row 287 (#1792): BUILD.md records sage-2958: gitea entries need scopes (role.mjs:100-111), equal to SEAT_SCOPES; seven chief-of-staff.json readers; doc only

The peer-output fixture execs isolated system Python to write its exact bytes
and exit with peer-status. This avoids masking parser/status faults behind the
supervisor session check. All17 faults assert an exact reason with a delimiter;
every existing assertion remains. No product change or timing delay.

Old packages/cli/tests/case1-accept.test.mjs💯
const PYTHON_STUB = `[ -f "$HC/peer-output" ] && { cat "$HC/peer-output"; exit "$(cat "$HC/peer-status")"; }

Diagnostic under sage-2752 found probe-inner-session for malformed output and
nonzero exit. Mos confirmed the fixture mask and authorized this repair.
No tests ran after the repair; Duckworth review and fresh whole gate follow.

BUILD-LOG.md

@@ -5190,6 +5190,127 @@ Before: managed project/thread verbs had no Console conversation area. After: fi
 
 2026-10-21 18:45 UTC | Gander row 196 preservation before rebase | Sage-2051, Mos order mos-1193, explicitly authorizes commit and fast-forward push of the current build before deferred full verification. Product and evidence preserved together; prior focused checks and stopped gates are recorded in the row196 packet, with no claim of full acceptance. Next: rebase onto a36523713 on new gander/row196-r2, report range-diff/patch-id/conflicts, then await Sage's clear for M1-M29 and all requested suites. No live action, force push, branch deletion or tests during hold.
 
+2026-10-21T16:34:44Z | Huey | Q198/Q199 system-manager design, mos-1183, Vikunja 452 | Before: pinned foundation 6c75887b0 has separate bus, development queue, run evidence, turn/cohort controls and launch/usage paths; the assignment requests a mechanical manager design. After: docs/plans/2026-10-21_q198-system-manager.md proposes admission/cooldown, priority and safe interruption, durable requests, bounded retry/DLQ/replay/rerouting, Console monitoring, optional decision adapters with USD reservations, six ordered slices and three recommended owner decisions. Verification: 26 pinned file:line references resolve, ten-line summary, manual source/contract review, git diff --check and installed queue guard pass. No builds/suites, runtime writes, credential reads, service changes or paid calls. Huey queue next refused the linked worktree, then returned nothing from canonical checkout; direct brief controls this assignment. Gitea issue and queue-row capture are handed to Sage under the no-credential-read/no-queue-write boundary.
+
+2026-10-21T18:45:47Z | Huey | Q198 system-manager design r2, mos-1194, Vikunja 452 | Before: Scrooge requested changes on add7cb506 for decision-key worker exposure, cap scope and absent sampler ownership. After: distinct MOSAIC_DECISION_OPENROUTER_KEY with S6 sessionEnv canary requirement; exclusive per-instance key with per-key caps and provider limit on every enablement; S2 owns supervisor sampler and waits until after MVP/re-pin. Also records P1 interpretation, missing-confidence fallback and stand-in timeout selection, explains verified Noul spelling, excludes notifier/gateway retry loops with citations, and cites lifecycle revocation requirement. Verification: 30 pinned citation spans resolve, ten-line summary, manual diff/source review and whitespace/queue-guard checks. No builds, suites, live changes, credential reads or paid calls.
+
+2026-10-21T19:56:11Z | Huey | Q198 design r3, mos-1201/1201a, Vikunja 452 | Before: Scrooge approved r2 7e785a08f with three notes. After: N1 names proposed system.health bus read verb and includes broker handler/authorization in S2 scope and review; N2 labels exclusive ownership as a setup attestation that cannot be mechanically proved and identifies provider key limit as real ceiling; N3 adds recommended Q4 for P1 narrowing and removes the Mos-flag instruction. Other design content retained. Verification: manual r2-to-r3 delta review, ten-line summary, whitespace and installed queue-guard checks. No builds, suites, live changes or paid calls.
+
+2026-10-21T20:19:53Z | Huey | Q198 design r4, mos-1203, DECISIONS Q204, Vikunja 452 | Before: r3 a36952564 presented Q1–Q4 for owner approval. After: section 9 records Q20a–Q20c verbatim as approved; D11 labels Huey’s reading of configurable daily/monthly caps with $0.10/$1 defaults in the one instance config via reviewed schema; provider key ceiling and explicit enable/key requirements retained; Q4 pending, Jason restated 2026-10-21, P1 unchanged. Verification: quotes match DECISIONS ledger, unrelated sections and P1 equal r3, ten-line summary, whitespace and installed queue guard checked. No builds, suites, live changes or paid calls.
+
+2026-10-21T20:48:49Z | Huey | Q198 design r5, mos-1206, DECISIONS Q205/Q206, Vikunja 452 | Before: r4 1e8bccff1 left Q4 pending and long outages could exhaust request retry budgets. After: protected mode separate from unchanged D1 human kill authority; mechanical detection, safe-point pause/proof, JEV-first endpoint-before-headless probes at 60-second increments to 600 seconds without attempt limit, upstream reset waits, shared D11 probe accounting, one test session then batches, proposed three-failed-exit escalation, frozen outage clocks/counters without DLQ, advisory online-service routing, Q4 superseded and Q22 pending. Thresholds/deadlines/batches/escalation explicitly labelled Huey readings. Acceptance proposals updated, no implementation. Verification: complete Q205/Q206 read, quotes match ledger, D1/inventory/Q1–Q3 unchanged, 30 pinned citation references resolve, 11-line summary, manual consistency/diff review, whitespace and installed queue guard checked. No builds, suites, real probes, live changes or paid calls.
+
+2026-10-21T21:04:37Z | Huey | Q198 design r6, mos-1208/mos-1210, DECISIONS Q207, scrooge-0003, Vikunja 452 | Before: r5 fd44f7c60 gated probes on JEV and lacked request-local resume failure separation. After: parallel independent probes; central JEV/smaller-model/rules endpoint chain, per-model timeout/calibration, 4 KiB metadata limit and isolated fallback credentials; subscription quota vs metered USD accounting and separately enabled paid-probe budget (proposed $0 defaults). S-F1–S-F7: bounded outage classification, request-local D6/two-resume DLQ rule and batch definition; escalation latch with authorized revision-bound system.recovery.release separate from kill clear; cooperative F5 pause/F6 proof only; proposed configurable 24-hour cumulative pause expiry; full Q205 kill sentence with labelled protected-mode interpretation; r3–r6 history. S5/S6 acceptance proposals updated. Verification: Q205/Q207 quotes match ledger, D1/inventory/Q1–Q3 unchanged, 30 pinned references resolve, summary within 15 lines, manual consistency/delta review, whitespace and installed queue guard checked. No builds, suites, real probes, live changes, credential reads or paid calls.
+
+2026-10-21T21:39:25Z | Huey | Q198 r6.1 touch-up, mos-1222, scrooge-0004 N1–N3, Vikunja 452 | Before: approved r6 2ee68cd69 had unprovable session-call denial wording, implicit queue/late-call behavior and a partial Q207 paragraph. After: rule/S6 tests require session decision calls/output have no routing authority; non-waiting dispatchers use internal rules immediately; timed-out JEV does not occupy fallback decision slot but retains spend reservation; full Q207 paragraph copied exactly from DECISIONS; matching Q22 reading corrected. ENV_ALLOW and all runtime code unchanged. Verification: exact full-quote equality, obsolete wording absent, D1 unchanged, summary within 15 lines, manual N1–N3 delta review, whitespace and installed queue guard checked. No builds, suites, probes, live changes or paid calls. Review/handoff via T3 as Mos authorized.
+
+2026-10-21T21:11:44Z | Della mos-1213 / Vikunja 460 planning phase | Before: PRD 1.10 has no email feature; MP 95b0298 and EP 7a64921 are read-only prior inputs. Scope: independent post-v1 email plan on della/email-plan, no implementation/live access/MVP or queue changes. Gitea issue enrollment belongs to Mos/Sage because this seat has no API credential.
+
+2026-10-21T21:12:18Z | Della mos-1213 / Vikunja 460 planning verification | After: docs/plans/2026-10-21_email-plan-della.md is 341 lines, with 13 post-v1 rows and six Jason questions. Verified 42 pinned citation anchors, ten requested coverage areas, identical prior src trees, append-only records, clean whitespace and repository queue guard. No configured CI pipeline or CI-queue wrapper found in the current foundation; documentation-only validation applies, no product suites or live tests run. Phase B/C and Gitea issue/queue enrollment remain with Mos/Sage. Only della/email-plan is authorized for push.
+
+2026-10-21T21:37:07Z | Della mos-1220 / Vikunja 460 phase B cross-review | Before: independent plans Della 191dff32f and Ludwig 4a27b73ac delivered. After: docs/plans/2026-10-21_email-review-by-della.md reviews all 218 Ludwig plan lines, records ten findings, five grafts, six retained strengths, nine disagreements and eleven merged Jason questions. Ludwig review 143415779 read in full after ludwig-0002 arrived; reconciliation records new mail-access action, no agent reroute and correction of Della dataRoot credential example. Original plan unchanged. Planning only, no product/MVP/queue/live change.
+
+2026-10-21T21:43:02Z | Della mos-1223 / Vikunja 460 phase C synthesis | Before: independent plans/reviews complete, Mos selected Della base. After: docs/plans/2026-10-21_email-plan.md merges Ludwig grafts and accepted corrections, with 16 post-v1 rows (eight READY, eight WAIT/optional), eleven deduplicated Jason questions, per-row test paths and explicit Q210 non-v1 scheduling. Original Della plan/review preserved; Ludwig originals remain on their branch. Static checks cover graft/row/question/citation anchors and original blobs. No source code, suite, mailbox, secret file, service, MVP or queue change. Candidate goes to Ludwig before Sage landing/queue handoff, copying Mos.
+
+2026-10-21T21:45:20Z | Della mos-1223 / ludwig-0004 focused corrections | Before: b096a16cc left content-key location implicit and E05 core registration marked ready. After: merged plan 399 lines fixes external configDir secret key/lifecycle namespace outside dataRoot backup/restore, E01 schema and E03 missing/expired-key restore tests, and E05/E06 test-local registry readiness with core kinds.mjs registration gated on approved E01/Q4. Sixteen rows and eleven questions retained; originals unchanged. Focused static checks and queue guard apply, no product/live changes. Reviewer will check changed lines only.
+
+2026-10-21T22:24:12Z | Huey | T1 item 7 sessions design r1, mos-1232, Vikunja 463 | Before: origin/refactor cca206cdc keys assistant claims/stores/messages by thread and renders Pi compaction markers; row 194 r4 excludes thread context clear. After: docs/plans/2026-10-21_t1-sessions.md proposes independent per-agent sessions within threads on Pi/Claude, scoped claims/stores/messages/workspaces, completed compaction counts, owner-write/RBAC matrix, idempotent proven-stop/fresh-successor clear, common admission/kill checks, migration and seven acceptance groups, replacement REQ-ROLE-2/REQ-THREAD-2 text and three owner questions. PRD 1.12 USER-3/4 candidate 1509c7cc5 cited separately from base. Verification: 22 pinned references resolve, eight-line summary and three exact owner quotes; manual source/consistency review, whitespace and installed queue guard checked. No code, queue/PRD edits, builds, suites, credential reads, live changes or paid calls. MVP priority ahead of Q198 S1. Review via Scrooge, then Sage/Ludwig as Mos authorized.
+
+2026-10-21T22:28:56Z | Huey | T1 sessions design r2, scrooge-0006, mos-1235/1236, Vikunja 463 | Before: r1 347278044 lacked the exact per-session checkout/single-writer invariant and safe runner drain ordering, and admitted other role instances. After: F1 exact workspace path, fenced checkout setup, legacy shared-workspace quiescence, clear retains old dirty/untracked/unpushed checkout and creates fresh approved checkout, T2 mutant; F2 dequeue fence and generation-bound turn-boundary idle proof before runner signal, busy drain stays clearing, T4 cases; F3 THREAD_DEFINITION only per Mos scope ruling, no role eligibility change; N1 private titles/history vs owner-visible count/activity projection; N2 Claude offline adapter/managed-store-reader dependency flagged as MVP risk. Section 8 records Mos’s Q1–Q3 readings, no questions to Jason. Verification: 27 pinned references resolve, summary within 15 lines, source/delta consistency review, whitespace and installed queue guard checked. No code, queue/PRD edits, builds/suites/live changes/provider calls/credential reads.
+
+2026-10-21T22:30:20Z | Huey | T1 sessions design r3, scrooge-0007 R1, Vikunja 463 | Before: r2 e19e30df2 nested new session checkouts under the retained legacy instance workspace, allowing project-name collision or historical parent inspection to reach live siblings. After: exact path is dataRoot/session-workspaces/business/instance/session, outside the legacy root; canonicalized ancestor/descendant overlap refuses; T2 nesting mutant covers historical mount/inspection and a legacy project named sessions. All other r2 content retained as approved, revision label updated. Verification: old nested path absent, manual R1-only delta, whitespace and installed queue guard checked; no code/builds/suites/live changes/provider calls/credential reads.
+
+2026-10-20 18:51:10 UTC | Row 191 #1689 design phase | Before: per-business launch revoke and per-binding Discord STOP leave task containers, active sessions and background work without one switch. Proposed per-data-root durable halt with human-only resume, generation-fenced starts, bounded concurrent termination, write-once stop receipts and existing event mirror; no schema migration. DESIGN.md inventories starter/continuation paths and container control-mount restriction. Sent to Dewey with Sage copied; implementation waits independent design approval. No tests, commits or live actions.
+
+2026-10-20 18:57:51 UTC | Row 191 design revision | Dewey r1 changes: interim Console --send absence, reserved processing events and missing-state semantics required correction. DESIGN-r2.md now names CLI interim path, unavailable UI controls, trusted initialization and fail-closed missing leaf, container delete/replace mount tests, reservations and id-bound reconciliation. Small notes addressed including diagnostic seats and aliases. Recommended smaller Docker scope to Sage; design and scope approval pending, no code or test runs.
+
+2026-10-20T19:50:56Z | Rocko | row 191 #1689 implementation stage: from independent brakes to shared root state, generation-fenced launcher and tracked stops, Discord/task guards and control HTTP/UI. Evidence is agents/rocko/work/queue-191/logs/ and PROGRESS.md. Fixture single files only so far; heavy verification and candidate not complete. Scope additions sage-1367 (one read-only CODE file) and sage-1392 (processing-only client socket timeout); no schema, proof baseline, live file/unit, commit or push change.
+
+2026-10-20 22:58:45 UTC | Rocko | row 191 #1689 rebase inspection candidate | Rebuilt uncommitted kill-switch tree from da230ca48 onto landed row 190 base 00d4cc1f6 under new branch rocko/row191-r2-00d4. Hand merges retained instance flags and SSO/sign-out changes; fixture tests exposed and fixed SSO signer compatibility and two unknown-runtime cleanup defects. Final touched singles 249/249 across 26 files; 15 overlapping Client reader files 102/102. Manifest a4f780c2 has 78 paths; packet 185 files verified with scan clear. Mutants and owner gate remain pending; no review-ready or activation claim, no commit/push/live action.
+
+2026-10-21 23:39:21 UTC | Rocko | row 191 #1689 inspection snapshot | Sage-2242 authorized a local inspection commit for Honker's row 194 S6. Created d52b4db1c on new rocko/row191-inspection-20261021, parent 00d4cc1f6, preserving the reviewed-design build and candidate a4f780c2 (78 paths). Static manifest/index/source scan and diff check verified; no tests run, no push credential or push attempt. Existing single-file evidence is historical, 249/249 and overlapping Client readers 102/102; suites/mutants/gate remain pending. Current code has verified runtime signalling and instance halt, but no dedicated per-run stop API yet; Honker and Sage notified of that seam directly. Snapshot is not review-ready or approved for live use.
+
+2026-10-22 00:04:05 UTC | Rocko | row 191 #1689 per-run stop inspection | Implemented agreed Honker-0079/0081 stopRun contract with verified per-signal identity, fixed 5s+2s, durable first-owner join and immutable result plus later-exit observations. Focused CLEAR sage-2250: final 9 files 62/62, no skipped, after correcting host guard placement and peer-discovery fixture timeout isolation; initial failures and failed teardown logs retained, only own failed group stopped. Slot returned with cwd sweep clear. Sage published f7bf7dfec; sage-2265 clean rebase creates 7aa18b0f6 on dcd8d4dda under new branch, explicit Rocko identity, all 79 manifest product blobs identical so 62/62 evidence carried. Direct S6 handoff sent to Honker and Sage. Wider suites, mutants, review and activation remain pending.
+
+2026-10-22T00:18:12Z | Sage (Opus 5.5) | row 254 landing (#1759), library.sync human timeout | Before: the human transport gave library.sync the 5-second default, so a sync longer than that reported outcome-unknown, and six library-* codes reached the Console as 502. After: 331597709 lands Megavolt's candidate (7 paths, tree d49e4626f, manifest digest be63cfbe recomputed and matched). human-cli.mjs waits 130 s for library.sync, past the server's 120 s hold, and 5 s for other verbs. webui bus.mjs maps library-sync-busy, library-diverged and library-accept-stale to 409, library-accept-invalid to 400, and library-credential-missing and library-fetch-failed to 503. channel-proof re-pinned. Merged-tree gate on the landing commit: library 77/0, bus 628/0, webui 305/0 (1 skip), cli 749/0 (23:44:33-23:55:11Z). eb9672c91 adds the README request-timeout sentence (Dewey N1) and a DEFERRED entry for the four library codes still at 502 (Dewey N2, binds the Console library routes row). Overlap sweep before push: 268 rebased to r2 ecd9b35eb (README only, approval carried webby-0096), 194 rebased to b7. Done rev 3072, #1759 closed.
+
+2026-10-22 00:24:34 UTC | Rocko (Codex gpt-6.1-sol, d99326cc) | row 191 #1689 full gate on c78f48946 | stopped on second integration failure per sage-2275; singles 269/269, processing-control 61/61, bus 646/646; CLI interrupted with 26 observed failures; no further edits; cwd sweep empty and slot returned to Sage.
+
+2026-10-22 00:48:20 UTC | Rocko (Codex gpt-6.1-sol, d99326cc) | row 191 #1689 eb3abba12 full gate | stopped at Discord 190/192; 32 singles 304/304, processing-control 61/61, bus 646/646, cli 761/761; two uninitialized Discord fixtures reported to Sage; no later run; cwd sweep empty, slot clear.
+
+2026-10-22 00:58:27 UTC | Rocko (Codex gpt-6.1-sol, d99326cc) | row 191 #1689 sage-2294 fixture fix | e6800380d on eb3abba12, two test files/four additions, assertions preserved; 338-entry static all-package sweep recorded; no tests; sent Sage for publication and Honker for dependent gate.
+
+2026-10-22 01:30:04 UTC | Rocko (Codex gpt-6.1-sol, d99326cc) | row 191 #1689 e6800380d resume | binding15/15, recover5/5, Discord192/192; stopped WebUI314 passed/4 failed/1 esbuild skip; processing polling violates sign-out/manual redirect and bar changes layout; no fixes/retries, cwd sweep empty, slot returned.
+
+2026-10-22 01:38:08 UTC | Rocko (Codex gpt-6.1-sol, d99326cc) | row 191 #1689 sage-2317 Console integration fix | 8e1f55c1d on e6800380d; shared sign-out/manual redirect/interval and desktop frame fixes, assertions retained, six browser cases, 73 mutant sites preflight; syntax only, no tests; sent Sage/Honker.
+
+2026-10-22 02:06:38 UTC | Rocko (Codex gpt-6.1-sol, d99326cc) | row 191 #1689 rebase sage-2329 | eafcbd3e7 on ddfb29af7, new branch, dispatcher retains processing and access; CLI/readme auto-merges checked; 87-path fd0f2740 manifest and 73-site preflight; Sage2333 published, awaiting CLEAR; no tests.
+
+2026-10-22 02:20:51 UTC | Rocko (Codex gpt-6.1-sol, d99326cc) | row 191 #1689 eafcbd3e7 full gate | stopped singles313/6: six new browser cases count app freshness timer as processing timer; diagnosis sent Sage, no fix/retry; no suites/shells/mutants; cwd sweep empty, slot clear.
+
+2026-10-22 02:23:13 UTC | Rocko (Codex gpt-6.1-sol, d99326cc) | row 191 #1689 sage-2345 timer fixture | 4db8b5778 on eafcbd3e7, one line attributes timer to processing.js; all assertions retained, no product change or tests; sent Sage and Honker; awaiting publication/CLEAR.
+
+2026-10-22 02:25:29 UTC | Rocko (Codex gpt-6.1-sol, d99326cc) | row 191 #1689 sage-2349 record commit | 0f8235277 on 4db8b5778 adds packet BUILD.md cause record; product manifest remains ffb46fbd/87 paths; no amend, product change or tests; Sage/Honker notified.
+
+2026-10-22 02:48:36 UTC | Rocko (Codex gpt-6.1-sol, d99326cc) | row 191 #1689 0f8235277 full gate second red | singles330/330, processing61/61, bus646/646, cli783/783, discord192/192; WebUI323/1/1 host esbuild skip; shell geometry1062vs1000; stopped/no retry, no later suites/shells/mutants; cwd sweep empty, slot returned, Sage escalates Mos.
+
+2026-10-22 02:57:36 UTC | Rocko (Codex gpt-6.1-sol, d99326cc) | row 191 #1689 mos-1248 desktop layout restart | FF 5cd32f4c1 on 0f8235277: desktop grid allocates processing bar, existing shell assertions kept, visibility/no-scroll assertions added; 74 static mutant sites; candidate 2f93ef19; sent Webby/Sage for static review; no runs, awaiting review and CLEAR.
+
+2026-10-22 03:11:09 UTC | Rocko (Codex gpt-6.1-sol, d99326cc) | row 191 static nav layout, mos-1249/1250 | FF da4334806 on 5cd32f4c1; controls first in nav, non-sticky per sage-2386/webby-0108; candidate-only placement assertion changed, landed shell assertions preserved; 77 mutants statically preflighted; manifest 245dceb1; Webby/Sage handoff sent, no runs, awaiting static look/publish/debug CLEAR.
+
+2026-10-22 03:15:11 UTC | Rocko (d99326cc) | row 191 sage-2394 debug | da4334806 shell5/5 and processing-browser9/9, awk14/0/0; geometry heights reported with read-only distinction; cwd sweep[] and slot returned; full window awaits separate CLEAR.
+
+2026-10-22 02:01:30 UTC | Sage (Claude Opus 5.5, 1ef1e4f8) | row 202 #1700 FED R5 landing | ddfb29af7 on 9c9732983: 6 manifest paths from a74cd9f87 (digests match CANDIDATE.sha256, patch-id 9d89077b equal); Duckworth APPROVE r5 rev 3026; C1 gate by Quackerjack on merge 3b86180b9: cli 771/771 skip 0 (run 2, run 1 red on gate TMPDIR length), 10 test-*.sh rc 0, M1-M13 killed; done rev 3108; landing note refused for length before the done move, so the record is the commit body and #1700 c30265; 191 and 194 rebased onto it (one scripts/mosaic case line)
+
+2026-10-22 03:35:55 UTC | Sage (Claude Opus 5.5, 1ef1e4f8) | row 273 #1778 activate --send/--no-sso landing | 0bbf0f6d1 landed on 378a76b85, a rebase of cac7d0f67 (0042f713d) with all 6 range-diff pairs = and equal patch-ids; 4-path manifest e1031023 unchanged; Filbert APPROVE rev 3111 (c30308) carried merge-scoped under mos-1160, carry comment c30319 names 0bbf0f6d1. Gate on 0bbf0f6d1 by Darkwing: stack-release.test.mjs 218/218 skip 0, stack-release-external.test.mjs 25/25 skip 0, test-release.sh rc 0 (selftest 14/0, no skips), T58 controls c0 11/11 pass and c1 11/11 fail, M1-M7 killed. Rerun because row 202 changed scripts/mosaic, which stack-release.test.mjs copies. Red 1 was 978143bf4 (T53 test 6 usage pin). This doc commit adds the TOOLS.md usage line and F39 rules (Filbert N1).
+
+2026-10-22 04:02:12 UTC | Rocko (d99326cc) | row191 full window0fa7bf421 | touched35files336pass, packages2403pass/1esbuildskip, shells425selftests+156queue node pass; SR01–07killed, SR08timeout,69unrun; stopped/no retry;88blobs restored,cwd sweep[],owned network removed,slot returned Sage; await Mos ruling.
+
+2026-10-22 04:14:56 UTC | Rocko (d99326cc) | row191 control/resume sage-2427 | control12/12;SR08separate timeoutkill;49resumed assertionkills thenKS43survived;total56assertionkills+1timeout,1survivor,19unrun;88blobs restored,cwd sweep[],slot returned,Sage/Mos informed;no retry/edit.
+
+2026-10-22 04:21:30 UTC | Rocko (d99326cc) | row191 KS43+19 retarget run | KS43assertionkill thenKS44invalid mutation syntax;57assertionkills+1timeout,1invalid,18unrun;stopped,no edit/retry;88hashes restored,cwd sweep[],slot returned,Sage/Mos notified.
+
+2026-10-22 04:30:06 UTC | Rocko (d99326cc) | row191 KS44+18 resume | 10assertionkills thenKS54timeout-without-control despite dependency assertion;total67assertionkills+1timeoutkill,1unqualifiedtimeout,8unrun;88hashes restored,cwd sweep[],slot returned,Sage/Mos notified,no retry/edit.
+
+2026-10-22 04:41:46 UTC | Rocko (Codex gpt-6.1-sol,d99326cc) | row191 #1689 builder complete/in-review | published0fa7bf421,manifest0bcbf337;35singles336pass,9packages2403pass/1knownskip,10shells425selftests+156queue nodepass;75assertionkills+2controlledtimeoutkills=77;88hashrestore,cwd sweep[],slotreturned;in-review rev3114,expected no-token failure3115(exit1);Sage/Dewey handoff,no live action.
+
+2026-10-22 05:03:18 UTC | Rocko (Codex gpt-6.1-sol,d99326cc) | Vikunja502 processing test/runner hardening | brief+isolatedrocko-v502;expected wordingred→green,Node27/27,Python4/4,5/5assertionkills(includingSR08andKS54nohang),0skips/timeouts;sweep[],candidate5hashrestored,slotreturned05:01:29Z;candidate968d6ee3,runnerc5bdc764;packetready,no commit/push/liveaction.
+
+2026-10-22 05:07:34 UTC | Rocko (d99326cc) | Vikunja502 committed/review handoff sage-2482 | newbranchrocko/vikunja502-ce6a-20261022,source8e3c6a79b+packet9bf4683c6 on ce6a96ad6;5paths no base drift,range-diff=,patch-id37135ebe unchanged;manifest968d6ee3,packet93889519 verifies39/39;focused runs carry;Sage publish/Dewey review handoff sent,no push/liveaction.
+
+2026-10-22 05:10:00 UTC | Sage (1ef1e4f8) | serial landing 205 then 268 | 205: 3 commits, 4 paths, digest 858463b1, every scripts/test-*.sh green on ce6a96ad6, Duckworth N1-N4 carried (N1/N3 to 205b or R3, N2 to the 193b2 brief, N4 #1782 before any user thread goes live). 268 r4: c27207f6e on 205, 9 paths, digest caa0fa4e, patch-id 2942acc8 equal to r3. Overlap checks clean before both pushes. No live action; LIVE stays 86f95bb27.
+
+2026-10-22 05:58:59 UTC | Rocko | row 279 #1784: before, deadline overshoot skipped final observation and returned unknown; after, one-line for (;;) retains final mapping and unchanged unreachable fallback. Regression red as specified; whole stop-run 13/13 and processing-control 62/62; M1 assertion kill, no skips, restored and swept. Source 1016b8584, packet cad927137; manifest 312ed511d8f1cff826ee2fd547de8368923130c7bfe06236d8e29d8655b80aaa. Pending Sage publication and Dewey review; no live action.
+
+2026-10-22 06:15:54 UTC | Sage (1ef1e4f8) | row 279 #1784 landed (mos-1269) | Before: stopRun returned unknown for a live run when a sleep overshot the deadline. After: LANDED ceadad993 as a carry of cad927137 onto 343b6dd76 (range-diff 1:= 2:=, patch-ids 6d8ae7f4/e484c297 equal, Dewey carry c30410). Sage gate on cad927137: business 209/0/0, cli 794/0/0, discord processing + processing-stop 9/0/0. Correction: the first discord run wrote to a wrong out path and ran nothing; the rerun is the result. Overlap sweep clean (13, 257). Note rev 3144, done rev 3145. No live action; LIVE stays 86f95bb27.
+
+2026-10-22 06:37:43 UTC | Sage (1ef1e4f8) | row 194 b16 third red (mos-1269/mos-1270) | Gate on ceadad993 + 9cdc47d04: business 228/0, cli 826/0 (T9a passes), control-board 124/0, bus 705/1 at grant-executor.test.mjs G13 (timed out 10044 ms); conversation, webui and scripts/test-*.sh never ran. runb8 green 436/0/0, 17/17 mutants. Correction to sage-2524 (mos-1270): the stuck wait is the first until at :733, the holding file after decision.resolve, so the executor never started the install and hosts.revoke at :734 never ran; it is not a revoke-path hang. Ruling: a diagnosis run, 30 base + 30 candidate alternating under cli load, no gate retry.
+
+2026-10-22 07:51:04 UTC | Rocko | row 280 #1785: before, any TCP connect could accept a port our sshd failed to bind; after, attempt-local exact log proof plus liveness and connect, non-ephemeral picker, bounded scratch remote sleep cleanup. Both occupied regressions red on old acceptance; CRLF build failure captured and fixed under sage-2535. Committed source b765f5cb8, packet d6c924764, manifest27806c0579c76d0999d2e6be4180c3867570df0268af9d7e0d7b971af799e6f5. Repeats07:29:03Z–07:48:38Z grant1230/1230,host780/780,CLI1588/1588; final M1/M2 four assertion kills,0skips/timeouts,sweepclear. Sage publishes/gates; Duckworth reviews.
+2026-10-22 08:00:02 UTC | Sage (1ef1e4f8) | row 280 #1785 landed | before: the bus tests' scratch sshd helper returned a port on a connect alone, and 194 b16's gate hung at G13 (base hung too, honker-0127). After: b0fd28b6f on refactor, a ff from da5d3651d (b765f5cb8 + Rocko slim packet; full evidence d6c924764 on rocko/row280-da5d-20261022). Duckworth approve rev 3153 (manifest 27806c05). Sage gate bus 656/0/0, ge 41/0/0, hr 26/0/0 (c30431). Rocko repeat 2010/2010 under cli 1588/1588, no timeout; M1/M2 killed 4/4. Two build-time slips recorded in Rocko's packet: a runner root path (no test ran) and the CRLF sshd log line. Overlap 13/257 clean. Note rev 3154, done 3155, #1785 closed c30432, P19 511 comment 623. 194 b17 rebases on b0fd28b6f (sage-2542).
+
+2026-10-22 08:38:11 UTC | Sage (1ef1e4f8) | row 194 #1692 landed | before: 194 b16 9cdc47d04 went red three times (stopRun deadline, then the bus test sshd port race), fixed by rows 279 and 280. After: fd6dd327c on refactor, a ff on e122aad8e. b18 is b17 3f451772d rebased after my doc and queue push blocked a ff (16 =, series patch-id 64303253f8e6, packages equal b17). Webby approve rev 3160 on manifest 29f131ab. Honker gate on fd6dd327c: runb8 503/0/0, mutants 17/17; 18 packages 3668/0, ten scripts rc=0, Docker up, env skips named. The secret scan hit three fake_*_token fixtures in bus tests (false positive). Note 3161, done 3162; #1692 closed c30435; P19 414 comment 625. LIVE still 86f95bb27.
+2026-10-22 08:42:04 UTC | Honker (Claude Opus 5.5, ecd17786) | row 194 #1692 agent lifecycle build | before: no Console or CLI lifecycle for agents (create, launch, terminate, regenerate, delete) and no per-agent hire/fire veto. After: 16 commits landed as fd6dd327c (b18, a rebase of b17 3f451772d on e122aad8e: 16 =, series patch-id 64303253f8e6, packages equal b17). Manifest 53 paths, digest 29f131ab. Final run on fd6dd327c: runb8 39 files whole 503/0/0, mutants 17/17 killed, restores matched; gate.sh merge onto e122aad8e, 18 packages 3668/0, ten scripts rc=0, Docker up, four env skips named (webui esbuild pin, queue render outside canonical root, test-task live provider x2); sweep clean. Corrections: b16 went red at G13; my diagnosis (60 runs, base hang on port 38927 sshd bind EADDRINUSE) placed it outside 194, fixed by row 280; the g13diag load kill missed its process group and overran about 8 minutes; one runb8 launch failed rc=126 on a lost exec bit before any test ran; the b17 runb8 was stopped unscored when refactor moved. In-review revs 3156/3157, Webby approve rev 3160.
+2026-10-22 09:43:34 UTC | Sage (Claude Opus 5.5, 1ef1e4f8) | row 236 #1742 Gitea grant landing, and row 281 filing | 236 landed bd5f11ded at 09:37:31Z, a fast-forward on be2b008cc: 08840f3c1 rebased past 194 (commit 1 unions only, 2-7 =), e40b74beb for two stale out-of-manifest pins, bd5f11ded for a gitea-not-configured raise test. Dewey approve rev 3168 on manifest 0b00269b (34 paths). Megavolt gate under my slot: 2c bus 131, cli 224, route 28, docker 1; whole bus 765, business 228, cli 832, ten scripts rc=0; mutants 40/40; skips named, env only. Overlap with 13 and 257 clean. Note 3169, done 3170; #1742 closed c30451; P19 436 comment 639. Correction: the first whole run on ce74477e1 went red 762/764 on the two stale pins; that run is void. Follow-up per mos-1271: row 281 (#1786), a fire or delete revokes host and Gitea grants, Megavolt owns, Dewey reviews; brief docs/plans/2026-10-22_fire-revokes-grants.md; DEFERRED entry points at it.
+2026-10-22 10:30:51 UTC | Sage (Claude Opus 5.5, 1ef1e4f8) | row 274 #1779 FED R3 broker user principal landing | 274 landed 4c485c63b at 10:28:26Z, a fast-forward on 47a35bf43: six Morgana commits d20c92bf6..4c485c63b. r5 f58cfc361 moved covers, LEVELS and the all marker into business/src/vocabulary.mjs so the broker keeps its sandbox import closure (M16/M16b/M16c). r6 4c485c63b pins USER_VERBS as the ruled seven and widens the R3 off-list set. Dewey approve rev 3178 on manifest 00047b52 (13 paths), comment 30487. Morgana gate under my slot, 10:09-10:22Z: 23 touched files 0 fail, bus 787, harness 151, business 228, cli 832, seat 167, ten scripts rc=0, mutants 22/22; skips named, env only (test-queue 1, test-task 2). Overlap with 13 and 257 clean. Note 3179, done 3180; #1779 closed c30491; P19 414 comment 646. Corrections: the r5 gate on f58cfc361 went red (M3x/M6x survived the R3 off-list set), void; my gate comment 30490 said 24 touched files, the count is 23; the kit comment guessed human-required for the M3x wall, the run code is not-holder.
+2026-10-22 10:57:34 UTC | Sage (Claude Opus 5.5, 1ef1e4f8) | row 256 #1761 the human deletes a creative instance, landing | before: row 194's deleteRefusal refused every END_PROTECTED definition for every actor, so nobody could delete a creative instance; the human could only delist one with launch: false. After: 256 landed f12441d4f, a fast-forward on 0165be266 (the 274 landing plus its docs and queue commits): four Honker commits b5f1e09d6..f12441d4f, patch-id b28e63746f8c. One protectedRefusal predicate serves delete and the listing's per-viewer endProtected; any non-human actor gets organization-creative-human-only, fire unchanged. Rebased twice (past 236, then past 274), each range-diff 4/4 =, carries checked by Webby (webby-0126, webby-0128). Webby APPROVE on manifest-r3 01eb75aa (10 paths), comment 30519, posted by Sage as jarvis because Webby has no token; review request c30518 (Sage, revs 3183/3184) after Honker's request failed (no token, revs 3181/3182). Gate by Honker under Sage's slot 10:33Z-10:52Z on merge tree ced6bf5f8: touched files 31/0/0, 18 packages 3757/0 (bus 788, business 231, cli 832, webui 335), ten scripts/test-*.sh rc=0, mutants M1, M2, M3, M4a, M4b killed with blob-checked restores. Skips, named and environment-only: webui editor rebuild byte check (esbuild 0.28.1 installed, pin 0.28.2), test-queue non-canonical root, test-task live provider x2. Overlap with in-review rows 13 and 257 clean. Order change sage-2594: 256 landed before 277 because 277's gate had not run. LIVE is still 86f95bb27. Queue note rev 3186, done rev 3187; #1761 closed c30520; P19 416 comment 649.
+2026-10-22 11:19:28 UTC | Sage (Claude Opus 5.5, 1ef1e4f8) | row 277 #1782 the owner sees a thread agent's claims, landing | before: a thread run's role.claim wrote thread_claims only, and the agents verb read role_claims only, so the owner had no way to see a thread agent's claim (PRD :1083-1084). After: 277 landed 62f53b1e0, a fast-forward on 46dedf925 (the 256 landing plus its docs and queue commits): seven Morgana commits 1d5d00939..62f53b1e0, range patch-id 7f0533520bd2. A bus verb thread.claims serves human and reader sessions; mosaic agents adds thread lines without --tester or --json, --json keeps the agents array, the tester path makes one call, a refused thread.claims prints the role lines and the refusal code, and an error with no bus code still throws. Rebased onto 0165be266, then onto 46dedf925 after 256 landed first (sage-2594); both range-diffs all =, manifest e281aa2c unchanged (duckworth-0126). Duckworth APPROVE comment 30539, recorded rev 3192, posted by Sage as jarvis; review request c30538 (revs 3190/3191) after Morgana's request failed (no token, revs 3188/3189). Gate by Morgana under Sage's slot 11:01:23Z-11:13:56Z: 7 touched files 0 fail (thread-claims 5, message-filter 6, user-principal 22, format 4, tester 11, other-tree 4, host 43), bus 793, cli 836, harness 151, business 231, seat 167, ten scripts/test-*.sh rc=0, M1-M9 killed on committed bytes. Skips named, environment only: test-queue non-canonical root, test-task live provider x2. Overlap with in-review 13 and 257 clean. Duckworth N1 (M8 dies on a rethrown error) to DEFERRED; 0123 N3 per-session claims binds 264a r7. Note rev 3193, done rev 3194; #1782 closed c30540; P19 506 comment 652. Also landed as doc-only picks: Honker's 256 BUILD.md gate results (80620a3a0 as b83173305) and Megavolt's 236 BUILD.md runs (9c6e1a165 as 01ea1fb11). LIVE is still 86f95bb27.
+
+2026-10-22T11:37:16Z | Gander row278 #1783 implementation prepared, verification held | Before: owner thread claims were visible through row277 but absent from the Console Agents view. After: prepared a separate four-field table, a Console-owned read adapter, section-local refusal handling and an explicit tester refusal before busRead. Ten tests and six unique check definitions are prepared but unrun. Base moved from980cec88c to6af85df4b under sage-2625 on new gander/row278-b; no candidate path overlapped. No Node process, syntax check, test, browser, queue command, push helper or live action ran. Next: Sage CLEAR for the queue claim and gate; Webby reviews the verified manifest.
+
+2026-10-22T12:09:45.285844+00:00 | Gander row278 run1 void, loader fake repaired | First new-file run stopped3/1/0 because the fake omitted BusReadError imported by base chat.mjs. Sage-2638 places the first-own-test red and permits the assertion-preserving export; test-only commit964b6b184. Runtime bytes unchanged. All run1 results void, no timeout or run leftovers. Run2 must restart every step after busy CLEAR; a second red goes to Sage then Mos before any change. No product acceptance or push claimed.
+
+### 2026-10-22 | Gander | row278 gate run3
+
+Fresh gate on3e4c77ac6 under sage-2648: bus793/0, WebUI345/0/1 (esbuild version skip), all ten shell files425/0, touched files15/0, M1-M6 killed6/6. No timeout; sweep0 run-created leftovers. Runs1/2 void. Seven-path manifest8fa859a0 goes to Webby for final review. No landing or live change.
+
+2026-10-22 11:29:09 UTC | Rocko | V502 carry/rerun on980cec88c: source407c8d7be and packet04a86cf33 match approved8e3c6a79b/9bf4683c6 patch-ids, no conflicts. Dewey0834 carry conditioned on rerun, satisfied under sage2616: stop-run13,processingHTTP6,bustasks9 allgreen (Node28/28),Python4/4,0skips/timeouts. Manifest5758d699,source5/5restored,cwdsweep[]. Doc rerun packet6af85df4b explicitly pushed to rocko/vikunja502-980c-20261022; no live action.
+
+2026-10-22 11:30:17 UTC | Sage | Vikunja 502 (row 191 follow-up, no queue row) LANDED 6af85df4b, a fast-forward from 980cec88c. Before: the processing failure diagnostics and cleanup in stop-run, processing HTTP and bus tasks tests were Dewey-approved on the pre-194 base only (8e3c6a79b/9bf4683c6). After: Rocko's picks 407c8d7be/04a86cf33 carry the same patch-ids (37135ebe/0dbcda54), plus a doc-only rerun record 6af85df4b. The rerun on the new base was green: stop-run 13/13, processing HTTP 6/6, bus tasks 9/9, Python 4/4, 0 skips. Dewey carried the approve (dewey-0836). mosaic-task.mjs is unchanged, so N7 (runs suite) didn't trigger. Overlap with in-review rows 13 and 257 was clean. LIVE is still 86f95bb27.
+
+2026-10-22 13:10 UTC | Sage | Rows 278 and 281 LANDED. Before: refactor at 6af85df4b (V502). Row 278 (#1783, Gander, Webby): the Console Agents view shows thread claims in their own section. It landed as 385a7194c at 12:39Z, ff, 9 commits, manifest 8fa859a0. Run 3 was green: bus 793, webui 345/0/1, ten shells 425/0 under the 3x limits (mos-1275), M1-M6 killed. Runs 1 and 2 were void, on fixture fixes 964b6b184 (placed by Sage) and 9696d1fcb (ruled by Mos, mos-1275). Webby approved (c30588, rev 3200). Done rev 3202, #1783 closed c30589. Row 281 (#1786, Megavolt, Dewey): a fire or a delete revokes the instance's host and Gitea grants. It landed as e479521d3 at 13:06Z, ff, 17 commits, manifest b73d4c81. Slot on 7979fb41e: bus 819, business 231, cli 837, dewey-bus 76 with the Docker gitea-grant test, shells green, M1-M22 killed. The M1 hang was fixed at its cause in b4a (mos-1273). Dewey approved (c30614, rev 3207). Done rev 3209, #1786 closed c30621. Skips on both: test-task's row 244 live-provider pair and test-queue's canonical-root check, plus webui's esbuild rebuild test on 278. After: refactor at e479521d3. DEFERRED moves the grant gap to Done and opens Dewey's N1/N2 text gaps. LIVE is still 86f95bb27.
+
+2026-10-22 14:18:23 UTC | Sage | Row 264a LANDED (#1769, Gizmoduck, Duckworth): sessions per thread, schema 3k-3l. Before: refactor at e479521d3 (row 281). It landed as 84f53540d, ff, 21 commits, manifest 257408e9 (Duckworth approve rev 3214, comment 30640). Gate r13 on 2cc34aef8: 20 touched files, bus 827, cli 837, webui 345/1 named skip, ten shells under 3x limits, mutants M1-M4 killed on assertions. Corrections on the way: the kit stopped on first red, so four reds surfaced one at a time. r10 later3l missed a trigger (mos-1276). T2 had failed since r2 because refusals log action.refused (mos-1277, my sage-2257 wording). threads.test:341 kept the old trigger text (mos-1278). M2 was caught by the store trigger before any assertion, so it now drops the trigger too (mos-1279, four files with the SCHEMA_SHA256 pin). Deferred: actor_run pin binds row 269, esbuild skip to a later gate, session-scoped user reply binds row 272. No live change; LIVE is still 86f95bb27.
 2026-10-21 21:24:47 UTC | Gander row253 #1758 design r1 | Investigation began21:12Z under sage-2162; recorded now. Before: case2 installer still renders tester TCP and case1 acceptance requires it. After: proposed design covers socket marker migration, actual configured dataRoot within unchanged hardening, target-uid metadata queries, kernel-peer acceptance observation and explicit same-uid residual. Initial inventory saved; no passing final static-check claim, product edit, test, host or live action. Duckworth design review precedes code.
 
 ### 2026-10-21 row253 implementation prepared, gate pending
@@ -5197,3 +5318,27 @@ Before: managed project/thread verbs had no Console conversation area. After: fi
 Gander: after Duckworth-0100 design approval with C1-C5, prepared the two host-script socket migrations, fake fixtures, updated retirement docs and 33 unique change checks. Static syntax/diff and source inventory checks pass; behavioral tests have not run. Sage-2191 queues the requested full scope and will send CLEAR. No host, unit or live config changed.
 
 2026-10-22 02:13:30 UTC | Gander row253 C4 committed candidate, gate pending | Sage-2335 explicitly directs committing runnable source and tests before the whole gate. The repair implements the approved after-uid supervisor with separate inner/outer bounds; the static packet is b64aa316a. Current repaired bytes have run no syntax check, test, probe or host experiment. Earlier static syntax results apply only to the old build. Results from 8a8df4171 are historical and do not carry. Duckworth static verdict and Sage CLEAR precede all gate execution. F5 is row276 / #1781 in DEFERRED.md.
+
+2026-10-22 14:45 UTC | Gander row253 focused27 on finalaca16404c base | Fresh0604d91fc / manifest573c51cf:27 whole files604/0/0, no timeout/retry, case134/0 in99.281s, case243/0 in66.418s, stack-release includingT46221/0 in583.453s. N9 sandbox bind ran and passed, no focused skips. Seven source blobs unchanged; sweep0 run-created leftovers, pre-existing infrastructure receipts retained. Whole gate and M1-M40 await separate Sage CLEAR after Duckworth rebase check. No live action.
+
+2026-10-22 14:46 UTC | Gander correction to the row253 focused27 entry immediately above | stack-release whole was218/0/0, not221/0. The27-file sum604/0/0 and duration583.453s are unchanged; raw files/results.json and SUMMARY.json give the exact per-file totals.
+
+2026-10-21T16:04:23Z | Q195/Q196 writing editor design, #1752 / Vikunja #448 | Before: row 154 edits Markdown in a separate Docs view, with no selected-word thesaurus or document pins. After: design draft on gyro/editor-design compares three editor approaches, records WordNet source/license/size, folds the pane/pin model and specifies guarded context/proposal APIs, DesignCraft handoff and seven proposed briefs. Q196 changes the basis to a Word-like interface. Verification so far: editor/provenance checks 10 pass, 1 explicit rebuild skip (pinned esbuild absent); brief fields, unique headings and 11-line checklist checked. Product, queue and live state unchanged. WordCraft scratch evaluation is being incorporated before publication. Review and Jason choices remain open.
+
+2026-10-21T16:22:36Z | Q195/Q196 design verification, #1752 / Vikunja #448 | Folded Fenton 7caf8008b and Louie 880ef19e0. Recommend bounded O3: Word-like DOM editor plus isolated headless DOCX export, with explicit feature cut and semantic loss checks. WordCraft web 44,179,239 bytes, identical twice; measured comment/footnote conversion limits recorded. Seven briefs and 12-line checklist validated. Fresh editor/provenance: 10 pass, 0 fail, 1 explicit rebuild skip (esbuild 0.28.2 absent). CI queue guard identity gyro/purpose push returned documented degraded-pass (exit 0), CANNOT_ASSERT credential-unresolvable, scratch audit gyro-q195-ci-queue-audit.jsonl; no fallback or CI-green claim. Documentation-only candidate for Mos/Fenton review, no source, queue or live changes.
+
+2026-10-22T16:06:34Z | Q195/Q196 design review fixes, #1752 / Vikunja #448, mos-1300 / fenton-0004 | Before: draft 105811400 had owner-only thread wording, stale source positions, two mismatched seat/model assignments, an assumed library save boundary and 12 owner questions. After: grant-aware pin validation and stale/revoked access redaction; references refreshed against aca16404c, including public/bus.js and README offsets; Sage assigns model-only seats; unimplemented library.file.save/C2-11b brief blocks book editing; tabs explicitly cover 62-76rem; J7 stricter context choice recorded; pronouns removed; six owner questions. Static docs/source-anchor checks only, no builds, product suites, MVP gate slot or live action. Fenton re-check pending; O3 and both companion folds retained.
+
+2026-10-22T16:09:56Z | Della mos-1303 / Vikunja 460 Q217/Q222 revision | Before: Q1/Q2 open and Q3-Q7 phrased as Jason questions. After: Jason-created InMotion/woltje.com ingress recorded; per-source mailboxScope defaults none with human-only CLI then Console writer and named default/change/agent-refusal tests. Q3-Q7 settings/defaults/owners documented; no new external decision required for default development, conditional provider/spend/exposure list retained. PRD/grant/data.delete/live gates preserved. Docs only, no product suite or live operation. Earlier uncommitted append-only PRD review session receipts are preserved in this docs commit. Ludwig reviews before Sage landing.
+
+2026-10-22T16:12:26Z | Della ludwig-0035 / mos-1303 / Vikunja 460 focused corrections | Verified REQ-WAIT-2/3 at db1e7732a: Jason approval is required to route mail.access out of hard waits. Restored explicit Jason-approved PRD gate; no Q211 waiver inferred. Named tunable parser/attachment settings, defaults and schema/test review ownership of resource bounds; E04 checks changed values and bound refusals. Clarified Q8 extraction stays Jason choice. Docs-only checks, no product/live action; focused review before Sage handoff.
+
+2026-10-22 13:06 UTC | Megavolt | Row 281 (#1786) build. Before: a fire or delete left host_grants/gitea_grants rows, the host line and the Gitea token live. After: step G in broker.mjs revokes them in a detached job per agent (the host line first, then Gitea local-first with an admin preflight); a refusal is grant.revoke.refused plus a human message; open grant decisions are in the set; a raise for a fired agent refuses instance-fired. Tests T1-T14 (bus fire-revokes-grants, lifecycle-revoke, grant-executor, gitea-grant; cli lifecycle). Gate on 7979fb41e: base 121/121 + 24/24, 29 anchors, M1 exit check rc1/17, M1-M22 22/22 killed, dewey-0840 files 76+14+23, bus 819, business 231, cli 837, ten shells rc 0 under the mos-1275 limits; skips: test-task row 244 live-provider pair, test-queue canonical-root check. Corrections: the first base run on c174f37ac went red on five first-run test defects (b3, test only); the first mutant run on 06ee5ed6b hung on M1 because T6c's held loop never ended (b4a fixed the teardown, and the runner now has timeout -k 10 180 and an exit check without --test-force-exit).
+
+2026-10-22T16:36:30Z | Della row224 C2-05b #1725 preparation | Before: C2-05a queries exist at 4f3fbc25a but no broker lookup verbs or typed tools. Scope: broker/tools plus Sage-authorized runtime/bundle integration, tests and docs. Existing human-only library reads retained; five agent queries require a live holder and trusted configured source. Code/docs only under row253 gate; no Node/test/push/claim. Runtime ownership coordinated with Rocko219/Huey272.
+
+2026-10-22T16:52:55Z | Rocko | Row219 prepared under sage2793/2807; explicit creative thread/default-session selection, narrow metadata route/picker U1–U5,22 static mutant sites; unrun while253 holds.
+
+2026-10-22T17:42:16Z | Sage | Row 253 (#1758, Gander, Duckworth) LANDED 48e450ce8. Before: refactor at aca16404c; case-sudo calls had no supervised session check and the M21 survivor hid behind a fast-exit fixture (mos-1297). After: a fast-forward of 22 commits; manifest 591020a1 rechecked with 0 mismatches; run 5 whole gate green with M1-M40 killed, the M38 PID equals SID assertion added under mos-1298; Duckworth APPROVE rev 3252, note rev 3253, done rev 3254; #1758 comment 30701 and closed; P19 416 comment 719. N1 (fast child reported as exit 85) is DEFERRED as Vikunja 532.
+
+2026-10-22T18:11:57Z | Sage | Row 275 (#1780, Morgana, Duckworth) LANDED 3410df7c3. Before: refactor at 48e450ce8; viewers had no verb list of their own and board reads were not refused to users. After: a fast-forward of 3 commits; manifest 39847b15 (4 paths) blobs match; gate 17:52:12Z-18:05:00Z green (whole files 7/22/6, bus 834, cli 861, harness 151, business 231, seat 167, 10 scripts with 3 named skips), M6 and M10 killed; Duckworth APPROVE rev 3260 (comment 30717); note and done by sage-2897; #1780 comment 30728 and closed. N1 (board refusal test as a loop over BOARD_VERBS) is non-blocking.

Containerfile

@@ -22,6 +22,7 @@ RUN npm ci --ignore-scripts
 # runtime adapters.
 COPY contracts /opt/mosaic/contracts
 COPY src /opt/mosaic/src
+COPY packages/processing-control/src/state.mjs packages/processing-control/src/entrypoint.mjs /opt/mosaic/processing-control/
 COPY adapters /opt/mosaic/adapters
 RUN chmod 0555 /opt/mosaic/contracts /opt/mosaic/contracts/* \
     && chmod 0555 /opt/mosaic/src /opt/mosaic/src/*.sh \

agents/README.md

@@ -27,6 +27,11 @@ not fleet seats. Keep changes in `/mnt/storage/src/mosaic-stack`; do not modify
 | Gizmoduck | Federation design (#414) and builder of FED R1 | T3 session (Claude, Opus 5.5, thread 9312a896) | none, T3 only |
 | Webby | Reviewer: Case 2 designs, rows 192 and 194 | T3 session (Claude, Opus 5.5, thread 03086006), started by Mos (mos-0981) | none, T3 only |
 | Duckworth | Reviewer: federation designs, row 193 | T3 session (Claude, Opus 5.5, thread ffceafec), started by Mos (mos-0977) | none, T3 only |
+| Della | Builder, email plan (Vikunja 460) and row 224 (C2-05b) | T3 session (Codex, gpt-6.1-sol, thread 66735a7f), started by Mos | none, T3 only |
+| Scrooge | Builder of row 252 and reviewer of row 272 | T3 session (Claude, Opus 5.5, thread 629b6cd3), started by Mos | none, T3 only |
+| Huey | Builder, row 272 (T1 sessions) | T3 session (Codex, gpt-6.1-sol, thread cabd45ca), started by Mos | none, T3 only |
+| Louie | Builder and research, editor evaluation and row 174 | T3 session (Codex, gpt-6-luna, thread bfd13d49), started by Mos | none, T3 only |
+| Ludwig | Builder and reviewer, post-v1 email PRD and row 258 (E01) | T3 session (Claude, Opus 5.5, thread 8615b2a6), started by Mos | none, T3 only |
 | Sage | Project lead: coordination, review, integration; earlier DYOR strategy records retained | T3 session (Claude Code); Pi launcher `zai/glm-5.3:high` retained | `agents/sage/launch.sh` |
 
 Each script supports `--check` and `--fresh`. Normal launches resume the agent's

agents/darkwing/work/queue-251/BUILD.md

@@ -0,0 +1,191 @@
+# Row 251 build: T27 lists no identities right after `ssh-add -t 1` (Vikunja #453)
+
+Brief `docs/plans/2026-10-21_t27-ssh-add-lifetime.md` (rev 2931), Mos ruling mos-1185 item 2, assigned in
+sage-2075. Owner Darkwing, reviewer Dewey, gate owner Sage. Branch `darkwing/row251` from 3b0aef995,
+claimed in-progress at rev 2938.
+
+## Step 1: the failure names its cause (e5e4b2e5a)
+
+T27's two lists now carry a message that prints only when they fail. It gives the time from addKey's
+start to its resolve and to each `ssh-add -l` call, the hrtime at each with how far into its second it
+fell, `/proc/uptime` at each, and whether the agent process and its socket were still there. The checks
+themselves did not change. The commit holds nothing else.
+
+## Step 2: the cause
+
+ssh-agent counts a key's lifetime in whole seconds of CLOCK_BOOTTIME, at the add and at the reap. I read
+OpenSSH 10.5p1, the version on dragon-lin (`ssh -V`: OpenSSH_10.5p1), at tag V_10_5_P1 (ssh-agent.c
+sha256 873691c4, misc.c sha256 ee467f43):
+
+- `misc.c:1790-1798` and `:1828`: `monotime()` returns `ts.tv_sec` of `clock_gettime(CLOCK_BOOTTIME)`,
+  falling back to MONOTONIC. The fraction of the second is dropped.
+- `ssh-agent.c:1315`: the `-t` constraint sets `*deathp = monotime() + seconds`. Lines 1410 and 1598
+  do the same for the agent's default lifetime.
+- `ssh-agent.c:1064`: the reaper drops a key when `now >= id->death`, `now` being `monotime()` again.
+- `ssh-agent.c:2650`: the main loop runs `reaper()` after every poll, before it reads requests. A list
+  that arrives after the boundary sees the key gone.
+
+So a key added at second s plus a fraction f dies at s + N, and `-t N` keeps it N - f seconds, between
+N - 1 and N. With `-t 1`, an add late in a second leaves the key milliseconds to live. That matches
+Sage's probe in the brief: 8 of 80 `-t 1` adds missed, each one made at 0.9947-0.9973 of a monotonic
+second and finished at 0.998-0.0008, and none earlier in the second missed. It also matches proof 5's
+failure, where the first list ran 31.9 ms into the test and found no identities.
+
+Node's hrtime is CLOCK_MONOTONIC. BOOTTIME differs from it by the time the host spent suspended. On
+dragon-lin the difference read 0.000001 s at 19:09Z, so a monotonic second boundary is a BOOTTIME one
+here.
+
+`addKey` and the agent start are not the cause. `addKey` passes the lifetime through as `-t`
+(`host-run.mjs:90`), and the agent starts with no default lifetime (`:175`). Production adds the key
+with `timeout + 30` (`:180`), where losing up to a second makes no difference. The only caller that
+can't afford the lost fraction is T27, which asks for 1 s. The fix belongs in the test's lifetime choice,
+and `host-run.mjs` doesn't change.
+
+The slot confirms this against T27 itself (below), not just from the source.
+
+## Step 3: the fix (this commit)
+
+T27 adds the key with `-t 2`. The agent then keeps it more than 1 s and at most 2 s. The first list
+runs milliseconds after the add, so it has over a second of margin even under load. The sleep before
+the second list grows from 2.5 s to 3.5 s, which keeps the old 1.5 s margin past the new 2 s ceiling.
+Both checks stay: listed after the add, gone after the lifetime. A comment above the add says why the
+lifetime is 2.
+
+I considered `-t 3` with a 4.5 s sleep for a 2 s floor. One second of floor is far above anything the
+first list has needed (31.9 ms in proof 5), and the concurrent-suite run below tests it under load, so I
+took the smaller change.
+
+## Base
+
+The branch stays on 3b0aef995. By 19:15Z origin/refactor was at 6096b051b, after rows 66 and 243
+landed. `git diff 3b0aef995 6096b051b` touches neither `packages/bus/src/host-run.mjs` nor
+`packages/bus/tests/host-run.test.mjs`, so there's no rebase (sage-2084). Row 243 did change
+`packages/bus/tests/process.test.mjs`. My slot's bus suites run that file as it was at 3b0aef995, and the
+gate rerun on Sage's slot runs it as landed.
+
+## Prediction for part A on e5e4b2e5a (written before the slot)
+
+The hook starts `ssh-add -t 1` at the given fraction of a monotonic second. From the brief's probe, the
+agent stores the key about 3 ms later. The first list reaches the agent a few ms after addKey resolves:
+Node's exit event, the mark, and `ssh-add -l`'s own start. A red needs the add to land before the second
+boundary and the list to land after it.
+
+- 0.990: green. The add and the list both land before the boundary.
+- 0.993, 0.995, 0.996, 0.997: red expected. The add lands before the boundary, the list after. At 0.993
+  and 0.997 I'm less sure, because the list (at 0.993) or the add (at 0.997) can land right at the
+  boundary. A green at either is in line with the cause, and so is a red.
+- 0.998: green. The add lands after the boundary, so the key gets almost a full second.
+
+Every red should show "first list got" an answer with no SHA256 line. It should also show addKey
+resolving before a second boundary and the first list starting after it or within a few ms of it, with
+the agent alive and its socket present.
+
+Under sage-2084's rule, on e5e4b2e5a only a red at 0.990 or 0.998 counts toward the stop, and two such
+reds stop the run. On the fix commit any red counts, and two stop it. In parts B to D, the first red stops
+the run.
+
+## Slot plan
+
+All scripts are in `/mnt/storage/scratch/darkwing-251-out/`, launched from `/`, each behind the busy
+checks and chained with `&&`, TMPDIR under `/mnt/storage/scratch/tmp`.
+
+1. Confirmation. `align-hooks.mjs` is a load hook, outside the repo, that serves `host-run.mjs` with
+   `addKey` wrapped to start `ssh-add` at a chosen fraction of a monotonic second. T27 runs unchanged
+   under it, alone (`--test-name-pattern`). It runs at fractions 0.990, 0.993, 0.995, 0.996, 0.997 and
+   0.998, three times each:
+   - on e5e4b2e5a (step 1, `-t 1`). Expected: some first lists fail, and the step 1 message shows the
+     add's resolve and the list on either side of a second boundary, with the agent alive and the
+     socket present. These reds are the point of the run.
+   - on the fix commit (`-t 2`). Expected: all 18 pass.
+2. `host-run.test.mjs` whole, once, on the fix commit.
+3. The bus suite whole, three times in a row.
+4. The bus suite whole in two clean worktrees at the same commit, started together.
+
+## Slot results
+
+Sage's CLEAR came in sage-2154 at 20:58:55Z. `slot-251.sh` ran parts A and B from 20:59:22Z to 21:01:33Z,
+on node v26.8.1 and OpenSSH_10.5p1, with TMPDIR `/mnt/storage/scratch/tmp/r251`. At the start, BOOTTIME
+minus MONOTONIC read 0.000001 s, then 0.000000 s twice (dewey-0769 N1). So the hrtime fractions below
+put the agent's second boundary in the right place.
+
+### Part A: T27 alone under `align-hooks.mjs`, 3 runs per fraction
+
+The fraction is when the hook started `ssh-add`. The hook logged each start within 0.0001 of its target.
+
+| fraction | e5e4b2e5a (`-t 1`) | 68f2dfd4b (`-t 2`) |
+|---|---|---|
+| 0.990 | 3 pass | 3 pass |
+| 0.993 | 3 pass | 3 pass |
+| 0.995 | 3 red | 3 pass |
+| 0.996 | 3 red | 3 pass |
+| 0.997 | 3 pass | 3 pass |
+| 0.998 | 3 pass | 3 pass |
+
+e5e4b2e5a went red 6 times out of 18, every time at a fraction the prediction named, so none of them
+counted toward the stop. 68f2dfd4b passed all 18. The fix runs used 68f2dfd4b, whose test blob is the same
+as c19b4167e's (280132c7).
+
+Every red failed on the first list and got `"The agent has no identities.\n"`, with the agent alive and
+its socket present. The step 1 message gave these hrtime fractions. "addKey start" is the mark before the
+hook's wait, so its fraction is earlier than the ssh-add start.
+
+| run | addKey resolved | first list mark |
+|---|---|---|
+| 0.995 rep 1 | 0.9992 (+317.6 ms) | 0.9993 |
+| 0.995 rep 2 | 0.9991 (+846.5 ms) | 0.9991 |
+| 0.995 rep 3 | 0.9988 (+845.0 ms) | 0.9988 |
+| 0.996 rep 1 | 0.9999 (+839.8 ms) | 1.0000 |
+| 0.996 rep 2 | 0.0004 (+845.0 ms) | 0.0004 |
+| 0.996 rep 3 | 0.0002 (+835.9 ms) | 0.0002 |
+
+At 0.995 the add finished about 4 ms in, before the boundary, and the list mark came just before it. The
+`ssh-add -l` process then reached the agent after the boundary. At 0.996 the agent stored the key before
+the boundary, and addKey resolved just after it. In both cases the key's whole second ended between the
+add and the list, which is the cause step 2 gives. The two edge fractions came out green on the first
+build. At 0.993 the list still reached the agent before the boundary, and at 0.997 the add landed after
+it, so the key got almost a full second. The prediction allowed either result at those two.
+
+### Part B: `host-run.test.mjs` whole on 68f2dfd4b
+
+24 tests, 24 passed (21:01:18Z, 14.0 s).
+
+### The stop before C1, and the resume
+
+At 21:01:33Z the script stopped before C1, with exit 4 and no red. My own `busy.sh` matched two `sleep 60`
+processes, mine, in `darkwing-r251/packages/bus`. Part B left them. They come from T27 "the start sweep
+keeps a live bus dir and kills only a matching live process" (`host-run.test.mjs:528` and `:536`). Its
+`t.after` SIGKILLs the `/bin/sh -c 'sleep 60; :'` parent, but the `sleep` child lives on for up to 60 s.
+That code is outside this row's diff, so the row leaves it alone, and it's recorded below as a follow-up.
+Sage confirmed (sage-2159) that the right move is to resume only the scope that hadn't run.
+
+`slot-251-cd.sh` runs C and D as `slot-251.sh` has them, with the same two busy checks. Before each check,
+it waits up to 75 s for those orphans to exit: my uid, my trees, a command line of exactly `sleep 60`.
+It logs them as it waits. Any other process still trips the checks.
+
+### Parts C and D: the bus suite whole on 68f2dfd4b
+
+| run | start | tests | pass | fail | time |
+|---|---|---|---|---|---|
+| C1 | 21:02:48Z | 598 | 598 | 0 | 21.6 s |
+| C2 | 21:04:06Z | 598 | 598 | 0 | 21.4 s |
+| C3 | 21:05:26Z | 598 | 598 | 0 | 22.1 s |
+| D1, darkwing-r251 | 21:06:44Z | 598 | 598 | 0 | 24.2 s |
+| D2, darkwing-r251b, TMPDIR `r251-b` | 21:06:44Z | 598 | 598 | 0 | 24.2 s |
+
+The script waited 33 s before C2, 34 s before C3, 33 s before D and 32 s before the sweep. Each time it
+was waiting for that run's `sleep 60` orphans (two per suite, four after D), and nothing else. After the
+wait, the sweep of my trees, the out dir and TMPDIR found 0 processes left (21:08:04Z). Sage confirmed
+(sage-2159, sage-2160) that the short gitea-api and `node --check` runs they made during the slot weren't
+stops. None of my busy checks refused on any of them.
+
+These runs used the bus files as they were at 3b0aef995. Since then, origin/refactor (666173292, then
+7247d80c7 and c3d88840c with row 196) has changed `broker.mjs`, `runtime.mjs` and `server.mjs`, which T27's
+file imports, along with other bus files. None of those commits touch this row's two paths or
+`host-run.mjs`, and `git merge-tree` of c3d88840c with 68f2dfd4b is clean. The gate rerun in
+a clean worktree on Sage's slot runs T27 against them.
+
+### Follow-up, not in this row
+
+T27's start-sweep test leaves the `sleep 60` child of each planted shell running for up to 60 s after
+the test. Killing the process group (`process.kill(-pid)`; both shells are spawned `detached`) or
+`exec sleep 60` in the shell would end the child along with its parent.

agents/darkwing/work/queue-273/BUILD.md

@@ -0,0 +1,113 @@
+# Row 273 (#1778): activate --send and --no-sso
+
+Darkwing, 2026-10-22. Brief: `docs/plans/2026-10-22_activate-send-nosso.md` (blob in f0d0b31e9), approved by
+Mos in mos-1246 (F39). Base: origin/refactor 0042f713d. Reviewer: Filbert. Gate owner: Sage.
+
+## What changed
+
+Only `scripts/stack-release.sh` and its two node test files.
+
+- `activate --send` puts `--send` into the run's Console flags after `--sso` and before the tester
+  flags, where webui-service.sh renders it. It refuses `send-needs-sso` unless those flags hold `--sso`,
+  given or carried. The plan line is `send: on; --send was given`, or `send: carried` when the pointer
+  already holds it. `check_target` lets it name the pointer's copy only when the pointer holds no `--send`,
+  so a second `--send` on the same copy refuses `already-active`.
+- `activate --no-sso` refuses `sso-not-on` when the pointer holds no `--sso`. Otherwise it takes the
+  Console flags from a rollback set (below) and keeps the pointer's tester flags. `send_for_target`
+  drops `--send`, whether it came from the set or the pointer. It is the only place that does, so one
+  mutant there (M3) shows the drop is tested. The plan prints `sso: off; Console flags from <set>/<file>; restores <flags>`
+  and a send line, `send: dropped; --no-sso drops --send (F39)` or `send: off; --no-sso was given and the
+  pointer holds no --send`. The steps log gets `drop --send; --no-sso was given` and
+  `turn off --sso; the Console flags come from <set>/<file>`.
+- Usage errors: `--send` with `--no-send`; `--no-sso` with `--sso`, `--send`, a proof pair or
+  `--no-proof`; either flag on any verb but activate; either flag under `--units external`.
+  `--no-sso --no-send` is allowed, since the brief doesn't forbid it and both drop the same flag.
+- The set read that `sso_base` did inline for a rollback to a Console without `--sso` moved into
+  `set_flags`, which both paths call. Its three messages are unchanged, and T57 still pins them.
+- `from_log` has a new mode, `sets`: the activation of each ok activate and rollback line, newest first,
+  stopping at the adopt line, which took no rollback set.
+
+## The consequential choice: which set --no-sso reads
+
+The brief says the flags come from "the rollback set of the activation that turned `--sso` on", and that
+"a set whose Console already ran with `--sso`" refuses. Each set holds the Console unit from before its
+run. So the activation that turned `--sso` on is the newest one whose set holds a Console without
+`--sso`: every activation after it ran with `--sso`, and so did every set it left.
+
+`no_sso_base` walks the log's sets newest first and stops at the first set whose Console has no `--sso`.
+It refuses `sso-off-flags` at the first set it can't read (missing, failing its SHA256SUMS, or with no
+argv the script can parse), since it can't tell whether that set was the one. If every set ran with
+`--sso`, it refuses with `the Console in <set>/<file> already ran with --sso, and the log names no
+earlier activation`. A log with no set at all refuses with `the log names no activation with a rollback
+set`.
+
+The tradeoff: a later same-copy re-pin that carried `--sso` (a `--no-send`, or a re-pin onto a newer
+copy) doesn't break `--no-sso`, which the phase 2 window needs if a re-pin lands between step 5 and a
+rollback. The cost is that "a set that ran with `--sso` refuses" now applies only when no older set
+without `--sso` exists. A tampered set on the walk still refuses, even one newer than the set the walk
+would have used. Filbert, please rule on this reading.
+
+## Filbert's early look: B1 and N1 (sage-2315)
+
+Filbert accepted the walk. Sage ruled both findings into this row.
+
+- B1: row 200's rollback to a copy whose Console has no `--sso` took the flags from the set and kept
+  the pointer's `--send`. From an `--sso --send` pointer, which this row's `--send` can now make, that
+  gave a Console with `--send` and no `--sso`, which F39 b forbids. `send_for_target` now drops `--send`
+  whenever the run drops the pointer's `--sso`, so it is still the one place that drops it. The plan
+  line reads `send: dropped; the run drops --sso, and --send needs it (F39)`, and the steps log gets
+  `drop --send; the run drops --sso`. Row 200's sso line now names only the tester as following the
+  pointer.
+- Changed existing assertion, for the review to approve by name: T57 item 3 (sage-1389), "the
+  plain case", ends with `assert.deepEqual(pointer(g).console,[...noSend(gbase),...pair(f)])`. It
+  used to expect `'--send'` at the end. The case seeds a legacy `--send` pointer, turns `--sso` on
+  (which carries `--send`), then rolls back to B, whose Console has no `--sso`. A carried `--send`
+  that ends without `--sso` breaks F39 b whatever its source, so the old pin asserted the wrong
+  outcome (Sage accepted this in sage-2321). Row 200's two sso plan strings also lose "--send and"
+  (`ROLLBACK_PLAN` and the round 3 named-instance case), since `--send` no longer follows the pointer
+  on that path.
+- N1: the walk skipped an ok line with no activation. Skipping it could land on an older set that
+  isn't the right one, so it now refuses `sso-off-flags` with `an ok line in the log names no
+  activation`. The walk reads the log through `mapfile`. That gives no entry for an empty log, so a
+  log with no set still gets its own message.
+
+## test-release.sh
+
+The window plan says test-release.sh "gets cases for both". The brief lists it only as a file to run
+whole. test-release.sh is release.sh's Docker selftest and doesn't call stack-release.sh, so the cases
+live in the node tests and test-release.sh runs unchanged.
+
+## Tests (T58 in stack-release.test.mjs)
+
+- T1: `--sso --send` from B onto C1 with a tester port: plan, pointer, unit and steps. `--send` beside a
+  carried `--sso` re-pins C1 once; a second `--send` refuses `already-active`; C carries it.
+- T2: `--send` without `--sso` refuses on another copy and on the pointer's copy, also when the pointer
+  carries `--send` alone; `--plan` lists the refusal.
+- T2 (sage-2315 B1): `--sso --send` onto C1, then a rollback to B, whose Console has no `--sso`. The
+  pointer and the unit end with neither flag, and the plan and steps name the drop.
+- T2 and T4 usage: every forbidden pairing and verb, checked against the full usage text.
+- T3: from an `--sso --send` pointer, `--no-sso` on the same copy gives back the pre-`--sso` ExecStart
+  line byte for byte, without `--send`. A second case walks past a `--no-send` re-pin that ran with
+  `--sso` and keeps the pointer's tester port (7334), which differs from the set's (7333). A third
+  (sage-2305 a) turns `--sso` on, then re-pins twice with `--send` and `--no-send`, so the two newest
+  sets both hold `--sso`. `--no-sso` then gives back the arrival's ExecStart line byte for byte.
+- T4 (sage-2305 b): two sets, both edited or written to hold `--sso` with sums intact, refuse
+  `sso-off-flags` through `refused()`.
+- T4: `sso-not-on`; an ok line with no activation; a set that fails its sums, ran with `--sso`, has no
+  argv or is missing; a log with no set. Each runs through `refused()`, so nothing stops and nothing else changes.
+- T5: stack-release-external.test.mjs adds `--send` and `--no-sso` to the row 232 usage list.
+- T55 test 5 and the T57 usage test match the new usage line.
+
+## Mutants
+
+| # | Change | Expected killer |
+|---|---|---|
+| M1 | `set_flags` skips the SHA256SUMS comparison when `--no-sso` is given | T4 tampered set |
+| M2 | `no_sso_base` skips the `sso-not-on` refusal | T4 `sso-not-on` |
+| M3 | the `--no-sso` branch of `send_for_target` keeps `--send` | T3 |
+| M4 | `--send` skips the `send-needs-sso` refusal | T2 |
+| M5 | parse_opts drops the `--send`/`--no-send` rule | T2 and T4 usage |
+| M6 | a rollback to a Console without `--sso` keeps `--send` (B1) | T2 (sage-2315 B1) |
+| M7 | the walk skips an ok line with no activation (N1) | T4 no-activation line |
+
+Runs and results go in the round's notes once Sage clears the slot.

agents/della/README.md

@@ -0,0 +1,8 @@
+# Della
+
+Builder seat, Codex gpt-6.1-sol, started by Mos for the email plan (Vikunja 460). Owns row 224 (C2-05b) under Q220.
+
+No launcher in this directory. The seat runs as a T3 thread (thread 66735a7f) and works in its own worktree. It has no
+credentials of its own; it pushes only its own `della/*` branches through the repository credential helper (mos-0981),
+never `refactor`, `main` or another seat's branch. Registered by Sage on 2026-10-22 so the queue can name the seat as
+row owner under Q220 (mos-1301).

agents/gander/work/queue-253/BUILD.md

@@ -195,3 +195,119 @@ N4: SID confirmation now waits within the existing inner watchdog budget rather
 The required gate base is the refactor tip Sage names at CLEAR, 378a76b85 or later. This delta is prepared on the current seat branch for static review only; no old-base gate is authorized. The final integrated gate candidate will get fresh hashes and integration records before execution. c4/delta-0112/ freezes the seven source/test/doc paths, the delta from aa81ca390, and static uniqueness. Prior frozen packets remain unchanged.
 
 Duckworth-0113 approves 761893dac after git reads only (8d3fa3f20). B1 and M1 are closed; real timing remains unverified until the gate. N5 is harmless diagnostic noise on a vanished stat entry: the input redirection can report before stderr is redirected, and tester_capture discards supervisor stderr. No source change is made for it. N6 is recorded with R3: if the inner watchdog expires before kernel SID confirmation, finish has only the known child PID and kills that PID, not an unverified session. Other members may remain. Root still refuses, discards stdout and waits only within the outer bound. This is an explicit limit of cleanup before session identity is established, not a claim that the session was swept. The independent outer bound does not prove cross-session cleanup. Source/test bytes and the seven-entry manifest remain exactly those approved at 761893dac.
+
+Sage-2463 integration onto 0fa7bf421: new gander/row253-0fa7 preserves both earlier branches. Only BUILD-LOG append conflicted; current upstream remains an exact prefix. README auto-merged with row191 processing controls. Focused row253 tests do not read the changed Console/processing code, but WebUI whole covers it on this base. Only README changed in the manifest; refreshed digest 24b6a01b2ede6f025ec898fa4ec830bb9585ce6151d6298e713e31c7430a502b. integration-0fa7/ records source-only dependency inspection, range-diff and every commit patch-id. No test/syntax/probe ran.
+
+## Re-integration under sage-2659, no runs
+
+New branch gander/row253-385a on385a7194c, rebased source141b79c29. Only the BUILD-LOG append conflicted; kept upstream as exact prefix. Runtime scripts, focused tests and shared fixture match8de88458d byte for byte. DEFERRED/README absorb upstream additions; manifest72a70e99ba0416ceb1f63ed737132ebbeb212332d1441c362b3dfa6c8b00209c. integration-385a/ holds the range-diff, full and no-log patch-ids, upstream manifest diff, test import/read drift and40 unique targets. No test or Node ran.
+
+The focused tests indirectly import Store through CLI helpers, so they read/hash-check current schema.sql and migrations. 264a changes3k-to-3l ahead of this gate and needs a dependency re-check before CLEAR, even if its manifest overlap is empty. Whole stack-release T46 also reads current schema. case2 sandbox availability skip remains named under Duckworth0116 N9. The real Console files moved in278, but the focused tests write Console/config stand-ins; wholeWebUI covers the real changes.
+
+SHELL-LIMITS.json now includes fresh278 run3 receipts. Same ceil(3*longest)+120 formula; foundation maximum39.901s gives240s. window.py uses each recorded whole-shell limit, and driver.py classifies GNUtimeout124/137 as timeout, never kill. No script/product/assertion changed. Historical row253 results carry nothing after C4.
+
+| Shell | Longest recorded seconds | Limit seconds |
+|---|---:|---:|
+| scripts/test-auth.sh | 1.908123 | 126 |
+| scripts/test-conductor.sh | 8.057174 | 145 |
+| scripts/test-config.sh | 3.167892 | 130 |
+| scripts/test-discord.sh | 8.776728 | 147 |
+| scripts/test-extension-package.sh | 3.012857 | 130 |
+| scripts/test-foundation.sh | 39.901000 | 240 |
+| scripts/test-land-work.sh | 12.623263 | 158 |
+| scripts/test-queue.sh | 23.443742 | 191 |
+| scripts/test-release.sh | 12.168674 | 157 |
+| scripts/test-task.sh | 36.783798 | 231 |
+
+## Post264a integration, sage-2698, no runs
+
+New gander/row253-264a rebases eleven commits onto84f53540d without conflicts; every pair and patch-id equals the385a branch. Rebased sourceb9d3d4c75c78aa6b06aefd734da781bef9b7f1da. Only DEFERRED absorbs upstream changes; seven-path manifest735fa2d7405d01ace8eb7aab366753fa5b1877cf8044b0151cb2113a0502bc1f. All runnable253 blobs unchanged. Store now loads schema3l and3k-3l migration from the landed base. integration-264a/ records the exact upstream drift and27 whole runnable test-file union (upstream-changed tests plus own focused files). Shared fixture is covered by importers. No carried result. Ask Sage for focused CLEAR, then publish after those whole files pass, then Duckworth rebase read, then whole gate on another CLEAR. N9 exact sandbox skip reason must be copied from the case2 log. No execution or push ran during integration.
+
+## Corrected docs base, sage-2700/2702, no runs
+
+New gander/row253-b789 rebases ontob78918850. Sourcec75c9bbd3339cb2343467715a14455044c2e4aea. Only append conflicts in BUILD-LOG and DEFERRED: current base remains exact byte prefix,253 entries appended. No old entry edited or removed. Manifest573c51cf72f2398532a6ea768536f04e3c1681997cb8b9a6f14a8aef884870ae. Five runnable blobs and README match preceding candidate; only DEFERRED hash changes.27-file whole union unchanged, no result carries. Hold branch local: final Gizmoduck docs tip must land first, then rebase/publish and focused CLEAR. No tests/Node/push. integration-b789/ records the resolution and hashes.
+
+## Final base aca16404c, sage-2705, before execution
+
+New gander/row253-aca1 rebases13 commits ontoaca16404c without conflicts; all13 final-hop pairs equal. Sourceed3bb376cdd5128dc58b3aa193282e1c2bfcf57d. Seven blobs unchanged, manifest573c51cf72f2398532a6ea768536f04e3c1681997cb8b9a6f14a8aef884870ae. Both append paths retain the full base prefix. Final upstream docs/queue changes touch no focused read.27-file union remains unchanged.
+
+Step2 file bounds: every file listed in integration-aca1/FILE-LIMITS.json runs whole as timeout -k10 300 node --test --test-reporter=tap FILE, outer harness330s. Own case1/case2 first, then25 others. Busy check before each start, pipefail and tee, TMPDIR from mktemp-d /mnt/storage/scratch/tmp/gXXXXXX. First unexpected failure or timeout stops to Sage/Mos unplaced; no retry. Print HEAD and manifest digest first. No test has run. Expect10-15min; status at15min. Whole-suite limits are separate and will be written before whole-gate CLEAR.
+
+Whole-shell limits remain as in the earlier table and SHELL-LIMITS.json:auth126,conductor145,config130,discord147,extension130,foundation240,land-work158,queue191,release157,task231. Each is at least3x its longest recorded successful whole run. No script changed.
+
+## Focused27 green under sage-2709
+
+Fresh candidate0604d91fc onaca16404c, manifest573c51cf. HEAD and digest are the first controller-log line, followed by the full900s CLI/300s bus-WebUI limit header before any test. Actual run14:30:03Z to2026-10-22T14:44:57Z, 894.0 wall seconds. All27 files whole604/0/0, timeout0, no retry or busy refusal. Commands use timeout-k10 per file, pipefail/tee and scratch gXXXXXX TMPDIR. No product/test/assertion changed. Entire seven-path manifest verifies after the run.
+
+N9 did not skip. Verbatim case2 result: `ok 43 - inside a session's sandbox a bind below 1024 fails with EACCES, and a bind on a free high port succeeds`. There are no skip lines in any focused file. Later wholeWebUI and shell skips are not measured by this focused scope.
+
+Every measured file duration and its later3x basis follows. The last column is ceil(3*measured whole-file wall)+120, not a completed whole-gate result. Historical C4 gates carry nothing. The whole gate still awaits separate CLEAR and Duckworth rebase review.
+
+# Focused27 whole-file results
+
+| Whole file | Pass/fail/skip | Wall seconds | Command limit seconds | Next3x plus120 basis |
+|---|---:|---:|---:|---:|
+| packages/cli/tests/case1-accept.test.mjs | 34/0/0 | 99.281 | 900 | 418 |
+| packages/cli/tests/case2-unit.test.mjs | 43/0/0 | 66.418 | 900 | 320 |
+| packages/bus/tests/account-migration.test.mjs | 3/0/0 | 0.415 | 300 | 122 |
+| packages/bus/tests/chief-of-staff.test.mjs | 42/0/0 | 2.168 | 300 | 127 |
+| packages/bus/tests/comment-migration.test.mjs | 5/0/0 | 0.565 | 300 | 122 |
+| packages/bus/tests/end-launch.test.mjs | 7/0/0 | 0.415 | 300 | 122 |
+| packages/bus/tests/fire-revokes-grants.test.mjs | 22/0/0 | 3.271 | 300 | 130 |
+| packages/bus/tests/gitea-grant.test.mjs | 49/0/0 | 8.634 | 300 | 146 |
+| packages/bus/tests/gitea-migration.test.mjs | 5/0/0 | 0.415 | 300 | 122 |
+| packages/bus/tests/grant-executor.test.mjs | 42/0/0 | 21.562 | 300 | 185 |
+| packages/bus/tests/grant-migration.test.mjs | 6/0/0 | 0.465 | 300 | 122 |
+| packages/bus/tests/lifecycle-revoke.test.mjs | 8/0/0 | 0.665 | 300 | 122 |
+| packages/bus/tests/message-filter.test.mjs | 6/0/0 | 0.515 | 300 | 122 |
+| packages/bus/tests/name-migration.test.mjs | 1/0/0 | 0.214 | 300 | 121 |
+| packages/bus/tests/schema.test.mjs | 1/0/0 | 0.214 | 300 | 121 |
+| packages/bus/tests/sessions.test.mjs | 7/0/0 | 0.615 | 300 | 122 |
+| packages/bus/tests/spec-migration.test.mjs | 1/0/0 | 0.214 | 300 | 121 |
+| packages/bus/tests/tester-writes.test.mjs | 8/0/0 | 0.565 | 300 | 122 |
+| packages/bus/tests/thread-claims.test.mjs | 6/0/0 | 0.264 | 300 | 121 |
+| packages/bus/tests/thread-migration.test.mjs | 3/0/0 | 0.365 | 300 | 122 |
+| packages/bus/tests/threads.test.mjs | 17/0/0 | 1.216 | 300 | 124 |
+| packages/bus/tests/usage-migration.test.mjs | 1/0/0 | 0.214 | 300 | 121 |
+| packages/cli/tests/lifecycle.test.mjs | 24/0/0 | 13.296 | 900 | 160 |
+| packages/cli/tests/stack-release.test.mjs | 218/0/0 | 583.453 | 900 | 1871 |
+| packages/cli/tests/thread-cli.test.mjs | 11/0/0 | 1.876 | 900 | 126 |
+| packages/cli/tests/thread-launch.test.mjs | 11/0/0 | 16.603 | 900 | 170 |
+| packages/webui/tests/chat.test.mjs | 23/0/0 | 0.515 | 300 | 122 |
+
+N9 verbatim: ok 43 - inside a session's sandbox a bind below 1024 fails with EACCES, and a bind on a free high port succeeds
+
+
+Sweep0 run-created leftovers. Initial broad sweep found nine current MCP/npm/code-mode infrastructure processes, all started14:20:57-14:21:07Z before this run14:30:03Z. UTC ps and /proc start ticks are retained; initial output saved, no signalling. Deleted cwd under run TMPDIR is included. No old-PID assumption replaces the receipt check.
+
+Sage2711/2714 reported unrelated queue reads/write and Python reads by other seats. First and subsequent busy checks passed; no retry was needed and no effect is attributed to those processes. No live data was read by this seat. Raw command/log paths and all27 totals live in run3-focused/files/results.json and SUMMARY.json. Return slot after the record publication; no whole suite or M1-M40 batch starts here.
+
+## Whole gate2737/2739, before execution
+
+HEAD34401e7c9, product0604d91fc, manifest573c51cf. Outside agents/gander the record-tip diff is only BUILD-LOG.md, skipped by gate-lane-auth SKIP_COPY per Sage2739. Full lists/counts are printed in run3-gate/HEADER.json before first test. Serial CLI whole55 files,WebUI whole58 files, plus the20 bus files in the rebase union (subset coverage, not a bus-whole claim). Every Node call including RED/controls/changes is timeout-k10 with its killer/whole file measured bound, or900 for an unmeasured file, outerwait+30. WHOLE-GATE-LIMITS.json pins this. The two touched case files also run whole after intended REDs. M1-M40 then serial package/union files and10 shells; every mutation restores exact bytes/status before next. Shell table unchanged. First unexpected pre-existing red/product suspect/loosened assertion/timeout/second red stops unplaced. First-run own new-test red may be placed under2737, but no automatic loosening. No whole-gate test run yet.
+
+## Whole gate2737 stopped unplaced atM21
+
+Run started14:59:22Z. Two intendedREDs observed, exact restoration. Touched whole case243/0/0 in66.112s; case134/0/0 in93.721s. N9 ran and passed. M1-M20 killed;M21survived1/0 in8.581s against8.532s base.9controls passed,0timeouts. M22-M40 and all full-package/union/shell stages NOTRUN. Driver restored bytes/status; all7manifest checks pass, packages/scripts diff empty. Sweep0run-created leftovers. Stopped and returned slot as0106 before any retry/edit.
+
+M21 drops only the peer regex end anchor. peer-malformed already writes a valid three-number prefix plus extra text, but the aggregate passingTAP does not expose the returnedreason. No loggedP10line can be quoted fromM21 orM17-base. Static trace shows onlyP10peerprobe executes PYTHON_STUB; configandearlierchecks useNode/shell, while tester_python reads metadata/ELF only. See run3-gate/STATIC-TRACE.md.
+
+Mos1293requires a scratch-base diagnostic onSagegap, all17P10lines, then exactdesignreasonassertions. peer-malformed expectsprobe. Unexpecteddesignreason or anyproductchange goes toMosbeforeedits. No diagnostic or repair yet. Newcandidate/manifest/review and entiregatefromstart, no carry. Stop packet committed locally; helperpushwaitsforgap.
+
+## Fixture-only M21 repair, mos1297, not run
+
+Diagnostic(a) on0604 observed probe-inner-session for peer-malformed andpeer-error, not their designed probe/probe-inner-command. Mos confirmed instant shell output exits before session verification; product fails closed. Authorized option1 uses the same system Python exec for peer-output bytes/status; no delay and no product change. Sourcecommit362ec674c9e7aa8cef0c26f4d7448f459171dbd4 names1297 andquotesoldline100.
+
+All17faults now assert exact reason with following space and anchoredP10prefix, from the accepted draft. Every old assertion retained. C4overflow andpeer-hang test bodies are byte-identical; overflow must remain probe-output-limit. Peer-hang looseprefixoutofscope unchanged. STATIC-PRESERVATION.json andREPAIR.diff in repair-1297/.
+
+Seven-path manifesta2ac57342d9c59ddaebddade0fa475a9568719fed50c132bd7bb141167c7e72e; onlycase1testhashchanges. No repaired-source test/syntax/Node execution. Whole gate from start, no carry, after Duckworth review and SageCLEAR. M21survival orwrongmalformed/errorreason goes toMosbeforeanychange. Product fast-exit issue isVikunja532post10-27; SageownsDEFERREDentry.
+
+
+### mos-1297 fresh gate under sage-2768, stopped
+
+Ran on pushed e1bc766d8, manifest a2ac5734, no carry. Both intendedREDs observed; touched whole43/0/0 and34/0/0,17fresh controls passed. M1-M37 killed including M21 by named P10 assertion; M38 survived (drop setsid, signals killer). M39-M40 and full package/union/shell stages NOTRUN. Wall404.837s,0timeouts,0skips,N9passed. Exact restoration and all7manifest checks pass; sweep0run-created leftovers. Stopped unplaced to Sage/Mos/Duckworth as gander-0116 and returned slot; no repair or rerun. run4-gate/ preserves raw logs,commands,counts and timing.
+
+
+### mos-1298: pin the direct query session
+
+M38 drops setsid but a blocking signals query can still fail closed with inner-timeout; the old kill rule was wrong. The named killer stays row253 C4 signals query. Every sleep/signals/member case in both exec/hop modes now reads the first query-pids line and asserts exact equality of its numeric PID and kernel SID. M38 must fail this new assertion, never a timeout or a cleanup-only assertion. Every old line of the C4 query test is preserved byte for byte. Product scripts remain byte-identical. No test or Node preflight run; fresh whole gate from start follows new candidate review and Sage CLEAR, with nothing carried. Base assertion failure, another survivor or any mismatch goes to Mos before a further change.

agents/gander/work/queue-253/CANDIDATE-SHAS.json

@@ -1,9 +1,9 @@
 {
-  "scripts/case2-unit.sh": "d7670bdb049ae41ba3774fc83de633636859b6723be858cfb31ea106b0e8812b",
-  "scripts/case1-accept.sh": "c02bef6b3495e5a4548d7b4e89675ed52be26a0c9ccce4d9d5cfc5fe2ce437bd",
+  "docs/plans/DEFERRED.md": "f8ad28aa8dc0f12b2c6dddb3b5dc805da05a97c7723e0525905456c064d0cfa3",
   "packages/cli/tests/case-sudo-fixture.mjs": "b259b8c7926e49829c8a956674021cb0cc85ddd65aebdc786d05cc08d7790008",
-  "packages/cli/tests/case2-unit.test.mjs": "1e0696eb196e83a0766b433ef71f27df0a3f8fcb6399787ab8c1c0f05c54dc44",
-  "packages/cli/tests/case1-accept.test.mjs": "6cfd2963303315aa6911c4d4f6d75d3ab87d9fcba8e128b056216e7f85fd8901",
-  "packages/webui/README.md": "2eeb1f79324f64463a9b3427e67492d672b8d1c14db6c0349c7de17d89e52fc9",
-  "docs/plans/DEFERRED.md": "3ea465cf7ed664ceb1ea4076b829f706f8480f80c4a8aaa6a7487e4eceaf318f"
+  "packages/cli/tests/case1-accept.test.mjs": "27378eb1297dc6115b4b1ce849de6ffdb3adccf5249783106fa0570c9d696e8a",
+  "packages/cli/tests/case2-unit.test.mjs": "9ca67403d8614266061624ab5fbf4ea8e8a54cbd08f5b569c95592ab5ed40472",
+  "packages/webui/README.md": "ce9054060867120798c6b26737ac7d910d8cfbc7aa4ad614f4295619c7605e46",
+  "scripts/case1-accept.sh": "c02bef6b3495e5a4548d7b4e89675ed52be26a0c9ccce4d9d5cfc5fe2ce437bd",
+  "scripts/case2-unit.sh": "d7670bdb049ae41ba3774fc83de633636859b6723be858cfb31ea106b0e8812b"
 }

agents/gander/work/queue-253/MANIFEST.md

@@ -5,3 +5,22 @@ MANIFEST.sha256 names seven source/test/doc landing paths and pins their bytes.
 Base before the required gate integration: c3d88840c. Initial static repair packet: b64aa316a; initial runnable candidate: aa81ca390. The delta packet is c4/delta-0112/. Full records live under agents/gander/work/queue-253/ as review evidence. DEFERRED.md preserves upstream entries and names row276 / #1781 for F5 and N1/N2.
 
 Sage-2335 authorizes the runnable commit before the whole gate. No repaired-source syntax check, test, probe or host experiment has run. No results from 8a8df4171 carry. After Duckworth's delta static verdict, the gate must use the candidate integrated onto the refactor tip named by Sage at CLEAR (378a76b85 or later under sage-2342), never this old base. Fresh integration records and hashes will identify that final gate candidate.
+
+Superseding integration under sage-2463: gander/row253-0fa7 on 0fa7bf421. See integration-0fa7/. Only README changed among the seven landing entries, retaining row191 processing-control documentation; the refreshed manifest digest is 24b6a01b2ede6f025ec898fa4ec830bb9585ce6151d6298e713e31c7430a502b. No gate has run.
+
+Superseding integration under sage-2659: gander/row253-385a on385a7194c, source141b79c29, digest72a70e99ba0416ceb1f63ed737132ebbeb212332d1441c362b3dfa6c8b00209c. Only README and DEFERRED hashes change. See integration-385a/ for drift, patch-ids and dependency reads. No gate run;264a schema dependency must be re-checked before CLEAR.
+
+Post264a supersedes the385a preview: gander/row253-264a on84f53540d, rebased sourceb9d3d4c75c78aa6b06aefd734da781bef9b7f1da, manifest735fa2d7405d01ace8eb7aab366753fa5b1877cf8044b0151cb2113a0502bc1f. Only DEFERRED differs from the preview. See integration-264a/ for all11 equal pairs, patch-ids and whole-file union. Focused whole-file runs, publication, rebase review and full gate are pending Sage CLEAR.
+
+Corrected interim integration2700/2702: gander/row253-b789 onb78918850, sourcec75c9bbd3339cb2343467715a14455044c2e4aea, digest573c51cf72f2398532a6ea768536f04e3c1681997cb8b9a6f14a8aef884870ae.27-file scope unchanged. Pending final docs tip, rebase and CLEAR; no gate run.
+
+Final base under sage-2705: gander/row253-aca1 onaca16404c, sourceed3bb376cdd5128dc58b3aa193282e1c2bfcf57d, digest573c51cf unchanged. integration-aca1/ is the final-hop packet. No runs yet.
+
+Focused27 under sage-2709 now passed on0604d91fc:604/0/0, no timeouts, no retries, N9 executed and passed (exact line in run3-focused/SUMMARY.json). All7 blobs unchanged;573c51cf remains the review digest. run3-focused/ contains every raw whole-file log/command, HEAD/digest/limits preamble, timings and3x basis. No full gate or mutation-batch result is claimed.
+
+Whole gate2737 stopped atM21 survivor after20kills. No final acceptance. run3-gate/STOP-SUMMARY.json andSTATIC-TRACE.md preserve the stop. Mos1293requires diagnostic thennewcandidate/review/fullgatefromstart. Current7sourceblobs remain573c51cf; no test/product repair made.
+
+Mos1297 supersedes573c51cf after one fixture-only repair and17exactreasonassertions: source362ec674c9e7aa8cef0c26f4d7448f459171dbd4, digesta2ac57342d9c59ddaebddade0fa475a9568719fed50c132bd7bb141167c7e72e. Onlycase1testchanges. repair-1297/ is the new review packet. Tests unrun; Duckworthreview and fullfreshgatepending.
+
+
+mos-1298 candidate source 14e46006171ef700a72f971fda5cb3a0b8dcc4f2, seven-path manifest 591020a1096a1606c11f2ee34b37243acddf83d91c69922ccc5cfe22d6180d3a. Only case2-unit.test.mjs changes among manifest paths from e1bc766d8. Pending review and fresh full gate; no carry.

agents/gander/work/queue-253/MANIFEST.sha256

@@ -1,7 +1,7 @@
-3ea465cf7ed664ceb1ea4076b829f706f8480f80c4a8aaa6a7487e4eceaf318f  docs/plans/DEFERRED.md
+f8ad28aa8dc0f12b2c6dddb3b5dc805da05a97c7723e0525905456c064d0cfa3  docs/plans/DEFERRED.md
 b259b8c7926e49829c8a956674021cb0cc85ddd65aebdc786d05cc08d7790008  packages/cli/tests/case-sudo-fixture.mjs
-6cfd2963303315aa6911c4d4f6d75d3ab87d9fcba8e128b056216e7f85fd8901  packages/cli/tests/case1-accept.test.mjs
-1e0696eb196e83a0766b433ef71f27df0a3f8fcb6399787ab8c1c0f05c54dc44  packages/cli/tests/case2-unit.test.mjs
-2eeb1f79324f64463a9b3427e67492d672b8d1c14db6c0349c7de17d89e52fc9  packages/webui/README.md
+27378eb1297dc6115b4b1ce849de6ffdb3adccf5249783106fa0570c9d696e8a  packages/cli/tests/case1-accept.test.mjs
+9ca67403d8614266061624ab5fbf4ea8e8a54cbd08f5b569c95592ab5ed40472  packages/cli/tests/case2-unit.test.mjs
+ce9054060867120798c6b26737ac7d910d8cfbc7aa4ad614f4295619c7605e46  packages/webui/README.md
 c02bef6b3495e5a4548d7b4e89675ed52be26a0c9ccce4d9d5cfc5fe2ce437bd  scripts/case1-accept.sh
 d7670bdb049ae41ba3774fc83de633636859b6723be858cfb31ea106b0e8812b  scripts/case2-unit.sh

agents/gander/work/queue-253/SHELL-LIMITS.json

@@ -0,0 +1,132 @@
+{
+  "authority": [
+    "mos-1275",
+    "sage-2659"
+  ],
+  "scope": "Own Gander row196 receipt set documented for row278, plus the complete row278 run3 shell phase. Row253 old C4 results do not carry. Receipts choose timeouts only.",
+  "consulted_records": [
+    "ec1e7fad8:agents/gander/work/queue-196/evidence/suite-results-run1.json",
+    "ec1e7fad8:agents/gander/work/queue-196/evidence/suite-results.json",
+    "ec1e7fad8:agents/gander/work/queue-196/r2/mutants/results.json",
+    "ec1e7fad8:agents/gander/work/queue-196/r2/run2/base-results.json",
+    "ec1e7fad8:agents/gander/work/queue-196/r2/run2/killers/results.json",
+    "ec1e7fad8:agents/gander/work/queue-196/r3/gate/base-results.json",
+    "ec1e7fad8:agents/gander/work/queue-196/r3/gate/killers/results.json",
+    "ec1e7fad8:agents/gander/work/queue-196/r3/gate/sso-results.json",
+    "ec1e7fad8:agents/gander/work/queue-196/r4/gate/base-results.json",
+    "ec1e7fad8:agents/gander/work/queue-196/r4/gate/killers/results.json",
+    "ec1e7fad8:agents/gander/work/queue-196/r4/gate/sso-results.json",
+    "ec1e7fad8:agents/gander/work/queue-196/r4/gate/whole-results.json",
+    "ec1e7fad8:agents/gander/work/queue-196/r5/gate/whole-results.json",
+    "ec1e7fad8:agents/gander/work/queue-196/r5/resume/summary.json",
+    "ec1e7fad8:agents/gander/work/queue-196/r5/resume/whole-results.json",
+    "ec1e7fad8:agents/gander/work/queue-196/r6/base-results.json",
+    "ec1e7fad8:agents/gander/work/queue-196/r6/first-attempt/results.json",
+    "ec1e7fad8:agents/gander/work/queue-196/r6/killers/results.json",
+    "ec1e7fad8:agents/gander/work/queue-196/r6/summary.json",
+    "ec1e7fad8:agents/gander/work/queue-196/r6/whole-results.json",
+    "385a7194c:agents/gander/work/queue-278/run3/whole/results.json"
+  ],
+  "scripts": {
+    "scripts/test-auth.sh": {
+      "recorded_duration_seconds": 1.9081228229999543,
+      "receipt": "ec1e7fad8:agents/gander/work/queue-196/r6/whole-results.json",
+      "limit_seconds": 126,
+      "derivation": "ceil(3 * longest successful whole-file receipt) + 120s headroom",
+      "script_sha256": "dd4720cb0cbecd2fc523a318f2222d21d257c8c5889996a3d69e522ee971a707",
+      "previous_maximum_seconds": 1.9081228229999543,
+      "previous_receipt": "ec1e7fad8:agents/gander/work/queue-196/r6/whole-results.json",
+      "row278_run3_seconds": 0.816
+    },
+    "scripts/test-conductor.sh": {
+      "recorded_duration_seconds": 8.057173820000026,
+      "receipt": "ec1e7fad8:agents/gander/work/queue-196/r6/whole-results.json",
+      "limit_seconds": 145,
+      "derivation": "ceil(3 * longest successful whole-file receipt) + 120s headroom",
+      "script_sha256": "da84150467494a4c979759f400854411bd93a7efce981139757bf526d688a23b",
+      "previous_maximum_seconds": 8.057173820000026,
+      "previous_receipt": "ec1e7fad8:agents/gander/work/queue-196/r6/whole-results.json",
+      "row278_run3_seconds": 6.078
+    },
+    "scripts/test-config.sh": {
+      "recorded_duration_seconds": 3.1678915339999367,
+      "receipt": "ec1e7fad8:agents/gander/work/queue-196/r6/whole-results.json",
+      "limit_seconds": 130,
+      "derivation": "ceil(3 * longest successful whole-file receipt) + 120s headroom",
+      "script_sha256": "3301c1fabf616bb961d62f6decd0a46dadb0f399b8ba7f3c2ca60023d2b24c78",
+      "previous_maximum_seconds": 3.1678915339999367,
+      "previous_receipt": "ec1e7fad8:agents/gander/work/queue-196/r6/whole-results.json",
+      "row278_run3_seconds": 1.868
+    },
+    "scripts/test-discord.sh": {
+      "recorded_duration_seconds": 8.776727847000002,
+      "receipt": "ec1e7fad8:agents/gander/work/queue-196/r5/resume/whole-results.json",
+      "limit_seconds": 147,
+      "derivation": "ceil(3 * longest successful whole-file receipt) + 120s headroom",
+      "script_sha256": "a5dcf783c51a5d5d184a357f91ebf9fa1c4e054f0cb84a3d1d7668f6156e025e",
+      "previous_maximum_seconds": 8.776727847000002,
+      "previous_receipt": "ec1e7fad8:agents/gander/work/queue-196/r5/resume/whole-results.json",
+      "row278_run3_seconds": 7.431
+    },
+    "scripts/test-extension-package.sh": {
+      "recorded_duration_seconds": 3.01285702399991,
+      "receipt": "ec1e7fad8:agents/gander/work/queue-196/r5/resume/whole-results.json",
+      "limit_seconds": 130,
+      "derivation": "ceil(3 * longest successful whole-file receipt) + 120s headroom",
+      "script_sha256": "5d7b687f16fd1a9414b229501177d530ba3af4eadd3cac319b33f38fdba9bf99",
+      "previous_maximum_seconds": 3.01285702399991,
+      "previous_receipt": "ec1e7fad8:agents/gander/work/queue-196/r5/resume/whole-results.json",
+      "row278_run3_seconds": 1.366
+    },
+    "scripts/test-foundation.sh": {
+      "recorded_duration_seconds": 39.901,
+      "receipt": "385a7194c:agents/gander/work/queue-278/run3/whole/results.json",
+      "limit_seconds": 240,
+      "derivation": "ceil(3 * longest successful whole-file receipt) + 120s headroom",
+      "script_sha256": "2e11038e7f784ec4f539eb768f63bab0fab9c9940334388a1fe2d47ab9e2b008",
+      "previous_maximum_seconds": 39.70872647900006,
+      "previous_receipt": "ec1e7fad8:agents/gander/work/queue-196/r5/resume/whole-results.json",
+      "row278_run3_seconds": 39.901
+    },
+    "scripts/test-land-work.sh": {
+      "recorded_duration_seconds": 12.623263413000037,
+      "receipt": "ec1e7fad8:agents/gander/work/queue-196/r5/resume/whole-results.json",
+      "limit_seconds": 158,
+      "derivation": "ceil(3 * longest successful whole-file receipt) + 120s headroom",
+      "script_sha256": "c9d1d5c9b006d5c12e5f796a9828361059f8e0410846fc55c070c0148b15cef4",
+      "previous_maximum_seconds": 12.623263413000037,
+      "previous_receipt": "ec1e7fad8:agents/gander/work/queue-196/r5/resume/whole-results.json",
+      "row278_run3_seconds": 11.338
+    },
+    "scripts/test-queue.sh": {
+      "recorded_duration_seconds": 23.443742031000088,
+      "receipt": "ec1e7fad8:agents/gander/work/queue-196/r5/resume/whole-results.json",
+      "limit_seconds": 191,
+      "derivation": "ceil(3 * longest successful whole-file receipt) + 120s headroom",
+      "script_sha256": "c270f181d1fa8b6d42ff4131c339beba786a8fd620bb66f8afdcec05e8b10868",
+      "previous_maximum_seconds": 23.443742031000088,
+      "previous_receipt": "ec1e7fad8:agents/gander/work/queue-196/r5/resume/whole-results.json",
+      "row278_run3_seconds": 21.158
+    },
+    "scripts/test-release.sh": {
+      "recorded_duration_seconds": 12.168674453999964,
+      "receipt": "ec1e7fad8:agents/gander/work/queue-196/r5/resume/whole-results.json",
+      "limit_seconds": 157,
+      "derivation": "ceil(3 * longest successful whole-file receipt) + 120s headroom",
+      "script_sha256": "be706dff832257bd4781abeabd19faa4ac16edf9a4af0c96457e33cf3bb6deb3",
+      "previous_maximum_seconds": 12.168674453999964,
+      "previous_receipt": "ec1e7fad8:agents/gander/work/queue-196/r5/resume/whole-results.json",
+      "row278_run3_seconds": 2.67
+    },
+    "scripts/test-task.sh": {
+      "recorded_duration_seconds": 36.783798266,
+      "receipt": "ec1e7fad8:agents/gander/work/queue-196/r5/resume/whole-results.json",
+      "limit_seconds": 231,
+      "derivation": "ceil(3 * longest successful whole-file receipt) + 120s headroom",
+      "script_sha256": "10c4abb70bf9b83e617089b06a5436cc7fa6b866a176458b22128c3a15163f94",
+      "previous_maximum_seconds": 36.783798266,
+      "previous_receipt": "ec1e7fad8:agents/gander/work/queue-196/r5/resume/whole-results.json",
+      "row278_run3_seconds": 13.843
+    }
+  }
+}

agents/gander/work/queue-253/WHOLE-GATE-LIMITS.json

@@ -0,0 +1,142 @@
+{
+  "authority": "sage-2737/sage-2739",
+  "files": {
+    "packages/cli/tests/access.test.mjs": 900,
+    "packages/cli/tests/app.test.mjs": 900,
+    "packages/cli/tests/boot-status.test.mjs": 900,
+    "packages/cli/tests/case1-accept.test.mjs": 418,
+    "packages/cli/tests/case1-hostcheck.test.mjs": 900,
+    "packages/cli/tests/case2-persona-import.test.mjs": 900,
+    "packages/cli/tests/case2-unit.test.mjs": 320,
+    "packages/cli/tests/channel-cli.test.mjs": 900,
+    "packages/cli/tests/channel-recovery.test.mjs": 900,
+    "packages/cli/tests/cli.test.mjs": 900,
+    "packages/cli/tests/config.test.mjs": 900,
+    "packages/cli/tests/credentials.test.mjs": 900,
+    "packages/cli/tests/follow.test.mjs": 900,
+    "packages/cli/tests/format.test.mjs": 900,
+    "packages/cli/tests/gate-lane-auth.test.mjs": 900,
+    "packages/cli/tests/gate-lane-fixtures.test.mjs": 900,
+    "packages/cli/tests/gate-lane-image.test.mjs": 900,
+    "packages/cli/tests/gate-lane-state.test.mjs": 900,
+    "packages/cli/tests/gate-lane.test.mjs": 900,
+    "packages/cli/tests/git-socket.test.mjs": 900,
+    "packages/cli/tests/grants.test.mjs": 900,
+    "packages/cli/tests/host.test.mjs": 900,
+    "packages/cli/tests/hosts.test.mjs": 900,
+    "packages/cli/tests/instances.test.mjs": 900,
+    "packages/cli/tests/launch-account.test.mjs": 900,
+    "packages/cli/tests/launch-limit-checks.test.mjs": 900,
+    "packages/cli/tests/launch-limits.test.mjs": 900,
+    "packages/cli/tests/launch-routes.test.mjs": 900,
+    "packages/cli/tests/launcher.test.mjs": 900,
+    "packages/cli/tests/lifecycle.test.mjs": 160,
+    "packages/cli/tests/limits-tokens.test.mjs": 900,
+    "packages/cli/tests/limits.test.mjs": 900,
+    "packages/cli/tests/mark-read.test.mjs": 900,
+    "packages/cli/tests/names.test.mjs": 900,
+    "packages/cli/tests/notifier.test.mjs": 900,
+    "packages/cli/tests/other-tree.test.mjs": 900,
+    "packages/cli/tests/processing-cli.test.mjs": 900,
+    "packages/cli/tests/project-name-repo.test.mjs": 900,
+    "packages/cli/tests/project.test.mjs": 900,
+    "packages/cli/tests/publish-socket.test.mjs": 900,
+    "packages/cli/tests/stack-copy.test.mjs": 900,
+    "packages/cli/tests/stack-instances.test.mjs": 900,
+    "packages/cli/tests/stack-release-external.test.mjs": 900,
+    "packages/cli/tests/stack-release.test.mjs": 1871,
+    "packages/cli/tests/stack-upgrade.test.mjs": 900,
+    "packages/cli/tests/tester-http.test.mjs": 900,
+    "packages/cli/tests/tester-reads.test.mjs": 900,
+    "packages/cli/tests/tester-threads.test.mjs": 900,
+    "packages/cli/tests/tester.test.mjs": 900,
+    "packages/cli/tests/thread-cli.test.mjs": 126,
+    "packages/cli/tests/thread-launch.test.mjs": 170,
+    "packages/cli/tests/trackers-boot.test.mjs": 900,
+    "packages/cli/tests/transport.test.mjs": 900,
+    "packages/cli/tests/usage.test.mjs": 900,
+    "packages/cli/tests/verbs.test.mjs": 900,
+    "packages/webui/tests/agents-browser.test.mjs": 900,
+    "packages/webui/tests/agents.test.mjs": 900,
+    "packages/webui/tests/assistant.test.mjs": 900,
+    "packages/webui/tests/board-held.test.mjs": 900,
+    "packages/webui/tests/browser-edge.test.mjs": 900,
+    "packages/webui/tests/browser.test.mjs": 900,
+    "packages/webui/tests/bus-browser.test.mjs": 900,
+    "packages/webui/tests/bus.test.mjs": 900,
+    "packages/webui/tests/channel-chat.test.mjs": 900,
+    "packages/webui/tests/chat-browser.test.mjs": 900,
+    "packages/webui/tests/chat.test.mjs": 122,
+    "packages/webui/tests/conversation.test.mjs": 900,
+    "packages/webui/tests/discord.test.mjs": 900,
+    "packages/webui/tests/docs-browser.test.mjs": 900,
+    "packages/webui/tests/editor-browser.test.mjs": 900,
+    "packages/webui/tests/editor-provenance.test.mjs": 900,
+    "packages/webui/tests/editor.test.mjs": 900,
+    "packages/webui/tests/history-return-flow.test.mjs": 900,
+    "packages/webui/tests/instances-browser.test.mjs": 900,
+    "packages/webui/tests/instances.test.mjs": 900,
+    "packages/webui/tests/library-cli.test.mjs": 900,
+    "packages/webui/tests/library-status.test.mjs": 900,
+    "packages/webui/tests/limits-browser.test.mjs": 900,
+    "packages/webui/tests/limits-route.test.mjs": 900,
+    "packages/webui/tests/markdown-preview.test.mjs": 900,
+    "packages/webui/tests/messages.test.mjs": 900,
+    "packages/webui/tests/pinned-copy.test.mjs": 900,
+    "packages/webui/tests/preview.test.mjs": 900,
+    "packages/webui/tests/processing-browser.test.mjs": 900,
+    "packages/webui/tests/processing-ui.test.mjs": 900,
+    "packages/webui/tests/processing.test.mjs": 900,
+    "packages/webui/tests/project-file.test.mjs": 900,
+    "packages/webui/tests/project-name-repo.test.mjs": 900,
+    "packages/webui/tests/proof-cli.test.mjs": 900,
+    "packages/webui/tests/proof.test.mjs": 900,
+    "packages/webui/tests/reads.test.mjs": 900,
+    "packages/webui/tests/relaunch.test.mjs": 900,
+    "packages/webui/tests/return-flow.test.mjs": 900,
+    "packages/webui/tests/routes-browser.test.mjs": 900,
+    "packages/webui/tests/routes.test.mjs": 900,
+    "packages/webui/tests/send-browser.test.mjs": 900,
+    "packages/webui/tests/send.test.mjs": 900,
+    "packages/webui/tests/serve.test.mjs": 900,
+    "packages/webui/tests/service.test.mjs": 900,
+    "packages/webui/tests/settings-form.test.mjs": 900,
+    "packages/webui/tests/settings-write.test.mjs": 900,
+    "packages/webui/tests/shell.test.mjs": 900,
+    "packages/webui/tests/sso-browser.test.mjs": 900,
+    "packages/webui/tests/sso.test.mjs": 900,
+    "packages/webui/tests/tester-browser.test.mjs": 900,
+    "packages/webui/tests/tester-cli.test.mjs": 900,
+    "packages/webui/tests/tester-listener.test.mjs": 900,
+    "packages/webui/tests/tester-socket.test.mjs": 900,
+    "packages/webui/tests/thread-claims-browser.test.mjs": 900,
+    "packages/webui/tests/thread-claims.test.mjs": 900,
+    "packages/webui/tests/usage-browser.test.mjs": 900,
+    "packages/webui/tests/usage.test.mjs": 900,
+    "packages/webui/tests/views.test.mjs": 900,
+    "packages/bus/tests/account-migration.test.mjs": 122,
+    "packages/bus/tests/chief-of-staff.test.mjs": 127,
+    "packages/bus/tests/comment-migration.test.mjs": 122,
+    "packages/bus/tests/end-launch.test.mjs": 122,
+    "packages/bus/tests/fire-revokes-grants.test.mjs": 130,
+    "packages/bus/tests/gitea-grant.test.mjs": 146,
+    "packages/bus/tests/gitea-migration.test.mjs": 122,
+    "packages/bus/tests/grant-executor.test.mjs": 185,
+    "packages/bus/tests/grant-migration.test.mjs": 122,
+    "packages/bus/tests/lifecycle-revoke.test.mjs": 122,
+    "packages/bus/tests/message-filter.test.mjs": 122,
+    "packages/bus/tests/name-migration.test.mjs": 121,
+    "packages/bus/tests/schema.test.mjs": 121,
+    "packages/bus/tests/sessions.test.mjs": 122,
+    "packages/bus/tests/spec-migration.test.mjs": 121,
+    "packages/bus/tests/tester-writes.test.mjs": 122,
+    "packages/bus/tests/thread-claims.test.mjs": 121,
+    "packages/bus/tests/thread-migration.test.mjs": 122,
+    "packages/bus/tests/threads.test.mjs": 124,
+    "packages/bus/tests/usage-migration.test.mjs": 121
+  },
+  "fallback_seconds": 900,
+  "kill_after_seconds": 10,
+  "outer_wait_slack_seconds": 30,
+  "source": "run3-focused/MEASURED-FILE-LIMITS.json"
+}

agents/gander/work/queue-253/c4/REPAIR-README.md

@@ -6,7 +6,7 @@ REPAIR.diff compares the repaired scripts against their original frozen source,
 
 ## Conditions mapped to the diff
 
-C1: fixed setsid without -f/-w; confirm the direct child's kernel SID equals its PID. M38 drops setsid; exact inner-timeout tests must kill it by observing inner-session instead.
+C1: fixed setsid without -f/-w; confirm the direct child's kernel SID equals its PID. M38 drops setsid; the named row253 C4 signals query killer must fail the exact numeric PID/SID equality assertion on the first query-pids line, in each kind and both sudo modes, without a timeout. A blocking child can still reach inner-timeout without setsid, so the refusal reason alone does not prove session creation (mos-1298).
 
 C2: exact inner/outer/output-limit refusals in both fake modes, query 5/7 s and probe 2/4 s. Outer cases require at least the outer duration and less than outer + 2 s. Root discards the valid-looking stdout of a stalled supervisor. A trusted notice plus status 137 identifies the outer timer.
 

agents/gander/work/queue-253/diagnostic-a/COMPARISON.json

@@ -0,0 +1,168 @@
+{
+  "count": 17,
+  "matches": 15,
+  "mismatches": [
+    {
+      "fault": "peer-malformed",
+      "expected": "probe",
+      "observed": "probe-inner-session",
+      "p10": [
+        "P10 tester-socket-squat unnamed boundary=failed reason=probe-inner-session path=/srv/mosaic/.mosaic-dev/console/tester.sock MainPID=200; hostile same-uid substitution remains"
+      ]
+    },
+    {
+      "fault": "peer-error",
+      "expected": "probe-inner-command",
+      "observed": "probe-inner-session",
+      "p10": [
+        "P10 tester-socket-squat unnamed boundary=failed reason=probe-inner-session path=/srv/mosaic/.mosaic-dev/console/tester.sock MainPID=200; hostile same-uid substitution remains"
+      ]
+    }
+  ],
+  "peer_malformed": {
+    "fault": "peer-malformed",
+    "p10": [
+      "P10 tester-socket-squat unnamed boundary=failed reason=probe-inner-session path=/srv/mosaic/.mosaic-dev/console/tester.sock MainPID=200; hostile same-uid substitution remains"
+    ],
+    "reason": "probe-inner-session",
+    "status": 0
+  },
+  "rows": [
+    {
+      "fault": "parent-mode",
+      "p10": [
+        "P10 tester-socket-squat unnamed boundary=failed reason=metadata path=/srv/mosaic/.mosaic-dev/console/tester.sock MainPID=200; hostile same-uid substitution remains"
+      ],
+      "reason": "metadata",
+      "status": 0
+    },
+    {
+      "fault": "parent-owner",
+      "p10": [
+        "P10 tester-socket-squat unnamed boundary=failed reason=metadata path=/srv/mosaic/.mosaic-dev/console/tester.sock MainPID=200; hostile same-uid substitution remains"
+      ],
+      "reason": "metadata",
+      "status": 0
+    },
+    {
+      "fault": "socket-mode",
+      "p10": [
+        "P10 tester-socket-squat unnamed boundary=failed reason=metadata path=/srv/mosaic/.mosaic-dev/console/tester.sock MainPID=200; hostile same-uid substitution remains"
+      ],
+      "reason": "metadata",
+      "status": 0
+    },
+    {
+      "fault": "socket-owner",
+      "p10": [
+        "P10 tester-socket-squat unnamed boundary=failed reason=metadata path=/srv/mosaic/.mosaic-dev/console/tester.sock MainPID=200; hostile same-uid substitution remains"
+      ],
+      "reason": "metadata",
+      "status": 0
+    },
+    {
+      "fault": "socket-type",
+      "p10": [
+        "P10 tester-socket-squat unnamed boundary=failed reason=metadata path=/srv/mosaic/.mosaic-dev/console/tester.sock MainPID=200; hostile same-uid substitution remains"
+      ],
+      "reason": "metadata",
+      "status": 0
+    },
+    {
+      "fault": "symlink",
+      "p10": [
+        "P10 tester-socket-squat unnamed boundary=failed reason=metadata path=/srv/mosaic/.mosaic-dev/console/tester.sock MainPID=200; hostile same-uid substitution remains"
+      ],
+      "reason": "metadata",
+      "status": 0
+    },
+    {
+      "fault": "peer",
+      "p10": [
+        "P10 tester-socket-squat unnamed boundary=failed reason=peer path=/srv/mosaic/.mosaic-dev/console/tester.sock MainPID=200; hostile same-uid substitution remains"
+      ],
+      "reason": "peer",
+      "status": 0
+    },
+    {
+      "fault": "peer-pid",
+      "p10": [
+        "P10 tester-socket-squat unnamed boundary=failed reason=peer path=/srv/mosaic/.mosaic-dev/console/tester.sock MainPID=200; hostile same-uid substitution remains"
+      ],
+      "reason": "peer",
+      "status": 0
+    },
+    {
+      "fault": "python-mode",
+      "p10": [
+        "P10 tester-socket-squat unnamed boundary=failed reason=interpreter path=/srv/mosaic/.mosaic-dev/console/tester.sock MainPID=200; hostile same-uid substitution remains"
+      ],
+      "reason": "interpreter",
+      "status": 0
+    },
+    {
+      "fault": "python-missing",
+      "p10": [
+        "P10 tester-socket-squat unnamed boundary=failed reason=interpreter path=/srv/mosaic/.mosaic-dev/console/tester.sock MainPID=200; hostile same-uid substitution remains"
+      ],
+      "reason": "interpreter",
+      "status": 0
+    },
+    {
+      "fault": "python-not-elf",
+      "p10": [
+        "P10 tester-socket-squat unnamed boundary=failed reason=interpreter path=/srv/mosaic/.mosaic-dev/console/tester.sock MainPID=200; hostile same-uid substitution remains"
+      ],
+      "reason": "interpreter",
+      "status": 0
+    },
+    {
+      "fault": "peer-malformed",
+      "p10": [
+        "P10 tester-socket-squat unnamed boundary=failed reason=probe-inner-session path=/srv/mosaic/.mosaic-dev/console/tester.sock MainPID=200; hostile same-uid substitution remains"
+      ],
+      "reason": "probe-inner-session",
+      "status": 0
+    },
+    {
+      "fault": "peer-error",
+      "p10": [
+        "P10 tester-socket-squat unnamed boundary=failed reason=probe-inner-session path=/srv/mosaic/.mosaic-dev/console/tester.sock MainPID=200; hostile same-uid substitution remains"
+      ],
+      "reason": "probe-inner-session",
+      "status": 0
+    },
+    {
+      "fault": "peer-uid-fields",
+      "p10": [
+        "P10 tester-socket-squat unnamed boundary=failed reason=metadata path=/srv/mosaic/.mosaic-dev/console/tester.sock MainPID=200; hostile same-uid substitution remains"
+      ],
+      "reason": "metadata",
+      "status": 1
+    },
+    {
+      "fault": "changed-inode",
+      "p10": [
+        "P10 tester-socket-squat unnamed boundary=failed reason=changed path=/srv/mosaic/.mosaic-dev/console/tester.sock MainPID=200; hostile same-uid substitution remains"
+      ],
+      "reason": "changed",
+      "status": 0
+    },
+    {
+      "fault": "changed-pid",
+      "p10": [
+        "P10 tester-socket-squat unnamed boundary=failed reason=changed path=/srv/mosaic/.mosaic-dev/console/tester.sock MainPID=200; hostile same-uid substitution remains"
+      ],
+      "reason": "changed",
+      "status": 0
+    },
+    {
+      "fault": "floor",
+      "p10": [
+        "P10 tester-socket-squat unnamed boundary=failed reason=floor path=/srv/mosaic/.mosaic-dev/console/tester.sock MainPID=200; hostile same-uid substitution remains"
+      ],
+      "reason": "floor",
+      "status": 0
+    }
+  ]
+}

agents/gander/work/queue-253/diagnostic-a/COPY-PATH

@@ -0,0 +1 @@
+/mnt/storage/scratch/tmp/gBHA

agents/gander/work/queue-253/diagnostic-a/EXPECTED-REASONS.json

@@ -0,0 +1,121 @@
+{
+  "parent-mode": {
+    "reason": "metadata",
+    "meaning": "Private parent mode is exact0700",
+    "semantic_source": "DESIGN.md:119; BUILD.md:17",
+    "code_label_location": "scripts/case1-accept.sh:659",
+    "exact_reason_token": "reason=metadata "
+  },
+  "parent-owner": {
+    "reason": "metadata",
+    "meaning": "Parent owner is stack uid",
+    "semantic_source": "DESIGN.md:119; BUILD.md:17",
+    "code_label_location": "scripts/case1-accept.sh:659",
+    "exact_reason_token": "reason=metadata "
+  },
+  "socket-mode": {
+    "reason": "metadata",
+    "meaning": "Socket mode is exact0600",
+    "semantic_source": "DESIGN.md:120; BUILD.md:17",
+    "code_label_location": "scripts/case1-accept.sh:659",
+    "exact_reason_token": "reason=metadata "
+  },
+  "socket-owner": {
+    "reason": "metadata",
+    "meaning": "Socket owner is stack uid",
+    "semantic_source": "DESIGN.md:120; BUILD.md:17",
+    "code_label_location": "scripts/case1-accept.sh:659",
+    "exact_reason_token": "reason=metadata "
+  },
+  "socket-type": {
+    "reason": "metadata",
+    "meaning": "Final entry is socket",
+    "semantic_source": "DESIGN.md:119; BUILD.md:17",
+    "code_label_location": "scripts/case1-accept.sh:659",
+    "exact_reason_token": "reason=metadata "
+  },
+  "symlink": {
+    "reason": "metadata",
+    "meaning": "Final entry is not symlink",
+    "semantic_source": "DESIGN.md:119; BUILD.md:17",
+    "code_label_location": "scripts/case1-accept.sh:659",
+    "exact_reason_token": "reason=metadata "
+  },
+  "peer": {
+    "reason": "peer",
+    "meaning": "Connected uid equals stack uid",
+    "semantic_source": "DESIGN.md:136; BUILD.md:17",
+    "code_label_location": "scripts/case1-accept.sh:665",
+    "exact_reason_token": "reason=peer "
+  },
+  "peer-pid": {
+    "reason": "peer",
+    "meaning": "Connected pid equals MainPID",
+    "semantic_source": "DESIGN.md:136; BUILD.md:17",
+    "code_label_location": "scripts/case1-accept.sh:665",
+    "exact_reason_token": "reason=peer "
+  },
+  "python-mode": {
+    "reason": "interpreter",
+    "meaning": "Fixed system interpreter safely owned and protected",
+    "semantic_source": "DESIGN.md:126; BUILD.md:17",
+    "code_label_location": "scripts/case1-accept.sh:660",
+    "exact_reason_token": "reason=interpreter "
+  },
+  "python-missing": {
+    "reason": "interpreter",
+    "meaning": "Missing system Python is failed observation",
+    "semantic_source": "DESIGN.md:129; BUILD.md:17",
+    "code_label_location": "scripts/case1-accept.sh:660",
+    "exact_reason_token": "reason=interpreter "
+  },
+  "python-not-elf": {
+    "reason": "interpreter",
+    "meaning": "System entry target is ELF",
+    "semantic_source": "DESIGN.md:126; BUILD.md:17",
+    "code_label_location": "scripts/case1-accept.sh:660",
+    "exact_reason_token": "reason=interpreter "
+  },
+  "peer-malformed": {
+    "reason": "probe",
+    "meaning": "Probe returns only exactly pid uid gid",
+    "semantic_source": "DESIGN.md:135; DESIGN.md:163; BUILD.md:17; mos-1293 item2 explicitly reason=probe",
+    "code_label_location": "scripts/case1-accept.sh:666",
+    "exact_reason_token": "reason=probe "
+  },
+  "peer-error": {
+    "reason": "probe-inner-command",
+    "meaning": "Nonzero child output discarded, distinct child failure",
+    "semantic_source": "DESIGN-C4.md:84-85; BUILD.md:175; BUILD.md:177",
+    "code_label_location": "scripts/case1-accept.sh:662; tester_capture_reason",
+    "exact_reason_token": "reason=probe-inner-command "
+  },
+  "peer-uid-fields": {
+    "reason": "metadata",
+    "meaning": "MainPID four proc uid fields equal stack uid",
+    "semantic_source": "DESIGN.md:118; BUILD.md:17",
+    "code_label_location": "scripts/case1-accept.sh:659",
+    "exact_reason_token": "reason=metadata "
+  },
+  "changed-inode": {
+    "reason": "changed",
+    "meaning": "Snapshot replacement fails observation",
+    "semantic_source": "DESIGN.md:120; DESIGN.md:121; BUILD.md:17",
+    "code_label_location": "scripts/case1-accept.sh:668",
+    "exact_reason_token": "reason=changed "
+  },
+  "changed-pid": {
+    "reason": "changed",
+    "meaning": "MainPID change fails observation",
+    "semantic_source": "DESIGN.md:121; BUILD.md:17",
+    "code_label_location": "scripts/case1-accept.sh:668",
+    "exact_reason_token": "reason=changed "
+  },
+  "floor": {
+    "reason": "floor",
+    "meaning": "Numeric floor above privileged Console port",
+    "semantic_source": "DESIGN.md:122; DESIGN.md:123",
+    "code_label_location": "scripts/case1-accept.sh:658",
+    "exact_reason_token": "reason=floor "
+  }
+}

agents/gander/work/queue-253/diagnostic-a/EXPECTED-REASONS.md

@@ -0,0 +1,37 @@
+# Draft(b): expected P10 reasons before diagnostic(a)
+
+Not derived from diagnostic output. No test edit is prepared or committed. The brief delegates P10 checks/outcome wording to DESIGN (docs/plans/2026-10-21_tester-socket-scripts.md:31). DESIGN.md:163-170 requires the failed reason to identify the failing observation, rather than accepting any unnamed line. BUILD.md:17 records the separate parent/socket/process/snapshot and peer checks. C4 refined failure classes in DESIGN-C4.md:84 and:91-95, with BUILD.md:175-177 recording distinct refusals.
+
+The approved prose names semantic classes, not a literal exhaustive code-name table. The expected bounded labels below name those classes using existing source labels, cited separately for transparency. They are not selected from (a). peer-malformed=probe is additionally explicit in mos1293. If the diagnostic reports a different class/code, send it to Mos before any edit, even if it would make an existing broad assertion pass.
+
+| Fault | Expected reason= | Designed observation | Design/build authority | Existing label locator, not output oracle |
+|---|---|---|---|---|
+| parent-mode | metadata | Private parent mode is exact0700 | DESIGN.md:119; BUILD.md:17 | scripts/case1-accept.sh:659 |
+| parent-owner | metadata | Parent owner is stack uid | DESIGN.md:119; BUILD.md:17 | scripts/case1-accept.sh:659 |
+| socket-mode | metadata | Socket mode is exact0600 | DESIGN.md:120; BUILD.md:17 | scripts/case1-accept.sh:659 |
+| socket-owner | metadata | Socket owner is stack uid | DESIGN.md:120; BUILD.md:17 | scripts/case1-accept.sh:659 |
+| socket-type | metadata | Final entry is socket | DESIGN.md:119; BUILD.md:17 | scripts/case1-accept.sh:659 |
+| symlink | metadata | Final entry is not symlink | DESIGN.md:119; BUILD.md:17 | scripts/case1-accept.sh:659 |
+| peer | peer | Connected uid equals stack uid | DESIGN.md:136; BUILD.md:17 | scripts/case1-accept.sh:665 |
+| peer-pid | peer | Connected pid equals MainPID | DESIGN.md:136; BUILD.md:17 | scripts/case1-accept.sh:665 |
+| python-mode | interpreter | Fixed system interpreter safely owned and protected | DESIGN.md:126; BUILD.md:17 | scripts/case1-accept.sh:660 |
+| python-missing | interpreter | Missing system Python is failed observation | DESIGN.md:129; BUILD.md:17 | scripts/case1-accept.sh:660 |
+| python-not-elf | interpreter | System entry target is ELF | DESIGN.md:126; BUILD.md:17 | scripts/case1-accept.sh:660 |
+| peer-malformed | probe | Probe returns only exactly pid uid gid | DESIGN.md:135; DESIGN.md:163; BUILD.md:17; mos-1293 item2 explicitly reason=probe | scripts/case1-accept.sh:666 |
+| peer-error | probe-inner-command | Nonzero child output discarded, distinct child failure | DESIGN-C4.md:84-85; BUILD.md:175; BUILD.md:177 | scripts/case1-accept.sh:662; tester_capture_reason |
+| peer-uid-fields | metadata | MainPID four proc uid fields equal stack uid | DESIGN.md:118; BUILD.md:17 | scripts/case1-accept.sh:659 |
+| changed-inode | changed | Snapshot replacement fails observation | DESIGN.md:120; DESIGN.md:121; BUILD.md:17 | scripts/case1-accept.sh:668 |
+| changed-pid | changed | MainPID change fails observation | DESIGN.md:121; BUILD.md:17 | scripts/case1-accept.sh:668 |
+| floor | floor | Numeric floor above privileged Console port | DESIGN.md:122; DESIGN.md:123 | scripts/case1-accept.sh:658 |
+
+All existing status assertions and the boundary=failed/no-boundary=observed assertions remain. The draft adds exact reasons; it never weakens a status or changes a failure to fit observation. The special peer-uid-fields functional failure remains exit1. Product changes require Mos. A fixture-only repair can be considered only when the stub is shown to mask the intended fault, under mos1293.
+
+One scratch archive of0604d91fc is prepared at the path in PREPARE.json. Its only change logs every P10 line, reason and status immediately before the same existing assertions in the named loop. Both product scripts and shared fixture are exact base blobs. The COPY-PATH is not a commit/worktree. No source or test in the seat checkout is changed.
+
+On Sage CLEAR: create TMPDIR via mktemp-d /mnt/storage/scratch/tmp/gXXX, export it, invoke diagnostic-a/run.py with that grant. It gates with the busy check, uses timeout-k10 418 and outer448, pipefail/tee, records command/header/results and writes P10.jsonl. It refuses a second run if output exists. No diagnostic/syntax/Node execution has run while preparing this.
+
+## Duckworth0160 expected-set review
+
+All17 expected reasons accepted by source-only review. C1: assert the exact reason token, including its following space, for example `reason=probe `, or match the full P10 line. A prefix expression `/reason=probe/` is forbidden because it also accepts probe-inner-command and other probe-* reasons. C2: keep every existing status, boundary=failed and no-boundary=observed assertion. A fixture repair is limited to a mask shown by diagnostic(a), and an unexpected reason goes to Mos before any edit.
+
+N1 citation corrected: peer-error child failure is DESIGN-C4.md:84-85. N2: the existing peer-hang test at case1-accept.test.mjs:291 has a separate loose probe prefix; Duckworth says it is outside mos1292/1293 scope and does not bind this repair. No change to it is prepared.

agents/gander/work/queue-253/diagnostic-a/INSTRUMENTATION.diff

@@ -0,0 +1,11 @@
+--- 0604d91fc/packages/cli/tests/case1-accept.test.mjs
++++ scratch/packages/cli/tests/case1-accept.test.mjs
+@@ -262,6 +262,8 @@
+   };
+   for(const [name,fault] of Object.entries(faults)){
+     const h=host(t);fault(h);const r=run(h);
++    const diagnosticP10 = r.lines.filter(line => line.startsWith('P10 '));
++    writeFileSync(process.env.ROW253_P10_DIAG, JSON.stringify({fault:name, p10:diagnosticP10, reason:/\breason=([^ ]+)/.exec(diagnosticP10.join('\n'))?.[1] ?? null, status:r.status})+'\n', {flag:'a'});
+     assert.equal(r.status,name==='peer-uid-fields'?1:0,`${name}: ${r.out}${r.err}`);
+     assert.match(r.out,/P10 tester-socket-squat unnamed boundary=failed/,name);
+     assert.doesNotMatch(r.out,/boundary=observed/,name);

agents/gander/work/queue-253/diagnostic-a/P10.jsonl

@@ -0,0 +1,17 @@
+{"fault":"parent-mode","p10":["P10 tester-socket-squat unnamed boundary=failed reason=metadata path=/srv/mosaic/.mosaic-dev/console/tester.sock MainPID=200; hostile same-uid substitution remains"],"reason":"metadata","status":0}
+{"fault":"parent-owner","p10":["P10 tester-socket-squat unnamed boundary=failed reason=metadata path=/srv/mosaic/.mosaic-dev/console/tester.sock MainPID=200; hostile same-uid substitution remains"],"reason":"metadata","status":0}
+{"fault":"socket-mode","p10":["P10 tester-socket-squat unnamed boundary=failed reason=metadata path=/srv/mosaic/.mosaic-dev/console/tester.sock MainPID=200; hostile same-uid substitution remains"],"reason":"metadata","status":0}
+{"fault":"socket-owner","p10":["P10 tester-socket-squat unnamed boundary=failed reason=metadata path=/srv/mosaic/.mosaic-dev/console/tester.sock MainPID=200; hostile same-uid substitution remains"],"reason":"metadata","status":0}
+{"fault":"socket-type","p10":["P10 tester-socket-squat unnamed boundary=failed reason=metadata path=/srv/mosaic/.mosaic-dev/console/tester.sock MainPID=200; hostile same-uid substitution remains"],"reason":"metadata","status":0}
+{"fault":"symlink","p10":["P10 tester-socket-squat unnamed boundary=failed reason=metadata path=/srv/mosaic/.mosaic-dev/console/tester.sock MainPID=200; hostile same-uid substitution remains"],"reason":"metadata","status":0}
+{"fault":"peer","p10":["P10 tester-socket-squat unnamed boundary=failed reason=peer path=/srv/mosaic/.mosaic-dev/console/tester.sock MainPID=200; hostile same-uid substitution remains"],"reason":"peer","status":0}
+{"fault":"peer-pid","p10":["P10 tester-socket-squat unnamed boundary=failed reason=peer path=/srv/mosaic/.mosaic-dev/console/tester.sock MainPID=200; hostile same-uid substitution remains"],"reason":"peer","status":0}
+{"fault":"python-mode","p10":["P10 tester-socket-squat unnamed boundary=failed reason=interpreter path=/srv/mosaic/.mosaic-dev/console/tester.sock MainPID=200; hostile same-uid substitution remains"],"reason":"interpreter","status":0}
+{"fault":"python-missing","p10":["P10 tester-socket-squat unnamed boundary=failed reason=interpreter path=/srv/mosaic/.mosaic-dev/console/tester.sock MainPID=200; hostile same-uid substitution remains"],"reason":"interpreter","status":0}
+{"fault":"python-not-elf","p10":["P10 tester-socket-squat unnamed boundary=failed reason=interpreter path=/srv/mosaic/.mosaic-dev/console/tester.sock MainPID=200; hostile same-uid substitution remains"],"reason":"interpreter","status":0}
+{"fault":"peer-malformed","p10":["P10 tester-socket-squat unnamed boundary=failed reason=probe-inner-session path=/srv/mosaic/.mosaic-dev/console/tester.sock MainPID=200; hostile same-uid substitution remains"],"reason":"probe-inner-session","status":0}
+{"fault":"peer-error","p10":["P10 tester-socket-squat unnamed boundary=failed reason=probe-inner-session path=/srv/mosaic/.mosaic-dev/console/tester.sock MainPID=200; hostile same-uid substitution remains"],"reason":"probe-inner-session","status":0}
+{"fault":"peer-uid-fields","p10":["P10 tester-socket-squat unnamed boundary=failed reason=metadata path=/srv/mosaic/.mosaic-dev/console/tester.sock MainPID=200; hostile same-uid substitution remains"],"reason":"metadata","status":1}
+{"fault":"changed-inode","p10":["P10 tester-socket-squat unnamed boundary=failed reason=changed path=/srv/mosaic/.mosaic-dev/console/tester.sock MainPID=200; hostile same-uid substitution remains"],"reason":"changed","status":0}
+{"fault":"changed-pid","p10":["P10 tester-socket-squat unnamed boundary=failed reason=changed path=/srv/mosaic/.mosaic-dev/console/tester.sock MainPID=200; hostile same-uid substitution remains"],"reason":"changed","status":0}
+{"fault":"floor","p10":["P10 tester-socket-squat unnamed boundary=failed reason=floor path=/srv/mosaic/.mosaic-dev/console/tester.sock MainPID=200; hostile same-uid substitution remains"],"reason":"floor","status":0}

agents/gander/work/queue-253/diagnostic-a/PREPARE.json

@@ -0,0 +1,18 @@
+{
+  "base": "0604d91fcfc1949810cd5321aea6ec43e9b74b4b",
+  "scratch_copy": "/mnt/storage/scratch/tmp/gBHA",
+  "source": "git archive base, all tracked files, no commit and no .git",
+  "test": "packages/cli/tests/case1-accept.test.mjs",
+  "original_test_sha256": "6cfd2963303315aa6911c4d4f6d75d3ab87d9fcba8e128b056216e7f85fd8901",
+  "instrumented_test_sha256": "0e029047fa7d8cd94a17e0caabc383432ef31068c4ea781e880664d7c7650d3d",
+  "unchanged_product_and_fixture": {
+    "scripts/case1-accept.sh": "c02bef6b3495e5a4548d7b4e89675ed52be26a0c9ccce4d9d5cfc5fe2ce437bd",
+    "scripts/case2-unit.sh": "d7670bdb049ae41ba3774fc83de633636859b6723be858cfb31ea106b0e8812b",
+    "packages/cli/tests/case-sudo-fixture.mjs": "b259b8c7926e49829c8a956674021cb0cc85ddd65aebdc786d05cc08d7790008"
+  },
+  "change": "Output-only JSONL before unchanged existing assertions, scoped to named P10 loop. Records all P10 lines and reason for each fault.",
+  "tests_run": false,
+  "node_modules": "plain symlink to canonical node_modules",
+  "planned_timeout_seconds": 418,
+  "planned_outer_wait_seconds": 448
+}

agents/gander/work/queue-253/diagnostic-a/RUN-HEADER.json

@@ -0,0 +1,19 @@
+{
+  "grant": "sage-2752",
+  "base": "0604d91fcfc1949810cd5321aea6ec43e9b74b4b",
+  "scratch_copy": "/mnt/storage/scratch/tmp/gBHA",
+  "tmpdir": "/mnt/storage/scratch/tmp/grCq",
+  "command": [
+    "timeout",
+    "-k",
+    "10",
+    "418",
+    "node",
+    "--test",
+    "--test-reporter=tap",
+    "--test-name-pattern",
+    "row253 P10 refuses unsafe metadata",
+    "packages/cli/tests/case1-accept.test.mjs"
+  ],
+  "reason_oracle": "EXPECTED-REASONS.md drafted before diagnostic; output does not define expected reasons"
+}

agents/gander/work/queue-253/diagnostic-a/RUN-RESULT.json

@@ -0,0 +1,26 @@
+{
+  "code": 0,
+  "timeout": false,
+  "seconds": 8.632,
+  "header": {
+    "grant": "sage-2752",
+    "base": "0604d91fcfc1949810cd5321aea6ec43e9b74b4b",
+    "scratch_copy": "/mnt/storage/scratch/tmp/gBHA",
+    "tmpdir": "/mnt/storage/scratch/tmp/grCq",
+    "command": [
+      "timeout",
+      "-k",
+      "10",
+      "418",
+      "node",
+      "--test",
+      "--test-reporter=tap",
+      "--test-name-pattern",
+      "row253 P10 refuses unsafe metadata",
+      "packages/cli/tests/case1-accept.test.mjs"
+    ],
+    "reason_oracle": "EXPECTED-REASONS.md drafted before diagnostic; output does not define expected reasons"
+  },
+  "log": "/home/jwoltje/.t3/worktrees/mosaic-stack/gander-row196/agents/gander/work/queue-253/diagnostic-a/diagnostic.log",
+  "p10_file": "/home/jwoltje/.t3/worktrees/mosaic-stack/gander-row196/agents/gander/work/queue-253/diagnostic-a/P10.jsonl"
+}

agents/gander/work/queue-253/diagnostic-a/SWEEP.json

@@ -0,0 +1,61 @@
+{
+  "count": 0,
+  "remaining": [],
+  "excluded_preexisting_infrastructure": [
+    {
+      "pid": 2469277,
+      "comm": "node-MainThread",
+      "cwd": "/home/jwoltje/.t3/worktrees/mosaic-stack/gander-row196",
+      "started_utc": "2026-10-22T14:20:57.360000+00:00"
+    },
+    {
+      "pid": 2469278,
+      "comm": "npm exec @model",
+      "cwd": "/home/jwoltje/.t3/worktrees/mosaic-stack/gander-row196",
+      "started_utc": "2026-10-22T14:20:57.370000+00:00"
+    },
+    {
+      "pid": 2469279,
+      "comm": "npm exec chrome",
+      "cwd": "/home/jwoltje/.t3/worktrees/mosaic-stack/gander-row196",
+      "started_utc": "2026-10-22T14:20:57.370000+00:00"
+    },
+    {
+      "pid": 2469292,
+      "comm": "npm exec @playw",
+      "cwd": "/home/jwoltje/.t3/worktrees/mosaic-stack/gander-row196",
+      "started_utc": "2026-10-22T14:20:57.380000+00:00"
+    },
+    {
+      "pid": 2469478,
+      "comm": "node-MainThread",
+      "cwd": "/home/jwoltje/.t3/worktrees/mosaic-stack/gander-row196",
+      "started_utc": "2026-10-22T14:20:58.770000+00:00"
+    },
+    {
+      "pid": 2469485,
+      "comm": "node-MainThread",
+      "cwd": "/home/jwoltje/.t3/worktrees/mosaic-stack/gander-row196",
+      "started_utc": "2026-10-22T14:20:58.800000+00:00"
+    },
+    {
+      "pid": 2469518,
+      "comm": "chrome-devtools",
+      "cwd": "/home/jwoltje/.t3/worktrees/mosaic-stack/gander-row196",
+      "started_utc": "2026-10-22T14:20:59.100000+00:00"
+    },
+    {
+      "pid": 2469601,
+      "comm": "node-MainThread",
+      "cwd": "/home/jwoltje/.t3/worktrees/mosaic-stack/gander-row196",
+      "started_utc": "2026-10-22T14:20:59.440000+00:00"
+    },
+    {
+      "pid": 2470486,
+      "comm": "codex-code-mode",
+      "cwd": "/home/jwoltje/.t3/worktrees/mosaic-stack/gander-row196",
+      "started_utc": "2026-10-22T14:21:07.580000+00:00"
+    }
+  ],
+  "note": "Read-only cwd sweep over own repo, scratch archive and diagnostic TMPDIR, including deleted cwd. No signalling."
+}

agents/gander/work/queue-253/diagnostic-a/TMPDIR

@@ -0,0 +1 @@
+/mnt/storage/scratch/tmp/grCq

agents/gander/work/queue-253/diagnostic-a/command.json

@@ -0,0 +1 @@
+["timeout", "-k", "10", "418", "node", "--test", "--test-reporter=tap", "--test-name-pattern", "row253 P10 refuses unsafe metadata", "packages/cli/tests/case1-accept.test.mjs"]

agents/gander/work/queue-253/diagnostic-a/controller.log

@@ -0,0 +1,18 @@
+{"grant": "sage-2752", "base": "0604d91fcfc1949810cd5321aea6ec43e9b74b4b", "scratch_copy": "/mnt/storage/scratch/tmp/gBHA", "tmpdir": "/mnt/storage/scratch/tmp/grCq", "command": ["timeout", "-k", "10", "418", "node", "--test", "--test-reporter=tap", "--test-name-pattern", "row253 P10 refuses unsafe metadata", "packages/cli/tests/case1-accept.test.mjs"], "reason_oracle": "EXPECTED-REASONS.md drafted before diagnostic; output does not define expected reasons"}
+TAP version 13
+# Subtest: row253 P10 refuses unsafe metadata, wrong peers and an unsafe Python without claiming closure
+ok 1 - row253 P10 refuses unsafe metadata, wrong peers and an unsafe Python without claiming closure
+  ---
+  duration_ms: 8459.11348
+  type: 'test'
+  ...
+1..1
+# tests 1
+# suites 0
+# pass 1
+# fail 0
+# cancelled 0
+# skipped 0
+# todo 0
+# duration_ms 8556.217902
+{"code": 0, "timeout": false, "seconds": 8.632, "header": {"grant": "sage-2752", "base": "0604d91fcfc1949810cd5321aea6ec43e9b74b4b", "scratch_copy": "/mnt/storage/scratch/tmp/gBHA", "tmpdir": "/mnt/storage/scratch/tmp/grCq", "command": ["timeout", "-k", "10", "418", "node", "--test", "--test-reporter=tap", "--test-name-pattern", "row253 P10 refuses unsafe metadata", "packages/cli/tests/case1-accept.test.mjs"], "reason_oracle": "EXPECTED-REASONS.md drafted before diagnostic; output does not define expected reasons"}, "log": "/home/jwoltje/.t3/worktrees/mosaic-stack/gander-row196/agents/gander/work/queue-253/diagnostic-a/diagnostic.log", "p10_file": "/home/jwoltje/.t3/worktrees/mosaic-stack/gander-row196/agents/gander/work/queue-253/diagnostic-a/P10.jsonl"}

agents/gander/work/queue-253/diagnostic-a/diagnostic.log

@@ -0,0 +1,16 @@
+TAP version 13
+# Subtest: row253 P10 refuses unsafe metadata, wrong peers and an unsafe Python without claiming closure
+ok 1 - row253 P10 refuses unsafe metadata, wrong peers and an unsafe Python without claiming closure
+  ---
+  duration_ms: 8459.11348
+  type: 'test'
+  ...
+1..1
+# tests 1
+# suites 0
+# pass 1
+# fail 0
+# cancelled 0
+# skipped 0
+# todo 0
+# duration_ms 8556.217902

agents/gander/work/queue-253/diagnostic-a/end.txt

@@ -0,0 +1 @@
+2026-10-22T15:25:48.412740+00:00

agents/gander/work/queue-253/diagnostic-a/run.py

@@ -0,0 +1,35 @@
+#!/usr/bin/env python3
+"""One scratch diagnostic, executable only after Sage grants its gap."""
+import argparse,json,os,signal,subprocess,time
+from pathlib import Path
+HERE=Path(__file__).resolve().parent
+
+def main():
+    ap=argparse.ArgumentParser();ap.add_argument('--grant',required=True);args=ap.parse_args()
+    if not os.environ.get('TMPDIR','').startswith('/mnt/storage/scratch/tmp/g'):
+        raise RuntimeError('create the granted gXXX TMPDIR first')
+    prep=json.loads((HERE/'PREPARE.json').read_text());copy=Path(prep['scratch_copy'])
+    busy=subprocess.run(['bash','/mnt/storage/scratch/sage-busy-now.sh'],capture_output=True,text=True)
+    if busy.returncode or busy.stdout.splitlines()[-1:]!=['CLEAR']:
+        raise RuntimeError('busy refusal: '+busy.stdout+busy.stderr)
+    env=os.environ.copy();env['ROW253_P10_DIAG']=str(HERE/'P10.jsonl')
+    if (HERE/'RUN-RESULT.json').exists() or (HERE/'P10.jsonl').exists():
+        raise RuntimeError('one diagnostic only; existing output refuses automatic rerun')
+    command=['timeout','-k','10','418','node','--test','--test-reporter=tap','--test-name-pattern','row253 P10 refuses unsafe metadata','packages/cli/tests/case1-accept.test.mjs']
+    command_file=HERE/'command.json';command_file.write_text(json.dumps(command)+'\n')
+    header=dict(grant=args.grant,base=prep['base'],scratch_copy=str(copy),tmpdir=env['TMPDIR'],command=command,reason_oracle='EXPECTED-REASONS.md drafted before diagnostic; output does not define expected reasons')
+    (HERE/'RUN-HEADER.json').write_text(json.dumps(header,indent=2)+'\n');print(json.dumps(header),flush=True)
+    started=time.monotonic()
+    p=subprocess.Popen(['bash','-o','pipefail','-c','python3 "$1" "$2" 2>&1 | tee "$3"','--',str(HERE.parent/'launch.py'),str(command_file),str(HERE/'diagnostic.log')],cwd=copy,env=env,start_new_session=True)
+    timeout=False
+    try:
+        code=p.wait(timeout=448);timeout=code in (124,137)
+    except subprocess.TimeoutExpired:
+        timeout=True;os.killpg(p.pid,signal.SIGKILL);code=p.wait()
+    finally:
+        try:os.killpg(p.pid,signal.SIGKILL)
+        except ProcessLookupError:pass
+    result=dict(code=code,timeout=timeout,seconds=round(time.monotonic()-started,3),header=header,log=str(HERE/'diagnostic.log'),p10_file=str(HERE/'P10.jsonl'))
+    (HERE/'RUN-RESULT.json').write_text(json.dumps(result,indent=2)+'\n');print(json.dumps(result),flush=True)
+    if timeout or code:raise RuntimeError('diagnostic stopped; no retry or repair before ruling')
+if __name__=='__main__':main()

agents/gander/work/queue-253/diagnostic-a/start.txt

@@ -0,0 +1 @@
+2026-10-22T15:25:29Z

agents/gander/work/queue-253/driver.py

@@ -21,6 +21,11 @@ def busy():
         raise RuntimeError('busy refusal: ' + p.stdout + p.stderr)
 
 def run(command, path, seconds=60):
+    if command[:2] == ['node', '--test']:
+        limits = json.loads((HERE/'WHOLE-GATE-LIMITS.json').read_text())['files']
+        limit = limits.get(command[-1], 900)
+        command = ['timeout','-k','10',str(limit),*command]
+        seconds = limit + 30
     busy()
     started = time.monotonic()
     command_file = path.with_suffix('.command.json')
@@ -33,6 +38,7 @@ def run(command, path, seconds=60):
     expired = False
     try:
         code = p.wait(timeout=seconds)
+        expired = code in (124, 137)
     except subprocess.TimeoutExpired:
         expired = True
         os.killpg(p.pid, signal.SIGKILL)
@@ -89,7 +95,7 @@ def main():
                 raise RuntimeError('invalid syntax: '+d['id'])
             result = run(command,args.out/(d['id']+'.log'))
             result.update(id=d['id'], base_seconds=results['bases'][key]['seconds'],
-                          outcome='killed' if result['code'] != 0 else 'survived')
+                          outcome='timeout' if result['timeout'] else 'killed' if result['code'] != 0 else 'survived')
             results['changes'].append(result)
             if result['timeout']:
                 raise RuntimeError('timeout requires Sage/Mos classification: '+d['id'])

agents/gander/work/queue-253/focused_report.py

@@ -0,0 +1,36 @@
+#!/usr/bin/env python3
+"""Summarize completed focused evidence without executing tests."""
+import datetime
+import hashlib
+import json
+import math
+from pathlib import Path
+HERE=Path(__file__).resolve().parent
+RUN=HERE/'run3-focused'
+def main():
+    results=json.loads((RUN/'files/results.json').read_text())
+    assert len(results['steps'])==27
+    assert all(s['code']==0 and not s['timeout'] and s['counts'].get('fail')==0 for s in results['steps'])
+    header=(RUN/'controller.log').read_text().splitlines()
+    assert json.loads(header[0])=={k:results[k] for k in ['grant','head','manifest']}
+    assert json.loads(header[1])['authority']=='sage-2709'
+    named=[]
+    basis={}
+    lines=['# Focused27 whole-file results','','| Whole file | Pass/fail/skip | Wall seconds | Command limit seconds | Next3x plus120 basis |','|---|---:|---:|---:|---:|']
+    for s in results['steps']:
+        command=json.loads(Path(s['log']).with_suffix('.command.json').read_text())
+        expected=900 if s['file'].startswith('packages/cli/') else 300
+        assert command==['timeout','-k','10',str(expected),'node','--test','--test-reporter=tap',s['file']]
+        c=s['counts'];limit=math.ceil(3*s['seconds'])+120
+        basis[s['file']]=dict(recorded_seconds=s['seconds'],receipt=s['log'],next_limit_seconds=limit,derivation='ceil(3*measured whole-file seconds)+120')
+        lines.append(f"| {s['file']} | {c['pass']}/{c['fail']}/{c['skipped']} | {s['seconds']} | {expected} | {limit} |")
+        named += [dict(file=s['file'],line=line) for line in s['named_skips']]
+    case2=next(s for s in results['steps'] if s['file'].endswith('/case2-unit.test.mjs'))
+    n9=[line for line in Path(case2['log']).read_text().splitlines() if 'inside a session' in line and 'ok ' in line]
+    assert len(n9)==1
+    result=dict(status='GREEN',grant=results['grant'],candidate=results['head'],manifest=results['manifest'],counts={k:sum(s['counts'].get(k,0) for s in results['steps']) for k in ['pass','fail','skipped']},steps=results['steps'],named_skips=named,n9_exact_line=n9[0],file_seconds_sum=round(sum(s['seconds'] for s in results['steps']),3),next_file_limits=basis,timeout_count=0,source_manifest_verified=True)
+    (RUN/'SUMMARY.json').write_text(json.dumps(result,indent=2)+'\n')
+    (RUN/'RESULTS.md').write_text('\n'.join(lines)+'\n\nN9 verbatim: '+n9[0]+'\n\nEvery skip:\n\n'+'\n'.join('- '+s['line'] for s in named)+'\n')
+    (RUN/'MEASURED-FILE-LIMITS.json').write_text(json.dumps(basis,indent=2)+'\n')
+    print(json.dumps({k:result[k] for k in ['counts','named_skips','n9_exact_line','file_seconds_sum']},indent=2))
+if __name__=='__main__':main()

agents/gander/work/queue-253/focused_sweep.py

@@ -0,0 +1,34 @@
+#!/usr/bin/env python3
+"""Read-only sweep of this worktree and focused TMPDIR, including deleted cwd."""
+import datetime
+import json
+import os
+from pathlib import Path
+HERE=Path(__file__).resolve().parent
+REPO=HERE.parents[3]
+RUN=HERE/'run3-focused'
+def main():
+    tmp=Path((RUN/'TMPDIR').read_text().strip())
+    started=datetime.datetime.fromisoformat((RUN/'start.txt').read_text().strip().replace('Z','+00:00')).timestamp()
+    boot=int(next(s.split()[1] for s in Path('/proc/stat').read_text().splitlines() if s.startswith('btime ')))
+    ancestors=set();pid=os.getpid()
+    while pid and pid not in ancestors:
+        ancestors.add(pid)
+        try:pid=int(next(s.split(':')[1] for s in Path(f'/proc/{pid}/status').read_text().splitlines() if s.startswith('PPid:')))
+        except (OSError,StopIteration):break
+    known={2880281,2880282,2880283,2880284,2880445,2880487,2880537,2883251,2880439,2469277,2469278,2469279,2469292,2469478,2469485,2469518,2469601,2470486}
+    remaining=[];excluded=[]
+    for proc in Path('/proc').iterdir():
+        if not proc.name.isdigit() or int(proc.name) in ancestors:continue
+        try:
+            rawcwd=os.readlink(proc/'cwd');cwd=Path(rawcwd.removesuffix(' (deleted)'))
+            if not(cwd==REPO or REPO in cwd.parents or cwd==tmp or tmp in cwd.parents):continue
+            stat=(proc/'stat').read_text().rsplit(') ',1)[1].split()
+            stamp=boot+int(stat[19])/os.sysconf('SC_CLK_TCK')
+            item=dict(pid=int(proc.name),comm=(proc/'comm').read_text().strip(),cwd=rawcwd,started_utc=datetime.datetime.fromtimestamp(stamp,datetime.timezone.utc).isoformat())
+            if int(proc.name) in known and stamp<started:excluded.append(item)
+            else:remaining.append(item)
+        except (OSError,ValueError,IndexError):continue
+    result=dict(timestamp=datetime.datetime.now(datetime.timezone.utc).isoformat(),count=len(remaining),remaining=remaining,excluded_preexisting_infrastructure=excluded,note='Read-only /proc cwd sweep, including deleted cwd under this run TMPDIR. Own ancestry excluded. Only known MCP/npm/code-mode infrastructure PIDs with pre-run start ticks are excluded. No signalling.')
+    (RUN/'sweep.json').write_text(json.dumps(result,indent=2)+'\n');print(json.dumps(result,indent=2))
+if __name__=='__main__':main()

agents/gander/work/queue-253/gate_report.py

@@ -0,0 +1,54 @@
+#!/usr/bin/env python3
+"""Assemble complete whole-gate evidence from retained logs only."""
+import hashlib,json,re
+from pathlib import Path
+HERE=Path(__file__).resolve().parent
+RUN=HERE/'run3-gate'
+def main():
+    sections={n:json.loads((RUN/n/'results.json').read_text()) for n in ['focused','changes','whole']}
+    header=json.loads((RUN/'HEADER.json').read_text());lists=json.loads((RUN/'FILE-LISTS.json').read_text())
+    whole=sections['whole']['steps'];expected=sum(map(len,lists.values()))+10
+    assert len(whole)==expected
+    assert all(s['code']==0 and not s['timeout'] for s in whole)
+    focused=sections['focused']['steps']
+    assert len(focused)==4 and all(not s['timeout'] and (s['code']!=0 if s['expected_red'] else s['code']==0) for s in focused)
+    changes=sections['changes']['changes'];assert len(changes)==40 and all(s['outcome']=='killed' and not s['timeout'] for s in changes)
+    limits=json.loads((HERE/'WHOLE-GATE-LIMITS.json').read_text())['files'];shell_limits=json.loads((HERE/'SHELL-LIMITS.json').read_text())['scripts']
+    counts={};skips=[];rows=[];shells=[];n9=[]
+    for package,files in lists.items():
+        steps=[s for s in whole if s['name'].startswith(package+'-')]
+        commands=[json.loads(Path(s['log']).with_suffix('.command.json').read_text()) for s in steps]
+        assert [c[-1] for c in commands]==files
+        counts[package]={k:sum(s['counts'].get(k,0) for s in steps) for k in ['pass','fail','skipped']}
+        for s,c,file in zip(steps,commands,files):
+            assert c==['timeout','-k','10',str(limits[file]),'node','--test','--test-reporter=tap',file]
+            text=Path(s['log']).read_text(errors='replace')
+            skips += [dict(file=file,line=line) for line in text.splitlines() if '# SKIP' in line]
+            if file.endswith('/case2-unit.test.mjs'):n9 += [line for line in text.splitlines() if line.startswith('ok ') and "inside a session's sandbox" in line]
+            rows.append(dict(file=file,counts=s['counts'],seconds=s['seconds'],limit_seconds=limits[file],log=s['log']))
+    for s in whole[-10:]:
+        command=json.loads(Path(s['log']).with_suffix('.command.json').read_text());file=command[-1]
+        assert command==['timeout','-k','10',str(shell_limits[file]['limit_seconds']),'bash',file]
+        text=Path(s['log']).read_text(errors='replace');found=re.findall(r'([^\n]*?: (\d+) passed, (\d+) failed)',text);assert found,file
+        line,passed,failed=found[-1];assert int(failed)==0
+        skips += [dict(file=file,line=line) for line in text.splitlines() if re.match(r'^\s*skip\b',line,re.I) or '# SKIP' in line]
+        shells.append(dict(file=file,pass_count=int(passed),fail_count=int(failed),seconds=s['seconds'],limit_seconds=shell_limits[file]['limit_seconds'],summary_line=line,log=s['log']))
+    assert len(n9)==1
+    counts['shell_self_assertions']=dict(pass_count=sum(s['pass_count'] for s in shells),fail_count=0)
+    result=dict(status='GREEN',header=header,sections=sections,counts=counts,files=rows,shells=shells,named_skips=skips,n9_exact_line=n9[0],killed=40,survived=0,timeouts=0,head_diff_outside_gander=(RUN/'HEAD-DIFF-OUTSIDE-GANDER.txt').read_text().splitlines())
+    repo=HERE.parents[3]
+    expected_hashes=json.loads((HERE/'CANDIDATE-SHAS.json').read_text())
+    assert all(hashlib.sha256((repo/n).read_bytes()).hexdigest()==v for n,v in expected_hashes.items())
+    assert all(hashlib.sha256((repo/n).read_bytes()).hexdigest()==v['script_sha256'] for n,v in shell_limits.items())
+    (RUN/'SUMMARY.json').write_text(json.dumps(result,indent=2)+'\n')
+    lines=['# Row253 whole gate RESULTS','','HEAD '+header['head']+', product '+header['product']+', manifest '+header['manifest']+'.','','0604..344 name-only outside agents/gander/:','','```text',*result['head_diff_outside_gander'],'```','','All listed whole files ran, with no unlisted-file coverage claim. Intended REDs and focused repeats are separate from package totals. Bus coverage is the20-file rebase union, not a bus-whole claim.','','| Whole file | Pass/fail/skip | Wall seconds | Limit seconds |','|---|---:|---:|---:|']
+    lines += [f"| {r['file']} | {r['counts']['pass']}/{r['counts']['fail']}/{r['counts']['skipped']} | {r['seconds']} | {r['limit_seconds']} |" for r in rows]
+    lines += [f"| {r['file']} | {r['pass_count']}/{r['fail_count']}/0 | {r['seconds']} | {r['limit_seconds']} |" for r in shells]
+    lines += ['','N9 verbatim: '+n9[0],'','Every named skip:','']+[f"- {s['file']}: {s['line']}" for s in skips]
+    (RUN/'RESULTS.md').write_text('\n'.join(lines)+'\n')
+    defs={d['id']:d for d in json.loads((HERE/'changes.json').read_text())}
+    table=['# M1-M40 kill table','','Every base passes; each change restored exact bytes and tracked status before the next. No timeout counts as kill.','','| Check | Named killer | Base seconds | Changed seconds | Outcome |','|---|---|---:|---:|---|']
+    table += [f"| {s['id']} | {defs[s['id']]['pattern']} | {s['base_seconds']} | {s['seconds']} | {s['outcome']} |" for s in changes]
+    (RUN/'KILL-TABLE.md').write_text('\n'.join(table)+'\n')
+    print(json.dumps(dict(counts=counts,named_skips=skips,n9=n9,killed=40),indent=2))
+if __name__=='__main__':main()

agents/gander/work/queue-253/gate_sweep.py

@@ -0,0 +1,34 @@
+#!/usr/bin/env python3
+"""Read-only sweep of this worktree and focused TMPDIR, including deleted cwd."""
+import datetime
+import json
+import os
+from pathlib import Path
+HERE=Path(__file__).resolve().parent
+REPO=HERE.parents[3]
+RUN=HERE/'run3-gate'
+def main():
+    tmp=Path((RUN/'TMPDIR').read_text().strip())
+    started=datetime.datetime.fromisoformat((RUN/'start.txt').read_text().strip().replace('Z','+00:00')).timestamp()
+    boot=int(next(s.split()[1] for s in Path('/proc/stat').read_text().splitlines() if s.startswith('btime ')))
+    ancestors=set();pid=os.getpid()
+    while pid and pid not in ancestors:
+        ancestors.add(pid)
+        try:pid=int(next(s.split(':')[1] for s in Path(f'/proc/{pid}/status').read_text().splitlines() if s.startswith('PPid:')))
+        except (OSError,StopIteration):break
+    known={2880281,2880282,2880283,2880284,2880445,2880487,2880537,2883251,2880439,2469277,2469278,2469279,2469292,2469478,2469485,2469518,2469601,2470486}
+    remaining=[];excluded=[]
+    for proc in Path('/proc').iterdir():
+        if not proc.name.isdigit() or int(proc.name) in ancestors:continue
+        try:
+            rawcwd=os.readlink(proc/'cwd');cwd=Path(rawcwd.removesuffix(' (deleted)'))
+            if not(cwd==REPO or REPO in cwd.parents or cwd==tmp or tmp in cwd.parents):continue
+            stat=(proc/'stat').read_text().rsplit(') ',1)[1].split()
+            stamp=boot+int(stat[19])/os.sysconf('SC_CLK_TCK')
+            item=dict(pid=int(proc.name),comm=(proc/'comm').read_text().strip(),cwd=rawcwd,started_utc=datetime.datetime.fromtimestamp(stamp,datetime.timezone.utc).isoformat())
+            if int(proc.name) in known and stamp<started:excluded.append(item)
+            else:remaining.append(item)
+        except (OSError,ValueError,IndexError):continue
+    result=dict(timestamp=datetime.datetime.now(datetime.timezone.utc).isoformat(),count=len(remaining),remaining=remaining,excluded_preexisting_infrastructure=excluded,note='Read-only /proc cwd sweep, including deleted cwd under this run TMPDIR. Own ancestry excluded. Only known MCP/npm/code-mode infrastructure PIDs with pre-run start ticks are excluded. No signalling.')
+    (RUN/'sweep.json').write_text(json.dumps(result,indent=2)+'\n');print(json.dumps(result,indent=2))
+if __name__=='__main__':main()

agents/gander/work/queue-253/integration-0fa7/NOTES.md

@@ -0,0 +1,15 @@
+# Row253 integration onto 0fa7bf421
+
+Authority: sage-2463. New branch gander/row253-0fa7, rebase tip before these records 67224933425e9687bf366cd7ba7c31c1daa4e9f3. Both earlier branches remain unchanged. Nine commits replayed onto 0fa7bf421fc153a226b5f06ed484e089e48e23ba.
+
+One conflict: the first design commit's BUILD-LOG.md append. Kept upstream in full, then appended the row253 phase. The integrated log has the entire current base blob as its exact prefix. It stays outside the manifest and lands as a separate doc-only append after code. README merged automatically, retaining row253's tester-socket wording and row191's complete Instance processing controls section. No runtime or test conflict.
+
+Only packages/webui/README.md changes among the seven manifest entries. CANDIDATE-SHAS.json and MANIFEST.sha256 are refreshed. The old C4 packets remain historical exact snapshots; the README addition is the sole new manifest blob. Runtime scripts, focused test files and shared fixture remain byte-identical to the approved candidate.
+
+## Static test dependency inspection
+
+The row253 focused case1/case2 files read their two host scripts, generated fixtures, kernel proc data, the two service templates, and case2-precheck.sh. They import the shared case-sudo fixture, cli test helpers, business test helpers and seat sandbox helpers. Neither directly reads or imports the row191 changes in webui cli.mjs, serve.mjs, index.html, processing.js/css or processing-http.mjs. The cli.mjs/config.mjs in their scratch copies are stand-ins written by the fixtures, not the repository Console code.
+
+The required WebUI whole suite does consume row191's changed modules and UI, including the processing/browser/shell tests now present on the integrated base. The full CLI suite also runs against the new base and scripts/mosaic. No focused test, suite, syntax execution, browser, probe or host experiment ran. Dependency inspection used source reads only.
+
+range-diff.json covers the nine replayed commits. patch-ids.json lists each old/new pair; the final record/manifest refresh commit has no old counterpart. The requested exact range-diff through the final committed tip is sent with the handoff. Publishing uses only the repo helper and waits for a clear busy check.

agents/gander/work/queue-253/integration-0fa7/manifest-check.json

@@ -0,0 +1,47 @@
+{
+  "digest": "24b6a01b2ede6f025ec898fa4ec830bb9585ce6151d6298e713e31c7430a502b",
+  "entries": [
+    {
+      "path": "scripts/case2-unit.sh",
+      "before": "d7670bdb049ae41ba3774fc83de633636859b6723be858cfb31ea106b0e8812b",
+      "after": "d7670bdb049ae41ba3774fc83de633636859b6723be858cfb31ea106b0e8812b",
+      "changed": false
+    },
+    {
+      "path": "scripts/case1-accept.sh",
+      "before": "c02bef6b3495e5a4548d7b4e89675ed52be26a0c9ccce4d9d5cfc5fe2ce437bd",
+      "after": "c02bef6b3495e5a4548d7b4e89675ed52be26a0c9ccce4d9d5cfc5fe2ce437bd",
+      "changed": false
+    },
+    {
+      "path": "packages/cli/tests/case-sudo-fixture.mjs",
+      "before": "b259b8c7926e49829c8a956674021cb0cc85ddd65aebdc786d05cc08d7790008",
+      "after": "b259b8c7926e49829c8a956674021cb0cc85ddd65aebdc786d05cc08d7790008",
+      "changed": false
+    },
+    {
+      "path": "packages/cli/tests/case2-unit.test.mjs",
+      "before": "1e0696eb196e83a0766b433ef71f27df0a3f8fcb6399787ab8c1c0f05c54dc44",
+      "after": "1e0696eb196e83a0766b433ef71f27df0a3f8fcb6399787ab8c1c0f05c54dc44",
+      "changed": false
+    },
+    {
+      "path": "packages/cli/tests/case1-accept.test.mjs",
+      "before": "6cfd2963303315aa6911c4d4f6d75d3ab87d9fcba8e128b056216e7f85fd8901",
+      "after": "6cfd2963303315aa6911c4d4f6d75d3ab87d9fcba8e128b056216e7f85fd8901",
+      "changed": false
+    },
+    {
+      "path": "packages/webui/README.md",
+      "before": "2eeb1f79324f64463a9b3427e67492d672b8d1c14db6c0349c7de17d89e52fc9",
+      "after": "9de6c8356e1f1e0ecb8d0be8ec523cb817b04bb633f0cd8aed7db32565ffd009",
+      "changed": true
+    },
+    {
+      "path": "docs/plans/DEFERRED.md",
+      "before": "3ea465cf7ed664ceb1ea4076b829f706f8480f80c4a8aaa6a7487e4eceaf318f",
+      "after": "3ea465cf7ed664ceb1ea4076b829f706f8480f80c4a8aaa6a7487e4eceaf318f",
+      "changed": false
+    }
+  ]
+}

agents/gander/work/queue-253/integration-0fa7/patch-ids.json

@@ -0,0 +1,74 @@
+[
+  {
+    "old": "971681f29a347a3771802b19d1b9a65c88943a79",
+    "new": "39c30f1c200a1f5f27767dae4b730cade7703777",
+    "subject": "gander: design tester socket migration for host scripts",
+    "old_patch_id": "47bdc56d349c8fcce2e5f56f3f5ce4ce7b1d6f14",
+    "new_patch_id": "895656745186c2dc4cb1ee1261c323af90bf9fb9",
+    "equal": false
+  },
+  {
+    "old": "43f17b9afe60bfe256e924b1317332d6068a8b4f",
+    "new": "d004b44982db5196777710e20163f877b07bf54d",
+    "subject": "test: prepare row253 socket fixtures and fix gate collisions",
+    "old_patch_id": "d597cc7402b568d845a87c1f142bde74ce6ae9da",
+    "new_patch_id": "d597cc7402b568d845a87c1f142bde74ce6ae9da",
+    "equal": true
+  },
+  {
+    "old": "f9b9112b970b634ee7c990447ded04dfe622d8cc",
+    "new": "9e4bbee25d3a97e9dfec743d92c20f50154222da",
+    "subject": "docs: propose row253 C4 session supervisor and draft hop fake",
+    "old_patch_id": "899327761a9bde7e7b4fefd790c1a523488e8029",
+    "new_patch_id": "899327761a9bde7e7b4fefd790c1a523488e8029",
+    "equal": true
+  },
+  {
+    "old": "70e6bb16159dd28391dbbfe0b4808f0c3dde5225",
+    "new": "69474277277fe87e7c398c508f6450aa0d691de7",
+    "subject": "docs(row253): freeze C4 repair for static review",
+    "old_patch_id": "38dcf7f0ec2a39bad2696d971a684a729b154747",
+    "new_patch_id": "38dcf7f0ec2a39bad2696d971a684a729b154747",
+    "equal": true
+  },
+  {
+    "old": "bef1bd886b6e90f2a404825cce728e3901328ba3",
+    "new": "d85cf93d64a4ebf37865cbb74719d842105a1864",
+    "subject": "docs(row253): store repair patch without context whitespace",
+    "old_patch_id": "1cf1916dab2a8552fadd07ce81246fce5f105b3d",
+    "new_patch_id": "1cf1916dab2a8552fadd07ce81246fce5f105b3d",
+    "equal": true
+  },
+  {
+    "old": "ecb15d1debdad4fbd2e9bdfedb639143467709c6",
+    "new": "463a97f49f6bcaa65a10a54c2ad40e428e7fd135",
+    "subject": "fix(row253): supervise socket queries across sudo sessions",
+    "old_patch_id": "d104bd53960b75c1e9d9402ec2ea193a55bf8164",
+    "new_patch_id": "08a16c862148ddae13044130cac740064d0e86fe",
+    "equal": false
+  },
+  {
+    "old": "39b98a26e9ac00edf3b8d77690cf06bc689a6272",
+    "new": "de93d8e038f591ea7be2f850c5fb0dea272c3d63",
+    "subject": "fix(row253): bound cleanup retries after initial inventory",
+    "old_patch_id": "aee9e5492bf07ee71687fd899c4e632bb36bc1e3",
+    "new_patch_id": "aee9e5492bf07ee71687fd899c4e632bb36bc1e3",
+    "equal": true
+  },
+  {
+    "old": "2f466464cccfe7b4f2522936a7f8409b74af7b5c",
+    "new": "36bd3c3a8bda8c31da8219cc726ce005ec2dbd2b",
+    "subject": "docs(row253): record static approval and pre-confirmation residual",
+    "old_patch_id": "d2aecebf222474b0e06c5109b5f22caf768176ce",
+    "new_patch_id": "d2aecebf222474b0e06c5109b5f22caf768176ce",
+    "equal": true
+  },
+  {
+    "old": "8b8f8d7810d076974aedcae3c800123bf791fa47",
+    "new": "67224933425e9687bf366cd7ba7c31c1daa4e9f3",
+    "subject": "docs(row253): record integration onto refactor 378a76b85",
+    "old_patch_id": "efb06f08af899d8f03390ab24ab65f6558cbae58",
+    "new_patch_id": "efb06f08af899d8f03390ab24ab65f6558cbae58",
+    "equal": true
+  }
+]

agents/gander/work/queue-253/integration-0fa7/upstream-paths.json

@@ -0,0 +1,98 @@
+[
+  "BUILD-LOG.md",
+  "Containerfile",
+  "agents/darkwing/work/queue-273/BUILD.md",
+  "agents/rocko/work/queue-191/stoprun-build/BUILD.md",
+  "compose.yaml",
+  "docs/TOOLS.md",
+  "docs/plans/QUEUE.md",
+  "docs/plans/queue.json",
+  "packages/bus/README.md",
+  "packages/bus/src/broker.mjs",
+  "packages/bus/src/client.mjs",
+  "packages/bus/src/runtime.mjs",
+  "packages/bus/src/server.mjs",
+  "packages/bus/src/web.mjs",
+  "packages/bus/tests/processing-runtime.test.mjs",
+  "packages/bus/tests/processing-timeout.test.mjs",
+  "packages/bus/tests/processing-web.test.mjs",
+  "packages/bus/tests/processing.test.mjs",
+  "packages/bus/tests/project-runtime.test.mjs",
+  "packages/bus/tests/tasks.test.mjs",
+  "packages/cli/README.md",
+  "packages/cli/src/cli.mjs",
+  "packages/cli/src/git-socket.mjs",
+  "packages/cli/src/launcher.mjs",
+  "packages/cli/src/notifier-process.mjs",
+  "packages/cli/src/notifier.mjs",
+  "packages/cli/tests/gate-lane-image.test.mjs",
+  "packages/cli/tests/host.test.mjs",
+  "packages/cli/tests/launch-account.test.mjs",
+  "packages/cli/tests/launch-limit-checks.test.mjs",
+  "packages/cli/tests/launch-limits.test.mjs",
+  "packages/cli/tests/launch-routes.test.mjs",
+  "packages/cli/tests/launcher.test.mjs",
+  "packages/cli/tests/notifier.test.mjs",
+  "packages/cli/tests/processing-cli.test.mjs",
+  "packages/cli/tests/stack-copy.test.mjs",
+  "packages/cli/tests/stack-release-external.test.mjs",
+  "packages/cli/tests/stack-release.test.mjs",
+  "packages/discord/src/cli.mjs",
+  "packages/discord/src/connector.mjs",
+  "packages/discord/src/engine-pi.mjs",
+  "packages/discord/src/journal.mjs",
+  "packages/discord/src/processing.mjs",
+  "packages/discord/tests/binding.test.mjs",
+  "packages/discord/tests/processing-stop.test.mjs",
+  "packages/discord/tests/processing.test.mjs",
+  "packages/discord/tests/recover.test.mjs",
+  "packages/processing-control/README.md",
+  "packages/processing-control/package.json",
+  "packages/processing-control/src/container-cli.mjs",
+  "packages/processing-control/src/containers.mjs",
+  "packages/processing-control/src/coordinator.mjs",
+  "packages/processing-control/src/effects.mjs",
+  "packages/processing-control/src/entrypoint.mjs",
+  "packages/processing-control/src/runtimes.mjs",
+  "packages/processing-control/src/state.mjs",
+  "packages/processing-control/tests/containers.test.mjs",
+  "packages/processing-control/tests/coordinator.test.mjs",
+  "packages/processing-control/tests/effects.test.mjs",
+  "packages/processing-control/tests/mount.test.mjs",
+  "packages/processing-control/tests/runtimes.test.mjs",
+  "packages/processing-control/tests/state.test.mjs",
+  "packages/processing-control/tests/stop-run.test.mjs",
+  "packages/processing-control/tests/task.test.mjs",
+  "packages/project/src/git.mjs",
+  "packages/seat/src/checkout.mjs",
+  "packages/seat/src/landing.mjs",
+  "packages/seat/src/sandbox.mjs",
+  "packages/seat/src/working.mjs",
+  "packages/seat/tests/working.test.mjs",
+  "packages/tasks/src/adapter.mjs",
+  "packages/tasks/src/vikunja.mjs",
+  "packages/tasks/tests/processing.test.mjs",
+  "packages/webui/README.md",
+  "packages/webui/src/cli.mjs",
+  "packages/webui/src/processing-http.mjs",
+  "packages/webui/src/public/index.html",
+  "packages/webui/src/public/processing.css",
+  "packages/webui/src/public/processing.js",
+  "packages/webui/src/serve.mjs",
+  "packages/webui/tests/browser.test.mjs",
+  "packages/webui/tests/processing-browser.test.mjs",
+  "packages/webui/tests/processing-ui.test.mjs",
+  "packages/webui/tests/processing.test.mjs",
+  "packages/webui/tests/shell.test.mjs",
+  "scripts/agent.sh",
+  "scripts/common.sh",
+  "scripts/hello.sh",
+  "scripts/mosaic",
+  "scripts/mosaic-task.mjs",
+  "scripts/run-task.sh",
+  "scripts/stack-copy.sh",
+  "scripts/stack-release.sh",
+  "scripts/testing/lane-image.mjs",
+  "scripts/verify.sh",
+  "src/run-agent.sh"
+]

agents/gander/work/queue-253/integration-264a/NOTES.md

@@ -0,0 +1,43 @@
+# Row253 final integration after264a
+
+Authority sage-2698. New gander/row253-264a on84f53540d; previous branch retained. Eleven commits replayed with no conflict. All eleven range-diff pairs and full patch-ids equal. Rebased tip before this record b9d3d4c75c78aa6b06aefd734da781bef9b7f1da.
+
+Only DEFERRED changes among the seven manifest blobs, preserving the new base as an exact byte prefix. Six other blobs remain unchanged, including both host scripts, both focused tests and shared sudo fixture. New manifest 735fa2d7405d01ace8eb7aab366753fa5b1877cf8044b0151cb2113a0502bc1f. BUILD-LOG remains an append outside the landing manifest.
+
+264a reaches the focused tests through Store loaded by CLI helpers. The new base includes schema3l, migrations/3k-3l.sql and matching store hash. The focused tests pin neither3k/3l nor schema bytes. No product/test/assertion repair. Duckworth0132 already checked this dependency statically against264a r9. This packet also lists actual landing changes. T46 stack-release.test.mjs reads actual schema and will run whole.
+
+The required whole-file union conservatively includes every .test.mjs changed upstream from385a to84f plus both own focused test files. Shared case-sudo fixture is exercised by its two importers; schema-3k.sql is a migration fixture, not a standalone test. Whole-test-union.json has 27 runnable files. No result carries. These runs await a focused CLEAR before publication and Duckworth rebase check; the whole gate needs a later CLEAR.
+
+N9 remains the exact case2 test: inside a session's sandbox a bind below1024 fails with EACCES, and a bind on a free high port succeeds. Its skip reason comes from sandboxProblem() at gate time and will be copied verbatim. Other environment/provider/canonical-root skips will be named too.
+
+SHELL-LIMITS.json stays as prepared under sage-2659. Every scripts/test-*.sh blob matches the previous base; the only changed script upstream is stack-release.sh. Current limits retain their receipts and3x rule. No tests, Node, syntax commands, browser, host probe, queue command or push ran.
+
+Required whole files:
+
+- packages/bus/tests/account-migration.test.mjs
+- packages/bus/tests/chief-of-staff.test.mjs
+- packages/bus/tests/comment-migration.test.mjs
+- packages/bus/tests/end-launch.test.mjs
+- packages/bus/tests/fire-revokes-grants.test.mjs
+- packages/bus/tests/gitea-grant.test.mjs
+- packages/bus/tests/gitea-migration.test.mjs
+- packages/bus/tests/grant-executor.test.mjs
+- packages/bus/tests/grant-migration.test.mjs
+- packages/bus/tests/lifecycle-revoke.test.mjs
+- packages/bus/tests/message-filter.test.mjs
+- packages/bus/tests/name-migration.test.mjs
+- packages/bus/tests/schema.test.mjs
+- packages/bus/tests/sessions.test.mjs
+- packages/bus/tests/spec-migration.test.mjs
+- packages/bus/tests/tester-writes.test.mjs
+- packages/bus/tests/thread-claims.test.mjs
+- packages/bus/tests/thread-migration.test.mjs
+- packages/bus/tests/threads.test.mjs
+- packages/bus/tests/usage-migration.test.mjs
+- packages/cli/tests/case1-accept.test.mjs
+- packages/cli/tests/case2-unit.test.mjs
+- packages/cli/tests/lifecycle.test.mjs
+- packages/cli/tests/stack-release.test.mjs
+- packages/cli/tests/thread-cli.test.mjs
+- packages/cli/tests/thread-launch.test.mjs
+- packages/webui/tests/chat.test.mjs

agents/gander/work/queue-253/integration-264a/drift.json

@@ -0,0 +1,90 @@
+{
+  "old_base": "385a7194c",
+  "old_tip": "d213ef651",
+  "new_base": "84f53540d",
+  "rebased_tip": "b9d3d4c75c78aa6b06aefd734da781bef9b7f1da",
+  "manifest": "735fa2d7405d01ace8eb7aab366753fa5b1877cf8044b0151cb2113a0502bc1f",
+  "manifest_blobs_changed": [
+    "docs/plans/DEFERRED.md"
+  ],
+  "upstream_paths": [
+    "agents/gizmoduck/work/queue-264/BUILD.md",
+    "agents/megavolt/work/queue-281/BUILD.md",
+    "docs/plans/DEFERRED.md",
+    "packages/bus/README.md",
+    "packages/bus/schema.sql",
+    "packages/bus/src/broker.mjs",
+    "packages/bus/src/migrations/3k-3l.sql",
+    "packages/bus/src/store.mjs",
+    "packages/bus/tests/account-migration.test.mjs",
+    "packages/bus/tests/chief-of-staff.test.mjs",
+    "packages/bus/tests/comment-migration.test.mjs",
+    "packages/bus/tests/end-launch.test.mjs",
+    "packages/bus/tests/fire-revokes-grants.test.mjs",
+    "packages/bus/tests/fixtures/schema-3k.sql",
+    "packages/bus/tests/gitea-grant.test.mjs",
+    "packages/bus/tests/gitea-migration.test.mjs",
+    "packages/bus/tests/grant-executor.test.mjs",
+    "packages/bus/tests/grant-migration.test.mjs",
+    "packages/bus/tests/lifecycle-revoke.test.mjs",
+    "packages/bus/tests/message-filter.test.mjs",
+    "packages/bus/tests/name-migration.test.mjs",
+    "packages/bus/tests/schema.test.mjs",
+    "packages/bus/tests/sessions.test.mjs",
+    "packages/bus/tests/spec-migration.test.mjs",
+    "packages/bus/tests/tester-writes.test.mjs",
+    "packages/bus/tests/thread-claims.test.mjs",
+    "packages/bus/tests/thread-migration.test.mjs",
+    "packages/bus/tests/threads.test.mjs",
+    "packages/bus/tests/usage-migration.test.mjs",
+    "packages/cli/tests/lifecycle.test.mjs",
+    "packages/cli/tests/stack-release.test.mjs",
+    "packages/cli/tests/thread-cli.test.mjs",
+    "packages/cli/tests/thread-launch.test.mjs",
+    "packages/webui/tests/chat.test.mjs",
+    "scripts/stack-release.sh"
+  ],
+  "whole_test_union": [
+    "packages/bus/tests/account-migration.test.mjs",
+    "packages/bus/tests/chief-of-staff.test.mjs",
+    "packages/bus/tests/comment-migration.test.mjs",
+    "packages/bus/tests/end-launch.test.mjs",
+    "packages/bus/tests/fire-revokes-grants.test.mjs",
+    "packages/bus/tests/gitea-grant.test.mjs",
+    "packages/bus/tests/gitea-migration.test.mjs",
+    "packages/bus/tests/grant-executor.test.mjs",
+    "packages/bus/tests/grant-migration.test.mjs",
+    "packages/bus/tests/lifecycle-revoke.test.mjs",
+    "packages/bus/tests/message-filter.test.mjs",
+    "packages/bus/tests/name-migration.test.mjs",
+    "packages/bus/tests/schema.test.mjs",
+    "packages/bus/tests/sessions.test.mjs",
+    "packages/bus/tests/spec-migration.test.mjs",
+    "packages/bus/tests/tester-writes.test.mjs",
+    "packages/bus/tests/thread-claims.test.mjs",
+    "packages/bus/tests/thread-migration.test.mjs",
+    "packages/bus/tests/threads.test.mjs",
+    "packages/bus/tests/usage-migration.test.mjs",
+    "packages/cli/tests/case1-accept.test.mjs",
+    "packages/cli/tests/case2-unit.test.mjs",
+    "packages/cli/tests/lifecycle.test.mjs",
+    "packages/cli/tests/stack-release.test.mjs",
+    "packages/cli/tests/thread-cli.test.mjs",
+    "packages/cli/tests/thread-launch.test.mjs",
+    "packages/webui/tests/chat.test.mjs"
+  ],
+  "shared_test_helpers": [
+    "packages/cli/tests/case-sudo-fixture.mjs"
+  ],
+  "shared_fixture_artifacts": [
+    "packages/bus/tests/fixtures/schema-3k.sql"
+  ],
+  "unchanged_runnable_blobs": [
+    "packages/cli/tests/case-sudo-fixture.mjs",
+    "packages/cli/tests/case1-accept.test.mjs",
+    "packages/cli/tests/case2-unit.test.mjs",
+    "packages/webui/README.md",
+    "scripts/case1-accept.sh",
+    "scripts/case2-unit.sh"
+  ]
+}

agents/gander/work/queue-253/integration-264a/manifest-drift.diff

@@ -0,0 +1,20 @@
+diff --git a/docs/plans/DEFERRED.md b/docs/plans/DEFERRED.md
+index 4c0c736f1..020fd5b57 100644
+--- a/docs/plans/DEFERRED.md
++++ b/docs/plans/DEFERRED.md
+@@ -460,6 +460,15 @@ at every gate. Started 2026-09-12 during the control board MVP.
+   changes `packages/cli/tests/tester.test.mjs`: add the resolve pin so M8
+   dies on an assertion. (2026-10-22)
+ 
++- **Row 274's user reply check is scoped to the thread, not the session.**
++  (Row 264a r6, sage-2591.) In `packages/bus/src/broker.mjs`, the check that
++  a run answers a user only in reply to that user's message in its thread
++  joins `message_threads` by thread. That holds while a user's thread has
++  only its default session: a user can't call `session.create`, and
++  `#thread` refuses anyone but the owner. Binds row 272 (264e, #1777), or
++  any row that lets a user add sessions: make the check session-scoped and
++  test it with two sessions. (2026-10-22)
++
+ ## Queue
+ 
+ Moved to `docs/plans/QUEUE.md` on 2026-09-13. This file holds only gaps.

agents/gander/work/queue-253/integration-264a/patch-ids.json

@@ -0,0 +1,68 @@
+[
+  {
+    "old": "a9c094d0657a52c22ba51b35e690868358cf2bd0",
+    "new": "0c44ba7c46103d4cb74de2a5393ce677a5010378",
+    "old_patch_id": "2b17f1d6773aa17909fc959081eec3f3821c3dee",
+    "new_patch_id": "2b17f1d6773aa17909fc959081eec3f3821c3dee"
+  },
+  {
+    "old": "2e81f78722ccd43d7524bb6a7d27d7ac26d0cea8",
+    "new": "a1f3b4f31b861e19b9a05189fb16692515819f5f",
+    "old_patch_id": "d597cc7402b568d845a87c1f142bde74ce6ae9da",
+    "new_patch_id": "d597cc7402b568d845a87c1f142bde74ce6ae9da"
+  },
+  {
+    "old": "3c8edc358c1f30ea7b5cc9a79d30282e59092715",
+    "new": "1ecc23eb1f0b68e8a940169a71b6d37f754a034c",
+    "old_patch_id": "899327761a9bde7e7b4fefd790c1a523488e8029",
+    "new_patch_id": "899327761a9bde7e7b4fefd790c1a523488e8029"
+  },
+  {
+    "old": "3114087efe655f1d38c5e30f8327f65980854043",
+    "new": "18523ce92db9b02fdc72d00999e04d4de8550d6a",
+    "old_patch_id": "38dcf7f0ec2a39bad2696d971a684a729b154747",
+    "new_patch_id": "38dcf7f0ec2a39bad2696d971a684a729b154747"
+  },
+  {
+    "old": "911e470b76d78e6a1ddd73c8e3e88a3ce821e43c",
+    "new": "7450fb71218e3736878d52bd7ce6a3a60ed531ba",
+    "old_patch_id": "1cf1916dab2a8552fadd07ce81246fce5f105b3d",
+    "new_patch_id": "1cf1916dab2a8552fadd07ce81246fce5f105b3d"
+  },
+  {
+    "old": "4a8b5c3ff98bfd9c31d6bfeb5356570df240e98c",
+    "new": "d202f6d631ccfe413621b6ef99d1c20f82578a0a",
+    "old_patch_id": "c93ea22b2651163be712ebb7ce96c8230ee41da8",
+    "new_patch_id": "c93ea22b2651163be712ebb7ce96c8230ee41da8"
+  },
+  {
+    "old": "e18b90e95dd928743c53d63449a82ffaffe360e8",
+    "new": "37c97b41d58b487f994591310383b48eec3383a9",
+    "old_patch_id": "aee9e5492bf07ee71687fd899c4e632bb36bc1e3",
+    "new_patch_id": "aee9e5492bf07ee71687fd899c4e632bb36bc1e3"
+  },
+  {
+    "old": "67776714515b562dd29a15d6a0a3bea9d642e6f2",
+    "new": "7bca9b042f245ff519ce58f57fbd57ce60359fbd",
+    "old_patch_id": "d2aecebf222474b0e06c5109b5f22caf768176ce",
+    "new_patch_id": "d2aecebf222474b0e06c5109b5f22caf768176ce"
+  },
+  {
+    "old": "c733371c5c297291b9d06c2dd2772e22670fe653",
+    "new": "3a2022038fa9fce043f7cf0e34b564ba3625e409",
+    "old_patch_id": "efb06f08af899d8f03390ab24ab65f6558cbae58",
+    "new_patch_id": "efb06f08af899d8f03390ab24ab65f6558cbae58"
+  },
+  {
+    "old": "141b79c293d78e78b9ce05bcf0fcaa18ba4d6963",
+    "new": "614bdc8e9b2692856972a252e4452c91990bc18b",
+    "old_patch_id": "e29f40a61cc88532701f0b063154a0cbe8d7ba7b",
+    "new_patch_id": "e29f40a61cc88532701f0b063154a0cbe8d7ba7b"
+  },
+  {
+    "old": "d213ef6514eb696df5c3e44eaa36d2385e2900ab",
+    "new": "b9d3d4c75c78aa6b06aefd734da781bef9b7f1da",
+    "old_patch_id": "afdf42b5115e72fb0aaaded10aed6617a1d68cd2",
+    "new_patch_id": "afdf42b5115e72fb0aaaded10aed6617a1d68cd2"
+  }
+]

agents/gander/work/queue-253/integration-264a/range-diff.txt

@@ -0,0 +1,11 @@
+ 1:  a9c094d06 =  1:  0c44ba7c4 gander: design tester socket migration for host scripts
+ 2:  2e81f7872 =  2:  a1f3b4f31 test: prepare row253 socket fixtures and fix gate collisions
+ 3:  3c8edc358 =  3:  1ecc23eb1 docs: propose row253 C4 session supervisor and draft hop fake
+ 4:  3114087ef =  4:  18523ce92 docs(row253): freeze C4 repair for static review
+ 5:  911e470b7 =  5:  7450fb712 docs(row253): store repair patch without context whitespace
+ 6:  4a8b5c3ff =  6:  d202f6d63 fix(row253): supervise socket queries across sudo sessions
+ 7:  e18b90e95 =  7:  37c97b41d fix(row253): bound cleanup retries after initial inventory
+ 8:  677767145 =  8:  7bca9b042 docs(row253): record static approval and pre-confirmation residual
+ 9:  c733371c5 =  9:  3a2022038 docs(row253): record integration onto refactor 378a76b85
+10:  141b79c29 = 10:  614bdc8e9 docs(row253): integrate row191 base and refresh manifest
+11:  d213ef651 = 11:  b9d3d4c75 docs(row253): integrate 385a base and record dependency drift and bounds

agents/gander/work/queue-253/integration-264a/whole-test-union.json

@@ -0,0 +1,29 @@
+[
+  "packages/bus/tests/account-migration.test.mjs",
+  "packages/bus/tests/chief-of-staff.test.mjs",
+  "packages/bus/tests/comment-migration.test.mjs",
+  "packages/bus/tests/end-launch.test.mjs",
+  "packages/bus/tests/fire-revokes-grants.test.mjs",
+  "packages/bus/tests/gitea-grant.test.mjs",
+  "packages/bus/tests/gitea-migration.test.mjs",
+  "packages/bus/tests/grant-executor.test.mjs",
+  "packages/bus/tests/grant-migration.test.mjs",
+  "packages/bus/tests/lifecycle-revoke.test.mjs",
+  "packages/bus/tests/message-filter.test.mjs",
+  "packages/bus/tests/name-migration.test.mjs",
+  "packages/bus/tests/schema.test.mjs",
+  "packages/bus/tests/sessions.test.mjs",
+  "packages/bus/tests/spec-migration.test.mjs",
+  "packages/bus/tests/tester-writes.test.mjs",
+  "packages/bus/tests/thread-claims.test.mjs",
+  "packages/bus/tests/thread-migration.test.mjs",
+  "packages/bus/tests/threads.test.mjs",
+  "packages/bus/tests/usage-migration.test.mjs",
+  "packages/cli/tests/case1-accept.test.mjs",
+  "packages/cli/tests/case2-unit.test.mjs",
+  "packages/cli/tests/lifecycle.test.mjs",
+  "packages/cli/tests/stack-release.test.mjs",
+  "packages/cli/tests/thread-cli.test.mjs",
+  "packages/cli/tests/thread-launch.test.mjs",
+  "packages/webui/tests/chat.test.mjs"
+]

agents/gander/work/queue-253/integration-378a/NOTES.md

@@ -0,0 +1,12 @@
+# Row253 integration onto 378a76b85
+
+Authority: sage-2348. New branch gander/row253-378a; gander/row253 remains at 9e916c454. Rebased range c3d88840c..9e916c454 onto 378a76b85; rebase tip before these records is 2f466464cccfe7b4f2522936a7f8409b74af7b5c.
+
+Two conflict resolutions, both documentation:
+
+1. First design commit, BUILD-LOG.md: kept every upstream appended line, then appended the row253 design phase. The integrated log has the complete 378a76b85 blob as its byte-identical prefix. Later row253 phase entries replayed normally. It remains outside the manifest and lands as a doc-only append after code.
+2. Runnable repair commit, DEFERRED.md: kept current upstream content and appended the row276 / #1781 F5 entry. That commit had incorporated upstream changes on the old branch; the rebase correctly omits changes already on the new base. The later N1/N2 entry replayed normally.
+
+No runtime or test conflict. All seven final manifest paths, including DEFERRED.md, are byte-identical to 9e916c454. Manifest digest remains 34d52cc500b2de855142daca4e293bbf05ff56d1c98bb94a061edabfc117e3e5. No entry changed. CANDIDATE-SHAS.json also remains valid.
+
+range-diff.json stores the exact command and stdout. patch-ids.json gives every paired commit. Six commits compare equal; design and runnable repair differ only through BUILD-LOG context and DEFERRED upstream incorporation described above. No test or syntax execution ran. No push helper ran during Darkwing's slot. Sage publishes both own branches in the next gap. The whole gate remains held for the manifest review and CLEAR on this integrated candidate.

agents/gander/work/queue-253/integration-378a/manifest-check.json

@@ -0,0 +1,47 @@
+{
+  "digest": "34d52cc500b2de855142daca4e293bbf05ff56d1c98bb94a061edabfc117e3e5",
+  "entries": [
+    {
+      "path": "docs/plans/DEFERRED.md",
+      "old_sha256": "3ea465cf7ed664ceb1ea4076b829f706f8480f80c4a8aaa6a7487e4eceaf318f",
+      "integrated_sha256": "3ea465cf7ed664ceb1ea4076b829f706f8480f80c4a8aaa6a7487e4eceaf318f",
+      "changed": false
+    },
+    {
+      "path": "packages/cli/tests/case-sudo-fixture.mjs",
+      "old_sha256": "b259b8c7926e49829c8a956674021cb0cc85ddd65aebdc786d05cc08d7790008",
+      "integrated_sha256": "b259b8c7926e49829c8a956674021cb0cc85ddd65aebdc786d05cc08d7790008",
+      "changed": false
+    },
+    {
+      "path": "packages/cli/tests/case1-accept.test.mjs",
+      "old_sha256": "6cfd2963303315aa6911c4d4f6d75d3ab87d9fcba8e128b056216e7f85fd8901",
+      "integrated_sha256": "6cfd2963303315aa6911c4d4f6d75d3ab87d9fcba8e128b056216e7f85fd8901",
+      "changed": false
+    },
+    {
+      "path": "packages/cli/tests/case2-unit.test.mjs",
+      "old_sha256": "1e0696eb196e83a0766b433ef71f27df0a3f8fcb6399787ab8c1c0f05c54dc44",
+      "integrated_sha256": "1e0696eb196e83a0766b433ef71f27df0a3f8fcb6399787ab8c1c0f05c54dc44",
+      "changed": false
+    },
+    {
+      "path": "packages/webui/README.md",
+      "old_sha256": "2eeb1f79324f64463a9b3427e67492d672b8d1c14db6c0349c7de17d89e52fc9",
+      "integrated_sha256": "2eeb1f79324f64463a9b3427e67492d672b8d1c14db6c0349c7de17d89e52fc9",
+      "changed": false
+    },
+    {
+      "path": "scripts/case1-accept.sh",
+      "old_sha256": "c02bef6b3495e5a4548d7b4e89675ed52be26a0c9ccce4d9d5cfc5fe2ce437bd",
+      "integrated_sha256": "c02bef6b3495e5a4548d7b4e89675ed52be26a0c9ccce4d9d5cfc5fe2ce437bd",
+      "changed": false
+    },
+    {
+      "path": "scripts/case2-unit.sh",
+      "old_sha256": "d7670bdb049ae41ba3774fc83de633636859b6723be858cfb31ea106b0e8812b",
+      "integrated_sha256": "d7670bdb049ae41ba3774fc83de633636859b6723be858cfb31ea106b0e8812b",
+      "changed": false
+    }
+  ]
+}

agents/gander/work/queue-253/integration-378a/patch-ids.json

@@ -0,0 +1,66 @@
+[
+  {
+    "old": "d8d7c34a7d10dffe93f3b931b8f4e3e1c4b6d983",
+    "new": "971681f29a347a3771802b19d1b9a65c88943a79",
+    "subject": "gander: design tester socket migration for host scripts",
+    "old_patch_id": "ee1088a4ca06de60f5a844d17d680bf33a37cd6c",
+    "new_patch_id": "47bdc56d349c8fcce2e5f56f3f5ce4ce7b1d6f14",
+    "equal": false
+  },
+  {
+    "old": "8a8df41715c016ea5aaf6de7307771ee2dde98f6",
+    "new": "43f17b9afe60bfe256e924b1317332d6068a8b4f",
+    "subject": "test: prepare row253 socket fixtures and fix gate collisions",
+    "old_patch_id": "d597cc7402b568d845a87c1f142bde74ce6ae9da",
+    "new_patch_id": "d597cc7402b568d845a87c1f142bde74ce6ae9da",
+    "equal": true
+  },
+  {
+    "old": "968db0bcdf96301f896873a81fa43e13d82f4a64",
+    "new": "f9b9112b970b634ee7c990447ded04dfe622d8cc",
+    "subject": "docs: propose row253 C4 session supervisor and draft hop fake",
+    "old_patch_id": "899327761a9bde7e7b4fefd790c1a523488e8029",
+    "new_patch_id": "899327761a9bde7e7b4fefd790c1a523488e8029",
+    "equal": true
+  },
+  {
+    "old": "144a7bf7c7947627b0fd5ed966b8f1a2e5431088",
+    "new": "70e6bb16159dd28391dbbfe0b4808f0c3dde5225",
+    "subject": "docs(row253): freeze C4 repair for static review",
+    "old_patch_id": "38dcf7f0ec2a39bad2696d971a684a729b154747",
+    "new_patch_id": "38dcf7f0ec2a39bad2696d971a684a729b154747",
+    "equal": true
+  },
+  {
+    "old": "b64aa316ab4fa911a4b4422dfdf39ad75ec96620",
+    "new": "bef1bd886b6e90f2a404825cce728e3901328ba3",
+    "subject": "docs(row253): store repair patch without context whitespace",
+    "old_patch_id": "1cf1916dab2a8552fadd07ce81246fce5f105b3d",
+    "new_patch_id": "1cf1916dab2a8552fadd07ce81246fce5f105b3d",
+    "equal": true
+  },
+  {
+    "old": "aa81ca390b059e36112093758484a564ce197505",
+    "new": "ecb15d1debdad4fbd2e9bdfedb639143467709c6",
+    "subject": "fix(row253): supervise socket queries across sudo sessions",
+    "old_patch_id": "24f6b70a08e4534381b7b4a0d59c6bf0699a3b80",
+    "new_patch_id": "d104bd53960b75c1e9d9402ec2ea193a55bf8164",
+    "equal": false
+  },
+  {
+    "old": "761893dac7133671b34aada788cfab91de111e5b",
+    "new": "39b98a26e9ac00edf3b8d77690cf06bc689a6272",
+    "subject": "fix(row253): bound cleanup retries after initial inventory",
+    "old_patch_id": "aee9e5492bf07ee71687fd899c4e632bb36bc1e3",
+    "new_patch_id": "aee9e5492bf07ee71687fd899c4e632bb36bc1e3",
+    "equal": true
+  },
+  {
+    "old": "9e916c4543912d2215d81a0a51b7f4751d36ce6d",
+    "new": "2f466464cccfe7b4f2522936a7f8409b74af7b5c",
+    "subject": "docs(row253): record static approval and pre-confirmation residual",
+    "old_patch_id": "d2aecebf222474b0e06c5109b5f22caf768176ce",
+    "new_patch_id": "d2aecebf222474b0e06c5109b5f22caf768176ce",
+    "equal": true
+  }
+]

agents/gander/work/queue-253/integration-385a/NOTES.md

@@ -0,0 +1,29 @@
+# Row253 re-integration onto 385a7194c
+
+Authority: sage-2659. Branch gander/row253-385a preserves all previous seat branches. Source tip before this packet: 141b79c293d78e78b9ce05bcf0fcaa18ba4d6963. Ten commits replayed from 0fa7bf421..8de88458d onto 385a7194c.
+
+The first design commit conflicted only on BUILD-LOG.md. Kept all upstream bytes and appended the row253 phase; later appends replayed. BUILD-LOG and DEFERRED keep 385a7194c as exact byte prefixes. BUILD-LOG stays outside the manifest and lands by append after code. README merged automatically; its four row253 replacement pairs are exactly the same as before. The row278 thread-claims documentation stays present. No runtime/test conflict or repair.
+
+range-diff.txt identifies two context-only changes (commits1 and6), both BUILD-LOG context. All other pairs equal. patch-ids.json records all ten old/new pairs. The full patch-ids for commits1 and6 change because their BUILD-LOG context changed. Excluding BUILD-LOG, all ten patch-ids match. No runtime/test change.
+
+The new seven-path manifest digest is 72a70e99ba0416ceb1f63ed737132ebbeb212332d1441c362b3dfa6c8b00209c. Only DEFERRED and README differ from8de88458d. The two host scripts, two test files and shared sudo fixture are byte-identical to Duckworth's approved candidate. manifest-drift.diff is the required 0fa7bf421..385a7194c diff restricted to the seven landing paths; upstream changed only DEFERRED(+79) and README(+9). drift.json lists every upstream changed path separately.
+
+## Test reads and pins, source-only inspection
+
+The focused case1/case2 tests read the host scripts and temporary fixture files. case2 also reads case2-precheck.sh and the two service templates; those three assets did not change in 0fa7bf421..385a7194c. Both tests write their own config.mjs and webui cli.mjs stand-ins into scratch copies. They do not import the real Console cli/serve/public modules, and row278's real Console changes require no focused fixture change.
+
+The earlier dependency claim is widened here: both tests import cli/tests/helpers.mjs, which imports Store/Broker. Store reads schema.sql and the migration chain and checks schema bytes at module load, even when a particular test only calls tmp(). Store, broker, schema.sql and 3j-3k.sql changed upstream. drift.json lists the conservative literal-import closure and its nine moved modules (including business access/credentials/role/vocabulary and library mapping). The closure includes generated-source literals and is not an execution trace. case2-precheck.sh also dynamically imports the actual cli config and business index; business imports changed and the whole focused file must cover them. cli config itself did not change.
+
+case2 imports seat/src/sandbox.mjs, as Duckworth0116 N9 identified. It did not change since0fa7, and its sandbox test still may skip on sandboxProblem(). Report that exact skip in the gate; do not assume zero. The actual sandbox binder reads the repository file inventory, so changed dependencies are covered by the whole-file run if available. No host experiment was run here.
+
+Whole CLI covers changed format/grants/instances/lifecycle/tester/stack-release tests and real cli modules. Whole WebUI covers row278 and its existing shell fixture repair on this base. stack-release.test.mjs T46 at916 reads actual schema.sql and classifies every table; Store's schema hash and migrations are another live consumer. Whole-shell calls can load queue/business/bus consumers too. No row253 test has a literal 3k/3l version pin to update by assumption. The relevant whole-CLI schema fixture strings in stack-release-fixture.mjs model old target copies intentionally; they are not pins on the current bus schema. No assertion is changed to anticipate264a.
+
+264a's 3k-to-3l schema change has not landed on this base. Before CLEAR, compare its store/schema/migration and any test or asset it moves, and integrate on a new branch if Sage names a new base. A seven-manifest-path-only check is insufficient because the focused import closure reads schema at load time. No result carries from the historical row253 gates after the C4 product repair.
+
+## Gate preparation, no runs
+
+SHELL-LIMITS.json uses the same successful whole-file receipt set as row278, plus every row278 run3 whole-shell result from385a7194c. Each limit is ceil(3*longest)+120 seconds. Foundation's newer39.901s receipt replaces39.708726s; its limit remains240. Other maxima remain the row196 receipts. All ten scripts have receipts;900 is the no-record fallback only. Each current script hash is pinned. No scripts/test-*.sh changed.
+
+window.py now uses these whole-shell wrappers: timeout -k10 LIMIT bash scripts/test-X.sh, with the outer harness wait30s later. driver.py marks exits124/137 as timeout and never reports them as kills. These are harness-only changes; no product/test/fixture changed. No command was executed by either harness. All40 proposed string targets still occur exactly once, checked as bytes in uniqueness.json without running syntax or tests. Full C4 timing and kills remain unverified.
+
+The next action is Duckworth's integration read, followed by Sage's CLEAR after281 and264a. No Node, test, syntax command, browser, probe, queue write, helper push or live action ran during this re-integration. Publishing the new branch needs a gap because the repo helper runs Node.

agents/gander/work/queue-253/integration-385a/drift.json

@@ -0,0 +1,385 @@
+{
+  "old_base": "0fa7bf421",
+  "old_tip": "8de88458d",
+  "new_base": "385a7194c",
+  "rebased_tip": "141b79c293d78e78b9ce05bcf0fcaa18ba4d6963",
+  "manifest_digest": "72a70e99ba0416ceb1f63ed737132ebbeb212332d1441c362b3dfa6c8b00209c",
+  "manifest_paths_changed_upstream": [
+    "docs/plans/DEFERRED.md",
+    "packages/webui/README.md"
+  ],
+  "candidate_blobs_changed": [
+    {
+      "path": "docs/plans/DEFERRED.md",
+      "before": "3ea465cf7ed664ceb1ea4076b829f706f8480f80c4a8aaa6a7487e4eceaf318f",
+      "after": "8a050b494f6678030aabb7a7c92116c58ad6306ab0a27f31b368cff53c9b5d7c"
+    },
+    {
+      "path": "packages/webui/README.md",
+      "before": "9de6c8356e1f1e0ecb8d0be8ec523cb817b04bb633f0cd8aed7db32565ffd009",
+      "after": "ce9054060867120798c6b26737ac7d910d8cfbc7aa4ad614f4295619c7605e46"
+    }
+  ],
+  "unchanged_runnable_manifest_paths": [
+    "packages/cli/tests/case-sudo-fixture.mjs",
+    "packages/cli/tests/case1-accept.test.mjs",
+    "packages/cli/tests/case2-unit.test.mjs",
+    "scripts/case1-accept.sh",
+    "scripts/case2-unit.sh"
+  ],
+  "literal_import_walk": [
+    "packages/bus/src/broker.mjs",
+    "packages/bus/src/landing.mjs",
+    "packages/bus/src/store.mjs",
+    "packages/business/src/access.mjs",
+    "packages/business/src/business.mjs",
+    "packages/business/src/credentials.mjs",
+    "packages/business/src/errors.mjs",
+    "packages/business/src/index.mjs",
+    "packages/business/src/launch.mjs",
+    "packages/business/src/project.mjs",
+    "packages/business/src/resolve.mjs",
+    "packages/business/src/role.mjs",
+    "packages/business/src/util.mjs",
+    "packages/business/src/vars.mjs",
+    "packages/business/src/vocabulary.mjs",
+    "packages/business/tests/helpers.mjs",
+    "packages/cli/src/errors.mjs",
+    "packages/cli/src/transport.mjs",
+    "packages/cli/tests/case-sudo-fixture.mjs",
+    "packages/cli/tests/case1-accept.test.mjs",
+    "packages/cli/tests/case2-unit.test.mjs",
+    "packages/cli/tests/helpers.mjs",
+    "packages/harness/tests/helpers.mjs",
+    "packages/library/src/mapping.mjs",
+    "packages/library/src/problems.mjs",
+    "packages/plugins/src/kinds.mjs",
+    "packages/plugins/src/loader.mjs",
+    "packages/plugins/tests/helpers.mjs",
+    "packages/processing-control/src/state.mjs",
+    "packages/seat/src/sandbox.mjs",
+    "packages/tasks/src/requirements.mjs"
+  ],
+  "import_edges": [
+    {
+      "source": "packages/cli/tests/case2-unit.test.mjs",
+      "target": "packages/business/tests/helpers.mjs"
+    },
+    {
+      "source": "packages/cli/tests/case2-unit.test.mjs",
+      "target": "packages/seat/src/sandbox.mjs"
+    },
+    {
+      "source": "packages/cli/tests/case2-unit.test.mjs",
+      "target": "packages/cli/tests/helpers.mjs"
+    },
+    {
+      "source": "packages/cli/tests/case2-unit.test.mjs",
+      "target": "packages/cli/tests/case-sudo-fixture.mjs"
+    },
+    {
+      "source": "packages/cli/tests/helpers.mjs",
+      "target": "packages/bus/src/broker.mjs"
+    },
+    {
+      "source": "packages/cli/tests/helpers.mjs",
+      "target": "packages/bus/src/store.mjs"
+    },
+    {
+      "source": "packages/cli/tests/helpers.mjs",
+      "target": "packages/business/tests/helpers.mjs"
+    },
+    {
+      "source": "packages/cli/tests/helpers.mjs",
+      "target": "packages/harness/tests/helpers.mjs"
+    },
+    {
+      "source": "packages/cli/tests/helpers.mjs",
+      "target": "packages/plugins/tests/helpers.mjs"
+    },
+    {
+      "source": "packages/cli/tests/helpers.mjs",
+      "target": "packages/cli/src/transport.mjs"
+    },
+    {
+      "source": "packages/cli/src/transport.mjs",
+      "target": "packages/cli/src/errors.mjs"
+    },
+    {
+      "source": "packages/harness/tests/helpers.mjs",
+      "target": "packages/business/src/index.mjs"
+    },
+    {
+      "source": "packages/harness/tests/helpers.mjs",
+      "target": "packages/business/tests/helpers.mjs"
+    },
+    {
+      "source": "packages/harness/tests/helpers.mjs",
+      "target": "packages/plugins/src/loader.mjs"
+    },
+    {
+      "source": "packages/harness/tests/helpers.mjs",
+      "target": "packages/business/tests/helpers.mjs"
+    },
+    {
+      "source": "packages/harness/tests/helpers.mjs",
+      "target": "packages/business/tests/helpers.mjs"
+    },
+    {
+      "source": "packages/plugins/src/loader.mjs",
+      "target": "packages/plugins/src/kinds.mjs"
+    },
+    {
+      "source": "packages/business/src/index.mjs",
+      "target": "packages/business/src/errors.mjs"
+    },
+    {
+      "source": "packages/business/src/index.mjs",
+      "target": "packages/business/src/vocabulary.mjs"
+    },
+    {
+      "source": "packages/business/src/index.mjs",
+      "target": "packages/business/src/role.mjs"
+    },
+    {
+      "source": "packages/business/src/index.mjs",
+      "target": "packages/business/src/vars.mjs"
+    },
+    {
+      "source": "packages/business/src/index.mjs",
+      "target": "packages/business/src/credentials.mjs"
+    },
+    {
+      "source": "packages/business/src/index.mjs",
+      "target": "packages/business/src/business.mjs"
+    },
+    {
+      "source": "packages/business/src/index.mjs",
+      "target": "packages/business/src/access.mjs"
+    },
+    {
+      "source": "packages/business/src/index.mjs",
+      "target": "packages/business/src/project.mjs"
+    },
+    {
+      "source": "packages/business/src/index.mjs",
+      "target": "packages/business/src/resolve.mjs"
+    },
+    {
+      "source": "packages/business/src/resolve.mjs",
+      "target": "packages/business/src/errors.mjs"
+    },
+    {
+      "source": "packages/business/src/resolve.mjs",
+      "target": "packages/business/src/vocabulary.mjs"
+    },
+    {
+      "source": "packages/business/src/resolve.mjs",
+      "target": "packages/business/src/vars.mjs"
+    },
+    {
+      "source": "packages/business/src/resolve.mjs",
+      "target": "packages/business/src/util.mjs"
+    },
+    {
+      "source": "packages/business/src/resolve.mjs",
+      "target": "packages/business/src/project.mjs"
+    },
+    {
+      "source": "packages/business/src/project.mjs",
+      "target": "packages/business/src/errors.mjs"
+    },
+    {
+      "source": "packages/business/src/project.mjs",
+      "target": "packages/business/src/vars.mjs"
+    },
+    {
+      "source": "packages/business/src/project.mjs",
+      "target": "packages/business/src/util.mjs"
+    },
+    {
+      "source": "packages/business/src/util.mjs",
+      "target": "packages/business/src/errors.mjs"
+    },
+    {
+      "source": "packages/business/src/util.mjs",
+      "target": "packages/business/src/vocabulary.mjs"
+    },
+    {
+      "source": "packages/business/src/vars.mjs",
+      "target": "packages/business/src/errors.mjs"
+    },
+    {
+      "source": "packages/business/src/vars.mjs",
+      "target": "packages/business/src/vocabulary.mjs"
+    },
+    {
+      "source": "packages/business/src/vars.mjs",
+      "target": "packages/business/src/util.mjs"
+    },
+    {
+      "source": "packages/business/src/vars.mjs",
+      "target": "packages/plugins/src/kinds.mjs"
+    },
+    {
+      "source": "packages/business/src/access.mjs",
+      "target": "packages/business/src/errors.mjs"
+    },
+    {
+      "source": "packages/business/src/access.mjs",
+      "target": "packages/business/src/business.mjs"
+    },
+    {
+      "source": "packages/business/src/access.mjs",
+      "target": "packages/business/src/util.mjs"
+    },
+    {
+      "source": "packages/business/src/access.mjs",
+      "target": "packages/business/src/vocabulary.mjs"
+    },
+    {
+      "source": "packages/business/src/business.mjs",
+      "target": "packages/business/src/errors.mjs"
+    },
+    {
+      "source": "packages/business/src/business.mjs",
+      "target": "packages/business/src/launch.mjs"
+    },
+    {
+      "source": "packages/business/src/business.mjs",
+      "target": "packages/business/src/vars.mjs"
+    },
+    {
+      "source": "packages/business/src/business.mjs",
+      "target": "packages/business/src/credentials.mjs"
+    },
+    {
+      "source": "packages/business/src/business.mjs",
+      "target": "packages/business/src/role.mjs"
+    },
+    {
+      "source": "packages/business/src/business.mjs",
+      "target": "packages/business/src/vocabulary.mjs"
+    },
+    {
+      "source": "packages/business/src/business.mjs",
+      "target": "packages/plugins/src/kinds.mjs"
+    },
+    {
+      "source": "packages/business/src/business.mjs",
+      "target": "packages/library/src/mapping.mjs"
+    },
+    {
+      "source": "packages/business/src/business.mjs",
+      "target": "packages/business/src/vocabulary.mjs"
+    },
+    {
+      "source": "packages/business/src/business.mjs",
+      "target": "packages/business/src/util.mjs"
+    },
+    {
+      "source": "packages/library/src/mapping.mjs",
+      "target": "packages/library/src/problems.mjs"
+    },
+    {
+      "source": "packages/business/src/role.mjs",
+      "target": "packages/business/src/errors.mjs"
+    },
+    {
+      "source": "packages/business/src/role.mjs",
+      "target": "packages/business/src/vocabulary.mjs"
+    },
+    {
+      "source": "packages/business/src/role.mjs",
+      "target": "packages/business/src/util.mjs"
+    },
+    {
+      "source": "packages/business/src/credentials.mjs",
+      "target": "packages/business/src/errors.mjs"
+    },
+    {
+      "source": "packages/business/src/credentials.mjs",
+      "target": "packages/business/src/vocabulary.mjs"
+    },
+    {
+      "source": "packages/business/src/credentials.mjs",
+      "target": "packages/business/src/util.mjs"
+    },
+    {
+      "source": "packages/business/src/launch.mjs",
+      "target": "packages/business/src/util.mjs"
+    },
+    {
+      "source": "packages/business/src/launch.mjs",
+      "target": "packages/business/src/errors.mjs"
+    },
+    {
+      "source": "packages/bus/src/broker.mjs",
+      "target": "packages/processing-control/src/state.mjs"
+    },
+    {
+      "source": "packages/bus/src/broker.mjs",
+      "target": "packages/plugins/src/kinds.mjs"
+    },
+    {
+      "source": "packages/bus/src/broker.mjs",
+      "target": "packages/tasks/src/requirements.mjs"
+    },
+    {
+      "source": "packages/bus/src/broker.mjs",
+      "target": "packages/bus/src/landing.mjs"
+    },
+    {
+      "source": "packages/bus/src/broker.mjs",
+      "target": "packages/business/src/vocabulary.mjs"
+    },
+    {
+      "source": "packages/seat/src/sandbox.mjs",
+      "target": "packages/business/src/vocabulary.mjs"
+    },
+    {
+      "source": "packages/cli/tests/case1-accept.test.mjs",
+      "target": "packages/cli/tests/helpers.mjs"
+    },
+    {
+      "source": "packages/cli/tests/case1-accept.test.mjs",
+      "target": "packages/cli/tests/case-sudo-fixture.mjs"
+    }
+  ],
+  "changed_import_dependencies": [
+    "packages/bus/src/broker.mjs",
+    "packages/bus/src/store.mjs",
+    "packages/business/src/access.mjs",
+    "packages/business/src/business.mjs",
+    "packages/business/src/credentials.mjs",
+    "packages/business/src/index.mjs",
+    "packages/business/src/role.mjs",
+    "packages/business/src/vocabulary.mjs",
+    "packages/library/src/mapping.mjs"
+  ],
+  "read_assets": [
+    "scripts/case1-accept.sh",
+    "scripts/case2-unit.sh",
+    "scripts/case2-precheck.sh",
+    "packages/cli/systemd/mosaic-bus.service.in",
+    "packages/webui/systemd/mosaic-webui.service.in",
+    "packages/bus/schema.sql",
+    "packages/bus/src/migrations/3b-3c.sql",
+    "packages/bus/src/migrations/3b.sql",
+    "packages/bus/src/migrations/3c-3d.sql",
+    "packages/bus/src/migrations/3d-3e.sql",
+    "packages/bus/src/migrations/3e-3f.sql",
+    "packages/bus/src/migrations/3f-3g.sql",
+    "packages/bus/src/migrations/3g-3h.sql",
+    "packages/bus/src/migrations/3h-3i.sql",
+    "packages/bus/src/migrations/3i-3j.sql",
+    "packages/bus/src/migrations/3j-3k.sql"
+  ],
+  "changed_read_assets": [
+    "packages/bus/schema.sql",
+    "packages/bus/src/migrations/3j-3k.sql"
+  ],
+  "readme_change_lines_equal": true,
+  "upstream_log_and_deferred_exact_prefix": true,
+  "dependency_limit": "Conservative static literal-import walk, including generated source strings; not runtime trace. Runtime file reads and stand-ins assessed in NOTES.md. Schema3l from264a not yet on base and must be checked before CLEAR."
+}

agents/gander/work/queue-253/integration-385a/manifest-drift.diff

@@ -0,0 +1,117 @@
+diff --git a/docs/plans/DEFERRED.md b/docs/plans/DEFERRED.md
+index 197a29ecb..4c0c736f1 100644
+--- a/docs/plans/DEFERRED.md
++++ b/docs/plans/DEFERRED.md
+@@ -319,6 +319,10 @@ at every gate. Started 2026-09-12 during the control board MVP.
+   waits 30 s before it calls a lone `sleep 30` a leak. The row 197
+   lanes scan only at lane end, about 15 minutes after pkg-bus, so they
+   can't see it (mos-1169). (2026-10-21)
++  Closing note, row 280 (2026-10-22): both scratch sshd fixtures install a
++  bounded 30/60-second sleep stub that exits when its test directory is gone;
++  other sleep arguments exec /usr/bin/sleep unchanged. Evidence is recorded
++  in agents/rocko/work/queue-280/BUILD.md.
+ 
+ - **Row 66 live checks: the unslop notice on a live managed session, both harnesses.**
+   (mos-1186, Vikunja #454.) Row 66's gate asked for one landing session per
+@@ -380,6 +384,81 @@ at every gate. Started 2026-09-12 during the control board MVP.
+   credential and a real `release.sh activate`, and records both results on
+   the re-pin row. Morgana's wording (row 244 BUILD.md), Webby N2 on row 244
+   r1 (#1757). (2026-10-21)
++- **Creative instances: the human can't delete one.** (Sage's ruling
++  sage-2164 on the row 194 b4 rebase, #1692.) Row 213 put the creative
++  definitions in END_PROTECTED, and row 194's `deleteRefusal`
++  (`instance-settings.mjs`) refuses END_PROTECTED for every actor, so
++  the human can't delete a companion instance and fire refuses one too.
++  The Agents page hides Delete on the listing's `endProtected`. The fix
++  threads the actor through `deleteRefusal` and the launcher's delete
++  pass, so the human may delete one and the tester may not
++  (`creativeHumanOnly`). Until then, the human can delist
++  (instances.set launch: false) but neither fire nor delete removes a
++  creative entry (sage-2166). The row covers fire and delete together;
++  Sage files it. (2026-10-21)
++  Closed for delete by row 256 (#1761, REQ-COS-3): `deleteRefusal` takes
++  the actor, so the human deletes a creative instance and any other actor
++  is refused `organization-creative-human-only`, and the listing's
++  endProtected is the same check for its reader. Fire still refuses every
++  END_PROTECTED instance, by the row 256 brief's ruling, not by a code
++  change. (2026-10-22)
++- **A fire stuck between step A and step B has no human escape.** (Webby
++  N4 on row 194 b5, webby-0094; Sage's ruling sage-2241, #1692.) The
++  broker's chief fire records `fire.stopped` at step A, and `#firing`
++  refuses every launch and take of the instance until a `fire.done`. The
++  events are in the store, so a bus restart doesn't clear them. Row 194
++  b6 runs the writer's checks against the file before step A
++  (`instance.fireCheck`), so a keep the bus hasn't loaded no longer
++  strands an instance. A step B that keeps refusing still does: a
++  credential revoke that fails every time, or a file a human changed
++  between the check and the write. Each repeat fire runs step A again
++  and refuses at B. The fix is a human verb, never an agent one, that
++  records the end of the firing (a `fire.done`, or a new
++  `fire.abandoned` that `#firing` also counts) with a reason. Its test:
++  a fire whose step B refuses leaves the instance `instance-firing`, the
++  verb as the chief or the tester refuses, and the verb as the human
++  clears it so the instance launches again. (2026-10-21)
++- **A fire's done with more than 64 stops refuses, and nothing flags a
++  run left alive.** (Webby N2 on row 194 b8 r2, webby-0100; Sage's ruling
++  sage-2290, #1692.) `lifecycleDone` caps `stops` at 64 and refuses
++  `invalid-request` above it (`broker.mjs`). The launcher's fireStop has
++  already signalled every run through stopRun by then, so the killed runs
++  are dead. But the refused done writes no lifecycle.end.killed or
++  lifecycle.end.alive event and no lifecycle.done, and the end request
++  stays taken. A run the stop left alive, or couldn't confirm (unknown),
++  gets no Console flag. The fire itself is unaffected, because
++  `fire.stopped` and `fire.done` are written at the verb. No MVP instance
++  comes near 64 runs. The follow-up row either raises the cap or splits
++  the done. Its test: a fire's done over the cap refuses, and the runs it
++  left alive still get the alive flag. (2026-10-22)
++- **A fired or deleted instance keeps its grants.** (Dewey on the row 236
++  rebase look, dewey-0815; Mos mos-1271; Sage sage-2558.) Row 194's
++  `instance.fire` and row 256's delete revoke only the roles entry's
++  credential services through `revoke()` in `runtime.mjs`. The agent's
++  host grants (row 235) and its Gitea user and token (row 236) stay live
++  until a human runs `mosaic hosts revoke` or `mosaic grants revoke`. The
++  Console has no revoke route and doesn't say a grant is left. Row 281
++  (#1786) closes it: a fire or a delete revokes every host and Gitea grant
++  the instance holds, fail closed, with a test for each kind. It lands
++  before the .53 Case 1 install hires an instance with a grant.
++  (2026-10-22)
++
++- **The runs suite doesn't gate a change to `scripts/mosaic-task.mjs`.**
++  (Dewey N7 on row 191, repeated on the Vikunja 502 review.)
++  `packages/runs/tests/task-cli.test.mjs` spawns `scripts/mosaic-task.mjs`,
++  but row 191's gate didn't run the runs suite. test-task.sh covers the same
++  list and show paths, so nothing is known broken. Binds the next row that
++  changes `scripts/mosaic-task.mjs`: its gate runs the runs suite whole.
++  (2026-10-22)
++
++- **Row 277's M8 is killed by a rethrown error, not an assertion.**
++  (Duckworth N1 on the row 277 manifest round, duckworth-0127.) M8 makes
++  the thread.claims catch in `packages/cli/src/cli.mjs` rethrow. The stubbed
++  `processing-halted` error then escapes `main` and fails
++  `packages/cli/tests/tester.test.mjs:149`. That counts as a kill, but no
++  test pins that `main` resolves on that path. Binds the next row that
++  changes `packages/cli/tests/tester.test.mjs`: add the resolve pin so M8
++  dies on an assertion. (2026-10-22)
+ 
+ ## Queue
+ 
+diff --git a/packages/webui/README.md b/packages/webui/README.md
+index 74d438c71..59cb4ee3a 100644
+--- a/packages/webui/README.md
++++ b/packages/webui/README.md
+@@ -382,6 +382,15 @@ there are others. The page says what each state means. It writes nothing;
+ the server passes the rows through unchanged. How the bus derives the state
+ and its limits: `packages/bus/README.md`, "Agent state".
+ 
++The same view has a separate **Thread claims** section (row 278, #1783).
++It reads `thread.claims` and shows thread id, holder run, harness and claim time,
++in the bus's order. Thread names, messages, instance and address are not shown.
++An empty read has an empty-state line. A refused or failed read clears only
++this section's kept claims and shows its reason; the held roles and their
++count stay intact. Sign-out clears the claims with the other bus reads.
++The read needs no `--send`. The bus permits human and reader sessions;
++the tester listener refuses it with HTTP 403 `tester-refused` before any bus call.
++
+ ## Board: held roles and signing out (row 95, #1589)
+ 
+ The Board (`#/`) opens with **Held roles**: each role a run holds on the

agents/gander/work/queue-253/integration-385a/patch-ids.json

@@ -0,0 +1,82 @@
+[
+  {
+    "old": "39c30f1c200a1f5f27767dae4b730cade7703777",
+    "new": "a9c094d0657a52c22ba51b35e690868358cf2bd0",
+    "old_patch_id": "895656745186c2dc4cb1ee1261c323af90bf9fb9",
+    "new_patch_id": "2b17f1d6773aa17909fc959081eec3f3821c3dee",
+    "old_without_build_log": "86a00d372cedf03f5a8c573f48065de11bbbff29",
+    "new_without_build_log": "86a00d372cedf03f5a8c573f48065de11bbbff29"
+  },
+  {
+    "old": "d004b44982db5196777710e20163f877b07bf54d",
+    "new": "2e81f78722ccd43d7524bb6a7d27d7ac26d0cea8",
+    "old_patch_id": "d597cc7402b568d845a87c1f142bde74ce6ae9da",
+    "new_patch_id": "d597cc7402b568d845a87c1f142bde74ce6ae9da",
+    "old_without_build_log": "d597cc7402b568d845a87c1f142bde74ce6ae9da",
+    "new_without_build_log": "d597cc7402b568d845a87c1f142bde74ce6ae9da"
+  },
+  {
+    "old": "9e4bbee25d3a97e9dfec743d92c20f50154222da",
+    "new": "3c8edc358c1f30ea7b5cc9a79d30282e59092715",
+    "old_patch_id": "899327761a9bde7e7b4fefd790c1a523488e8029",
+    "new_patch_id": "899327761a9bde7e7b4fefd790c1a523488e8029",
+    "old_without_build_log": "899327761a9bde7e7b4fefd790c1a523488e8029",
+    "new_without_build_log": "899327761a9bde7e7b4fefd790c1a523488e8029"
+  },
+  {
+    "old": "69474277277fe87e7c398c508f6450aa0d691de7",
+    "new": "3114087efe655f1d38c5e30f8327f65980854043",
+    "old_patch_id": "38dcf7f0ec2a39bad2696d971a684a729b154747",
+    "new_patch_id": "38dcf7f0ec2a39bad2696d971a684a729b154747",
+    "old_without_build_log": "38dcf7f0ec2a39bad2696d971a684a729b154747",
+    "new_without_build_log": "38dcf7f0ec2a39bad2696d971a684a729b154747"
+  },
+  {
+    "old": "d85cf93d64a4ebf37865cbb74719d842105a1864",
+    "new": "911e470b76d78e6a1ddd73c8e3e88a3ce821e43c",
+    "old_patch_id": "1cf1916dab2a8552fadd07ce81246fce5f105b3d",
+    "new_patch_id": "1cf1916dab2a8552fadd07ce81246fce5f105b3d",
+    "old_without_build_log": "1cf1916dab2a8552fadd07ce81246fce5f105b3d",
+    "new_without_build_log": "1cf1916dab2a8552fadd07ce81246fce5f105b3d"
+  },
+  {
+    "old": "463a97f49f6bcaa65a10a54c2ad40e428e7fd135",
+    "new": "4a8b5c3ff98bfd9c31d6bfeb5356570df240e98c",
+    "old_patch_id": "08a16c862148ddae13044130cac740064d0e86fe",
+    "new_patch_id": "c93ea22b2651163be712ebb7ce96c8230ee41da8",
+    "old_without_build_log": "197948a3ddc789f46161ad573d52956990dbfcfb",
+    "new_without_build_log": "197948a3ddc789f46161ad573d52956990dbfcfb"
+  },
+  {
+    "old": "de93d8e038f591ea7be2f850c5fb0dea272c3d63",
+    "new": "e18b90e95dd928743c53d63449a82ffaffe360e8",
+    "old_patch_id": "aee9e5492bf07ee71687fd899c4e632bb36bc1e3",
+    "new_patch_id": "aee9e5492bf07ee71687fd899c4e632bb36bc1e3",
+    "old_without_build_log": "aee9e5492bf07ee71687fd899c4e632bb36bc1e3",
+    "new_without_build_log": "aee9e5492bf07ee71687fd899c4e632bb36bc1e3"
+  },
+  {
+    "old": "36bd3c3a8bda8c31da8219cc726ce005ec2dbd2b",
+    "new": "67776714515b562dd29a15d6a0a3bea9d642e6f2",
+    "old_patch_id": "d2aecebf222474b0e06c5109b5f22caf768176ce",
+    "new_patch_id": "d2aecebf222474b0e06c5109b5f22caf768176ce",
+    "old_without_build_log": "d2aecebf222474b0e06c5109b5f22caf768176ce",
+    "new_without_build_log": "d2aecebf222474b0e06c5109b5f22caf768176ce"
+  },
+  {
+    "old": "67224933425e9687bf366cd7ba7c31c1daa4e9f3",
+    "new": "c733371c5c297291b9d06c2dd2772e22670fe653",
+    "old_patch_id": "efb06f08af899d8f03390ab24ab65f6558cbae58",
+    "new_patch_id": "efb06f08af899d8f03390ab24ab65f6558cbae58",
+    "old_without_build_log": "efb06f08af899d8f03390ab24ab65f6558cbae58",
+    "new_without_build_log": "efb06f08af899d8f03390ab24ab65f6558cbae58"
+  },
+  {
+    "old": "8de88458d2c8bef57c8af51a1e4d459cf8feb8d9",
+    "new": "141b79c293d78e78b9ce05bcf0fcaa18ba4d6963",
+    "old_patch_id": "e29f40a61cc88532701f0b063154a0cbe8d7ba7b",
+    "new_patch_id": "e29f40a61cc88532701f0b063154a0cbe8d7ba7b",
+    "old_without_build_log": "e29f40a61cc88532701f0b063154a0cbe8d7ba7b",
+    "new_without_build_log": "e29f40a61cc88532701f0b063154a0cbe8d7ba7b"
+  }
+]

agents/gander/work/queue-253/integration-385a/range-diff.txt

@@ -0,0 +1,31 @@
+ 1:  39c30f1c2 !  1:  a9c094d06 gander: design tester socket migration for host scripts
+    @@ Commit message
+     
+      ## BUILD-LOG.md ##
+     @@ BUILD-LOG.md: Before: managed project/thread verbs had no Console conversation area. After: fi
+    - 2026-10-22 02:01:30 UTC | Sage (Claude Opus 5.5, 1ef1e4f8) | row 202 #1700 FED R5 landing | ddfb29af7 on 9c9732983: 6 manifest paths from a74cd9f87 (digests match CANDIDATE.sha256, patch-id 9d89077b equal); Duckworth APPROVE r5 rev 3026; C1 gate by Quackerjack on merge 3b86180b9: cli 771/771 skip 0 (run 2, run 1 red on gate TMPDIR length), 10 test-*.sh rc 0, M1-M13 killed; done rev 3108; landing note refused for length before the done move, so the record is the commit body and #1700 c30265; 191 and 194 rebased onto it (one scripts/mosaic case line)
+    + ### 2026-10-22 | Gander | row278 gate run3
+      
+    - 2026-10-22 03:35:55 UTC | Sage (Claude Opus 5.5, 1ef1e4f8) | row 273 #1778 activate --send/--no-sso landing | 0bbf0f6d1 landed on 378a76b85, a rebase of cac7d0f67 (0042f713d) with all 6 range-diff pairs = and equal patch-ids; 4-path manifest e1031023 unchanged; Filbert APPROVE rev 3111 (c30308) carried merge-scoped under mos-1160, carry comment c30319 names 0bbf0f6d1. Gate on 0bbf0f6d1 by Darkwing: stack-release.test.mjs 218/218 skip 0, stack-release-external.test.mjs 25/25 skip 0, test-release.sh rc 0 (selftest 14/0, no skips), T58 controls c0 11/11 pass and c1 11/11 fail, M1-M7 killed. Rerun because row 202 changed scripts/mosaic, which stack-release.test.mjs copies. Red 1 was 978143bf4 (T53 test 6 usage pin). This doc commit adds the TOOLS.md usage line and F39 rules (Filbert N1).
+    + Fresh gate on3e4c77ac6 under sage-2648: bus793/0, WebUI345/0/1 (esbuild version skip), all ten shell files425/0, touched files15/0, M1-M6 killed6/6. No timeout; sweep0 run-created leftovers. Runs1/2 void. Seven-path manifest8fa859a0 goes to Webby for final review. No landing or live change.
+     +2026-10-21 21:24:47 UTC | Gander row253 #1758 design r1 | Investigation began21:12Z under sage-2162; recorded now. Before: case2 installer still renders tester TCP and case1 acceptance requires it. After: proposed design covers socket marker migration, actual configured dataRoot within unchanged hardening, target-uid metadata queries, kernel-peer acceptance observation and explicit same-uid residual. Initial inventory saved; no passing final static-check claim, product edit, test, host or live action. Duckworth design review precedes code.
+     
+      ## agents/gander/work/queue-253/BASE-PORT-INVENTORY.json (new) ##
+ 2:  d004b4498 =  2:  2e81f7872 test: prepare row253 socket fixtures and fix gate collisions
+ 3:  9e4bbee25 =  3:  3c8edc358 docs: propose row253 C4 session supervisor and draft hop fake
+ 4:  694742772 =  4:  3114087ef docs(row253): freeze C4 repair for static review
+ 5:  d85cf93d6 =  5:  911e470b7 docs(row253): store repair patch without context whitespace
+ 6:  463a97f49 !  6:  4a8b5c3ff fix(row253): supervise socket queries across sudo sessions
+    @@ Commit message
+      ## BUILD-LOG.md ##
+     @@ BUILD-LOG.md: Before: managed project/thread verbs had no Console conversation area. After: fi
+      
+    - 2026-10-22 03:35:55 UTC | Sage (Claude Opus 5.5, 1ef1e4f8) | row 273 #1778 activate --send/--no-sso landing | 0bbf0f6d1 landed on 378a76b85, a rebase of cac7d0f67 (0042f713d) with all 6 range-diff pairs = and equal patch-ids; 4-path manifest e1031023 unchanged; Filbert APPROVE rev 3111 (c30308) carried merge-scoped under mos-1160, carry comment c30319 names 0bbf0f6d1. Gate on 0bbf0f6d1 by Darkwing: stack-release.test.mjs 218/218 skip 0, stack-release-external.test.mjs 25/25 skip 0, test-release.sh rc 0 (selftest 14/0, no skips), T58 controls c0 11/11 pass and c1 11/11 fail, M1-M7 killed. Rerun because row 202 changed scripts/mosaic, which stack-release.test.mjs copies. Red 1 was 978143bf4 (T53 test 6 usage pin). This doc commit adds the TOOLS.md usage line and F39 rules (Filbert N1).
+    + Fresh gate on3e4c77ac6 under sage-2648: bus793/0, WebUI345/0/1 (esbuild version skip), all ten shell files425/0, touched files15/0, M1-M6 killed6/6. No timeout; sweep0 run-created leftovers. Runs1/2 void. Seven-path manifest8fa859a0 goes to Webby for final review. No landing or live change.
+      2026-10-21 21:24:47 UTC | Gander row253 #1758 design r1 | Investigation began21:12Z under sage-2162; recorded now. Before: case2 installer still renders tester TCP and case1 acceptance requires it. After: proposed design covers socket marker migration, actual configured dataRoot within unchanged hardening, target-uid metadata queries, kernel-peer acceptance observation and explicit same-uid residual. Initial inventory saved; no passing final static-check claim, product edit, test, host or live action. Duckworth design review precedes code.
+     +
+     +### 2026-10-21 row253 implementation prepared, gate pending
+ 7:  de93d8e03 =  7:  e18b90e95 fix(row253): bound cleanup retries after initial inventory
+ 8:  36bd3c3a8 =  8:  677767145 docs(row253): record static approval and pre-confirmation residual
+ 9:  672249334 =  9:  c733371c5 docs(row253): record integration onto refactor 378a76b85
+10:  8de88458d = 10:  141b79c29 docs(row253): integrate row191 base and refresh manifest

agents/gander/work/queue-253/integration-385a/uniqueness.json

@@ -0,0 +1,242 @@
+[
+  {
+    "id": "M1",
+    "file": "scripts/case2-unit.sh",
+    "occurrences": 1,
+    "before": "d7670bdb049ae41ba3774fc83de633636859b6723be858cfb31ea106b0e8812b"
+  },
+  {
+    "id": "M2",
+    "file": "scripts/case2-unit.sh",
+    "occurrences": 1,
+    "before": "d7670bdb049ae41ba3774fc83de633636859b6723be858cfb31ea106b0e8812b"
+  },
+  {
+    "id": "M3",
+    "file": "scripts/case2-unit.sh",
+    "occurrences": 1,
+    "before": "d7670bdb049ae41ba3774fc83de633636859b6723be858cfb31ea106b0e8812b"
+  },
+  {
+    "id": "M4",
+    "file": "scripts/case2-unit.sh",
+    "occurrences": 1,
+    "before": "d7670bdb049ae41ba3774fc83de633636859b6723be858cfb31ea106b0e8812b"
+  },
+  {
+    "id": "M5",
+    "file": "scripts/case2-unit.sh",
+    "occurrences": 1,
+    "before": "d7670bdb049ae41ba3774fc83de633636859b6723be858cfb31ea106b0e8812b"
+  },
+  {
+    "id": "M6",
+    "file": "scripts/case2-unit.sh",
+    "occurrences": 1,
+    "before": "d7670bdb049ae41ba3774fc83de633636859b6723be858cfb31ea106b0e8812b"
+  },
+  {
+    "id": "M7",
+    "file": "scripts/case2-unit.sh",
+    "occurrences": 1,
+    "before": "d7670bdb049ae41ba3774fc83de633636859b6723be858cfb31ea106b0e8812b"
+  },
+  {
+    "id": "M8",
+    "file": "scripts/case2-unit.sh",
+    "occurrences": 1,
+    "before": "d7670bdb049ae41ba3774fc83de633636859b6723be858cfb31ea106b0e8812b"
+  },
+  {
+    "id": "M9",
+    "file": "scripts/case2-unit.sh",
+    "occurrences": 1,
+    "before": "d7670bdb049ae41ba3774fc83de633636859b6723be858cfb31ea106b0e8812b"
+  },
+  {
+    "id": "M10",
+    "file": "scripts/case2-unit.sh",
+    "occurrences": 1,
+    "before": "d7670bdb049ae41ba3774fc83de633636859b6723be858cfb31ea106b0e8812b"
+  },
+  {
+    "id": "M11",
+    "file": "scripts/case2-unit.sh",
+    "occurrences": 1,
+    "before": "d7670bdb049ae41ba3774fc83de633636859b6723be858cfb31ea106b0e8812b"
+  },
+  {
+    "id": "M12",
+    "file": "scripts/case1-accept.sh",
+    "occurrences": 1,
+    "before": "c02bef6b3495e5a4548d7b4e89675ed52be26a0c9ccce4d9d5cfc5fe2ce437bd"
+  },
+  {
+    "id": "M13",
+    "file": "scripts/case1-accept.sh",
+    "occurrences": 1,
+    "before": "c02bef6b3495e5a4548d7b4e89675ed52be26a0c9ccce4d9d5cfc5fe2ce437bd"
+  },
+  {
+    "id": "M14",
+    "file": "scripts/case1-accept.sh",
+    "occurrences": 1,
+    "before": "c02bef6b3495e5a4548d7b4e89675ed52be26a0c9ccce4d9d5cfc5fe2ce437bd"
+  },
+  {
+    "id": "M15",
+    "file": "scripts/case1-accept.sh",
+    "occurrences": 1,
+    "before": "c02bef6b3495e5a4548d7b4e89675ed52be26a0c9ccce4d9d5cfc5fe2ce437bd"
+  },
+  {
+    "id": "M16",
+    "file": "scripts/case1-accept.sh",
+    "occurrences": 1,
+    "before": "c02bef6b3495e5a4548d7b4e89675ed52be26a0c9ccce4d9d5cfc5fe2ce437bd"
+  },
+  {
+    "id": "M17",
+    "file": "scripts/case1-accept.sh",
+    "occurrences": 1,
+    "before": "c02bef6b3495e5a4548d7b4e89675ed52be26a0c9ccce4d9d5cfc5fe2ce437bd"
+  },
+  {
+    "id": "M18",
+    "file": "scripts/case1-accept.sh",
+    "occurrences": 1,
+    "before": "c02bef6b3495e5a4548d7b4e89675ed52be26a0c9ccce4d9d5cfc5fe2ce437bd"
+  },
+  {
+    "id": "M19",
+    "file": "scripts/case1-accept.sh",
+    "occurrences": 1,
+    "before": "c02bef6b3495e5a4548d7b4e89675ed52be26a0c9ccce4d9d5cfc5fe2ce437bd"
+  },
+  {
+    "id": "M20",
+    "file": "scripts/case1-accept.sh",
+    "occurrences": 1,
+    "before": "c02bef6b3495e5a4548d7b4e89675ed52be26a0c9ccce4d9d5cfc5fe2ce437bd"
+  },
+  {
+    "id": "M21",
+    "file": "scripts/case1-accept.sh",
+    "occurrences": 1,
+    "before": "c02bef6b3495e5a4548d7b4e89675ed52be26a0c9ccce4d9d5cfc5fe2ce437bd"
+  },
+  {
+    "id": "M22",
+    "file": "scripts/case1-accept.sh",
+    "occurrences": 1,
+    "before": "c02bef6b3495e5a4548d7b4e89675ed52be26a0c9ccce4d9d5cfc5fe2ce437bd"
+  },
+  {
+    "id": "M23",
+    "file": "scripts/case1-accept.sh",
+    "occurrences": 1,
+    "before": "c02bef6b3495e5a4548d7b4e89675ed52be26a0c9ccce4d9d5cfc5fe2ce437bd"
+  },
+  {
+    "id": "M24",
+    "file": "scripts/case2-unit.sh",
+    "occurrences": 1,
+    "before": "d7670bdb049ae41ba3774fc83de633636859b6723be858cfb31ea106b0e8812b"
+  },
+  {
+    "id": "M25",
+    "file": "scripts/case1-accept.sh",
+    "occurrences": 1,
+    "before": "c02bef6b3495e5a4548d7b4e89675ed52be26a0c9ccce4d9d5cfc5fe2ce437bd"
+  },
+  {
+    "id": "M26",
+    "file": "scripts/case1-accept.sh",
+    "occurrences": 1,
+    "before": "c02bef6b3495e5a4548d7b4e89675ed52be26a0c9ccce4d9d5cfc5fe2ce437bd"
+  },
+  {
+    "id": "M27",
+    "file": "scripts/case1-accept.sh",
+    "occurrences": 1,
+    "before": "c02bef6b3495e5a4548d7b4e89675ed52be26a0c9ccce4d9d5cfc5fe2ce437bd"
+  },
+  {
+    "id": "M28",
+    "file": "scripts/case2-unit.sh",
+    "occurrences": 1,
+    "before": "d7670bdb049ae41ba3774fc83de633636859b6723be858cfb31ea106b0e8812b"
+  },
+  {
+    "id": "M29",
+    "file": "scripts/case2-unit.sh",
+    "occurrences": 1,
+    "before": "d7670bdb049ae41ba3774fc83de633636859b6723be858cfb31ea106b0e8812b"
+  },
+  {
+    "id": "M30",
+    "file": "scripts/case2-unit.sh",
+    "occurrences": 1,
+    "before": "d7670bdb049ae41ba3774fc83de633636859b6723be858cfb31ea106b0e8812b"
+  },
+  {
+    "id": "M31",
+    "file": "scripts/case2-unit.sh",
+    "occurrences": 1,
+    "before": "d7670bdb049ae41ba3774fc83de633636859b6723be858cfb31ea106b0e8812b"
+  },
+  {
+    "id": "M32",
+    "file": "scripts/case2-unit.sh",
+    "occurrences": 1,
+    "before": "d7670bdb049ae41ba3774fc83de633636859b6723be858cfb31ea106b0e8812b"
+  },
+  {
+    "id": "M33",
+    "file": "scripts/case2-unit.sh",
+    "occurrences": 1,
+    "before": "d7670bdb049ae41ba3774fc83de633636859b6723be858cfb31ea106b0e8812b"
+  },
+  {
+    "id": "M34",
+    "file": "scripts/case2-unit.sh",
+    "occurrences": 1,
+    "before": "d7670bdb049ae41ba3774fc83de633636859b6723be858cfb31ea106b0e8812b"
+  },
+  {
+    "id": "M35",
+    "file": "scripts/case2-unit.sh",
+    "occurrences": 1,
+    "before": "d7670bdb049ae41ba3774fc83de633636859b6723be858cfb31ea106b0e8812b"
+  },
+  {
+    "id": "M36",
+    "file": "scripts/case2-unit.sh",
+    "occurrences": 1,
+    "before": "d7670bdb049ae41ba3774fc83de633636859b6723be858cfb31ea106b0e8812b"
+  },
+  {
+    "id": "M37",
+    "file": "scripts/case2-unit.sh",
+    "occurrences": 1,
+    "before": "d7670bdb049ae41ba3774fc83de633636859b6723be858cfb31ea106b0e8812b"
+  },
+  {
+    "id": "M38",
+    "file": "scripts/case2-unit.sh",
+    "occurrences": 1,
+    "before": "d7670bdb049ae41ba3774fc83de633636859b6723be858cfb31ea106b0e8812b"
+  },
+  {
+    "id": "M39",
+    "file": "scripts/case2-unit.sh",
+    "occurrences": 1,
+    "before": "d7670bdb049ae41ba3774fc83de633636859b6723be858cfb31ea106b0e8812b"
+  },
+  {
+    "id": "M40",
+    "file": "scripts/case2-unit.sh",
+    "occurrences": 1,
+    "before": "d7670bdb049ae41ba3774fc83de633636859b6723be858cfb31ea106b0e8812b"
+  }
+]

agents/gander/work/queue-253/integration-385a/upstream-paths.json

@@ -0,0 +1,417 @@
+[
+  "BUILD-LOG.md",
+  "agents/gander/work/queue-278/BASE-DRIFT.json",
+  "agents/gander/work/queue-278/BUILD.md",
+  "agents/gander/work/queue-278/CANDIDATE-SHAS.json",
+  "agents/gander/work/queue-278/CANDIDATE.patch",
+  "agents/gander/work/queue-278/MANIFEST.md",
+  "agents/gander/work/queue-278/MANIFEST.sha256",
+  "agents/gander/work/queue-278/SHELL-LIMITS.json",
+  "agents/gander/work/queue-278/SOURCE.json",
+  "agents/gander/work/queue-278/UNIQUENESS.json",
+  "agents/gander/work/queue-278/changes.json",
+  "agents/gander/work/queue-278/checks.py",
+  "agents/gander/work/queue-278/launch.py",
+  "agents/gander/work/queue-278/manifest-check.txt",
+  "agents/gander/work/queue-278/report.py",
+  "agents/gander/work/queue-278/run1/SUMMARY.json",
+  "agents/gander/work/queue-278/run1/claim.log",
+  "agents/gander/work/queue-278/run1/focused-controller.log",
+  "agents/gander/work/queue-278/run1/focused/focused-0.command.json",
+  "agents/gander/work/queue-278/run1/focused/focused-0.log",
+  "agents/gander/work/queue-278/run1/focused/results.json",
+  "agents/gander/work/queue-278/run1/red-controller.log",
+  "agents/gander/work/queue-278/run1/red/red-0.command.json",
+  "agents/gander/work/queue-278/run1/red/red-0.log",
+  "agents/gander/work/queue-278/run1/red/red-1.command.json",
+  "agents/gander/work/queue-278/run1/red/red-1.log",
+  "agents/gander/work/queue-278/run1/red/results.json",
+  "agents/gander/work/queue-278/run1/start.txt",
+  "agents/gander/work/queue-278/run1/sweep-initial.json",
+  "agents/gander/work/queue-278/run1/sweep.json",
+  "agents/gander/work/queue-278/run1/syntax-controller.log",
+  "agents/gander/work/queue-278/run1/syntax/results.json",
+  "agents/gander/work/queue-278/run1/syntax/syntax-0.command.json",
+  "agents/gander/work/queue-278/run1/syntax/syntax-0.log",
+  "agents/gander/work/queue-278/run1/syntax/syntax-1.command.json",
+  "agents/gander/work/queue-278/run1/syntax/syntax-1.log",
+  "agents/gander/work/queue-278/run1/syntax/syntax-2.command.json",
+  "agents/gander/work/queue-278/run1/syntax/syntax-2.log",
+  "agents/gander/work/queue-278/run1/syntax/syntax-3.command.json",
+  "agents/gander/work/queue-278/run1/syntax/syntax-3.log",
+  "agents/gander/work/queue-278/run1/syntax/syntax-4.command.json",
+  "agents/gander/work/queue-278/run1/syntax/syntax-4.log",
+  "agents/gander/work/queue-278/run1/tmpdir.txt",
+  "agents/gander/work/queue-278/run2/KILL-TABLE.md",
+  "agents/gander/work/queue-278/run2/SUMMARY.json",
+  "agents/gander/work/queue-278/run2/changes-controller.log",
+  "agents/gander/work/queue-278/run2/changes/M1-base.command.json",
+  "agents/gander/work/queue-278/run2/changes/M1-base.log",
+  "agents/gander/work/queue-278/run2/changes/M1.command.json",
+  "agents/gander/work/queue-278/run2/changes/M1.log",
+  "agents/gander/work/queue-278/run2/changes/M2.command.json",
+  "agents/gander/work/queue-278/run2/changes/M2.log",
+  "agents/gander/work/queue-278/run2/changes/M3-base.command.json",
+  "agents/gander/work/queue-278/run2/changes/M3-base.log",
+  "agents/gander/work/queue-278/run2/changes/M3.command.json",
+  "agents/gander/work/queue-278/run2/changes/M3.log",
+  "agents/gander/work/queue-278/run2/changes/M4-base.command.json",
+  "agents/gander/work/queue-278/run2/changes/M4-base.log",
+  "agents/gander/work/queue-278/run2/changes/M4.command.json",
+  "agents/gander/work/queue-278/run2/changes/M4.log",
+  "agents/gander/work/queue-278/run2/changes/M5-base.command.json",
+  "agents/gander/work/queue-278/run2/changes/M5-base.log",
+  "agents/gander/work/queue-278/run2/changes/M5.command.json",
+  "agents/gander/work/queue-278/run2/changes/M5.log",
+  "agents/gander/work/queue-278/run2/changes/M6.command.json",
+  "agents/gander/work/queue-278/run2/changes/M6.log",
+  "agents/gander/work/queue-278/run2/changes/results.json",
+  "agents/gander/work/queue-278/run2/focused-controller.log",
+  "agents/gander/work/queue-278/run2/focused/focused-0.command.json",
+  "agents/gander/work/queue-278/run2/focused/focused-0.log",
+  "agents/gander/work/queue-278/run2/focused/focused-1.command.json",
+  "agents/gander/work/queue-278/run2/focused/focused-1.log",
+  "agents/gander/work/queue-278/run2/focused/results.json",
+  "agents/gander/work/queue-278/run2/red-controller.log",
+  "agents/gander/work/queue-278/run2/red/red-0.command.json",
+  "agents/gander/work/queue-278/run2/red/red-0.log",
+  "agents/gander/work/queue-278/run2/red/red-1.command.json",
+  "agents/gander/work/queue-278/run2/red/red-1.log",
+  "agents/gander/work/queue-278/run2/red/results.json",
+  "agents/gander/work/queue-278/run2/start.txt",
+  "agents/gander/work/queue-278/run2/sweep.json",
+  "agents/gander/work/queue-278/run2/syntax-controller.log",
+  "agents/gander/work/queue-278/run2/syntax/results.json",
+  "agents/gander/work/queue-278/run2/syntax/syntax-0.command.json",
+  "agents/gander/work/queue-278/run2/syntax/syntax-0.log",
+  "agents/gander/work/queue-278/run2/syntax/syntax-1.command.json",
+  "agents/gander/work/queue-278/run2/syntax/syntax-1.log",
+  "agents/gander/work/queue-278/run2/syntax/syntax-2.command.json",
+  "agents/gander/work/queue-278/run2/syntax/syntax-2.log",
+  "agents/gander/work/queue-278/run2/syntax/syntax-3.command.json",
+  "agents/gander/work/queue-278/run2/syntax/syntax-3.log",
+  "agents/gander/work/queue-278/run2/syntax/syntax-4.command.json",
+  "agents/gander/work/queue-278/run2/syntax/syntax-4.log",
+  "agents/gander/work/queue-278/run2/tmpdir.txt",
+  "agents/gander/work/queue-278/run2/whole-controller.log",
+  "agents/gander/work/queue-278/run2/whole/bus.command.json",
+  "agents/gander/work/queue-278/run2/whole/bus.log",
+  "agents/gander/work/queue-278/run2/whole/results.json",
+  "agents/gander/work/queue-278/run2/whole/webui.command.json",
+  "agents/gander/work/queue-278/run2/whole/webui.log",
+  "agents/gander/work/queue-278/run3/KILL-TABLE.md",
+  "agents/gander/work/queue-278/run3/SUMMARY.json",
+  "agents/gander/work/queue-278/run3/TMPDIR",
+  "agents/gander/work/queue-278/run3/changes-controller.log",
+  "agents/gander/work/queue-278/run3/changes/M1-base.command.json",
+  "agents/gander/work/queue-278/run3/changes/M1-base.log",
+  "agents/gander/work/queue-278/run3/changes/M1.command.json",
+  "agents/gander/work/queue-278/run3/changes/M1.log",
+  "agents/gander/work/queue-278/run3/changes/M2.command.json",
+  "agents/gander/work/queue-278/run3/changes/M2.log",
+  "agents/gander/work/queue-278/run3/changes/M3-base.command.json",
+  "agents/gander/work/queue-278/run3/changes/M3-base.log",
+  "agents/gander/work/queue-278/run3/changes/M3.command.json",
+  "agents/gander/work/queue-278/run3/changes/M3.log",
+  "agents/gander/work/queue-278/run3/changes/M4-base.command.json",
+  "agents/gander/work/queue-278/run3/changes/M4-base.log",
+  "agents/gander/work/queue-278/run3/changes/M4.command.json",
+  "agents/gander/work/queue-278/run3/changes/M4.log",
+  "agents/gander/work/queue-278/run3/changes/M5-base.command.json",
+  "agents/gander/work/queue-278/run3/changes/M5-base.log",
+  "agents/gander/work/queue-278/run3/changes/M5.command.json",
+  "agents/gander/work/queue-278/run3/changes/M5.log",
+  "agents/gander/work/queue-278/run3/changes/M6.command.json",
+  "agents/gander/work/queue-278/run3/changes/M6.log",
+  "agents/gander/work/queue-278/run3/changes/results.json",
+  "agents/gander/work/queue-278/run3/end.txt",
+  "agents/gander/work/queue-278/run3/focused-controller.log",
+  "agents/gander/work/queue-278/run3/focused/focused-0.command.json",
+  "agents/gander/work/queue-278/run3/focused/focused-0.log",
+  "agents/gander/work/queue-278/run3/focused/focused-1.command.json",
+  "agents/gander/work/queue-278/run3/focused/focused-1.log",
+  "agents/gander/work/queue-278/run3/focused/focused-2.command.json",
+  "agents/gander/work/queue-278/run3/focused/focused-2.log",
+  "agents/gander/work/queue-278/run3/focused/results.json",
+  "agents/gander/work/queue-278/run3/preexisting-processes.txt",
+  "agents/gander/work/queue-278/run3/red-controller.log",
+  "agents/gander/work/queue-278/run3/red/red-0.command.json",
+  "agents/gander/work/queue-278/run3/red/red-0.log",
+  "agents/gander/work/queue-278/run3/red/red-1.command.json",
+  "agents/gander/work/queue-278/run3/red/red-1.log",
+  "agents/gander/work/queue-278/run3/red/results.json",
+  "agents/gander/work/queue-278/run3/start.txt",
+  "agents/gander/work/queue-278/run3/sweep-initial.json",
+  "agents/gander/work/queue-278/run3/sweep.json",
+  "agents/gander/work/queue-278/run3/syntax-controller.log",
+  "agents/gander/work/queue-278/run3/syntax/results.json",
+  "agents/gander/work/queue-278/run3/syntax/syntax-0.command.json",
+  "agents/gander/work/queue-278/run3/syntax/syntax-0.log",
+  "agents/gander/work/queue-278/run3/syntax/syntax-1.command.json",
+  "agents/gander/work/queue-278/run3/syntax/syntax-1.log",
+  "agents/gander/work/queue-278/run3/syntax/syntax-2.command.json",
+  "agents/gander/work/queue-278/run3/syntax/syntax-2.log",
+  "agents/gander/work/queue-278/run3/syntax/syntax-3.command.json",
+  "agents/gander/work/queue-278/run3/syntax/syntax-3.log",
+  "agents/gander/work/queue-278/run3/syntax/syntax-4.command.json",
+  "agents/gander/work/queue-278/run3/syntax/syntax-4.log",
+  "agents/gander/work/queue-278/run3/syntax/syntax-6.command.json",
+  "agents/gander/work/queue-278/run3/syntax/syntax-6.log",
+  "agents/gander/work/queue-278/run3/whole-controller.log",
+  "agents/gander/work/queue-278/run3/whole/bus.command.json",
+  "agents/gander/work/queue-278/run3/whole/bus.log",
+  "agents/gander/work/queue-278/run3/whole/results.json",
+  "agents/gander/work/queue-278/run3/whole/test-auth.command.json",
+  "agents/gander/work/queue-278/run3/whole/test-auth.log",
+  "agents/gander/work/queue-278/run3/whole/test-conductor.command.json",
+  "agents/gander/work/queue-278/run3/whole/test-conductor.log",
+  "agents/gander/work/queue-278/run3/whole/test-config.command.json",
+  "agents/gander/work/queue-278/run3/whole/test-config.log",
+  "agents/gander/work/queue-278/run3/whole/test-discord.command.json",
+  "agents/gander/work/queue-278/run3/whole/test-discord.log",
+  "agents/gander/work/queue-278/run3/whole/test-extension-package.command.json",
+  "agents/gander/work/queue-278/run3/whole/test-extension-package.log",
+  "agents/gander/work/queue-278/run3/whole/test-foundation.command.json",
+  "agents/gander/work/queue-278/run3/whole/test-foundation.log",
+  "agents/gander/work/queue-278/run3/whole/test-land-work.command.json",
+  "agents/gander/work/queue-278/run3/whole/test-land-work.log",
+  "agents/gander/work/queue-278/run3/whole/test-queue.command.json",
+  "agents/gander/work/queue-278/run3/whole/test-queue.log",
+  "agents/gander/work/queue-278/run3/whole/test-release.command.json",
+  "agents/gander/work/queue-278/run3/whole/test-release.log",
+  "agents/gander/work/queue-278/run3/whole/test-task.command.json",
+  "agents/gander/work/queue-278/run3/whole/test-task.log",
+  "agents/gander/work/queue-278/run3/whole/webui.command.json",
+  "agents/gander/work/queue-278/run3/whole/webui.log",
+  "agents/gander/work/queue-278/sweep.py",
+  "agents/gander/work/queue-278/window.py",
+  "agents/gizmoduck/work/queue-268/BUILD.md",
+  "agents/honker/work/queue-194/BUILD.md",
+  "agents/honker/work/queue-194/DESIGN.md",
+  "agents/honker/work/queue-194/PRD-1.8-DRAFT.md",
+  "agents/honker/work/queue-256/BUILD.md",
+  "agents/honker/work/queue-256/DESIGN.md",
+  "agents/megavolt/work/queue-236/BUILD.md",
+  "agents/morgana/work/fed-r3/BUILD.md",
+  "agents/morgana/work/queue-205/BUILD.md",
+  "agents/morgana/work/queue-205/DESIGN.md",
+  "agents/morgana/work/queue-277/BUILD.md",
+  "agents/rocko/work/queue-191/stoprun-build/BUILD.md",
+  "agents/rocko/work/queue-279/BUILD.md",
+  "agents/rocko/work/queue-279/base.txt",
+  "agents/rocko/work/queue-279/build.patch",
+  "agents/rocko/work/queue-279/candidate-manifest.sha256",
+  "agents/rocko/work/queue-279/candidate.txt",
+  "agents/rocko/work/queue-279/changed-paths.txt",
+  "agents/rocko/work/queue-279/commit.txt",
+  "agents/rocko/work/queue-279/logs/M1.log",
+  "agents/rocko/work/queue-279/logs/processing-control-whole.log",
+  "agents/rocko/work/queue-279/logs/regression-red.log",
+  "agents/rocko/work/queue-279/logs/stop-run-whole.log",
+  "agents/rocko/work/queue-279/mutant-plan.json",
+  "agents/rocko/work/queue-279/packet-manifest.sha256",
+  "agents/rocko/work/queue-279/reader-search.txt",
+  "agents/rocko/work/queue-279/results.json",
+  "agents/rocko/work/queue-279/run-step.py",
+  "agents/rocko/work/queue-279/scan-result.json",
+  "agents/rocko/work/queue-279/skips.txt",
+  "agents/rocko/work/queue-279/source-scope-check.json",
+  "agents/rocko/work/queue-279/sweep.json",
+  "agents/rocko/work/queue-279/tmpdir.txt",
+  "agents/rocko/work/queue-280/BUILD.md",
+  "agents/rocko/work/queue-280/assertion-preservation.json",
+  "agents/rocko/work/queue-280/base.txt",
+  "agents/rocko/work/queue-280/build.patch",
+  "agents/rocko/work/queue-280/candidate-manifest.sha256",
+  "agents/rocko/work/queue-280/candidate.txt",
+  "agents/rocko/work/queue-280/changed-paths.txt",
+  "agents/rocko/work/queue-280/commit.txt",
+  "agents/rocko/work/queue-280/final-sweep.json",
+  "agents/rocko/work/queue-280/mutant-restore.json",
+  "agents/rocko/work/queue-280/mutants.json",
+  "agents/rocko/work/queue-280/packet-manifest.sha256",
+  "agents/rocko/work/queue-280/post-phase1-pgrep.txt",
+  "agents/rocko/work/queue-280/reader-search.txt",
+  "agents/rocko/work/queue-280/repeat-commit.txt",
+  "agents/rocko/work/queue-280/repeat-results.json",
+  "agents/rocko/work/queue-280/repeat-summary.json",
+  "agents/rocko/work/queue-280/restored-hashes.json",
+  "agents/rocko/work/queue-280/results.json",
+  "agents/rocko/work/queue-280/scan-result.json",
+  "agents/rocko/work/queue-280/skips.txt",
+  "agents/rocko/work/queue-280/sweep-phase1.json",
+  "agents/rocko/work/vikunja-502/BUILD.md",
+  "agents/rocko/work/vikunja-502/RESULTS.md",
+  "agents/rocko/work/vikunja-502/all-mutants.json",
+  "agents/rocko/work/vikunja-502/base-drift-ce6a.json",
+  "agents/rocko/work/vikunja-502/base.txt",
+  "agents/rocko/work/vikunja-502/build.patch",
+  "agents/rocko/work/vikunja-502/candidate-manifest.sha256",
+  "agents/rocko/work/vikunja-502/candidate.txt",
+  "agents/rocko/work/vikunja-502/changed-paths.txt",
+  "agents/rocko/work/vikunja-502/commit.txt",
+  "agents/rocko/work/vikunja-502/cwd-sweep.json",
+  "agents/rocko/work/vikunja-502/focused-results.json",
+  "agents/rocko/work/vikunja-502/gate-plan.json",
+  "agents/rocko/work/vikunja-502/logs/bus-tasks-whole.log",
+  "agents/rocko/work/vikunja-502/logs/processing-http-whole.log",
+  "agents/rocko/work/vikunja-502/logs/python-regressions.log",
+  "agents/rocko/work/vikunja-502/logs/replays.log",
+  "agents/rocko/work/vikunja-502/logs/runner-green.log",
+  "agents/rocko/work/vikunja-502/logs/runner-red.log",
+  "agents/rocko/work/vikunja-502/logs/stop-run-whole.log",
+  "agents/rocko/work/vikunja-502/mutant-logs/KS43.tap",
+  "agents/rocko/work/vikunja-502/mutant-logs/KS44.tap",
+  "agents/rocko/work/vikunja-502/mutant-logs/KS54.tap",
+  "agents/rocko/work/vikunja-502/mutant-logs/SR08.tap",
+  "agents/rocko/work/vikunja-502/mutant-logs/V502-status.tap",
+  "agents/rocko/work/vikunja-502/mutant-results.json",
+  "agents/rocko/work/vikunja-502/mutant-resume-summary.json",
+  "agents/rocko/work/vikunja-502/packet-manifest.sha256",
+  "agents/rocko/work/vikunja-502/pre-rebase-commit.txt",
+  "agents/rocko/work/vikunja-502/rebase-980c/BUILD.md",
+  "agents/rocko/work/vikunja-502/rebase-980c/base.txt",
+  "agents/rocko/work/vikunja-502/rebase-980c/candidate-manifest.sha256",
+  "agents/rocko/work/vikunja-502/rebase-980c/candidate.txt",
+  "agents/rocko/work/vikunja-502/rebase-980c/cwd-sweep.json",
+  "agents/rocko/work/vikunja-502/rebase-980c/logs/bus-tasks-whole.log",
+  "agents/rocko/work/vikunja-502/rebase-980c/logs/processing-http-whole.log",
+  "agents/rocko/work/vikunja-502/rebase-980c/logs/python-regressions.log",
+  "agents/rocko/work/vikunja-502/rebase-980c/logs/stop-run-whole.log",
+  "agents/rocko/work/vikunja-502/rebase-980c/packet-manifest.sha256",
+  "agents/rocko/work/vikunja-502/rebase-980c/range-diff.txt",
+  "agents/rocko/work/vikunja-502/rebase-980c/restored-hashes.json",
+  "agents/rocko/work/vikunja-502/rebase-980c/results.json",
+  "agents/rocko/work/vikunja-502/rebase-980c/scan-result.json",
+  "agents/rocko/work/vikunja-502/rebase-980c/tmpdir.txt",
+  "agents/rocko/work/vikunja-502/rebase-proof.json",
+  "agents/rocko/work/vikunja-502/rebase-range-diff.txt",
+  "agents/rocko/work/vikunja-502/restored-candidate.json",
+  "agents/rocko/work/vikunja-502/run-mutants.baseline.py",
+  "agents/rocko/work/vikunja-502/run-mutants.py",
+  "agents/rocko/work/vikunja-502/runner-change.diff",
+  "agents/rocko/work/vikunja-502/runner.sha256",
+  "agents/rocko/work/vikunja-502/scan-summary.json",
+  "agents/rocko/work/vikunja-502/skips.json",
+  "agents/rocko/work/vikunja-502/tests/test_timeout_cause.py",
+  "agents/rocko/work/vikunja-502/tmpdir.txt",
+  "agents/sage/work/vikunja-setup/comment-r191-landed.mjs",
+  "agents/sage/work/vikunja-setup/file-thread-claims.mjs",
+  "agents/sage/work/vikunja-setup/post-w12-86f95bb27.mjs",
+  "agents/sage/work/window-plan/repin-86f95bb27.md",
+  "docs/SESSIONS.md",
+  "docs/case2/SETUP-SHEET.md",
+  "docs/case2/SURVEY-RUN.md",
+  "docs/plans/2026-10-22_fire-revokes-grants.md",
+  "docs/plans/2026-10-22_owner-thread-claims.md",
+  "docs/plans/2026-10-22_sshd-port-race.md",
+  "docs/plans/2026-10-22_sso-phase2-window.md",
+  "docs/plans/2026-10-22_stoprun-deadline.md",
+  "docs/plans/DEFERRED.md",
+  "docs/plans/QUEUE.md",
+  "docs/plans/queue.json",
+  "packages/bus/README.md",
+  "packages/bus/schema.sql",
+  "packages/bus/src/broker.mjs",
+  "packages/bus/src/client.mjs",
+  "packages/bus/src/credentials.mjs",
+  "packages/bus/src/gitea-grant.mjs",
+  "packages/bus/src/human-cli.mjs",
+  "packages/bus/src/migrations/3j-3k.sql",
+  "packages/bus/src/process.mjs",
+  "packages/bus/src/runtime.mjs",
+  "packages/bus/src/server.mjs",
+  "packages/bus/src/store.mjs",
+  "packages/bus/src/user-cli.mjs",
+  "packages/bus/tests/account-migration.test.mjs",
+  "packages/bus/tests/channel-proof.test.mjs",
+  "packages/bus/tests/chief-of-staff.test.mjs",
+  "packages/bus/tests/comment-migration.test.mjs",
+  "packages/bus/tests/creative.test.mjs",
+  "packages/bus/tests/fake-gitea-api.mjs",
+  "packages/bus/tests/fixtures/schema-3j.sql",
+  "packages/bus/tests/gitea-grant-docker.test.mjs",
+  "packages/bus/tests/gitea-grant.test.mjs",
+  "packages/bus/tests/gitea-migration.test.mjs",
+  "packages/bus/tests/grant-executor.test.mjs",
+  "packages/bus/tests/grant-host.test.mjs",
+  "packages/bus/tests/grant-migration.test.mjs",
+  "packages/bus/tests/host-run.test.mjs",
+  "packages/bus/tests/instances-verb.test.mjs",
+  "packages/bus/tests/lifecycle-revoke.test.mjs",
+  "packages/bus/tests/lifecycle-verbs.test.mjs",
+  "packages/bus/tests/message-filter.test.mjs",
+  "packages/bus/tests/name-migration.test.mjs",
+  "packages/bus/tests/project-runtime.test.mjs",
+  "packages/bus/tests/reload.test.mjs",
+  "packages/bus/tests/schema.test.mjs",
+  "packages/bus/tests/scratch-sshd.mjs",
+  "packages/bus/tests/spec-migration.test.mjs",
+  "packages/bus/tests/tasks.test.mjs",
+  "packages/bus/tests/tester-writes.test.mjs",
+  "packages/bus/tests/thread-claims.test.mjs",
+  "packages/bus/tests/thread-migration.test.mjs",
+  "packages/bus/tests/usage-migration.test.mjs",
+  "packages/bus/tests/user-principal.test.mjs",
+  "packages/business/README.md",
+  "packages/business/src/access.mjs",
+  "packages/business/src/business.mjs",
+  "packages/business/src/credentials.mjs",
+  "packages/business/src/index.mjs",
+  "packages/business/src/instance-settings.mjs",
+  "packages/business/src/launch-settings.mjs",
+  "packages/business/src/organization.mjs",
+  "packages/business/src/role.mjs",
+  "packages/business/src/vocabulary.mjs",
+  "packages/business/tests/business.test.mjs",
+  "packages/business/tests/chief-of-staff.test.mjs",
+  "packages/business/tests/cli.test.mjs",
+  "packages/business/tests/hard-waits.test.mjs",
+  "packages/business/tests/instance-settings.test.mjs",
+  "packages/business/tests/launch-settings.test.mjs",
+  "packages/business/tests/lifecycle-settings.test.mjs",
+  "packages/business/tests/role.test.mjs",
+  "packages/cli/README.md",
+  "packages/cli/src/cli.mjs",
+  "packages/cli/src/format.mjs",
+  "packages/cli/src/grants.mjs",
+  "packages/cli/src/instances.mjs",
+  "packages/cli/src/launcher.mjs",
+  "packages/cli/tests/format.test.mjs",
+  "packages/cli/tests/grants.test.mjs",
+  "packages/cli/tests/instances.test.mjs",
+  "packages/cli/tests/lifecycle.test.mjs",
+  "packages/cli/tests/stack-release.test.mjs",
+  "packages/cli/tests/tester.test.mjs",
+  "packages/harness/src/runner.mjs",
+  "packages/harness/src/tools.mjs",
+  "packages/harness/tests/bundle.test.mjs",
+  "packages/harness/tests/runner.test.mjs",
+  "packages/harness/tests/tools.test.mjs",
+  "packages/library/README.md",
+  "packages/library/src/mapping.mjs",
+  "packages/library/src/scope.mjs",
+  "packages/library/tests/mapping.test.mjs",
+  "packages/library/tests/scope.test.mjs",
+  "packages/processing-control/src/runtimes.mjs",
+  "packages/processing-control/tests/stop-run.test.mjs",
+  "packages/webui/README.md",
+  "packages/webui/src/bus.mjs",
+  "packages/webui/src/cli.mjs",
+  "packages/webui/src/public/agents.js",
+  "packages/webui/src/public/bus.js",
+  "packages/webui/src/public/index.html",
+  "packages/webui/src/serve.mjs",
+  "packages/webui/tests/agents-browser.test.mjs",
+  "packages/webui/tests/agents.test.mjs",
+  "packages/webui/tests/browser.test.mjs",
+  "packages/webui/tests/instances.test.mjs",
+  "packages/webui/tests/processing.test.mjs",
+  "packages/webui/tests/shell.test.mjs",
+  "packages/webui/tests/sso.test.mjs",
+  "packages/webui/tests/thread-claims-browser.test.mjs",
+  "packages/webui/tests/thread-claims.test.mjs",
+  "roles/chief-of-staff.json",
+  "roles/chief-of-staff.md",
+  "scripts/mosaic"
+]

agents/gander/work/queue-253/integration-aca1/FILE-LIMITS.json

@@ -0,0 +1,164 @@
+{
+  "packages/cli/tests/case1-accept.test.mjs": {
+    "timeout_seconds": 900,
+    "kill_after_seconds": 10,
+    "outer_harness_seconds": 930,
+    "reason": "sage-2709: six CLI whole files use900s; measured durations establish later3x basis."
+  },
+  "packages/cli/tests/case2-unit.test.mjs": {
+    "timeout_seconds": 900,
+    "kill_after_seconds": 10,
+    "outer_harness_seconds": 930,
+    "reason": "sage-2709: six CLI whole files use900s; measured durations establish later3x basis."
+  },
+  "packages/bus/tests/account-migration.test.mjs": {
+    "timeout_seconds": 300,
+    "kill_after_seconds": 10,
+    "outer_harness_seconds": 330,
+    "reason": "Whole-file bound under sage-2705; no prior repaired-C4 whole-file timing claimed."
+  },
+  "packages/bus/tests/chief-of-staff.test.mjs": {
+    "timeout_seconds": 300,
+    "kill_after_seconds": 10,
+    "outer_harness_seconds": 330,
+    "reason": "Whole-file bound under sage-2705; no prior repaired-C4 whole-file timing claimed."
+  },
+  "packages/bus/tests/comment-migration.test.mjs": {
+    "timeout_seconds": 300,
+    "kill_after_seconds": 10,
+    "outer_harness_seconds": 330,
+    "reason": "Whole-file bound under sage-2705; no prior repaired-C4 whole-file timing claimed."
+  },
+  "packages/bus/tests/end-launch.test.mjs": {
+    "timeout_seconds": 300,
+    "kill_after_seconds": 10,
+    "outer_harness_seconds": 330,
+    "reason": "Whole-file bound under sage-2705; no prior repaired-C4 whole-file timing claimed."
+  },
+  "packages/bus/tests/fire-revokes-grants.test.mjs": {
+    "timeout_seconds": 300,
+    "kill_after_seconds": 10,
+    "outer_harness_seconds": 330,
+    "reason": "Whole-file bound under sage-2705; no prior repaired-C4 whole-file timing claimed."
+  },
+  "packages/bus/tests/gitea-grant.test.mjs": {
+    "timeout_seconds": 300,
+    "kill_after_seconds": 10,
+    "outer_harness_seconds": 330,
+    "reason": "Whole-file bound under sage-2705; no prior repaired-C4 whole-file timing claimed."
+  },
+  "packages/bus/tests/gitea-migration.test.mjs": {
+    "timeout_seconds": 300,
+    "kill_after_seconds": 10,
+    "outer_harness_seconds": 330,
+    "reason": "Whole-file bound under sage-2705; no prior repaired-C4 whole-file timing claimed."
+  },
+  "packages/bus/tests/grant-executor.test.mjs": {
+    "timeout_seconds": 300,
+    "kill_after_seconds": 10,
+    "outer_harness_seconds": 330,
+    "reason": "Whole-file bound under sage-2705; no prior repaired-C4 whole-file timing claimed."
+  },
+  "packages/bus/tests/grant-migration.test.mjs": {
+    "timeout_seconds": 300,
+    "kill_after_seconds": 10,
+    "outer_harness_seconds": 330,
+    "reason": "Whole-file bound under sage-2705; no prior repaired-C4 whole-file timing claimed."
+  },
+  "packages/bus/tests/lifecycle-revoke.test.mjs": {
+    "timeout_seconds": 300,
+    "kill_after_seconds": 10,
+    "outer_harness_seconds": 330,
+    "reason": "Whole-file bound under sage-2705; no prior repaired-C4 whole-file timing claimed."
+  },
+  "packages/bus/tests/message-filter.test.mjs": {
+    "timeout_seconds": 300,
+    "kill_after_seconds": 10,
+    "outer_harness_seconds": 330,
+    "reason": "Whole-file bound under sage-2705; no prior repaired-C4 whole-file timing claimed."
+  },
+  "packages/bus/tests/name-migration.test.mjs": {
+    "timeout_seconds": 300,
+    "kill_after_seconds": 10,
+    "outer_harness_seconds": 330,
+    "reason": "Whole-file bound under sage-2705; no prior repaired-C4 whole-file timing claimed."
+  },
+  "packages/bus/tests/schema.test.mjs": {
+    "timeout_seconds": 300,
+    "kill_after_seconds": 10,
+    "outer_harness_seconds": 330,
+    "reason": "Whole-file bound under sage-2705; no prior repaired-C4 whole-file timing claimed."
+  },
+  "packages/bus/tests/sessions.test.mjs": {
+    "timeout_seconds": 300,
+    "kill_after_seconds": 10,
+    "outer_harness_seconds": 330,
+    "reason": "Whole-file bound under sage-2705; no prior repaired-C4 whole-file timing claimed."
+  },
+  "packages/bus/tests/spec-migration.test.mjs": {
+    "timeout_seconds": 300,
+    "kill_after_seconds": 10,
+    "outer_harness_seconds": 330,
+    "reason": "Whole-file bound under sage-2705; no prior repaired-C4 whole-file timing claimed."
+  },
+  "packages/bus/tests/tester-writes.test.mjs": {
+    "timeout_seconds": 300,
+    "kill_after_seconds": 10,
+    "outer_harness_seconds": 330,
+    "reason": "Whole-file bound under sage-2705; no prior repaired-C4 whole-file timing claimed."
+  },
+  "packages/bus/tests/thread-claims.test.mjs": {
+    "timeout_seconds": 300,
+    "kill_after_seconds": 10,
+    "outer_harness_seconds": 330,
+    "reason": "Whole-file bound under sage-2705; no prior repaired-C4 whole-file timing claimed."
+  },
+  "packages/bus/tests/thread-migration.test.mjs": {
+    "timeout_seconds": 300,
+    "kill_after_seconds": 10,
+    "outer_harness_seconds": 330,
+    "reason": "Whole-file bound under sage-2705; no prior repaired-C4 whole-file timing claimed."
+  },
+  "packages/bus/tests/threads.test.mjs": {
+    "timeout_seconds": 300,
+    "kill_after_seconds": 10,
+    "outer_harness_seconds": 330,
+    "reason": "Whole-file bound under sage-2705; no prior repaired-C4 whole-file timing claimed."
+  },
+  "packages/bus/tests/usage-migration.test.mjs": {
+    "timeout_seconds": 300,
+    "kill_after_seconds": 10,
+    "outer_harness_seconds": 330,
+    "reason": "Whole-file bound under sage-2705; no prior repaired-C4 whole-file timing claimed."
+  },
+  "packages/cli/tests/lifecycle.test.mjs": {
+    "timeout_seconds": 900,
+    "kill_after_seconds": 10,
+    "outer_harness_seconds": 930,
+    "reason": "sage-2709: six CLI whole files use900s; measured durations establish later3x basis."
+  },
+  "packages/cli/tests/stack-release.test.mjs": {
+    "timeout_seconds": 900,
+    "kill_after_seconds": 10,
+    "outer_harness_seconds": 930,
+    "reason": "sage-2709: six CLI whole files use900s; measured durations establish later3x basis."
+  },
+  "packages/cli/tests/thread-cli.test.mjs": {
+    "timeout_seconds": 900,
+    "kill_after_seconds": 10,
+    "outer_harness_seconds": 930,
+    "reason": "sage-2709: six CLI whole files use900s; measured durations establish later3x basis."
+  },
+  "packages/cli/tests/thread-launch.test.mjs": {
+    "timeout_seconds": 900,
+    "kill_after_seconds": 10,
+    "outer_harness_seconds": 930,
+    "reason": "sage-2709: six CLI whole files use900s; measured durations establish later3x basis."
+  },
+  "packages/webui/tests/chat.test.mjs": {
+    "timeout_seconds": 300,
+    "kill_after_seconds": 10,
+    "outer_harness_seconds": 330,
+    "reason": "Whole-file bound under sage-2705; no prior repaired-C4 whole-file timing claimed."
+  }
+}

agents/gander/work/queue-253/integration-aca1/NOTES.md

@@ -0,0 +1,15 @@
+# Row253 final base and pre-gate scope
+
+Authority sage-2705. New branch gander/row253-aca1 on aca16404cf522b03f39acaf140e4f6185a507b88. Rebased source tip ed3bb376cdd5128dc58b3aa193282e1c2bfcf57d. Thirteen commits replayed from b78918850..288cdecf6; all thirteen final-hop range-diff pairs equal, no conflict. Earlier branches remain. The requested comparison from d213ef651 is range-diff-from-d213.txt; the two extra interim packet commits have no old counterpart, and the original BUILD-LOG context changes are documented in integration-b789/.
+
+Seven manifest blobs are byte-identical to288cdecf6. Digest573c51cf72f2398532a6ea768536f04e3c1681997cb8b9a6f14a8aef884870ae. All seven sha256sum checks pass. Both append-only paths keep the entire final base as exact byte prefix. Final-hop upstream changes only Gizmoduck BUILD and queue JSON/rendering; none is a253 focused read or pinned asset. The earlier264a Store/schema dependency is present on the base and is covered by whole-file scope.
+
+Duckworth's requested prefix-resolution material remains in integration-b789/NOTES.md, manifest-drift.diff and whole-test-union.json. This folder's drift is385a7194c..finalbase on the manifest paths and its whole union was independently recomputed:27 runnable files, unchanged from interim. Fixtures are exercised through importers, not represented as standalone tests. N9 is the exact sandbox bind case in case2; report its runtime skip reason verbatim.
+
+## Bounds written before any run
+
+Step2 runs all27 files whole, own case1/case2 first, then remaining sorted paths. Every call is timeout -k10 300 node --test --test-reporter=tap FILE; Python harness outer wait330s is a fallback. FILE-LIMITS.json records every file. Busy check gates each start, pipefail and tee capture raw logs and structured command JSONs. Any timeout is a stop, never a kill/pass; any unexpected red stops with no retry. Print HEAD and manifest digest first. No run starts before focused CLEAR. Expected duration10-15min; status every15min and immediate stop report.
+
+The later whole gate remains separately gated. Every whole shell uses SHELL-LIMITS.json (ceil3xmax+120), recorded in BUILD.md. Script bytes unchanged; no no-record case, so900 fallback unused. Whole CLI needs a separately stated bound in its whole-gate plan because the historical whole result took597s; a300s file limit is not a claim about full-suite runtime. No carried results. No product/test/assertion changed during final integration.
+
+No tests, Node, syntax commands, browser, probe, queue write or push have run while writing this packet. Publishing is authorized by sage-2705 after this record is committed. The next action is request focused CLEAR, then27 whole files, Duckworth rebase check and later whole-gate CLEAR.

agents/gander/work/queue-253/integration-aca1/STATUS.json

@@ -0,0 +1,18 @@
+{
+  "authority": "sage-2705",
+  "base": "aca16404cf522b03f39acaf140e4f6185a507b88",
+  "source_tip": "ed3bb376cdd5128dc58b3aa193282e1c2bfcf57d",
+  "branch": "gander/row253-aca1",
+  "manifest": "573c51cf72f2398532a6ea768536f04e3c1681997cb8b9a6f14a8aef884870ae",
+  "final_hop_paths": [
+    "agents/gizmoduck/work/queue-264/BUILD.md",
+    "docs/plans/QUEUE.md",
+    "docs/plans/queue.json"
+  ],
+  "final_hop_conflicts": [],
+  "manifest_unchanged": true,
+  "all_7_blobs_equal_b789": true,
+  "append_prefix_checks": true,
+  "test_union_count": 27,
+  "tests_run": false
+}

agents/gander/work/queue-253/integration-aca1/manifest-drift.diff

@@ -0,0 +1,78 @@
+diff --git a/docs/plans/DEFERRED.md b/docs/plans/DEFERRED.md
+index 4c0c736f1..f990eb3a9 100644
+--- a/docs/plans/DEFERRED.md
++++ b/docs/plans/DEFERRED.md
+@@ -431,17 +431,6 @@ at every gate. Started 2026-09-12 during the control board MVP.
+   comes near 64 runs. The follow-up row either raises the cap or splits
+   the done. Its test: a fire's done over the cap refuses, and the runs it
+   left alive still get the alive flag. (2026-10-22)
+-- **A fired or deleted instance keeps its grants.** (Dewey on the row 236
+-  rebase look, dewey-0815; Mos mos-1271; Sage sage-2558.) Row 194's
+-  `instance.fire` and row 256's delete revoke only the roles entry's
+-  credential services through `revoke()` in `runtime.mjs`. The agent's
+-  host grants (row 235) and its Gitea user and token (row 236) stay live
+-  until a human runs `mosaic hosts revoke` or `mosaic grants revoke`. The
+-  Console has no revoke route and doesn't say a grant is left. Row 281
+-  (#1786) closes it: a fire or a delete revokes every host and Gitea grant
+-  the instance holds, fail closed, with a test for each kind. It lands
+-  before the .53 Case 1 install hires an instance with a grant.
+-  (2026-10-22)
+ 
+ - **The runs suite doesn't gate a change to `scripts/mosaic-task.mjs`.**
+   (Dewey N7 on row 191, repeated on the Vikunja 502 review.)
+@@ -460,6 +449,44 @@ at every gate. Started 2026-09-12 during the control board MVP.
+   changes `packages/cli/tests/tester.test.mjs`: add the resolve pin so M8
+   dies on an assertion. (2026-10-22)
+ 
++- **Row 274's user reply check is scoped to the thread, not the session.**
++  (Row 264a r6, sage-2591.) In `packages/bus/src/broker.mjs`, the check that
++  a run answers a user only in reply to that user's message in its thread
++  joins `message_threads` by thread. That holds while a user's thread has
++  only its default session: a user can't call `session.create`, and
++  `#thread` refuses anyone but the owner. Binds row 272 (264e, #1777), or
++  any row that lets a user add sessions: make the check session-scoped and
++  test it with two sessions. (2026-10-22)
++
++- **Row 281's refusal texts point the wrong way.** (Dewey N1 and N2 on
++  the row 281 manifest round, dewey-0842/0843 and dewey-0846; Sage
++  sage-2653.) N1: when a host decision is still open and the host is
++  removed, step G's fire or delete job refuses `host-unknown`, and the
++  inbox hint names a verb that can't help. The way out is to decline or
++  withdraw the decision (`packages/bus/src/broker.mjs`, the closed check
++  near :1684 and `decision.withdraw` near :5015). T14 now pins that path.
++  N2: the chief's fire tool text in `packages/harness/src/tools.mjs`
++  (near :186) doesn't say the fire's job can come back for an answer.
++  Neither changes behaviour. Binds the next row that changes the step G
++  hint text in `broker.mjs` or the fire tool text in `tools.mjs`: fix
++  both wording gaps and pin the hint in a test. (2026-10-22)
++
++- **Row 264a's refusal check in sessions.test doesn't pin the actor.**
++  (Duckworth N1 on the row 264a r12 delta, duckworth-0138; Sage sage-2695.)
++  `refusedOnce` in `packages/bus/tests/sessions.test.mjs` checks that each
++  refused call adds one `action.refused` event with code `not-holder`, but
++  not that the event's `actor_run` is the refused run. Binds row 269 (264b,
++  #1774), or the next row that changes `sessions.test.mjs`: pin `actor_run`
++  in `refusedOnce`. (2026-10-22)
++
++- **editor-provenance skips its rebuild check on esbuild 0.28.1.** (Duckworth
++  N2 on the row 264a manifest round, duckworth-0146.) The webui test
++  "rebuilding from the source gives the same bytes" needs esbuild 0.28.2,
++  the checkout has 0.28.1, and the gate logs a skip (webui.log:99). The file
++  is at base and was not in 264a's manifest. Binds the next gate that
++  touches the webui build: install the pinned esbuild in the gate checkout
++  so the check runs, or record why it can't. (2026-10-22)
++
+ ## Queue
+ 
+ Moved to `docs/plans/QUEUE.md` on 2026-09-13. This file holds only gaps.
+@@ -531,3 +558,10 @@ Moved to `docs/plans/QUEUE.md` on 2026-09-13. This file holds only gaps.
+   `packages/cli/tests/gate-lane-auth.test.mjs` proves no gate step mounts
+   the host default. The real-model cases this moved off the gate are open
+   above.
++- A fired or deleted instance kept its grants (2026-10-22, Dewey on the
++  row 236 rebase look, mos-1271): closed by row 281 (#1786), landing
++  e479521d3. A fire or a delete now runs a step G job that revokes every
++  host and Gitea grant the instance holds, fail closed, and tells the
++  human in the inbox when it can't. Megavolt built it; Dewey approved the
++  design (d6) and the manifest (c30614). The text gaps it left are open
++  above.

agents/gander/work/queue-253/integration-aca1/range-diff-final-hop.txt

@@ -0,0 +1,13 @@
+ 1:  e8b096948 =  1:  730a78aa9 gander: design tester socket migration for host scripts
+ 2:  0d7f9da11 =  2:  643d16528 test: prepare row253 socket fixtures and fix gate collisions
+ 3:  7c1fcbd96 =  3:  6f320b4b0 docs: propose row253 C4 session supervisor and draft hop fake
+ 4:  565302e71 =  4:  62de84882 docs(row253): freeze C4 repair for static review
+ 5:  bcf4e2501 =  5:  c8cca3a68 docs(row253): store repair patch without context whitespace
+ 6:  f2c594d7b =  6:  cca936716 fix(row253): supervise socket queries across sudo sessions
+ 7:  29d5f0d5e =  7:  950cf47f3 fix(row253): bound cleanup retries after initial inventory
+ 8:  e24d7b559 =  8:  3b142c9c6 docs(row253): record static approval and pre-confirmation residual
+ 9:  94c2b76b8 =  9:  ad67d9595 docs(row253): record integration onto refactor 378a76b85
+10:  049088866 = 10:  72b17562d docs(row253): integrate row191 base and refresh manifest
+11:  7916f0ee6 = 11:  e75ef1b19 docs(row253): integrate 385a base and record dependency drift and bounds
+12:  c75c9bbd3 = 12:  cd269e733 docs(row253): record schema3l integration before final base correction
+13:  288cdecf6 = 13:  ed3bb376c docs(row253): preserve doc sweep appends on corrected interim base

agents/gander/work/queue-253/integration-aca1/range-diff-from-d213.txt

@@ -0,0 +1,50 @@
+ 1:  a9c094d06 !  1:  730a78aa9 gander: design tester socket migration for host scripts
+    @@ Commit message
+         gander: design tester socket migration for host scripts
+     
+      ## BUILD-LOG.md ##
+    -@@ BUILD-LOG.md: Before: managed project/thread verbs had no Console conversation area. After: fi
+    - ### 2026-10-22 | Gander | row278 gate run3
+    +@@ BUILD-LOG.md: Fresh gate on3e4c77ac6 under sage-2648: bus793/0, WebUI345/0/1 (esbuild version
+    + 2026-10-22 13:10 UTC | Sage | Rows 278 and 281 LANDED. Before: refactor at 6af85df4b (V502). Row 278 (#1783, Gander, Webby): the Console Agents view shows thread claims in their own section. It landed as 385a7194c at 12:39Z, ff, 9 commits, manifest 8fa859a0. Run 3 was green: bus 793, webui 345/0/1, ten shells 425/0 under the 3x limits (mos-1275), M1-M6 killed. Runs 1 and 2 were void, on fixture fixes 964b6b184 (placed by Sage) and 9696d1fcb (ruled by Mos, mos-1275). Webby approved (c30588, rev 3200). Done rev 3202, #1783 closed c30589. Row 281 (#1786, Megavolt, Dewey): a fire or a delete revokes the instance's host and Gitea grants. It landed as e479521d3 at 13:06Z, ff, 17 commits, manifest b73d4c81. Slot on 7979fb41e: bus 819, business 231, cli 837, dewey-bus 76 with the Docker gitea-grant test, shells green, M1-M22 killed. The M1 hang was fixed at its cause in b4a (mos-1273). Dewey approved (c30614, rev 3207). Done rev 3209, #1786 closed c30621. Skips on both: test-task's row 244 live-provider pair and test-queue's canonical-root check, plus webui's esbuild rebuild test on 278. After: refactor at e479521d3. DEFERRED moves the grant gap to Done and opens Dewey's N1/N2 text gaps. LIVE is still 86f95bb27.
+      
+    - Fresh gate on3e4c77ac6 under sage-2648: bus793/0, WebUI345/0/1 (esbuild version skip), all ten shell files425/0, touched files15/0, M1-M6 killed6/6. No timeout; sweep0 run-created leftovers. Runs1/2 void. Seven-path manifest8fa859a0 goes to Webby for final review. No landing or live change.
+    + 2026-10-22 14:18:23 UTC | Sage | Row 264a LANDED (#1769, Gizmoduck, Duckworth): sessions per thread, schema 3k-3l. Before: refactor at e479521d3 (row 281). It landed as 84f53540d, ff, 21 commits, manifest 257408e9 (Duckworth approve rev 3214, comment 30640). Gate r13 on 2cc34aef8: 20 touched files, bus 827, cli 837, webui 345/1 named skip, ten shells under 3x limits, mutants M1-M4 killed on assertions. Corrections on the way: the kit stopped on first red, so four reds surfaced one at a time. r10 later3l missed a trigger (mos-1276). T2 had failed since r2 because refusals log action.refused (mos-1277, my sage-2257 wording). threads.test:341 kept the old trigger text (mos-1278). M2 was caught by the store trigger before any assertion, so it now drops the trigger too (mos-1279, four files with the SCHEMA_SHA256 pin). Deferred: actor_run pin binds row 269, esbuild skip to a later gate, session-scoped user reply binds row 272. No live change; LIVE is still 86f95bb27.
+     +2026-10-21 21:24:47 UTC | Gander row253 #1758 design r1 | Investigation began21:12Z under sage-2162; recorded now. Before: case2 installer still renders tester TCP and case1 acceptance requires it. After: proposed design covers socket marker migration, actual configured dataRoot within unchanged hardening, target-uid metadata queries, kernel-peer acceptance observation and explicit same-uid residual. Initial inventory saved; no passing final static-check claim, product edit, test, host or live action. Duckworth design review precedes code.
+     
+      ## agents/gander/work/queue-253/BASE-PORT-INVENTORY.json (new) ##
+ 2:  2e81f7872 =  2:  643d16528 test: prepare row253 socket fixtures and fix gate collisions
+ 3:  3c8edc358 =  3:  6f320b4b0 docs: propose row253 C4 session supervisor and draft hop fake
+ 4:  3114087ef =  4:  62de84882 docs(row253): freeze C4 repair for static review
+ 5:  911e470b7 =  5:  c8cca3a68 docs(row253): store repair patch without context whitespace
+ 6:  4a8b5c3ff !  6:  cca936716 fix(row253): supervise socket queries across sudo sessions
+    @@ Commit message
+         fix(row253): supervise socket queries across sudo sessions
+     
+      ## BUILD-LOG.md ##
+    -@@ BUILD-LOG.md: Before: managed project/thread verbs had no Console conversation area. After: fi
+    +@@ BUILD-LOG.md: Fresh gate on3e4c77ac6 under sage-2648: bus793/0, WebUI345/0/1 (esbuild version
+      
+    - Fresh gate on3e4c77ac6 under sage-2648: bus793/0, WebUI345/0/1 (esbuild version skip), all ten shell files425/0, touched files15/0, M1-M6 killed6/6. No timeout; sweep0 run-created leftovers. Runs1/2 void. Seven-path manifest8fa859a0 goes to Webby for final review. No landing or live change.
+    + 2026-10-22 14:18:23 UTC | Sage | Row 264a LANDED (#1769, Gizmoduck, Duckworth): sessions per thread, schema 3k-3l. Before: refactor at e479521d3 (row 281). It landed as 84f53540d, ff, 21 commits, manifest 257408e9 (Duckworth approve rev 3214, comment 30640). Gate r13 on 2cc34aef8: 20 touched files, bus 827, cli 837, webui 345/1 named skip, ten shells under 3x limits, mutants M1-M4 killed on assertions. Corrections on the way: the kit stopped on first red, so four reds surfaced one at a time. r10 later3l missed a trigger (mos-1276). T2 had failed since r2 because refusals log action.refused (mos-1277, my sage-2257 wording). threads.test:341 kept the old trigger text (mos-1278). M2 was caught by the store trigger before any assertion, so it now drops the trigger too (mos-1279, four files with the SCHEMA_SHA256 pin). Deferred: actor_run pin binds row 269, esbuild skip to a later gate, session-scoped user reply binds row 272. No live change; LIVE is still 86f95bb27.
+      2026-10-21 21:24:47 UTC | Gander row253 #1758 design r1 | Investigation began21:12Z under sage-2162; recorded now. Before: case2 installer still renders tester TCP and case1 acceptance requires it. After: proposed design covers socket marker migration, actual configured dataRoot within unchanged hardening, target-uid metadata queries, kernel-peer acceptance observation and explicit same-uid residual. Initial inventory saved; no passing final static-check claim, product edit, test, host or live action. Duckworth design review precedes code.
+     +
+     +### 2026-10-21 row253 implementation prepared, gate pending
+    @@ agents/gander/work/queue-253/MANIFEST.sha256 (new)
+     
+      ## docs/plans/DEFERRED.md ##
+     @@ docs/plans/DEFERRED.md: Moved to `docs/plans/QUEUE.md` on 2026-09-13. This file holds only gaps.
+    -   `packages/cli/tests/gate-lane-auth.test.mjs` proves no gate step mounts
+    -   the host default. The real-model cases this moved off the gate are open
+    +   human in the inbox when it can't. Megavolt built it; Dewey approved the
+    +   design (d6) and the manifest (c30614). The text gaps it left are open
+        above.
+     +
+     +## Row253 F5: legacy Case AS_USER supervision
+ 7:  e18b90e95 =  7:  950cf47f3 fix(row253): bound cleanup retries after initial inventory
+ 8:  677767145 =  8:  3b142c9c6 docs(row253): record static approval and pre-confirmation residual
+ 9:  c733371c5 =  9:  ad67d9595 docs(row253): record integration onto refactor 378a76b85
+10:  141b79c29 = 10:  72b17562d docs(row253): integrate row191 base and refresh manifest
+11:  d213ef651 = 11:  e75ef1b19 docs(row253): integrate 385a base and record dependency drift and bounds
+ -:  --------- > 12:  cd269e733 docs(row253): record schema3l integration before final base correction
+ -:  --------- > 13:  ed3bb376c docs(row253): preserve doc sweep appends on corrected interim base

agents/gander/work/queue-253/integration-aca1/whole-test-union.json

@@ -0,0 +1,29 @@
+[
+  "packages/cli/tests/case1-accept.test.mjs",
+  "packages/cli/tests/case2-unit.test.mjs",
+  "packages/bus/tests/account-migration.test.mjs",
+  "packages/bus/tests/chief-of-staff.test.mjs",
+  "packages/bus/tests/comment-migration.test.mjs",
+  "packages/bus/tests/end-launch.test.mjs",
+  "packages/bus/tests/fire-revokes-grants.test.mjs",
+  "packages/bus/tests/gitea-grant.test.mjs",
+  "packages/bus/tests/gitea-migration.test.mjs",
+  "packages/bus/tests/grant-executor.test.mjs",
+  "packages/bus/tests/grant-migration.test.mjs",
+  "packages/bus/tests/lifecycle-revoke.test.mjs",
+  "packages/bus/tests/message-filter.test.mjs",
+  "packages/bus/tests/name-migration.test.mjs",
+  "packages/bus/tests/schema.test.mjs",
+  "packages/bus/tests/sessions.test.mjs",
+  "packages/bus/tests/spec-migration.test.mjs",
+  "packages/bus/tests/tester-writes.test.mjs",
+  "packages/bus/tests/thread-claims.test.mjs",
+  "packages/bus/tests/thread-migration.test.mjs",
+  "packages/bus/tests/threads.test.mjs",
+  "packages/bus/tests/usage-migration.test.mjs",
+  "packages/cli/tests/lifecycle.test.mjs",
+  "packages/cli/tests/stack-release.test.mjs",
+  "packages/cli/tests/thread-cli.test.mjs",
+  "packages/cli/tests/thread-launch.test.mjs",
+  "packages/webui/tests/chat.test.mjs"
+]

agents/gander/work/queue-253/integration-b789/NOTES.md

@@ -0,0 +1,5 @@
+# Row253 corrected base, pending final docs tip
+
+Sage2700 moves the base tob78918850;2702 says one docs-only Gizmoduck BUILD commit still lands. Rebased on new branch gander/row253-b789, preserving gander/row253-264a. Resolved only BUILD-LOG and DEFERRED append conflicts, keeping every upstream entry first, then253. Both current files retain the full base blobs as exact byte prefixes. No source/test/assertion change.
+
+Source tipc75c9bbd3339cb2343467715a14455044c2e4aea, manifest573c51cf72f2398532a6ea768536f04e3c1681997cb8b9a6f14a8aef884870ae. Six manifest blobs remain identical to the prior integration; DEFERRED absorbs the doc sweep. Runnable blobs match Duckworth-approved preview. The27-file union is unchanged. SHELL-LIMITS and script bytes are unchanged. No tests, Node, syntax execution, queue command, helper push or host action. Hold locally until Sage names final tip; then another rebase, no force-push, and focused CLEAR before any test.

agents/gander/work/queue-253/integration-b789/STATUS.json

@@ -0,0 +1,53 @@
+{
+  "authority": [
+    "sage-2700",
+    "sage-2702"
+  ],
+  "base": "b78918850",
+  "tip": "c75c9bbd3339cb2343467715a14455044c2e4aea",
+  "manifest": "573c51cf72f2398532a6ea768536f04e3c1681997cb8b9a6f14a8aef884870ae",
+  "conflicts": [
+    "BUILD-LOG.md first design append",
+    "docs/plans/DEFERRED.md first F5 append"
+  ],
+  "resolution": "Kept upstream exact byte prefix then appended253; later253 appends replayed. No existing entry edited/dropped.",
+  "unchanged_runnable_paths": [
+    "packages/cli/tests/case-sudo-fixture.mjs",
+    "packages/cli/tests/case1-accept.test.mjs",
+    "packages/cli/tests/case2-unit.test.mjs",
+    "scripts/case1-accept.sh",
+    "scripts/case2-unit.sh"
+  ],
+  "whole_test_files": [
+    "packages/bus/tests/account-migration.test.mjs",
+    "packages/bus/tests/chief-of-staff.test.mjs",
+    "packages/bus/tests/comment-migration.test.mjs",
+    "packages/bus/tests/end-launch.test.mjs",
+    "packages/bus/tests/fire-revokes-grants.test.mjs",
+    "packages/bus/tests/gitea-grant.test.mjs",
+    "packages/bus/tests/gitea-migration.test.mjs",
+    "packages/bus/tests/grant-executor.test.mjs",
+    "packages/bus/tests/grant-migration.test.mjs",
+    "packages/bus/tests/lifecycle-revoke.test.mjs",
+    "packages/bus/tests/message-filter.test.mjs",
+    "packages/bus/tests/name-migration.test.mjs",
+    "packages/bus/tests/schema.test.mjs",
+    "packages/bus/tests/sessions.test.mjs",
+    "packages/bus/tests/spec-migration.test.mjs",
+    "packages/bus/tests/tester-writes.test.mjs",
+    "packages/bus/tests/thread-claims.test.mjs",
+    "packages/bus/tests/thread-migration.test.mjs",
+    "packages/bus/tests/threads.test.mjs",
+    "packages/bus/tests/usage-migration.test.mjs",
+    "packages/cli/tests/case1-accept.test.mjs",
+    "packages/cli/tests/case2-unit.test.mjs",
+    "packages/cli/tests/lifecycle.test.mjs",
+    "packages/cli/tests/stack-release.test.mjs",
+    "packages/cli/tests/thread-cli.test.mjs",
+    "packages/cli/tests/thread-launch.test.mjs",
+    "packages/webui/tests/chat.test.mjs"
+  ],
+  "tests_run": false,
+  "published": false,
+  "next": "Wait final docs-only tip, rebase on a new name, publish when authorized, ask focused CLEAR. No test before CLEAR."
+}

agents/gander/work/queue-253/integration-b789/manifest-drift.diff

@@ -0,0 +1,78 @@
+diff --git a/docs/plans/DEFERRED.md b/docs/plans/DEFERRED.md
+index 4c0c736f1..f990eb3a9 100644
+--- a/docs/plans/DEFERRED.md
++++ b/docs/plans/DEFERRED.md
+@@ -431,17 +431,6 @@ at every gate. Started 2026-09-12 during the control board MVP.
+   comes near 64 runs. The follow-up row either raises the cap or splits
+   the done. Its test: a fire's done over the cap refuses, and the runs it
+   left alive still get the alive flag. (2026-10-22)
+-- **A fired or deleted instance keeps its grants.** (Dewey on the row 236
+-  rebase look, dewey-0815; Mos mos-1271; Sage sage-2558.) Row 194's
+-  `instance.fire` and row 256's delete revoke only the roles entry's
+-  credential services through `revoke()` in `runtime.mjs`. The agent's
+-  host grants (row 235) and its Gitea user and token (row 236) stay live
+-  until a human runs `mosaic hosts revoke` or `mosaic grants revoke`. The
+-  Console has no revoke route and doesn't say a grant is left. Row 281
+-  (#1786) closes it: a fire or a delete revokes every host and Gitea grant
+-  the instance holds, fail closed, with a test for each kind. It lands
+-  before the .53 Case 1 install hires an instance with a grant.
+-  (2026-10-22)
+ 
+ - **The runs suite doesn't gate a change to `scripts/mosaic-task.mjs`.**
+   (Dewey N7 on row 191, repeated on the Vikunja 502 review.)
+@@ -460,6 +449,44 @@ at every gate. Started 2026-09-12 during the control board MVP.
+   changes `packages/cli/tests/tester.test.mjs`: add the resolve pin so M8
+   dies on an assertion. (2026-10-22)
+ 
++- **Row 274's user reply check is scoped to the thread, not the session.**
++  (Row 264a r6, sage-2591.) In `packages/bus/src/broker.mjs`, the check that
++  a run answers a user only in reply to that user's message in its thread
++  joins `message_threads` by thread. That holds while a user's thread has
++  only its default session: a user can't call `session.create`, and
++  `#thread` refuses anyone but the owner. Binds row 272 (264e, #1777), or
++  any row that lets a user add sessions: make the check session-scoped and
++  test it with two sessions. (2026-10-22)
++
++- **Row 281's refusal texts point the wrong way.** (Dewey N1 and N2 on
++  the row 281 manifest round, dewey-0842/0843 and dewey-0846; Sage
++  sage-2653.) N1: when a host decision is still open and the host is
++  removed, step G's fire or delete job refuses `host-unknown`, and the
++  inbox hint names a verb that can't help. The way out is to decline or
++  withdraw the decision (`packages/bus/src/broker.mjs`, the closed check
++  near :1684 and `decision.withdraw` near :5015). T14 now pins that path.
++  N2: the chief's fire tool text in `packages/harness/src/tools.mjs`
++  (near :186) doesn't say the fire's job can come back for an answer.
++  Neither changes behaviour. Binds the next row that changes the step G
++  hint text in `broker.mjs` or the fire tool text in `tools.mjs`: fix
++  both wording gaps and pin the hint in a test. (2026-10-22)
++
++- **Row 264a's refusal check in sessions.test doesn't pin the actor.**
++  (Duckworth N1 on the row 264a r12 delta, duckworth-0138; Sage sage-2695.)
++  `refusedOnce` in `packages/bus/tests/sessions.test.mjs` checks that each
++  refused call adds one `action.refused` event with code `not-holder`, but
++  not that the event's `actor_run` is the refused run. Binds row 269 (264b,
++  #1774), or the next row that changes `sessions.test.mjs`: pin `actor_run`
++  in `refusedOnce`. (2026-10-22)
++
++- **editor-provenance skips its rebuild check on esbuild 0.28.1.** (Duckworth
++  N2 on the row 264a manifest round, duckworth-0146.) The webui test
++  "rebuilding from the source gives the same bytes" needs esbuild 0.28.2,
++  the checkout has 0.28.1, and the gate logs a skip (webui.log:99). The file
++  is at base and was not in 264a's manifest. Binds the next gate that
++  touches the webui build: install the pinned esbuild in the gate checkout
++  so the check runs, or record why it can't. (2026-10-22)
++
+ ## Queue
+ 
+ Moved to `docs/plans/QUEUE.md` on 2026-09-13. This file holds only gaps.
+@@ -531,3 +558,10 @@ Moved to `docs/plans/QUEUE.md` on 2026-09-13. This file holds only gaps.
+   `packages/cli/tests/gate-lane-auth.test.mjs` proves no gate step mounts
+   the host default. The real-model cases this moved off the gate are open
+   above.
++- A fired or deleted instance kept its grants (2026-10-22, Dewey on the
++  row 236 rebase look, mos-1271): closed by row 281 (#1786), landing
++  e479521d3. A fire or a delete now runs a step G job that revokes every
++  host and Gitea grant the instance holds, fail closed, and tells the
++  human in the inbox when it can't. Megavolt built it; Dewey approved the
++  design (d6) and the manifest (c30614). The text gaps it left are open
++  above.

agents/gander/work/queue-253/integration-b789/range-diff-from-264a.txt

@@ -0,0 +1,49 @@
+ 1:  0c44ba7c4 !  1:  e8b096948 gander: design tester socket migration for host scripts
+    @@ Commit message
+         gander: design tester socket migration for host scripts
+     
+      ## BUILD-LOG.md ##
+    -@@ BUILD-LOG.md: Before: managed project/thread verbs had no Console conversation area. After: fi
+    - ### 2026-10-22 | Gander | row278 gate run3
+    +@@ BUILD-LOG.md: Fresh gate on3e4c77ac6 under sage-2648: bus793/0, WebUI345/0/1 (esbuild version
+    + 2026-10-22 13:10 UTC | Sage | Rows 278 and 281 LANDED. Before: refactor at 6af85df4b (V502). Row 278 (#1783, Gander, Webby): the Console Agents view shows thread claims in their own section. It landed as 385a7194c at 12:39Z, ff, 9 commits, manifest 8fa859a0. Run 3 was green: bus 793, webui 345/0/1, ten shells 425/0 under the 3x limits (mos-1275), M1-M6 killed. Runs 1 and 2 were void, on fixture fixes 964b6b184 (placed by Sage) and 9696d1fcb (ruled by Mos, mos-1275). Webby approved (c30588, rev 3200). Done rev 3202, #1783 closed c30589. Row 281 (#1786, Megavolt, Dewey): a fire or a delete revokes the instance's host and Gitea grants. It landed as e479521d3 at 13:06Z, ff, 17 commits, manifest b73d4c81. Slot on 7979fb41e: bus 819, business 231, cli 837, dewey-bus 76 with the Docker gitea-grant test, shells green, M1-M22 killed. The M1 hang was fixed at its cause in b4a (mos-1273). Dewey approved (c30614, rev 3207). Done rev 3209, #1786 closed c30621. Skips on both: test-task's row 244 live-provider pair and test-queue's canonical-root check, plus webui's esbuild rebuild test on 278. After: refactor at e479521d3. DEFERRED moves the grant gap to Done and opens Dewey's N1/N2 text gaps. LIVE is still 86f95bb27.
+      
+    - Fresh gate on3e4c77ac6 under sage-2648: bus793/0, WebUI345/0/1 (esbuild version skip), all ten shell files425/0, touched files15/0, M1-M6 killed6/6. No timeout; sweep0 run-created leftovers. Runs1/2 void. Seven-path manifest8fa859a0 goes to Webby for final review. No landing or live change.
+    + 2026-10-22 14:18:23 UTC | Sage | Row 264a LANDED (#1769, Gizmoduck, Duckworth): sessions per thread, schema 3k-3l. Before: refactor at e479521d3 (row 281). It landed as 84f53540d, ff, 21 commits, manifest 257408e9 (Duckworth approve rev 3214, comment 30640). Gate r13 on 2cc34aef8: 20 touched files, bus 827, cli 837, webui 345/1 named skip, ten shells under 3x limits, mutants M1-M4 killed on assertions. Corrections on the way: the kit stopped on first red, so four reds surfaced one at a time. r10 later3l missed a trigger (mos-1276). T2 had failed since r2 because refusals log action.refused (mos-1277, my sage-2257 wording). threads.test:341 kept the old trigger text (mos-1278). M2 was caught by the store trigger before any assertion, so it now drops the trigger too (mos-1279, four files with the SCHEMA_SHA256 pin). Deferred: actor_run pin binds row 269, esbuild skip to a later gate, session-scoped user reply binds row 272. No live change; LIVE is still 86f95bb27.
+     +2026-10-21 21:24:47 UTC | Gander row253 #1758 design r1 | Investigation began21:12Z under sage-2162; recorded now. Before: case2 installer still renders tester TCP and case1 acceptance requires it. After: proposed design covers socket marker migration, actual configured dataRoot within unchanged hardening, target-uid metadata queries, kernel-peer acceptance observation and explicit same-uid residual. Initial inventory saved; no passing final static-check claim, product edit, test, host or live action. Duckworth design review precedes code.
+     
+      ## agents/gander/work/queue-253/BASE-PORT-INVENTORY.json (new) ##
+ 2:  a1f3b4f31 =  2:  0d7f9da11 test: prepare row253 socket fixtures and fix gate collisions
+ 3:  1ecc23eb1 =  3:  7c1fcbd96 docs: propose row253 C4 session supervisor and draft hop fake
+ 4:  18523ce92 =  4:  565302e71 docs(row253): freeze C4 repair for static review
+ 5:  7450fb712 =  5:  bcf4e2501 docs(row253): store repair patch without context whitespace
+ 6:  d202f6d63 !  6:  f2c594d7b fix(row253): supervise socket queries across sudo sessions
+    @@ Commit message
+         fix(row253): supervise socket queries across sudo sessions
+     
+      ## BUILD-LOG.md ##
+    -@@ BUILD-LOG.md: Before: managed project/thread verbs had no Console conversation area. After: fi
+    +@@ BUILD-LOG.md: Fresh gate on3e4c77ac6 under sage-2648: bus793/0, WebUI345/0/1 (esbuild version
+      
+    - Fresh gate on3e4c77ac6 under sage-2648: bus793/0, WebUI345/0/1 (esbuild version skip), all ten shell files425/0, touched files15/0, M1-M6 killed6/6. No timeout; sweep0 run-created leftovers. Runs1/2 void. Seven-path manifest8fa859a0 goes to Webby for final review. No landing or live change.
+    + 2026-10-22 14:18:23 UTC | Sage | Row 264a LANDED (#1769, Gizmoduck, Duckworth): sessions per thread, schema 3k-3l. Before: refactor at e479521d3 (row 281). It landed as 84f53540d, ff, 21 commits, manifest 257408e9 (Duckworth approve rev 3214, comment 30640). Gate r13 on 2cc34aef8: 20 touched files, bus 827, cli 837, webui 345/1 named skip, ten shells under 3x limits, mutants M1-M4 killed on assertions. Corrections on the way: the kit stopped on first red, so four reds surfaced one at a time. r10 later3l missed a trigger (mos-1276). T2 had failed since r2 because refusals log action.refused (mos-1277, my sage-2257 wording). threads.test:341 kept the old trigger text (mos-1278). M2 was caught by the store trigger before any assertion, so it now drops the trigger too (mos-1279, four files with the SCHEMA_SHA256 pin). Deferred: actor_run pin binds row 269, esbuild skip to a later gate, session-scoped user reply binds row 272. No live change; LIVE is still 86f95bb27.
+      2026-10-21 21:24:47 UTC | Gander row253 #1758 design r1 | Investigation began21:12Z under sage-2162; recorded now. Before: case2 installer still renders tester TCP and case1 acceptance requires it. After: proposed design covers socket marker migration, actual configured dataRoot within unchanged hardening, target-uid metadata queries, kernel-peer acceptance observation and explicit same-uid residual. Initial inventory saved; no passing final static-check claim, product edit, test, host or live action. Duckworth design review precedes code.
+     +
+     +### 2026-10-21 row253 implementation prepared, gate pending
+    @@ agents/gander/work/queue-253/MANIFEST.sha256 (new)
+     
+      ## docs/plans/DEFERRED.md ##
+     @@ docs/plans/DEFERRED.md: Moved to `docs/plans/QUEUE.md` on 2026-09-13. This file holds only gaps.
+    -   `packages/cli/tests/gate-lane-auth.test.mjs` proves no gate step mounts
+    -   the host default. The real-model cases this moved off the gate are open
+    +   human in the inbox when it can't. Megavolt built it; Dewey approved the
+    +   design (d6) and the manifest (c30614). The text gaps it left are open
+        above.
+     +
+     +## Row253 F5: legacy Case AS_USER supervision
+ 7:  37c97b41d =  7:  29d5f0d5e fix(row253): bound cleanup retries after initial inventory
+ 8:  7bca9b042 =  8:  e24d7b559 docs(row253): record static approval and pre-confirmation residual
+ 9:  3a2022038 =  9:  94c2b76b8 docs(row253): record integration onto refactor 378a76b85
+10:  614bdc8e9 = 10:  049088866 docs(row253): integrate row191 base and refresh manifest
+11:  b9d3d4c75 = 11:  7916f0ee6 docs(row253): integrate 385a base and record dependency drift and bounds
+12:  2c383ef65 = 12:  c75c9bbd3 docs(row253): record schema3l integration before final base correction

agents/gander/work/queue-253/integration-b789/range-diff.txt

@@ -0,0 +1,49 @@
+ 1:  a9c094d06 !  1:  e8b096948 gander: design tester socket migration for host scripts
+    @@ Commit message
+         gander: design tester socket migration for host scripts
+     
+      ## BUILD-LOG.md ##
+    -@@ BUILD-LOG.md: Before: managed project/thread verbs had no Console conversation area. After: fi
+    - ### 2026-10-22 | Gander | row278 gate run3
+    +@@ BUILD-LOG.md: Fresh gate on3e4c77ac6 under sage-2648: bus793/0, WebUI345/0/1 (esbuild version
+    + 2026-10-22 13:10 UTC | Sage | Rows 278 and 281 LANDED. Before: refactor at 6af85df4b (V502). Row 278 (#1783, Gander, Webby): the Console Agents view shows thread claims in their own section. It landed as 385a7194c at 12:39Z, ff, 9 commits, manifest 8fa859a0. Run 3 was green: bus 793, webui 345/0/1, ten shells 425/0 under the 3x limits (mos-1275), M1-M6 killed. Runs 1 and 2 were void, on fixture fixes 964b6b184 (placed by Sage) and 9696d1fcb (ruled by Mos, mos-1275). Webby approved (c30588, rev 3200). Done rev 3202, #1783 closed c30589. Row 281 (#1786, Megavolt, Dewey): a fire or a delete revokes the instance's host and Gitea grants. It landed as e479521d3 at 13:06Z, ff, 17 commits, manifest b73d4c81. Slot on 7979fb41e: bus 819, business 231, cli 837, dewey-bus 76 with the Docker gitea-grant test, shells green, M1-M22 killed. The M1 hang was fixed at its cause in b4a (mos-1273). Dewey approved (c30614, rev 3207). Done rev 3209, #1786 closed c30621. Skips on both: test-task's row 244 live-provider pair and test-queue's canonical-root check, plus webui's esbuild rebuild test on 278. After: refactor at e479521d3. DEFERRED moves the grant gap to Done and opens Dewey's N1/N2 text gaps. LIVE is still 86f95bb27.
+      
+    - Fresh gate on3e4c77ac6 under sage-2648: bus793/0, WebUI345/0/1 (esbuild version skip), all ten shell files425/0, touched files15/0, M1-M6 killed6/6. No timeout; sweep0 run-created leftovers. Runs1/2 void. Seven-path manifest8fa859a0 goes to Webby for final review. No landing or live change.
+    + 2026-10-22 14:18:23 UTC | Sage | Row 264a LANDED (#1769, Gizmoduck, Duckworth): sessions per thread, schema 3k-3l. Before: refactor at e479521d3 (row 281). It landed as 84f53540d, ff, 21 commits, manifest 257408e9 (Duckworth approve rev 3214, comment 30640). Gate r13 on 2cc34aef8: 20 touched files, bus 827, cli 837, webui 345/1 named skip, ten shells under 3x limits, mutants M1-M4 killed on assertions. Corrections on the way: the kit stopped on first red, so four reds surfaced one at a time. r10 later3l missed a trigger (mos-1276). T2 had failed since r2 because refusals log action.refused (mos-1277, my sage-2257 wording). threads.test:341 kept the old trigger text (mos-1278). M2 was caught by the store trigger before any assertion, so it now drops the trigger too (mos-1279, four files with the SCHEMA_SHA256 pin). Deferred: actor_run pin binds row 269, esbuild skip to a later gate, session-scoped user reply binds row 272. No live change; LIVE is still 86f95bb27.
+     +2026-10-21 21:24:47 UTC | Gander row253 #1758 design r1 | Investigation began21:12Z under sage-2162; recorded now. Before: case2 installer still renders tester TCP and case1 acceptance requires it. After: proposed design covers socket marker migration, actual configured dataRoot within unchanged hardening, target-uid metadata queries, kernel-peer acceptance observation and explicit same-uid residual. Initial inventory saved; no passing final static-check claim, product edit, test, host or live action. Duckworth design review precedes code.
+     
+      ## agents/gander/work/queue-253/BASE-PORT-INVENTORY.json (new) ##
+ 2:  2e81f7872 =  2:  0d7f9da11 test: prepare row253 socket fixtures and fix gate collisions
+ 3:  3c8edc358 =  3:  7c1fcbd96 docs: propose row253 C4 session supervisor and draft hop fake
+ 4:  3114087ef =  4:  565302e71 docs(row253): freeze C4 repair for static review
+ 5:  911e470b7 =  5:  bcf4e2501 docs(row253): store repair patch without context whitespace
+ 6:  4a8b5c3ff !  6:  f2c594d7b fix(row253): supervise socket queries across sudo sessions
+    @@ Commit message
+         fix(row253): supervise socket queries across sudo sessions
+     
+      ## BUILD-LOG.md ##
+    -@@ BUILD-LOG.md: Before: managed project/thread verbs had no Console conversation area. After: fi
+    +@@ BUILD-LOG.md: Fresh gate on3e4c77ac6 under sage-2648: bus793/0, WebUI345/0/1 (esbuild version
+      
+    - Fresh gate on3e4c77ac6 under sage-2648: bus793/0, WebUI345/0/1 (esbuild version skip), all ten shell files425/0, touched files15/0, M1-M6 killed6/6. No timeout; sweep0 run-created leftovers. Runs1/2 void. Seven-path manifest8fa859a0 goes to Webby for final review. No landing or live change.
+    + 2026-10-22 14:18:23 UTC | Sage | Row 264a LANDED (#1769, Gizmoduck, Duckworth): sessions per thread, schema 3k-3l. Before: refactor at e479521d3 (row 281). It landed as 84f53540d, ff, 21 commits, manifest 257408e9 (Duckworth approve rev 3214, comment 30640). Gate r13 on 2cc34aef8: 20 touched files, bus 827, cli 837, webui 345/1 named skip, ten shells under 3x limits, mutants M1-M4 killed on assertions. Corrections on the way: the kit stopped on first red, so four reds surfaced one at a time. r10 later3l missed a trigger (mos-1276). T2 had failed since r2 because refusals log action.refused (mos-1277, my sage-2257 wording). threads.test:341 kept the old trigger text (mos-1278). M2 was caught by the store trigger before any assertion, so it now drops the trigger too (mos-1279, four files with the SCHEMA_SHA256 pin). Deferred: actor_run pin binds row 269, esbuild skip to a later gate, session-scoped user reply binds row 272. No live change; LIVE is still 86f95bb27.
+      2026-10-21 21:24:47 UTC | Gander row253 #1758 design r1 | Investigation began21:12Z under sage-2162; recorded now. Before: case2 installer still renders tester TCP and case1 acceptance requires it. After: proposed design covers socket marker migration, actual configured dataRoot within unchanged hardening, target-uid metadata queries, kernel-peer acceptance observation and explicit same-uid residual. Initial inventory saved; no passing final static-check claim, product edit, test, host or live action. Duckworth design review precedes code.
+     +
+     +### 2026-10-21 row253 implementation prepared, gate pending
+    @@ agents/gander/work/queue-253/MANIFEST.sha256 (new)
+     
+      ## docs/plans/DEFERRED.md ##
+     @@ docs/plans/DEFERRED.md: Moved to `docs/plans/QUEUE.md` on 2026-09-13. This file holds only gaps.
+    -   `packages/cli/tests/gate-lane-auth.test.mjs` proves no gate step mounts
+    -   the host default. The real-model cases this moved off the gate are open
+    +   human in the inbox when it can't. Megavolt built it; Dewey approved the
+    +   design (d6) and the manifest (c30614). The text gaps it left are open
+        above.
+     +
+     +## Row253 F5: legacy Case AS_USER supervision
+ 7:  e18b90e95 =  7:  29d5f0d5e fix(row253): bound cleanup retries after initial inventory
+ 8:  677767145 =  8:  e24d7b559 docs(row253): record static approval and pre-confirmation residual
+ 9:  c733371c5 =  9:  94c2b76b8 docs(row253): record integration onto refactor 378a76b85
+10:  141b79c29 = 10:  049088866 docs(row253): integrate row191 base and refresh manifest
+11:  d213ef651 = 11:  7916f0ee6 docs(row253): integrate 385a base and record dependency drift and bounds
+ -:  --------- > 12:  c75c9bbd3 docs(row253): record schema3l integration before final base correction

agents/gander/work/queue-253/integration-b789/whole-test-union.json

@@ -0,0 +1,29 @@
+[
+  "packages/bus/tests/account-migration.test.mjs",
+  "packages/bus/tests/chief-of-staff.test.mjs",
+  "packages/bus/tests/comment-migration.test.mjs",
+  "packages/bus/tests/end-launch.test.mjs",
+  "packages/bus/tests/fire-revokes-grants.test.mjs",
+  "packages/bus/tests/gitea-grant.test.mjs",
+  "packages/bus/tests/gitea-migration.test.mjs",
+  "packages/bus/tests/grant-executor.test.mjs",
+  "packages/bus/tests/grant-migration.test.mjs",
+  "packages/bus/tests/lifecycle-revoke.test.mjs",
+  "packages/bus/tests/message-filter.test.mjs",
+  "packages/bus/tests/name-migration.test.mjs",
+  "packages/bus/tests/schema.test.mjs",
+  "packages/bus/tests/sessions.test.mjs",
+  "packages/bus/tests/spec-migration.test.mjs",
+  "packages/bus/tests/tester-writes.test.mjs",
+  "packages/bus/tests/thread-claims.test.mjs",
+  "packages/bus/tests/thread-migration.test.mjs",
+  "packages/bus/tests/threads.test.mjs",
+  "packages/bus/tests/usage-migration.test.mjs",
+  "packages/cli/tests/case1-accept.test.mjs",
+  "packages/cli/tests/case2-unit.test.mjs",
+  "packages/cli/tests/lifecycle.test.mjs",
+  "packages/cli/tests/stack-release.test.mjs",
+  "packages/cli/tests/thread-cli.test.mjs",
+  "packages/cli/tests/thread-launch.test.mjs",
+  "packages/webui/tests/chat.test.mjs"
+]

agents/gander/work/queue-253/repair-1297/COMMIT-MESSAGE.txt

@@ -0,0 +1,13 @@
+test(row253): expose peer failures and pin reasons (mos-1297)
+
+The peer-output fixture execs isolated system Python to write its exact bytes
+and exit with peer-status. This avoids masking parser/status faults behind the
+supervisor session check. All17 faults assert an exact reason with a delimiter;
+every existing assertion remains. No product change or timing delay.
+
+Old packages/cli/tests/case1-accept.test.mjs:100:
+const PYTHON_STUB = `[ -f "$HC/peer-output" ] && { cat "$HC/peer-output"; exit "$(cat "$HC/peer-status")"; }
+
+Diagnostic under sage-2752 found probe-inner-session for malformed output and
+nonzero exit. Mos confirmed the fixture mask and authorized this repair.
+No tests ran after the repair; Duckworth review and fresh whole gate follow.

agents/gander/work/queue-253/repair-1297/NOTES.md

@@ -0,0 +1,11 @@
+# Row253 mos1297 repair candidate
+
+Source 362ec674c9e7aa8cef0c26f4d7448f459171dbd4, baseaca16404c. Manifest a2ac57342d9c59ddaebddade0fa475a9568719fed50c132bd7bb141167c7e72e. Only case1-accept.test.mjs changes among the seven entries. No product script, shared fixture, other test or policy change. Source commit names mos1297 and quotes the exact old first line of PYTHON_STUB at0604:100.
+
+One stub-line change only: when peer-output exists, exec /usr/bin/python3 -I -S, write that file's exact bytes to stdout and exit with peer-status. No fixed delay. All other stub lines remain byte-identical. The healthy Python path remains unchanged. This removes the confirmed instant-shell-exit mask while retaining the fixture's intended output/status fault.
+
+Add a17-entry expected-reason map, taken from the accepted diagnostic-a/EXPECTED-REASONS draft, and one exact reason assertion per iteration. The new regex anchors the P10 line and requires the following space, so reason=probe does not accept probe-* codes. Every original status, boundary=failed and no-boundary=observed assertion line remains. peer-malformed=probe; peer-error=probe-inner-command. STATIC-PRESERVATION.json checks all old assertion lines remain and that the overflow/peer-hang bodies are byte-identical. No change to the peer-hang loose prefix. No result is claimed for the new code.
+
+The original single diagnostic remains in diagnostic-a/. It observed15matches and2probe-inner-session mismatches on0604. Mos confirmed the source of that mask with their own no-Node supervisor controls, and authorized this fixture-only repair. Real fast-exit product behavior is post10-27 Vikunja532, with Sage owning its DEFERRED entry; no product repair or DEFERRED edit here.
+
+Next: new manifest to Duckworth, then a complete whole gate from the start under Sage CLEAR, no carry from any old run. Both17-fault reasons must match the drafted oracle. The C4 overflow test must still give reason=probe-output-limit. The named P10 test must killM21 on assertions. If M21 survives or either reason differs, stop to Mos before anything else changes. All other existing gates/limits and exact restores stand. No Node, syntax test, payload experiment or repaired test run occurred after the change.

agents/gander/work/queue-253/repair-1297/REPAIR.diff

@@ -0,0 +1,45 @@
+diff --git a/packages/cli/tests/case1-accept.test.mjs b/packages/cli/tests/case1-accept.test.mjs
+index 5baddb646..b2673c325 100644
+--- a/packages/cli/tests/case1-accept.test.mjs
++++ b/packages/cli/tests/case1-accept.test.mjs
+@@ -97,7 +97,7 @@ const NODE_STUB = `[ "$HOME" = "$ROOT_DIR/srv/mosaic" ] || touch "$HC/node-as-ro
+ [ "\${1:-}" = --version ] && { cat "$HC/node-version"; exit 0; }
+ exec "$REAL_NODE" "$@"`;
+ // The real Python payload runs against a mock socket object, never an OS listener.
+-const PYTHON_STUB = `[ -f "$HC/peer-output" ] && { cat "$HC/peer-output"; exit "$(cat "$HC/peer-status")"; }
++const PYTHON_STUB = `[ -f "$HC/peer-output" ] && exec /usr/bin/python3 -I -S -c 'import os,sys; root=os.environ["HC"]; sys.stdout.buffer.write(open(root+"/peer-output","rb").read()); sys.exit(int(open(root+"/peer-status").read()))'
+ [ -f "$HC/peer-hang" ] && {
+  here="$BASHPID"; read -r sid < <(/bin/ps -o sid= -p "$here")
+  echo "$here" > "$HC/peer-pid"; printf '%s %s\\n' "$here" "$sid" >> "$HC/query-pids"
+@@ -260,11 +260,31 @@ test('row253 P10 refuses unsafe metadata, wrong peers and an unsafe Python witho
+     'changed-pid':h=>put(join(h.hc,'peer-pid-change'),'ActiveState=active\nUser=mosaic\nMainPID=201\n'),
+     floor:h=>put(join(h.root,'proc/sys/net/ipv4/ip_unprivileged_port_start'),'700\n'),
+   };
++  const reasons = {
++    "parent-mode": "metadata",
++    "parent-owner": "metadata",
++    "socket-mode": "metadata",
++    "socket-owner": "metadata",
++    "socket-type": "metadata",
++    "symlink": "metadata",
++    "peer": "peer",
++    "peer-pid": "peer",
++    "python-mode": "interpreter",
++    "python-missing": "interpreter",
++    "python-not-elf": "interpreter",
++    "peer-malformed": "probe",
++    "peer-error": "probe-inner-command",
++    "peer-uid-fields": "metadata",
++    "changed-inode": "changed",
++    "changed-pid": "changed",
++    "floor": "floor",
++  };
+   for(const [name,fault] of Object.entries(faults)){
+     const h=host(t);fault(h);const r=run(h);
+     assert.equal(r.status,name==='peer-uid-fields'?1:0,`${name}: ${r.out}${r.err}`);
+     assert.match(r.out,/P10 tester-socket-squat unnamed boundary=failed/,name);
+     assert.doesNotMatch(r.out,/boundary=observed/,name);
++    assert.match(r.out,new RegExp('^P10 tester-socket-squat unnamed boundary=failed reason='+reasons[name]+' ', 'm'),name);
+   }
+ });
+ 

agents/gander/work/queue-253/repair-1297/SOURCE.json

@@ -0,0 +1,22 @@
+{
+  "authority": "mos-1297",
+  "source_commit": "362ec674c9e7aa8cef0c26f4d7448f459171dbd4",
+  "base": "aca16404cf522b03f39acaf140e4f6185a507b88",
+  "previous_product": "0604d91fcfc1949810cd5321aea6ec43e9b74b4b",
+  "previous_manifest": "573c51cf72f2398532a6ea768536f04e3c1681997cb8b9a6f14a8aef884870ae",
+  "manifest": "a2ac57342d9c59ddaebddade0fa475a9568719fed50c132bd7bb141167c7e72e",
+  "changed_manifest_paths": [
+    "packages/cli/tests/case1-accept.test.mjs"
+  ],
+  "hashes": {
+    "docs/plans/DEFERRED.md": "f8ad28aa8dc0f12b2c6dddb3b5dc805da05a97c7723e0525905456c064d0cfa3",
+    "packages/cli/tests/case-sudo-fixture.mjs": "b259b8c7926e49829c8a956674021cb0cc85ddd65aebdc786d05cc08d7790008",
+    "packages/cli/tests/case1-accept.test.mjs": "27378eb1297dc6115b4b1ce849de6ffdb3adccf5249783106fa0570c9d696e8a",
+    "packages/cli/tests/case2-unit.test.mjs": "1e0696eb196e83a0766b433ef71f27df0a3f8fcb6399787ab8c1c0f05c54dc44",
+    "packages/webui/README.md": "ce9054060867120798c6b26737ac7d910d8cfbc7aa4ad614f4295619c7605e46",
+    "scripts/case1-accept.sh": "c02bef6b3495e5a4548d7b4e89675ed52be26a0c9ccce4d9d5cfc5fe2ce437bd",
+    "scripts/case2-unit.sh": "d7670bdb049ae41ba3774fc83de633636859b6723be858cfb31ea106b0e8812b"
+  },
+  "tests_run": false,
+  "gate": "Entire whole gate from start, no carry. M21 must be assertion-killed by named P10 test; malformed/error reasons must match draft or stop to Mos before any further change."
+}

agents/gander/work/queue-253/repair-1297/STATIC-PRESERVATION.json

@@ -0,0 +1,14 @@
+{
+  "authority": "mos-1297",
+  "changed_test": "packages/cli/tests/case1-accept.test.mjs",
+  "old_assertion_lines": 121,
+  "all_old_assertions_preserved": true,
+  "new_assertions": [
+    "    assert.match(r.out,new RegExp('^P10 tester-socket-squat unnamed boundary=failed reason='+reasons[name]+' ', 'm'),name);"
+  ],
+  "stub_first_line_only": true,
+  "overflow_tests_byte_identical": true,
+  "peer_hang_test_byte_identical": true,
+  "expected_reason_count": 17,
+  "tests_run": false
+}

agents/gander/work/queue-253/repair-1298/NOTES.md

@@ -0,0 +1,3 @@
+# mos-1298 candidate
+
+Source 14e46006171ef700a72f971fda5cb3a0b8dcc4f2; manifest 591020a1096a1606c11f2ee34b37243acddf83d91c69922ccc5cfe22d6180d3a. Two inserted lines read the first query-pids record as numbers and assert PID equals SID, inside the existing per-kind/per-mode loop. All prior test bytes remain. Both product scripts match e1bc766d8 exactly. BUILD.md and c4/REPAIR-README.md correct the M38 kill rule. No execution since the stop; fresh whole gate after review and CLEAR, no carry.

agents/gander/work/queue-253/repair-1298/REPAIR.diff

@@ -0,0 +1,13 @@
+diff --git a/packages/cli/tests/case2-unit.test.mjs b/packages/cli/tests/case2-unit.test.mjs
+index 834f8d848..78dd77721 100644
+--- a/packages/cli/tests/case2-unit.test.mjs
++++ b/packages/cli/tests/case2-unit.test.mjs
+@@ -199,6 +199,8 @@ for(const kind of ['sleep','signals','member']) test(`row253 C4 ${kind} query ha
+   const capture=cleanupFixture(t,files);const stopGuard=fixtureGuard(t,files);
+   const start=performance.now(),r=unit(h,{profile:'factory'}),seconds=(performance.now()-start)/1000;capture();
+   refuses(r,/^case2-unit: tester config query inner-timeout\n$/);
++  const [queryPid,querySid]=read(queries).trim().split('\n')[0].trim().split(/\s+/).map(Number);
++  assert.equal(queryPid,querySid,`${kind}/${mode}: direct query PID must equal its kernel SID`);
+   assert.ok(seconds<7,`${kind}/${mode}: ${seconds}s exceeds outer bound`);
+   assert.deepEqual(await pollFixtureGone(files),[],mode);
+   if(kind==='member')assert.ok(read(proof).includes('('+member.split('/').at(-1)+') '),'member comm with newline and closing parenthesis was observed');

agents/gander/work/queue-253/repair-1298/SOURCE.json

@@ -0,0 +1,20 @@
+{
+  "source": "14e46006171ef700a72f971fda5cb3a0b8dcc4f2",
+  "previous": "e1bc766d87a0c6b8894aff93a221315a044cb36a",
+  "manifest": "591020a1096a1606c11f2ee34b37243acddf83d91c69922ccc5cfe22d6180d3a",
+  "paths": {
+    "docs/plans/DEFERRED.md": "f8ad28aa8dc0f12b2c6dddb3b5dc805da05a97c7723e0525905456c064d0cfa3",
+    "packages/cli/tests/case-sudo-fixture.mjs": "b259b8c7926e49829c8a956674021cb0cc85ddd65aebdc786d05cc08d7790008",
+    "packages/cli/tests/case1-accept.test.mjs": "27378eb1297dc6115b4b1ce849de6ffdb3adccf5249783106fa0570c9d696e8a",
+    "packages/cli/tests/case2-unit.test.mjs": "9ca67403d8614266061624ab5fbf4ea8e8a54cbd08f5b569c95592ab5ed40472",
+    "packages/webui/README.md": "ce9054060867120798c6b26737ac7d910d8cfbc7aa4ad614f4295619c7605e46",
+    "scripts/case1-accept.sh": "c02bef6b3495e5a4548d7b4e89675ed52be26a0c9ccce4d9d5cfc5fe2ce437bd",
+    "scripts/case2-unit.sh": "d7670bdb049ae41ba3774fc83de633636859b6723be858cfb31ea106b0e8812b"
+  },
+  "existing_test_lines_byte_identical": true,
+  "scripts_unchanged": {
+    "scripts/case1-accept.sh": "c02bef6b3495e5a4548d7b4e89675ed52be26a0c9ccce4d9d5cfc5fe2ce437bd",
+    "scripts/case2-unit.sh": "d7670bdb049ae41ba3774fc83de633636859b6723be858cfb31ea106b0e8812b"
+  },
+  "execution": "No test, Node preflight or experiment run; pending Duckworth review and Sage CLEAR"
+}

agents/gander/work/queue-253/run3-focused/MEASURED-FILE-LIMITS.json

@@ -0,0 +1,164 @@
+{
+  "packages/cli/tests/case1-accept.test.mjs": {
+    "recorded_seconds": 99.281,
+    "receipt": "agents/gander/work/queue-253/run3-focused/files/01.log",
+    "next_limit_seconds": 418,
+    "derivation": "ceil(3*measured whole-file seconds)+120"
+  },
+  "packages/cli/tests/case2-unit.test.mjs": {
+    "recorded_seconds": 66.418,
+    "receipt": "agents/gander/work/queue-253/run3-focused/files/02.log",
+    "next_limit_seconds": 320,
+    "derivation": "ceil(3*measured whole-file seconds)+120"
+  },
+  "packages/bus/tests/account-migration.test.mjs": {
+    "recorded_seconds": 0.415,
+    "receipt": "agents/gander/work/queue-253/run3-focused/files/03.log",
+    "next_limit_seconds": 122,
+    "derivation": "ceil(3*measured whole-file seconds)+120"
+  },
+  "packages/bus/tests/chief-of-staff.test.mjs": {
+    "recorded_seconds": 2.168,
+    "receipt": "agents/gander/work/queue-253/run3-focused/files/04.log",
+    "next_limit_seconds": 127,
+    "derivation": "ceil(3*measured whole-file seconds)+120"
+  },
+  "packages/bus/tests/comment-migration.test.mjs": {
+    "recorded_seconds": 0.565,
+    "receipt": "agents/gander/work/queue-253/run3-focused/files/05.log",
+    "next_limit_seconds": 122,
+    "derivation": "ceil(3*measured whole-file seconds)+120"
+  },
+  "packages/bus/tests/end-launch.test.mjs": {
+    "recorded_seconds": 0.415,
+    "receipt": "agents/gander/work/queue-253/run3-focused/files/06.log",
+    "next_limit_seconds": 122,
+    "derivation": "ceil(3*measured whole-file seconds)+120"
+  },
+  "packages/bus/tests/fire-revokes-grants.test.mjs": {
+    "recorded_seconds": 3.271,
+    "receipt": "agents/gander/work/queue-253/run3-focused/files/07.log",
+    "next_limit_seconds": 130,
+    "derivation": "ceil(3*measured whole-file seconds)+120"
+  },
+  "packages/bus/tests/gitea-grant.test.mjs": {
+    "recorded_seconds": 8.634,
+    "receipt": "agents/gander/work/queue-253/run3-focused/files/08.log",
+    "next_limit_seconds": 146,
+    "derivation": "ceil(3*measured whole-file seconds)+120"
+  },
+  "packages/bus/tests/gitea-migration.test.mjs": {
+    "recorded_seconds": 0.415,
+    "receipt": "agents/gander/work/queue-253/run3-focused/files/09.log",
+    "next_limit_seconds": 122,
+    "derivation": "ceil(3*measured whole-file seconds)+120"
+  },
+  "packages/bus/tests/grant-executor.test.mjs": {
+    "recorded_seconds": 21.562,
+    "receipt": "agents/gander/work/queue-253/run3-focused/files/10.log",
+    "next_limit_seconds": 185,
+    "derivation": "ceil(3*measured whole-file seconds)+120"
+  },
+  "packages/bus/tests/grant-migration.test.mjs": {
+    "recorded_seconds": 0.465,
+    "receipt": "agents/gander/work/queue-253/run3-focused/files/11.log",
+    "next_limit_seconds": 122,
+    "derivation": "ceil(3*measured whole-file seconds)+120"
+  },
+  "packages/bus/tests/lifecycle-revoke.test.mjs": {
+    "recorded_seconds": 0.665,
+    "receipt": "agents/gander/work/queue-253/run3-focused/files/12.log",
+    "next_limit_seconds": 122,
+    "derivation": "ceil(3*measured whole-file seconds)+120"
+  },
+  "packages/bus/tests/message-filter.test.mjs": {
+    "recorded_seconds": 0.515,
+    "receipt": "agents/gander/work/queue-253/run3-focused/files/13.log",
+    "next_limit_seconds": 122,
+    "derivation": "ceil(3*measured whole-file seconds)+120"
+  },
+  "packages/bus/tests/name-migration.test.mjs": {
+    "recorded_seconds": 0.214,
+    "receipt": "agents/gander/work/queue-253/run3-focused/files/14.log",
+    "next_limit_seconds": 121,
+    "derivation": "ceil(3*measured whole-file seconds)+120"
+  },
+  "packages/bus/tests/schema.test.mjs": {
+    "recorded_seconds": 0.214,
+    "receipt": "agents/gander/work/queue-253/run3-focused/files/15.log",
+    "next_limit_seconds": 121,
+    "derivation": "ceil(3*measured whole-file seconds)+120"
+  },
+  "packages/bus/tests/sessions.test.mjs": {
+    "recorded_seconds": 0.615,
+    "receipt": "agents/gander/work/queue-253/run3-focused/files/16.log",
+    "next_limit_seconds": 122,
+    "derivation": "ceil(3*measured whole-file seconds)+120"
+  },
+  "packages/bus/tests/spec-migration.test.mjs": {
+    "recorded_seconds": 0.214,
+    "receipt": "agents/gander/work/queue-253/run3-focused/files/17.log",
+    "next_limit_seconds": 121,
+    "derivation": "ceil(3*measured whole-file seconds)+120"
+  },
+  "packages/bus/tests/tester-writes.test.mjs": {
+    "recorded_seconds": 0.565,
+    "receipt": "agents/gander/work/queue-253/run3-focused/files/18.log",
+    "next_limit_seconds": 122,
+    "derivation": "ceil(3*measured whole-file seconds)+120"
+  },
+  "packages/bus/tests/thread-claims.test.mjs": {
+    "recorded_seconds": 0.264,
+    "receipt": "agents/gander/work/queue-253/run3-focused/files/19.log",
+    "next_limit_seconds": 121,
+    "derivation": "ceil(3*measured whole-file seconds)+120"
+  },
+  "packages/bus/tests/thread-migration.test.mjs": {
+    "recorded_seconds": 0.365,
+    "receipt": "agents/gander/work/queue-253/run3-focused/files/20.log",
+    "next_limit_seconds": 122,
+    "derivation": "ceil(3*measured whole-file seconds)+120"
+  },
+  "packages/bus/tests/threads.test.mjs": {
+    "recorded_seconds": 1.216,
+    "receipt": "agents/gander/work/queue-253/run3-focused/files/21.log",
+    "next_limit_seconds": 124,
+    "derivation": "ceil(3*measured whole-file seconds)+120"
+  },
+  "packages/bus/tests/usage-migration.test.mjs": {
+    "recorded_seconds": 0.214,
+    "receipt": "agents/gander/work/queue-253/run3-focused/files/22.log",
+    "next_limit_seconds": 121,
+    "derivation": "ceil(3*measured whole-file seconds)+120"
+  },
+  "packages/cli/tests/lifecycle.test.mjs": {
+    "recorded_seconds": 13.296,
+    "receipt": "agents/gander/work/queue-253/run3-focused/files/23.log",
+    "next_limit_seconds": 160,
+    "derivation": "ceil(3*measured whole-file seconds)+120"
+  },
+  "packages/cli/tests/stack-release.test.mjs": {
+    "recorded_seconds": 583.453,
+    "receipt": "agents/gander/work/queue-253/run3-focused/files/24.log",
+    "next_limit_seconds": 1871,
+    "derivation": "ceil(3*measured whole-file seconds)+120"
+  },
+  "packages/cli/tests/thread-cli.test.mjs": {
+    "recorded_seconds": 1.876,
+    "receipt": "agents/gander/work/queue-253/run3-focused/files/25.log",
+    "next_limit_seconds": 126,
+    "derivation": "ceil(3*measured whole-file seconds)+120"
+  },
+  "packages/cli/tests/thread-launch.test.mjs": {
+    "recorded_seconds": 16.603,
+    "receipt": "agents/gander/work/queue-253/run3-focused/files/26.log",
+    "next_limit_seconds": 170,
+    "derivation": "ceil(3*measured whole-file seconds)+120"
+  },
+  "packages/webui/tests/chat.test.mjs": {
+    "recorded_seconds": 0.515,
+    "receipt": "agents/gander/work/queue-253/run3-focused/files/27.log",
+    "next_limit_seconds": 122,
+    "derivation": "ceil(3*measured whole-file seconds)+120"
+  }
+}

agents/gander/work/queue-253/run3-focused/NOTES.md

@@ -0,0 +1,7 @@
+# Focused window notes
+
+Grant sage-2709 at14:29:21Z, test run start14:30:03Z. First busy check passed; no busy refusal occurred. Sage2711 reports one unrelated canonical queue write by Gizmoduck at14:29:42Z, row269 rev3217, and authorizes rechecking if it trips a busy guard. No recheck or test retry was needed. No test path was changed by that write. Later file results determine the gate outcome; no timing explanation is assumed.
+
+Duckworth0149 static integration check has no blockers on0604d91fc /573c51cf. Focused logs will supply HEAD/digest,27 file totals and every skip, including exact N9 case2 skip.
+
+Sage2714 reports Darkwing queue-show reads around14:31Z and two Python read operations at14:32Z, outside this worktree/TMPDIR. No own busy refusal or retry occurred. No test impact observed; no causal claim made about timings. This seat did not access the live data named in that notice.

agents/gander/work/queue-253/run3-focused/RESULTS.md

@@ -0,0 +1,37 @@
+# Focused27 whole-file results
+
+| Whole file | Pass/fail/skip | Wall seconds | Command limit seconds | Next3x plus120 basis |
+|---|---:|---:|---:|---:|
+| packages/cli/tests/case1-accept.test.mjs | 34/0/0 | 99.281 | 900 | 418 |
+| packages/cli/tests/case2-unit.test.mjs | 43/0/0 | 66.418 | 900 | 320 |
+| packages/bus/tests/account-migration.test.mjs | 3/0/0 | 0.415 | 300 | 122 |
+| packages/bus/tests/chief-of-staff.test.mjs | 42/0/0 | 2.168 | 300 | 127 |
+| packages/bus/tests/comment-migration.test.mjs | 5/0/0 | 0.565 | 300 | 122 |
+| packages/bus/tests/end-launch.test.mjs | 7/0/0 | 0.415 | 300 | 122 |
+| packages/bus/tests/fire-revokes-grants.test.mjs | 22/0/0 | 3.271 | 300 | 130 |
+| packages/bus/tests/gitea-grant.test.mjs | 49/0/0 | 8.634 | 300 | 146 |
+| packages/bus/tests/gitea-migration.test.mjs | 5/0/0 | 0.415 | 300 | 122 |
+| packages/bus/tests/grant-executor.test.mjs | 42/0/0 | 21.562 | 300 | 185 |
+| packages/bus/tests/grant-migration.test.mjs | 6/0/0 | 0.465 | 300 | 122 |
+| packages/bus/tests/lifecycle-revoke.test.mjs | 8/0/0 | 0.665 | 300 | 122 |
+| packages/bus/tests/message-filter.test.mjs | 6/0/0 | 0.515 | 300 | 122 |
+| packages/bus/tests/name-migration.test.mjs | 1/0/0 | 0.214 | 300 | 121 |
+| packages/bus/tests/schema.test.mjs | 1/0/0 | 0.214 | 300 | 121 |
+| packages/bus/tests/sessions.test.mjs | 7/0/0 | 0.615 | 300 | 122 |
+| packages/bus/tests/spec-migration.test.mjs | 1/0/0 | 0.214 | 300 | 121 |
+| packages/bus/tests/tester-writes.test.mjs | 8/0/0 | 0.565 | 300 | 122 |
+| packages/bus/tests/thread-claims.test.mjs | 6/0/0 | 0.264 | 300 | 121 |
+| packages/bus/tests/thread-migration.test.mjs | 3/0/0 | 0.365 | 300 | 122 |
+| packages/bus/tests/threads.test.mjs | 17/0/0 | 1.216 | 300 | 124 |
+| packages/bus/tests/usage-migration.test.mjs | 1/0/0 | 0.214 | 300 | 121 |
+| packages/cli/tests/lifecycle.test.mjs | 24/0/0 | 13.296 | 900 | 160 |
+| packages/cli/tests/stack-release.test.mjs | 218/0/0 | 583.453 | 900 | 1871 |
+| packages/cli/tests/thread-cli.test.mjs | 11/0/0 | 1.876 | 900 | 126 |
+| packages/cli/tests/thread-launch.test.mjs | 11/0/0 | 16.603 | 900 | 170 |
+| packages/webui/tests/chat.test.mjs | 23/0/0 | 0.515 | 300 | 122 |
+
+N9 verbatim: ok 43 - inside a session's sandbox a bind below 1024 fails with EACCES, and a bind on a free high port succeeds
+
+Every skip:
+
+

agents/gander/work/queue-253/run3-focused/SUMMARY.json

@@ -0,0 +1,625 @@
+{
+  "status": "GREEN",
+  "grant": "sage-2709",
+  "candidate": "0604d91fcfc1949810cd5321aea6ec43e9b74b4b",
+  "manifest": "573c51cf72f2398532a6ea768536f04e3c1681997cb8b9a6f14a8aef884870ae",
+  "counts": {
+    "pass": 604,
+    "fail": 0,
+    "skipped": 0
+  },
+  "steps": [
+    {
+      "code": 0,
+      "timeout": false,
+      "seconds": 99.281,
+      "log": "agents/gander/work/queue-253/run3-focused/files/01.log",
+      "file": "packages/cli/tests/case1-accept.test.mjs",
+      "counts": {
+        "tests": 34,
+        "pass": 34,
+        "fail": 0,
+        "skipped": 0
+      },
+      "named_skips": []
+    },
+    {
+      "code": 0,
+      "timeout": false,
+      "seconds": 66.418,
+      "log": "agents/gander/work/queue-253/run3-focused/files/02.log",
+      "file": "packages/cli/tests/case2-unit.test.mjs",
+      "counts": {
+        "tests": 43,
+        "pass": 43,
+        "fail": 0,
+        "skipped": 0
+      },
+      "named_skips": []
+    },
+    {
+      "code": 0,
+      "timeout": false,
+      "seconds": 0.415,
+      "log": "agents/gander/work/queue-253/run3-focused/files/03.log",
+      "file": "packages/bus/tests/account-migration.test.mjs",
+      "counts": {
+        "tests": 3,
+        "pass": 3,
+        "fail": 0,
+        "skipped": 0
+      },
+      "named_skips": []
+    },
+    {
+      "code": 0,
+      "timeout": false,
+      "seconds": 2.168,
+      "log": "agents/gander/work/queue-253/run3-focused/files/04.log",
+      "file": "packages/bus/tests/chief-of-staff.test.mjs",
+      "counts": {
+        "tests": 42,
+        "pass": 42,
+        "fail": 0,
+        "skipped": 0
+      },
+      "named_skips": []
+    },
+    {
+      "code": 0,
+      "timeout": false,
+      "seconds": 0.565,
+      "log": "agents/gander/work/queue-253/run3-focused/files/05.log",
+      "file": "packages/bus/tests/comment-migration.test.mjs",
+      "counts": {
+        "tests": 5,
+        "pass": 5,
+        "fail": 0,
+        "skipped": 0
+      },
+      "named_skips": []
+    },
+    {
+      "code": 0,
+      "timeout": false,
+      "seconds": 0.415,
+      "log": "agents/gander/work/queue-253/run3-focused/files/06.log",
+      "file": "packages/bus/tests/end-launch.test.mjs",
+      "counts": {
+        "tests": 7,
+        "pass": 7,
+        "fail": 0,
+        "skipped": 0
+      },
+      "named_skips": []
+    },
+    {
+      "code": 0,
+      "timeout": false,
+      "seconds": 3.271,
+      "log": "agents/gander/work/queue-253/run3-focused/files/07.log",
+      "file": "packages/bus/tests/fire-revokes-grants.test.mjs",
+      "counts": {
+        "tests": 22,
+        "pass": 22,
+        "fail": 0,
+        "skipped": 0
+      },
+      "named_skips": []
+    },
+    {
+      "code": 0,
+      "timeout": false,
+      "seconds": 8.634,
+      "log": "agents/gander/work/queue-253/run3-focused/files/08.log",
+      "file": "packages/bus/tests/gitea-grant.test.mjs",
+      "counts": {
+        "tests": 49,
+        "pass": 49,
+        "fail": 0,
+        "skipped": 0
+      },
+      "named_skips": []
+    },
+    {
+      "code": 0,
+      "timeout": false,
+      "seconds": 0.415,
+      "log": "agents/gander/work/queue-253/run3-focused/files/09.log",
+      "file": "packages/bus/tests/gitea-migration.test.mjs",
+      "counts": {
+        "tests": 5,
+        "pass": 5,
+        "fail": 0,
+        "skipped": 0
+      },
+      "named_skips": []
+    },
+    {
+      "code": 0,
+      "timeout": false,
+      "seconds": 21.562,
+      "log": "agents/gander/work/queue-253/run3-focused/files/10.log",
+      "file": "packages/bus/tests/grant-executor.test.mjs",
+      "counts": {
+        "tests": 42,
+        "pass": 42,
+        "fail": 0,
+        "skipped": 0
+      },
+      "named_skips": []
+    },
+    {
+      "code": 0,
+      "timeout": false,
+      "seconds": 0.465,
+      "log": "agents/gander/work/queue-253/run3-focused/files/11.log",
+      "file": "packages/bus/tests/grant-migration.test.mjs",
+      "counts": {
+        "tests": 6,
+        "pass": 6,
+        "fail": 0,
+        "skipped": 0
+      },
+      "named_skips": []
+    },
+    {
+      "code": 0,
+      "timeout": false,
+      "seconds": 0.665,
+      "log": "agents/gander/work/queue-253/run3-focused/files/12.log",
+      "file": "packages/bus/tests/lifecycle-revoke.test.mjs",
+      "counts": {
+        "tests": 8,
+        "pass": 8,
+        "fail": 0,
+        "skipped": 0
+      },
+      "named_skips": []
+    },
+    {
+      "code": 0,
+      "timeout": false,
+      "seconds": 0.515,
+      "log": "agents/gander/work/queue-253/run3-focused/files/13.log",
+      "file": "packages/bus/tests/message-filter.test.mjs",
+      "counts": {
+        "tests": 6,
+        "pass": 6,
+        "fail": 0,
+        "skipped": 0
+      },
+      "named_skips": []
+    },
+    {
+      "code": 0,
+      "timeout": false,
+      "seconds": 0.214,
+      "log": "agents/gander/work/queue-253/run3-focused/files/14.log",
+      "file": "packages/bus/tests/name-migration.test.mjs",
+      "counts": {
+        "tests": 1,
+        "pass": 1,
+        "fail": 0,
+        "skipped": 0
+      },
+      "named_skips": []
+    },
+    {
+      "code": 0,
+      "timeout": false,
+      "seconds": 0.214,
+      "log": "agents/gander/work/queue-253/run3-focused/files/15.log",
+      "file": "packages/bus/tests/schema.test.mjs",
+      "counts": {
+        "tests": 1,
+        "pass": 1,
+        "fail": 0,
+        "skipped": 0
+      },
+      "named_skips": []
+    },
+    {
+      "code": 0,
+      "timeout": false,
+      "seconds": 0.615,
+      "log": "agents/gander/work/queue-253/run3-focused/files/16.log",
+      "file": "packages/bus/tests/sessions.test.mjs",
+      "counts": {
+        "tests": 7,
+        "pass": 7,
+        "fail": 0,
+        "skipped": 0
+      },
+      "named_skips": []
+    },
+    {
+      "code": 0,
+      "timeout": false,
+      "seconds": 0.214,
+      "log": "agents/gander/work/queue-253/run3-focused/files/17.log",
+      "file": "packages/bus/tests/spec-migration.test.mjs",
+      "counts": {
+        "tests": 1,
+        "pass": 1,
+        "fail": 0,
+        "skipped": 0
+      },
+      "named_skips": []
+    },
+    {
+      "code": 0,
+      "timeout": false,
+      "seconds": 0.565,
+      "log": "agents/gander/work/queue-253/run3-focused/files/18.log",
+      "file": "packages/bus/tests/tester-writes.test.mjs",
+      "counts": {
+        "tests": 8,
+        "pass": 8,
+        "fail": 0,
+        "skipped": 0
+      },
+      "named_skips": []
+    },
+    {
+      "code": 0,
+      "timeout": false,
+      "seconds": 0.264,
+      "log": "agents/gander/work/queue-253/run3-focused/files/19.log",
+      "file": "packages/bus/tests/thread-claims.test.mjs",
+      "counts": {
+        "tests": 6,
+        "pass": 6,
+        "fail": 0,
+        "skipped": 0
+      },
+      "named_skips": []
+    },
+    {
+      "code": 0,
+      "timeout": false,
+      "seconds": 0.365,
+      "log": "agents/gander/work/queue-253/run3-focused/files/20.log",
+      "file": "packages/bus/tests/thread-migration.test.mjs",
+      "counts": {
+        "tests": 3,
+        "pass": 3,
+        "fail": 0,
+        "skipped": 0
+      },
+      "named_skips": []
+    },
+    {
+      "code": 0,
+      "timeout": false,
+      "seconds": 1.216,
+      "log": "agents/gander/work/queue-253/run3-focused/files/21.log",
+      "file": "packages/bus/tests/threads.test.mjs",
+      "counts": {
+        "tests": 17,
+        "pass": 17,
+        "fail": 0,
+        "skipped": 0
+      },
+      "named_skips": []
+    },
+    {
+      "code": 0,
+      "timeout": false,
+      "seconds": 0.214,
+      "log": "agents/gander/work/queue-253/run3-focused/files/22.log",
+      "file": "packages/bus/tests/usage-migration.test.mjs",
+      "counts": {
+        "tests": 1,
+        "pass": 1,
+        "fail": 0,
+        "skipped": 0
+      },
+      "named_skips": []
+    },
+    {
+      "code": 0,
+      "timeout": false,
+      "seconds": 13.296,
+      "log": "agents/gander/work/queue-253/run3-focused/files/23.log",
+      "file": "packages/cli/tests/lifecycle.test.mjs",
+      "counts": {
+        "tests": 24,
+        "pass": 24,
+        "fail": 0,
+        "skipped": 0
+      },
+      "named_skips": []
+    },
+    {
+      "code": 0,
+      "timeout": false,
+      "seconds": 583.453,
+      "log": "agents/gander/work/queue-253/run3-focused/files/24.log",
+      "file": "packages/cli/tests/stack-release.test.mjs",
+      "counts": {
+        "tests": 218,
+        "pass": 218,
+        "fail": 0,
+        "skipped": 0
+      },
+      "named_skips": []
+    },
+    {
+      "code": 0,
+      "timeout": false,
+      "seconds": 1.876,
+      "log": "agents/gander/work/queue-253/run3-focused/files/25.log",
+      "file": "packages/cli/tests/thread-cli.test.mjs",
+      "counts": {
+        "tests": 11,
+        "pass": 11,
+        "fail": 0,
+        "skipped": 0
+      },
+      "named_skips": []
+    },
+    {
+      "code": 0,
+      "timeout": false,
+      "seconds": 16.603,
+      "log": "agents/gander/work/queue-253/run3-focused/files/26.log",
+      "file": "packages/cli/tests/thread-launch.test.mjs",
+      "counts": {
+        "tests": 11,
+        "pass": 11,
+        "fail": 0,
+        "skipped": 0
+      },
+      "named_skips": []
+    },
+    {
+      "code": 0,
+      "timeout": false,
+      "seconds": 0.515,
+      "log": "agents/gander/work/queue-253/run3-focused/files/27.log",
+      "file": "packages/webui/tests/chat.test.mjs",
+      "counts": {
+        "tests": 23,
+        "pass": 23,
+        "fail": 0,
+        "skipped": 0
+      },
+      "named_skips": []
+    }
+  ],
+  "named_skips": [],
+  "n9_exact_line": "ok 43 - inside a session's sandbox a bind below 1024 fails with EACCES, and a bind on a free high port succeeds",
+  "file_seconds_sum": 824.413,
+  "next_file_limits": {
+    "packages/cli/tests/case1-accept.test.mjs": {
+      "recorded_seconds": 99.281,
+      "receipt": "agents/gander/work/queue-253/run3-focused/files/01.log",
+      "next_limit_seconds": 418,
+      "derivation": "ceil(3*measured whole-file seconds)+120"
+    },
+    "packages/cli/tests/case2-unit.test.mjs": {
+      "recorded_seconds": 66.418,
+      "receipt": "agents/gander/work/queue-253/run3-focused/files/02.log",
+      "next_limit_seconds": 320,
+      "derivation": "ceil(3*measured whole-file seconds)+120"
+    },
+    "packages/bus/tests/account-migration.test.mjs": {
+      "recorded_seconds": 0.415,
+      "receipt": "agents/gander/work/queue-253/run3-focused/files/03.log",
+      "next_limit_seconds": 122,
+      "derivation": "ceil(3*measured whole-file seconds)+120"
+    },
+    "packages/bus/tests/chief-of-staff.test.mjs": {
+      "recorded_seconds": 2.168,
+      "receipt": "agents/gander/work/queue-253/run3-focused/files/04.log",
+      "next_limit_seconds": 127,
+      "derivation": "ceil(3*measured whole-file seconds)+120"
+    },
+    "packages/bus/tests/comment-migration.test.mjs": {
+      "recorded_seconds": 0.565,
+      "receipt": "agents/gander/work/queue-253/run3-focused/files/05.log",
+      "next_limit_seconds": 122,
+      "derivation": "ceil(3*measured whole-file seconds)+120"
+    },
+    "packages/bus/tests/end-launch.test.mjs": {
+      "recorded_seconds": 0.415,
+      "receipt": "agents/gander/work/queue-253/run3-focused/files/06.log",
+      "next_limit_seconds": 122,
+      "derivation": "ceil(3*measured whole-file seconds)+120"
+    },
+    "packages/bus/tests/fire-revokes-grants.test.mjs": {
+      "recorded_seconds": 3.271,
+      "receipt": "agents/gander/work/queue-253/run3-focused/files/07.log",
+      "next_limit_seconds": 130,
+      "derivation": "ceil(3*measured whole-file seconds)+120"
+    },
+    "packages/bus/tests/gitea-grant.test.mjs": {
+      "recorded_seconds": 8.634,
+      "receipt": "agents/gander/work/queue-253/run3-focused/files/08.log",
+      "next_limit_seconds": 146,
+      "derivation": "ceil(3*measured whole-file seconds)+120"
+    },
+    "packages/bus/tests/gitea-migration.test.mjs": {
+      "recorded_seconds": 0.415,
+      "receipt": "agents/gander/work/queue-253/run3-focused/files/09.log",
+      "next_limit_seconds": 122,
+      "derivation": "ceil(3*measured whole-file seconds)+120"
+    },
+    "packages/bus/tests/grant-executor.test.mjs": {
+      "recorded_seconds": 21.562,
+      "receipt": "agents/gander/work/queue-253/run3-focused/files/10.log",
+      "next_limit_seconds": 185,
+      "derivation": "ceil(3*measured whole-file seconds)+120"
+    },
+    "packages/bus/tests/grant-migration.test.mjs": {
+      "recorded_seconds": 0.465,
+      "receipt": "agents/gander/work/queue-253/run3-focused/files/11.log",
+      "next_limit_seconds": 122,
+      "derivation": "ceil(3*measured whole-file seconds)+120"
+    },
+    "packages/bus/tests/lifecycle-revoke.test.mjs": {
+      "recorded_seconds": 0.665,
+      "receipt": "agents/gander/work/queue-253/run3-focused/files/12.log",
+      "next_limit_seconds": 122,
+      "derivation": "ceil(3*measured whole-file seconds)+120"
+    },
+    "packages/bus/tests/message-filter.test.mjs": {
+      "recorded_seconds": 0.515,
+      "receipt": "agents/gander/work/queue-253/run3-focused/files/13.log",
+      "next_limit_seconds": 122,
+      "derivation": "ceil(3*measured whole-file seconds)+120"
+    },
+    "packages/bus/tests/name-migration.test.mjs": {
+      "recorded_seconds": 0.214,
+      "receipt": "agents/gander/work/queue-253/run3-focused/files/14.log",
+      "next_limit_seconds": 121,
+      "derivation": "ceil(3*measured whole-file seconds)+120"
+    },
+    "packages/bus/tests/schema.test.mjs": {
+      "recorded_seconds": 0.214,
+      "receipt": "agents/gander/work/queue-253/run3-focused/files/15.log",
+      "next_limit_seconds": 121,
+      "derivation": "ceil(3*measured whole-file seconds)+120"
+    },
+    "packages/bus/tests/sessions.test.mjs": {
+      "recorded_seconds": 0.615,
+      "receipt": "agents/gander/work/queue-253/run3-focused/files/16.log",
+      "next_limit_seconds": 122,
+      "derivation": "ceil(3*measured whole-file seconds)+120"
+    },
+    "packages/bus/tests/spec-migration.test.mjs": {
+      "recorded_seconds": 0.214,
+      "receipt": "agents/gander/work/queue-253/run3-focused/files/17.log",
+      "next_limit_seconds": 121,
+      "derivation": "ceil(3*measured whole-file seconds)+120"
+    },
+    "packages/bus/tests/tester-writes.test.mjs": {
+      "recorded_seconds": 0.565,
+      "receipt": "agents/gander/work/queue-253/run3-focused/files/18.log",
+      "next_limit_seconds": 122,
+      "derivation": "ceil(3*measured whole-file seconds)+120"
+    },
+    "packages/bus/tests/thread-claims.test.mjs": {
+      "recorded_seconds": 0.264,
+      "receipt": "agents/gander/work/queue-253/run3-focused/files/19.log",
+      "next_limit_seconds": 121,
+      "derivation": "ceil(3*measured whole-file seconds)+120"
+    },
+    "packages/bus/tests/thread-migration.test.mjs": {
+      "recorded_seconds": 0.365,
+      "receipt": "agents/gander/work/queue-253/run3-focused/files/20.log",
+      "next_limit_seconds": 122,
+      "derivation": "ceil(3*measured whole-file seconds)+120"
+    },
+    "packages/bus/tests/threads.test.mjs": {
+      "recorded_seconds": 1.216,
+      "receipt": "agents/gander/work/queue-253/run3-focused/files/21.log",
+      "next_limit_seconds": 124,
+      "derivation": "ceil(3*measured whole-file seconds)+120"
+    },
+    "packages/bus/tests/usage-migration.test.mjs": {
+      "recorded_seconds": 0.214,
+      "receipt": "agents/gander/work/queue-253/run3-focused/files/22.log",
+      "next_limit_seconds": 121,
+      "derivation": "ceil(3*measured whole-file seconds)+120"
+    },
+    "packages/cli/tests/lifecycle.test.mjs": {
+      "recorded_seconds": 13.296,
+      "receipt": "agents/gander/work/queue-253/run3-focused/files/23.log",
+      "next_limit_seconds": 160,
+      "derivation": "ceil(3*measured whole-file seconds)+120"
+    },
+    "packages/cli/tests/stack-release.test.mjs": {
+      "recorded_seconds": 583.453,
+      "receipt": "agents/gander/work/queue-253/run3-focused/files/24.log",
+      "next_limit_seconds": 1871,
+      "derivation": "ceil(3*measured whole-file seconds)+120"
+    },
+    "packages/cli/tests/thread-cli.test.mjs": {
+      "recorded_seconds": 1.876,
+      "receipt": "agents/gander/work/queue-253/run3-focused/files/25.log",
+      "next_limit_seconds": 126,
+      "derivation": "ceil(3*measured whole-file seconds)+120"
+    },
+    "packages/cli/tests/thread-launch.test.mjs": {
+      "recorded_seconds": 16.603,
+      "receipt": "agents/gander/work/queue-253/run3-focused/files/26.log",
+      "next_limit_seconds": 170,
+      "derivation": "ceil(3*measured whole-file seconds)+120"
+    },
+    "packages/webui/tests/chat.test.mjs": {
+      "recorded_seconds": 0.515,
+      "receipt": "agents/gander/work/queue-253/run3-focused/files/27.log",
+      "next_limit_seconds": 122,
+      "derivation": "ceil(3*measured whole-file seconds)+120"
+    }
+  },
+  "timeout_count": 0,
+  "source_manifest_verified": true,
+  "sweep": {
+    "timestamp": "2026-10-22T14:45:17.148081+00:00",
+    "count": 0,
+    "remaining": [],
+    "excluded_preexisting_infrastructure": [
+      {
+        "pid": 2469277,
+        "comm": "node-MainThread",
+        "cwd": "/home/jwoltje/.t3/worktrees/mosaic-stack/gander-row196",
+        "started_utc": "2026-10-22T14:20:57.360000+00:00"
+      },
+      {
+        "pid": 2469278,
+        "comm": "npm exec @model",
+        "cwd": "/home/jwoltje/.t3/worktrees/mosaic-stack/gander-row196",
+        "started_utc": "2026-10-22T14:20:57.370000+00:00"
+      },
+      {
+        "pid": 2469279,
+        "comm": "npm exec chrome",
+        "cwd": "/home/jwoltje/.t3/worktrees/mosaic-stack/gander-row196",
+        "started_utc": "2026-10-22T14:20:57.370000+00:00"
+      },
+      {
+        "pid": 2469292,
+        "comm": "npm exec @playw",
+        "cwd": "/home/jwoltje/.t3/worktrees/mosaic-stack/gander-row196",
+        "started_utc": "2026-10-22T14:20:57.380000+00:00"
+      },
+      {
+        "pid": 2469478,
+        "comm": "node-MainThread",
+        "cwd": "/home/jwoltje/.t3/worktrees/mosaic-stack/gander-row196",
+        "started_utc": "2026-10-22T14:20:58.770000+00:00"
+      },
+      {
+        "pid": 2469485,
+        "comm": "node-MainThread",
+        "cwd": "/home/jwoltje/.t3/worktrees/mosaic-stack/gander-row196",
+        "started_utc": "2026-10-22T14:20:58.800000+00:00"
+      },
+      {
+        "pid": 2469518,
+        "comm": "chrome-devtools",
+        "cwd": "/home/jwoltje/.t3/worktrees/mosaic-stack/gander-row196",
+        "started_utc": "2026-10-22T14:20:59.100000+00:00"
+      },
+      {
+        "pid": 2469601,
+        "comm": "node-MainThread",
+        "cwd": "/home/jwoltje/.t3/worktrees/mosaic-stack/gander-row196",
+        "started_utc": "2026-10-22T14:20:59.440000+00:00"
+      },
+      {
+        "pid": 2470486,
+        "comm": "codex-code-mode",
+        "cwd": "/home/jwoltje/.t3/worktrees/mosaic-stack/gander-row196",
+        "started_utc": "2026-10-22T14:21:07.580000+00:00"
+      }
+    ],
+    "note": "Read-only /proc cwd sweep, including deleted cwd under this run TMPDIR. Own ancestry excluded. Only known MCP/npm/code-mode infrastructure PIDs with pre-run start ticks are excluded. No signalling."
+  },
+  "start": "2026-10-22T14:30:03Z",
+  "end": "2026-10-22T14:44:57Z",
+  "wall_seconds": 894.0
+}

agents/gander/work/queue-253/run3-focused/TMPDIR

@@ -0,0 +1 @@
+/mnt/storage/scratch/tmp/gMJyGKC

agents/gander/work/queue-253/run3-focused/end.txt

@@ -0,0 +1 @@
+2026-10-22T14:44:57Z

agents/gander/work/queue-253/run3-focused/files/01.command.json

@@ -0,0 +1 @@
+["timeout", "-k", "10", "900", "node", "--test", "--test-reporter=tap", "packages/cli/tests/case1-accept.test.mjs"]

agents/gander/work/queue-253/run3-focused/files/01.log

@@ -0,0 +1,214 @@
+TAP version 13
+# Subtest: row253 socket observation uses configured root, metadata and the Console peer without sending bytes
+ok 1 - row253 socket observation uses configured root, metadata and the Console peer without sending bytes
+  ---
+  duration_ms: 635.08322
+  type: 'test'
+  ...
+# Subtest: row253 P10 refuses unsafe metadata, wrong peers and an unsafe Python without claiming closure
+ok 2 - row253 P10 refuses unsafe metadata, wrong peers and an unsafe Python without claiming closure
+  ---
+  duration_ms: 8910.768359
+  type: 'test'
+  ...
+# Subtest: row253 acceptance rejects bad config and unsupported copies before talk
+ok 3 - row253 acceptance rejects bad config and unsupported copies before talk
+  ---
+  duration_ms: 1287.210524
+  type: 'test'
+  ...
+# Subtest: row253 stalled peer observation ends within its bound without leaving a reader
+ok 4 - row253 stalled peer observation ends within its bound without leaving a reader
+  ---
+  duration_ms: 2759.173042
+  type: 'test'
+  ...
+# Subtest: row253 P8 refuses both retired TCP and board listeners
+ok 5 - row253 P8 refuses both retired TCP and board listeners
+  ---
+  duration_ms: 1495.993888
+  type: 'test'
+  ...
+# Subtest: row253 C4 acceptance query inner reason holds under both sudo models
+ok 6 - row253 C4 acceptance query inner reason holds under both sudo models
+  ---
+  duration_ms: 10714.050013
+  type: 'test'
+  ...
+# Subtest: row253 C4 acceptance query outer reason discards stdout and names residual cleanup
+ok 7 - row253 C4 acceptance query outer reason discards stdout and names residual cleanup
+  ---
+  duration_ms: 14202.380117
+  type: 'test'
+  ...
+# Subtest: row253 C4 acceptance query overflow is output-limit in both models
+ok 8 - row253 C4 acceptance query overflow is output-limit in both models
+  ---
+  duration_ms: 533.74284
+  type: 'test'
+  ...
+# Subtest: row253 C4 P10 inner reason holds under both sudo models
+ok 9 - row253 C4 P10 inner reason holds under both sudo models
+  ---
+  duration_ms: 5977.183052
+  type: 'test'
+  ...
+# Subtest: row253 C4 P10 outer reason holds under both sudo models
+ok 10 - row253 C4 P10 outer reason holds under both sudo models
+  ---
+  duration_ms: 9158.961886
+  type: 'test'
+  ...
+# Subtest: row253 C4 P10 overflow reason holds under both sudo models
+ok 11 - row253 C4 P10 overflow reason holds under both sudo models
+  ---
+  duration_ms: 1068.808446
+  type: 'test'
+  ...
+# Subtest: row 195 accept: every check passing exits 0, with each P mark and counts that match the lines
+ok 12 - row 195 accept: every check passing exits 0, with each P mark and counts that match the lines
+  ---
+  duration_ms: 657.788738
+  type: 'test'
+  ...
+# Subtest: row 195 accept: exits 1 with each F check failing alone, and its line names it
+ok 13 - row 195 accept: exits 1 with each F check failing alone, and its line names it
+  ---
+  duration_ms: 7275.151025
+  type: 'test'
+  ...
+# Subtest: row 195 accept: F3 fails on exit 0 with no reply line, and its evidence takes talk's error
+ok 14 - row 195 accept: F3 fails on exit 0 with no reply line, and its evidence takes talk's error
+  ---
+  duration_ms: 1359.251446
+  type: 'test'
+  ...
+# Subtest: row 195 accept: F1 fails on a unit that isn't active or isn't User=mosaic
+ok 15 - row 195 accept: F1 fails on a unit that isn't active or isn't User=mosaic
+  ---
+  duration_ms: 1214.848264
+  type: 'test'
+  ...
+# Subtest: row 195 accept: F2 fails when healthz doesn't answer and when another pid holds the port
+ok 16 - row 195 accept: F2 fails when healthz doesn't answer and when another pid holds the port
+  ---
+  duration_ms: 1318.107134
+  type: 'test'
+  ...
+# Subtest: row 195 accept: F5 fails on unpriv_bwrap (enforce), on complain and on a trailing space
+ok 17 - row 195 accept: F5 fails on unpriv_bwrap (enforce), on complain and on a trailing space
+  ---
+  duration_ms: 2891.844673
+  type: 'test'
+  ...
+# Subtest: row 195 accept: F5 fails with no bwrap of mosaic's, and passes on comm alone
+ok 18 - row 195 accept: F5 fails with no bwrap of mosaic's, and passes on comm alone
+  ---
+  duration_ms: 1370.822639
+  type: 'test'
+  ...
+# Subtest: row 195 accept: F6 fails on a stub that prints nothing, on a path outside claude-<pin> and on a .. segment
+ok 19 - row 195 accept: F6 fails on a stub that prints nothing, on a path outside claude-<pin> and on a .. segment
+  ---
+  duration_ms: 2098.024276
+  type: 'test'
+  ...
+# Subtest: row 195 accept: F7 fails on two live PM launches, one for another business, and no launch.by
+ok 20 - row 195 accept: F7 fails on two live PM launches, one for another business, and no launch.by
+  ---
+  duration_ms: 2106.445728
+  type: 'test'
+  ...
+# Subtest: row 195 accept: F8 fails on 0640, on another owner and on a symlink, and never prints the credential
+ok 21 - row 195 accept: F8 fails on 0640, on another owner and on a symlink, and never prints the credential
+  ---
+  duration_ms: 2002.61524
+  type: 'test'
+  ...
+# Subtest: row 195 accept: F9 fails on another owner, a group-writable mode and a number for the flag
+ok 22 - row 195 accept: F9 fails on another owner, a group-writable mode and a number for the flag
+  ---
+  duration_ms: 1861.992457
+  type: 'test'
+  ...
+# Subtest: row 195 accept: F9 won't run --node as root off the pin path or with a writable directory above it
+ok 23 - row 195 accept: F9 won't run --node as root off the pin path or with a writable directory above it
+  ---
+  duration_ms: 1901.812772
+  type: 'test'
+  ...
+# Subtest: row 195 accept: F11 fails on one *.json under discord/ and passes on an empty directory
+ok 24 - row 195 accept: F11 fails on one *.json under discord/ and passes on an empty directory
+  ---
+  duration_ms: 1431.808863
+  type: 'test'
+  ...
+# Subtest: row 195 accept: each P check reports unnamed on its fault, and the exit stays 0
+ok 25 - row 195 accept: each P check reports unnamed on its fault, and the exit stays 0
+  ---
+  duration_ms: 5915.695807
+  type: 'test'
+  ...
+# Subtest: row 195 accept: P2 is unnamed with a supplementary group, and P5 names docker
+ok 26 - row 195 accept: P2 is unnamed with a supplementary group, and P5 names docker
+  ---
+  duration_ms: 1423.353014
+  type: 'test'
+  ...
+# Subtest: row 195 accept: P5 is closed with no jarvis account, and P2 with an empty authorized_keys
+ok 27 - row 195 accept: P5 is closed with no jarvis account, and P2 with an empty authorized_keys
+  ---
+  duration_ms: 616.405224
+  type: 'test'
+  ...
+# Subtest: row 195 accept: P9 is unnamed once for each item missing
+ok 28 - row 195 accept: P9 is unnamed once for each item missing
+  ---
+  duration_ms: 3502.799413
+  type: 'test'
+  ...
+# Subtest: row253 accept: P10 fails its observation with another peer; P11 with the unit disabled
+ok 29 - row253 accept: P10 fails its observation with another peer; P11 with the unit disabled
+  ---
+  duration_ms: 1268.612039
+  type: 'test'
+  ...
+# Subtest: row 195 accept: every P check unnamed together still exits 0
+ok 30 - row 195 accept: every P check unnamed together still exits 0
+  ---
+  duration_ms: 517.656059
+  type: 'test'
+  ...
+# Subtest: row 195 accept: a bad args file refuses with exit 2 before any check, each for its own reason
+ok 31 - row 195 accept: a bad args file refuses with exit 2 before any check, each for its own reason
+  ---
+  duration_ms: 114.130545
+  type: 'test'
+  ...
+# Subtest: row 195 accept: usage errors and a run without --root as a user exit 2
+ok 32 - row 195 accept: usage errors and a run without --root as a user exit 2
+  ---
+  duration_ms: 12.783137
+  type: 'test'
+  ...
+# Subtest: row 195 accept: every in-instance call goes through sudo -u mosaic -H env PATH=<node dir>:...
+ok 33 - row 195 accept: every in-instance call goes through sudo -u mosaic -H env PATH=<node dir>:...
+  ---
+  duration_ms: 719.568395
+  type: 'test'
+  ...
+# Subtest: row 195 accept: the host check runs with --check and never --enforce
+ok 34 - row 195 accept: the host check runs with --check and never --enforce
+  ---
+  duration_ms: 753.65801
+  type: 'test'
+  ...
+1..34
+# tests 34
+# suites 0
+# pass 34
+# fail 0
+# cancelled 0
+# skipped 0
+# todo 0
+# duration_ms 99207.214655

agents/gander/work/queue-253/run3-focused/files/02.command.json

@@ -0,0 +1 @@
+["timeout", "-k", "10", "900", "node", "--test", "--test-reporter=tap", "packages/cli/tests/case2-unit.test.mjs"]

agents/gander/work/queue-253/run3-focused/files/02.log

@@ -0,0 +1,268 @@
+TAP version 13
+# Subtest: row253 factory socket uses actual config and target-uid query without widening hardening
+ok 1 - row253 factory socket uses actual config and target-uid query without widening hardening
+  ---
+  duration_ms: 262.277524
+  type: 'test'
+  ...
+# Subtest: row253 installer refuses unsafe location and query facts before unit writes
+ok 2 - row253 installer refuses unsafe location and query facts before unit writes
+  ---
+  duration_ms: 2888.737963
+  type: 'test'
+  ...
+# Subtest: row253 query timeout kills its process group and leaves no running child
+ok 3 - row253 query timeout kills its process group and leaves no running child
+  ---
+  duration_ms: 7063.145938
+  type: 'test'
+  ...
+# Subtest: row253 protected homes refuse before any filesystem access
+ok 4 - row253 protected homes refuse before any filesystem access
+  ---
+  duration_ms: 9.095629
+  type: 'test'
+  ...
+# Subtest: row253 C4 sleep query has exact inner reason and cleans all members
+ok 5 - row253 C4 sleep query has exact inner reason and cleans all members
+  ---
+  duration_ms: 10654.435358
+  type: 'test'
+  ...
+# Subtest: row253 C4 signals query has exact inner reason and cleans all members
+ok 6 - row253 C4 signals query has exact inner reason and cleans all members
+  ---
+  duration_ms: 10558.851516
+  type: 'test'
+  ...
+# Subtest: row253 C4 member query has exact inner reason and cleans all members
+ok 7 - row253 C4 member query has exact inner reason and cleans all members
+  ---
+  duration_ms: 10575.034076
+  type: 'test'
+  ...
+# Subtest: row253 C4 overflow is output-limit in both sudo modes
+ok 8 - row253 C4 overflow is output-limit in both sudo modes
+  ---
+  duration_ms: 356.84676
+  type: 'test'
+  ...
+# Subtest: row253 C4 stalled supervisor uses the outer reason and explicit residual cleanup
+ok 9 - row253 C4 stalled supervisor uses the outer reason and explicit residual cleanup
+  ---
+  duration_ms: 14132.115825
+  type: 'test'
+  ...
+# Subtest: row253 C4 inline supervisor is byte-identical in both host scripts
+ok 10 - row253 C4 inline supervisor is byte-identical in both host scripts
+  ---
+  duration_ms: 0.332222
+  type: 'test'
+  ...
+# Subtest: row253 C4 cleanup budget starts after inventory pass one
+ok 11 - row253 C4 cleanup budget starts after inventory pass one
+  ---
+  duration_ms: 27.312099
+  type: 'test'
+  ...
+# Subtest: row253 query reaps its group even when a child closes stdout before the query returns
+ok 12 - row253 query reaps its group even when a child closes stdout before the query returns
+  ---
+  duration_ms: 125.14664
+  type: 'test'
+  ...
+# Subtest: row253 config parser is strict
+ok 13 - row253 config parser is strict
+  ---
+  duration_ms: 8.171201
+  type: 'test'
+  ...
+# Subtest: a clean library render writes both units 0644 with the fixed lines, and enables both then starts the bus then the Console
+ok 14 - a clean library render writes both units 0644 with the fixed lines, and enables both then starts the bus then the Console
+  ---
+  duration_ms: 94.172642
+  type: 'test'
+  ...
+# Subtest: PATH starts with the --node directory, for a node outside the default list and for /usr/bin/node
+ok 15 - PATH starts with the --node directory, for a node outside the default list and for /usr/bin/node
+  ---
+  duration_ms: 93.781364
+  type: 'test'
+  ...
+# Subtest: a failed bus start refuses with the Console not started
+ok 16 - a failed bus start refuses with the Console not started
+  ---
+  duration_ms: 91.475307
+  type: 'test'
+  ...
+# Subtest: the script never links a unit file
+ok 17 - the script never links a unit file
+  ---
+  duration_ms: 0.17219
+  type: 'test'
+  ...
+# Subtest: factory renders --pm once and one MOSAIC_CLAUDE_BIN line, and without them both tokens render empty
+ok 18 - factory renders --pm once and one MOSAIC_CLAUDE_BIN line, and without them both tokens render empty
+  ---
+  duration_ms: 533.168317
+  type: 'test'
+  ...
+# Subtest: a re-install over running units says they are still on the old copy and must restart together, never that it started them
+ok 19 - a re-install over running units says they are still on the old copy and must restart together, never that it started them
+  ---
+  duration_ms: 410.859392
+  type: 'test'
+  ...
+# Subtest: a re-install to another copy re-renders both units, and an edited installed unit refuses
+ok 20 - a re-install to another copy re-renders both units, and an edited installed unit refuses
+  ---
+  duration_ms: 978.008405
+  type: 'test'
+  ...
+# Subtest: a template with a namespace, user or system call restriction refuses
+ok 21 - a template with a namespace, user or system call restriction refuses
+  ---
+  duration_ms: 262.771603
+  type: 'test'
+  ...
+# Subtest: the bus template's EnvironmentFile line must be there and point at the session env, and the Console template must have none
+ok 22 - the bus template's EnvironmentFile line must be there and point at the session env, and the Console template must have none
+  ---
+  duration_ms: 178.505576
+  type: 'test'
+  ...
+# Subtest: a template holding an unknown token, PermissionsStartOnly or a privileged Exec prefix refuses
+ok 23 - a template holding an unknown token, PermissionsStartOnly or a privileged Exec prefix refuses
+  ---
+  duration_ms: 135.131551
+  type: 'test'
+  ...
+# Subtest: a symlink at either unit path refuses
+ok 24 - a symlink at either unit path refuses
+  ---
+  duration_ms: 164.772609
+  type: 'test'
+  ...
+# Subtest: a --node that is relative, not root-owned or under <home> refuses
+ok 25 - a --node that is relative, not root-owned or under <home> refuses
+  ---
+  duration_ms: 18.273626
+  type: 'test'
+  ...
+# Subtest: a re-install with a different --node or different serve flags refuses
+ok 26 - a re-install with a different --node or different serve flags refuses
+  ---
+  duration_ms: 454.1624
+  type: 'test'
+  ...
+# Subtest: an installed pair whose units name different copies refuses
+ok 27 - an installed pair whose units name different copies refuses
+  ---
+  duration_ms: 238.147366
+  type: 'test'
+  ...
+# Subtest: a copy id that is short, uppercase, holds / or .., or names no directory refuses
+ok 28 - a copy id that is short, uppercase, holds / or .., or names no directory refuses
+  ---
+  duration_ms: 26.564149
+  type: 'test'
+  ...
+# Subtest: library refuses a privileged-floor miss, a bad proof pair and every flag outside its set
+ok 29 - library refuses a privileged-floor miss, a bad proof pair and every flag outside its set
+  ---
+  duration_ms: 267.048019
+  type: 'test'
+  ...
+# Subtest: library refuses a proof file not owned by <user>'s uid
+ok 30 - library refuses a proof file not owned by <user>'s uid
+  ---
+  duration_ms: 17.16447
+  type: 'test'
+  ...
+# Subtest: factory refuses duplicate socket, a missing --port or --business, and each proxy flag
+ok 31 - factory refuses duplicate socket, a missing --port or --business, and each proxy flag
+  ---
+  duration_ms: 179.834197
+  type: 'test'
+  ...
+# Subtest: row253 factory refuses retired TCP and a value after the socket marker
+ok 32 - row253 factory refuses retired TCP and a value after the socket marker
+  ---
+  duration_ms: 27.35353
+  type: 'test'
+  ...
+# Subtest: factory refuses a --claude that is relative, not root-owned or under <home>, and a re-install with another --pm or --claude
+ok 33 - factory refuses a --claude that is relative, not root-owned or under <home>, and a re-install with another --pm or --claude
+  ---
+  duration_ms: 1109.424536
+  type: 'test'
+  ...
+# Subtest: the precheck passes on a good host and prints free memory, without the key
+ok 34 - the precheck passes on a good host and prints free memory, without the key
+  ---
+  duration_ms: 105.001864
+  type: 'test'
+  ...
+# Subtest: the precheck refuses each failed host check
+ok 35 - the precheck refuses each failed host check
+  ---
+  duration_ms: 912.086148
+  type: 'test'
+  ...
+# Subtest: the precheck refuses a user missing from passwd, a business file that does not load, and a symlinked run root
+ok 36 - the precheck refuses a user missing from passwd, a business file that does not load, and a symlinked run root
+  ---
+  duration_ms: 468.71868
+  type: 'test'
+  ...
+# Subtest: a bwrap that fails refuses and prints the sysctl and where bwrap is
+ok 37 - a bwrap that fails refuses and prints the sysctl and where bwrap is
+  ---
+  duration_ms: 103.211063
+  type: 'test'
+  ...
+# Subtest: an unprivileged port floor at or below the Console's port refuses, and so does a missing Console unit
+ok 38 - an unprivileged port floor at or below the Console's port refuses, and so does a missing Console unit
+  ---
+  duration_ms: 483.098555
+  type: 'test'
+  ...
+# Subtest: bus.tester: library refuses it on, factory needs it on, and factory refuses a library business
+ok 39 - bus.tester: library refuses it on, factory needs it on, and factory refuses a library business
+  ---
+  duration_ms: 397.641457
+  type: 'test'
+  ...
+# Subtest: the claude check runs only for a claude-code instance, and refuses a claude that appends or answers wrong
+ok 40 - the claude check runs only for a claude-code instance, and refuses a claude that appends or answers wrong
+  ---
+  duration_ms: 856.874242
+  type: 'test'
+  ...
+# Subtest: the claude check runs the bus unit's MOSAIC_CLAUDE_BIN over claude on PATH
+ok 41 - the claude check runs the bus unit's MOSAIC_CLAUDE_BIN over claude on PATH
+  ---
+  duration_ms: 262.683595
+  type: 'test'
+  ...
+# Subtest: the session env file refuses when missing, open to others, a symlink, empty, or emptied by a later line
+ok 42 - the session env file refuses when missing, open to others, a symlink, empty, or emptied by a later line
+  ---
+  duration_ms: 591.944048
+  type: 'test'
+  ...
+# Subtest: inside a session's sandbox a bind below 1024 fails with EACCES, and a bind on a free high port succeeds
+ok 43 - inside a session's sandbox a bind below 1024 fails with EACCES, and a bind on a free high port succeeds
+  ---
+  duration_ms: 82.554846
+  type: 'test'
+  ...
+1..43
+# tests 43
+# suites 0
+# pass 43
+# fail 0
+# cancelled 0
+# skipped 0
+# todo 0
+# duration_ms 66326.521088

agents/gander/work/queue-253/run3-focused/files/03.command.json

@@ -0,0 +1 @@
+["timeout", "-k", "10", "300", "node", "--test", "--test-reporter=tap", "packages/bus/tests/account-migration.test.mjs"]

agents/gander/work/queue-253/run3-focused/files/03.log

@@ -0,0 +1,28 @@
+TAP version 13
+# Subtest: REQ-LIMIT-4 3h copy migrates to 3i: every row keeps its seq, the sequence carries over, and only the account CHECK changes
+ok 1 - REQ-LIMIT-4 3h copy migrates to 3i: every row keeps its seq, the sequence carries over, and only the account CHECK changes
+  ---
+  duration_ms: 82.597902
+  type: 'test'
+  ...
+# Subtest: REQ-LIMIT-4 a 3h→3i step that fails partway leaves the store at 3h with every row, the sequence and the schema intact
+ok 2 - REQ-LIMIT-4 a 3h→3i step that fails partway leaves the store at 3h with every row, the sequence and the schema intact
+  ---
+  duration_ms: 92.53462
+  type: 'test'
+  ...
+# Subtest: REQ-LIMIT-4 the 3h engine refuses a migrated store, migrating or not, and leaves it as it was
+ok 3 - REQ-LIMIT-4 the 3h engine refuses a migrated store, migrating or not, and leaves it as it was
+  ---
+  duration_ms: 81.102574
+  type: 'test'
+  ...
+1..3
+# tests 3
+# suites 0
+# pass 3
+# fail 0
+# cancelled 0
+# skipped 0
+# todo 0
+# duration_ms 340.975929

agents/gander/work/queue-253/run3-focused/files/04.command.json

@@ -0,0 +1 @@
+["timeout", "-k", "10", "300", "node", "--test", "--test-reporter=tap", "packages/bus/tests/chief-of-staff.test.mjs"]

agents/gander/work/queue-253/run3-focused/files/04.log

@@ -0,0 +1,271 @@
+TAP version 13
+# organization: {"event":"reload-needs-restart","business":"demo"}
+# organization: {"event":"reload-needs-restart","business":"demo"}
+# organization: {"event":"reload-needs-restart","business":"demo"}
+# organization: {"event":"reload-needs-restart","business":"demo"}
+# organization: {"event":"reload-needs-restart","business":"demo"}
+# organization: {"event":"reload-needs-restart","business":"demo"}
+# organization: {"event":"reload-needs-restart","business":"demo"}
+# organization: {"event":"reload-needs-restart","business":"demo"}
+# organization: {"event":"reload-needs-restart","business":"demo"}
+# Subtest: REQ-COS-1, REQ-ROLE-2: the chief of staff ends a run with a reason and no decision, and the reason is logged
+ok 1 - REQ-COS-1, REQ-ROLE-2: the chief of staff ends a run with a reason and no decision, and the reason is logged
+  ---
+  duration_ms: 28.331746
+  type: 'test'
+  ...
+# Subtest: REQ-ROLE-2: a role without role.end still needs a resolved decision to revoke
+ok 2 - REQ-ROLE-2: a role without role.end still needs a resolved decision to revoke
+  ---
+  duration_ms: 26.434808
+  type: 'test'
+  ...
+# Subtest: REQ-ROLE-2: storage accepts a revoke with a reason or a decision and aborts one with neither
+ok 3 - REQ-ROLE-2: storage accepts a revoke with a reason or a decision and aborts one with neither
+  ---
+  duration_ms: 17.938787
+  type: 'test'
+  ...
+# Subtest: REQ-ROLE-2: the chief of staff may still cite a decision, and a decision alone is the old path
+ok 4 - REQ-ROLE-2: the chief of staff may still cite a decision, and a decision alone is the old path
+  ---
+  duration_ms: 18.620206
+  type: 'test'
+  ...
+# Subtest: REQ-ROLE-2: a role without role.end still ends a run through a resolved decision, which is recorded and has no reason
+ok 5 - REQ-ROLE-2: a role without role.end still ends a run through a resolved decision, which is recorded and has no reason
+  ---
+  duration_ms: 21.128166
+  type: 'test'
+  ...
+# Subtest: REQ-ROLE-2: a reason is required, bounded, and never sent with a decision
+ok 6 - REQ-ROLE-2: a reason is required, bounded, and never sent with a decision
+  ---
+  duration_ms: 23.298242
+  type: 'test'
+  ...
+# Subtest: REQ-COS-1: the chief of staff cannot end its own run; its end of the assistant stops the assistant's thread run
+ok 7 - REQ-COS-1: the chief of staff cannot end its own run; its end of the assistant stops the assistant's thread run
+  ---
+  duration_ms: 24.376739
+  type: 'test'
+  ...
+# Subtest: REQ-LIMIT-1, REQ-COS-1: organization.set from the chief of staff reaches the shared writer, named as the actor
+ok 8 - REQ-LIMIT-1, REQ-COS-1: organization.set from the chief of staff reaches the shared writer, named as the actor
+  ---
+  duration_ms: 18.346487
+  type: 'test'
+  ...
+# Subtest: REQ-LIMIT-1, REQ-COS-1: a refused organization.set logs action.refused and no action.allowed, like a refused limits.set
+ok 9 - REQ-LIMIT-1, REQ-COS-1: a refused organization.set logs action.refused and no action.allowed, like a refused limits.set
+  ---
+  duration_ms: 23.149091
+  type: 'test'
+  ...
+# Subtest: REQ-LIMIT-1: organization.set is refused for every caller whose role file lacks organization.change
+ok 10 - REQ-LIMIT-1: organization.set is refused for every caller whose role file lacks organization.change
+  ---
+  duration_ms: 26.114851
+  type: 'test'
+  ...
+# Subtest: REQ-LIMIT-1: the chief of staff is logged as allowed, and organization.set takes only the human's keys
+ok 11 - REQ-LIMIT-1: the chief of staff is logged as allowed, and organization.set takes only the human's keys
+  ---
+  duration_ms: 28.913122
+  type: 'test'
+  ...
+# Subtest: REQ-COS-1: organization.revision answers the revision alone to the chief of staff and spends nothing
+ok 12 - REQ-COS-1: organization.revision answers the revision alone to the chief of staff and spends nothing
+  ---
+  duration_ms: 23.086141
+  type: 'test'
+  ...
+# Subtest: REQ-COS-1, REQ-LIMIT-1: organization.revision is refused for every caller whose role file lacks organization.change
+ok 13 - REQ-COS-1, REQ-LIMIT-1: organization.revision is refused for every caller whose role file lacks organization.change
+  ---
+  duration_ms: 24.973528
+  type: 'test'
+  ...
+# Subtest: REQ-ROLE-3, REQ-LIMIT-1: a chief-of-staff change is validated, written and logged like a human's; an invalid one is refused
+ok 14 - REQ-ROLE-3, REQ-LIMIT-1: a chief-of-staff change is validated, written and logged like a human's; an invalid one is refused
+  ---
+  duration_ms: 121.448868
+  type: 'test'
+  ...
+# Subtest: REQ-COS-1: the chief of staff reads the revision, changes the file with it, and reads again after a stale one is refused
+ok 15 - REQ-COS-1: the chief of staff reads the revision, changes the file with it, and reads again after a stale one is refused
+  ---
+  duration_ms: 69.528621
+  type: 'test'
+  ...
+# Subtest: Q169: the chief of staff's change of the assistant is validated, written and logged; a stale or protection-stripping one is refused
+ok 16 - Q169: the chief of staff's change of the assistant is validated, written and logged; a stale or protection-stripping one is refused
+  ---
+  duration_ms: 77.400397
+  type: 'test'
+  ...
+# Subtest: row 65, Q169: the chief's change of the assistant's route runs the routing checks, and a valid one saves as the chief
+ok 17 - row 65, Q169: the chief's change of the assistant's route runs the routing checks, and a valid one saves as the chief
+  ---
+  duration_ms: 52.105961
+  type: 'test'
+  ...
+# Subtest: REQ-ROLE-2, REQ-COS-1: the 3c→3d migration lets the chief of staff end a held role with a reason; neither is still refused
+ok 18 - REQ-ROLE-2, REQ-COS-1: the 3c→3d migration lets the chief of staff end a held role with a reason; neither is still refused
+  ---
+  duration_ms: 75.179142
+  type: 'test'
+  ...
+# Subtest: row 194 T10: the chief's reason end of a kept instance refuses instance-kept, holds the claim and spends nothing
+ok 19 - row 194 T10: the chief's reason end of a kept instance refuses instance-kept, holds the claim and spends nothing
+  ---
+  duration_ms: 18.345149
+  type: 'test'
+  ...
+# Subtest: row 194 T10 (Q2): a role.revoke citing a decision the human resolved still ends a kept run
+ok 20 - row 194 T10 (Q2): a role.revoke citing a decision the human resolved still ends a kept run
+  ---
+  duration_ms: 19.386726
+  type: 'test'
+  ...
+# Subtest: row 194 T10 (B7): the chief's organization.set of a kept instance's model refuses before the writer; the human's limits.set does not
+ok 21 - row 194 T10 (B7): the chief's organization.set of a kept instance's model refuses before the writer; the human's limits.set does not
+  ---
+  duration_ms: 19.01179
+  type: 'test'
+  ...
+# Subtest: row 194 T13: organization.set and limits.set refuse the launch, retired, keep and noHire keys before the writer
+ok 22 - row 194 T13: organization.set and limits.set refuse the launch, retired, keep and noHire keys before the writer
+  ---
+  duration_ms: 23.117738
+  type: 'test'
+  ...
+# Subtest: row 194 T18 (D2.4): from a chief session veto.set and instances.set refuse, and nothing reaches the writer
+ok 23 - row 194 T18 (D2.4): from a chief session veto.set and instances.set refuse, and nothing reaches the writer
+  ---
+  duration_ms: 22.420802
+  type: 'test'
+  ...
+# Subtest: row 194 T8: the chief hires with a reason and no decision, the writer gets the reason as context, and the log names it
+ok 24 - row 194 T8: the chief hires with a reason and no decision, the writer gets the reason as context, and the log names it
+  ---
+  duration_ms: 21.138167
+  type: 'test'
+  ...
+# Subtest: row 194 T11: on a bus with two businesses, the chief of one hires and fires only in its own
+ok 25 - row 194 T11: on a bus with two businesses, the chief of one hires and fires only in its own
+  ---
+  duration_ms: 18.321241
+  type: 'test'
+  ...
+# Subtest: row 194 T8: hire and fire need a reason of 1 to 500 characters and refuse a decision key
+ok 26 - row 194 T8: hire and fire need a reason of 1 to 500 characters and refuse a decision key
+  ---
+  duration_ms: 29.401579
+  type: 'test'
+  ...
+# Subtest: row 194 T8 (sage-1471): only the chief hires or fires; every other role refuses role-not-chief, even one granted the actions
+ok 27 - row 194 T8 (sage-1471): only the chief hires or fires; every other role refuses role-not-chief, even one granted the actions
+  ---
+  duration_ms: 27.890795
+  type: 'test'
+  ...
+# Subtest: row 194 T8 (sage-1471): a chief whose authority lacks role.hire or role.fire refuses decision-required before the writer
+ok 28 - row 194 T8 (sage-1471): a chief whose authority lacks role.hire or role.fire refuses decision-required before the writer
+  ---
+  duration_ms: 39.940767
+  type: 'test'
+  ...
+# Subtest: row 194 T8a: a re-hire of a fired name goes to the writer like a hire, and the writer's refusals pass through by name
+ok 29 - row 194 T8a: a re-hire of a fired name goes to the writer like a hire, and the writer's refusals pass through by name
+  ---
+  duration_ms: 23.456981
+  type: 'test'
+  ...
+# Subtest: row 194 T8b: a definition is hireable only when every action is on HIRE_ALLOWED, it is version 2, the chief lists it and noHire doesn't
+ok 30 - row 194 T8b: a definition is hireable only when every action is on HIRE_ALLOWED, it is version 2, the chief lists it and noHire doesn't
+  ---
+  duration_ms: 664.437436
+  type: 'test'
+  ...
+# Subtest: row 194 T8b: a hire without the role files configured refuses not-configured
+ok 31 - row 194 T8b: a hire without the role files configured refuses not-configured
+  ---
+  duration_ms: 18.714128
+  type: 'test'
+  ...
+# Subtest: row 194 T9: a fire revokes the claim, cancels open requests, asks the launcher to kill the runs, then delists and logs
+ok 32 - row 194 T9: a fire revokes the claim, cancels open requests, asks the launcher to kill the runs, then delists and logs
+  ---
+  duration_ms: 21.402072
+  type: 'test'
+  ...
+# Subtest: row 194 T9a (bus): a fire end's done writes lifecycle.end.killed and lifecycle.end.alive with run and pid, and an unknown stop's reason; a terminate's done or a bad stop refuses
+ok 33 - row 194 T9a (bus): a fire end's done writes lifecycle.end.killed and lifecycle.end.alive with run and pid, and an unknown stop's reason; a terminate's done or a bad stop refuses
+  ---
+  duration_ms: 25.798012
+  type: 'test'
+  ...
+# Subtest: row 194 T9: fire refusals come before step A and leave the claim, the requests and the file alone
+ok 34 - row 194 T9: fire refusals come before step A and leave the claim, the requests and the file alone
+  ---
+  duration_ms: 22.191888
+  type: 'test'
+  ...
+# Subtest: row 194 T9c: a writer failure at B leaves the instance firing, and the repeat delists and logs once
+ok 35 - row 194 T9c: a writer failure at B leaves the instance firing, and the repeat delists and logs once
+  ---
+  duration_ms: 23.500086
+  type: 'test'
+  ...
+# Subtest: row 194 T9c: a failure at C leaves the fire unlogged and the instance firing, and the repeat logs it
+ok 36 - row 194 T9c: a failure at C leaves the fire unlogged and the instance firing, and the repeat logs it
+  ---
+  duration_ms: 24.322177
+  type: 'test'
+  ...
+# Subtest: row 194 W-N1: a fire.done before a later fire.stopped of the same instance leaves it firing; another instance's done does not end it
+ok 37 - row 194 W-N1: a fire.done before a later fire.stopped of the same instance leaves it firing; another instance's done does not end it
+  ---
+  duration_ms: 21.989082
+  type: 'test'
+  ...
+# Subtest: row 194 T10: a hire or fire of a kept name refuses instance-kept before the writer
+ok 38 - row 194 T10: a hire or fire of a kept name refuses instance-kept before the writer
+  ---
+  duration_ms: 18.687603
+  type: 'test'
+  ...
+# Subtest: row 194 T10: a fire the writer's check refuses from the file stops nothing and leaves the instance launchable
+ok 39 - row 194 T10: a fire the writer's check refuses from the file stops nothing and leaves the instance launchable
+  ---
+  duration_ms: 18.529568
+  type: 'test'
+  ...
+# Subtest: row 194 T18: hire and fire take only their own keys, and a refused call writes nothing
+ok 40 - row 194 T18: hire and fire take only their own keys, and a refused call writes nothing
+  ---
+  duration_ms: 24.530376
+  type: 'test'
+  ...
+# Subtest: row 194 T8, T9, T18: through the runtime the chief hires and fires with the real writer, the receipt carries the reason, and a refusal leaves the file alone
+ok 41 - row 194 T8, T9, T18: through the runtime the chief hires and fires with the real writer, the receipt carries the reason, and a refusal leaves the file alone
+  ---
+  duration_ms: 67.04966
+  type: 'test'
+  ...
+# Subtest: row 194 W-N1: the launcher's take of a launch or regenerate of a firing instance closes it as instance-firing
+ok 42 - row 194 W-N1: the launcher's take of a launch or regenerate of a firing instance closes it as instance-firing
+  ---
+  duration_ms: 24.174855
+  type: 'test'
+  ...
+1..42
+# tests 42
+# suites 0
+# pass 42
+# fail 0
+# cancelled 0
+# skipped 0
+# todo 0
+# duration_ms 2069.126162

agents/gander/work/queue-253/run3-focused/files/05.command.json

@@ -0,0 +1 @@
+["timeout", "-k", "10", "300", "node", "--test", "--test-reporter=tap", "packages/bus/tests/comment-migration.test.mjs"]

agents/gander/work/queue-253/run3-focused/files/05.log

@@ -0,0 +1,40 @@
+TAP version 13
+# Subtest: explicit 3b copy migration preserves evidence and opens as 3g; normal startup never migrates
+ok 1 - explicit 3b copy migration preserves evidence and opens as 3g; normal startup never migrates
+  ---
+  duration_ms: 66.915434
+  type: 'test'
+  ...
+# Subtest: migration refuses active writers and drifted legacy schemas, with no partial upgrade
+ok 2 - migration refuses active writers and drifted legacy schemas, with no partial upgrade
+  ---
+  duration_ms: 87.090397
+  type: 'test'
+  ...
+# Subtest: named migration registry chains 3b through 3g to a fixture-only future version in order
+ok 3 - named migration registry chains 3b through 3g to a fixture-only future version in order
+  ---
+  duration_ms: 92.896241
+  type: 'test'
+  ...
+# Subtest: migration refuses mismatched source metadata without changing schema or evidence
+ok 4 - migration refuses mismatched source metadata without changing schema or evidence
+  ---
+  duration_ms: 36.477831
+  type: 'test'
+  ...
+# Subtest: offline command migrates only the supplied fixture root and reports usage errors
+ok 5 - offline command migrates only the supplied fixture root and reports usage errors
+  ---
+  duration_ms: 168.952237
+  type: 'test'
+  ...
+1..5
+# tests 5
+# suites 0
+# pass 5
+# fail 0
+# cancelled 0
+# skipped 0
+# todo 0
+# duration_ms 517.394008

agents/gander/work/queue-253/run3-focused/files/06.command.json

@@ -0,0 +1 @@
+["timeout", "-k", "10", "300", "node", "--test", "--test-reporter=tap", "packages/bus/tests/end-launch.test.mjs"]

agents/gander/work/queue-253/run3-focused/files/06.log

@@ -0,0 +1,52 @@
+TAP version 13
+# Subtest: endLaunch writes session.ended, releases the run claim and kills its capabilities
+ok 1 - endLaunch writes session.ended, releases the run claim and kills its capabilities
+  ---
+  duration_ms: 19.923626
+  type: 'test'
+  ...
+# Subtest: endLaunch refuses an unknown run, a second end and a rebind of the ended run
+ok 2 - endLaunch refuses an unknown run, a second end and a rebind of the ended run
+  ---
+  duration_ms: 11.57898
+  type: 'test'
+  ...
+# Subtest: a restarted broker refuses to rebind an ended run; a refused rebind leaves the run unbound
+ok 3 - a restarted broker refuses to rebind an ended run; a refused rebind leaves the run unbound
+  ---
+  duration_ms: 13.959669
+  type: 'test'
+  ...
+# Subtest: endLaunch leaves a claim another run took alone
+ok 4 - endLaunch leaves a claim another run took alone
+  ---
+  duration_ms: 15.607261
+  type: 'test'
+  ...
+# Subtest: refuse records action.refused against the caller with the code only
+ok 5 - refuse records action.refused against the caller with the code only
+  ---
+  duration_ms: 11.34653
+  type: 'test'
+  ...
+# Subtest: launches off refuses role.launch with launch-revoked until launches on
+ok 6 - launches off refuses role.launch with launch-revoked until launches on
+  ---
+  duration_ms: 15.612767
+  type: 'test'
+  ...
+# Subtest: broker process: launch ops authorize role.launch, record refusals and end runs
+ok 7 - broker process: launch ops authorize role.launch, record refusals and end runs
+  ---
+  duration_ms: 162.081295
+  type: 'test'
+  ...
+1..7
+# tests 7
+# suites 0
+# pass 7
+# fail 0
+# cancelled 0
+# skipped 0
+# todo 0
+# duration_ms 323.68804

agents/gander/work/queue-253/run3-focused/files/07.command.json

@@ -0,0 +1 @@
+["timeout", "-k", "10", "300", "node", "--test", "--test-reporter=tap", "packages/bus/tests/fire-revokes-grants.test.mjs"]

agents/gander/work/queue-253/run3-focused/files/07.log

@@ -0,0 +1,142 @@
+TAP version 13
+# Subtest: row 281 T2: a fire with host grants on two hosts and a Gitea grant answers with a job, then revokes all three
+ok 1 - row 281 T2: a fire with host grants on two hosts and a Gitea grant answers with a job, then revokes all three
+  ---
+  duration_ms: 232.783752
+  type: 'test'
+  ...
+# Subtest: row 281 T3 (sage-2575): a delete with grants takes two requests: the first starts the job, the next completes
+ok 2 - row 281 T3 (sage-2575): a delete with grants takes two requests: the first starts the job, the next completes
+  ---
+  duration_ms: 223.116777
+  type: 'test'
+  ...
+# Subtest: row 281 T3b (Q2): a delete whose job refuses on host B; the retry refuses grant-revoke-failed and revokes only B and Gitea
+ok 3 - row 281 T3b (Q2): a delete whose job refuses on host B; the retry refuses grant-revoke-failed and revokes only B and Gitea
+  ---
+  duration_ms: 211.879543
+  type: 'test'
+  ...
+# Subtest: row 281 T3b: B cleared by hand with hosts.revoke; the next delete starts a job for Gitea and the leftover line only
+ok 4 - row 281 T3b: B cleared by hand with hosts.revoke; the next delete starts a job for Gitea and the leftover line only
+  ---
+  duration_ms: 208.941116
+  type: 'test'
+  ...
+# Subtest: row 281 T3c (sage-2575 condition 4): a delete of an instance with no grant completes in one request
+ok 5 - row 281 T3c (sage-2575 condition 4): a delete of an instance with no grant completes in one request
+  ---
+  duration_ms: 52.070752
+  type: 'test'
+  ...
+# Subtest: row 281 T4: host B unreachable in a fire: the job refuses, A stays revoked, B and Gitea untouched; a repeat completes
+ok 6 - row 281 T4: host B unreachable in a fire: the job refuses, A stays revoked, B and Gitea untouched; a repeat completes
+  ---
+  duration_ms: 193.713805
+  type: 'test'
+  ...
+# Subtest: row 281 T4b (Q1): a line a manual hosts.revoke left on C is removed by the fire, with its close
+ok 7 - row 281 T4b (Q1): a line a manual hosts.revoke left on C is removed by the fire, with its close
+  ---
+  duration_ms: 100.196392
+  type: 'test'
+  ...
+# Subtest: row 281 T4b (Q1): with C unreachable, the fire completes and names the line in grantsLeft
+ok 8 - row 281 T4b (Q1): with C unreachable, the fire completes and names the line in grantsLeft
+  ---
+  duration_ms: 82.925658
+  type: 'test'
+  ...
+# Subtest: row 281 T5: Gitea's admin token can't be checked: the job refuses with the Gitea grant intact
+ok 9 - row 281 T5: Gitea's admin token can't be checked: the job refuses with the Gitea grant intact
+  ---
+  duration_ms: 112.342135
+  type: 'test'
+  ...
+# Subtest: row 281 T5b (N1): a failed token DELETE refuses gitea-left; the repeat retries only this agent's entries
+ok 10 - row 281 T5b (N1): a failed token DELETE refuses gitea-left; the repeat retries only this agent's entries
+  ---
+  duration_ms: 295.497967
+  type: 'test'
+  ...
+# Subtest: row 281 T6 (sage-2574): a host decision approved before the fire and run after it ends revoked, with nothing applied
+ok 11 - row 281 T6 (sage-2574): a host decision approved before the fire and run after it ends revoked, with nothing applied
+  ---
+  duration_ms: 64.894992
+  type: 'test'
+  ...
+# Subtest: row 281 T6b (sage-2574): a Gitea decision approved before the fire and run after it ends revoked before any Gitea write
+ok 12 - row 281 T6b (sage-2574): a Gitea decision approved before the fire and run after it ends revoked before any Gitea write
+  ---
+  duration_ms: 86.54008
+  type: 'test'
+  ...
+# Subtest: row 281 T6c: a host executor in flight aborts and ends revoked; a Gitea executor in flight is awaited and leaves no token
+ok 13 - row 281 T6c: a host executor in flight aborts and ends revoked; a Gitea executor in flight is awaited and leaves no token
+  ---
+  duration_ms: 237.49431
+  type: 'test'
+  ...
+# Subtest: row 281 T6d (B1): undecided host and Gitea decisions are in the set, and approved after the fire both end revoked
+ok 14 - row 281 T6d (B1): undecided host and Gitea decisions are in the set, and approved after the fire both end revoked
+  ---
+  duration_ms: 92.642809
+  type: 'test'
+  ...
+# Subtest: row 281 T6e (B1): a grant raise refuses instance-fired while firing and after the fire, goes through after a rehire, and refuses grant-revoke-running during a delete job
+ok 15 - row 281 T6e (B1): a grant raise refuses instance-fired while firing and after the fire, goes through after a rehire, and refuses grant-revoke-running during a delete job
+  ---
+  duration_ms: 104.408759
+  type: 'test'
+  ...
+# Subtest: row 281 T7: an instance with no grant fires as today, synchronously, with the same events
+ok 16 - row 281 T7: an instance with no grant fires as today, synchronously, with the same events
+  ---
+  duration_ms: 52.79141
+  type: 'test'
+  ...
+# Subtest: row 281 T9 (B3): one step G per agent; the manual verbs refuse while it runs, and sweep names it running
+ok 17 - row 281 T9 (B3): one step G per agent; the manual verbs refuse while it runs, and sweep names it running
+  ---
+  duration_ms: 223.695847
+  type: 'test'
+  ...
+# Subtest: row 281 T10 (B2): the fire and the delete answer while their jobs are held, and the broker answers other verbs
+ok 18 - row 281 T10 (B2): the fire and the delete answer while their jobs are held, and the broker answers other verbs
+  ---
+  duration_ms: 196.138967
+  type: 'test'
+  ...
+# Subtest: row 281 T11 (C1): a fire's job completes after the chief's run ends and processing halts
+ok 19 - row 281 T11 (C1): a fire's job completes after the chief's run ends and processing halts
+  ---
+  duration_ms: 81.192633
+  type: 'test'
+  ...
+# Subtest: row 281 T12 (C1, N7): a step B refusal in the job is fire.failed, and the repeat runs B and C synchronously
+ok 20 - row 281 T12 (C1, N7): a step B refusal in the job is fire.failed, and the repeat runs B and C synchronously
+  ---
+  duration_ms: 76.945309
+  type: 'test'
+  ...
+# Subtest: row 281 T13 (N4): a restart records each held job interrupted once, with one message each; an ended job gets none
+ok 21 - row 281 T13 (N4): a restart records each held job interrupted once, with one message each; an ended job gets none
+  ---
+  duration_ms: 129.403455
+  type: 'test'
+  ...
+# Subtest: row 281 T14 (N1, sage-2653): a host removed under an undecided decision stops the fire on host-unknown; the human's no closes it, and the repeat fire has no job
+ok 22 - row 281 T14 (N1, sage-2653): a host removed under an undecided decision stops the fire on host-unknown; the human's no closes it, and the repeat fire has no job
+  ---
+  duration_ms: 61.78992
+  type: 'test'
+  ...
+1..22
+# tests 22
+# suites 0
+# pass 22
+# fail 0
+# cancelled 0
+# skipped 0
+# todo 0
+# duration_ms 3217.339801

agents/gander/work/queue-253/run3-focused/files/08.command.json

@@ -0,0 +1 @@
+["timeout", "-k", "10", "300", "node", "--test", "--test-reporter=tap", "packages/bus/tests/gitea-grant.test.mjs"]