morgana: row 267 assertion diff for Mos (sage-4389 finding b, mos-1272): survey.test.mjs:75 gains R8 0

BUILD-LOG.md

@@ -5583,3 +5583,5 @@ claim. Receipts and limitations in agents/lena/work/queue-296/BUILD.md and run-r
 
 2026-10-24 — Magica row329 R2 (#1827): B1 ASCII-only management key fix verified with complete-tree refusals and positive auth control; package66/66,30bus readers261/261,49CLI readers726/726,config55/55, no required skip/failure. N1 corrects R1 bus total to1019; N3 stale-lock guidance and N4 34-code inventory corrected. Two over-selected file runs are recorded separately, with no F7 inference; cause unknown/Vikunja625. Old502 test/helper files byte-identical, slot returned to Sage. Evidence agents/magica/work/queue-329/BUILD.md.
 2026-10-24T23:37:46Z | Sage | Row 329 (#1827, P1 pinned model proxy, Magica) LANDED 61ebf2c34, pushed 23:31:27Z 10-24. Before: refactor at 669cdf42c. After: Magica's 4 commits (94cde633e, c65fb34ee, d1f6f2b19, 61ebf2c34) cherry-picked onto 669cdf42c, diff vs the gated tree limited to drift paths, range-diff in scratch. Gate: one unchanged full landing gate in /mnt/storage/scratch/sage-r329l/wt (gate.sh 8b4978887 c8a9bcf94), started 23:08:12Z at load 14.35, GATE GREEN 23:29:14Z at load 8.67, no rerun, no test or timeout edit (mos-1634). Host note: two Codex workers cleaned T3 worktrees from about 23:14Z (mos-1639, Vikunja 632). Approvals: Dewey r2 c31643 rev 4047, Boyd r2 c31642 rev 4048. #1827 comment 31650, closed. Vikunja 237 comment 1109 (stays open for P2-P7); C4 P10 red filed as Vikunja 631. Queue: note rev 4063, done rev 4064, committed b24d917ec. DEFERRED: N2 and R2-N1 bound to row 331, N1 bound to P7. Overlap: row 284 (packages/bus/src/broker.mjs) and row 157 (scripts/mosaic-config.mjs) rebase onto 61ebf2c34 before their gates.
+2026-10-25T00:15:48Z | Sage | Row 284 (#1789, C2-05c library.get scope, Della) LANDED ce0b6ed41, pushed 00:09:52Z 10-25. Before: refactor at 9e2689dff (row 329 landing docs). After: fast-forward to Della's 7 rebased commits 78b932feb..ce0b6ed41; 8 paths, manifest-r4 de505cfd matches the landed tree. Gate: one unchanged full landing gate in /mnt/storage/scratch/sage-r284l/wt (the 329 gate.sh with D and the compose project renamed), started 23:51:19Z at load 1.62, GATE GREEN 00:09:04Z at load 5.20, no rerun, no test or timeout edit. Counts: bus 1020/0, business 283/0, cli 999 pass 1 allowed skip (FED R7), harness 177/0, library 156/0, seat 218/0, webui 458/0, every scripts/test-*.sh rc 0; queue 34 and task 87/93 skips are the standing ones. Della's whole-file runs on ce0b6ed41: library-lookups 12/0, library-tools 5/0, query 34/0. Approval: Webby round 2 delta c31654 rev 4070 (round 1 rev 4062). Overlap sweep: rows 13, 157, 309, gyro/row310 and fethry/row332-p1 clean. #1789 comment 31655, closed. No Vikunja task for the row. Queue: note rev 4071, done rev 4072, committed 7c8dc2033. DEFERRED: Webby N1 (whole-tree listing per get) bound to the next library read-path row; N2 needs nothing; N3 is this gate.
+2026-10-25T00:18:35Z | Sage | Follow-up tasks for mos-1647 item 3 (Q109): Vikunja 633 (P7 cutover, CLIProxyAPI 8.0.42 startup Grok-npm and antigravity version refreshes, from row 332 isolated runs) and 634 (row 284 Webby N1, library get lists the whole tree). DEFERRED gains the 633 entry and the 634 number for row 284 N1. Filing script and receipt in agents/sage/work/vikunja-setup/.

agents/morgana/work/queue-267/BUILD.md

@@ -0,0 +1,171 @@
+# Row 267 (C2-15, #1772): hybrid universes, exclusions, pins and the crossover. Build notes
+
+Morgana, 2026-10-25. Brief: `docs/plans/2026-10-20_case2-rows.md` "C2-15 hybrid universes: exclusions,
+pins and the end-to-end crossover" (blob 85e6fe2e). Reviewer Filbert, gate owner Sage. Claimed at rev 4087.
+Branch `morgana/row267` from refactor 78b69e1e6. Design 1.4 is `agents/gosalyn/work/case2/DESIGN.md`.
+
+Status: draft design. Nothing is built or run. No runs before Sage's CLEAR.
+
+## 1. What the code does today (78b69e1e6)
+
+- `mapping.mjs:119-134` checks only the shape of a constraint. `exclude` is any folder path, and
+  `pin.entity` is any folder path with a scalar value. Nothing checks either against the sources.
+- `query.mjs:52-57` `sees()` reads `exclude` as a path prefix only (`inside(c.exclude, file.path)`). The
+  type form `second/Characters` (`mapping.test.mjs:203`) passes the validator but hides nothing, because
+  no file path starts with `second/`.
+- `reader.mjs:206-210` gives R6 only for a canon link into a universe that is neither the file's own nor
+  one of its sources. A hybrid canon file that links into an excluded source path gets no problem.
+- `guard.mjs:91-97` lets any mix of one hybrid and its sources pass. It doesn't check exclusions.
+- `problems.mjs` has R1-R7 and no R8.
+
+## 2. Design
+
+### 2.1 Validator (`mapping.mjs`)
+
+The validator runs after every universe is read, alongside the existing sources check at `:141-146`,
+because it needs each source's books, playground and supporting lists. For each constraint of a hybrid:
+
+- **Type form:** the first segment is one of the hybrid's `sources`, and the rest is exactly one key of
+  `types`.
+- **Path form:** the path equals, or lies inside, a book folder of one of the sources.
+- Both forms fit: refuse `library-mapping-invalid` ("... reads as both a source/type and a source path").
+- Neither form fits: refuse `library-mapping-invalid` ("... lies inside no book of the hybrid's
+  sources"). This covers a path in the hybrid's own books, in a non-source universe, or unmapped.
+- **Path form under a playground:** a path equal to or inside one of a source's playground prefixes
+  refuses ("... lies under a playground of universes.X, which the hybrid never reads"). "Under" means the
+  path equals the prefix without its trailing `/`, or starts with the prefix.
+- **`pin.entity`:** the same path-form rules apply, with no type form. An entity is one file.
+
+The stored shape stays `{ exclude }` / `{ pin }`. I don't add a `form` field. `library_universe`
+returns `constraints` as they are now, and the index cache digest doesn't change for existing mappings.
+`excluded()` works out the form again each time. It's pure and cheap.
+
+### 2.2 `excluded(mapping, hybrid, path)` (`scope.mjs`)
+
+This returns true when any `exclude` of universe `hybrid` covers `path`:
+
+- **Type form `S/T`:** `path` starts with `${book}/${T}/` for some book of source S.
+- **Path form P:** `path === P` or `path` starts with `${P}/`.
+
+It returns false when `hybrid` isn't a hybrid. It reads only the path (D2). It has three callers:
+
+- `query.mjs` `sees()` replaces its own `inside(c.exclude, ...)` reading with this helper.
+- `reader.mjs` uses it for the excluded-link R6.
+- `guard.mjs` uses it for the excluded cite.
+
+`query-fixture.mjs` `EXCLUSION` (`Book One/Research`) is path form and still fits, so the existing
+C2-05a query tests keep their constants.
+
+### 2.3 Reader: excluded-link R6 and R8
+
+- **Excluded-link R6:** in the canon branch at `:206`, a hybrid file's link to a target where
+  `excluded(mapping, file.universe, to.path)` is true gives `problem('R6', file.path, link.line)`, with
+  the default message. A custom message isn't possible: `mirror.mjs:196-201` `validProblem` accepts a
+  sync-state problem only when `message === RULES[code]`, so a new message would make every later sync
+  state read refuse `library-state-invalid`. The link stays in `file.links`, as the other R-rules leave
+  it. `sees()` already drops it from the hybrid's `links_out`. A link that is both foreign and excluded
+  can't occur, because an excluded path always lies in a source, so each link gets at most one R6.
+- **R8:** a new `RULES.R8` entry reads "pinned value changed". The check runs once per commit, after the
+  link pass, for each pin of each hybrid:
+  - **Entity missing** from `byPath`: R8 at `entity`, with no line. This covers a file that is absent,
+    R1, R2 or R7.
+  - **Entity present:** R8 at `entity`, on the `field` key's line where there is one, unless the parsed
+    front matter holds `field` as a scalar (string, number or boolean) and `String(parsed) ===
+    String(value)`. A list, null, a missing key and unparsed (R3) front matter all count as changed. Under
+    a plain `String()` comparison, `['grey']` would equal `'grey'`, so this rule closes that hole.
+  - **Hybrid versions:** each canon file of the hybrid whose `type` (from `classify`) equals the entity's
+    type, and whose name matches the entity's, is a version of it. Names are the trimmed front matter
+    `name` on both sides. When either file has no text `name`, the file names (stems) compare instead.
+    A version that holds `field` with another value gets R8 at its own path, on that key's line. A version
+    without `field` gets nothing, and neither does any other file that only links to the entity.
+- The entity's type and name come from `classify(mapping, entity)` and the entity's parsed file. When the
+  entity is missing, its stem stands in for the name.
+
+### 2.4 Guard (`guard.mjs`)
+
+After the existing span check at `:91-97`, the guard looks for a hybrid among the cited universes. If
+there is one, and some cite lies in one of its sources while `excluded(mapping, hybrid, c.path)` is true,
+the guard refuses `citation-cross-universe` ("citation N (path) is excluded from hybrid H"). A reply that
+cites only source paths, excluded ones included, has no hybrid among its universes, so it's unchanged.
+
+### 2.5 Setup sheet
+
+`docs/case2/SETUP-SHEET.md` gets one section after "Supporting folders", headed "Making a crossover
+(hybrid) universe". It covers `kind`, `name`, `sources`, `books`, `playground`, `constraints`
+(`exclude` in both forms, `pin`) and `notes`, and says that the continuity role reads and cites the notes.
+It also says that only she edits this entry (C2-04 rule M9).
+
+## 3. Tests and mutants
+
+New files and cases, all on scratch repos under TMPDIR (never /tmp):
+
+- **`packages/library/tests/hybrid.test.mjs` (new):**
+  - A business-file-shaped mapping (fixture `mapping.json` plus a `cross` hybrid) on a repo in her
+    layout's shape.
+  - `find` and `search` in `cross` return its own files plus the sources' canon, each carrying its source
+    universe. They never return a source playground or an excluded path, and this runs once for each
+    exclude form.
+  - `get` keeps `links_out` into the sources and drops excluded targets.
+  - A source universe's lookups never return a `cross` file.
+  - `universeInfo` returns the sources, constraints and notes.
+  - `excluded()` gets unit cases for both forms and for a non-hybrid.
+- **`mapping.test.mjs`:** one case per new refusal: both forms fit, neither fits, the hybrid's own book,
+  an exclude under a source playground, and a pin under a source playground. `second/Characters` at
+  `:203` still checks.
+- **`reader.test.mjs`:**
+  - R8 cases: entity missing, entity changed, a same-name hybrid version with no link, and a list value.
+  - Non-R8 cases: a hybrid place file with `age: 300` that links the entity, and a different hybrid
+    character that links it.
+  - The excluded-link R6, once for each exclude form.
+- **`guard.test.mjs`:** a hybrid cite with source canon passes, and a hybrid cite beside an excluded path
+  refuses in both forms. A cite of only an excluded source path passes as that universe's item.
+- **`packages/bus/tests/citation-guard.test.mjs`:** through `citationWorld` with `mapChange` adding the
+  hybrid, the excluded-beside-hybrid send refuses and the `messages` count stays the same.
+- **`packages/bus/tests/library-lookups.test.mjs`:** one broker case, where `library.find` and
+  `library.universe` in the hybrid return what the library tests above assert.
+- **C2-04 M9 rule (agents can't write `projects`), not a mutant:** a case in `packages/business/tests/library-projects-protected.test.mjs` where an organization
+  write that adds a new hybrid universe refuses `organization-projects-protected`. This is outside the
+  brief's "tests in library and bus" list (§4 Q1).
+
+Mutants. Each runs only its own named tests, and the tree is restored after each one.
+
+| # | Mutation | Killed by |
+|---|---|---|
+| X1 | `excluded()` ignores the type form | hybrid.test lookups, type form |
+| X2 | `excluded()` ignores the path form | hybrid.test lookups, path form |
+| X3 | `sees()` keeps its old `inside()` reading | hybrid.test type form |
+| X4 | the validator accepts "both forms fit" | mapping.test |
+| X5 | the validator skips the playground check | mapping.test |
+| X6 | R8 compares with plain `String()` (list equals scalar) | reader.test list value |
+| X7 | a version is matched by link instead of name | reader.test non-R8 cases |
+| X8 | the reader drops the excluded-link R6 | reader.test |
+| X9 | the guard skips the excluded check | guard.test "C2-15 a hybrid cite beside an excluded source path refuses citation-cross-universe, both forms" (the mutant run); bus citation-guard "C2-15 excluded cite beside a hybrid refuses and inserts nothing" also fails |
+
+## 4. Open questions for Sage and Filbert
+
+- **Q1 (manifest):** the C2-04 M9 test lives in `packages/business/tests`, which the brief's file list leaves
+  out. I recommend adding it there, beside the existing C2-04 M9 cases, and putting the business suite on the
+  gate. The alternative is a bus-level `organization.set` test, which needs more setup and tests the
+  same writer.
+- **Q2 (supporting):** the brief refuses a path under a source's playground. A source's supporting
+  prefix is never read by the hybrid either (`sees()` passes canon only). I recommend refusing that too,
+  under the same REQ-LIB-3 reason. That widens the brief by one rule, so I need a yes.
+- **Q3 (R8 reaches other readers):** adding `RULES.R8` goes beyond the reader:
+  - `survey.mjs:70` counts problems per `RULES` key, so the survey line gains `R8 0`.
+    `survey.test.mjs:75` pins that line and has to change. It's in the library tests, so it's in scope.
+  - `mirror.mjs` `validProblem` accepts R8 through `RULES`, so a sync state written after this row
+    carries R8 problems.
+  - A copy running older code would refuse such a state. That only matters if a re-pin goes backwards.
+  - I'll grep `docs/case2/SURVEY-RUN.md` and the Console for R-code lists before in-review.
+- **Q4 (version scope):** I count only the hybrid's canon files as versions. Playground is "what if" and
+  is exempt, as it is from R5 and R6. A hybrid with `books: []` therefore never gets a version R8. It
+  still gets the entity R8.
+- **Q5 (`pin.entity` not `.md`):** a non-`.md` entity is never indexed, so R8 would report it missing at
+  every commit. I recommend refusing it in the validator. The brief leaves existence to the reader, but
+  this is a shape check, not an existence check.
+
+## 5. Gate
+
+Filbert approves the manifest. The library and bus suites, plus business if Q1 stands, run green on
+Sage's gate along with every `scripts/test-*.sh`. Hash pins on the changed files are grepped before
+in-review.

agents/morgana/work/queue-267/assertion-diff.md

@@ -0,0 +1,22 @@
+# Row 267: one existing assertion changes (mos-1272)
+
+File: `packages/library/tests/survey.test.mjs:75`, in the test that checks the survey's last three lines
+with `--mapping`.
+
+Before:
+
+```
+    'problems R1 0, R2 3, R3 0, R4 0, R5 0, R6 0, R7 0']);
+```
+
+After:
+
+```
+    'problems R1 0, R2 3, R3 0, R4 0, R5 0, R6 0, R7 0, R8 0']);
+```
+
+Why: R8 ("pinned value changed") is a new rule in `problems.mjs` `RULES`, and the survey line lists a
+count for every `RULES` key (`survey.mjs:70`), so it gains `R8 0`. The fixture has no hybrid and no pin,
+so the count is 0 and no other count moves.
+
+No other existing assertion in the row changes.

agents/sage/work/vikunja-setup/file-1025-followups.mjs

@@ -0,0 +1,71 @@
+// Sage, 2026-10-25: files two follow-ups as P19 tasks (mos-1647 item 3, Q109): the CLIProxyAPI startup version refreshes
+// seen in row 332's isolated runs (a P7 cutover item) and Webby's row 284 N1 (library read path). No relation, labels,
+// assignees, due dates or bucket moves. Sage's own key (bot user 13); the sync key reads back. Refuses if a title exists.
+// Prints no secret.
+// Usage: node file-1025-followups.mjs https://tasks.woltje.com SAGE_TOKEN_FILE SYNC_TOKEN_FILE OUT_JSON
+import { readFileSync, writeFileSync, existsSync } from "node:fs";
+const [ORIGIN, KEY, SYNC, OUT] = process.argv.slice(2);
+if (!/^https:\/\/tasks\.woltje\.com$/.test(ORIGIN)) throw new Error("tasks.woltje.com only");
+if (!OUT || existsSync(OUT)) throw new Error("OUT_JSON missing or exists; refusing");
+const PROJECT = 19;
+const SIG = "Created by Sage (T3 1ef1e4f8) with Sage's own key (bot user 13).";
+const esc = (s) => s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
+const ps = (sig, xs) => xs.map((x) => `<p>${esc(x)}</p>`).join("") + `<p>${esc(sig)}</p>`;
+const TASKS = [
+  {
+    title: "Stack P7 cutover: CLIProxyAPI 8.0.42 makes outbound version-refresh calls at startup (Grok CLI via npm, antigravity)",
+    description: ps(SIG, [
+      "Filed by Mos's ruling mos-1647 item 3. Seen by Fethry in row 332 (P3) isolated runs on 2026-10-24, pinned CLIProxyAPI 8.0.42 (commit bc064340, PIN binary sha256 74661f8c), run under unshare -rn with only lo, empty HOME and auth, panel auto-update disabled.",
+      "At startup the binary logged xai_version.go:96 'failed to fetch latest Grok CLI version from npm' for https://registry.npmjs.org/@xai-official/grok/latest (network unreachable inside the namespace), then xai_version.go:79 'periodic Grok CLI version refresh started (interval=3h0m0s)'. It also logged antigravity_version.go:71 'periodic antigravity version refresh started (interval=3h0m0s)'. Evidence: origin/fethry/row332-p1 agents/fethry/work/queue-332/BUILD.md:251-252 and evidence/offline.txt.",
+      "On the live host these calls would leave the machine every 3 hours, which P1's loopback-only design doesn't account for. The proxy kept working with the fallback version, so the failure is harmless to requests.",
+      "Needed before or at P7 cutover, with Jason present: find whether 8.0.42 has a config switch for these refreshes; if so set it in P1's initial config with a test, otherwise decide deliberately to allow or block the egress (unit-level network policy) and record the choice in P7's receipt. Also recorded in docs/plans/DEFERRED.md. Umbrella: 237.",
+    ]),
+  },
+  {
+    title: "Stack: library get lists the whole served tree per read (row 284 N1, Webby)",
+    description: ps(SIG, [
+      "Filed by Mos's ruling mos-1647 item 3. Webby's round 1 note N1 on row 284 (#1789, landed ce0b6ed41 on 2026-10-25), carried in c31654. Not a correctness issue.",
+      "Each read that resolves one file walks the whole served tree with listTree (git ls-tree -r -l) and then finds the one entry: packages/library/src/mirror.mjs:257 and packages/library/src/query.mjs:142, both via packages/library/src/reader.mjs:28. On a large library that is one full tree listing per read.",
+      "Fix options: git rev-parse <commit>:<path> for the one oid, or a per-commit listing cache. listTree also bounds and checks the tree and its object IDs, so a replacement must keep those checks.",
+      "Bound to the next row that edits the library read path: that row measures a get on a library of realistic size and records the choice in its BUILD.md. Also recorded in docs/plans/DEFERRED.md.",
+    ]),
+  },
+];
+const key = readFileSync(KEY, "utf8").trim(), sync = readFileSync(SYNC, "utf8").trim();
+async function api(method, path, body, auth) {
+  const r = await fetch(ORIGIN + path, { method, headers: { Authorization: `Bearer ${auth}`, "Content-Type": "application/json" }, body: body === undefined ? undefined : JSON.stringify(body), redirect: "error" });
+  const t = await r.text(); let json = null; try { json = JSON.parse(t); } catch {}
+  return { status: r.status, json };
+}
+const list = (j) => j?.items ?? (Array.isArray(j) ? j : []);
+async function existing() {
+  const out = [];
+  for (let page = 1; page < 20; page++) {
+    const r = await api("GET", `/api/v2/projects/${PROJECT}/tasks?per_page=50&page=${page}`, undefined, sync);
+    if (r.status !== 200) throw new Error(`list tasks: ${r.status}`);
+    out.push(...list(r.json));
+    if (list(r.json).length < 50) return out;
+  }
+  throw new Error("more than 19 pages");
+}
+const rec = { at: new Date().toISOString(), project: PROJECT, created: null, problems: [] };
+const save = () => {
+  const out = JSON.stringify(rec, null, 1) + "\n";
+  if (out.includes(key) || out.includes(sync)) throw new Error("secret in the record; not written");
+  writeFileSync(OUT, out);
+};
+const have = await existing();
+for (const T of TASKS) if (have.some((t) => t.title === T.title)) throw new Error("title exists; refusing");
+writeFileSync(OUT, "", { flag: "wx" });
+rec.created = [];
+for (const T of TASKS) {
+  const r = await api("PUT", `/api/v1/projects/${PROJECT}/tasks`, { title: T.title, description: T.description }, key);
+  const c = { status: r.status, id: r.json?.id ?? null };
+  rec.created.push(c);
+  if (r.status >= 300 || !Number.isSafeInteger(r.json?.id)) { rec.problems.push(`create: ${r.status} ${r.json?.message ?? ""}`); continue; }
+  const back = await api("GET", `/api/v2/tasks/${r.json.id}`, undefined, sync);
+  Object.assign(c, { readBack: back.status, done: back.json?.done });
+  if (back.status !== 200 || back.json?.title !== T.title || back.json?.done) rec.problems.push(`read-back differs for ${r.json.id}`);
+}
+save();
+console.log(JSON.stringify(rec));

agents/sage/work/vikunja-setup/followups-filed-2026-10-25.json

@@ -0,0 +1,19 @@
+{
+ "at": "2026-10-25T00:18:17.480Z",
+ "project": 19,
+ "created": [
+  {
+   "status": 201,
+   "id": 633,
+   "readBack": 200,
+   "done": false
+  },
+  {
+   "status": 201,
+   "id": 634,
+   "readBack": 200,
+   "done": false
+  }
+ ],
+ "problems": []
+}

docs/SESSIONS.md

@@ -1693,3 +1693,4 @@ are never rewritten or removed; corrections are new entries.
 2026-10-24 | magica | row329 round2 #1827 | In-progress rev4031; B1 ASCII-only key fix/new inventory tests and N1/N3/N4 docs, cleared reader verification running, old tests byte-identical.
 2026-10-24 | magica | row329 R2 #1827 | ASCII management-key fix and docs verified: package66/66,bus readers261/261,CLI readers726/726,config55/55; no required failures/skips, slot returned. Preparing authorized ff review candidate; old tests unchanged.
 2026-10-24 | Sage 1ef1e4f8 | row329 landing #1827 (mos-1634) | Gate GREEN 23:29:14Z unchanged, landed 61ebf2c34 pushed 23:31:27Z; #1827 closed c31650; queue note 4063, done 4064 (b24d917ec); DEFERRED N2/R2-N1 to 331, N1 to P7; Vikunja 631 filed, 237 c1109; 284 and 157 must rebase.
+2026-10-25 | Sage 1ef1e4f8 | row284 landing #1789 | Gate GREEN 00:09:04Z unchanged, landed ce0b6ed41 pushed 00:09:52Z; #1789 closed c31655; queue note 4071, done 4072 (7c8dc2033); DEFERRED Webby N1 to the next library read-path row; row 332 PROXY_CODEX_API ruled openai-responses (sage-4331), P3 holds for row 331.

docs/plans/DEFERRED.md

@@ -796,3 +796,27 @@ Sage, for Dewey's round 1 N1 on row 329 (c31639). The acceptance netns had only
 but never saw the real binary refuse a non-loopback client.
 Bound to P7: at cutover, with Jason present, confirm the listener is on 127.0.0.1 only (`ss -ltnp`), and
 record it in P7's receipt.
+
+## Row 284 N1: library.get lists the whole served tree per read
+
+Sage, for Webby's round 1 N1 on row 284 (c31654 carries it forward). Each library get runs `listTree`
+(`git ls-tree -r -l`) over the whole served tree to find one blob oid. On a large library that is one full
+tree listing per read. `git rev-parse <commit>:<path>`, or a per-commit cache, would avoid it. Not a
+correctness issue. Bound to the next row that edits the library read path; that row measures a get on a
+library of realistic size and records the choice in its BUILD.md.
+
+## Row 284 N1: Vikunja task
+
+Sage, for mos-1647 item 3 (Q109). The row 284 N1 entry above is tracked as Vikunja 634. No open task
+covered the library read path.
+
+## Row 332 finding: CLIProxyAPI startup version refreshes reach outside the host
+
+Sage, for Fethry's row 332 isolated runs (2026-10-24, pinned 8.0.42, `unshare -rn` with only `lo`). At
+startup the binary tried `https://registry.npmjs.org/@xai-official/grok/latest` (xai_version.go:96, blocked
+by the namespace) and then started a 3-hour Grok CLI version refresh and a 3-hour antigravity version
+refresh. The proxy kept serving with its fallback version. Evidence: origin/fethry/row332-p1
+`agents/fethry/work/queue-332/BUILD.md`:251-252 and `evidence/offline.txt`. Bound to P7: before or at
+cutover, find a config switch that turns these off and set it in P1's initial config with a test, or
+decide on purpose to allow or block that egress and record it in P7's receipt. Tracked as Vikunja 633
+(umbrella 237).

docs/plans/QUEUE.md

@@ -33,7 +33,7 @@ Gaps found while working go to `docs/plans/DEFERRED.md`, not here.
 
 <!-- mosaic-queue:begin -->
 
-Generated from `docs/plans/queue.json` revision 4064 by `queue render`. Do not edit between the markers; change the queue with `scripts/mosaic queue`.
+Generated from `docs/plans/queue.json` revision 4072 by `queue render`. Do not edit between the markers; change the queue with `scripts/mosaic queue`.
 
 | # | Piece | Owner | Issues | State | After | Gate | Brief | Note |
 |---|---|---|---|---|---|---|---|---|
@@ -320,7 +320,7 @@ Generated from `docs/plans/queue.json` revision 4064 by `queue render`. Do not e
 | 281 | A fire or a delete revokes the instance's host and Gitea grants (194/236 follow-up, MVP, mos-1271) | megavolt; reviewers dewey | #1786 | done | 236 done | Dewey approves the design, then the manifest. Bus, business, cli and every touched test file run whole, plus the Docker gitea-grant test and every scripts/test-*.sh, green on Sage's gate. M1-M4 killed. Lands before .53 Case 1 hires a granted instance. Red goes to Sage, then Mos. (sage) | `docs/plans/2026-10-22_fire-revokes-grants.md` § Brief: no grant outlives its instance | LANDED e479521d3 ff on 385a7194c (17 commits, manifest b73d4c81). Slot on 7979fb41e green: bus 819, business 231, cli 837, dewey-bus 76 with gitea-grant-docker run, shells green under 3x limits, M1-M22 killed. M1 hang fixed in b4a (mos-1273). Skips: test-task row 244 live-provider pair, test-queue canonical root. DEFERRED: N1 host-unknown hint verb, N2 fire tool text, to the follow-up row. Dewey APPROVE c30614. |
 | 282 | PRD REQ-LIB-6 rewritten to Q223 and Q226 (mos-1320 item 8) | gosalyn; reviewers webby | #1787 | done | — | Webby approves against the ruling. requirements.test.mjs and every scripts/test-*.sh that reads the PRD or requirements.json are green on Sage's gate. Jason gets a report. (sage) | `docs/plans/2026-10-20_case2-rows.md` § PRD REQ-LIB-6 rewritten to Q223 and Q226 (mos-1320 item 8) | Landed 647424442 on 86a665bdf: 1841f7d4e and 6b5b06819 rebased, patch-ids equal (4e50b4b6, 16a7a02f), range-diff =, tree 4f30ed10a = Gosalyn's gated trial tree. Webby APPROVE rev 3308 c30764 on 6b5b06819. Gate 19:06Z on the tip tree: bus+tasks requirements and tasks verbs 37/0/0, 0 skips; no scripts/test-*.sh reads the PRD (control ok). PRD 1.15. 1.16 is row 291, waits for Jason. |
 | 283 | Case 2 C2-01d supporting folders, the supporting scope, the editor field and supportingPath (M12) | honker; reviewers webby | #1788 | done | 268 done, 282 done | Webby approves the manifest. The library and business suites are green on Sage's gate, along with every scripts/test-*.sh. (sage) | `docs/plans/2026-10-20_case2-rows.md` § C2-01d supporting folders, the supporting scope, the editor field and supportingPath (M12) | LANDED 8d2856ee3 (replay of 0bf308dba onto 59226f878, 13 patch-ids equal) plus DEFERRED N1 93694c518. Webby APPROVE r1 c31338 rev 3677, r2 c31342 rev 3683 (mos-1528 G1 mapping.test:52). Sage full gate GREEN 20:37:16Z: all package suites but queue plus every scripts/test-*.sh, 0 fail, library 98/0, webui npm ci, editor build required. supporting.test first-run red placed (mos-1272, 54d9e07bb). #1788 closed c31358. Live unchanged 45dca69f6. |
-| 284 | Case 2 C2-05c the supporting scope and blob in the lookups | della; reviewers webby | #1789 | in-review, round 1, request posted | 224 done, 283 done | Dewey approves the manifest. Library, bus and harness suites and every scripts/test-*.sh green on Sage's gate. Grep packages/*/tests for the scope enum pin and ['canon', 'playground'] before in-review; update each. (sage) | `docs/plans/2026-10-20_case2-rows.md` § C2-05c the supporting scope and blob in the lookups (sage-2833) | — |
+| 284 | Case 2 C2-05c the supporting scope and blob in the lookups | della; reviewers webby | #1789 | done | 224 done, 283 done | Dewey approves the manifest. Library, bus and harness suites and every scripts/test-*.sh green on Sage's gate. Grep packages/*/tests for the scope enum pin and ['canon', 'playground'] before in-review; update each. (sage) | `docs/plans/2026-10-20_case2-rows.md` § C2-05c the supporting scope and blob in the lookups (sage-2833) | LANDED ce0b6ed41 (fast-forward of Della r4 on 9e2689dff), pushed 00:09:52Z 10-25. Sage gate GREEN 00:09:04Z on ce0b6ed41: every package suite but queue (cli 999/0 + allowed FED R7 skip) and every scripts/test-*.sh rc 0. Webby APPROVE r2 c31654 rev 4070 on manifest-r4 de505cfd; landed tree matches. Della whole-file runs 51/0. #1789 closed with c31655. |
 | 285 | Case 2 C2-08b role changes for agent writes and the chief's read grant | magica; reviewers poe, webby | #1790 | done | 213 done, 291 done | Webby approves the manifest. Business suite, test-config.sh and every scripts/test-*.sh green on Sage's gate. Grep for CREATIVE_KINDS and 64-hex pins of changed role files. Sage checks it against mos-1309 item 5. (sage) | `docs/plans/2026-10-20_case2-rows.md` § C2-08b role changes for agent writes and the chief's read grant (mos-1309 item 5) | LANDED 1f3d0350f 13:33:42Z: candidate 2e4503dc7 (14 commits) cherry-picked onto 25874bc86. Logs kept both sides; otherwise the tree equals the candidate except on 7 base paths. Poe c31568 rev 3919, Webby c31569 rev 3920. Sage gate GREEN 13:28:46Z with its own npm ci: 4236 package tests, 0 fail, 1 allowed FED R7 skip; 12 scripts rc 0. No CREATIVE_KINDS, no role-file hash pins. Roles match mos-1309 item 5. 286 rebases as r5. |
 | 286 | Case 2 C2-03b push and per-seat credentials for the library mirror (with R4, mos-1323) | rockerduck; reviewers boyd, dewey | #1791 | done | 222 done | Dewey approves the manifest. Library and bus suites and every scripts/test-*.sh green on Sage's gate, mutant killed. A search of the run output for the fixture token finds nothing. (sage) | `docs/plans/2026-10-20_case2-rows.md` § C2-03b push and per-seat credentials for the library mirror | LANDED 5d7801dc1 14:37:02Z: r6 75f6d56b1 (19 commits) picked onto d55944edb; logs kept both sides, code equals the candidate. Boyd c31587 rev 3942, Dewey c31588 rev 3943 (r2 c31584/c31585). Sage gate GREEN 14:36:42Z, own npm ci: 4251 tests, 0 fail, 1 allowed FED R7 skip; 12 scripts rc 0; fixture values in 0 of 29 outputs; B285-M1 kills T7/T9. r6 shortened two fixtures after push-check STOP secrets (sage-4112). Chief seed per sage-4100. |
 | 287 | Case 2 C2-21 the grant executor for a library project | steelbeak; reviewers boyd, dewey | #1792 | done | 226 done, 285 done | Dewey approves the manifest. Bus suite, Gitea Docker test, install test and every scripts/test-*.sh green on Sage's gate. A search of the run output for the fixture admin and seat tokens finds nothing. (sage) | `docs/plans/2026-10-20_case2-rows.md` § C2-21 the grant executor for a library project | LANDED 0e935776e 16:12:35Z 10-24 (cand c2338ed58 + a5370b198 on 9b6345466). Boyd APPROVE c31602 rev 3967, Dewey APPROVE c31603 rev 3968. Sage gate GREEN 16:11:38Z: bus 998/0 (Gitea Docker F-A/F-B + X-G3, minted 4 hits 0), business 283/0, cli 989 +1 allowed FED R7 skip, webui 442/0, 12 scripts rc 0. F-C negative record-only follow-up. Dewey N1-N3 non-blocking. #1792 closed c31606. No P19 task. |

docs/plans/queue.json

@@ -1,7 +1,7 @@
 {
   "version": 1,
   "canonicalRoot": "/mnt/storage/src/mosaic-stack",
-  "revision": 4064,
+  "revision": 4072,
   "rows": [
     {
       "id": 1,
@@ -30162,7 +30162,7 @@
       "closes": [
         1789
       ],
-      "state": "in-review",
+      "state": "done",
       "previousState": null,
       "required": false,
       "requiredSince": null,
@@ -30241,18 +30241,69 @@
                 "candidate": "c403f7e3e4496c8eabfe29cce00582267c6dc5a5140b74fcb4ba4c2ec031ca65"
               }
             ]
+          },
+          {
+            "n": 2,
+            "op": "della-284-r2-review",
+            "by": "della",
+            "at": "2026-10-24T23:43:28.297Z",
+            "issue": 1789,
+            "candidate": {
+              "kind": "manifest",
+              "digest": "de505cfd18c82f66ff6cc5faf00789e81c66d148e07e1972c5d664031ee0f727",
+              "text": "0cf1506f848cc1734e34625f101b60561ecdc8505e33b6a9d16e430b3cb2f68e  agents/della/work/queue-284/BUILD.md\n591a412ed4243288da29c406269ff089a58bbcfcb0a2a0b3536b87bfa2e89eab  packages/bus/src/broker.mjs\n9b974b53c7fde08b795e1a26c75ad1e6dd664fda72b79a656900ec96f1603d03  packages/bus/tests/library-lookups.test.mjs\n145ede2d2f5c9c776cc2a6eb5f48975e96b09e78c495401d5aaae435974496a4  packages/harness/src/tools.mjs\n21e78b4424ae0e8337aaf548e880abf297407301cb0ae41711bd794e99344276  packages/harness/tests/library-tools.test.mjs\nbafe113bee70f17bd249876d6bdd1c08fa051223c2111955e5d5f275bd76bba0  packages/library/src/query.mjs\n766b80f53f4565588ac48bd613f6099b1f7ca1c933994779fe6c6cb9eae23a29  packages/library/tests/query-fixture.mjs\nd99111d1a4f7ca42881ba699cbc55d2dad12f6c75e7b8e1bac44f05c7df56dec  packages/library/tests/query.test.mjs\n"
+            },
+            "request": "comment",
+            "attempts": [
+              {
+                "op": "della-284-r2-review",
+                "by": "della",
+                "at": "2026-10-24T23:43:28.297Z",
+                "state": "failed",
+                "comment": null,
+                "transport": {
+                  "outcome": "failed",
+                  "status": null,
+                  "comment": null,
+                  "detail": "pre-send: the credential or account check failed"
+                },
+                "resolutions": []
+              },
+              {
+                "op": "sage-284-r2-request",
+                "by": "sage",
+                "at": "2026-10-24T23:46:18.731Z",
+                "state": "posted",
+                "comment": 31653,
+                "transport": {
+                  "outcome": "posted",
+                  "status": 201,
+                  "comment": 31653,
+                  "detail": "created"
+                },
+                "resolutions": []
+              }
+            ],
+            "duplicateRisk": false,
+            "receipts": [
+              {
+                "reviewer": "webby",
+                "op": "webby-284-verdict-r2",
+                "at": "2026-10-24T23:48:52.791Z",
+                "verdict": "approve",
+                "comment": 31654,
+                "candidate": "de505cfd18c82f66ff6cc5faf00789e81c66d148e07e1972c5d664031ee0f727"
+              }
+            ]
           }
         ]
       },
-      "claim": {
-        "seat": "della",
-        "op": "della-284-start-1"
-      },
-      "note": null,
+      "claim": null,
+      "note": "LANDED ce0b6ed41 (fast-forward of Della r4 on 9e2689dff), pushed 00:09:52Z 10-25. Sage gate GREEN 00:09:04Z on ce0b6ed41: every package suite but queue (cli 999/0 + allowed FED R7 skip) and every scripts/test-*.sh rc 0. Webby APPROVE r2 c31654 rev 4070 on manifest-r4 de505cfd; landed tree matches. Della whole-file runs 51/0. #1789 closed with c31655.",
       "blockedReason": null,
       "createdAt": "2026-10-22T18:28:04.590Z",
-      "updatedAt": "2026-10-24T23:25:20.620Z",
-      "updatedBy": "webby"
+      "updatedAt": "2026-10-25T00:12:13.878Z",
+      "updatedBy": "sage"
     },
     {
       "id": 285,
@@ -140751,6 +140802,194 @@
         "receipt": "ok sage-329-done-landed rev 4064 row 329 in-review→done round 2"
       },
       "viewSha": "cf64a27b66b579121eb5f4dba03d2b4a3e88ff1aedd95ffe2c3d713591edf8b4"
+    },
+    {
+      "rev": 4065,
+      "op": "della-284-r2-reopen",
+      "verb": "move",
+      "args": {
+        "id": 284,
+        "to": "in-progress",
+        "reason": null,
+        "candidate": null,
+        "evidence": null,
+        "issue": null
+      },
+      "by": "della",
+      "at": "2026-10-24T23:42:25.130Z",
+      "semantics": 2,
+      "result": {
+        "row": 284,
+        "from": "in-review",
+        "to": "in-progress",
+        "round": null,
+        "issue": null,
+        "candidate": null,
+        "receipt": "ok della-284-r2-reopen rev 4065 row 284 in-review→in-progress"
+      },
+      "viewSha": "1ca33a4b5b66adffafabf5096cc182b7dd13cd71cdab6186fba9a0d3974ead96"
+    },
+    {
+      "rev": 4066,
+      "op": "della-284-r2-review",
+      "verb": "move",
+      "args": {
+        "id": 284,
+        "to": "in-review",
+        "reason": null,
+        "candidate": "/mnt/storage/scratch/della-row284-r2-evidence/manifest-r4.txt",
+        "evidence": null,
+        "issue": null
+      },
+      "by": "della",
+      "at": "2026-10-24T23:43:28.297Z",
+      "semantics": 2,
+      "result": {
+        "row": 284,
+        "from": "in-progress",
+        "to": "in-review",
+        "round": 2,
+        "issue": 1789,
+        "candidate": {
+          "kind": "manifest",
+          "digest": "de505cfd18c82f66ff6cc5faf00789e81c66d148e07e1972c5d664031ee0f727",
+          "text": "0cf1506f848cc1734e34625f101b60561ecdc8505e33b6a9d16e430b3cb2f68e  agents/della/work/queue-284/BUILD.md\n591a412ed4243288da29c406269ff089a58bbcfcb0a2a0b3536b87bfa2e89eab  packages/bus/src/broker.mjs\n9b974b53c7fde08b795e1a26c75ad1e6dd664fda72b79a656900ec96f1603d03  packages/bus/tests/library-lookups.test.mjs\n145ede2d2f5c9c776cc2a6eb5f48975e96b09e78c495401d5aaae435974496a4  packages/harness/src/tools.mjs\n21e78b4424ae0e8337aaf548e880abf297407301cb0ae41711bd794e99344276  packages/harness/tests/library-tools.test.mjs\nbafe113bee70f17bd249876d6bdd1c08fa051223c2111955e5d5f275bd76bba0  packages/library/src/query.mjs\n766b80f53f4565588ac48bd613f6099b1f7ca1c933994779fe6c6cb9eae23a29  packages/library/tests/query-fixture.mjs\nd99111d1a4f7ca42881ba699cbc55d2dad12f6c75e7b8e1bac44f05c7df56dec  packages/library/tests/query.test.mjs\n"
+        },
+        "receipt": "ok della-284-r2-review rev 4066 row 284 in-progress→in-review round 2 on #1789; request della-284-r2-review requesting"
+      },
+      "viewSha": "06c4188500095cb6d4a33ed66cf0ca641c422791578fd716de241899f8e6cd9a"
+    },
+    {
+      "rev": 4067,
+      "op": "della-284-r2-review.outcome",
+      "verb": "review-outcome",
+      "args": {
+        "id": 284,
+        "attempt": "della-284-r2-review",
+        "outcome": "failed",
+        "status": null,
+        "comment": null,
+        "detail": "pre-send: the credential or account check failed"
+      },
+      "by": "della",
+      "at": "2026-10-24T23:44:28.236Z",
+      "semantics": 2,
+      "result": {
+        "row": 284,
+        "round": 2,
+        "attempt": "della-284-r2-review",
+        "state": "failed",
+        "receipt": "ok della-284-r2-review.outcome rev 4067 row 284 round 2 request della-284-r2-review failed"
+      },
+      "viewSha": "c5746412794db34382b1445e1cf6653bd9bc5d18ced39eb7530f3d8b85f9dc71"
+    },
+    {
+      "rev": 4068,
+      "op": "sage-284-r2-request",
+      "verb": "review-request",
+      "args": {
+        "id": 284
+      },
+      "by": "sage",
+      "at": "2026-10-24T23:46:18.731Z",
+      "semantics": 2,
+      "result": {
+        "row": 284,
+        "round": 2,
+        "attempt": "sage-284-r2-request",
+        "state": "requesting",
+        "receipt": "ok sage-284-r2-request rev 4068 row 284 round 2 request sage-284-r2-request requesting"
+      },
+      "viewSha": "d88a0b75a5e83fc52e67f38060a10beb206122bd3c7b4c8f6e5abc59ec5db2cd"
+    },
+    {
+      "rev": 4069,
+      "op": "sage-284-r2-request.outcome",
+      "verb": "review-outcome",
+      "args": {
+        "id": 284,
+        "attempt": "sage-284-r2-request",
+        "outcome": "posted",
+        "status": 201,
+        "comment": 31653,
+        "detail": "created"
+      },
+      "by": "sage",
+      "at": "2026-10-24T23:47:19.540Z",
+      "semantics": 2,
+      "result": {
+        "row": 284,
+        "round": 2,
+        "attempt": "sage-284-r2-request",
+        "state": "posted",
+        "receipt": "ok sage-284-r2-request.outcome rev 4069 row 284 round 2 request sage-284-r2-request posted comment 31653"
+      },
+      "viewSha": "afadc7eb51a8de8bc7ea9e231718958e058ad4b34f355396d589e5b90d994ab0"
+    },
+    {
+      "rev": 4070,
+      "op": "webby-284-verdict-r2",
+      "verb": "review-record",
+      "args": {
+        "id": 284,
+        "verdict": "approve",
+        "comment": 31654,
+        "candidate": "de505cfd18c82f66ff6cc5faf00789e81c66d148e07e1972c5d664031ee0f727"
+      },
+      "by": "webby",
+      "at": "2026-10-24T23:48:52.791Z",
+      "semantics": 2,
+      "result": {
+        "row": 284,
+        "round": 2,
+        "verdict": "approve",
+        "receipt": "ok webby-284-verdict-r2 rev 4070 row 284 round 2 approve by webby (comment 31654)"
+      },
+      "viewSha": "fc73cc2acac68aad3f22e65bd531f278572839f3134073aafd3cbf1e495411a3"
+    },
+    {
+      "rev": 4071,
+      "op": "sage-284-note-landed",
+      "verb": "note",
+      "args": {
+        "id": 284,
+        "text": "LANDED ce0b6ed41 (fast-forward of Della r4 on 9e2689dff), pushed 00:09:52Z 10-25. Sage gate GREEN 00:09:04Z on ce0b6ed41: every package suite but queue (cli 999/0 + allowed FED R7 skip) and every scripts/test-*.sh rc 0. Webby APPROVE r2 c31654 rev 4070 on manifest-r4 de505cfd; landed tree matches. Della whole-file runs 51/0. #1789 closed with c31655."
+      },
+      "by": "sage",
+      "at": "2026-10-25T00:11:07.895Z",
+      "semantics": 2,
+      "result": {
+        "row": 284,
+        "field": "note",
+        "receipt": "ok sage-284-note-landed rev 4071 row 284 note"
+      },
+      "viewSha": "c02f6437f45a2ef9181cd3b05d90b331d0468534a294200a55e38dcc316d3ac9"
+    },
+    {
+      "rev": 4072,
+      "op": "sage-284-done-landed",
+      "verb": "move",
+      "args": {
+        "id": 284,
+        "to": "done",
+        "reason": null,
+        "candidate": null,
+        "evidence": null,
+        "issue": null
+      },
+      "by": "sage",
+      "at": "2026-10-25T00:12:13.878Z",
+      "semantics": 2,
+      "result": {
+        "row": 284,
+        "from": "in-review",
+        "to": "done",
+        "round": 2,
+        "issue": null,
+        "candidate": null,
+        "receipt": "ok sage-284-done-landed rev 4072 row 284 in-review→done round 2"
+      },
+      "viewSha": "546679f234a78b2d4582ed5a50b90c7427bf82cf2bd75243eeccad1f5730fa79"
     }
   ]
 }