-20_human-users-build.md § Brief: 193b2, thread shares (schema 3l) @de3a6310bf4b"
-      },
-      "viewSha": "e1be879de881831f65099a1654aa6228ac9c806e0d2c3e031165491ef315c5a9"
-    },
-    {
-      "rev": 3099,
-      "op": "sage-206-after-0022",
-      "verb": "set",
-      "args": {
-        "id": 206,
-        "field": "after",
-        "value": [
-          {
-            "id": 205,
-            "when": "done"
-          },
-          {
-            "id": 234,
-            "when": "done"
-          },
-          {
-            "id": 236,
-            "when": "done"
-          },
-          {
-            "id": 275,
-            "when": "done"
-          }
-        ],
-        "reason": null
-      },
-      "by": "sage",
-      "at": "2026-10-22T00:53:17.472Z",
-      "semantics": 2,
-      "result": {
-        "row": 206,
-        "field": "after",
-        "from": [
-          {
-            "id": 205,
-            "when": "done"
-          },
-          {
-            "id": 234,
-            "when": "done"
-          },
-          {
-            "id": 236,
-            "when": "done"
-          }
-        ],
-        "to": [
-          {
-            "id": 205,
-            "when": "done"
-          },
-          {
-            "id": 234,
-            "when": "done"
-          },
-          {
-            "id": 236,
-            "when": "done"
-          },
-          {
-            "id": 275,
-            "when": "done"
-          }
-        ],
-        "receipt": "ok sage-206-after-0022 rev 3099 row 206 after: 205 done, 234 done, 236 done→205 done, 234 done, 236 done, 275 done"
-      },
-      "viewSha": "dac3592f0b8e9506ea3bb3b93a82fc7e6c468878ad444908b5711437a813c43b"
-    },
-    {
-      "rev": 3100,
-      "op": "sage-273-briefed-0022",
-      "verb": "move",
-      "args": {
-        "id": 273,
-        "to": "briefed",
-        "reason": null,
-        "candidate": null,
-        "evidence": null,
-        "issue": null
-      },
-      "by": "sage",
-      "at": "2026-10-22T00:54:21.474Z",
-      "semantics": 2,
-      "result": {
-        "row": 273,
-        "from": "queued",
-        "to": "briefed",
-        "round": null,
-        "issue": null,
-        "candidate": null,
-        "receipt": "ok sage-273-briefed-0022 rev 3100 row 273 queued→briefed"
-      },
-      "viewSha": "588d0cbc1bf6dc28dd0156b5abfa29d505be23899863eb90001c91c8acc2410a"
-    },
-    {
-      "rev": 3101,
-      "op": "sage-274-briefed-0022",
-      "verb": "move",
-      "args": {
-        "id": 274,
-        "to": "briefed",
-        "reason": null,
-        "candidate": null,
-        "evidence": null,
-        "issue": null
-      },
-      "by": "sage",
-      "at": "2026-10-22T00:55:05.247Z",
-      "semantics": 2,
-      "result": {
-        "row": 274,
-        "from": "queued",
-        "to": "briefed",
-        "round": null,
-        "issue": null,
-        "candidate": null,
-        "receipt": "ok sage-274-briefed-0022 rev 3101 row 274 queued→briefed"
-      },
-      "viewSha": "edbb0627ae12025c1404a6b2c19976b4ad38c5294402d7e5e1308832ab43a179"
-    },
-    {
-      "rev": 3102,
-      "op": "sage-275-briefed-0022",
-      "verb": "move",
-      "args": {
-        "id": 275,
-        "to": "briefed",
-        "reason": null,
-        "candidate": null,
-        "evidence": null,
-        "issue": null
-      },
-      "by": "sage",
-      "at": "2026-10-22T00:55:47.065Z",
-      "semantics": 2,
-      "result": {
-        "row": 275,
-        "from": "queued",
-        "to": "briefed",
-        "round": null,
-        "issue": null,
-        "candidate": null,
-        "receipt": "ok sage-275-briefed-0022 rev 3102 row 275 queued→briefed"
-      },
-      "viewSha": "f25628bc6b477edaff12ba424225bf82f3cff21bdf45e678496e5f2e3a862893"
     }
   ]
 }

packages/bus/src/broker.mjs

@@ -463,6 +463,22 @@ export class Broker {
   #owner(s) {
     return s.tester ? 'tester' : s.human;
   }
+  // Row 205 (193b1a, #1703, row 193 design 5.7): a message in a thread a user other than the caller
+  // owns is hidden from trail and replies unless #readable holds. The business human's and the
+  // tester's threads are never hidden, so row 177 is unchanged. A reader owns nothing.
+  #hiddenMessage(s, id) {
+    const t = this.#store.get(
+      'SELECT t.* FROM message_threads mt JOIN threads t ON t.id=mt.thread WHERE mt.message=? AND t.business=?',
+      id,
+      s.business,
+    );
+    return Boolean(t) && t.owner.startsWith('user:') && t.owner !== this.#owner(s) && !this.#readable(s, t);
+  }
+  // Row 193 design 5.4. Rule 1 needs a share in force, and there is no thread_shares table before
+  // 193b2 (schema 3j), so nobody reads another's thread yet. 193b2 adds the share rule and rules 2-4.
+  #readable(s, t) {
+    return false;
+  }
   #agent(s) {
     if (s.tester) fail('tester-refused');
     if (s.reader) fail('read-only');
@@ -3562,10 +3578,15 @@ export class Broker {
         identifier(a.id);
         if (!this.#store.get('SELECT id FROM messages WHERE id=? AND business=?', a.id, s.business))
           fail('message-not-found');
+        // Row 205 (design 5.7): a hidden id fails as an unknown one does. Hidden replies are left out
+        // in the query, so a page of them doesn't come back short; #readable is false until 193b2,
+        // which adds the share exception to this clause too.
+        if (this.#hiddenMessage(s, a.id)) fail('message-not-found');
         return this.#store.all(
-          `SELECT * FROM messages WHERE business=? AND in_reply_to=? ORDER BY seq LIMIT ${REPLIES}`,
+          `SELECT * FROM messages m WHERE business=? AND in_reply_to=? AND NOT EXISTS(SELECT 1 FROM message_threads mt JOIN threads t ON t.id=mt.thread WHERE mt.message=m.id AND substr(t.owner,1,5)='user:' AND t.owner IS NOT ?) ORDER BY seq LIMIT ${REPLIES}`,
           s.business,
           a.id,
+          this.#owner(s) || null,
         );
       }
       default:
@@ -3814,6 +3835,8 @@ export class Broker {
     for (const m of rows) this.#delivery(m.id, 'routed', h);
   }
   #trail(s, subject) {
+    // Row 205 (design 5.7, sage-2288): a hidden subject answers exactly as an unknown id does.
+    if (this.#hiddenMessage(s, subject)) return [];
     const rows = new Map();
     const add = (table, list) => {
       for (const row of list) {
@@ -3895,6 +3918,18 @@ export class Broker {
         this.#store.all('SELECT * FROM role_claims WHERE business=? AND holder_run=?', s.business, run),
       );
     }
+    // Row 205 (design 5.7): drop hidden messages, their deliveries and the events about them.
+    // Decision rows and their events stay: the run's governance is the owner's to see.
+    const hidden = new Set(
+      [...rows.values()].filter((r) => r.table === 'messages' && this.#hiddenMessage(s, r.id)).map((r) => r.id),
+    );
+    for (const [key, r] of rows)
+      if (
+        (r.table === 'messages' && hidden.has(r.id)) ||
+        (r.table === 'deliveries' && hidden.has(r.message)) ||
+        (r.table === 'events' && hidden.has(r.subject))
+      )
+        rows.delete(key);
     return [...rows.values()].sort(
       (a, b) => a.at.localeCompare(b.at) || a.table.localeCompare(b.table) || a.seq - b.seq,
     );

packages/bus/tests/message-filter.test.mjs

@@ -0,0 +1,189 @@
+// Row 205 (193b1a, #1703, row 193 design 5.7, sage-2288): a user's messages are private from the
+// business owner, reader sessions and the tester on trail and replies; the run's governance is not.
+// Nothing makes a user session before FED R3, so a user's thread and its messages are written to the
+// store as R3's thread.send and the run's reply will write them.
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { mkdtempSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { randomUUID } from 'node:crypto';
+import { Store } from '../src/store.mjs';
+import { Broker, REPLIES } from '../src/broker.mjs';
+import { fixture } from './spec-fixtures.mjs';
+
+const AT = '2026-10-21T00:00:00.000Z';
+const within = (grants) => ({ authority: { withinRole: grants, crossRole: [] } });
+const options = [{ key: 'yes', text: 'Yes' }, { key: 'no', text: 'No' }];
+
+// A thread owned by `owner`, on the business's assistant instance.
+function threadOf(store, project, owner, name) {
+  const id = randomUUID();
+  store.run(
+    'INSERT INTO threads(id,at,business,project,instance,owner,name) VALUES(?,?,?,?,?,?,?)',
+    id, AT, 'demo', project, 'assistant', owner, name,
+  );
+  return id;
+}
+// A message with its thread row, its routed delivery and one event about it.
+function put(store, { thread = null, from_role, from_run, to_role, in_reply_to = null, decision = null, body }) {
+  const id = randomUUID();
+  store.run(
+    'INSERT INTO messages(id,at,business,from_role,from_run,to_role,class,in_reply_to,decision,corrects,body) VALUES(?,?,?,?,?,?,?,?,?,?,?)',
+    id, AT, 'demo', from_role, from_run, to_role, 'INFO', in_reply_to, decision, null, body,
+  );
+  if (thread) store.run('INSERT INTO message_threads(message,thread) VALUES(?,?)', id, thread);
+  store.run('INSERT INTO deliveries(message,at,op,holder_run,transport,address) VALUES(?,?,?,?,?,?)', id, AT, 'routed', null, null, null);
+  store.run(
+    'INSERT INTO events(id,at,business,kind,actor_role,actor_run,subject,body) VALUES(?,?,?,?,?,?,?,?)',
+    randomUUID(), AT, 'demo', 'action.allowed', from_role, from_run, id, '{}',
+  );
+  return id;
+}
+// From alice to the instance, as R3's thread.send writes it.
+const fromAlice = (store, thread, body, extra = {}) =>
+  put(store, { thread, from_role: 'user', from_run: 'user:alice', to_role: 'assistant', body, ...extra });
+// The run's reply to alice, as R3's `to: 'user'` path writes it.
+const toAlice = (store, thread, body, extra = {}) =>
+  put(store, { thread, from_role: 'assistant', from_run: 'assistant-run', to_role: 'user', body, ...extra });
+
+function setup(t) {
+  const root = mkdtempSync(join(tmpdir(), 'bus-message-filter-'));
+  const store = new Store(root);
+  t.after(() => {
+    store.close();
+    rmSync(root, { recursive: true, force: true });
+  });
+  const b = new Broker({
+    store,
+    businesses: {
+      demo: {
+        id: 'demo', human: 'jason', arbiters: { technical: 'chief', delivery: 'chief' }, vars: { 'bus.tester': true },
+        roles: { chief: { definition: 'chief-of-staff', ...within(['message.send']) }, assistant: { definition: 'assistant', ...within(['message.send']) } },
+      },
+    },
+  });
+  const caps = {
+    human: b.bindHuman({ business: 'demo', human: 'jason', via: 'cli', outsideAgent: true }),
+    reader: b.bindReader({ business: 'demo' }),
+    tester: b.bindTester({ business: 'demo' }),
+  };
+  const call = (who, verb, args = {}) => b.request(caps[who], { verb, args });
+  const project = call('human', 'project.create', { name: 'shared work' }).id;
+  const U = threadOf(store, project, 'user:alice', 'alice');
+  return { b, store, caps, call, project, U };
+}
+const sessions = ['human', 'reader', 'tester'];
+// What a caller sees of a call: its result, or its refusal's code and message.
+const answer = (fn) => {
+  try {
+    return JSON.stringify({ result: fn() });
+  } catch (e) {
+    return JSON.stringify({ code: e.code, message: e.message });
+  }
+};
+
+test('trail on a hidden message id answers exactly as on an unknown id, for the owner, a reader and the tester', (t) => {
+  const { store, call, U } = setup(t);
+  const A = fromAlice(store, U, 'alice: my salary is private');
+  const unknown = randomUUID();
+  for (const who of sessions) {
+    const hidden = answer(() => call(who, 'trail', { subject: A }));
+    assert.equal(hidden, answer(() => call(who, 'trail', { subject: unknown })), who);
+    assert.equal(hidden, JSON.stringify({ result: [] }), who);
+  }
+});
+
+test('replies on a hidden message id answers exactly as on an unknown id, for the owner, a reader and the tester', (t) => {
+  const { store, call, U } = setup(t);
+  const A = fromAlice(store, U, 'alice: hello');
+  toAlice(store, U, 'hello alice', { in_reply_to: A });
+  const unknown = randomUUID();
+  for (const who of sessions) {
+    const hidden = answer(() => call(who, 'replies', { id: A }));
+    assert.equal(hidden, answer(() => call(who, 'replies', { id: unknown })), who);
+    assert.equal(JSON.parse(hidden).code, 'message-not-found', who);
+  }
+});
+
+test('trail on a decision keeps the decision and drops the user thread messages, their deliveries and their events', (t) => {
+  const { b, store, call, U } = setup(t);
+  const run = b.bindLaunch({ business: 'demo', role: 'assistant', run: 'assistant-run', harness: 'pi', thread: U });
+  b.request(run, { verb: 'role.claim' });
+  const d = b.request(run, {
+    verb: 'decision.raise',
+    args: { action: 'deploy', question: 'Ship it?', options, recommendation: 'yes', blocking: false },
+  }).id;
+  const hidden = toAlice(store, U, 'alice, I asked the owner about shipping', { decision: d });
+  const shown = put(store, { from_role: 'assistant', from_run: 'assistant-run', to_role: 'human', body: 'Ship it, owner?', decision: d });
+  for (const who of sessions) {
+    const rows = call(who, 'trail', { subject: d });
+    assert.ok(rows.some((r) => r.table === 'decisions' && r.id === d), `${who}: the decision row shows`);
+    assert.ok(rows.some((r) => r.table === 'messages' && r.id === shown), `${who}: the owner's message shows`);
+    assert.ok(rows.some((r) => r.table === 'deliveries' && r.message === shown), `${who}: its delivery shows`);
+    assert.ok(rows.some((r) => r.table === 'events' && r.subject === shown), `${who}: its event shows`);
+    assert.equal(rows.filter((r) => r.table === 'messages' && r.id === hidden).length, 0, `${who}: no hidden message`);
+    assert.equal(rows.filter((r) => r.table === 'deliveries' && r.message === hidden).length, 0, `${who}: no hidden delivery`);
+    assert.equal(rows.filter((r) => r.table === 'events' && r.subject === hidden).length, 0, `${who}: no hidden event`);
+    assert.equal(JSON.stringify(rows).includes('alice, I asked'), false, `${who}: the body appears nowhere`);
+  }
+});
+
+test('replies leaves out other users thread messages and still fills a page', (t) => {
+  const { store, call, U } = setup(t);
+  const P = put(store, { from_role: 'human', from_run: 'human-cli', to_role: 'chief', body: 'Status, everyone?' });
+  for (let i = 0; i < REPLIES; i++) toAlice(store, U, `hidden ${i}`, { in_reply_to: P });
+  const shown = put(store, { from_role: 'chief', from_run: 'chief-run', to_role: 'human', body: 'All green.', in_reply_to: P });
+  for (const who of sessions) assert.deepEqual(call(who, 'replies', { id: P }).map((m) => m.id), [shown], who);
+});
+
+test('messages in the business human and tester threads are not hidden (row 177 unchanged)', (t) => {
+  const { store, call, project } = setup(t);
+  const H = threadOf(store, project, 'jason', 'mine');
+  const T = threadOf(store, project, 'tester', 'probe');
+  const h = put(store, { thread: H, from_role: 'human', from_run: 'human-cli', to_role: 'assistant', body: 'from jason' });
+  const x = put(store, { thread: T, from_role: 'tester', from_run: 'tester-cli', to_role: 'assistant', body: 'from tester' });
+  const hr = put(store, { thread: H, from_role: 'assistant', from_run: 'r', to_role: 'human', body: 'to jason', in_reply_to: h });
+  const xr = put(store, { thread: T, from_role: 'assistant', from_run: 'r', to_role: 'tester', body: 'to tester', in_reply_to: x });
+  for (const who of sessions) {
+    for (const id of [h, x]) assert.ok(call(who, 'trail', { subject: id }).some((r) => r.table === 'messages' && r.id === id), `${who} ${id}`);
+    assert.deepEqual(call(who, 'replies', { id: h }).map((m) => m.id), [hr], who);
+    assert.deepEqual(call(who, 'replies', { id: x }).map((m) => m.id), [xr], who);
+  }
+});
+
+// Row 193's user sentence, one assertion per item: "The business owner sees your thread's agent's
+// decisions, inbox entries, claims, tasks and project files, but not your messages."
+test('governance pin: the owner sees decisions, inbox entries, claims, tasks and project files, but not the user messages', async (t) => {
+  const f = await fixture(t, { roles: { assistant: { definition: 'assistant', ...within(['message.send', 'record.write']) } } });
+  const project = (await f.call(f.human, 'project.create', { name: 'alice work' })).id;
+  const U = threadOf(f.store, project, 'user:alice', 'alice');
+  const run = f.broker.bindLaunch({ business: 'demo', role: 'assistant', run: 'assistant-run', harness: 'pi', thread: U });
+  await f.call(run, 'role.claim');
+  const A = fromAlice(f.store, U, 'alice: please write up my plan');
+  toAlice(f.store, U, 'alice, done', { in_reply_to: A });
+  await f.call(run, 'record.write', { project: 'stack', path: 'docs/alice-plan.md', record: '# Plan\n' });
+  const d = (await f.call(run, 'decision.raise', { action: 'deploy', question: 'Ship the plan?', options, recommendation: 'yes', blocking: false })).id;
+  f.store.run(
+    'INSERT INTO task_snapshots(at,business,task_ref,updated,digest,fields,source,via,read_at,role,run) VALUES(?,?,?,?,?,?,?,?,?,?,?)',
+    AT, 'demo', 'vikunja:3/47', AT, 'a'.repeat(64), JSON.stringify({ bucket: 1, done: false }), 'self', null, null, 'assistant', 'assistant-run',
+  );
+
+  const inbox = await f.call(f.human, 'inbox');
+  assert.ok(inbox.some((x) => x.id === d), 'inbox entries: the run raise is in the owner inbox');
+  const agents = await f.call(f.human, 'agents');
+  assert.ok(agents.some((c) => c.role === 'assistant' && c.holder_run === 'assistant-run'), 'claims: the run claim shows');
+  const tasks = await f.call(f.human, 'tasks');
+  assert.ok(tasks.some((x) => x.task_ref === 'vikunja:3/47' && x.run === 'assistant-run'), 'tasks: the run task write shows');
+  const file = await f.call(f.human, 'project.file', { project: 'stack', path: 'docs/alice-plan.md' });
+  assert.equal(file.content, '# Plan\n', 'project files: the run record shows');
+  await f.call(f.human, 'decision.resolve', { id: d, choice: 'yes' });
+  const recent = await f.call(f.human, 'decisions', { list: 'recent' });
+  assert.ok(recent.some((x) => x.id === d), 'decisions: the closed raise shows in recent');
+
+  assert.deepEqual(await f.call(f.human, 'trail', { subject: A }), [], 'messages: trail hides the user message');
+  await assert.rejects(Promise.resolve().then(() => f.call(f.human, 'replies', { id: A })), { code: 'message-not-found' }, 'messages: replies hides it');
+  const trail = await f.call(f.human, 'trail', { subject: d });
+  assert.ok(trail.some((r) => r.table === 'decisions' && r.id === d), 'decisions: the trail keeps the decision');
+  assert.equal(JSON.stringify(trail).includes('alice'), false, 'messages: no user body on the decision trail');
+});

packages/cli/tests/stack-release-external.test.mjs

@@ -66,13 +66,13 @@ async function closed(e,x,a){
 const storeSha=(e)=>sha(e.store);
 const backupStore=(e,a)=>join(e.data,'backups','stack',a,'bus','bus.sqlite');
 
-test('row 232: confirm, revert, gate, --to and --expect-from need --units external; the user-only flags are usage under it, and so are row 273\'s --send and --no-sso',async(t)=>{
+test('row 232: confirm, revert, gate, --to and --expect-from need --units external; the user-only flags are usage under it',async(t)=>{
  const {e,x}=await xseed(t);
  const logs=logLines(e).length;
  for(const a of [['confirm',C1,'acme'],['revert',C1,'acme'],['gate',B,'acme','--since','1'],['rollback','acme','--to',B],['activate',C1,'acme','--plan','--expect-from',B]]){
   const r=await run(e,...a);assert.equal(r.code,4,a.join(' '));assert.match(r.err,/^usage: stack-release.sh adopt BUSINESS\n/);
  }
- for(const a of [['activate',C1,'acme','--pm'],['activate',C1,'acme','--tester-port','7444'],['activate',C1,'acme','--no-proof'],['activate',C1,'acme','--no-send'],['activate',C1,'acme','--sso'],['activate',C1,'acme','--send'],['activate',C1,'acme','--no-sso'],['activate',C1,'acme','--proof-header','X','--proof-file','/p'],['rollback','acme'],['gate',B,'acme'],['activate',C1,'acme','--expect-from',B],['confirm',C1,'acme','--rollback',B],['confirm',C1,'acme','--cause','A5']]){
+ for(const a of [['activate',C1,'acme','--pm'],['activate',C1,'acme','--tester-port','7444'],['activate',C1,'acme','--no-proof'],['activate',C1,'acme','--no-send'],['activate',C1,'acme','--sso'],['activate',C1,'acme','--proof-header','X','--proof-file','/p'],['rollback','acme'],['gate',B,'acme'],['activate',C1,'acme','--expect-from',B],['confirm',C1,'acme','--rollback',B],['confirm',C1,'acme','--cause','A5']]){
   const r=await run(x,...a);assert.equal(r.code,4,a.join(' '));
  }
  assert.equal(logLines(e).length,logs);

packages/cli/tests/stack-release.test.mjs

@@ -1258,7 +1258,7 @@ test('T53 row 187: activate sets, carries and drops the proof pair',async(t)=>{
    ['activate',C1,'acme','--plan','--proof-file',f]]){
    const r=await prun(e,...args);assert.equal(r.code,4,args.join(' '));assert.equal(r.out,'');assert.equal(r.err,usageText);
   }
-  assert.match(usageText,/\[--proof-header NAME --proof-file PATH \| --no-proof \| --sso \| --no-sso\]/);
+  assert.match(usageText,/\[--proof-header NAME --proof-file PATH \| --no-proof \| --sso\]/);
   assert.deepEqual(fp(e),before);assert.deepEqual(startsStops(e,n),[]);assert.equal(logLines(e).length,logs);
   await noLeak(e);
  });
@@ -1417,7 +1417,7 @@ test('T55 row 189: activate --no-send drops --send, and rollback and pm-on carry
    ['rehearse','acme','--backup','/tmp/x','--port','7400','--no-send']]){
    const r=await prun(e,...args);assert.equal(r.code,4,args.join(' '));assert.equal(r.out,'');assert.equal(r.err,usageText);
   }
-  assert.match(usageText,/\| --no-proof \| --sso \| --no-sso\] \[--send \| --no-send\]/);
+  assert.match(usageText,/\| --no-proof \| --sso\] \[--no-send\]/);
   assert.deepEqual(fp(e),before);assert.deepEqual(startsStops(e,n),[]);assert.equal(logLines(e).length,logs);
   await noLeak(e);
  });
@@ -1465,7 +1465,7 @@ const DROPS='--public-host console.example --auth-header x-user --allow-user jas
 const SHOW=`show-${CON}.txt`;
 const setOf=(e,act)=>join(e.state,'stack-rollback',act);
 const arrivalSet=(e,to)=>setOf(e,logLines(e).findLast((l)=>l.result==='ok'&&l.to===to&&l.from!==to).activation);
-const ROLLBACK_PLAN=(set)=>`sso: dropped; ${B}'s Console does not support --sso, so the rollback takes the Console flags from ${set}/${SHOW}, with --tester-port as the pointer has it`;
+const ROLLBACK_PLAN=(set)=>`sso: dropped; ${B}'s Console does not support --sso, so the rollback takes the Console flags from ${set}/${SHOW}, with --send and --tester-port as the pointer has them`;
 const KEY_MSG=(e,to,op,why)=>`${e.cfg} holds a console key, and ${to}'s loader refuses it (${why}); remove the key first (restore the config.json backup from the window's step 1), then run the ${op} again`;
 const RB_MSG=(why)=>`${B}'s Console does not support --sso, and the Console flags it ran with cannot be read: ${why}`;
 // Rewrites a file in a rollback set (0700, files kept by cp -p) and, unless sums is false, its SHA256SUMS line.
@@ -1526,7 +1526,7 @@ test('T57 row 200: activate --sso, its refusals before any stop, and the rollbac
    ['rollback','acme','--sso'],['pm-on','acme','--sso'],['status','acme','--sso'],['adopt','acme','--sso']]){
    const r=await prun(e,...args);assert.equal(r.code,4,args.join(' '));assert.equal(r.out,'');assert.equal(r.err,usageText);
   }
-  assert.match(usageText,/\[--proof-header NAME --proof-file PATH \| --no-proof \| --sso \| --no-sso\] \[--send \| --no-send\]/);
+  assert.match(usageText,/\[--proof-header NAME --proof-file PATH \| --no-proof \| --sso\] \[--no-send\]/);
   assert.deepEqual(fp(e),before);assert.deepEqual(startsStops(e,n),[]);assert.equal(logLines(e).length,logs);
   await noLeak(e);
  });
@@ -1600,14 +1600,14 @@ test('T57 row 200: activate --sso, its refusals before any stop, and the rollbac
   assert.ok(conExec(e).endsWith(` --checkout ${repo} ${want.join(' ')}`),conExec(e));
   assert.ok(stepText(e).includes(`Z drop --sso; ${B}'s Console does not support it, so the Console flags come from ${set}/${SHOW}\n`));
   r=await prun(e,'status','acme');assert.equal(r.code,0,r.err);assert.match(r.out,/unit flags: match the pointer/);
-  // The plain case: the preview set and pair come back as they were. --send lost its --sso, so it goes (row 273, F39 b).
+  // The plain case: --send and the preview set and pair come back as they were.
   const g=await mk(t),gbase=await seedPreview(g,undefined,['--send']),f=await proofFile(g);
   r=await prun(g,'activate',B,'acme',...pair(f));assert.equal(r.code,0,r.out+r.err);
   await ssoConfig(g);
   r=await prun(g,'activate',C1,'acme','--sso');assert.equal(r.code,0,r.out+r.err);
   setKey(g,undefined);
   r=await prun(g,'rollback','acme');assert.equal(r.code,0,r.out+r.err);
-  assert.deepEqual(pointer(g).console,[...noSend(gbase),...pair(f)]);
+  assert.deepEqual(pointer(g).console,[...noSend(gbase),...pair(f),'--send']);
   for(const x of [e,g])await noLeak(x);
  });
  await t.test('item 3: a rollback set that is missing, fails its sums, holds no argv or already ran --sso refuses sso-rollback-flags',async(t)=>{
@@ -1679,7 +1679,7 @@ test('T57 row 200: activate --sso, its refusals before any stop, and the rollbac
   r=await prun(a,'status','acme');assert.equal(r.code,0,r.err);assert.match(r.out,/unit flags: match the pointer/);
   setKey(a,undefined);
   const set=arrivalSet(a,C1);assert.ok(existsSync(join(set,show)),show);
-  assert.deepEqual(ssoLines(await planOnly(a,0,'rollback','acme')),[`sso: dropped; ${B}'s Console does not support --sso, so the rollback takes the Console flags from ${set}/${show}, with --tester-port as the pointer has it`]);
+  assert.deepEqual(ssoLines(await planOnly(a,0,'rollback','acme')),[`sso: dropped; ${B}'s Console does not support --sso, so the rollback takes the Console flags from ${set}/${show}, with --send and --tester-port as the pointer has them`]);
   r=await prun(a,'rollback','acme');assert.equal(r.code,0,r.out+r.err);
   assert.equal(pointer(a).copy,B);assert.deepEqual(pointer(a).console,want.slice(0,-1));
   assert.ok(stepText(a).includes(`Z drop --sso; ${B}'s Console does not support it, so the Console flags come from ${set}/${show}\n`));
@@ -1695,198 +1695,6 @@ test('T57 row 200: activate --sso, its refusals before any stop, and the rollbac
  });
 });
 
-// Row 273 (#1778, mos-1246 F39): activate --send turns send on only beside --sso, given or carried, and
-// activate --no-sso turns --sso off with the Console flags from the set of the activation that turned
-// it on, dropping --send. The tester follows the pointer.
-const SEND_MSG="--send needs --sso in the run's Console flags, given or carried; under forward auth any same-uid process could send (F39)";
-const NOT_ON_MSG="the pointer's Console flags hold no --sso, so --no-sso has nothing to turn off";
-const OFF_MSG=(why)=>`the Console flags from before --sso cannot be read: ${why}`;
-const OFF_PLAN=(set,restores)=>`sso: off; Console flags from ${set}/${SHOW}; restores ${restores}`;
-const NOTE=(to)=>`note: ${to} is the pointer's copy; the run re-pins it and only the Console flags change`;
-test('T58 row 273: activate --send and --no-sso',async(t)=>{
- await t.test('T1: --sso --send turns send on after --sso and before the tester port, and the plan says so',async(t)=>{
-  const e=await mk(t);await seedPreview(e,undefined,['--tester-port','7333']);await ssoConfig(e);
-  const want=['--port',e.port,'--business','acme','--sso','--send','--tester-port','7333'];
-  const out=await planOnly(e,0,'activate',C1,'acme','--sso','--send');
-  assert.deepEqual([...sendLines(out),...ssoLines(out)],['send: on; --send was given',`sso: on; drops ${DROPS}; carries --port ${e.port} --business acme --send --tester-port 7333`]);
-  assert.equal(out.find((l)=>l.startsWith('Console: ')),`Console: scripts/webui-service.sh install --copy ${C1} --copies ${COPIES} ${want.join(' ')}`);
-  let r=await prun(e,'activate',C1,'acme','--sso','--send');assert.equal(r.code,0,r.out+r.err);
-  assert.equal(pointer(e).copy,C1);assert.deepEqual(pointer(e).console,want);
-  assert.ok(conExec(e).endsWith(` --checkout ${repo} ${want.join(' ')}`),conExec(e));
-  const steps=stepText(e);
-  assert.ok(steps.includes('Z turn on --send; --send was given\n'),steps);assert.ok(steps.includes(`Z turn on --sso; drop ${DROPS}\n`),steps);
-  r=await prun(e,'status','acme');assert.equal(r.code,0,r.err);assert.match(r.out,/unit flags: match the pointer/);
-  // The same copy with send on again is already active.
-  await refused(e,['activate',C1,'acme','--send'],'already-active',`${C1} is the pointer's copy`);
-  await noLeak(e);
- });
- await t.test('T1: --send beside a carried --sso re-pins the live copy once, and the plan names the carried --sso',async(t)=>{
-  const e=await mk(t);await seedPreview(e);await ssoConfig(e);
-  let r=await prun(e,'activate',C1,'acme','--sso');assert.equal(r.code,0,r.out+r.err);
-  assert.deepEqual(pointer(e).console,['--port',e.port,'--business','acme','--sso']);
-  const out=await planOnly(e,0,'activate',C1,'acme','--send');
-  assert.deepEqual([...sendLines(out),...ssoLines(out)],['send: on; --send was given','sso: carried']);
-  assert.ok(out.includes(NOTE(C1)),out.join('\n'));
-  r=await prun(e,'activate',C1,'acme','--send');assert.equal(r.code,0,r.out+r.err);
-  const l=logLines(e).at(-1);assert.deepEqual([l.op,l.from,l.to,l.result],['activate',C1,C1,'ok']);
-  const want=['--port',e.port,'--business','acme','--sso','--send'];
-  assert.deepEqual(pointer(e).console,want);assert.ok(conExec(e).endsWith(` --checkout ${repo} ${want.join(' ')}`),conExec(e));
-  assert.ok(stepText(e).includes('Z turn on --send; --send was given\n'));assert.doesNotMatch(stepText(e),/^\S+Z .*sso/m);
-  await refused(e,['activate',C1,'acme','--send'],'already-active',`${C1} is the pointer's copy`);
-  // Another copy carries both.
-  assert.deepEqual(sendLines(await planOnly(e,0,'activate',C,'acme','--send')),['send: carried']);
-  r=await prun(e,'status','acme');assert.equal(r.code,0,r.err);assert.match(r.out,/unit flags: match the pointer/);
-  await noLeak(e);
- });
- await t.test('T2: --send without --sso, given or carried, refuses before any stop, and --plan lists it',async(t)=>{
-  const e=await mk(t);await seedPreview(e);
-  await refused(e,['activate',C1,'acme','--send'],'send-needs-sso',SEND_MSG);
-  await refused(e,['activate',B,'acme','--send'],'send-needs-sso',SEND_MSG);
-  const out=await planOnly(e,3,'activate',C1,'acme','--send');
-  assert.deepEqual(sendLines(out),['send: off']);
-  assert.deepEqual(out.filter((l)=>l.startsWith('refuses ')),[`refuses send-needs-sso: ${SEND_MSG}`]);
-  // A pointer that already holds --send without --sso still refuses a --send.
-  const g=await mk(t);await seedPreview(g,undefined,['--send']);
-  await refused(g,['activate',C1,'acme','--send'],'send-needs-sso',SEND_MSG);
-  await refused(g,['activate',B,'acme','--send'],'already-active',`${B} is the pointer's copy`);
-  for(const x of [e,g])await noLeak(x);
- });
- await t.test('T2 (sage-2315 B1): a rollback from an --sso --send pointer to a Console without --sso ends with neither flag',async(t)=>{
-  const e=await mk(t),base=await seedPreview(e);await ssoConfig(e);
-  let r=await prun(e,'activate',C1,'acme','--sso','--send');assert.equal(r.code,0,r.out+r.err);
-  assert.deepEqual(pointer(e).console,['--port',e.port,'--business','acme','--sso','--send']);
-  const set=arrivalSet(e,C1);
-  setKey(e,undefined);
-  const out=await planOnly(e,0,'rollback','acme');
-  assert.deepEqual([...sendLines(out),...ssoLines(out)],['send: dropped; the run drops --sso, and --send needs it (F39)',ROLLBACK_PLAN(set)]);
-  assert.equal(out.find((l)=>l.startsWith('Console: ')),`Console: scripts/webui-service.sh install --copy ${B} --copies ${COPIES} ${base.join(' ')}`);
-  r=await prun(e,'rollback','acme');assert.equal(r.code,0,r.out+r.err);
-  assert.equal(pointer(e).copy,B);assert.deepEqual(pointer(e).console,base);
-  assert.doesNotMatch(conExec(e),/ --sso( |$)| --send( |$)/);assert.ok(conExec(e).endsWith(` --checkout ${repo} ${base.join(' ')}`),conExec(e));
-  assert.ok(stepText(e).includes('Z drop --send; the run drops --sso\n'),stepText(e));
-  r=await prun(e,'status','acme');assert.equal(r.code,0,r.err);assert.match(r.out,/unit flags: match the pointer/);
-  await noLeak(e);
- });
- await t.test('T2 and T4: --send with --no-send, --no-sso with --sso, --send, a pair or --no-proof, and either flag on another verb, is a usage error',async(t)=>{
-  const e=await mk(t);await seedPreview(e);await ssoConfig(e);const f=await proofFile(e);
-  let r=await prun(e,'activate',C1,'acme','--sso','--send');assert.equal(r.code,0,r.out+r.err);
-  const usageText=(await prun(e,'--help')).err,n=calls(e).length,logs=logLines(e).length,before=fp(e);
-  for(const args of [['activate',C1,'acme','--send','--no-send'],['activate',C1,'acme','--no-send','--send','--plan'],['activate',C1,'acme','--sso','--send','--no-send'],
-   ['activate',C1,'acme','--no-sso','--sso'],['activate',C1,'acme','--sso','--no-sso','--plan'],['activate',C1,'acme','--no-sso','--send'],
-   ['activate',C1,'acme','--no-sso',...pair(f)],['activate',C1,'acme','--no-sso','--no-proof'],
-   ['rollback','acme','--send'],['rollback','acme','--no-sso'],['pm-on','acme','--send'],['pm-on','acme','--no-sso'],['status','acme','--no-sso'],['adopt','acme','--send']]){
-   r=await prun(e,...args);assert.equal(r.code,4,args.join(' '));assert.equal(r.out,'');assert.equal(r.err,usageText);
-  }
-  assert.match(usageText,/\[--proof-header NAME --proof-file PATH \| --no-proof \| --sso \| --no-sso\] \[--send \| --no-send\]/);
-  assert.match(usageText,/\n--send needs --sso in the run's Console flags, given or carried\. --no-sso needs --sso in the\n/);
-  assert.deepEqual(fp(e),before);assert.deepEqual(startsStops(e,n),[]);assert.equal(logLines(e).length,logs);
-  await noLeak(e);
- });
- await t.test('T3: --no-sso on the same copy returns the unit and the pointer to the flags from before --sso, without --send',async(t)=>{
-  const e=await mk(t),base=await seedPreview(e,undefined,['--send','--tester-port','7333']);await ssoConfig(e);
-  let r=await prun(e,'activate',C1,'acme');assert.equal(r.code,0,r.out+r.err);
-  const pre=conExec(e),want=noSend(base);
-  assert.ok(pre.endsWith(` ${base.join(' ')}`),pre);
-  r=await prun(e,'activate',C1,'acme','--sso');assert.equal(r.code,0,r.out+r.err);
-  const set=setOf(e,pointer(e).activation);
-  assert.deepEqual(pointer(e).console,['--port',e.port,'--business','acme','--sso','--send','--tester-port','7333']);
-  const out=await planOnly(e,0,'activate',C1,'acme','--no-sso');
-  assert.deepEqual([...proofLines(out),...sendLines(out),...ssoLines(out)],['proof: off','send: dropped; --no-sso drops --send (F39)',OFF_PLAN(set,want.slice(0,-2).join(' '))]);
-  assert.ok(out.includes(NOTE(C1)),out.join('\n'));
-  assert.equal(out[out.findIndex((l)=>l.startsWith('sso:'))+1],`Console: scripts/webui-service.sh install --copy ${C1} --copies ${COPIES} ${want.join(' ')}`);
-  r=await prun(e,'activate',C1,'acme','--no-sso');assert.equal(r.code,0,r.out+r.err);
-  const l=logLines(e).at(-1);assert.deepEqual([l.op,l.from,l.to,l.result],['activate',C1,C1,'ok']);
-  assert.equal(pointer(e).copy,C1);assert.deepEqual(pointer(e).console,want);
-  assert.equal(conExec(e),pre.replace(' --send --tester-port 7333',' --tester-port 7333'));
-  const steps=stepText(e);
-  assert.ok(steps.includes('Z drop --send; --no-sso was given\n'),steps);
-  assert.ok(steps.includes(`Z turn off --sso; the Console flags come from ${set}/${SHOW}\n`),steps);
-  r=await prun(e,'status','acme');assert.equal(r.code,0,r.err);assert.match(r.out,/unit flags: match the pointer/);
-  // --sso is off now, so a second --no-sso has nothing to turn off.
-  await refused(e,['activate',C1,'acme','--no-sso'],'sso-not-on',NOT_ON_MSG);
-  await noLeak(e);
- });
- await t.test('T3: the set walk passes later re-pins that ran with --sso, and the tester follows the pointer',async(t)=>{
-  const e=await mk(t),base=await seedPreview(e,undefined,['--send','--tester-port','7333']);await ssoConfig(e);
-  // The activation that turns --sso on also moves the tester to 7334, so the set and the pointer differ.
-  let r=await prun(e,'activate',C1,'acme','--sso','--tester-port','7334');assert.equal(r.code,0,r.out+r.err);
-  const set=setOf(e,pointer(e).activation);
-  r=await prun(e,'activate',C1,'acme','--no-send');assert.equal(r.code,0,r.out+r.err);
-  assert.match(readFileSync(join(setOf(e,pointer(e).activation),SHOW),'utf8'),/ --sso /);
-  assert.deepEqual(pointer(e).console,['--port',e.port,'--business','acme','--sso','--tester-port','7334']);
-  const restores=base.slice(0,-3),want=[...restores,'--tester-port','7334'];
-  const out=await planOnly(e,0,'activate',C1,'acme','--no-sso');
-  assert.deepEqual([...sendLines(out),...ssoLines(out)],['send: off; --no-sso was given and the pointer holds no --send',OFF_PLAN(set,restores.join(' '))]);
-  r=await prun(e,'activate',C1,'acme','--no-sso');assert.equal(r.code,0,r.out+r.err);
-  assert.deepEqual(pointer(e).console,want);assert.ok(conExec(e).endsWith(` --checkout ${repo} ${want.join(' ')}`),conExec(e));
-  assert.doesNotMatch(stepText(e),/drop --send/);
-  r=await prun(e,'status','acme');assert.equal(r.code,0,r.err);assert.match(r.out,/unit flags: match the pointer/);
-  await noLeak(e);
- });
- await t.test('T3 (sage-2305 a): after --sso, two later re-pins that carry it, then --no-sso restores the flags from before --sso byte for byte',async(t)=>{
-  const e=await mk(t),base=await seedPreview(e,undefined,['--tester-port','7333']);await ssoConfig(e);
-  let r=await prun(e,'activate',C1,'acme');assert.equal(r.code,0,r.out+r.err);
-  const pre=conExec(e);assert.ok(pre.endsWith(` ${base.join(' ')}`),pre);
-  r=await prun(e,'activate',C1,'acme','--sso');assert.equal(r.code,0,r.out+r.err);
-  const set=setOf(e,pointer(e).activation);
-  // Two same-copy re-pins carry --sso, so the two newest sets both hold a Console with it.
-  r=await prun(e,'activate',C1,'acme','--send');assert.equal(r.code,0,r.out+r.err);
-  r=await prun(e,'activate',C1,'acme','--no-send');assert.equal(r.code,0,r.out+r.err);
-  const acts=logLines(e).filter((l)=>l.result==='ok'&&l.op==='activate').map((l)=>l.activation).slice(-2);
-  for(const a of acts)assert.match(readFileSync(join(setOf(e,a),SHOW),'utf8'),/ --sso /);
-  const out=await planOnly(e,0,'activate',C1,'acme','--no-sso');
-  assert.deepEqual(ssoLines(out),[OFF_PLAN(set,base.slice(0,-2).join(' '))]);
-  r=await prun(e,'activate',C1,'acme','--no-sso');assert.equal(r.code,0,r.out+r.err);
-  assert.deepEqual(pointer(e).console,base);assert.equal(conExec(e),pre);
-  r=await prun(e,'status','acme');assert.equal(r.code,0,r.err);assert.match(r.out,/unit flags: match the pointer/);
-  await noLeak(e);
- });
- await t.test('T4 (sage-2305 b): a log in which every set holds a Console with --sso refuses before any unit stops',async(t)=>{
-  const e=await mk(t);await seedPreview(e,undefined,['--send']);await ssoConfig(e);
-  let r=await prun(e,'activate',C1,'acme','--sso');assert.equal(r.code,0,r.out+r.err);
-  const first=setOf(e,pointer(e).activation);
-  r=await prun(e,'activate',C1,'acme','--no-send');assert.equal(r.code,0,r.out+r.err);
-  assert.match(readFileSync(join(setOf(e,pointer(e).activation),SHOW),'utf8'),/ --sso /);
-  // The set of the activation that turned --sso on now claims its Console ran with it too, sums intact.
-  setEdit(first,SHOW,' --public-host ',' --sso --public-host ');
-  const why=OFF_MSG(`the Console in ${join(first,SHOW)} already ran with --sso, and the log names no earlier activation`);
-  await refused(e,['activate',C1,'acme','--no-sso'],'sso-off-flags',why);
-  assert.deepEqual((await planOnly(e,3,'activate',C1,'acme','--no-sso')).filter((l)=>l.startsWith('refuses ')),[`refuses sso-off-flags: ${why}`]);
-  await noLeak(e);
- });
- await t.test('T4: --no-sso refuses before any stop on a pointer without --sso, a tampered or missing set, a set that ran with --sso, an ok line with no activation, and a log with no set',async(t)=>{
-  const e=await mk(t);await seedPreview(e,undefined,['--send']);
-  await refused(e,['activate',B,'acme','--no-sso'],'sso-not-on',NOT_ON_MSG);
-  await refused(e,['activate',C1,'acme','--no-sso'],'sso-not-on',NOT_ON_MSG);
-  assert.deepEqual((await planOnly(e,3,'activate',C1,'acme','--no-sso')).filter((l)=>l.startsWith('refuses ')),[`refuses sso-not-on: ${NOT_ON_MSG}`]);
-  // One set, from the activation that turned --sso on.
-  await ssoConfig(e);
-  let r=await prun(e,'activate',C1,'acme','--sso');assert.equal(r.code,0,r.out+r.err);
-  const set=setOf(e,pointer(e).activation),show=join(set,SHOW),text=readFileSync(show,'utf8');
-  // An ok line with no activation stops the walk (sage-2315 N1); skipping it would reach the set above.
-  const logText=readFileSync(e.log,'utf8');
-  appendFileSync(e.log,JSON.stringify({at:'2026-10-22T00:00:00Z',op:'activate',from:C1,to:C1,backup:null,activation:null,result:'ok'})+'\n');
-  await refused(e,['activate',C1,'acme','--no-sso'],'sso-off-flags',OFF_MSG('an ok line in the log names no activation'));
-  writeFileSync(e.log,logText);
-  setEdit(set,SHOW,' --allow-user jason',' --allow-user mallory',false);
-  await refused(e,['activate',C1,'acme','--no-sso'],'sso-off-flags',OFF_MSG(`${show} does not match the set's SHA256SUMS`));
-  assert.deepEqual((await planOnly(e,3,'activate',C1,'acme','--no-sso')).filter((l)=>l.startsWith('refuses ')),[`refuses sso-off-flags: ${OFF_MSG(`${show} does not match the set's SHA256SUMS`)}`]);
-  setEdit(set,SHOW,' --allow-user mallory',' --sso --allow-user jason');
-  await refused(e,['activate',C1,'acme','--no-sso'],'sso-off-flags',OFF_MSG(`the Console in ${show} already ran with --sso, and the log names no earlier activation`));
-  setEdit(set,SHOW,' serve ',' ');
-  await refused(e,['activate',C1,'acme','--no-sso'],'sso-off-flags',OFF_MSG(`${show} holds no Console argv this script can read`));
-  rmSync(show);
-  await refused(e,['activate',C1,'acme','--no-sso'],'sso-off-flags',OFF_MSG(`${set} has no ${SHOW} and SHA256SUMS`));
-  writeFileSync(show,text);setEdit(set,SHOW,'\n','\n');
-  r=await prun(e,'activate',C1,'acme','--no-sso');assert.equal(r.code,0,r.out+r.err);
-  assert.doesNotMatch(conExec(e),/ --sso( |$)| --send( |$)/);
-  // A pointer with --sso and only the adopt line: no activation took a set.
-  const g=await mk(t);await seedPreview(g,undefined,['--sso']);
-  await refused(g,['activate',C1,'acme','--no-sso'],'sso-off-flags',OFF_MSG('the log names no activation with a rollback set'));
-  for(const x of [e,g])await noLeak(x);
- });
-});
-
 // --- rehearse (D2, row 163; the brief's "Stack rehearsal on a scratch root") ---
 // Copies of their own in RCOPIES: the real scripts/mosaic, config loader, business loader, roles and
 // mosaic-config.mjs, with stand-ins for the bus host (cli.mjs), the Console, the Store and

scripts/stack-release.sh

@@ -5,8 +5,6 @@
 # Console tester listener flags follow target support (row 176, #1674); so does the row 178 proof
 # pair, which activate sets or drops (row 187, #1685). activate --no-send drops --send (row 189, #1687).
 # activate --sso swaps the preview set and the pair for the Console's own sign-in (row 200, #1698).
-# activate --send turns send on, only beside --sso, and activate --no-sso turns --sso off with the
-# Console flags from before it, dropping --send (row 273, #1778, mos-1246 F39).
 # Design and tests: agents/darkwing/work/queue-162/BUILD.md.
 #
 # Who runs it. Decision 96 (Mos, mos-0716) lets this script stop and start the live units under
@@ -40,14 +38,14 @@ COPIES="${XDG_DATA_HOME:-$HOME/.local/share}/mosaic-stack/copies"
 BIN="$HOME/.npm-global/bin"
 UNIT_DIR="${XDG_CONFIG_HOME:-$HOME/.config}/systemd/user"
 TIMEOUT=60 WANT_PM=0 AFTER_HARNESS=0 MIGRATE=0 PLAN=0 RESTORE="" EVENTS="" TESTER_PORT="" TESTER_SOCKET=0 EXPECTED_INTERPRETER=""
-PROOF_HEADER="" PROOF_FILE="" NO_PROOF=0 NO_SEND=0 SEND=0 SSO=0 NO_SSO=0 R_BACKUP="" R_PORT=""
+PROOF_HEADER="" PROOF_FILE="" NO_PROOF=0 NO_SEND=0 SSO=0 R_BACKUP="" R_PORT=""
 UNITS=user TO_FLAG="" EXPECT_FROM="" SINCE="" ROLLBACK_OLD="" CAUSE=""
 
 usage() {
     cat >&2 <<'USAGE'
 usage: stack-release.sh adopt BUSINESS
        stack-release.sh activate ID BUSINESS [--pm | --pm-after-harness] [--migrate] [--tester-socket | --tester-port N (legacy copies)]
-           [--proof-header NAME --proof-file PATH | --no-proof | --sso | --no-sso] [--send | --no-send] [--timeout S] [--plan]
+           [--proof-header NAME --proof-file PATH | --no-proof | --sso] [--no-send] [--timeout S] [--plan]
        stack-release.sh pm-on BUSINESS [--timeout S]
        stack-release.sh rollback BUSINESS [--restore ACTIVATION [--events N]] [--timeout S] [--plan]
        stack-release.sh status BUSINESS
@@ -63,9 +61,7 @@ every table in COUNTED.
 --units external (row 232) reads root's system units and starts or stops none. adopt, activate,
 rollback, status, confirm, revert and gate take it; rollback then needs --to ID, the previous copy.
 activate and rollback --plan take --expect-from OLD. --pm, --pm-after-harness, --tester-port, the
-proof flags, --no-proof, --send, --no-send, --sso, --no-sso and pm-on are not for it.
---send needs --sso in the run's Console flags, given or carried. --no-sso needs --sso in the
-pointer's, and takes the Console flags from the rollback set of the activation that turned it on.
+proof flags, --no-proof, --no-send, --sso and pm-on are not for it.
 USAGE
     exit "${1:-4}"
 }
@@ -132,9 +128,7 @@ parse_opts() {
             --proof-file) [ "$OP" = activate ] && [ $# -ge 2 ] && [ -n "$2" ] || usage; PROOF_FILE="$2"; shift 2 ;;
             --no-proof) [ "$OP" = activate ] || usage; NO_PROOF=1; shift ;;
             --no-send) [ "$OP" = activate ] || usage; NO_SEND=1; shift ;;
-            --send) [ "$OP" = activate ] || usage; SEND=1; shift ;;
             --sso) [ "$OP" = activate ] || usage; SSO=1; shift ;;
-            --no-sso) [ "$OP" = activate ] || usage; NO_SSO=1; shift ;;
             --migrate) [ "$OP" = activate ] || usage; MIGRATE=1; shift ;;
             --restore) [ "$OP" = rollback ] && [ $# -ge 2 ] && [[ "$2" =~ ^[0-9]{8}T[0-9]{6}Z-[0-9a-f]{12}(-[1-9])?$ ]] || usage; RESTORE="$2"; shift 2 ;;
             --backup) [ "$OP" = rehearse ] && [ $# -ge 2 ] && { [ "$2" = last ] || [[ "$2" =~ ^[0-9]{8}T[0-9]{6}Z-[0-9a-f]{12}(-[1-9])?$ ]] || [[ "$2" =~ ^/[A-Za-z0-9/._+-]*$ ]]; } || usage; R_BACKUP="$2"; shift 2 ;;
@@ -156,8 +150,7 @@ parse_opts() {
         [ "$OP" != confirm ] && [ "$OP" != revert ] && [ "$OP" != gate ] && [ -z "$TO_FLAG" ] && [ -z "$EXPECT_FROM" ] || usage
     else
         [ "$OP" != rollback ] || [ -n "$TO_FLAG" ] || usage
-        [ "$TESTER_SOCKET" = 0 ] && [ "$WANT_PM" = 0 ] && [ -z "$TESTER_PORT" ] && [ -z "$PROOF_HEADER" ] && [ -z "$PROOF_FILE" ] && [ "$NO_PROOF" = 0 ] && [ "$NO_SEND" = 0 ] && [ "$SSO" = 0 ] &&
-            [ "$SEND" = 0 ] && [ "$NO_SSO" = 0 ] || usage
+        [ "$TESTER_SOCKET" = 0 ] && [ "$WANT_PM" = 0 ] && [ -z "$TESTER_PORT" ] && [ -z "$PROOF_HEADER" ] && [ -z "$PROOF_FILE" ] && [ "$NO_PROOF" = 0 ] && [ "$NO_SEND" = 0 ] && [ "$SSO" = 0 ] || usage
     fi
     [ "$OP" != gate ] || [ -n "$SINCE" ] || usage
     [ -z "$EXPECT_FROM" ] || [ "$PLAN" = 1 ] || usage
@@ -174,10 +167,6 @@ parse_opts() {
     [ "$NO_PROOF" = 0 ] || [ -z "$PROOF_HEADER" ] || usage
     # --sso drops the pair itself, so it takes neither a pair nor --no-proof (row 200).
     [ "$SSO" = 0 ] || { [ -z "$PROOF_HEADER" ] && [ "$NO_PROOF" = 0 ]; } || usage
-    # Row 273: --send and --no-send contradict. --no-sso takes its Console flags from a rollback set
-    # and drops --send, so it goes with no --sso, --send, pair or --no-proof.
-    [ "$SEND" = 0 ] || [ "$NO_SEND" = 0 ] || usage
-    [ "$NO_SSO" = 0 ] || { [ "$SSO" = 0 ] && [ "$SEND" = 0 ] && [ -z "$PROOF_HEADER" ] && [ "$NO_PROOF" = 0 ]; } || usage
     local d
     for d in "$COPIES" "$BIN"; do
         case "$d" in /*) ;; *) usage ;; esac
@@ -236,8 +225,7 @@ for(const k of open.keys())process.stdout.write(k+"\n");' -- "$LOG"
 # line that made the pointer's copy live, the backup a rollback would restore. `newest` prints the
 # backup field of the newest line that has one, rehearse's --backup last (row 233). `arrival` prints the
 # activation and `from` of the line that moved the stack onto the pointer's copy from another one,
-# past any same-copy re-pin after it (row 200, sage-1389). `sets` prints the activation of each
-# activate and rollback, newest first, back to the adopt line, whose run took no rollback set (row 273).
+# past any same-copy re-pin after it (row 200, sage-1389).
 from_log() {
     [ -f "$LOG" ] || return 1
     node -e '
@@ -246,13 +234,12 @@ const lines=require("fs").readFileSync(file,"utf8").split("\n").filter((l)=>l.tr
 for(const l of lines.reverse()){
   let o;try{o=JSON.parse(l)}catch{continue}
   if(o.result!=="ok"||!["adopt","activate","rollback"].includes(o.op)||!o.to)continue;
-  if(mode==="sets"){if(o.op==="adopt")process.exit(0);process.stdout.write(`${o.activation??""}\n`);continue}
   if(mode==="previous"&&o.to!==current){process.stdout.write(o.to+"\n");process.exit(0)}
   if(mode==="backup"&&o.to===current){if(o.backup)process.stdout.write(o.backup+"\n");process.exit(o.backup?0:1)}
   if(mode==="newest"&&o.backup){process.stdout.write(o.backup+"\n");process.exit(0)}
   if(mode==="arrival"&&o.to===current&&o.from!==current){process.stdout.write(`${o.activation??""} ${o.from??""}\n`);process.exit(0)}
 }
-process.exit(mode==="sets"?0:1);' -- "$LOG" "$1" "$P_COPY"
+process.exit(1);' -- "$LOG" "$1" "$P_COPY"
 }
 
 # --- Reading the units ---
@@ -336,18 +323,15 @@ in_chain() { local v; for v in "${T_CHAIN[@]}"; do [ "$v" != "$1" ] || return 0;
 
 # The item 3 checks on the target copy, in order: copy, schema, already-active. An activate that
 # sets a proof pair, drops the pointer's pair with --no-proof, drops the pointer's --send with
-# --no-send, turns on --sso, turns on --send, or turns off --sso may name the pointer's copy: it
-# re-pins the live copy with new Console flags (row 187, Part B's B3 and B-R1; row 189, mos-0972;
-# row 200, the phase 2 window; row 273). --no-sso on a pointer without --sso gets past here and
-# refuses sso-not-on in no_sso_base, which names the reason.
+# --no-send, or turns on --sso, may name the pointer's copy: it re-pins the live copy with new
+# Console flags (row 187, Part B's B3 and B-R1; row 189, mos-0972; row 200, the phase 2 window).
 check_target() {
     copy_exists "$TO" 2>/dev/null || refuse copy-missing "no copy $TO in $COPIES"
     copy_ok "$TO" 2>/dev/null || refuse copy-unreachable "$TO is not reachable from refactor and origin/refactor"
     target_schema "$TO" || refuse copy-schema-unknown "cannot read SCHEMA_VERSION and its chain from $COPIES/$TO/packages/bus/src/store.mjs"
-    [ "$TO" != "$P_COPY" ] || [ -n "$PROOF_HEADER" ] || [ "$NO_SSO" = 1 ] ||
+    [ "$TO" != "$P_COPY" ] || [ -n "$PROOF_HEADER" ] ||
         { [ "$NO_PROOF" = 1 ] && [[ " ${P_CONSOLE[*]} " == *" --proof-header "* ]]; } ||
         { [ "$NO_SEND" = 1 ] && [[ " ${P_CONSOLE[*]} " == *" --send "* ]]; } ||
-        { [ "$SEND" = 1 ] && [[ " ${P_CONSOLE[*]} " != *" --send "* ]]; } ||
         { [ "$SSO" = 1 ] && [[ " ${P_CONSOLE[*]} " != *" --sso "* ]]; } ||
         refuse already-active "$TO is the pointer's copy"
 }
@@ -870,17 +854,21 @@ has_flag() { local f="$1"; shift; [[ " $* " == *" $f "* ]]; }
 # skips sso_checks after a refusal here, so --plan lists that refusal alone.
 sso_base() {
     BASE_CONSOLE=("${P_CONSOLE[@]}") SSO_PLAN="" SSO_STEP="" SSO_NO_TARGET=""
-    if [ "$NO_SSO" = 1 ]; then no_sso_base; return 0; fi
     has_flag --sso "${P_CONSOLE[@]}" || return 0
     [ "$SSO" = 1 ] || SSO_PLAN="sso: carried"
     [ "$OP" = rollback ] && ! sso_supported || return 0
-    local f="show-$CONSOLE_UNIT.txt" why="" act="" from="" set
+    local f="show-$CONSOLE_UNIT.txt" argv="" why="" act="" from="" set
     read -r act from <<< "$(from_log arrival || true)"
     set="$STATE/stack-rollback/$act"
     if [ "$from" != "$TO" ]; then why="the log names no activation that moved the stack from $TO onto $P_COPY"
     elif ! [[ "$act" =~ ^[0-9]{8}T[0-9]{6}Z-[0-9a-f]{12}(-[1-9])?$ ]]; then why="the activation $act that moved the stack onto $P_COPY names no rollback set"
-    elif ! set_flags "$set"; then why="$SET_WHY"
-    elif has_flag --sso "${SERVE_FLAGS[@]}"; then why="the Console in $set/$f already ran with --sso"
+    elif [ ! -f "$set/$f" ] || [ ! -f "$set/SHA256SUMS" ]; then why="$set has no $f and SHA256SUMS"
+    elif [ "$(sum_of "$set" "$f")" != "$(sha256sum < "$set/$f" | cut -d' ' -f1)" ]; then why="$set/$f does not match the set's SHA256SUMS"
+    else
+        argv="$(argv_of "$(cat "$set/$f")")"
+        if ! unquoted "$argv" || ! serve_flags "$argv"; then why="$set/$f holds no Console argv this script can read"
+        elif has_flag --sso "${SERVE_FLAGS[@]}"; then why="the Console in $set/$f already ran with --sso"
+        fi
     fi
     if [ -n "$why" ]; then
         SSO_NO_TARGET=1
@@ -888,8 +876,7 @@ sso_base() {
         return 0
     fi
     # --send and --tester-port follow the pointer, so a --no-send or a tester port set after that
-    # activation stays (row 189's rule that rollback carries --send off). A --send carried here has
-    # lost its --sso, so send_for_target drops it (row 273, F39 b).
+    # activation stays (row 189's rule that rollback carries --send off).
     local i
     BASE_CONSOLE=()
     for ((i = 0; i < ${#SERVE_FLAGS[@]}; i++)); do
@@ -907,79 +894,10 @@ sso_base() {
             --tester-socket) BASE_CONSOLE+=(--tester-socket) ;;
         esac
     done
-    SSO_PLAN="sso: dropped; $TO's Console does not support --sso, so the rollback takes the Console flags from $set/$f, with --tester-port as the pointer has it"
+    SSO_PLAN="sso: dropped; $TO's Console does not support --sso, so the rollback takes the Console flags from $set/$f, with --send and --tester-port as the pointer has them"
     SSO_STEP="drop --sso; $TO's Console does not support it, so the Console flags come from $set/$f"
 }
 
-# Sets SERVE_FLAGS to the Console flags in rollback set $1's show-$CONSOLE_UNIT.txt, the Console
-# unit as it was before that set's run, checked against the set's SHA256SUMS. Returns 1 with
-# SET_WHY when the file is missing, fails its sum or holds no argv this script can read.
-set_flags() {
-    local set="$1" f="show-$CONSOLE_UNIT.txt" argv
-    SET_WHY=""
-    if [ ! -f "$set/$f" ] || [ ! -f "$set/SHA256SUMS" ]; then SET_WHY="$set has no $f and SHA256SUMS"
-    elif [ "$(sum_of "$set" "$f")" != "$(sha256sum < "$set/$f" | cut -d' ' -f1)" ]; then SET_WHY="$set/$f does not match the set's SHA256SUMS"
-    else
-        argv="$(argv_of "$(cat "$set/$f")")"
-        unquoted "$argv" && serve_flags "$argv" && return 0
-        SET_WHY="$set/$f holds no Console argv this script can read"
-    fi
-    return 1
-}
-
-# Row 273 (#1778, mos-1246 F39 a): activate --no-sso turns --sso off. The Console flags come from the
-# rollback set of the activation that turned --sso on. Each set holds the Console from before its
-# run, so that activation is the newest one whose set holds a Console without --sso: every newer
-# set ran with it. The walk reads the log's activations newest first, back to the adopt line, and
-# refuses at the first set it can't read, since it can't tell whether that set is the one. --send
-# is dropped (F39 a) and the tester follows the pointer. Sets BASE_CONSOLE, SSO_PLAN and SSO_STEP.
-no_sso_base() {
-    local f="show-$CONSOLE_UNIT.txt" why="" act set="" found=0 i restored=""
-    local -a acts=()
-    if ! has_flag --sso "${P_CONSOLE[@]}"; then
-        check_refuse sso-not-on "the pointer's Console flags hold no --sso, so --no-sso has nothing to turn off"
-        return 0
-    fi
-    # An empty entry is an ok line with no activation; skipping it could land on an older set.
-    mapfile -t acts < <(from_log sets || true)
-    for act in "${acts[@]}"; do
-        set="$STATE/stack-rollback/$act"
-        if [ -z "$act" ]; then why="an ok line in the log names no activation"; break; fi
-        if ! [[ "$act" =~ ^[0-9]{8}T[0-9]{6}Z-[0-9a-f]{12}(-[1-9])?$ ]]; then why="the activation $act names no rollback set"; break; fi
-        set_flags "$set" || { why="$SET_WHY"; break; }
-        has_flag --sso "${SERVE_FLAGS[@]}" || { found=1; break; }
-    done
-    if [ -z "$why" ] && [ "$found" = 0 ]; then
-        if [ -z "$set" ]; then why="the log names no activation with a rollback set"
-        else why="the Console in $set/$f already ran with --sso, and the log names no earlier activation"
-        fi
-    fi
-    if [ -n "$why" ]; then
-        SSO_NO_TARGET=1
-        check_refuse sso-off-flags "the Console flags from before --sso cannot be read: $why"
-        return 0
-    fi
-    # A --send in the set stays here: send_for_target is the one place that drops it, so the
-    # restores list leaves it out.
-    BASE_CONSOLE=()
-    for ((i = 0; i < ${#SERVE_FLAGS[@]}; i++)); do
-        case "${SERVE_FLAGS[i]}" in
-            --tester-port) i=$((i + 1)) ;;
-            --tester-socket) ;;
-            *) BASE_CONSOLE+=("${SERVE_FLAGS[i]}")
-               [ "${SERVE_FLAGS[i]}" = --send ] || restored+="${restored:+ }${SERVE_FLAGS[i]}" ;;
-        esac
-    done
-    for ((i = 0; i < ${#P_CONSOLE[@]}; i++)); do
-        case "${P_CONSOLE[i]}" in
-            --tester-port) i=$((i + 1)); BASE_CONSOLE+=(--tester-port "${P_CONSOLE[i]:-}") ;;
-            --tester-socket) BASE_CONSOLE+=(--tester-socket) ;;
-        esac
-    done
-    SSO_PLAN="sso: off; Console flags from $set/$f; restores ${restored:-nothing}"
-    SSO_STEP="turn off --sso; the Console flags come from $set/$f"
-}
-
 # Row 200 (#1698): activate --sso drops the preview set and the proof pair, which serve refuses beside
 # it, and puts --sso where webui-service.sh renders it: after the other flags, before --send and
 # --tester-port. Sets SSO_DROP (the plan's dropped preview flags), PROOF_PLAN and PROOF_STEP.
@@ -1099,53 +1017,14 @@ process.exit(d!==null&&typeof d==="object"&&Object.hasOwn(d,"console")?0:1)' --
 # Row 189 (mos-0972): --no-send drops --send from RUN_CONSOLE, so the unit and the pointer both lose
 # it; without the flag the pointer's --send goes on unchanged. Rollback and pm-on never take it, so
 # they carry the pointer as it is. Sets SEND_PLAN (the plan's send: line) and SEND_STEP.
-# Row 273 (mos-1246 F39): under forward auth any same-uid process can send as the signed-in user
-# through the Console's port, so --send turns send on only when the run's Console flags hold --sso,
-# given or carried. --no-sso drops the pointer's --send, and so does a rollback to a Console without
-# --sso.
 send_for_target() {
     local had=0 i
-    local -a without_send=() with_send=()
+    local -a without_send=()
     for ((i = 0; i < ${#RUN_CONSOLE[@]}; i++)); do
         if [ "${RUN_CONSOLE[i]}" = --send ]; then had=1; else without_send+=("${RUN_CONSOLE[i]}"); fi
     done
     SEND_STEP=""
-    if [ "$NO_SSO" = 1 ]; then
-        RUN_CONSOLE=("${without_send[@]}")
-        if has_flag --send "${P_CONSOLE[@]}"; then
-            SEND_PLAN="send: dropped; --no-sso drops --send (F39)"
-            SEND_STEP="drop --send; --no-sso was given"
-        else
-            SEND_PLAN="send: off; --no-sso was given and the pointer holds no --send"
-        fi
-    elif has_flag --sso "${P_CONSOLE[@]}" && ! has_flag --sso "${RUN_CONSOLE[@]}"; then
-        # Row 273 (F39 b): a rollback to a Console without --sso drops it, and --send goes with it.
-        RUN_CONSOLE=("${without_send[@]}")
-        if [ "$had" = 1 ]; then
-            SEND_PLAN="send: dropped; the run drops --sso, and --send needs it (F39)"
-            SEND_STEP="drop --send; the run drops --sso"
-        else
-            SEND_PLAN="send: off"
-        fi
-    elif [ "$SEND" = 1 ]; then
-        if ! has_flag --sso "${RUN_CONSOLE[@]}"; then
-            SEND_PLAN="send: off"
-            check_refuse send-needs-sso "--send needs --sso in the run's Console flags, given or carried; under forward auth any same-uid process could send (F39)"
-            return 0
-        fi
-        if [ "$had" = 1 ]; then
-            SEND_PLAN="send: carried"
-            return 0
-        fi
-        # webui-service.sh renders --send after --sso, before the tester flags.
-        for ((i = 0; i < ${#RUN_CONSOLE[@]}; i++)); do
-            case "${RUN_CONSOLE[i]}" in --tester-port | --tester-socket) break ;; esac
-            with_send+=("${RUN_CONSOLE[i]}")
-        done
-        RUN_CONSOLE=("${with_send[@]}" --send "${RUN_CONSOLE[@]:i}")
-        SEND_PLAN="send: on; --send was given"
-        SEND_STEP="turn on --send; --send was given"
-    elif [ "$NO_SEND" = 1 ]; then
+    if [ "$NO_SEND" = 1 ]; then
         RUN_CONSOLE=("${without_send[@]}")
         if [ "$had" = 1 ]; then
             SEND_PLAN="send: dropped; --no-send was given"