launchpad: row 294 BUILD.md M1 expectation corrected (Duckworth C1), review recorded with N1-N4 dispositions

launchpad: row 294 round 1 manifest (17 paths from 9450774cb) and notes with the owner-transport exception
launchpad: row 294 sage-3157, owner-transport exception written out, userOptionsFor, G9 pins no user value, M10/M11 (unrun, #1800 )
2026-10-22 22:34:33 -05:00 · 2026-10-22 22:17:05 -05:00 · 2026-10-22 21:57:39 -05:00 · 2026-10-22 21:52:29 -05:00 · 2026-10-22 21:52:26 -05:00 · 2026-10-22 21:48:48 -05:00
38 changed files with 1203 additions and 848 deletions
@@ -5376,7 +5376,3 @@ Gander: after Duckworth-0100 design approval with C1-C5, prepared the two host-s
 2026-10-23T01:41:59Z | Gyro sage-3121 A1-A3 PRD alignment | Before: 8d209016b adds a current Connections graph, excludes new Markdown stories in converted books and defaults archiveFolder. After: parent/W4 align with PRD1.17 d6 sha256 886b93c571f87bfbb2f27ee3113b6800a32d8f89196d95ace33566031bee380a: clickable editor links only; graph/tests later pending J-b; new different-path Markdown in a converted book remains canon until import, only recreated converted old paths are unmapped; archive folder is human-set in library mapping with no default, missing folder refuses conversion. Static A1-A3/11-brief checks pass; W4 locator/extractor/access/remote/recovery blocks unchanged. Local commit only, push held for Sage's named gap while Gizmoduck holds 270+271 run5. No product/build/browser/worker/queue/live action. Fenton gets local SHA through shared object store.

 2026-10-23T01:49:08Z | Gyro fenton-0012 B1/B2 and N1-N6, mos-1379 | B1: off-host remote must deny the real shared jason.woltje seat-helper credential as well as seat identities until #431; private visibility/dummy-token denial is insufficient; W3b/A16/A26 require that future fixture proof. B2 follows mos-1379: human-only editor.agentReadComments and editor.agentReadTrackedDeletions both default false, comment/original/markup reads/resolves/index/context refuse when off; final access remains D9 and no role allowlist/per-document grant. N1 staging-ref allowlist and retained private refused/published audit refs; N2 URLs literal with fidelity-report loss and confirmation; N3 future paths marked new or predecessor row; N4 rename/sharing wording fixed; N5 historical thread text not refreshed; N6 protected VM1012 backup cited in P5. Static checks pass, locator JSON/package/projection mechanics retained. Local commit only; HTTPS push still held for Sage's named gap. No credentials tested/read/printed, no product/build/browser/worker/queue/live action. Fenton gets exact local SHA/blobs.
-
-2026-10-23T01:53:25Z | Gyro fenton-0013 N7 mixed-format chapter order | Fenton approved local 0f4fa4f93. D10 now explicitly orders every chapter ID regardless of Markdown/DOCX format, inserts new canon Markdown by row216 or human committed order, and preserves ID/position at import. W7 tests cover mixed traversal/insertion/import stability. Static diff/append-only checks and docs hook pass. Local commit only, narrow re-check requested, HTTPS push still held for Sage gap. No runtime, queue or live change.
-
-2026-10-23T02:21:06Z | Sage, rows 270+271 landing, 571 landing, MVP rows | Before: 270 (#1775) and 271 (#1776) were approved on gizmoduck/row270-271-r4 49cee846e and 2b964a082 after combined gate C2 run 5 GREEN on 53406f3e4 (bus 873, seat 202, cli 905, ten scripts, 38/38 mutants). After: 33 commits cherry-picked onto 767bb62c7 as 7328da8ca, range-diff all "=", 40 paths identical to the candidate; 270 manifest f4174458 matches, 271 manifest 3ab1f5c8 matches on 29 paths, the other 4 moved under 270 and match its manifest. Done revs 3396/3398, #1775 c30962 and #1776 c30964 closed, P19 463 c861. 571 (Gyro, Fenton APPROVE) picked as ee5f7b9ef, 6345aae3d, 767bb62c7 (blobs 9382f85b, 7ec0897b), 1ac76a417 left out; N7 911dad2aa (Fenton-0014) picked after. Rows 293-299 added (574, FED R6, R4, R7, GitHub grant, Q228, 573), queue commit 253346e3c. Correction: the push sync step checked out O..S paths over the canonical worktree without testing for uncommitted edits, so any pending SESSIONS or BUILD-LOG line in the canonical checkout at 02:06Z would have been overwritten; the sync now skips edited paths. Schema 3n is not live (LIVE 0cbe2e9b3 at 3m).
@@ -1,7 +0,0 @@
-{
-  "base": "01983cd3f",
-  "test": "packages/cli/tests/stack-release.test.mjs",
-  "base_is_byte_exact_prefix": true,
-  "old_assertions_changed": 0,
-  "old_console_refusal_text_unchanged": true
-}
@@ -1,48 +0,0 @@
-# Target config validation for every key implementation plan
-
-Goal: #1797, mos-1353, brief f0e3dcdf4:docs/plans/2026-10-22_config-checks-any-key-brief.md. Base01983cd3f, branchgander/config-checks-any-key. Reviewer Duckworth. Queue number pending Sage; packet moves to queue-N when assigned. No Node, test or push before Sage gap/CLEAR. Rows270/271/203 land first; rebase under a new branch name before the gate.
-
-Architecture: config_checks classifies missing/parseable/unreadable config independently of console presence. With a loader, every existing parseable config goes through the target's own validate. Missing config passes. Malformed JSON refuses. With no loader, allow only the oldest four top-level keys: configVersion, environment, dataRoot, execution. Evidence: c3d29e796:scripts/mosaic-config.mjs:114, the first loader commit, rejectUnknownKeys; row200 fixture's LOADER_OLD has the same list. A missing loader plus a later key refuses and names that key, without inventing validation support. The legacy public refusal code config-console-key and existing console-specific message stay byte-identical; new non-console refusals name the loader's first diagnostic and preserve restore-config-backup instruction. The target loader's resolved stdout is discarded. Its first stderr diagnostic is reported and may echo an invalid value.
-
-Files: scripts/stack-release.sh config_checks/comment only; packages/cli/tests/stack-release.test.mjs appended regression coverage only; docs/TOOLS.md broadens the current console-only release-check description. Existing row200 tests and assertions stay unchanged. No fixture-module edit, flags, pointers, migration, schema, data, live unit or host change.
-
-Tests to write before implementation, unrun until CLEAR:
- A target loader rejecting a non-console key refuses activate and rollback before any unit stop/start, pointer/unit/store mutation; one refused log entry; --plan preserves state and lists refusal. Reuse refused() and planOnly(). Use execution, already known to the current loader, to prove console-free dispatch before row270 integration; add compactionReadBytes/compactionStreams cases on final post270 base if needed.
- An accepting target loader is actually called with validate and the selected MOSAIC_CONFIG, succeeds activate/rollback without console, and resolved stdout is not leaked.
- Missing-loader target permits oldest-key config but rejects a later key with backup instruction. A stand-in rejecting the existing execution key exercises the generic target-validation branch; missing-loader later-key test may use console until final post270 base supplies non-console new keys.
- Missing file passes the isolated real config_checks function; malformed JSON refuses there, since load_config otherwise exits before this function. Tests extract only that function and provide copies/path/check_refuse stand-ins, never live state.
- Existing console-key row200 tests and malformed-load test run whole unchanged.
-
-Mutants, each unique target, syntax preflight and byte-identical restore:
-M1 restores the console-only skip, killed by the named non-console activate/rollback refusal test.
-M2 ignores failed target validation, killed by the same refusal assertions.
-M3 allows a missing-loader target with a later key, killed by the explicit missing-loader regression.
-M4 treats malformed JSON as absence, killed by isolated parse guard test.
-M5 skips the loader for an oldest-key config, killed by accepting-loader invocation witness.
-
-Gate after static review and required rebases: intended RED/GREEN; touched stack-release.test.mjs whole, CLI suite whole and every scripts/test-*.sh whole; M1-M5 with fresh passing controls, no timeout counted as kill, restored bytes/status before next. TMPDIR mktemp-d /mnt/storage/scratch/tmp/gXXX; pipefail/tee and busy check before each start. Node timeout-k10 uses at least3x measured duration plus margin; stack-release prior full receipt around584s implies at least1871s, to be recorded from actual receipts before CLEAR. Shell3x table retained with receipts. No test ran and no behavior passes claimed.
-
-Review focus: parser races after load_config; target stderr naming only the refused key, stdout never persisted; current versus target loader selection; unknown key with no console; missing loader compatibility set from immutable history; upcoming row270 loader-list fixture drift. Final integration audits every test dependency and hash pin against the named base. Session registration remains Sage's.
-
-
-Implementation ready, unrun. Four appended tests cover full activate/rollback refusal and plan; actual accepting validate witness/configpath and stdout nonleak; oldest-only missing loader with both compaction keys; missing/invalid JSON isolated realfunction. Stand-in loaders are ESM, matching .mjs. Every old test byte is preserved as a prefix. Existing console refusal text including missing-loader diagnostic is unchanged. Missing-loader compatibility is top-level key compatibility only; current load_config still validates the whole config before normal release operations. Three-path manifest, no fixture-module changes. Static target uniqueness M1-M5 passes. No Node parse, Bash execution or behavior run. Exact full compaction activate/rollback cases must be added against post270 loader, before final gate.
-
-
-Execution state:
- [x] Read brief, config_checks and row200 assertions.
- [x] Pin oldest key set from immutable loader history.
- [x] Write regression tests, implement bounded scope, prepare unique mutants.
- [ ] Duckworth static review.
- [ ] Move packet to queue-N on assignment, rebase after270/271/203 and add full compaction-key cases.
- [ ] On CLEAR run intendedRED/GREEN, touched whole file, CLI whole, M1-M5, ten shells; commit/push records only when authorized.
-
-
-## Duckworth0229 static approval, gate conditions
-
-Source0585b3213, packet e7371025f, manifestd6226d28 approved by static read, note a5a717391:agents/duckworth/work/row1797/ROUND1-0585b3213.md. No runtime proof yet.
-
-C1: after270/271/203 land, rebase under a new branch name and open a new static round. Add exact compactionReadBytes and compactionStreams full activate/rollback refusals. The existing LOADER_OLD uses the current loader plus concat after270, so it is not a pre270 witness; the new test requires its own pre270 stand-in. Reviewer checks the integrated manifest/test before CLEAR. N3 joins that delta: compactionStreams fixture value1024, matching the real type, instead of ['messages'].
-
-C2: every existing B/C1/C release now validates its copied real loader, including external/upgrade suites. Any old CLI red is a change-related suspect and goes to Mos/Sage under mos-1272; no automatic placement as an unrelated fixture.
-
-N1 console plus another refused key retains the old console text by design. N2 missing-loader wording is retained pending final integration review. N4 corrected above: only resolved stdout is suppressed; first stderr may echo a value, so no blanket secrecy claim. No runtime/Node/queue/push authorization is inferred from static approval.
@@ -1,3 +0,0 @@
-eea06caad07c746d194f793603052b210e437b7184009f8b1617c88db49a5517  docs/TOOLS.md
-a35c49c5703e02f35073450e4a98e1b90cffcda581490f97a70cbdc6d2afee59  packages/cli/tests/stack-release.test.mjs
-f8fe1348796d40a096362fb0c6d5072c15ca68ff8fe10384a3eaa708eb92c150  scripts/stack-release.sh
@@ -1,9 +0,0 @@
-{
-  "reviewer": "duckworth",
-  "verdict": "static approve, conditions C1-C2",
-  "message": "duckworth-0229",
-  "source": "0585b3213",
-  "manifest": "d6226d28",
-  "note": "a5a717391:agents/duckworth/work/row1797/ROUND1-0585b3213.md",
-  "next": "wait for row number and post270/271/203 base, new integration static round before gate"
-}
@@ -1,5 +0,0 @@
-{
-  "docs/TOOLS.md": "eea06caad07c746d194f793603052b210e437b7184009f8b1617c88db49a5517",
-  "packages/cli/tests/stack-release.test.mjs": "a35c49c5703e02f35073450e4a98e1b90cffcda581490f97a70cbdc6d2afee59",
-  "scripts/stack-release.sh": "f8fe1348796d40a096362fb0c6d5072c15ca68ff8fe10384a3eaa708eb92c150"
-}
@@ -1,14 +0,0 @@
-{
-  "issue": 1797,
-  "row": "pending Sage assignment",
-  "branch": "gander/config-checks-any-key",
-  "base": "01983cd3f",
-  "source": "0585b321309e4d8a199afb1a1024cf6091f56770",
-  "manifest": "d6226d281c778677a45e90993bbd9c985de89ba0f870d4a3ca12b6923a497e4a",
-  "runtime": "NOT RUN; no Node, tests or push authorized",
-  "after": [
-    270,
-    271,
-    203
-  ]
-}
@@ -1,32 +0,0 @@
-[
-  {
-    "id": "M1",
-    "occurrences": 1,
-    "before": "f8fe1348796d40a096362fb0c6d5072c15ca68ff8fe10384a3eaa708eb92c150",
-    "after": "804a86442527f2728f633f485eaeca02552df66a34350eac5101127046415188"
-  },
-  {
-    "id": "M2",
-    "occurrences": 1,
-    "before": "f8fe1348796d40a096362fb0c6d5072c15ca68ff8fe10384a3eaa708eb92c150",
-    "after": "1c2acb6397e29ab898d8a89bc5bc691a294be749ca7d7f7897c83ec1b3e9f9ef"
-  },
-  {
-    "id": "M3",
-    "occurrences": 1,
-    "before": "f8fe1348796d40a096362fb0c6d5072c15ca68ff8fe10384a3eaa708eb92c150",
-    "after": "954c9a9735904e1c566d844001b2e85c13cd16eb16e7b4b91b752974bb6dc754"
-  },
-  {
-    "id": "M4",
-    "occurrences": 1,
-    "before": "f8fe1348796d40a096362fb0c6d5072c15ca68ff8fe10384a3eaa708eb92c150",
-    "after": "953d91bf28073b11e4bc5a6da516a0db1b8dfff892083cd3e6fcebe9c47b6bbf"
-  },
-  {
-    "id": "M5",
-    "occurrences": 1,
-    "before": "f8fe1348796d40a096362fb0c6d5072c15ca68ff8fe10384a3eaa708eb92c150",
-    "after": "310c32b16f0fc554d5a7ffeeb0742ea7dd9fc84e1ddafabb25d7ca3f449865ef"
-  }
-]
@@ -1,37 +0,0 @@
-[
-  {
-    "id": "M1",
-    "file": "scripts/stack-release.sh",
-    "old": "    [ \"$key\" != 1 ] || return 0\n    if [ \"$key\" != 0 ]; then",
-    "new": "    [ \"$key\" != 1 ] || return 0\n    [ \"$extra\" = '\"console\"' ] || return 0\n    if [ \"$key\" != 0 ]; then",
-    "killer": "config-any-key: a non-console target refusal"
-  },
-  {
-    "id": "M2",
-    "file": "scripts/stack-release.sh",
-    "old": "elif out=\"$(MOSAIC_CONFIG=\"$cfg\" node \"$loader\" validate 2>&1 >/dev/null)\"; then return 0",
-    "new": "elif out=\"$(MOSAIC_CONFIG=\"$cfg\" node \"$loader\" validate 2>&1 >/dev/null)\" || true; then return 0",
-    "killer": "config-any-key: a non-console target refusal"
-  },
-  {
-    "id": "M3",
-    "file": "scripts/stack-release.sh",
-    "old": "        [ -n \"$extra\" ] || return 0",
-    "new": "        return 0 # drop missing-loader later-key refusal",
-    "killer": "config-any-key: missing-loader copies"
-  },
-  {
-    "id": "M4",
-    "file": "scripts/stack-release.sh",
-    "old": "    if [ \"$key\" != 0 ]; then\n        check_refuse config-console-key",
-    "new": "    if [ \"$key\" = 99 ]; then\n        check_refuse config-console-key",
-    "killer": "config-any-key: missing config passes but malformed JSON refuses"
-  },
-  {
-    "id": "M5",
-    "file": "scripts/stack-release.sh",
-    "old": "    if [ ! -f \"$loader\" ]; then",
-    "new": "    [ -n \"$extra\" ] || return 0\n    if [ ! -f \"$loader\" ]; then",
-    "killer": "config-any-key: accepting loaders run validate"
-  }
-]
@@ -1,230 +0,0 @@
-# Row 292 (#1797): config_checks runs the target loader on any config
-
-Builder Gizmoduck (sage-3146, mos-1387), reviewer Duckworth, gate owner Sage. Brief
-docs/plans/2026-10-22_config-checks-any-key-brief.md. Gander built round 1 on 01983cd3f
-(gander/config-checks-any-key, packet agents/gander/work/config-checks-any-key/, Duckworth static
-approve duckworth-0229 with C1-C2 and N1-N4). Gander doesn't build 292; questions about round 1 go
-to Gander. Nothing in this packet has run. No test, mutant or repo node ran, with one exception
-recorded under "Disclosure".
-
-## Rebase (sage-3146 item 1, sage-3148)
-
-Branch gizmoduck/row292, base b23783f39 (the row 270+271 landing 7328da8ca plus its docs commit;
-row 203 landed earlier). `git rebase --onto b23783f39 01983cd3f d4c796e44`.
-
-| commit | rebased | patch-id (stable) before | after |
-|---|---|---|---|
-| 0585b3213 fix(release) | 3b17c7550 | a922252a85b1317e09a625193172167b7ea39edb | 15f1a38e3c1e6c72c38b77a460b6cd4ce60c6dd4 |
-| e7371025f docs (plan, packet) | a54baff21 | 8e9b78ac185a49548e94e76c83f7fea1a982038a | 8e9b78ac185a49548e94e76c83f7fea1a982038a |
-| d4c796e44 docs (approval) | 9c6e39b25 | fc50b630d432ff7134e3d6c711a054d15ff1f997 | fc50b630d432ff7134e3d6c711a054d15ff1f997 |
-
-e7371025f and d4c796e44 keep their patch-ids. 0585b3213 changes, by the conflict below.
-
-### The conflict and its resolution
-
-Only `scripts/stack-release.sh` conflicted, in `config_checks` (now :1076-1107). Row 203
-(284d55cf2) made the old probe exit 0 on a `console` or a `federation` key and the refusal read
-"holds a console or federation key". Gander's commit replaced the probe and split the refusal into a
-console text and a text for any other key. The test file and docs/TOOLS.md merged without conflict.
-
-Resolution, per sage-3146 item 1 and sage-3148:
-
-1. The probe picks `console` first, then `federation`, then the first key outside the oldest set
-   `configVersion, environment, dataRoot, execution`. Without the federation step, a config that
-   holds a later key before `federation` would get Gander's text although the loader refuses
-   federation.
-2. With no target loader, a console or federation key gets 203's reason "it has no
-   scripts/mosaic-config.mjs", as at b23783f39. Any other later key gets Gander's "to validate
-   configuration key: <key>".
-3. The refusal for a console or federation key is 203's line, byte for byte as 284d55cf2 and
-   b23783f39 have it (compared by script, not by eye). Gander's text, "is refused by $TO's loader
-   ($first); remove the refused key first (restore the config.json backup from the window's step 1),
-   ...", applies only when the key is neither console nor federation. In both, `$first` is the
-   loader's first stderr line, which names the refused key (`unsupported configuration key: "<key>"`).
-4. The comment names 203's protection. docs/TOOLS.md gains one sentence: a console or federation key
-   keeps row 203's message.
-
-Gander's console-only text "holds a console key" (round 1 at 01983cd3f, before 203) is gone: 203's
-wording covers console as well. Duckworth's N1 (console plus another refused key keeps the console
-text) holds, now for federation too.
-
-Row 203's tests: every line of stack-release.test.mjs up to :2600 at b23783f39 is unchanged. The
-rebased file only appends. KEY_MSG (:1471), the item 3 console cases (:1575-1580), the row 203
-federation test (:1585-1595) and :1607 are byte-identical to the base. No 203 test or assertion
-changed, so nothing goes to Mos under mos-1272 for it.
-
-### Range-diff
-
-`git range-diff 01983cd3f..d4c796e44 b23783f39..9c6e39b25`:
-
-```
-1:  0585b3213 ! 1:  3b17c7550 fix(release): validate non-console config keys with target loader
-    @@ docs/TOOLS.md: onto the pointer's copy from the target, past any same-copy re-pi
-     +key. Every existing parseable config is checked; a missing file passes. A target
-     +without a loader accepts only the oldest top-level keys: `configVersion`,
-     +`environment`, `dataRoot`, and `execution`; any later key refuses. The refusal
-    -+names the rejected key and says to restore the config.json backup first. So a
-    ++names the rejected key and says to restore the config.json backup first. A
-    ++`console` or `federation` key keeps row 203's message, which says the config
-    ++holds a console or federation key. So a
-      window re-pins to row 192 or later before it writes the key, and a rollback past
-      row 192 removes the key first.
-      
-    @@ scripts/stack-release.sh: slot_problem() {
-     -# target's own scripts/mosaic-config.mjs validate; its output, the resolved config, is not kept.
-     +# Row 200 item 3 and #1797: every existing parseable config must be one the
-     +# target loader reads. Older copies without a loader accept only the four keys
-    -+# in c3d29e796's first loader. Resolved config stdout is never kept.
-    ++# in c3d29e796's first loader. A console or federation key (row 203) keeps its own refusal text.
-    ++# Resolved config stdout is never kept.
-      config_checks() {
-     -    local cfg="${MOSAIC_CONFIG:-$HOME/.config/mosaic-dev/config.json}" out loader="$COPIES/$TO/scripts/mosaic-config.mjs" first
-    --    # 0: a console key; 1: no key, or no file; 2: the file doesn't parse, so whether it holds the key
-    +-    # 0: a console or federation key (row 203: a pre-203 loader refuses federation too); 1: neither, or no file; 2: the file doesn't parse, so whether it holds the key
-     -    # is unknown, and the run refuses rather than pass it (webby-0028 N2). load_config already exits on
-     -    # such a file before anything is read or stopped, so this is reached only if the file changes after it.
-     +    local cfg="${MOSAIC_CONFIG:-$HOME/.config/mosaic-dev/config.json}" out loader="$COPIES/$TO/scripts/mosaic-config.mjs" first extra
-     +    # 1: missing file; 2: unreadable JSON. This also fences a change after load_config.
-    ++    # extra: "console" or "federation" first (row 203: a pre-203 loader refuses federation too),
-    ++    # then the first key outside the oldest set.
-          local key=0
-     -    node -e 'const fs=require("fs"),f=process.argv[1];if(!fs.existsSync(f))process.exit(1);let d;try{d=JSON.parse(fs.readFileSync(f,"utf8"))}catch{process.exit(2)}
-    --process.exit(d!==null&&typeof d==="object"&&Object.hasOwn(d,"console")?0:1)' -- "$cfg" 2>/dev/null || key=$?
-    +-process.exit(d!==null&&typeof d==="object"&&(Object.hasOwn(d,"console")||Object.hasOwn(d,"federation"))?0:1)' -- "$cfg" 2>/dev/null || key=$?
-     +    extra="$(node -e 'const fs=require("fs"),f=process.argv[1];if(!fs.existsSync(f))process.exit(1);let d;try{d=JSON.parse(fs.readFileSync(f,"utf8"))}catch{process.exit(2)}
-     +const oldest=["configVersion","environment","dataRoot","execution"];
-     +if(d===null||typeof d!=="object"||Array.isArray(d)){process.stdout.write(JSON.stringify("[configuration shape]"));process.exit(0)}
-    -+const k=Object.hasOwn(d,"console")?"console":Object.keys(d).find(k=>!oldest.includes(k));if(k!==undefined)process.stdout.write(JSON.stringify(k))' -- "$cfg" 2>/dev/null)" || key=$?
-    ++const k=Object.hasOwn(d,"console")?"console":Object.hasOwn(d,"federation")?"federation":Object.keys(d).find(k=>!oldest.includes(k));if(k!==undefined)process.stdout.write(JSON.stringify(k))' -- "$cfg" 2>/dev/null)" || key=$?
-          [ "$key" != 1 ] || return 0
-          if [ "$key" != 0 ]; then
-              check_refuse config-console-key "$cfg cannot be read as JSON, so whether $TO's loader reads it is unknown; fix the config first, then run the $OP again"
-    @@ scripts/stack-release.sh: slot_problem() {
-     -    if [ ! -f "$loader" ]; then out="it has no scripts/mosaic-config.mjs"
-     +    if [ ! -f "$loader" ]; then
-     +        [ -n "$extra" ] || return 0
-    -+        if [ "$extra" = '"console"' ]; then out="it has no scripts/mosaic-config.mjs"
-    ++        if [ "$extra" = '"console"' ] || [ "$extra" = '"federation"' ]; then out="it has no scripts/mosaic-config.mjs"
-     +        else out="it has no scripts/mosaic-config.mjs to validate configuration key: $extra"; fi
-          elif out="$(MOSAIC_CONFIG="$cfg" node "$loader" validate 2>&1 >/dev/null)"; then return 0
-          fi
-          first="${out%%$'\n'*}"
-    --    check_refuse config-console-key "$cfg holds a console key, and $TO's loader refuses it ($first); remove the key first (restore the config.json backup from the window's step 1), then run the $OP again"
-    -+    if [ "$extra" = '"console"' ]; then
-    -+        check_refuse config-console-key "$cfg holds a console key, and $TO's loader refuses it ($first); remove the key first (restore the config.json backup from the window's step 1), then run the $OP again"
-    +-    check_refuse config-console-key "$cfg holds a console or federation key, and $TO's loader refuses it ($first); remove the key first (restore the config.json backup from the window's step 1), then run the $OP again"
-    ++    if [ "$extra" = '"console"' ] || [ "$extra" = '"federation"' ]; then
-    ++        check_refuse config-console-key "$cfg holds a console or federation key, and $TO's loader refuses it ($first); remove the key first (restore the config.json backup from the window's step 1), then run the $OP again"
-     +    else
-     +        check_refuse config-console-key "$cfg is refused by $TO's loader ($first); remove the refused key first (restore the config.json backup from the window's step 1), then run the $OP again"
-     +    fi
-2:  e7371025f = 2:  a54baff21 docs(release): record any-key config plan and static review packet
-3:  d4c796e44 = 3:  9c6e39b25 docs(release): record static approval and post-compaction review conditions
-```
-
-## C1 and N3 (sage-3146 item 3, duckworth-0229 C1)
-
-Commit 4fa7d6834, test file only.
-
- LOADER_OLD (stack-release-fixture.mjs:301) is today's loader with a shorter first list, so it
-  still reads `compactionReadBytes` and `compactionStreams` through the `.concat`. It is no pre-270
-  witness. The new stand-in `PRE270` is C1's copy of today's loader with the
-  `.concat(["compactionReadBytes", "compactionStreams"])` taken out. That leaves
-  `["configVersion", "environment", "dataRoot", "execution", "console", "federation"]`, the list
-  the loader had at bce491715^ (01b57f48b), before bce491715 added the first key. The stand-in
-  asserts the replace changed something, so a reworded loader fails loudly rather than passing a
-  no-op stand-in. The fixture module isn't edited (not an owned file).
- New test "config-any-key: a pre-270 target refuses each row 270 key on a full activate and
-  rollback, naming the key". It seeds on B, activates C1 and installs PRE270 as B's loader. For
-  `compactionReadBytes` 1048576 and `compactionStreams` 1024 in turn, it first runs C1's own loader
-  `validate` on the config (exit 0, so the refusal is the target's). Then it asserts the exact
-  refusal for a full `activate B` and for `rollback`, using `refused()`: exit 3, the exact stderr,
-  no file changed, no start or stop and one refused log line. The text is ANY_CONFIG_MSG with
-  `mosaic-config: unsupported configuration key: "<key>"`. Afterwards it restores the loader and
-  config, and the rollback to B passes.
- N3: the missing-loader test sets `compactionStreams` to 1024, not `['messages']`.
- The missing-loader test also checks 203's no-loader text word for word for `console` and for
-  `federation`, each placed after `compactionStreams` in the file. This covers resolution items 1
-  and 2, which no 203 test reaches: 203's tests all use a target with a loader.
-
-## Files (manifest)
-
-Paths changed from b23783f39 to the candidate, with sha256 at the candidate:
-
-| path | b23783f39 sha256 | candidate sha256 |
-|---|---|---|
-| scripts/stack-release.sh | d3f52f72f2ea345118d30dc34f045f2b5b6abce41697e62f6de07d7a2f25748c | 8f535d53896fefe44525dea39169ac8df29f3d7845f83552a34ec1cd707595bb |
-| packages/cli/tests/stack-release.test.mjs | 45faa5d236d4cfb5cf3c026d64d039a5f29ce8868efeed4e9428cf85a5f0067f | 5a228aee7c3811f906513809f8a78a1fe4f3a26057089ae6c87918f432a5ba65 |
-| docs/TOOLS.md | 423babffc7be40a2d578ef00e97cdc49d887762e416fc20726d328d96b2a9533 | 611aeb79d603dd1af1917dcbb3db81b51ac0ae30c5b4991ea72e18bc45ee59de |
-
-The rest of the diff is packets: Gander's agents/gander/work/config-checks-any-key/ (eight files)
-and this one (BUILD.md, mutants.py). The manifest with every path and sha256 goes to Duckworth with
-the round key.
-
-## Mutants
-
-agents/gizmoduck/work/queue-292/mutants.py. Each anchor appears exactly once, and each mutated
-script passes `bash -n` (checked with python3 and bash only, no node). None has run. M1-M5 are
-Gander's edits (changes.json) on the resolved function. M6-M9 test the resolution. M1 restores the
-console-only skip, the brief's required mutant.
-
-### Kill rules (sage-3152)
-
-Each mutant runs only its killing test: `node --test --test-name-pattern '<pattern>'
-tests/stack-release.test.mjs`. The patterns are the test names, anchored with ^ and $, and all
-four are top-level tests. A mutant counts as killed only when all three of these hold:
-
-1. The run ends with `ℹ fail 1`, and the failing test is the named one. The spec reporter lists
-   it twice, inline and in the failing-tests summary.
-2. The first error's stack names every listed stack-release.test.mjs line.
-3. The log holds the listed text. The texts carry no quote characters, which node's inspect may
-   escape.
-
-Anything else is a STOP that goes to Sage before the next mutant: a fail in another test or at
-another line, a missing text, zero tests matched, a timeout or a crash before the assertion. A
-fixture or module-load error is the second-fence trap from 264a M2. A mutant whose targeted run
-passes gets one run of stack-release.test.mjs whole before it counts as a survivor.
-
-| id | edit | test (pattern) | stack lines | text | why that assertion |
-|---|---|---|---|---|---|
-| M1 | console-only skip restored | non-console target refusal | :517 (refused), :2619 | `actual: 0` | no console key, so the check returns 0 and activate B runs: exit 0, not 3 |
-| M2 | failed validate ignored (`\|\| true`) | non-console target refusal | :517, :2619 | `actual: 0` | the stand-in's exit 2 is lost, so activate B runs |
-| M3 | no-loader target passes any later key | missing-loader copies | :2670 | `actual: 0` | compactionReadBytes, the first case, passes with status 0 |
-| M4 | malformed JSON treated as absent | missing config passes but malformed JSON | :2684 | `actual: 0` | key 2 falls through to the witness loader, which exits 0 |
-| M5 | oldest-key config skips the loader | accepting loaders run validate | :2654 | `actual: []` | the witness file is never written |
-| M6 | probe drops the federation preference | missing-loader copies | :2677 | `to validate configuration key: ` | federation after compactionStreams: the probe picks compactionStreams |
-| M7 | probe drops the console preference | missing-loader copies | :2677 | `to validate configuration key: ` | the same for console, the first case of that loop |
-| M8 | final refusal treats only console as 203's | missing-loader copies | :2677 | `is refused by old` | federation gets Gander's text, not KEY_MSG |
-| M9 | no-loader branch treats only console as 203's | missing-loader copies | :2677 | `to validate configuration key: ` | federation's reason gains the later-key wording |
-
-M1 would also fail the pre-270 test and the row 203 federation test, and M8 the row 203 federation
-test. The targeted runs don't select those, so they aren't counted.
-
-## Run plan (on Sage's CLEAR only, after Duckworth approves this round)
-
-1. stack-release.test.mjs whole, limit 2100 s.
-2. The cli suite whole, `node --test tests/*.test.mjs` in packages/cli, limit 2100 s.
-3. The ten `scripts/test-*.sh`, limit 900 s each.
-4. Only on a green base: M1-M9 under the kill rules above. Targeted runs get 600 s and a
-   whole-file rerun of a survivor gets 2100 s. After each mutant: `git checkout --
-   scripts/stack-release.sh`, sha256 equal to the candidate's (8f535d53...) and a clean tree.
-
-Every stage gets its own short TMPDIR, `mktemp -d /mnt/storage/scratch/tmp/gXXX`, directly under
-/mnt/storage/scratch/tmp (sage-3152, 574 run 1's socket-path fault). Every mutant run gets one too.
-All runs use pipefail, tee and `timeout -k 10`. The busy check passes before each start. A first red
-in stages 1-3 stops the run.
-
-The limits come from the run 5 receipts (gizmo-271-out/r4, 01:49Z 10-23). stack-release.test.mjs
-whole took 682 s (duration_ms 681648), the cli suite 624 s and the longest shell suite 44 s. Each
-limit is at least 3x. Expected time: about 26 minutes for the base, plus about a minute per targeted
-mutant (fixture setup and one test, not measured yet), plus 12 minutes per whole-file rerun.
-
-C2 (duckworth-0229, sage-3146 item 4): every B, C1 and C release now validates its copied real
-loader. Any red in an old cli test is a suspect from this change. It stops the run and goes to Sage
-and Mos under mos-1272, unplaced.
-
-## Disclosure
-
-During the hold (sage-3146 item 6, no repo node) I ran `node --check
-packages/cli/tests/stack-release.test.mjs` once, between the rebase finish (02:43:51Z, reflog) and
-the first C1 commit (02:45:41Z). It is a parse-only syntax check that lasted a few milliseconds. It printed nothing. No other node, test, queue write or https push/fetch has run.
@@ -1,53 +0,0 @@
-#!/usr/bin/env python3
-# Row 292 mutants. M1-M5 are Gander's (agents/gander/work/config-checks-any-key/changes.json), with
-# the same edits on the resolved config_checks; M1 restores the console-only skip (the brief's
-# required mutant). M6-M9 are the resolution's: row 203's console and federation text. `apply <id>`
-# edits the worktree and prints the touched path; each edit asserts its anchor appears exactly once.
-# `check` prints each anchor's count and kill. K is read from the tests, not run. A restore is `git checkout -- <path>`, then sha256 against the blob in BUILD.md.
-import sys
-WT = "/mnt/storage/scratch/gizmo-292/"
-S = "scripts/stack-release.sh"
-T = "packages/cli/tests/stack-release.test.mjs"
-M = {
- "M1": (S, '    [ "$key" != 1 ] || return 0\n    if [ "$key" != 0 ]; then',
-           '    [ "$key" != 1 ] || return 0\n    [ "$extra" = \'"console"\' ] || return 0\n    if [ "$key" != 0 ]; then'),
- "M2": (S, 'elif out="$(MOSAIC_CONFIG="$cfg" node "$loader" validate 2>&1 >/dev/null)"; then return 0',
-           'elif out="$(MOSAIC_CONFIG="$cfg" node "$loader" validate 2>&1 >/dev/null)" || true; then return 0'),
- "M3": (S, '        [ -n "$extra" ] || return 0', '        return 0 # drop missing-loader later-key refusal'),
- "M4": (S, '    if [ "$key" != 0 ]; then\n        check_refuse config-console-key',
-           '    if [ "$key" = 99 ]; then\n        check_refuse config-console-key'),
- "M5": (S, '    if [ ! -f "$loader" ]; then', '    [ -n "$extra" ] || return 0\n    if [ ! -f "$loader" ]; then'),
- "M6": (S, 'Object.hasOwn(d,"federation")?"federation":', ''),
- "M7": (S, 'const k=Object.hasOwn(d,"console")?"console":', 'const k='),
- "M8": (S, '    if [ "$extra" = \'"console"\' ] || [ "$extra" = \'"federation"\' ]; then\n        check_refuse',
-           '    if [ "$extra" = \'"console"\' ]; then\n        check_refuse'),
- "M9": (S, '[ "$extra" = \'"federation"\' ]; then out="it has no scripts/mosaic-config.mjs"',
-           '[ "$extra" = \'"federation-off"\' ]; then out="it has no scripts/mosaic-config.mjs"'),
-}
-# K: (--test-name-pattern, the test.mjs lines the failing stack must show, the text the failure
-# must show). Kill rule (sage-3152): the named test fails, its first error's stack names every
-# listed line, and the log holds the text (no quote characters, which node's inspect may escape). A fail anywhere else, or a crash first, is a STOP to Sage.
-# A survivor of its targeted run gets one whole-file run before it counts as a survivor.
-K = {
- "M1": ('^config-any-key: a non-console target refusal stops activate and rollback before any stop$', [517, 2619], "actual: 0"),
- "M2": ('^config-any-key: a non-console target refusal stops activate and rollback before any stop$', [517, 2619], "actual: 0"),
- "M3": ('^config-any-key: missing-loader copies accept only the four oldest keys$', [2670], "actual: 0"),
- "M4": ('^config-any-key: missing config passes but malformed JSON refuses without calling the loader$', [2684], "actual: 0"),
- "M5": ('^config-any-key: accepting loaders run validate with the selected config on activate and rollback$', [2654], "actual: []"),
- "M6": ('^config-any-key: missing-loader copies accept only the four oldest keys$', [2677], "to validate configuration key: "),
- "M7": ('^config-any-key: missing-loader copies accept only the four oldest keys$', [2677], "to validate configuration key: "),
- "M8": ('^config-any-key: missing-loader copies accept only the four oldest keys$', [2677], "is refused by old"),
- "M9": ('^config-any-key: missing-loader copies accept only the four oldest keys$', [2677], "to validate configuration key: "),
-}
-cmd = sys.argv[1]
-if cmd == "list":
-    print(" ".join(M)); sys.exit(0)
-if cmd == "check":
-    for k, (f, a, b) in M.items():
-        print(k, f, open(WT + f).read().count(a), "kill:", *K[k])
-    sys.exit(0)
-f, a, b = M[sys.argv[2]]
-s = open(WT + f).read()
-assert s.count(a) == 1, (sys.argv[2], s.count(a))
-open(WT + f, "w").write(s.replace(a, b))
-print(f)
@@ -0,0 +1,297 @@
+# Row 294 build notes (Launchpad): FED R6, Console granted-user sign-in (#1800)
+
+Brief: docs/plans/2026-10-23_mvp-readiness-rows.md, "Brief: FED R6, Console granted-user sign-in".
+Design: agents/gizmoduck/work/federation/DESIGN.md at b93f098f0 (r4.11, sha256 1bcee8df…c8e6),
+sections 3.1, 3.4, 3.7 and the R6 row of section 7. Assigned in sage-3136. Reviewer Duckworth.
+
+## Base and chain
+
+Branch launchpad/row294 on origin/refactor 253346e3c (270+271, schema 3n in packages/bus, and 571).
+Parents done: 192 (#412 phase 1), R1 (201), R2, R3 (274). Row 208 and R7 (296) wait on this row.
+
+## Plan
+
+### What the Console does today
+
+- `sso.mjs` callback: a `sub` that is not in `console.sso.providers[].subjects` refuses
+  `subject-unknown`. A session record is `{provider, iss, sub, name, ...}` and every signed-in
+  request runs as the business human.
+- `serve.mjs`: every bus route, chat route and write uses objects built once in `cli.mjs` over the
+  human transport (`busCaller` over `HUMAN_CLI`).
+- `accessContextFor` (packages/cli/src/access.mjs:62) returns `peers: []`.
+
+### Build items
+
+1. **Granted-user sign-in (sso.mjs).** `createSso` takes an optional `users` hook:
+   `users.find({provider, sub})` returns a user id with a live grant, or null. The callback asks it
+   only after the owner subjects miss, so the owner path is unchanged. A user session record carries
+   `user: <id>` and `name: <id>`. A miss on both refuses `subject-unknown`, as today (the log line
+   names the provider, iss and sub; no new code is needed for the refusal).
+2. **The access hook (new `packages/webui/src/access.mjs`).** `consoleAccess({ load, business })`:
+   - `load` is `() => loadAccess(accessFilePath(configDir()), accessContextFor(system, env))`, R1's
+     loader, called on every use, never cached.
+   - `find({provider, sub})`: the user whose `subjects` hold that pair, with at least one grant in
+     the Console's business that `covers` at level `viewer` (the bus's own liveness test,
+     `#userGrants`). A loader throw finds nobody (fail closed).
+   - `check(session)`: the same test for the session's user and its own `(provider, sub)`. A user
+     whose subject was removed, whose grants were all removed or expired, or whose file now refuses
+     fails it.
+   - `business` resolves as `busCaller` does: `--business`, else the live host state.
+3. **Per-request re-read (sso.mjs `session()`).** For a user session, `users.check(session)` runs
+   after the expiry check, before any route. A failure deletes the session record and logs
+   `sso refused code=user-revoked provider=<id> user="<id>"`. The request then goes the
+   signed-out way: 401 (`sign-in required`) for /api/ and writes, or the sign-in redirect for a
+   page GET. The cookie is not cleared on that response; it names a session that no longer exists,
+   so it signs nothing in, and the next sign-in replaces it.
+4. **A user-cli transport per session (new user-bus.mjs, cli.mjs).** `userCall({ socket,
+   business, user })` spawns `USER_CLI` (packages/bus/src/user-cli.mjs) as a
+   direct child of the Console with `MOSAIC_BUS_USER_NONCE` set, so user-cli does not re-exec and
+   the broker's parent check (principal.mjs: parent argv[1] is webui/src/cli.mjs, argv[2] `serve`)
+   sees the Console. The request on stdin is `{business, user, verb, args}`. It never sets
+   `MOSAIC_BUS_CLI_NONCE` (it strips one from the inherited env) and never runs `HUMAN_CLI`.
+   `startServer` takes `userOptions(session)`, a factory that builds the whole bus-backed option
+   set (`consoleBus`, new console-bus.mjs) over that session's user transport, per request.
+5. **Owner-only controls hidden (serve.mjs and a user page).** A user session reaches only:
+   - the chat routes (`/api/chat/*`), over its own user transport, and
+   - `GET /api/config`, `/healthz`, `/auth/*`, and the user page's static files.
+   Every other path answers 403 `owner-only` before any bus call. Behind that gate, a user request
+   never holds a human-transport object: the handler swaps every bus-backed option (`bus`, `chat`,
+   `send` and each write, `processing`, project files) for the same object built over that
+   session's user transport, and nulls the ones with no bus behind them (`reads`, the board proxy),
+   so with the gate removed an owner route still reaches the broker only as the user, or answers
+   `not-configured`. `GET /` serves a separate page,
+   `user.html` with `user.js`, that renders only projects, threads and messages (no board, inbox,
+   agents, settings, editor, processing or Sign-in-as-owner controls). The owner page's assets are
+   not served to a user session. The gate is one function, `userRoute(path, method)`, so the M1
+   mutant removes one call.
+6. **The notice.** `user.html` holds row 193's sentence word for word in the thread view:
+   "The business owner sees your thread's agent's decisions, inbox entries, claims, tasks and
+   project files, but not your messages."
+7. **Hub label and peer links.** `/api/config` returns `federation: {self, peers: [{label,
+   origin}]}` from `system.federation` when set, for owner and user sessions alike. Both pages show
+   "This Console: <self>" and one plain `<a href="<origin>">label</a>` per peer, built with
+   textContent and `setAttribute('href')`; no script, no fetch to a peer, no proxy (the hub proxy
+   route is R8's).
+8. **F8 peers wiring.** `accessContextFor` returns
+   `peers: (system.federation?.peers ?? []).map((p) => p.id)`, and the ACCESS_USAGE text and the
+   function's comment drop "peer homes are not read yet".
+9. **Bus boot wiring (packages/cli/src/config.mjs).** `bootConfig` adds
+   `access: { file: accessFilePath(configDir(env)), context: accessContextFor(system, env) }` when
+   the file exists (lstat). No file: no `access` key, so no user binds, as before R6. A context
+   that throws: a warning and no `access`. A file the loader refuses at boot (sage-3153): one
+   warning line, which the host writes to stderr as `mosaic-bus: warning: access file refused at
+   boot (<code>), no granted user binds until it is fixed: <path>`. The access stays wired, so
+   the broker refuses each user bind and the owner's bus boots. R1's loader has no refusal codes,
+   and its messages can quote the file (a JSON parse error, a `got "<value>"`), so the line never
+   carries the message. The code comes from the loader's exit code instead: 4 (the file could not
+   be opened as a regular file, including a symbolic link) is `access-unreadable`, and anything
+   else is `access-invalid`.
+   config.mjs now imports access.mjs, which imports config.mjs (`loadSystem`). The cycle is safe
+   because neither module touches the other's exports at module top level, only inside
+   functions (sage-3153).
+
+### Choices and departures (for Sage and Duckworth)
+
+- **C1. A separate user page, not the owner SPA with sections hidden.** "Hidden" here means never
+  sent: the owner page's markup and scripts are not served to a user session. Hiding sections in
+  app.js would ship the owner controls and rely on CSS. Tradeoff: a second small page to keep.
+- **C2. The Console's gate is an allowlist of user routes**, so a new owner route added later is
+  owner-only by default.
+- **C2b. No human transport behind a user session.** Without the swap, M1 would send
+  `/api/bus/message` through the owner's `send` over human-cli, and the bus would accept it as the
+  owner. The swap is what makes "the bus refusal stands on its own" true.
+- **C3. Liveness is the bus's test** (`covers` at `viewer`, in the Console's business), so the
+  Console and the broker agree on who is live. The broker still decides every verb, project,
+  instance and thread (design 3.1 D4).
+- **C4. The bus's `access` boot option is wired here (sage-3142, Q2; accepted, sage-3153).** Build item 9 above.
+  Sage's ruling: with the file, users bind; without it, none; with a bad file, it "refuses as R1's
+  loader does"; a boot never invents a grant. My reading of "refuses": the broker's `access` is
+  R1's loader, read on every user request, so a bad file refuses every user bind
+  (`access-revoked`) and the owner's bus still boots. Refusing the whole boot would take the
+  owner's bus down over a user file. Tests B3 pin this reading. No live unit or config changes.
+- **C5. Tests use an in-process Broker behind the user transport seam.** The broker's user
+  principal needs the Console as the user-cli's parent process, which a node:test process is not.
+  So the webui tests inject a `userOptions` factory over a real `Broker` with `bindUser` and an
+  `access` function, and a separate transport test checks the spawn: the `USER_CLI` path, the user
+  nonce variable, no human nonce, and the `{business, user, verb, args}` request. R7 runs the real
+  Console process end to end.
+
+- **C6. The chat's `plugins` read goes over the owner transport (accepted, sage-3153).**
+  `createChat` asks the bus `plugins` first (createChannelCaller), and `plugins` is not a user
+  verb, so a user chat would refuse before its first read. `createChat({ call, owner })` sends
+  `owner` exactly `plugins` with `{}`, and every other verb goes over `call`. consoleBus passes
+  `owner` through, and cli.mjs gives it `ownerCall`. createChannelCaller
+  (plugins/src/channel.mjs:16-20) uses the answer only to gate the webui channel, server-side.
+  Sage's conditions, each pinned by G9:
+  - the plugins answer never appears in a user's response;
+  - in a user's chat the owner transport carries only `plugins` with `{}`;
+  - every chat verb goes over the user transport.
+  Mutant M8 routes one more chat verb over the owner transport, and G9 kills it. A new broker
+  user verb would have been a policy change, so it is out.
+- **C7. The user transport is a new file, user-bus.mjs, not a mode in bus.mjs.**
+  bus/tests/channel-proof.test.mjs pins the sha256 of webui/src/bus.mjs (with human-cli.mjs,
+  human.mjs and cli/src/transport.mjs). Changing bus.mjs would mean an old-test change through
+  Mos. user-bus.mjs repeats the spawn and framing code (about 40 lines). bus.mjs is byte-identical
+  to the base. Tradeoff: two copies of the spawn plumbing. Accepted (sage-3153).
+  **Follow-up (not this row):** the next row that re-pins the channel-proof hash folds userCall
+  back into bus.mjs and drops the copy.
+- **C8. console-bus.mjs.** The bus-backed option set moved out of cli.mjs into `consoleBus(call,
+  {send, plugins})`, so the owner and each user session build the same set the same way. The
+  agent verb lists and `agentCaller` moved with it; the tester socket still builds its own.
+- **C9. 401 and 403 from the broker.** chat-http's STATUS maps `access-refused` to 403 and
+  `access-revoked` to 401, so a broker refusal reaches the browser as the right status.
+
+## Exception: the owner transport in a user's chat (C6; mos-1394, sage-3157)
+
+Duckworth rules on this directly. The same text goes in the manifest notes.
+
+> In a granted user's chat the Console uses the owner's transport for one call: `plugins` with
+> `{}`, the channel gate read. Nothing else goes over it. Its answer stays in the Console and is
+> never sent to the user. No value from the user's session or request reaches the call. Mos ruled
+> in mos-1394 that this is not an access-rule change, because the Console reads its own channel
+> gate, and that it holds only while nothing from the user reaches the call. Every chat verb goes
+> over the user's own transport. Where: createChat's `owner` (chat.mjs) and userOptionsFor
+> (console-bus.mjs), wired with `ownerCall` in cli.mjs. Pinned by G9 and mutants M8, M10 and M11.
+> If this reads as owner authority used for the user, it goes back to Mos.
+
+## Rulings (sage-3153)
+
+1. Boot wiring is accepted: a bad file refuses every user bind and the owner's bus boots. Added:
+   one stderr line at boot naming the path and a code, never the contents (item 9, B3, M9). The
+   mutual import is fine with no top-level use (item 9).
+2. C6 is accepted under conditions: the plugins answer stays server-side, the owner transport
+   carries only `plugins` with `{}`, one G test (G9) records both transports, and a mutant (M8)
+   routing one more chat verb over the owner is killed.
+3. C7 is accepted, with the follow-up note under C7.
+4. Owned files are accepted. packages/cli/src/access.mjs overlaps Morgana's row 295 (527002f97),
+   and merge-tree is clean. 294 lands first and 295 rebases after it. packages/cli/tests/
+   access.test.mjs is now unchanged: the peer test moved to access-boot.test.mjs, so the only
+   overlap is access.mjs.
+
+Ruling sage-3157 (mos-1394): the boot line is accepted as built, with no codes from R1. For C6,
+G9 asserts the owner call is exactly `plugins` with exactly `{}`, and that no value from the
+session or the request reaches it. Mutants M10 (session value) and M11 (request value) are killed
+by G9. The exception is written above and goes in the manifest notes. The per-session builder
+moved into console-bus.mjs (`userOptionsFor`), so the wiring G9 runs is the same code cli.mjs
+uses, and a session value added there is a mutant G9 can kill.
+
+## Owned files
+
+- cli: src/config.mjs, src/access.mjs, tests/access-boot.test.mjs (new)
+- webui src: sso.mjs, access.mjs (new), console-bus.mjs (new), user-bus.mjs (new), chat.mjs,
+  chat-http.mjs, cli.mjs, serve.mjs
+- webui public: user.html (new), user.js (new), federation.js (new), index.html, app.js
+- webui tests: granted-user.test.mjs (new)
+- this BUILD.md
+
+No old test changes. Hash pins checked: `git grep` over 'packages/*/tests/*' for each touched
+path with a 64-hex pin found only channel-proof's bus.mjs pin, which C7 avoids.
+
+## Tests
+
+New file packages/webui/tests/granted-user.test.mjs, on Sage's fake OP (tests/helpers/fake-oidc.mjs)
+and an in-process Broker with an access function, like bus/tests/user-principal.test.mjs:
+
+- G1 a granted user signs in: session cookie set, `/api/config` says `user`, `GET /` is the user
+  page, the chat lists reach the broker as `user:<id>`.
+- G2 an ungranted `sub` is refused: a user in the file with no grant, a grant for another business,
+  an expired grant, and a sub in no file; each is `subject-unknown`, no cookie, nothing bound.
+- G3 revoked mid-session: sign in, then remove the grant, remove the subject, expire the grant,
+  or make the loader refuse. The next chat read is 401 with a `user-revoked` log line and no
+  transport call. Restoring the grant does not bring the session back, and `GET /` redirects to
+  sign-in.
+- G4 owner verbs: for each owner route (board reads under /api/bus/*, settings, names, instances,
+  routes, agents, processing, project files, /api/bus/message, /api/board), a user session gets
+  403 `owner-only` and the transport ran zero times.
+- G5 the bus refusal stands alone: the same session's user transport, called directly with each
+  owner verb, gets `access-refused` from the broker and nothing is written.
+- G9 the C6 seam (sage-3153, sage-3157), with the test's userOptions built by userOptionsFor as
+  cli.mjs builds them: a user session runs the chat's project list, thread create, list,
+  open, send and messages. The owner transport (a recording `ownerCall`) saw only
+  `['plugins', {}]`. Each chat verb went over the user transport, and `plugins` never did. A
+  marker in the owner's answer appears in no response. Every owner call is exactly
+  `['plugins', {}]`, and none of alice, alice-sub, the thread name, the message body, the project
+  id or the thread id appears in what the owner transport received.
+- G6 the notice: the user page's notice element text equals the sentence exactly.
+- G7 hub label and peer links render from config: `/api/config` carries self and the peers'
+  labels and origins; the user and owner pages show "This Console: hub" and an `<a>` per peer with
+  the configured href and label (browser test, sso-browser.test.mjs style).
+- G8 the transport: `userCall` over a recording unix socket in a scratch dir. While the child
+  waits for the answer, the test reads /proc/<pid>/cmdline (argv[1] is USER_CLI), environ
+  (MOSAIC_BUS_USER_NONCE set; MOSAIC_BUS_CLI_NONCE absent though the parent env passed one) and
+  stat (ppid is the test process, so user-cli did not re-exec). The request line is
+  `{verb, args, user: {business, user, nonce, pid}}`, which user-cli builds from
+  `{business, user, verb, args}`.
+
+packages/cli/tests/access-boot.test.mjs (sage-3142), over bootConfig and startBroker in a scratch
+root, the boot config through a JSON round trip as over the host IPC:
+
+- B1 with access.json: `access.file` and `context.peers` set; alice (home a configured peer)
+  binds; bob gets `access-revoked`.
+- B2 without the file: no `access` key; alice gets `access-revoked`.
+- B3 with text that is not JSON, a home that is not a configured peer, and a symbolic link: the
+  bus boots and alice gets `access-revoked`. The warnings are exactly one line, with
+  `access-invalid`, `access-invalid` and `access-unreadable` and the path, and none quotes the
+  file (a marker string in the file is absent from the line).
+
+access-boot.test.mjs also holds the F8 peer test: a grant whose user's home is a configured peer id
+validates; an unconfigured peer id refuses `home must be a configured peer`.
+
+Old tests: the sso.test.mjs and serve tests stay as they are. If one needs a change, it goes to
+Mos through Sage first (mos-1272).
+
+## Mutants
+
+| # | Change | Killed by | Expected |
+|---|---|---|---|
+| M1 | remove the `userRoute` gate call in serve.mjs | G4 (:239, first route answers 403 `access-refused`, not `owner-only`) | G4 red at :239 on its first route; G5 green in the same run |
+| M2 | skip `access.check(session)` per request | G3 | red |
+| M3 | change one word of the notice in user.html | G6 | red |
+| M4 | `peers: []` back in accessContextFor | the F8 peer test and B1 (access-boot.test.mjs) | red |
+| M5 | sign-in skips the grant test (any listed user signs in) | G2 | red |
+| M6 | userCall sets MOSAIC_BUS_CLI_NONCE or runs HUMAN_CLI | G8 | red |
+| M7 | bootConfig drops `access` | B1 | red |
+| M8 | chat.mjs routes `thread.list` over `owner` too | G9 | red |
+| M9 | accessFor drops the boot refusal line | B3 | red |
+| M10 | userOptionsFor passes `owner: (v, a) => owner(v, { ...a, sub: session.sub })` | G9 | red |
+| M11 | chat.mjs keeps the last request's args in `channel()` and passes them to `owner('plugins', …)` | G9 (thread create's `{project, name}` reaches owner) | red |
+
+M1 is the brief's "owner verb still refused by the bus": with the Console gate gone, the owner
+verb reaches the broker over the user transport and the broker refuses it (`access-refused`, 403).
+G4 kills M1 at :239 on its first route, because it pins the Console's own code `owner-only`. The
+count and "nothing written" asserts at :242-244 come after the loop, so under M1 they never run;
+the run records G4's failure with the actual value (`access-refused`). The bus refusing on its own
+is shown by G5, green in the same M1 run. (Corrected per Duckworth C1, duckworth-0249b; the earlier
+row said G4's "refused, nothing written" stayed green, which cannot be observed under M1.)
+
+## Run limits
+
+Each `timeout -k 10 LIMIT`, TMPDIR from `mktemp -d /mnt/storage/scratch/tmp/gXXXXXX`. A timeout with
+no failed test goes to Sage first; a timeout in the shell phase goes to Mos unplaced (mos-1275).
+
+| Run | LIMIT |
+|---|---|
+| each touched or new file alone | 300 s |
+| webui suite | 1800 s |
+| bus suite | 900 s |
+| cli suite | 1800 s |
+| each scripts/test-*.sh | 900 s |
+| each mutant probe | 300 s |
+
+## Review
+
+Round 1, manifest 0b3f9c9d…94f3 (ca710eabd): Duckworth APPROVE (static), duckworth-0249b, note
+agents/duckworth/work/row294/ROUND1-ca710eabd.md on duckworth/reviews 5b7089ea1. The owner-transport
+exception is accepted and does not go to Mos.
+
+- C1: the M1 row and note above are corrected. The M1 run records G4's :239 failure value and G5.
+- C2: the gate runs on Sage's CLEAR.
+- N1 (no test reaches the C2b swap): no M12 in this row. Adding one needs a new test and a new
+  manifest round after approval; the brief does not require it. Left as a follow-up for Sage to
+  place: a test that a user session's options carry no owner caller besides `plugins`, with an M12
+  where serve.mjs keeps the owner's `send` for a user session.
+- N2, N3: accepted as they stand; no change.
+- N4: the user-bus.mjs fold-back (C7) is proposed to Sage as a queue row, for the next
+  channel-proof re-pin.
+
+## Runs
@@ -0,0 +1,31 @@
+# Row 294 (FED R6, #1800) candidate manifest, round 1
+
+Branch launchpad/row294, base 253346e3c, pushed tip 9450774cbe7986d80150b27a4da33b43d93bf026.
+MANIFEST.sha256 lists the 17 code and test paths changed from the base, hashed from the tip's
+blobs (`sha256sum -c` passes on the tip). BUILD.md is the row note and is not in the manifest.
+No old test changes. webui/src/bus.mjs is byte-identical to the base (channel-proof hash pin, C7).
+packages/cli/tests/access.test.mjs is unchanged; packages/cli/src/access.mjs overlaps row 295,
+which rebases after this row (sage-3153).
+
+Nothing has run. Runs follow Duckworth's approval and Sage's test CLEAR, in slot order: each
+touched file alone, mutants M1-M11, the webui, cli and bus suites and every scripts/test-*.sh,
+with the limits in BUILD.md.
+
+## Exception for Duckworth to rule on: the owner transport in a user's chat (C6; mos-1394, sage-3157)
+
+> In a granted user's chat the Console uses the owner's transport for one call: `plugins` with
+> `{}`, the channel gate read. Nothing else goes over it. Its answer stays in the Console and is
+> never sent to the user. No value from the user's session or request reaches the call. Mos ruled
+> in mos-1394 that this is not an access-rule change, because the Console reads its own channel
+> gate, and that it holds only while nothing from the user reaches the call. Every chat verb goes
+> over the user's own transport. Where: createChat's `owner` (chat.mjs) and userOptionsFor
+> (console-bus.mjs), wired with `ownerCall` in cli.mjs. Pinned by G9 and mutants M8, M10 and M11.
+> If this reads as owner authority used for the user, it goes back to Mos.
+
+## Other choices
+
+C1-C9 and rulings sage-3142, sage-3153 and sage-3157 are in BUILD.md. In short: a separate user
+page (C1); an allowlist gate of user routes (C2); every bus-backed option swapped to the user
+transport behind the gate (C2b); liveness by the broker's own `covers` test (C3); the bus boot
+`access` wiring, where a bad file refuses each user bind and writes one stderr line with the path
+and a code, never the contents (C4, item 9); and user-bus.mjs as a copy of the spawn code (C7).
@@ -0,0 +1,17 @@
+52206bd92b0f223bf9310d50db650f36e12836691d739b499192e3eedd81401c  packages/cli/src/access.mjs
+a948886a8c57d700b3d116097c9597c2b29dc7cc89ff6e18ae57436754195853  packages/cli/src/config.mjs
+abb5ccb77b8d5c97c81e84fb1fb32367bf69890e8ea1f1912d739a3dd1678738  packages/cli/tests/access-boot.test.mjs
+1be61ba66c3b747decdb3e12de743265b8cc7ba7cd06c033393b157ce1bc0b70  packages/webui/src/access.mjs
+954dee1535b258d9590e4d102423d081303b640b3bea750bd3653883e67bf309  packages/webui/src/chat-http.mjs
+230a5759f5027f9208c716b176f9b0a30310d5f433493bfcd8862c71abe182ae  packages/webui/src/chat.mjs
+7fcb28a7a67418a8d3fd26dd157860ec1a89fe1891887f661e53a17d3b3bbc7d  packages/webui/src/cli.mjs
+941c8f91ad40264c5622d60af85e00f6198db31a0504b4b0caa48312d8f57c3e  packages/webui/src/console-bus.mjs
+692c5eabb0fc866240b12931418c17d3392b6097575dfacf7425a6f0127dd291  packages/webui/src/public/app.js
+c41a34a32f23f742e30ca408bc7deda0fa8feb4f8c25c7036604c336bb1545eb  packages/webui/src/public/federation.js
+e7673188c1d76ecc63cdc24e7d1470922b1d69bedeb994a862e94924edfc27d2  packages/webui/src/public/index.html
+969a52284b667e075b04e3fa63d45415f3517080784ee372ee4725caf51d15d9  packages/webui/src/public/user.html
+571ce191c0b5f545e3a65f7b388f754e2ca6396a68038ccc57321d8f490cb86e  packages/webui/src/public/user.js
+9343ea9edb862c1545df2886754244ffd76b714cc90d7791fc32aee4ecfec594  packages/webui/src/serve.mjs
+70b243ed9a83ff822a4c7a148528ff5153574cc87d5c776fd2e12f340762ed76  packages/webui/src/sso.mjs
+8cc1185beda9085ced62470f1b9e39d95dcca2dcc8bf9325c18c2f0b2da618dc  packages/webui/src/user-bus.mjs
+8f89a1cc853ad275e62a518eb4f5567b5aaa629d32060c11daaaa671aded29db  packages/webui/tests/granted-user.test.mjs
@@ -1563,5 +1563,3 @@ are never rewritten or removed; corrections are new entries.
 2026-10-23T01:37:07Z | Gyro (Codex gpt-6.1-sol, mos-1368/1372/1375) | Vikunja571 O2 parent/W4 revision complete for review | P1-P6/B1-B4 and A17-A41/Q1-Q16 folded; same-thread Case 2 lookups/support writes, human-set host-pushed off-host remote, Hermes/restore/counting/order/role gates. Static docs checks pass; old locator/projection mechanics retained, authority/access review reopened. No code, build/browser/worker run, private conversion, queue or live action. Direct Fenton/Mos/Sage handoff after push.
 2026-10-23T01:41:59Z | Gyro (Codex gpt-6.1-sol, sage-3121) | 571 PRD d6 A1-A3 alignment | Both designs corrected and statically checked; local commit for Fenton in shared repo object store. HTTPS push held for Sage gap, independent review pending. No product, test-slot, queue or live change.
 2026-10-23T01:49:08Z | Gyro (Codex gpt-6.1-sol, fenton-0012/mos-1379) | 571 B1/B2 and N1-N6 docs corrections | Real-helper denial gate and two off-by-default human review settings; static acceptance/brief/immutable-mechanics checks pass. Local candidate for Fenton via shared Git objects; no HTTPS push before Sage gap, no runtime or credential experiment.
-2026-10-23T01:53:25Z | Gyro (Codex gpt-6.1-sol, fenton-0013) | 571 N7 chapter-order clarification | D10 and W7 explicitly cover mixed formats and stable chapter identity/position. Docs checks pass; local candidate sent for narrow re-check, push held for Sage gap. No runtime or live change.
-2026-10-23T02:21:06Z | Sage (Opus 5.5, 1ef1e4f8) | Gap after 270+271 run 5: landings and MVP rows | 270+271 LANDED 7328da8ca (mos-1351), 571 landed 767bb62c7 plus N7, rows 293-299 added and committed 253346e3c, 270 request c30929 and Duckworth verdict c30930 posted, 219 rebase conflict ruled (rocko/row219 fd17203ed), 574 CLEAR to Gander 02:19Z.
@@ -632,14 +632,9 @@ onto the pointer's copy from the target, past any same-copy re-pin, checked
 against the set's `SHA256SUMS`. `--send` and `--tester-port` follow the pointer.
 When that set is missing, fails its sums, holds no readable argv or already ran
 `--sso`, the run refuses `sso-rollback-flags`. Any activate or rollback also
-refuses `config-console-key` before anything stops when the target's
-`scripts/mosaic-config.mjs validate` refuses the config, including a non-console
-key. Every existing parseable config is checked; a missing file passes. A target
-without a loader accepts only the oldest top-level keys: `configVersion`,
-`environment`, `dataRoot`, and `execution`; any later key refuses. The refusal
-names the rejected key and says to restore the config.json backup first. A
-`console` or `federation` key keeps row 203's message, which says the config
-holds a console or federation key. So a
+refuses `config-console-key` before anything stops when the config holds a
+`console` key the target's `scripts/mosaic-config.mjs validate` refuses (a copy
+before row 192 refuses the key). The message says to remove the key first. So a
 window re-pins to row 192 or later before it writes the key, and a rollback past
 row 192 removes the key first.

@@ -181,11 +181,9 @@ managed document has a stable document ID and manifest naming its canonical DOCX
 source origin, format revision, current blob and commit. DOCX and manifest changes publish
 atomically in one commit. They are not two editable masters.

-D10's book manifest also owns chapter order. It lists every chapter ID in order, whether
-the current file is Markdown or DOCX. Seed from row216's existing path-order rule. A new
-canon Markdown chapter takes its position by that rule or a human's committed order, and
-import preserves its chapter ID and position. Human reordering commits the manifest.
-library_manuscript and next_chapter use this order, never archived paths. Each
+D10's book manifest also owns chapter order. Seed from row216's existing path-order rule,
+then keep stable chapter IDs in order across conversions; human reordering commits the
+manifest. library_manuscript and next_chapter use this order, never archived paths. Each
 answer/page names format, owned location/ID and captured commit. DOCX wikilinks stay clickable
 in the Console editor; no graph shows their current links yet. A Console Connections view
 and its tests are later work, waiting for Jason's J-b answer in PRD 1.17. Obsidian's archive
@@ -1196,8 +1194,6 @@ only inside their supporting scope. mos-1372 D9 replaces M1's dedicated-session/
 read-story then write-character-sheet workflow works under existing Case 2 authority.
 Never allow that writer to target DOCX or archive files.

-Tests prove mixed Markdown/DOCX chapter traversal and next_chapter order, new canon Markdown
-insertion by row216 or human order, and unchanged chapter ID/position after import.
 Tests prove all P1–P6, per-story-file reports/confirmations/manifests/commits, human-set archive folder with no default, missing-folder refusal,
 archive blob equality/history retention, human loss-report confirmation,
 wiki tokens/front matter/metadata and draft/canon-status preservation, converted-marker discovery, map scope filtering,
@@ -33,7 +33,7 @@ Gaps found while working go to `docs/plans/DEFERRED.md`, not here.

 <!-- mosaic-queue:begin -->

-Generated from `docs/plans/queue.json` revision 3406 by `queue render`. Do not edit between the markers; change the queue with `scripts/mosaic queue`.
+Generated from `docs/plans/queue.json` revision 3398 by `queue render`. Do not edit between the markers; change the queue with `scripts/mosaic queue`.

 | # | Piece | Owner | Issues | State | After | Gate | Brief | Note |
 |---|---|---|---|---|---|---|---|---|
@@ -329,13 +329,13 @@ Generated from `docs/plans/queue.json` revision 3406 by `queue render`. Do not e
 | 290 | Case 2 C2-12b the setup sheet rewrite for free chat, supporting folders and saves | louie; reviewers webby | #1795 | briefed | 217 done, 218 done, 285 done, 291 done | Doc only. Webby approves it against the ruling. Before landing, grep packages/*/tests and scripts/test-*.sh to confirm no test reads the file. (sage) | `docs/plans/2026-10-20_case2-rows.md` § C2-12b the setup sheet rewrite for free chat, supporting folders and saves | — |
 | 291 | PRD 1.16 library.write routes under REQ-LIB-6 (mos-1328) | gosalyn; reviewers webby | #1796 | in-review, round 1, request posted | 282 done | Webby approves the text. Jason says yes to the exact text (Mos asks him, mos-1328 step 3); no landing before that. requirements.test.mjs and every scripts/test-*.sh that reads the PRD or requirements.json are green on Sage's gate. Mos gets the landing commit. (sage) | `docs/plans/2026-10-22_prd-1-16-brief.md` § PRD 1.16 library.write routes under REQ-LIB-6 (mos-1328) | — |
 | 292 | stack-release.sh config_checks runs the target loader on any config (row 270 rollback hazard) | gander; reviewers duckworth | #1797 | briefed | 203 done, 270 done, 271 done | Duckworth approves the manifest. The touched test files run whole, the cli suite and every scripts/test-*.sh are green on Sage's gate, and the mutants are killed. (sage) | `docs/plans/2026-10-22_config-checks-any-key-brief.md` § stack-release.sh config_checks runs the target loader on any config (row 270 rollback hazard) | — |
-| 293 | 574: maintenance-free test fixture commits (Vikunja 574) | gander; reviewers filbert | #1805 | in-progress | — | Filbert approves. The four whole files, then the seat and cli suites, are green on Sage's gate. (sage) | `docs/plans/2026-10-23_mvp-readiness-rows.md` § Brief: 574, maintenance-free test fixture commits (Vikunja 574) | — |
-| 294 | FED R6: Console granted-user sign-in, user-cli transport, peer links | launchpad; reviewers duckworth | #1800 | briefed | — | Duckworth approves the manifest. The webui, cli and bus suites and every scripts/test-*.sh are green on Sage's gate, and the mutants are killed. (sage) | `docs/plans/2026-10-23_mvp-readiness-rows.md` § Brief: FED R6, Console granted-user sign-in | — |
-| 295 | FED R4: revocation | morgana; reviewers dewey | #1801 | briefed | — | Dewey approves the manifest. The bus, cli and business suites and every scripts/test-*.sh are green on Sage's gate, and the mutants are killed. (sage) | `docs/plans/2026-10-23_mvp-readiness-rows.md` § Brief: FED R4, revocation | — |
-| 296 | FED R7: scratch two-instance acceptance | quackerjack; reviewers filbert | #1802 | briefed | 190 done, 294 done, 295 done | Filbert approves the manifest. The script test and every scripts/test-*.sh are green on Sage's gate, and no unit, port or socket of the script's outlives the run. (sage) | `docs/plans/2026-10-23_mvp-readiness-rows.md` § Brief: FED R7, scratch two-instance acceptance | — |
-| 297 | GitHub grant method (Bushroot's half of #436b) | bushroot; reviewers dewey | #1803 | briefed | 198 done | Dewey approves the manifest. The touched suites and every scripts/test-*.sh are green on Sage's gate, and the mutants are killed. (sage) | `docs/plans/2026-10-23_mvp-readiness-rows.md` § Brief: the GitHub grant method (Bushroot's half of #436b) | — |
-| 298 | Q228: chief-of-staff grant scope | megavolt; reviewers dewey | #1804 | briefed | 252 done | Dewey approves the manifest. The touched suites and every scripts/test-*.sh are green on Sage's gate, and the mutants are killed. (sage) | `docs/plans/2026-10-23_mvp-readiness-rows.md` § Brief: the chief-of-staff grant scope (Q228) | — |
-| 299 | 573: the P10 hop band (Vikunja 573) | gander; reviewers filbert | #1806 | briefed | 293 done | Filbert approves. The whole file under load at least 3 times, then the cli suite, are green on Sage's gate. (sage) | `docs/plans/2026-10-23_mvp-readiness-rows.md` § Brief: 573, the P10 hop band (Vikunja 573) | — |
+| 293 | 574: maintenance-free test fixture commits (Vikunja 574) | gander; reviewers filbert | #1805 | queued | — | Filbert approves. The four whole files, then the seat and cli suites, are green on Sage's gate. (sage) | `docs/plans/2026-10-23_mvp-readiness-rows.md` § Brief: 574, maintenance-free test fixture commits (Vikunja 574) | — |
+| 294 | FED R6: Console granted-user sign-in, user-cli transport, peer links | launchpad; reviewers duckworth | #1800 | queued | — | Duckworth approves the manifest. The webui, cli and bus suites and every scripts/test-*.sh are green on Sage's gate, and the mutants are killed. (sage) | `docs/plans/2026-10-23_mvp-readiness-rows.md` § Brief: FED R6, Console granted-user sign-in | — |
+| 295 | FED R4: revocation | morgana; reviewers dewey | #1801 | queued | — | Dewey approves the manifest. The bus, cli and business suites and every scripts/test-*.sh are green on Sage's gate, and the mutants are killed. (sage) | `docs/plans/2026-10-23_mvp-readiness-rows.md` § Brief: FED R4, revocation | — |
+| 296 | FED R7: scratch two-instance acceptance | quackerjack; reviewers filbert | #1802 | queued | 190 done, 294 done, 295 done | Filbert approves the manifest. The script test and every scripts/test-*.sh are green on Sage's gate, and no unit, port or socket of the script's outlives the run. (sage) | `docs/plans/2026-10-23_mvp-readiness-rows.md` § Brief: FED R7, scratch two-instance acceptance | — |
+| 297 | GitHub grant method (Bushroot's half of #436b) | bushroot; reviewers dewey | #1803 | queued | 198 done | Dewey approves the manifest. The touched suites and every scripts/test-*.sh are green on Sage's gate, and the mutants are killed. (sage) | `docs/plans/2026-10-23_mvp-readiness-rows.md` § Brief: the GitHub grant method (Bushroot's half of #436b) | — |
+| 298 | Q228: chief-of-staff grant scope | megavolt; reviewers dewey | #1804 | queued | 252 done | Dewey approves the manifest. The touched suites and every scripts/test-*.sh are green on Sage's gate, and the mutants are killed. (sage) | `docs/plans/2026-10-23_mvp-readiness-rows.md` § Brief: the chief-of-staff grant scope (Q228) | — |
+| 299 | 573: the P10 hop band (Vikunja 573) | gander; reviewers filbert | #1806 | queued | 293 done | Filbert approves. The whole file under load at least 3 times, then the cli suite, are green on Sage's gate. (sage) | `docs/plans/2026-10-23_mvp-readiness-rows.md` § Brief: 573, the P10 hop band (Vikunja 573) | — |

 <!-- mosaic-queue:end -->

@@ -1,7 +1,7 @@
 {
  "version": 1,
  "canonicalRoot": "/mnt/storage/src/mosaic-stack",
-  "revision": 3406,
+  "revision": 3398,
  "rows": [
    {
      "id": 1,
@@ -29376,7 +29376,7 @@
      "closes": [
        1805
      ],
-      "state": "in-progress",
+      "state": "queued",
      "previousState": null,
      "required": false,
      "requiredSince": null,
@@ -29392,15 +29392,12 @@
        "filbert"
      ],
      "review": null,
-      "claim": {
-        "seat": "gander",
-        "op": "gander-293-start"
-      },
+      "claim": null,
      "note": null,
      "blockedReason": null,
      "createdAt": "2026-10-23T01:50:49.168Z",
-      "updatedAt": "2026-10-23T02:23:19.161Z",
-      "updatedBy": "gander"
+      "updatedAt": "2026-10-23T01:50:49.168Z",
+      "updatedBy": "sage"
    },
    {
      "id": 294,
@@ -29412,7 +29409,7 @@
      "closes": [
        1800
      ],
-      "state": "briefed",
+      "state": "queued",
      "previousState": null,
      "required": false,
      "requiredSince": null,
@@ -29432,7 +29429,7 @@
      "note": null,
      "blockedReason": null,
      "createdAt": "2026-10-23T01:52:56.603Z",
-      "updatedAt": "2026-10-23T02:24:22.317Z",
+      "updatedAt": "2026-10-23T01:52:56.603Z",
      "updatedBy": "sage"
    },
    {
@@ -29445,7 +29442,7 @@
      "closes": [
        1801
      ],
-      "state": "briefed",
+      "state": "queued",
      "previousState": null,
      "required": false,
      "requiredSince": null,
@@ -29465,7 +29462,7 @@
      "note": null,
      "blockedReason": null,
      "createdAt": "2026-10-23T01:55:27.867Z",
-      "updatedAt": "2026-10-23T02:25:29.220Z",
+      "updatedAt": "2026-10-23T01:55:27.867Z",
      "updatedBy": "sage"
    },
    {
@@ -29478,7 +29475,7 @@
      "closes": [
        1802
      ],
-      "state": "briefed",
+      "state": "queued",
      "previousState": null,
      "required": false,
      "requiredSince": null,
@@ -29511,7 +29508,7 @@
      "note": null,
      "blockedReason": null,
      "createdAt": "2026-10-23T02:06:14.055Z",
-      "updatedAt": "2026-10-23T02:26:20.629Z",
+      "updatedAt": "2026-10-23T02:06:14.055Z",
      "updatedBy": "sage"
    },
    {
@@ -29524,7 +29521,7 @@
      "closes": [
        1803
      ],
-      "state": "briefed",
+      "state": "queued",
      "previousState": null,
      "required": false,
      "requiredSince": null,
@@ -29549,7 +29546,7 @@
      "note": null,
      "blockedReason": null,
      "createdAt": "2026-10-23T02:07:06.080Z",
-      "updatedAt": "2026-10-23T02:27:10.622Z",
+      "updatedAt": "2026-10-23T02:07:06.080Z",
      "updatedBy": "sage"
    },
    {
@@ -29562,7 +29559,7 @@
      "closes": [
        1804
      ],
-      "state": "briefed",
+      "state": "queued",
      "previousState": null,
      "required": false,
      "requiredSince": null,
@@ -29587,7 +29584,7 @@
      "note": null,
      "blockedReason": null,
      "createdAt": "2026-10-23T02:07:55.156Z",
-      "updatedAt": "2026-10-23T02:27:58.683Z",
+      "updatedAt": "2026-10-23T02:07:55.156Z",
      "updatedBy": "sage"
    },
    {
@@ -29600,7 +29597,7 @@
      "closes": [
        1806
      ],
-      "state": "briefed",
+      "state": "queued",
      "previousState": null,
      "required": false,
      "requiredSince": null,
@@ -29625,7 +29622,7 @@
      "note": null,
      "blockedReason": null,
      "createdAt": "2026-10-23T02:08:45.559Z",
-      "updatedAt": "2026-10-23T02:28:48.103Z",
+      "updatedAt": "2026-10-23T02:08:45.559Z",
      "updatedBy": "sage"
    }
  ],
@@ -119216,214 +119213,6 @@
        "receipt": "ok sage-271-done rev 3398 row 271 in-review→done round 2"
      },
      "viewSha": "f708d387d56974ef32192c1cfe62b7c66317758f7830855b57b6fa0972cd6139"
-    },
-    {
-      "rev": 3399,
-      "op": "sage-293-briefed",
-      "verb": "move",
-      "args": {
-        "id": 293,
-        "to": "briefed",
-        "reason": null,
-        "candidate": null,
-        "evidence": null,
-        "issue": null
-      },
-      "by": "sage",
-      "at": "2026-10-23T02:22:09.917Z",
-      "semantics": 2,
-      "result": {
-        "row": 293,
-        "from": "queued",
-        "to": "briefed",
-        "round": null,
-        "issue": null,
-        "candidate": null,
-        "receipt": "ok sage-293-briefed rev 3399 row 293 queued→briefed"
-      },
-      "viewSha": "45c7b4a59ab6740ee9f879aa59b7fdeb54db7fd90cac709668bc6a68cf90b19b"
-    },
-    {
-      "rev": 3400,
-      "op": "gander-293-start",
-      "verb": "move",
-      "args": {
-        "id": 293,
-        "to": "in-progress",
-        "reason": null,
-        "candidate": null,
-        "evidence": null,
-        "issue": null
-      },
-      "by": "gander",
-      "at": "2026-10-23T02:23:19.161Z",
-      "semantics": 2,
-      "result": {
-        "row": 293,
-        "from": "briefed",
-        "to": "in-progress",
-        "round": null,
-        "issue": null,
-        "candidate": null,
-        "receipt": "ok gander-293-start rev 3400 row 293 briefed→in-progress"
-      },
-      "viewSha": "f6e6eb3aa837eae377759b83e856289ae912ba406fc98b61e24f5a501f25826b"
-    },
-    {
-      "rev": 3401,
-      "op": "sage-294-briefed",
-      "verb": "move",
-      "args": {
-        "id": 294,
-        "to": "briefed",
-        "reason": null,
-        "candidate": null,
-        "evidence": null,
-        "issue": null
-      },
-      "by": "sage",
-      "at": "2026-10-23T02:24:22.317Z",
-      "semantics": 2,
-      "result": {
-        "row": 294,
-        "from": "queued",
-        "to": "briefed",
-        "round": null,
-        "issue": null,
-        "candidate": null,
-        "receipt": "ok sage-294-briefed rev 3401 row 294 queued→briefed"
-      },
-      "viewSha": "942d6360560dac9046aa1618002d54f45c775a1770722484e2e1d03fa6e15e9f"
-    },
-    {
-      "rev": 3402,
-      "op": "sage-295-briefed",
-      "verb": "move",
-      "args": {
-        "id": 295,
-        "to": "briefed",
-        "reason": null,
-        "candidate": null,
-        "evidence": null,
-        "issue": null
-      },
-      "by": "sage",
-      "at": "2026-10-23T02:25:29.220Z",
-      "semantics": 2,
-      "result": {
-        "row": 295,
-        "from": "queued",
-        "to": "briefed",
-        "round": null,
-        "issue": null,
-        "candidate": null,
-        "receipt": "ok sage-295-briefed rev 3402 row 295 queued→briefed"
-      },
-      "viewSha": "8485d2d4083398650448ac035c58a04d6de45c322890de582aa792b39e5f0beb"
-    },
-    {
-      "rev": 3403,
-      "op": "sage-296-briefed",
-      "verb": "move",
-      "args": {
-        "id": 296,
-        "to": "briefed",
-        "reason": null,
-        "candidate": null,
-        "evidence": null,
-        "issue": null
-      },
-      "by": "sage",
-      "at": "2026-10-23T02:26:20.629Z",
-      "semantics": 2,
-      "result": {
-        "row": 296,
-        "from": "queued",
-        "to": "briefed",
-        "round": null,
-        "issue": null,
-        "candidate": null,
-        "receipt": "ok sage-296-briefed rev 3403 row 296 queued→briefed"
-      },
-      "viewSha": "3ceb60f6d34c6dc7d91fb695b85ab7be1d99f04f6e4b04dbb2edbe20e7b85c44"
-    },
-    {
-      "rev": 3404,
-      "op": "sage-297-briefed",
-      "verb": "move",
-      "args": {
-        "id": 297,
-        "to": "briefed",
-        "reason": null,
-        "candidate": null,
-        "evidence": null,
-        "issue": null
-      },
-      "by": "sage",
-      "at": "2026-10-23T02:27:10.622Z",
-      "semantics": 2,
-      "result": {
-        "row": 297,
-        "from": "queued",
-        "to": "briefed",
-        "round": null,
-        "issue": null,
-        "candidate": null,
-        "receipt": "ok sage-297-briefed rev 3404 row 297 queued→briefed"
-      },
-      "viewSha": "38b62c26dbef5e0d96fb42589107cffe419878585ef333033b25dca6f258c14e"
-    },
-    {
-      "rev": 3405,
-      "op": "sage-298-briefed",
-      "verb": "move",
-      "args": {
-        "id": 298,
-        "to": "briefed",
-        "reason": null,
-        "candidate": null,
-        "evidence": null,
-        "issue": null
-      },
-      "by": "sage",
-      "at": "2026-10-23T02:27:58.683Z",
-      "semantics": 2,
-      "result": {
-        "row": 298,
-        "from": "queued",
-        "to": "briefed",
-        "round": null,
-        "issue": null,
-        "candidate": null,
-        "receipt": "ok sage-298-briefed rev 3405 row 298 queued→briefed"
-      },
-      "viewSha": "e9a36736e8f2d7b4b5a32efb08a185eed9b4f0670f43b97c018993cdce00f9b6"
-    },
-    {
-      "rev": 3406,
-      "op": "sage-299-briefed",
-      "verb": "move",
-      "args": {
-        "id": 299,
-        "to": "briefed",
-        "reason": null,
-        "candidate": null,
-        "evidence": null,
-        "issue": null
-      },
-      "by": "sage",
-      "at": "2026-10-23T02:28:48.103Z",
-      "semantics": 2,
-      "result": {
-        "row": 299,
-        "from": "queued",
-        "to": "briefed",
-        "round": null,
-        "issue": null,
-        "candidate": null,
-        "receipt": "ok sage-299-briefed rev 3406 row 299 queued→briefed"
-      },
-      "viewSha": "53435e2d6f9ac928b2d2ab6ca54cd990918d3add2bf1d826c4267e43d3cc4112"
    }
  ]
 }
@@ -26,9 +26,9 @@ export const ACCESS_USAGE = [
 // The help text. A grant's `instances` is the real limit: the granted instance
 // runs with the owner's role, so a collaborator drives it with that authority.
 // Removing a user acts at once. Removing a provider from console.sso waits for a
-// Console restart, so take the users out of access.json first. Peer homes are
-// empty until the federation key lands (row 203), so a grant naming a peer
-// home refuses until then. A grant naming a subject needs console.sso.
+// Console restart, so take the users out of access.json first. A user's home is
+// local or a peer named in federation.peers (FED R6, #1800). A grant naming a
+// subject needs console.sso.
 export const ACCESS_HELP = `${ACCESS_USAGE}

 A grant gives a user exactly what the granted instances can do. The instances
@@ -37,16 +37,16 @@ the owner's role.
 To cut a user off, revoke them here first. It acts at once. Removing a provider
 from console.sso takes effect only after a Console restart, so do that second.
 user remove refuses while the user has a grant at any business: revoke those first.
-Peer homes are not read yet (row 203 adds the federation key), so a grant that
-names a peer home refuses. A grant that names a sign-in subject needs console.sso
+A user's home is local or a peer id from federation.peers in the system config;
+any other home refuses. A grant that names a sign-in subject needs console.sso
 in the system config; without it every such grant refuses.
 The command runs as the instance's uid: access.json must belong to it and must
 not be writable by group or other, or the command refuses (exit 3) and writes nothing.`;

 // The instance's context for checkAccess, read from the system config and the business
 // files. providers and ssoSubjects come from console.sso (row 192's shape: each provider
-// has an id and a subjects list). peers is empty until row 203. A business file that
-// fails to load fails the whole command.
+// has an id and a subjects list). peers are the ids in federation.peers (FED R6, F8),
+// empty without the key. A business file that fails to load fails the whole command.
 export function accessContextFor(system, env) {
  const providers = system.console?.sso?.providers ?? [];
  const ssoSubjects = providers.flatMap((p) => p.subjects.map((s) => ({ provider: p.id, sub: s.sub })));
@@ -59,7 +59,8 @@ export function accessContextFor(system, env) {
      businesses[id] = { human: doc.human, instances: Object.keys(doc.roles) };
    }
  }
-  return { providers: providers.map((p) => p.id), peers: [], businesses, ssoSubjects };
+  const peers = (system.federation?.peers ?? []).map((p) => p.id);
+  return { providers: providers.map((p) => p.id), peers, businesses, ssoSubjects };
 }

 // Every verb needs --business: the human proof runs through that business's bus.
@@ -4,13 +4,14 @@
 // Everything here reads and refuses; nothing writes.

 import { spawnSync } from "node:child_process";
-import { existsSync } from "node:fs";
+import { existsSync, lstatSync } from "node:fs";
 import { dirname, join, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
-import { BusinessError, configDir, loadBusiness, loadProject, projectFilePath, resolveInstance, systemVars } from "../../business/src/index.mjs";
+import { BusinessError, accessFilePath, configDir, loadAccess, loadBusiness, loadProject, projectFilePath, resolveInstance, systemVars } from "../../business/src/index.mjs";
 import { busBusiness } from "../../bus/src/business.mjs";
 import { BusError } from "../../bus/src/broker.mjs";
 import { CliError } from "./errors.mjs";
+import { accessContextFor } from "./access.mjs";

 export const REPO = resolve(dirname(fileURLToPath(import.meta.url)), "..", "..", "..");

@@ -83,6 +84,36 @@ function trackerFor(system, b, warn) {
  };
 }

+// FED R6 (#1800, sage-3142): the runtime's `access`, { file, context }. The broker reads the file
+// with R1's loadAccess on every user request, so a bad file leaves every user with no grant and
+// the owner's bus still boots (sage-3153). The context is the cli's accessContextFor, peers included. No file,
+// or a context that can't be built, means no `access`: no user binds, as before R6.
+function accessFor(system, env, warn) {
+  const file = accessFilePath(configDir(env));
+  try {
+    lstatSync(file);
+  } catch {
+    return null;
+  }
+  let context;
+  try {
+    context = accessContextFor(system, env);
+  } catch (e) {
+    warn(`access.json is present but its context can't be read, so no granted user binds: ${e.message}`);
+    return null;
+  }
+  // sage-3153: one line at boot when the loader refuses the file, so the owner sees why no user
+  // binds. The loader's messages can quote the file, so the line names only the path and a code
+  // from its exit code: 4 is a file it could not open as a regular file, anything else invalid.
+  try {
+    loadAccess(file, context);
+  } catch (e) {
+    const code = e instanceof BusinessError && e.exitCode !== 4 ? "access-invalid" : "access-unreadable";
+    warn(`access file refused at boot (${code}), no granted user binds until it is fixed: ${file}`);
+  }
+  return { file, context };
+}
+
 // The `{op: 'boot'}` config for packages/bus/src/process.mjs, for one
 // business. The host holds a reader capability for the notifier and binds
 // launches later through bindLaunch, so `launches` starts empty.
@@ -101,6 +132,8 @@ export function bootConfig({ system, businessId, env = process.env, warn = () =>
    };
    const tracker = trackerFor(vars, b, warn);
    if (tracker) config.trackers = { [b.id]: tracker };
+    const access = accessFor(system, env, warn);
+    if (access) config.access = access;
    return config;
  });
 }
@@ -0,0 +1,94 @@
+// FED R6 (#1800, sage-3142, sage-3153): the bus host's boot config carries the runtime's `access`
+// ({ file, context }) when <configDir>/access.json exists, with the cli's accessContextFor as the
+// context. The broker then binds a granted user; with no file, or a file R1's loader refuses, no
+// user binds and the owner's bus still boots. A refused file gives one boot warning naming the path
+// and a code, never the file's contents. Scratch roots only. The boot config goes through a JSON
+// round trip first, as it does over the host's IPC.
+import test from "node:test";
+import assert from "node:assert/strict";
+import { chmodSync, symlinkSync, writeFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { startBroker } from "../../bus/src/runtime.mjs";
+import { checkAccess } from "../../business/src/index.mjs";
+import { accessContextFor } from "../src/access.mjs";
+import { bootConfig, loadSystem } from "../src/config.mjs";
+import { fixture, tmp } from "./helpers.mjs";
+
+const SSO = { sso: { providers: [{ id: "authentik", subjects: [{ sub: "jason-sub" }] }] } };
+const FEDERATION = { self: "hub", peers: [{ id: "factory", origin: "https://factory.example.test", label: "Software factory" }] };
+const DOC = {
+  accessVersion: 1,
+  revision: 1,
+  users: [{ id: "alice", home: "factory", subjects: [{ provider: "authentik", sub: "alice-sub" }] }],
+  grants: [{ id: "g-1", user: "alice", business: "acme", projects: ["*"], instances: ["*"], level: "collaborator" }],
+};
+
+// F8: the context's peers are federation.peers' ids, so a user whose home is a configured peer
+// validates and one whose home is any other id, the hub's own included, refuses.
+test("R6 a configured peer id validates as a user's home and an unconfigured one refuses", (t) => {
+  const root = tmp(t, "mosaic-access-peers-");
+  fixture(root, "acme");
+  const ctx = accessContextFor({ console: SSO, federation: FEDERATION }, { MOSAIC_CONFIG: join(root, "config", "config.json") });
+  assert.deepEqual(ctx.peers, ["factory"]);
+  const doc = (home) => ({ ...DOC, users: [{ ...DOC.users[0], home }] });
+  assert.equal(checkAccess(doc("factory"), ctx).users[0].home, "factory");
+  assert.throws(() => checkAccess(doc("elsewhere"), ctx), /home must be a configured peer/);
+  assert.throws(() => checkAccess(doc("hub"), ctx), /home must be a configured peer/);
+});
+
+// A scratch instance whose system config names the sign-in provider and one peer, and the boot
+// config bootConfig makes for it. `file` is the access file's text, null for none, or a function
+// that makes the file at the path.
+async function boot(t, file) {
+  const f = fixture(tmp(t, "mosaic-access-boot-"), "acme");
+  const system = { ...loadSystem({ env: f.env }), console: SSO, federation: FEDERATION };
+  const path = join(dirname(f.config), "access.json");
+  if (typeof file === "function") file(path);
+  else if (file !== null) {
+    writeFileSync(path, file);
+    chmodSync(path, 0o600);
+  }
+  const warnings = [];
+  const { trackers, ...config } = JSON.parse(JSON.stringify(bootConfig({ system, businessId: "acme", env: f.env, warn: (w) => warnings.push(w) })));
+  const runtime = await startBroker(config);
+  t.after(() => runtime.close());
+  const bind = (user) => {
+    try {
+      return runtime.broker.bindUser({ business: "acme", user }) ? "bound" : "none";
+    } catch (e) {
+      return e.code;
+    }
+  };
+  return { config, path, bind, warnings };
+}
+
+test("R6 B1 a boot with access.json binds a granted user, whose home is a configured peer", async (t) => {
+  const s = await boot(t, JSON.stringify(DOC));
+  assert.equal(s.config.access.file, s.path);
+  assert.deepEqual(s.config.access.context.peers, ["factory"]);
+  assert.deepEqual(s.config.access.context.ssoSubjects, [{ provider: "authentik", sub: "jason-sub" }]);
+  assert.equal(s.bind("alice"), "bound");
+  assert.equal(s.bind("bob"), "access-revoked");
+  assert.deepEqual(s.warnings, []);
+});
+
+test("R6 B2 a boot without access.json has no access and binds no user", async (t) => {
+  const s = await boot(t, null);
+  assert.equal(Object.hasOwn(s.config, "access"), false);
+  assert.equal(s.bind("alice"), "access-revoked");
+  assert.deepEqual(s.warnings, []);
+});
+
+test("R6 B3 a boot with a file R1's loader refuses still boots, binds no user and says so once", async (t) => {
+  for (const [why, file, code] of [
+    ["not JSON", '{"secret-marker"', "access-invalid"],
+    ["a home that is not a configured peer", JSON.stringify({ ...DOC, users: [{ ...DOC.users[0], home: "secret-marker" }] }), "access-invalid"],
+    ["a symbolic link", (path) => { writeFileSync(`${path}.real`, JSON.stringify(DOC), { mode: 0o600 }); symlinkSync(`${path}.real`, path); }, "access-unreadable"],
+  ]) {
+    const s = await boot(t, file);
+    assert.equal(s.config.access.file, s.path, why);
+    assert.equal(s.bind("alice"), "access-revoked", why);
+    assert.deepEqual(s.warnings, [`access file refused at boot (${code}), no granted user binds until it is fixed: ${s.path}`], why);
+    assert.doesNotMatch(s.warnings[0], /secret-marker/, why);
+  }
+});
@@ -2598,88 +2598,3 @@ test('row196 rehearsal selects socket only for marked copies and uses scratch da
  assert.equal(untouched(e),before);
 });
 });
-
-// #1797: validate every config with the target loader, even without console.
-function anyConfigLoader(file,text){
- const old=existsSync(file)?readFileSync(file):null;
- if(old!==null)chmodSync(file,0o644);
- mkdirSync(dirname(file),{recursive:true});writeFileSync(file,text);
- return ()=>{if(old===null)rmSync(file);else{writeFileSync(file,old);chmodSync(file,0o444);}};
-}
-const ANY_CONFIG_MSG=(e,to,op,why)=>`${e.cfg} is refused by ${to}'s loader (${why}); remove the refused key first (restore the config.json backup from the window's step 1), then run the ${op} again`;
-test('config-any-key: a non-console target refusal stops activate and rollback before any stop',async t=>{
- const e=await mk(t);await seed(e);
- let r=await run(e,'activate',C1,'acme');assert.equal(r.code,0,r.out+r.err);
- const why='mosaic-config: unsupported configuration key: "execution"';
- const undo=anyConfigLoader(join(COPIES,B,'scripts/mosaic-config.mjs'),`console.error(${JSON.stringify(why)});process.exitCode=2;\n`);
- try{
-  assert.equal(Object.hasOwn(JSON.parse(readFileSync(e.cfg,'utf8')),'console'),false);
-  for(const op of ['activate','rollback']){
-   const args=op==='activate'?['activate',B,'acme']:['rollback','acme'];
-   await refused(e,args,'config-console-key',ANY_CONFIG_MSG(e,B,op,why));
-  }
-  const out=await planOnly(e,3,'rollback','acme');
-  assert.deepEqual(out.filter(l=>l.startsWith('refuses ')),[`refuses config-console-key: ${ANY_CONFIG_MSG(e,B,'rollback',why)}`]);
- }finally{undo();}
-});
-// Duckworth C1 (duckworth-0229): B's fixture loader (LOADER_OLD) is today's loader with a shorter
-// first list, so it still reads the row 270 keys. This stand-in is C1's loader without the row 270
-// concat, the list the loader had before bce491715 added the first of the two keys.
-const PRE270=(now)=>{const old=now.replace('.concat(["compactionReadBytes", "compactionStreams"])','');assert.notEqual(old,now);return old};
-test('config-any-key: a pre-270 target refuses each row 270 key on a full activate and rollback, naming the key',async t=>{
- const e=await mk(t);await seed(e);
- let r=await run(e,'activate',C1,'acme');assert.equal(r.code,0,r.out+r.err);
- const original=readFileSync(e.cfg,'utf8'),now=join(COPIES,C1,'scripts/mosaic-config.mjs');
- assert.equal(Object.hasOwn(JSON.parse(original),'console'),false);
- const undo=anyConfigLoader(join(COPIES,B,'scripts/mosaic-config.mjs'),PRE270(readFileSync(now,'utf8')));
- try{
-  for(const [key,value] of [['compactionReadBytes',1048576],['compactionStreams',1024]]){
-   writeFileSync(e.cfg,JSON.stringify({...JSON.parse(original),[key]:value}));
-   // C1's own loader reads the key, so the refusal is the target's.
-   const ok=spawnSync(NODE,[now,'validate'],{encoding:'utf8',env:{...e.env,MOSAIC_CONFIG:e.cfg}});assert.equal(ok.status,0,ok.stderr);
-   const why=`mosaic-config: unsupported configuration key: "${key}"`;
-   await refused(e,['activate',B,'acme'],'config-console-key',ANY_CONFIG_MSG(e,B,'activate',why));
-   await refused(e,['rollback','acme'],'config-console-key',ANY_CONFIG_MSG(e,B,'rollback',why));
-  }
- }finally{undo();writeFileSync(e.cfg,original);}
- r=await run(e,'rollback','acme');assert.equal(r.code,0,r.out+r.err);assert.equal(pointer(e).copy,B);
-});
-test('config-any-key: accepting loaders run validate with the selected config on activate and rollback',async t=>{
- const e=await mk(t);await seed(e);const witness=join(e.root,'loader-calls.jsonl'),canary='resolved-config-must-not-leak';
- const undos=[B,C1].map(id=>anyConfigLoader(join(COPIES,id,'scripts/mosaic-config.mjs'),`import fs from 'node:fs';fs.appendFileSync(${JSON.stringify(witness)},JSON.stringify({copy:${JSON.stringify(id)},args:process.argv.slice(2),config:process.env.MOSAIC_CONFIG})+'\\n');console.log(${JSON.stringify(canary)});\n`));
- try{
-  for(const args of [['activate',C1,'acme'],['rollback','acme']]){
-   const r=await run(e,...args);assert.equal(r.code,0,r.out+r.err);assert.equal((r.out+r.err).includes(canary),false);
-  }
-  assert.deepEqual(lines(witness).map(JSON.parse),[
-   {copy:C1,args:['validate'],config:e.cfg},{copy:B,args:['validate'],config:e.cfg},
-  ]);
- }finally{for(const undo of undos)undo();}
-});
-function isolatedConfigChecks(e){
- const source=readFileSync(SR,'utf8'),body=source.split('config_checks() {')[1]?.split('\n}\n')[0];assert.ok(body,'config_checks exists');
- return spawnSync('bash',['-c','config_checks() {'+body+'\n}\ncheck_refuse(){ printf "%s: %s\\n" "$1" "$2" >&2; exit 3; }; config_checks'],{
-  encoding:'utf8',env:{...e.env,COPIES:join(e.root,'target-copies'),TO:'old',OP:'activate'},
- });
-}
-test('config-any-key: missing-loader copies accept only the four oldest keys',async t=>{
- const e=await mk(t);let r=isolatedConfigChecks(e);assert.equal(r.status,0,r.stderr);
- const original=JSON.parse(readFileSync(e.cfg,'utf8'));
- for(const [key,value] of [['compactionReadBytes',1048576],['compactionStreams',1024]]){
-  writeFileSync(e.cfg,JSON.stringify({...original,[key]:value}));r=isolatedConfigChecks(e);
-  assert.equal(r.status,3,r.stderr);assert.match(r.stderr,new RegExp(`configuration key: "${key}"`));
-  assert.ok(r.stderr.includes('restore the config.json backup from the window\'s step 1'));
- }
- // Row 203's text for a console or federation key stays word for word with no loader too, even
- // when a later key comes first in the file.
- for(const [key,value] of [['console',{}],['federation',{self:'hub',peers:[]}]]){
-  writeFileSync(e.cfg,JSON.stringify({...original,compactionStreams:1024,[key]:value}));r=isolatedConfigChecks(e);
-  assert.equal(r.status,3,r.stderr);assert.equal(r.stderr,`config-console-key: ${KEY_MSG(e,'old','activate','it has no scripts/mosaic-config.mjs')}\n`);
- }
-});
-test('config-any-key: missing config passes but malformed JSON refuses without calling the loader',async t=>{
- const e=await mk(t),file=join(e.root,'target-copies/old/scripts/mosaic-config.mjs'),witness=join(e.root,'validate-called');
- mkdirSync(dirname(file),{recursive:true});writeFileSync(file,`import fs from 'node:fs';fs.writeFileSync(${JSON.stringify(witness)},'called');\n`);
- rmSync(e.cfg);let r=isolatedConfigChecks(e);assert.equal(r.status,0,r.stderr);assert.equal(existsSync(witness),false);
- writeFileSync(e.cfg,'{');r=isolatedConfigChecks(e);assert.equal(r.status,3,r.stderr);assert.match(r.stderr,/cannot be read as JSON/);assert.equal(existsSync(witness),false);
-});
@@ -0,0 +1,26 @@
+// FED R6 (#1800, federation design 3.1 D3 and D5): who besides the owner may sign in to this
+// Console. `load` is R1's loadAccess over this instance's access.json and context, called on every
+// use and never cached, so a revoke, a removed subject or an expired grant counts on the next
+// request. A user is live while one grant in the Console's business covers at `viewer`, the same
+// test as the broker's #userGrants. The broker still decides every verb, project, instance and
+// thread (D4). Any failure to load, or to name the business, finds nobody (fail closed).
+import { covers } from '../../business/src/vocabulary.mjs';
+
+export function consoleAccess({ load, business }) {
+  if (typeof load !== 'function' || typeof business !== 'function') throw new TypeError('consoleAccess needs load and business functions');
+  const live = (doc, id, b) => doc.grants.some(g => g.user === id && g.business === b &&
+    covers(g, { business: b, project: g.projects[0], instance: g.instances[0] }, new Date(), { level: 'viewer' }));
+  const lookup = (provider, sub) => {
+    try {
+      const doc = load(), b = business();
+      const user = doc.users.find(u => u.subjects.some(s => s.provider === provider && s.sub === sub));
+      return user && live(doc, user.id, b) ? user.id : null;
+    } catch { return null; }
+  };
+  return Object.freeze({
+    // The user id this (provider, sub) signs in as, or null.
+    find: ({ provider, sub }) => lookup(provider, sub),
+    // Is this session's user still the holder of its own subject, with a live grant?
+    check: session => typeof session?.user === 'string' && lookup(session.provider, session.sub) === session.user,
+  });
+}
@@ -17,6 +17,8 @@ const STATUS = {
  'unknown-business': 403, 'read-only': 403, 'not-configured': 503, 'no-bus-host': 503,
  'thread-instance-missing': 503, 'thread-instance-ambiguous': 503, 'outcome-unknown': 503,
  'tester-off': 403, 'tester-required': 403, 'tester-refused': 403,
+  // FED R6 (#1800): the broker's refusals of a granted user.
+  'access-refused': 403, 'access-revoked': 401,
 };
 function safeMessage(code) {
  if (code === 'channel-disabled') return 'Run mosaic plugins to read the revision, then mosaic plugins set --file PATCH with plugins.channel set to ["cli","webui"].';
@@ -6,9 +6,14 @@ import { createChannelCaller } from '../../plugins/src/channel.mjs';
 import { PluginError } from '../../plugins/src/kinds.mjs';
 import { BusReadError } from './bus.mjs';

-export function createChat({ call }) {
+// FED R6 (#1800, sage-3153): `owner`, when given, is the owner's transport, and it carries only
+// the channel settings read, `plugins` with {}. A granted user's chat needs it since `plugins` is
+// not a user verb. The result gates the webui channel server-side and is never sent to the user.
+// Every chat verb goes over the user's own `call`.
+export function createChat({ call, owner = null }) {
  if (typeof call !== 'function') throw new TypeError('chat needs a bus transport function');
-  const dispatch = createChannelCaller({ name: 'webui', call });
+  if (owner !== null && typeof owner !== 'function') throw new TypeError('chat owner must be a bus transport function');
+  const dispatch = createChannelCaller({ name: 'webui', call: owner === null ? call : (verb, args) => verb === 'plugins' ? owner('plugins', {}) : call(verb, args) });
  const channel = async (verb, args) => {
    try { return await dispatch(verb, args); }
    catch (err) {
@@ -3,6 +3,11 @@
 import { createChat } from './chat.mjs';
 import { startServer, previewOptions, proofOptions, DEFAULT_BOARD } from './serve.mjs';
 import { busCaller } from './bus.mjs';
+import { busBusiness, userCaller } from './user-bus.mjs';
+import { consoleBus, userOptionsFor, agentCaller, TESTER_AGENT_VERBS } from './console-bus.mjs';
+import { consoleAccess } from './access.mjs';
+import { accessContextFor } from '../../cli/src/access.mjs';
+import { accessFilePath, loadAccess } from '../../business/src/access.mjs';
 import { startTesterSocket } from './tester-socket.mjs';
 import { TESTER_CLI } from '../../cli/src/transport.mjs';
 import { views } from '../../bus/src/views.mjs';
@@ -13,14 +18,6 @@ import { createSso, readSlot } from './sso.mjs';
 import { statSync } from 'node:fs';
 import { isAbsolute } from 'node:path';
 import { ID_PATTERN } from '../../business/src/vocabulary.mjs';
-// Row 194 (#1692, D7): the Agents section's verbs. The caller refuses any other, so the server's
-// agentWrite reaches only these.
-const AGENT_VERBS = ['instance.launch', 'instance.regenerate', 'instance.end', 'veto.set', 'instance.request'];
-const TESTER_AGENT_VERBS = ['instance.launch', 'instance.end', 'instance.request'];
-const agentCaller = (call, verbs) => async (verb, args) => {
-  if (!verbs.includes(verb)) throw new Error(`the Console does not call ${verb}`);
-  return call(verb, args);
-};
 const args = process.argv.slice(2);
 const usage = 'node packages/webui/src/cli.mjs serve [--port N] [--tester-socket] [--checkout PATH] [--board http://127.0.0.1:7331] [--business ID] [--sso [--send]] [--public-host NAME --auth-header HEADER --allow-user ID [--send] [--proof-header NAME --proof-file PATH]]';
 try {
@@ -73,24 +70,13 @@ try {
  // no notifier. A refusal printed here names no path (redactor).
  // --send without a bus refuses to start rather than serve a composer that can't send.
  let bus = null, send = null, settingsWrite = null, projectFiles = null, projectFile = null, libraryFile = null, libraryStatus = null, librarySync = null, projectSave = null, chat = null, nameWrite = null, assistantStop = null, instancesWrite = null, routesWrite = null, agentWrite = null, busLine, system = null;
-  let processing = null;
+  let processing = null, ownerCall = null;
  try {
    system = loadSystem();
    const { dataRoot } = system;
-    const call = busCaller({ dataRoot, socket: socketPath(dataRoot), business: options.business ?? null });
-    processing = { read: () => call('processing.status'), halt: args => call('processing.halt', args), resume: args => call('processing.resume', args) };
-    chat = createChat({ call });
-    // Row 155 (#1649): `names` is a webui read only, so it sits beside the shared views. Row 165
-    // (#1662): so is `instances`, and its write `instances.set` is only under --send. Row 65
-    // (mos-0840): so is `routes`, and its write `routes.set`.
-    // Row 278: this owner/reader read belongs to the Console, not the shared
-    // role views or the tester adapter. The bus decides caller eligibility.
-    bus = { ...views({ call }), names: () => call('names'), instances: () => call('instances'), routes: () => call('routes'), 'thread.claims': () => call('thread.claims') };
-    // Row 148: the spec and docs editor reads like the other reads and saves only under --send.
-    projectFiles = args => call('project.files', args);
-    projectFile = args => call('project.file', args);
-    libraryFile = args => call('library.file', args); libraryStatus = args => call('library.status', args);
-    if (sendOn) {send = args => call('message.send', args);librarySync=args=>call('library.sync',args);settingsWrite=args=>call('limits.set',args);projectSave=args=>call('project.file.save',args);nameWrite=args=>call('name.set',args);assistantStop=args=>call('assistant.stop',args);instancesWrite=args=>call('instances.set',args);routesWrite=args=>call('routes.set',args);agentWrite=agentCaller(call,AGENT_VERBS);}
+    const call = ownerCall = busCaller({ dataRoot, socket: socketPath(dataRoot), business: options.business ?? null });
+    // FED R6 (#1800): the bus-backed options, shared with each granted user's session (console-bus.mjs).
+    ({ processing, chat, bus, projectFiles, projectFile, libraryFile, libraryStatus, send, librarySync, settingsWrite, projectSave, nameWrite, assistantStop, instancesWrite, routesWrite, agentWrite } = consoleBus(call, { send: sendOn }));
    busLine = `Bus: ${options.business ?? 'the running bus host\'s business'}`;
  } catch (err) {
    const why = redactor({ configDir: configDir() })(err.message);
@@ -102,15 +88,24 @@ try {
  const reads = consoleReads({ root: REPO, queueRoot: options.checkout ?? REPO, system, configDir: configDir(), rolesDir: rolesDir(), business: options.business ?? null });
  // The sign-in config is checked again here, then each slot file, before anything listens. A
  // provider that can't be reached starts degraded; one whose discovery is refused stops the start.
-  let sso = null;
+  let sso = null, userOptions = null;
  if (ssoOn) {
    if (!system.console?.sso) throw new Error('--sso needs console.sso in the system config');
    const secrets = new Map(system.console.sso.providers.map(p => [p.id, readSlot(configDir(), p, { repo: REPO, checkout: options.checkout ?? null })]));
-    sso = await createSso(system.console.sso, { secrets });
+    // FED R6 (#1800): access.json users sign in too. R1's loader reads the file on every check,
+    // with the same context as `mosaic access`; a missing or refused file signs nobody in.
+    const users = consoleAccess({
+      load: () => loadAccess(accessFilePath(configDir()), accessContextFor(system, process.env)),
+      business: busBusiness({ dataRoot: system.dataRoot, business: options.business ?? null }),
+    });
+    sso = await createSso(system.console.sso, { secrets, users });
+    // Each request of a granted user's session gets the bus options over that user's own
+    // user-cli transport. The human transport above serves only the chat's `plugins` read (C6).
+    userOptions = userOptionsFor({ owner: ownerCall, send: sendOn, transport: user => userCaller({ dataRoot: system.dataRoot, socket: socketPath(system.dataRoot), business: options.business ?? null, user }) });
  }
  let server;
  try {
-    server = await startServer({ board: options.board, port: options.port, bus, reads, preview: options.preview, sso, proof, send, settingsWrite, projectFiles, projectFile, libraryFile, libraryStatus, librarySync, projectSave, chat, nameWrite, assistantStop, instancesWrite, routesWrite, agentWrite, processing });
+    server = await startServer({ board: options.board, port: options.port, bus, reads, preview: options.preview, sso, proof, send, settingsWrite, projectFiles, projectFile, libraryFile, libraryStatus, librarySync, projectSave, chat, nameWrite, assistantStop, instancesWrite, routesWrite, agentWrite, processing, userOptions, federation: system?.federation ?? null });
  } catch (err) { sso?.close(); throw err; }
  let testerServer = null;
  if (testerSocket) {
@@ -0,0 +1,49 @@
+// FED R6 (#1800): the Console's bus-backed options for startServer, built over one transport
+// `call`. cli.mjs builds them once over the human transport. A granted user's session gets the same
+// set over its own user transport (user-bus.mjs userCaller), so no route a user reaches holds a
+// human-transport object, and the broker decides every verb the user sends (design 3.1 D4).
+import { createChat } from './chat.mjs';
+import { views } from '../../bus/src/views.mjs';
+
+// Row 194 (#1692, D7): the Agents section's verbs. The caller refuses any other, so the server's
+// agentWrite reaches only these.
+export const AGENT_VERBS = ['instance.launch', 'instance.regenerate', 'instance.end', 'veto.set', 'instance.request'];
+export const TESTER_AGENT_VERBS = ['instance.launch', 'instance.end', 'instance.request'];
+export const agentCaller = (call, verbs) => async (verb, args) => {
+  if (!verbs.includes(verb)) throw new Error(`the Console does not call ${verb}`);
+  return call(verb, args);
+};
+
+// `send` is the --send flag: without it every write is null. `owner` is the owner's transport for
+// a granted user's options; it goes to createChat, which sends it only the `plugins` read.
+export function consoleBus(call, { send: sendOn = false, owner = null } = {}) {
+  const o = {
+    processing: { read: () => call('processing.status'), halt: args => call('processing.halt', args), resume: args => call('processing.resume', args) },
+    chat: createChat({ call, owner }),
+    // Row 155 (#1649): `names` is a webui read only, so it sits beside the shared views. Row 165
+    // (#1662): so is `instances`, and its write `instances.set` is only under --send. Row 65
+    // (mos-0840): so is `routes`, and its write `routes.set`.
+    // Row 278: this owner/reader read belongs to the Console, not the shared
+    // role views or the tester adapter. The bus decides caller eligibility.
+    bus: { ...views({ call }), names: () => call('names'), instances: () => call('instances'), routes: () => call('routes'), 'thread.claims': () => call('thread.claims') },
+    // Row 148: the spec and docs editor reads like the other reads and saves only under --send.
+    projectFiles: args => call('project.files', args),
+    projectFile: args => call('project.file', args),
+    libraryFile: args => call('library.file', args), libraryStatus: args => call('library.status', args),
+    send: null, librarySync: null, settingsWrite: null, projectSave: null, nameWrite: null, assistantStop: null, instancesWrite: null, routesWrite: null, agentWrite: null,
+  };
+  if (sendOn) {
+    o.send = args => call('message.send', args); o.librarySync = args => call('library.sync', args); o.settingsWrite = args => call('limits.set', args);
+    o.projectSave = args => call('project.file.save', args); o.nameWrite = args => call('name.set', args); o.assistantStop = args => call('assistant.stop', args);
+    o.instancesWrite = args => call('instances.set', args); o.routesWrite = args => call('routes.set', args); o.agentWrite = agentCaller(call, AGENT_VERBS);
+  }
+  return o;
+}
+
+// A granted user's options per session: consoleBus over `transport(session.user)`, that user's own
+// transport, with the owner's transport `owner` passed as it is. Nothing from the session or the
+// request reaches `owner` (mos-1394, sage-3157): createChat sends it only `plugins` with {}.
+export function userOptionsFor({ owner, transport, send = false }) {
+  if (typeof owner !== 'function' || typeof transport !== 'function') throw new TypeError('userOptionsFor needs owner and transport functions');
+  return session => consoleBus(transport(session.user), { send, owner });
+}
@@ -476,5 +476,5 @@
    setTimeout(() => { const a = document.activeElement; if (!a || a === document.body || a.disabled || !a.getClientRects().length) line.focus(); });
  });
  // Sign out (sage-1347, F7): a plain same-origin form POST to /auth/logout, shown only under --sso.
-  api('/api/config').then(config => { board = config.board; $('board-url').textContent = `Board: ${board}`; if (config.sso === true) { sso = true; $('sign-out').hidden = out(); } }).catch(err => { if (machine) error(err); }).finally(refresh);
+  api('/api/config').then(config => { board = config.board; $('board-url').textContent = `Board: ${board}`; window.MosaicFederation?.render(config.federation, $('federation')); if (config.sso === true) { sso = true; $('sign-out').hidden = out(); } }).catch(err => { if (machine) error(err); }).finally(refresh);
 })();
@@ -0,0 +1,26 @@
+/* FED R6 (#1800): the hub label and plain peer links from /api/config's `federation`. Text and
+   href only: no script, no fetch to a peer and no proxy (the hub proxy route is R8's). */
+(() => {
+  'use strict';
+  function render(federation, container) {
+    if (!container) return;
+    container.replaceChildren();
+    if (!federation || typeof federation !== 'object') { container.hidden = true; return; }
+    if (typeof federation.self === 'string') {
+      const label = document.createElement('span');
+      label.id = 'hub-label';
+      label.textContent = `This Console: ${federation.self}`;
+      container.append(label);
+    }
+    for (const peer of Array.isArray(federation.peers) ? federation.peers : []) {
+      if (typeof peer?.origin !== 'string' || !/^https?:\/\//.test(peer.origin)) continue;
+      const a = document.createElement('a');
+      a.className = 'peer-link';
+      a.setAttribute('href', peer.origin);
+      a.textContent = typeof peer.label === 'string' && peer.label ? peer.label : peer.origin;
+      container.append(' ', a);
+    }
+    container.hidden = !container.childNodes.length;
+  }
+  window.MosaicFederation = Object.freeze({ render });
+})();
@@ -4,11 +4,12 @@
 <link rel="stylesheet" href="/shared/app.css"><link rel="stylesheet" href="/tokens.css"><link rel="stylesheet" href="/console.css"><link rel="stylesheet" href="/live.css"><link rel="stylesheet" href="/bus.css"><link rel="stylesheet" href="/chat.css"><link rel="stylesheet" href="/shell.css">
 <link rel="stylesheet" href="/editor.css"><script src="/editor.js" defer></script>
 <link rel="stylesheet" href="/processing.css"><script src="/processing.js" defer></script>
-<script src="/brand.js" defer></script><script src="/app.js" defer></script><script src="/markdown-preview.js" defer></script><script src="/chat.js" defer></script><script src="/agents.js" defer></script><script src="/bus.js" defer></script></head>
+<script src="/federation.js" defer></script><script src="/brand.js" defer></script><script src="/app.js" defer></script><script src="/markdown-preview.js" defer></script><script src="/chat.js" defer></script><script src="/agents.js" defer></script><script src="/bus.js" defer></script></head>
 <body>
 <a class="skip" href="#main">Skip to content</a>
 <header class="cmdbar"><a href="/" class="wordmark"><svg class="mark" viewBox="0 0 16 17" aria-hidden="true"><use href="/icons.svg#mark"/></svg>Mosaic<small>Console</small></a>
 <button type="button" class="cmdk" id="cmdk" aria-haspopup="dialog" aria-controls="cmdk-dialog"><svg class="i" aria-hidden="true"><use href="/icons.svg#i-search"/></svg><span>Go to a view, decision or task</span><kbd>Ctrl K</kbd></button>
+<nav id="federation" class="federation small" aria-label="Consoles" hidden></nav>
 <p class="fresh" id="fresh"><span id="fresh-board"></span><span id="fresh-bus"></span></p>
 <div class="cmd-right"><label>Palette<select id="palette"></select></label><label>Appearance<select id="mode"><option value="system">system</option><option value="light">light</option><option value="dim">dim</option><option value="dark">dark</option></select></label><button class="btn" id="refresh" type="button">Refresh</button><button class="btn" id="pause" type="button" aria-pressed="false">Pause</button><form id="sign-out" method="post" action="/auth/logout" hidden><button class="btn" type="submit">Sign out</button></form></div></header>
 <div id="processing-banner" class="processing-banner" role="alert" hidden></div>
@@ -0,0 +1,17 @@
+<!doctype html>
+<html lang="en" data-design="console" data-palette="harbor">
+<head><meta charset="utf-8"><meta name="viewport" content="width=device-width, initial-scale=1"><title>Mosaic Console</title>
+<link rel="stylesheet" href="/tokens.css"><link rel="stylesheet" href="/console.css"><link rel="stylesheet" href="/chat.css">
+<script src="/federation.js" defer></script><script src="/chat.js" defer></script><script src="/user.js" defer></script></head>
+<body>
+<a class="skip" href="#main">Skip to content</a>
+<header class="cmdbar"><a href="/" class="wordmark"><svg class="mark" viewBox="0 0 16 17" aria-hidden="true"><use href="/icons.svg#mark"/></svg>Mosaic<small>Console</small></a>
+<nav id="federation" class="federation small" aria-label="Consoles" hidden></nav>
+<div class="cmd-right"><form id="sign-out" method="post" action="/auth/logout"><button class="btn" type="submit">Sign out</button></form></div></header>
+<main id="main" class="content" tabindex="-1">
+<div id="signed-out" class="banner ref" role="alert" tabindex="-1" hidden>You are signed out. <a href="/">Sign in again</a>.</div>
+<p id="user-notice" class="banner ref">The business owner sees your thread's agent's decisions, inbox entries, claims, tasks and project files, but not your messages.</p>
+<div id="chat"></div>
+</main>
+<footer class="foot"><span id="footer">Mosaic Stack</span></footer>
+</body></html>
@@ -0,0 +1,23 @@
+/* FED R6 (#1800): a granted user's page. Projects, threads and messages through chat.js; the
+   broker decides what this user reads and sends. No owner control is on this page. */
+(() => {
+  'use strict';
+  const $ = id => document.getElementById(id);
+  let canSend = false, ready = false;
+  const route = () => {
+    const path = location.hash.slice(1).split('?')[0];
+    return path.startsWith('/chat') ? path : '/chat';
+  };
+  function show(navigated) {
+    if (ready && window.MosaicChat) void window.MosaicChat.render({ path: route(), container: $('chat'), canSend, navigated });
+  }
+  document.addEventListener('mosaic-signed-out', () => { $('signed-out').hidden = false; $('sign-out').hidden = true; });
+  window.addEventListener('hashchange', () => show(true));
+  fetch('/api/config', { cache: 'no-store', redirect: 'manual' }).then(async res => {
+    if (res.type === 'opaqueredirect' || res.status === 401) { document.dispatchEvent(new Event('mosaic-signed-out')); return; }
+    const config = await res.json();
+    canSend = config.send === true;
+    window.MosaicFederation?.render(config.federation, $('federation'));
+    ready = true; show(true);
+  }).catch(() => { $('chat').textContent = 'The Console could not be read. Refresh to try again.'; });
+})();
@@ -27,7 +27,7 @@ export function boardURL(value) {
 const root = resolve(import.meta.dirname, 'public');
 const files = new Map([
  ['/', ['index.html', 'text/html; charset=utf-8']],
-  ...['app.js', 'brand.js', 'bus.js', 'markdown-preview.js', 'chat.js', 'processing.js', 'agents.js'].map(f => ['/' + f, [f, 'text/javascript; charset=utf-8']]),
+  ...['app.js', 'brand.js', 'bus.js', 'markdown-preview.js', 'chat.js', 'processing.js', 'agents.js', 'federation.js'].map(f => ['/' + f, [f, 'text/javascript; charset=utf-8']]),
  ...['shared/app.css', 'tokens.css', 'console.css', 'live.css', 'bus.css', 'shell.css', 'chat.css', 'processing.css'].map(f => ['/' + f, [f, 'text/css; charset=utf-8']]),
  ['/editor.js', ['editor.js', 'text/javascript; charset=utf-8']],
  ['/editor.css', ['editor.css', 'text/css; charset=utf-8']],
@@ -35,6 +35,26 @@ const files = new Map([
  ...[400, 500, 600, 700].map(w => [`/assets/fonts/manrope-${w}.woff2`, [`assets/fonts/manrope-${w}.woff2`, 'font/woff2']]),
  ...[400, 500, 700].map(w => [`/assets/fonts/jetbrains-mono-${w}.woff2`, [`assets/fonts/jetbrains-mono-${w}.woff2`, 'font/woff2']]),
 ]);
+// FED R6 (#1800): a granted user's page. The owner page's markup and scripts are never served to a
+// user session, so its controls are not sent at all (design 3.1 D5).
+const USER_FILES = new Map([
+  ['/', ['user.html', 'text/html; charset=utf-8']],
+  ...['user.js', 'chat.js', 'federation.js'].map(f => ['/' + f, [f, 'text/javascript; charset=utf-8']]),
+  ...['tokens.css', 'console.css', 'chat.css'].map(f => ['/' + f, [f, 'text/css; charset=utf-8']]),
+  ...[...files].filter(([p]) => p.startsWith('/assets/fonts/') || p === '/icons.svg'),
+]);
+// The only routes a granted user's session reaches: the chat, the page config and the user page.
+// Anything else is the owner's, so a route added later is owner-only until it is added here.
+export function userRoute(path, method) {
+  if (path === '/api/chat' || path.startsWith('/api/chat/')) return true;
+  if (method !== 'GET' && method !== 'HEAD') return false;
+  return path === '/api/config' || path === '/favicon.ico' || USER_FILES.has(path);
+}
+// The hub label and plain peer links, from system.federation: ids, labels and origins only.
+function federationView(federation) {
+  if (federation === null || typeof federation !== 'object') return null;
+  return { self: federation.self ?? null, peers: (federation.peers ?? []).map(({ id, label, origin }) => ({ id, label, origin })) };
+}
 function json(res, status, body) {
  res.writeHead(status, { 'content-type': 'application/json', 'cache-control': 'no-store' });
  res.end(JSON.stringify(body));
@@ -579,7 +599,7 @@ async function projectFileRead(res, read, path, search) {
 // `log` takes one line per send attempt that got past sign-in; never the body. `fieldsFile` is for
 // tests; the field table is otherwise the committed packages/tasks/fields.json.
 // `agentWrite` (row 194, D7) is `(verb, args) => Promise` for the Agents section's verbs and instance.request.
-export async function startServer({ host = '127.0.0.1', port = 7330, board = DEFAULT_BOARD, timeout = 20000, bus = null, reads = null, preview = null, sso = null, tester = false, testerSocket = null, testerAuthHeader = null, proof = null, testerProofHeader = null, send = null, settingsWrite = null, projectFiles = null, projectFile = null, projectSave = null, chat = null, nameWrite = null, assistantStop = null, instancesWrite = null, routesWrite = null, agentWrite = null, processing = null, log = line => console.log(line), fieldsFile = undefined } = {}) {
+export async function startServer({ host = '127.0.0.1', port = 7330, board = DEFAULT_BOARD, timeout = 20000, bus = null, reads = null, preview = null, sso = null, tester = false, testerSocket = null, testerAuthHeader = null, proof = null, testerProofHeader = null, send = null, settingsWrite = null, projectFiles = null, projectFile = null, projectSave = null, chat = null, nameWrite = null, assistantStop = null, instancesWrite = null, routesWrite = null, agentWrite = null, processing = null, userOptions = null, federation = null, log = line => console.log(line), fieldsFile = undefined } = {}) {
  if (!isLoopback(host)) throw new Error('refusing to bind to non-loopback host');
  if (host === 'localhost') host = '127.0.0.1';
  if (tester && preview !== null) throw new Error('tester listener cannot use preview mode');
@@ -591,6 +611,11 @@ export async function startServer({ host = '127.0.0.1', port = 7330, board = DEF
  if (tester && !testerSocket) throw new Error('tester listener requires private socket');
  if (!tester && testerSocket) throw new Error('tester socket requires tester listener');
  const upstream = boardURL(board);
+  // `userOptions` (FED R6, #1800) is `session => options`, the bus-backed options over that session
+  // user's own transport (console-bus.mjs). Only a signed-in listener has user sessions.
+  if (userOptions !== null && (sso === null || typeof userOptions !== 'function')) throw new Error('user sessions need --sso');
+  const owner = { bus, reads, send, settingsWrite, projectFiles, projectFile, projectSave, chat, nameWrite, assistantStop, instancesWrite, routesWrite, agentWrite, processing, upstream, files };
+  const hub = federationView(federation);
  // An object with none of the three is refused too: asking for the preview never serves without it.
  if (preview !== null && !(preview = previewOptions({ publicHost: preview.host, authHeader: preview.header, allowUser: preview.user }))) {
    throw new Error('preview mode needs --public-host, --auth-header and --allow-user together');
@@ -598,6 +623,8 @@ export async function startServer({ host = '127.0.0.1', port = 7330, board = DEF
  if (proof !== null && (preview === null || tester)) throw new Error('proxy proof needs preview mode');
  if (send !== null && ((preview === null && sso === null) || typeof send !== 'function')) throw new Error('--send needs the preview mode (--public-host, --auth-header and --allow-user) or --sso');
  const server = createServer(async (req, res) => {
+    // A granted user's request rebinds these below; every other request keeps the owner's.
+    let { bus, reads, send, settingsWrite, projectFiles, projectFile, projectSave, chat, nameWrite, assistantStop, instancesWrite, routesWrite, agentWrite, processing, upstream, files } = owner, granted = false;
    res.setHeader('x-content-type-options', 'nosniff');
    res.setHeader('referrer-policy', 'no-referrer');
    // Under --sso the Sign out form's POST is redirected to the provider's end-session endpoint, and
@@ -653,6 +680,14 @@ export async function startServer({ host = '127.0.0.1', port = 7330, board = DEF
        return res.end();
      }
      if (session) signer = { sso: true, user: session.name, host: sso.publicHost, origin: sso.publicOrigin };
+      // FED R6 (#1800): a granted user. The Console's gate first; behind it no human-transport
+      // object is left, so a route past the gate reaches the broker only as this user.
+      if (session?.user !== undefined) {
+        if (!userRoute(path, req.method)) return json(res, 403, { error: 'owner-only', message: 'this part of the Console is the business owner\'s' });
+        if (userOptions === null) return json(res, 503, { error: 'not-configured', message: 'the Console has no user transport' });
+        ({ bus, send, settingsWrite, projectFiles, projectFile, projectSave, chat, nameWrite, assistantStop, instancesWrite, routesWrite, agentWrite, processing } = userOptions(session));
+        reads = null; upstream = null; files = USER_FILES; granted = true;
+      }
    }
    if (named && preview !== null) {
      // One value, equal to the user id; the proxy strips client copies and sets it after sign-in.
@@ -715,6 +750,7 @@ export async function startServer({ host = '127.0.0.1', port = 7330, board = DEF
    const allowed = path === '/api/board' || conversation ? 'GET' : ['/api/seen', '/api/reply'].includes(path) ? 'POST' : null;
    if (allowed) {
      if (req.method !== allowed) return json(res, 405, { error: 'method not allowed' });
+      if (upstream === null) return json(res, 503, { error: 'not-configured', message: 'the Console has no board for this session' });
      let bytes;
      if (allowed === 'POST') {
        try { bytes = await body(req); } catch (err) { return json(res, 400, { error: err.message }); }
@@ -763,7 +799,8 @@ export async function startServer({ host = '127.0.0.1', port = 7330, board = DEF
    if (req.method !== 'GET' && req.method !== 'HEAD') return json(res, 405, { error: 'method not allowed' });
    // `send`: the page shows the composer only where a send can pass (the public name, --send on).
    // `edit`: the editor shows Save only where a save can pass, the same test as the route's.
-    if (path === '/api/config') return json(res, 200, { board: upstream, ...(tester ? { tester: true } : {}), ...(sso ? { sso: true } : {}), send: !tester && Boolean(send) && named, edit: !tester && Boolean(send) && Boolean(projectSave) && named });
+    // `user` and `federation` (FED R6) only when there is one, so the owner's config is unchanged.
+    if (path === '/api/config') return json(res, 200, { board: upstream, ...(tester ? { tester: true } : {}), ...(sso ? { sso: true } : {}), ...(granted ? { user: true } : {}), ...(hub ? { federation: hub } : {}), send: !tester && Boolean(send) && named, edit: !tester && !granted && Boolean(send) && Boolean(projectSave) && named });
    if (path === '/healthz') return json(res, 200, { ok: true, ...(sso ? { sso: sso.health() } : {}) });
    if (path === '/favicon.ico') { res.writeHead(204); return res.end(); }
    const file = files.get(path);
@@ -22,7 +22,7 @@ const SESSION_ABSOLUTE = 8 * 3600 * 1000, SESSION_IDLE = 3600 * 1000;
 const MAX_SESSIONS = 64, MAX_LOGINS = 32;
 const FETCH_TIMEOUT = 10000;
 const RETRY_CAP = 300000;
-const CODES = new Set(['login-record-missing', 'state-mismatch', 'auth-error-response', 'grant-failed', 'id-token-invalid', 'signature-invalid', 'alg-refused', 'issuer-mismatch', 'subject-unknown', 'discovery-failed', 'jwks-failed']);
+const CODES = new Set(['login-record-missing', 'state-mismatch', 'auth-error-response', 'grant-failed', 'id-token-invalid', 'signature-invalid', 'alg-refused', 'issuer-mismatch', 'subject-unknown', 'user-revoked', 'discovery-failed', 'jwks-failed']);

 const sha256 = value => createHash('sha256').update(value).digest('hex');
 const escape = text => String(text).replace(/[&<>"']/g, c => `&#${c.charCodeAt(0)};`);
@@ -123,7 +123,9 @@ async function discover(p, fetchOptions) {
 // `config` is console.sso, checked again here; `secrets` maps provider id to its client secret
 // (readSlot). `fetch` is for tests: a fetch that trusts only the fake OP's certificate.
 // `retryFirst` is for tests too; production waits 5 s, doubling, capped at 5 minutes.
-export async function createSso(config, { secrets, fetch: customFetch = null, log = line => console.log(line), retryFirst = 5000 } = {}) {
+// `users` (FED R6, #1800) is consoleAccess() from access.mjs, or null: a subject that is not the
+// owner's signs in as the access-file user with a live grant, and each request checks it again.
+export async function createSso(config, { secrets, fetch: customFetch = null, log = line => console.log(line), retryFirst = 5000, users = null } = {}) {
  checkConsole({ sso: config });
  oauth ??= await import('oauth4webapi');
  const publicOrigin = config.publicOrigin;
@@ -278,14 +280,18 @@ export async function createSso(config, { secrets, fetch: customFetch = null, lo
    try { header = JSON.parse(Buffer.from(result.id_token.split('.')[0], 'base64url').toString('utf8')); } catch { header = null; }
    if (!header || !entry.config.algs.includes(header.alg)) { refuse('alg-refused', pid); return failed(res, clear); }
    if (claims.iss !== entry.config.issuer) { refuse('issuer-mismatch', pid); return failed(res, clear); }
-    const name = typeof claims.sub === 'string' ? entry.subjects.get(claims.sub) : undefined;
+    let name = typeof claims.sub === 'string' ? entry.subjects.get(claims.sub) : undefined;
+    // FED R6: console.sso subjects and access-file subjects are disjoint (R1), so the owner's
+    // list is asked first and a user is asked only on a miss.
+    const user = name === undefined && typeof claims.sub === 'string' ? users?.find({ provider: pid, sub: claims.sub }) ?? null : null;
+    if (user !== null) name = user;
    if (name === undefined) {
      refuse('subject-unknown', pid, ` iss=${JSON.stringify(String(claims.iss).slice(0, 255))} sub=${JSON.stringify(String(claims.sub).slice(0, 255))}`);
      return failed(res, clear);
    }
    // Step 7: the session, then the return path.
    const id = randomBytes(32).toString('base64url'), now = Date.now();
-    remember(sessions, sha256(id), { provider: pid, iss: claims.iss, sub: claims.sub, name, idToken: result.id_token, created: now, seen: now }, MAX_SESSIONS);
+    remember(sessions, sha256(id), { provider: pid, iss: claims.iss, sub: claims.sub, name, ...(user !== null ? { user } : {}), idToken: result.id_token, created: now, seen: now }, MAX_SESSIONS);
    return redirect(res, returnURL(record.ret), [...clear, `${SESSION_COOKIE}=${id}; ${ATTRS}`]);
  }

@@ -298,6 +304,13 @@ export async function createSso(config, { secrets, fetch: customFetch = null, lo
    if (!s) return null;
    const now = Date.now();
    if (now - s.created >= SESSION_ABSOLUTE || now - s.seen >= SESSION_IDLE) { sessions.delete(key); return null; }
+    // FED R6 (design 3.1 D5): a user's grant is read again on every request, so a user revoked,
+    // removed or expired since sign-in has no session from the next request on.
+    if (s.user !== undefined && !users?.check(s)) {
+      sessions.delete(key);
+      refuse('user-revoked', s.provider, ` user=${JSON.stringify(s.user)}`);
+      return null;
+    }
    if (touch) s.seen = now;
    return s;
  }
@@ -0,0 +1,63 @@
+// FED R6 (#1800): a granted user's bus transport, R3's user-cli.mjs (#414, design 3.6). Kept apart
+// from bus.mjs so the human transport's reviewed bytes stay as row 164 froze them
+// (bus/tests/channel-proof.test.mjs). Same protocol as humanCall: the request on stdin, JSON on
+// stdout, or a bus error code as the last `^[a-z-]{1,64}$` line of stderr.
+import { spawn } from 'node:child_process';
+import { randomBytes } from 'node:crypto';
+import { fileURLToPath } from 'node:url';
+import { readHostState } from '../../cli/src/host.mjs';
+import { BusReadError } from './bus.mjs';
+
+export const USER_CLI = fileURLToPath(new URL('../../bus/src/user-cli.mjs', import.meta.url));
+
+// The Console sets the user nonce itself, so user-cli.mjs doesn't re-exec and the broker sees the
+// Console (`cli.mjs serve`) as its parent (principal.mjs). The human nonce is dropped, so this child
+// can never pass as human-cli, and it only ever runs USER_CLI.
+export function userCall({ socket, business, user, env = process.env, timeoutMs = 30000, maxBytes = 8 * 1024 * 1024 }) {
+  const { MOSAIC_BUS_CLI_NONCE, ...rest } = env;
+  return (verb, args = {}) => new Promise((resolve, reject) => {
+    let child;
+    try {
+      child = spawn(process.execPath, [USER_CLI, socket], { env: { ...rest, MOSAIC_BUS_USER_NONCE: randomBytes(32).toString('hex') }, stdio: ['pipe', 'pipe', 'pipe'] });
+    } catch { return reject(new BusReadError('outcome-unknown', 'the bus transport did not start')); }
+    const out = [], err = [];
+    let size = 0, settled = false;
+    const done = (fn, value) => { if (!settled) { settled = true; clearTimeout(timer); fn(value); } };
+    const timer = setTimeout(() => { child.kill('SIGKILL'); done(reject, new BusReadError('outcome-unknown', 'the bus transport did not finish in time')); }, timeoutMs);
+    child.stdout.on('data', chunk => {
+      size += chunk.length;
+      if (size > maxBytes) { child.kill('SIGKILL'); return done(reject, new BusReadError('response-too-large')); }
+      out.push(chunk);
+    });
+    child.stderr.on('data', chunk => { if (err.length < 64) err.push(chunk); });
+    child.on('error', () => done(reject, new BusReadError('outcome-unknown', 'the bus transport did not start')));
+    child.on('close', status => {
+      if (status === null) return done(reject, new BusReadError('outcome-unknown', 'the bus transport did not finish'));
+      if (status !== 0) {
+        const code = Buffer.concat(err).toString('utf8').trim().split('\n').reverse().find(l => /^[a-z-]{1,64}$/.test(l)) ?? 'invalid-response';
+        return done(reject, new BusReadError(code));
+      }
+      try { done(resolve, JSON.parse(Buffer.concat(out).toString('utf8'))); }
+      catch { done(reject, new BusReadError('invalid-response')); }
+    });
+    child.stdin.on('error', () => {}); // A child that exits early reports through 'close'.
+    child.stdin.end(`${JSON.stringify({ business, user, verb, args })}\n`);
+  });
+}
+
+// The business is the --business flag, or else the live bus host's, read on every call, as busCaller does.
+export function busBusiness({ dataRoot, business = null }) {
+  return () => {
+    if (business) return business;
+    let state;
+    try { state = readHostState(dataRoot); } catch { throw new BusReadError('no-bus-host', 'the bus host state file is unreadable'); }
+    if (!state?.live) throw new BusReadError('no-bus-host', 'no bus host is running and no --business was given');
+    return state.business;
+  };
+}
+
+// One granted user's caller, for that user's session only.
+export function userCaller({ dataRoot, socket, business = null, user, env = process.env, timeoutMs = 30000 }) {
+  const which = busBusiness({ dataRoot, business });
+  return async (verb, args) => userCall({ socket, business: which(), user, env, timeoutMs })(verb, args);
+}
@@ -0,0 +1,384 @@
+// FED R6 (#1800, federation design 3.1 D3-D5, 3.4 and 3.7): a granted user signs in to the
+// Console. Every provider is the fake OP in helpers/fake-oidc.mjs on loopback; no test reaches a
+// real provider, the live Console or a real config, slot or access file. The broker is an
+// in-process Broker with an access function (bus/tests/user-principal.test.mjs), reached through a
+// per-session user transport that binds the user on every call, as user-cli.mjs does. The real
+// user-cli spawn is checked on its own in G8 against a recording socket.
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import { request, createServer as createHttpServer } from 'node:http';
+import { createServer as createNetServer } from 'node:net';
+import { mkdtempSync, readFileSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { Store } from '../../bus/src/store.mjs';
+import { Broker } from '../../bus/src/broker.mjs';
+import { HUMAN_CLI } from '../../cli/src/transport.mjs';
+import { startServer, userRoute } from '../src/serve.mjs';
+import { createSso, SESSION_COOKIE } from '../src/sso.mjs';
+import { consoleAccess } from '../src/access.mjs';
+import { consoleBus, userOptionsFor } from '../src/console-bus.mjs';
+import { BusReadError } from '../src/bus.mjs';
+import { USER_CLI, userCall } from '../src/user-bus.mjs';
+import { close, fixture } from './fixture.mjs';
+import { browser } from './browser.mjs';
+import { fakeOidc } from './helpers/fake-oidc.mjs';
+
+const HOST = 'console.example.test', ORIGIN = `https://${HOST}`;
+const PUBLIC = new URL('../src/public/', import.meta.url);
+const NOTICE = "The business owner sees your thread's agent's decisions, inbox entries, claims, tasks and project files, but not your messages.";
+const OWNER_MARKER = 'owner-plugins-marker-7f3a';
+const FEDERATION = { self: 'hub', peers: [{ id: 'factory', origin: 'https://factory.example.test', label: 'Software factory' }] };
+
+function call(port, { method = 'GET', path = '/', headers = {}, body, host = HOST } = {}) {
+  return new Promise((resolve, reject) => {
+    const length = body === undefined ? {} : { 'content-length': Buffer.byteLength(body) };
+    const req = request({ host: '127.0.0.1', port, method, path, headers: { host, ...length, ...headers } }, res => {
+      let text = '';
+      res.on('data', c => (text += c));
+      res.on('end', () => resolve({ status: res.statusCode, headers: res.headers, body: text && (res.headers['content-type'] ?? '').startsWith('application/json') ? JSON.parse(text) : text }));
+    });
+    req.on('error', reject);
+    req.end(body);
+  });
+}
+const setCookies = r => [r.headers['set-cookie'] ?? []].flat();
+const sessionOf = r => setCookies(r).find(c => c.startsWith(`${SESSION_COOKIE}=`) && !c.includes('Max-Age=0'))?.split(';')[0] ?? null;
+const writeHeaders = cookie => ({ cookie, origin: ORIGIN, 'sec-fetch-site': 'same-origin', 'content-type': 'application/json' });
+const grant = (over = {}) => ({ id: 'g-1', user: 'alice', business: 'demo', projects: ['*'], instances: ['assistant'], level: 'collaborator', ...over });
+const ALICE = { id: 'alice', home: 'local', subjects: [{ provider: 'a', sub: 'alice-sub' }] };
+
+// The fake OP, an in-process broker for business `demo`, createSso with the access hook, and the
+// human listener. The owner's options are counting stubs; each user session's options are
+// consoleBus over that user's transport. `counts` records every owner stub and user transport call.
+async function setup(t, { users = [ALICE], grants = [grant()] } = {}) {
+  const op = await fakeOidc();
+  t.after(() => op.close());
+  const iss = op.issuer('a');
+  const root = mkdtempSync(join(tmpdir(), 'webui-granted-user-'));
+  const store = new Store(root);
+  t.after(() => { store.close(); rmSync(root, { recursive: true, force: true }); });
+  const access = { doc: { accessVersion: 1, revision: 1, users, grants }, fail: false };
+  const load = () => { if (access.fail) throw new Error('access file refused'); return access.doc; };
+  const broker = new Broker({
+    store,
+    businesses: {
+      demo: {
+        id: 'demo', human: 'jason', arbiters: { technical: 'chief', delivery: 'chief' }, vars: {},
+        roles: {
+          chief: { definition: 'chief-of-staff', authority: { withinRole: ['message.send'], crossRole: [] } },
+          assistant: { definition: 'assistant', authority: { withinRole: ['message.send'], crossRole: [] } },
+        },
+        definitions: { 'chief-of-staff': {}, assistant: { messaging: JSON.parse(readFileSync(new URL('../../../roles/assistant.json', import.meta.url), 'utf8')).messaging } },
+      },
+    },
+    access: load,
+  });
+  const human = broker.bindHuman({ business: 'demo', human: 'jason', via: 'cli', outsideAgent: true });
+  const counts = { owner: 0, user: 0 };
+  // As user-cli.mjs: a fresh bind per call, and the broker's refusal code as the transport's.
+  // `userVerbs` and `ownerVerbs` record what each transport carried for a user session.
+  const userVerbs = [], ownerVerbs = [];
+  const userTransport = user => async (verb, args = {}) => {
+    counts.user++; userVerbs.push(verb);
+    try { return broker.request(broker.bindUser({ business: 'demo', user }), { verb, args }); }
+    catch (e) { throw new BusReadError(e.code ?? 'invalid-response'); }
+  };
+  // The owner's transport as cli.mjs passes it (ownerCall). Its answer carries a marker that must
+  // never reach a user's response.
+  const ownerCall = async (verb, args) => { ownerVerbs.push([verb, args]); return { plugins: { channel: ['webui'] }, marker: OWNER_MARKER }; };
+  const opened = [];
+  const userOptions = userOptionsFor({ owner: ownerCall, send: true, transport: user => { opened.push(user); return userTransport(user); } });
+  const lines = [];
+  const log = line => lines.push(line);
+  const config = { publicOrigin: ORIGIN, providers: [{ id: 'a', issuer: iss.issuer, clientId: iss.clientId, clientSecret: { slot: 'a' }, algs: ['RS256'], subjects: [{ sub: 'owner-sub', name: 'jason' }] }] };
+  const sso = await createSso(config, { secrets: new Map([['a', iss.clientSecret]]), fetch: op.fetch, log, users: consoleAccess({ load, business: () => 'demo' }) });
+  t.after(() => sso.close());
+  const stub = name => async () => { counts.owner++; return name === 'send' ? { id: 'msg-0001' } : [{ verb: name }]; };
+  const ownerBus = Object.fromEntries(['inbox', 'tasks', 'agents', 'trail', 'decisions', 'names', 'instances', 'routes', 'thread.claims'].map(v => [v, stub(v)]));
+  const owner = {
+    bus: ownerBus, send: stub('send'), settingsWrite: stub('settings'), projectFiles: stub('files'), projectFile: stub('file'), projectSave: stub('save'),
+    nameWrite: stub('name'), assistantStop: stub('stop'), instancesWrite: stub('instances'), routesWrite: stub('routes'), agentWrite: stub('agent'),
+    processing: { read: stub('processing'), halt: stub('halt'), resume: stub('resume') },
+    reads: Object.fromEntries(['settings', 'business', 'busStatus', 'queue', 'row'].map(v => [v, stub(v)])),
+    chat: Object.fromEntries(['projects', 'threads', 'messages', 'send', 'open', 'createProject', 'createThread'].map(v => [v, stub(v)])),
+  };
+  const web = await startServer({ port: 0, board: 'http://127.0.0.1:9', sso, log, ...owner, userOptions, federation: FEDERATION });
+  t.after(() => close(web));
+  const p1 = broker.request(human, { verb: 'project.create', args: { name: 'shared' } }).id;
+  const p2 = broker.request(human, { verb: 'project.create', args: { name: 'private' } }).id;
+  return { op, iss, broker, human, store, access, counts, opened, lines, port: web.address().port, p1, p2, userTransport, ownerCall, userVerbs, ownerVerbs };
+}
+
+// A whole sign-in with `sub`: start, a code at the OP, the callback.
+async function signIn(env, sub) {
+  const start = await call(env.port, { path: '/auth/login' });
+  assert.equal(start.status, 303);
+  const cookie = setCookies(start)[0].split(';')[0];
+  const location = start.headers.location;
+  const g = env.op.grant(env.iss, location, { sub });
+  const q = new URLSearchParams({ code: g.code, state: new URL(location).searchParams.get('state') });
+  const r = await call(env.port, { path: `/auth/callback?${q}`, headers: { cookie } });
+  return { r, session: sessionOf(r) };
+}
+const events = env => env.store.get('SELECT count(*) n FROM events').n;
+
+test('R6 G1 a granted user signs in, gets the user page and reaches the broker as itself', async t => {
+  const env = await setup(t);
+  env.access.doc.grants = [grant({ projects: [env.p1] })];
+  const { r, session } = await signIn(env, 'alice-sub');
+  assert.equal(r.status, 303, JSON.stringify(r.body));
+  assert.ok(session, 'a session cookie was set');
+  const config = await call(env.port, { path: '/api/config', headers: { cookie: session } });
+  assert.equal(config.status, 200);
+  assert.equal(config.body.user, true);
+  assert.equal(config.body.edit, false);
+  assert.deepEqual(config.body.federation, FEDERATION);
+  const page = await call(env.port, { path: '/', headers: { cookie: session } });
+  assert.equal(page.status, 200);
+  assert.match(page.body, /<script src="\/user\.js" defer><\/script>/);
+  assert.doesNotMatch(page.body, /app\.js|bus\.js|agents\.js|processing\.js|editor\.js/);
+  // Only the granted project shows: the broker answered as alice, not as the owner.
+  const projects = await call(env.port, { path: '/api/chat/projects', headers: { cookie: session } });
+  assert.equal(projects.status, 200, JSON.stringify(projects.body));
+  assert.deepEqual(projects.body.rows.map(p => p.id), [env.p1]);
+  const made = await call(env.port, { method: 'POST', path: '/api/chat/threads', headers: writeHeaders(session), body: JSON.stringify({ project: env.p1, name: 'alice work' }) });
+  assert.equal(made.status, 200, JSON.stringify(made.body));
+  const threads = await call(env.port, { path: '/api/chat/threads', headers: { cookie: session } });
+  assert.deepEqual(threads.body.rows.map(x => x.id), [made.body.id]);
+  assert.equal(env.counts.owner, 0, 'an owner object ran for a user session');
+  assert.ok(env.opened.length > 0 && env.opened.every(u => u === 'alice'));
+  assert.ok(env.lines.some(l => / chat action=createThread user="alice" id=/.test(l)));
+  // The owner signs in as before and gets the owner page and config.
+  const ownerSession = (await signIn(env, 'owner-sub')).session;
+  const ownerConfig = await call(env.port, { path: '/api/config', headers: { cookie: ownerSession } });
+  assert.equal(Object.hasOwn(ownerConfig.body, 'user'), false);
+  assert.deepEqual(ownerConfig.body.federation, FEDERATION);
+  assert.match((await call(env.port, { path: '/', headers: { cookie: ownerSession } })).body, /<script src="\/app\.js" defer><\/script>/);
+});
+
+test('R6 G2 a subject with no live grant in this business is refused subject-unknown', async t => {
+  const past = new Date(Date.now() - 60000).toISOString();
+  for (const [why, users, grants, sub] of [
+    ['a listed user with no grant', [ALICE], [], 'alice-sub'],
+    ['a grant in another business', [ALICE], [grant({ business: 'other' })], 'alice-sub'],
+    ['an expired grant', [ALICE], [grant({ expires: past })], 'alice-sub'],
+    ["another user's grant", [ALICE, { id: 'bob', home: 'local', subjects: [{ provider: 'a', sub: 'bob-sub' }] }], [grant({ user: 'bob' })], 'alice-sub'],
+    ['a sub in no file', [ALICE], [grant()], 'stranger-sub'],
+  ]) {
+    await t.test(why, async t => {
+      const env = await setup(t, { users, grants });
+      const { r, session } = await signIn(env, sub);
+      assert.equal(r.status, 403, why);
+      assert.equal(session, null, `${why}: a session cookie was set`);
+      assert.match(env.lines.at(-1), / sso refused code=subject-unknown provider=a /);
+      assert.deepEqual(env.opened, []);
+      assert.equal(env.counts.user + env.counts.owner, 0);
+    });
+  }
+  await t.test('a file the loader refuses', async t => {
+    const env = await setup(t);
+    env.access.fail = true;
+    const { r, session } = await signIn(env, 'alice-sub');
+    assert.equal(r.status, 403);
+    assert.equal(session, null);
+  });
+});
+
+test('R6 G3 a revoke counts on the next request: 401 and the session is gone', async t => {
+  for (const [why, revoke] of [
+    ['grant removed', env => { env.access.doc.grants = []; }],
+    ['subject removed', env => { env.access.doc.users = [{ ...ALICE, subjects: [] }]; }],
+    ['grant expired', env => { env.access.doc.grants = [grant({ expires: new Date(Date.now() - 1000).toISOString() })]; }],
+    ['file now refused', env => { env.access.fail = true; }],
+  ]) {
+    await t.test(why, async t => {
+      const env = await setup(t);
+      const { session } = await signIn(env, 'alice-sub');
+      assert.equal((await call(env.port, { path: '/api/chat/projects', headers: { cookie: session } })).status, 200);
+      revoke(env);
+      const before = env.counts.user;
+      const r = await call(env.port, { path: '/api/chat/projects', headers: { cookie: session } });
+      assert.equal(r.status, 401, `${why}: ${JSON.stringify(r.body)}`);
+      assert.equal(r.body.error, 'sign-in required');
+      assert.match(env.lines.at(-1), / sso refused code=user-revoked provider=a user="alice"$/);
+      assert.equal(env.counts.user, before, 'the transport ran after the revoke');
+      // Restoring the grant does not bring the session back: it was deleted.
+      env.access.fail = false; env.access.doc.users = [ALICE]; env.access.doc.grants = [grant()];
+      assert.equal((await call(env.port, { path: '/api/chat/projects', headers: { cookie: session } })).status, 401);
+      const page = await call(env.port, { path: '/', headers: { cookie: session } });
+      assert.equal(page.status, 303);
+      assert.match(page.headers.location, /^\/auth\/login\?return=/);
+    });
+  }
+});
+
+// Every owner route a user session might try; none is a chat route.
+const OWNER_ROUTES = [
+  ['GET', '/api/bus/inbox'], ['GET', '/api/bus/tasks'], ['GET', '/api/bus/names'], ['GET', '/api/bus/thread.claims'],
+  ['POST', '/api/bus/message', { to: 'coder', body: 'hi' }],
+  ['GET', '/api/settings'], ['POST', '/api/settings', { revision: 'x' }],
+  ['POST', '/api/name', { role: 'assistant', name: 'x' }], ['POST', '/api/assistant/stop', {}],
+  ['POST', '/api/instances', { instance: 'x' }], ['POST', '/api/routes', { routes: [] }],
+  ['POST', '/api/agent/launch', { instance: 'x' }], ['GET', '/api/agent/request?id=x'],
+  ['GET', '/api/processing'], ['POST', '/api/processing/halt', {}],
+  ['GET', '/api/project-files?project=p'], ['GET', '/api/project-file?project=p&path=a'], ['POST', '/api/project-file', { project: 'p' }],
+  ['GET', '/api/board'], ['GET', '/api/conversations'], ['POST', '/api/seen', {}], ['POST', '/api/reply', {}],
+  ['GET', '/api/queue'], ['GET', '/api/queue/1'], ['GET', '/api/business'], ['GET', '/api/bus-status'], ['GET', '/api/task-fields'],
+  ['GET', '/app.js'], ['GET', '/bus.js'], ['GET', '/agents.js'], ['GET', '/editor.js'], ['GET', '/shared/app.css'], ['GET', '/index.html'],
+];
+
+test('R6 G4 every owner route answers 403 owner-only before any bus call', async t => {
+  const env = await setup(t);
+  const { session } = await signIn(env, 'alice-sub');
+  const before = events(env);
+  for (const [method, path, value] of OWNER_ROUTES) {
+    const r = await call(env.port, { method, path, headers: value === undefined ? { cookie: session } : writeHeaders(session), body: value === undefined ? undefined : JSON.stringify(value) });
+    assert.equal(r.status, 403, `${method} ${path}: ${r.status} ${JSON.stringify(r.body)}`);
+    assert.equal(r.body.error, 'owner-only', `${method} ${path}`);
+    assert.equal(userRoute(new URL(path, 'http://x').pathname, method), false, `${method} ${path}`);
+  }
+  assert.deepEqual(env.counts, { owner: 0, user: 0 });
+  assert.deepEqual(env.opened, [], 'a user transport was built for an owner route');
+  assert.equal(events(env), before, 'something was written');
+});
+
+test('R6 G5 the bus refuses every owner verb over the user transport on its own', async t => {
+  const env = await setup(t);
+  const o = consoleBus(env.userTransport('alice'), { send: true, owner: env.ownerCall });
+  const before = events(env);
+  for (const [why, run] of [
+    ['inbox', () => o.bus.inbox()], ['tasks', () => o.bus.tasks()], ['agents', () => o.bus.agents()], ['trail', () => o.bus.trail()],
+    ['decisions', () => o.bus.decisions()], ['instances', () => o.bus.instances()], ['routes', () => o.bus.routes()], ['thread.claims', () => o.bus['thread.claims']()],
+    ['message.send', () => o.send({ to: 'chief', body: 'as the owner' })], ['limits.set', () => o.settingsWrite({ revision: 'x' })],
+    ['project.files', () => o.projectFiles({ project: env.p1 })], ['project.file', () => o.projectFile({ project: env.p1, path: 'a' })],
+    ['project.file.save', () => o.projectSave({ project: env.p1 })], ['name.set', () => o.nameWrite({ role: 'assistant', name: 'x' })],
+    ['assistant.stop', () => o.assistantStop({})], ['instances.set', () => o.instancesWrite({})], ['routes.set', () => o.routesWrite({})],
+    ['instance.launch', () => o.agentWrite('instance.launch', {})], ['processing.status', () => o.processing.read()],
+    ['processing.halt', () => o.processing.halt({})], ['library.status', () => o.libraryStatus({})],
+    ['project.create', () => o.chat.createProject({ name: 'mine' })],
+  ]) await assert.rejects(Promise.resolve().then(run), e => e.code === 'access-refused', why);
+  assert.equal(events(env), before, 'a refused verb wrote');
+});
+
+// sage-3153 (C6): in a user's chat the owner transport carries `plugins` with {} and nothing else,
+// every chat verb goes over the user transport, and the owner's answer never reaches the user.
+test('R6 G9 a user chat sends only the plugins read over the owner transport', async t => {
+  const env = await setup(t);
+  const { session } = await signIn(env, 'alice-sub');
+  const bodies = [];
+  const go = async (method, path, value) => {
+    const r = await call(env.port, { method, path, headers: value === undefined ? { cookie: session } : writeHeaders(session), body: value === undefined ? undefined : JSON.stringify(value) });
+    assert.equal(r.status, 200, `${method} ${path}: ${JSON.stringify(r.body)}`);
+    bodies.push(JSON.stringify(r.body));
+    return r.body;
+  };
+  await go('GET', '/api/chat/projects');
+  const thread = (await go('POST', '/api/chat/threads', { project: env.p1, name: 'alice work' })).id;
+  await go('GET', `/api/chat/threads?project=${env.p1}`);
+  await go('POST', `/api/chat/threads/${thread}/open`, {});
+  await go('POST', `/api/chat/threads/${thread}/messages`, { body: 'hello' });
+  await go('GET', `/api/chat/threads/${thread}/messages`);
+  assert.ok(env.ownerVerbs.length > 0, 'the chat never read plugins');
+  // Exactly the verb `plugins` and exactly {}: no value from the session or a request reaches it.
+  for (const entry of env.ownerVerbs) assert.deepEqual(entry, ['plugins', {}]);
+  const sent = JSON.stringify(env.ownerVerbs);
+  for (const value of ['alice', 'alice-sub', 'alice work', 'hello', env.p1, thread]) assert.equal(sent.includes(value), false, `${value} reached the owner transport`);
+  for (const verb of ['project.list', 'thread.create', 'thread.list', 'thread.open', 'thread.send', 'thread.messages']) assert.ok(env.userVerbs.includes(verb), `${verb} did not go over the user transport`);
+  assert.equal(env.userVerbs.includes('plugins'), false);
+  for (const body of bodies) assert.doesNotMatch(body, new RegExp(OWNER_MARKER));
+  assert.equal(env.counts.owner, 0);
+});
+
+test('R6 G6 the user page holds the notice word for word', async t => {
+  const html = readFileSync(new URL('user.html', PUBLIC), 'utf8');
+  const notice = /<p id="user-notice"[^>]*>([^<]*)<\/p>/.exec(html);
+  assert.ok(notice, 'no #user-notice paragraph');
+  assert.equal(notice[1], NOTICE);
+  const env = await setup(t);
+  const { session } = await signIn(env, 'alice-sub');
+  assert.ok((await call(env.port, { path: '/', headers: { cookie: session } })).body.includes(NOTICE));
+});
+
+// The user page outside a session: a small static server over the public files, /api/config stubbed.
+async function userPage(t, config) {
+  const types = { html: 'text/html', js: 'text/javascript', css: 'text/css', svg: 'image/svg+xml' };
+  const server = createHttpServer((req, res) => {
+    const path = new URL(req.url, 'http://x').pathname;
+    if (path === '/api/config') { res.writeHead(200, { 'content-type': 'application/json' }); return res.end(JSON.stringify(config)); }
+    if (path.startsWith('/api/chat/')) { res.writeHead(200, { 'content-type': 'application/json' }); return res.end(JSON.stringify({ rows: [], at: new Date().toISOString() })); }
+    const name = path === '/' ? 'user.html' : path.slice(1);
+    if (!/^[a-z.]+$/.test(name)) { res.writeHead(404); return res.end(); }
+    try { const body = readFileSync(new URL(name, PUBLIC)); res.writeHead(200, { 'content-type': types[name.split('.').pop()] ?? 'text/plain' }); res.end(body); }
+    catch { res.writeHead(404); res.end(); }
+  });
+  await new Promise(r => server.listen(0, '127.0.0.1', r));
+  t.after(() => close(server));
+  return server.address().port;
+}
+
+test('R6 G7 the hub label and plain peer links render from config on both pages', async t => {
+  const links = 'JSON.stringify({label:document.querySelector("#hub-label")?.textContent,hidden:document.querySelector("#federation").hidden,peers:[...document.querySelectorAll("#federation a")].map(a=>[a.getAttribute("href"),a.textContent,a.attributes.length])})';
+  const expected = { label: 'This Console: hub', hidden: false, peers: [['https://factory.example.test', 'Software factory', 2]] };
+  const wait = (b, expression) => b.evaluate(`(async()=>{for(let i=0;i<100;i++){if(${expression})return;await new Promise(r=>setTimeout(r,30));}throw new Error(${JSON.stringify(expression)});})()`);
+  const b = await browser(); t.after(() => b.close());
+  // The owner page, over the real server.
+  const f = await fixture(); t.after(() => f.close());
+  const owner = await startServer({ port: 0, board: f.boardURL, federation: FEDERATION }); t.after(() => close(owner));
+  await b.navigate(`http://127.0.0.1:${owner.address().port}/`);
+  await wait(b, '!document.querySelector("#federation").hidden');
+  assert.deepEqual(JSON.parse(await b.evaluate(links)), expected);
+  // The user page, with a hostile label kept as text.
+  const hostile = { self: 'hub', peers: [...FEDERATION.peers, { id: 'x', origin: 'https://x.example.test', label: '<img src=x onerror="window.injected=1">' }, { id: 'y', origin: 'javascript:alert(1)', label: 'bad' }] };
+  await b.navigate(`http://127.0.0.1:${await userPage(t, { user: true, send: true, federation: hostile })}/`);
+  await wait(b, '!document.querySelector("#federation").hidden');
+  const user = JSON.parse(await b.evaluate(links));
+  assert.equal(user.label, 'This Console: hub');
+  assert.deepEqual(user.peers, [...expected.peers, ['https://x.example.test', '<img src=x onerror="window.injected=1">', 2]]);
+  assert.equal(await b.evaluate('window.injected'), undefined);
+  assert.equal(await b.evaluate('document.querySelector("#user-notice").textContent'), NOTICE);
+  // No federation in config: nothing is shown.
+  await b.navigate(`http://127.0.0.1:${await userPage(t, { user: true, send: true })}/`);
+  await wait(b, 'document.querySelector(".chat-area")');
+  assert.equal(await b.evaluate('document.querySelector("#federation").hidden'), true);
+});
+
+test('R6 G8 userCall spawns user-cli directly with the user nonce, no human nonce, and the user request', async t => {
+  const dir = mkdtempSync(join(tmpdir(), 'webui-user-call-'));
+  t.after(() => rmSync(dir, { recursive: true, force: true }));
+  const socket = join(dir, 'bus.sock');
+  const seen = [];
+  const server = createNetServer(conn => {
+    let input = '';
+    conn.on('data', chunk => {
+      input += chunk;
+      if (!input.includes('\n')) return;
+      const message = JSON.parse(input);
+      const pid = message.user?.pid;
+      // Read the child while it waits on this answer.
+      const proc = name => readFileSync(`/proc/${pid}/${name}`, 'utf8');
+      seen.push({ message, argv: proc('cmdline').split('\0'), env: proc('environ').split('\0').map(e => e.split('=')[0]), ppid: Number(proc('stat').replace(/^.*\) /s, '').split(' ')[1]) });
+      conn.end(JSON.stringify({ ok: true, result: { answered: true } }) + '\n');
+    });
+  });
+  await new Promise(r => server.listen(socket, r));
+  t.after(() => server.close());
+  const result = await userCall({ socket, business: 'demo', user: 'alice', env: { ...process.env, MOSAIC_BUS_CLI_NONCE: 'f'.repeat(64) } })('thread.list', { project: 'p' });
+  assert.deepEqual(result, { answered: true });
+  assert.equal(seen.length, 1);
+  const [{ message, argv, env, ppid }] = seen;
+  assert.equal(argv[1], USER_CLI);
+  assert.notEqual(argv[1], HUMAN_CLI);
+  assert.equal(argv[2], socket);
+  assert.equal(ppid, process.pid, 'user-cli re-executed: the Console is not its parent');
+  assert.ok(env.includes('MOSAIC_BUS_USER_NONCE'));
+  assert.equal(env.includes('MOSAIC_BUS_CLI_NONCE'), false);
+  assert.deepEqual(Object.keys(message).sort(), ['args', 'user', 'verb']);
+  assert.equal(message.verb, 'thread.list');
+  assert.deepEqual(message.args, { project: 'p' });
+  assert.equal(message.user.business, 'demo');
+  assert.equal(message.user.user, 'alice');
+  assert.match(message.user.nonce, /^[0-9a-f]{64}$/);
+  assert.equal(USER_CLI, fileURLToPath(new URL('../../bus/src/user-cli.mjs', import.meta.url)));
+});
@@ -1073,37 +1073,27 @@ slot_problem() {
    [ "$size" != 0 ] || echo "is empty"
 }

-# Row 200 item 3 and #1797: every existing parseable config must be one the
-# target loader reads. Older copies without a loader accept only the four keys
-# in c3d29e796's first loader. A console or federation key (row 203) keeps its own refusal text.
-# Resolved config stdout is never kept.
+# Row 200 item 3 and the design's phase 2 rollback order: a config.json with a `console` key must be
+# one the target's loader reads, or its bus, Console and seats fail on their next read. Runs the
+# target's own scripts/mosaic-config.mjs validate; its output, the resolved config, is not kept.
 config_checks() {
-    local cfg="${MOSAIC_CONFIG:-$HOME/.config/mosaic-dev/config.json}" out loader="$COPIES/$TO/scripts/mosaic-config.mjs" first extra
-    # 1: missing file; 2: unreadable JSON. This also fences a change after load_config.
-    # extra: "console" or "federation" first (row 203: a pre-203 loader refuses federation too),
-    # then the first key outside the oldest set.
+    local cfg="${MOSAIC_CONFIG:-$HOME/.config/mosaic-dev/config.json}" out loader="$COPIES/$TO/scripts/mosaic-config.mjs" first
+    # 0: a console or federation key (row 203: a pre-203 loader refuses federation too); 1: neither, or no file; 2: the file doesn't parse, so whether it holds the key
+    # is unknown, and the run refuses rather than pass it (webby-0028 N2). load_config already exits on
+    # such a file before anything is read or stopped, so this is reached only if the file changes after it.
    local key=0
-    extra="$(node -e 'const fs=require("fs"),f=process.argv[1];if(!fs.existsSync(f))process.exit(1);let d;try{d=JSON.parse(fs.readFileSync(f,"utf8"))}catch{process.exit(2)}
-const oldest=["configVersion","environment","dataRoot","execution"];
-if(d===null||typeof d!=="object"||Array.isArray(d)){process.stdout.write(JSON.stringify("[configuration shape]"));process.exit(0)}
-const k=Object.hasOwn(d,"console")?"console":Object.hasOwn(d,"federation")?"federation":Object.keys(d).find(k=>!oldest.includes(k));if(k!==undefined)process.stdout.write(JSON.stringify(k))' -- "$cfg" 2>/dev/null)" || key=$?
+    node -e 'const fs=require("fs"),f=process.argv[1];if(!fs.existsSync(f))process.exit(1);let d;try{d=JSON.parse(fs.readFileSync(f,"utf8"))}catch{process.exit(2)}
+process.exit(d!==null&&typeof d==="object"&&(Object.hasOwn(d,"console")||Object.hasOwn(d,"federation"))?0:1)' -- "$cfg" 2>/dev/null || key=$?
    [ "$key" != 1 ] || return 0
    if [ "$key" != 0 ]; then
        check_refuse config-console-key "$cfg cannot be read as JSON, so whether $TO's loader reads it is unknown; fix the config first, then run the $OP again"
        return 0
    fi
-    if [ ! -f "$loader" ]; then
-        [ -n "$extra" ] || return 0
-        if [ "$extra" = '"console"' ] || [ "$extra" = '"federation"' ]; then out="it has no scripts/mosaic-config.mjs"
-        else out="it has no scripts/mosaic-config.mjs to validate configuration key: $extra"; fi
+    if [ ! -f "$loader" ]; then out="it has no scripts/mosaic-config.mjs"
    elif out="$(MOSAIC_CONFIG="$cfg" node "$loader" validate 2>&1 >/dev/null)"; then return 0
    fi
    first="${out%%$'\n'*}"
-    if [ "$extra" = '"console"' ] || [ "$extra" = '"federation"' ]; then
-        check_refuse config-console-key "$cfg holds a console or federation key, and $TO's loader refuses it ($first); remove the key first (restore the config.json backup from the window's step 1), then run the $OP again"
-    else
-        check_refuse config-console-key "$cfg is refused by $TO's loader ($first); remove the refused key first (restore the config.json backup from the window's step 1), then run the $OP again"
-    fi
+    check_refuse config-console-key "$cfg holds a console or federation key, and $TO's loader refuses it ($first); remove the key first (restore the config.json backup from the window's step 1), then run the $OP again"
 }

 # Row 189 (mos-0972): --no-send drops --send from RUN_CONSOLE, so the unit and the pointer both lose
Author	SHA1	Message	Date
jason.woltje	ee77b36359	launchpad: row 294 BUILD.md M1 expectation corrected (Duckworth C1), review recorded with N1-N4 dispositions	2026-10-22 22:34:33 -05:00
jason.woltje	ca710eabdb	launchpad: row 294 round 1 manifest (17 paths from `9450774cb`) and notes with the owner-transport exception	2026-10-22 22:17:05 -05:00
jason.woltje	9450774cbe	launchpad: row 294 sage-3157, owner-transport exception written out, userOptionsFor, G9 pins no user value, M10/M11 (unrun, #1800 )	2026-10-22 21:57:39 -05:00
jason.woltje	77514b8b9a	launchpad: row 294 BUILD.md M4 kill names the moved test	2026-10-22 21:52:29 -05:00
jason.woltje	338e93185c	launchpad: row 294 rulings sage-3153 (boot refusal line, owner transport seam G9, C7 follow-up, access.test.mjs unchanged; unrun, #1800 )	2026-10-22 21:52:26 -05:00
jason.woltje	c866a8a695	launchpad: row 294 FED R6 build and plan, granted-user sign-in (unrun, #1800 ) Console granted-user sign-in, a user-cli transport per session, the per-request grant re-read, the owner-only gate and user page, the notice, the hub label and peer links, accessContextFor peers, and the bus boot access wiring (sage-3142). Tests G1-G8 and B1-B3 are written and not yet run; runs wait for Sage's CLEAR. Choices C1-C9 in agents/launchpad/work/queue-294/BUILD.md.	2026-10-22 21:48:48 -05:00