docs(gyro): record supplemental notice collection recheck

docs(gyro): record 223 release measurement and supplemental notices
docs(gyro): measure row 310 223-package source and pruned lock
2026-10-24 01:45:35 -05:00 · 2026-10-24 01:41:42 -05:00 · 2026-10-24 01:29:58 -05:00 · 2026-10-24 00:26:11 -05:00 · 2026-10-24 00:19:05 -05:00 · 2026-10-24 00:16:26 -05:00
203 changed files with 125306 additions and 101 deletions
@@ -5429,3 +5429,69 @@ Row 299 (573, #1806, Gander, Filbert): before, the P10 band test timed a fault r
 2026-10-23 | Boyd | Row 298 (#1804, Q228), targeted verification | On sage-3642 T1 lane B, five whole files serial: business scope 7/0, bus scope 14/0, scope runtime 1/0, CLI scope 4/0, project runtime 3/0 (29/0, no skips). Initial bus fixture typo recorded and corrected. M1-M10 killed by named assertions, source restored and final files green. Dewey dewey-0933 positive control and notes addressed; manifest and evidence in agents/boyd/work/queue-298/BUILD.md. Full package/script gate remains Sage's. No live scope set.

 2026-10-23T22:41:07Z | Boyd | Row 298 (#1804), rebase after row 239 | Rebased onto 833ec1cc8d7c11842efb82e57c1a0b256c8d22d7 on boyd/row298-r2 without altering published boyd/row298. Only append-log conflicts; upstream bytes preserved and Boyd suffixes appended. Product merges automatic; row 239 writer-lock revoke and post-revoke error handling preserved, organization.mjs unchanged from new base. Static checks only; UNTESTED on new base pending Sage CLEAR. Details in Boyd BUILD.md.
+
+2026-10-23 | Goldie | Row 322 / #1818 F8/F9 before | The library installer runs the clone importer, whose yaml dependency is absent on fresh clones, and tail -n 1 hides uncaught errors behind Node's version banner. Plan: run the same-commit copy importer, include it in COPY_PATHS, keep the first error line with last-line fallback, append isolated regression coverage. Mos-1550 approves setup-only world(t) additions and the one-path copy-file pin addition. No tests run yet; Sage slot required.
+
+2026-10-23 | Goldie | Row 322 / #1818 F8/F9 after | Importer now runs from the same-commit dependency-equipped copy; COPY_PATHS includes it. One-line refusal selects an actual Error/ERR_ line, avoiding Node's source excerpt/banner, with last-line fallback. Mos-1550-approved fixture setup and one-file pin changes; two append-only regression tests. Under sage-3808 CLEAR, serialized timeout -k 10 runs in /mnt/storage/scratch/tmp/goldieuQ2664: install26/26, copy18/18, pinned-copy10/10; new tests2/2 first run and restored; N installer expected-red2/2, F8 and F9 mutants killed, installer SHA256 restored each time. No unexpected red. Evidence and exact old-test changes in agents/goldie/work/queue-322/BUILD.md; full gate and Morgana review belong to Sage.
+
+2026-10-23 | Goldie | Row 324 / #1820 before (Q247, mos-1555) | New branch goldie/row324 at row298 approved860afc2b6. Design/readers audit in agents/goldie/work/queue-324/BUILD.md: normalize omitted tracker to null, preserve present validation, guard sync readers/adapter config; runtime/instance-settings/broker checks already optional. Existing business.test.mjs98 explicitly requires tracker, so implementation held for Mos approval of removing that one list entry; no old test or product edit, no tests run.
+
+2026-10-23 | Goldie | Row 324 / #1820 draft built (sage-3836, mos-1556) | Claim rev3759. Omitted tracker normalizes null; present including null/malformed stays validated. Loader, business validate, bootConfig trackerFor and Console sync reader handle absence. Row298's guarded runtime/instance-settings/broker paths preserved. Two new test files (9 planned tests); sole old-test edit drops tracker from required-key list under mos-1556. node --check6/6 and diff check pass. No tests run: untested branch push expressly ordered before CLEAR; Duckworth review and Sage gate pending.
+
+2026-10-23 | Goldie | Row 324 / #1820 rebased verification (sage-3850) | Rebased onto3569bf54f as7e59ba8b3; only append-log conflicts, eight manifest files byte-equal. Serialized timeout-k10 scratch TMPDIR goldieOdgIjr: new business5/5, new CLI4/4 (includes Console absent read), existing business21/21; presence mutant killed, bytes restored, new files rerun5/5 and4/4. No unexpected red. Published rebased branch goldie/row324-r2 preserves original remote draft without force-push. Evidence/mutant diff/reader list in BUILD.md; review/full gate pending.
+
+2026-10-23 | Goldie | Row 323 / #1819 before | Case 1 lacks a committed business file. Brief requires actual .53 values and refuses guessing. New branch goldie/row323 from local refactor da537e7d1; source review shows project root, literal human id, tracker sync identity/reference metadata and launch model values absent from DESIGN, plus nonempty launch.instances requires another role. Asked Sage (goldie-0008); no config or test written, no test run. Details agents/goldie/work/queue-323/BUILD.md.
+
+2026-10-23 | Goldie | Row 323 / #1819 static blocker (sage-3823) | Mos-1554 requires no bot and an absent, never-created tracker token path. Static tracing confirms this refuses install validation (business cli84-97, credentials78-83) and bus boot (runtime131/157, bus credentials225-228), even without tracker.baseUrl; unset env also refuses at bus credentials278. Reported Sage goldie-0009; no JSON/test/credential written, no tests. Accepted source values/role and refusal-test rulings are recorded in BUILD.md; waiting for product-boundary resolution.
+
+2026-10-24 | Goldie | Row 323 / #1819 resumed draft (sage-3859) | Rebasing prior notes onto Q247 landing dd6cb5872 resolved only append logs. Added trackerless .53 factory JSON: jason, approved project root, chief+assistant for required nonempty launch.instances, claude-code/Opus5.5/high, tester on. No credentials or token placeholder. Seven new tests prepare exact-doc loading plus scratch real validate/install/boot and three refusal paths; one restoring tester-switch mutant prepared. No old test edits; no tests before Sage CLEAR. Source choices/rulings in BUILD.md.
+
+2026-10-24 | Goldie | Row 323 / #1819 pre-test commit (sage-3861 CLEAR) | Sage explicitly requests commit before runs; JSON/new7-case test/restoring mutant and field provenance committed untested before slot work. Exact sources distinguish mos-1554 human/no-bot intent, sage-3820 roles, sage-3822 project/model, and Q247 tracker omission. No old test edits. Next runs: new file, business whole, CLI whole, mutant/restored file, serialized scratch TMPDIR timeout-k10.
+
+2026-10-24 | Goldie | Row 323 / #1819 first slot STOP (sage-3861) | On committed571376c30: new file7/7 and business261/261 green; whole CLI hit unchanged revoke-window.test.mjs170 (test579, row306 R4), no RESULT after20.1s at ask167/Promise.all194. Stopped suite on observing red, cleaned only positively identified own scratch fixture. Partial631 pass/1 fail before termination, not full-suite green. No mutant/restored run, no old-test edit/rerun. Manifest unchanged; Sage notified goldie-0016 and slot returned. Evidence local under queue-323, awaits ruling.
+
+2026-10-24 | Goldie | Row 323 / #1819 second red STOP (mos-1560, sage-3864) | Isolated revoke-window whole-file run1 on unchanged571376c30 failed0/1 after20.126s, same no RESULT at ask167/test194. Start00:24:22Z, load1.46/1.68/2.70, busyhelperCLEAR, fresh scratch goldieBObDQ9. No run2/3/CLI retry/mutant/restored run; no source/old-test edit. Sage goldie-0018 has log/load/error; slot returned, awaits base-dd6cb5872 root cause. Remote remains unverified571.
+
+2026-10-24 | Goldie | Row 323 / #1819 accepted evidence (mos-1561, sage-3869) | Sage traced revoke-window reds to37-byte TMPDIR making109-byte tools.sock >107 limit (session.mjs278), not Codex. Fresh31-byte /scratch/tmp/XXXXXX confirmation passes1/1 in0.84s. On unchanged571376c30 serialized timeout-k10: business261/261, new7/7, tester-switch mutant killed/restored SHA85e6b9ac, restored new7/7. Every log starts UTC/load/helperCLEAR; all positive runs0 fail/skip/cancel. CLI whole acceptance comes from Sage gate under mos-1561; no local CLI rerun. Evidence-only notes/log commit follows, no old test/source changes.
+
+2026-10-24 | Goldie | Row325 / #1821 before (mos-1563/1564) | Real .mosaic/project.json idstack disagrees with Case1 project's mosaic-stack key; row323 scratch fixture omitted project file and only warned. New goldie/row325 at99930362e changes only that JSON key and expressly authorized old assertion key; new real-byte project-copy validation tests require valid and reject old key. Mutant prepared; no tests before Sage CLEAR, no queue writes/host actions.
+
+2026-10-24 | Goldie | Row325 / #1821 after (sage-3882 CLEAR) | Only Case1 projects key becomesstack; only old test70 expected key updated under mos-1564. New3-case test copies real .mosaic/project.json bytes, requires CLI project valid, rejects old key. Serialized shortTMP timeout-k10: new3/3, business264/264, old-key mutant killed/restored SHA9e43bfef, restored new3/3; all positive0 fail/skip/cancel. Manifest4/4 verifies including unchanged project document. Logs/load lines and mutant diff in BUILD.md; no queue writes/host action, Gladstone review/Sage gate pending.
+
+2026-10-24 — Poe, row 208 / 193d (#1706), before: building Console shared list,
+share controls and per-grant viewer read-only against approved design e2d161e2e.
+Base ec86f2c84. Isolated tests and UI-guard mutants pending Sage CLEAR; no live action.
+
+2026-10-24 — Poe, row 208 / 193d (#1706), after: Console shared list, share/unshare
+controls and live per-grant viewer UI implemented. Webui 418/418 and plugins
+119/119 green under sage-3925 CLEAR; four UI guard mutants killed with viewer
+bus bypass refusals. Prior old-test draft regression fixed under sage-3918;
+missing root oauth4webapi corrected by pinned npm ci under sage-3924. Evidence:
+agents/poe/work/queue-208/BUILD.md. Independent reviews and Sage's global gate
+remain; no live state, schema or bus policy change.
+
+2026-10-24 | Goldie | Row265 / #1770 before, recorded during authorized verification | C2-09b has no project room verbs. On goldie/row265 at ec86f2c84, add only room.open/send/read, pure exported leading-tag parser, README verb rows and new bus tests. Sage-3921 fixes EOF-tag and message-only timestamp readings; tester list/helpers/schema stay unchanged. Claim rev3814; Sage-3932 CLEAR for serialized new files, whole bus and twelve refusal mutants. No old-test edits authorized; stop rules apply.
+
+2026-10-24 | Goldie | Row265 / #1770 first slot STOP (sage-3932) | New parser14/14, rooms18/18 green; serialized bus stops at old project-runtime.test.mjs:14 import-closure pin, partial619 ok/1 not ok. New pure address.mjs import is absent from expected imports. Static trace also needs address.mjs in seat RUNNER_FILES. No old-test/product correction, no mutant/restored run, no green commit/push; old-pin and out-of-owned-files mount change sent to Sage for ruling. Audit prose missed the direct source pin despite raw grep hit; correction recorded in BUILD.md.
+
+2026-10-24 | Goldie | Row265 / #1770 verified (mos-1567, sage-3942) | Approved correction adds solely address import pin + Row265 comment to project-runtime.test and one pure-source RUNNER_FILES mount; new block checks parser has no imports. Serialized fresh-short-TMP timeout-k10: unchanged sandbox10/10, parser15/15, rooms18/18, full bus957/957, twelve named refusal mutants killed (each Node1, driver0), restored parser15/15 + rooms18/18. All positives zero fail/skip/cancel; every mutation restored full broker SHA71b32ee4. Old first-red evidence retained, no other old-test change. Slot returned goldie-0034; Boyd packet explicitly includes mount-list review, candidate push next.
+
+## 2026-10-24 — W2 row 310 / #1824 started (Gyro)
+
+Before: only Louie's evaluation artifact and S0 conditional baseline review exist. Sage assigned the owned source import, offline pinned restricted web build and root-independent output/CSP evidence under Q246/mos-1571. Implementation plan and subsequent measurements live in agents/gyro/work/queue-310/BUILD.md. No build/test, serving route or live change at start.
+
+## 2026-10-24 — W2 row 310 / #1824 bounded scratch measurement (Gyro)
+
+After sage-3992: 534 existing cached registry archives extract to 24,844 files / 611,577,974 bytes, or 614,049,226 bytes with generated checksums. A full 538-package lock vendor set adds 329 identities beyond S0's 209. In isolated scratch, with the three already-reviewed git inputs and approved local workspace reduction, exact S0 199/209 package closures matched; baseline release measurement succeeded offline with networking disabled. Valid absolute-nice19/four-job environment retry: 397.864805 s; four runtime files total 44,142,800 bytes, scratch Git blob pack 16,720,159 bytes. Initial 388.757578 s attempt had an inherited-priority defect and is retained as limited evidence. Receipt and caveats: agents/gyro/work/queue-310/BUILD.md, “Full-lock measurement results (sage-3992)”. No full-lock repository import, runtime output commit/push, serving or live change. W2 remains incomplete at the packaging boundary; no M1–M14/CSP/reproducibility acceptance claimed.
+
+## 2026-10-24 — W2 row 310 / #1824 223-source packaging evidence (Gyro)
+
+Under sage-4008/4010, exactly209+14 source packages measured in scratch: total11,201 files /145,260,334 bytes and26,538,894-byte independent blob pack; extra14 total702 files /14,523,104 bytes and1,720,566-byte blob pack. Original pinned lock refused with --locked after existing cfg-filter script; one authorized automatic offline lock regeneration produced a strict subset (558→226 entries,332 removed,0 added,0 changed). Original lock untouched. Per-package source/archive/license/notice inventory and exact errors are in agents/gyro/work/queue-310/BUILD.md, “223-source measurement — sage-4008 and sage-4010”. Release measurement approved but awaits CLEAR after row327 gate (sage-4011). This evidence commit contains plain text only, no imported crate source or runtime outputs; packaging/landing choice remains held under Vikunja618, and source/notice review goes to Gladstone.
+
+## 2026-10-24 — W2 row310 / #1824 223-vendor release measurement (Gyro)
+
+sage-4014 CLEAR run: frozen/offline scratch build exit0 in380.674036s, actual nice19/four jobs/cores/CPUs, no external network interface, no retry. Four outputs total44,137,258 bytes; WASM43,952,335 bytes SHA2560322beb9e58b9abeed6b6e05125879bfb3eccbebb05094e191df3542a74007ea differs from the full-lock build. Exact S0 package closures passed preflight; original lock unchanged, pruned lock remains3401363e.... Slot released immediately for Bradford in gyro-0018. Gladstone supplemental review of14 additions found10 PASS/4 CONCERN (not adoption approval); embedded W3C notices/attribution, dpi full-source conjunction/copyrights, explicit spirv standard-text map and winit example PNG inventory are now documented in plain-text evidence. Details: agents/gyro/work/queue-310/BUILD.md, “223 release result and notice supplement — sage-4014”. No crate sources/binaries/runtime route committed or served; row held for Vikunja618 and all implementation/CSP gates remain open.
+
+## 2026-10-24 — W2 row310 supplemental notice collection recheck recorded (Gyro)
+
+Gladstone-0027 at9522d2356 independently passes the four corrected collection/mapping gaps, with earlier ten package source/notice PASS results standing. Bundle4d8e2aac... and all12 incremental path hashes verified. This is supplemental evidence only: W3C/M13/license adoption, pruned lock, packaging/size, Worker/native runtime, WASM difference and implementation/CSP gates remain uncleared; row310 stays held. Details: agents/gyro/work/queue-310/BUILD.md, “Supplemental notice recheck — gladstone-0027”. No build or source/notice/runtime change.
@@ -0,0 +1,10 @@
+# Bentina
+
+Builder seat, Codex gpt-6.1-sol, started by Sage under Q246 and mos-1566. Owns row 157, I2: the install images, the
+install config key, the endpoint helper and the egress proxy (docs/plans/2026-10-18_containerized-install-rows.md),
+reassigned from Researcher so the coding runs on Codex.
+
+No launcher in this directory. The seat runs as a T3 thread and works in its own worktree. It has no credentials of its
+own; it pushes only its own `bentina/*` branches through the repository credential helper (mos-0981), never `refactor`,
+`main` or another seat's branch. Claude seats orchestrate and review the install path (mos-1542 rule 4). Registered by
+Sage on 2026-10-24 so the queue can name the seat as row owner (store.mjs isSeatDir).
@@ -0,0 +1,78 @@
+# Row 208 (193d) second review: poe/row208 4a4bef6c1 (duckworth-0302)
+
+Request: sage-3934 (sage-3931 request, c31492 on #1706). Candidate: 4a4bef6c1 on ec86f2c84, one
+commit. Design: e2d161e2e:agents/morgana/work/queue-193/DESIGN.md section 8, sha256 dd7fcb41
+(matches). Scope under mos-1542: the guards only. The question is whether a viewer can widen
+authority.
+Method: static. Git reads, plus the mutant summary Sage sent by path. No node, no tests.
+
+## Verdict: APPROVE (static)
+
+The diff has no bus or schema change. Every write is still decided by the broker as it stood at the
+base. The webui adds routes and hints, and no authority.
+
+- **chat-http.mjs.**
+  - share and unshare are POST only. They come after the same write fences as every other write:
+    send and named mode, the SSO session or auth header, Origin, and sec-fetch-site.
+  - The body must be exactly `{to}`: a string of 1-200 characters with no CR, LF or NUL. Extra keys
+    (owner, verb) refuse 400, and the test covers that.
+  - shares is GET only and takes no query.
+  - The reply must echo thread, to and op exactly. Anything else is 503 outcome-unknown.
+  - The new STATUS codes map share-not-covered to 403, share-exists to 409 and share-not-found to 404.
+  - `?shared=` accepts only `true`.
+- **chat.mjs and the adapter.**
+  - The three verbs go over `createChannelCaller` to the webui adapter (index.mjs:12-14). The adapter
+    is an allowlist passthrough to the session's own `call`.
+  - A granted user's chat is rebound per session (serve.mjs:701), so share calls carry the user's
+    principal, never the owner's.
+  - The test fixture runs the real adapter and the real Broker.
+- **The broker decides each new path, unchanged from the base.**
+  - thread.share, thread.unshare and thread.shares are in USER_VERBS and not in VIEWER_VERBS, so
+    userLevel gives collaborator. A viewer gets access-refused at #grantedThread (broker.mjs:950).
+  - Each of the three goes through `#thread`'s owner check (broker.mjs:909-913). A sharee gets
+    thread-not-owned and can't reshare.
+  - share-not-covered applies to a `user:` target (broker.mjs:6559).
+  - Only thread.messages takes `#threadRead`, so a share gives read access and nothing else.
+- **The grant-hint predicate.**
+  - access.mjs `chatGrants` re-runs `lookup`, so the subject must still sign in as session.user with a
+    live grant. It then keeps only that user's grants in this business that cover at collaborator,
+    which is the same `covers` call as the broker's `#granted`.
+  - It returns only `{projects, instances}`. No ids, receipts, subjects or other users escape. Any
+    failure gives [].
+  - The client's `scopeWrites` requires the project and the instance to match within one grant
+    (`some(g => project && instance)`). It never pairs a project from one grant with an instance from
+    another, so mixed grants can't combine into a scope that no single grant has.
+  - `includes('*')` on the client is equivalent to covers' `[0] === '*'`, because checkScope
+    (business access.mjs:97-103) refuses `*` unless it is alone.
+  - The hint is never carried over: chatGrants starts at [] and is re-read from /api/config on each
+    user render. It is in /api/config only when `granted`.
+- **No client-only hiding stands in for a broker refusal.** Each hidden control maps to a refusal:
+
+  | Hidden control | Who | Broker refusal |
+  | --- | --- | --- |
+  | composer and resume | viewer | thread.send/open: access-refused |
+  | composer and resume | sharee | thread.send/open: thread-not-owned |
+  | share form | viewer | access-refused |
+  | share form | sharee | thread-not-owned |
+  | create thread | out of scope | collaborator check at create |
+  | create project | user | project.create isn't in USER_VERBS |
+  | session controls, clear, cancel | user | session.* isn't in USER_VERBS (tester-only) |
+
+  Test :136 POSTs create, send, open and share from the page with the UI bypassed, and checks four
+  403 access-refused responses, unchanged table counts, and that each verb reached the bus. Test :19
+  adds unshare and the shares read over HTTP. Test :154 covers the sharee's thread-not-owned on send,
+  open and share.
+- **Mutants, as reported (sage-3920 CLEAR, /mnt/storage/scratch/tmp/8UlAhS/poe-208-mutants.json, not
+  rerun).**
+  - There are four served-copy mutants: composer, open, share and create. Each one's anchor must exist,
+    or the fixture throws.
+  - Each mutant fails the UI-absence test with ERR_ASSERTION, and the bypass test passes under each
+    one, so the broker still refuses. That meets design section 8: "With each UI check removed, the
+    bus still refuses."
+  - The full webui suite passed 418/0 and plugins 119/0 (sage-3925), as reported.
+
+## Notes
+
+- N1 (outside guard scope). user.js:16 re-renders every 5 s while the tab is visible. Each render
+  re-reads /api/config, projects, threads and the shared list. This doesn't affect authority, but it
+  is steady load per open user tab.
@@ -0,0 +1,74 @@
+# Row 323 round 1 verdict: goldie/row323 6a0f0f4f8 (duckworth-0300)
+
+Request: sage-3865 (early look at draft 571376c30) and sage-3870 (candidate 6a0f0f4f8, base dd6cb5872,
+manifest 903ef0225f2f…cda79f). Brief: docs/plans/2026-10-23_case1-business-file-brief.md, section "Brief:
+the Case 1 factory business file".
+Method: static. Git reads of local objects only. No node, no tests, no fetch, no queue reads.
+
+## Verdict: APPROVE (static), with one condition
+
+- **The manifest matches.** MANIFEST.sha256 hashes to 903ef0225f2f…cda79f, and both of its blobs match at
+  6a0f0f4f8: the JSON 85e6b9ac… and the test aecd1c0f…. Neither file changed between 571376c30 and
+  6a0f0f4f8. The rest of that range is BUILD.md, logs, BUILD-LOG and SESSIONS. dd6cb5872 is an ancestor.
+  No existing test or source file changed.
+- **Fields against the brief and the cited rulings:**
+  - id `mosaic-stack` (DESIGN section 7). `vars.bus.tester` true. There is no `library` key and no
+    library project.
+  - human `jason`. I can't read mos-1554 myself, so this rests on Sage's relay in sage-3823. BUILD.md is
+    explicit that this is the only literal value that comes from mos-1554.
+  - The project root /srv/mosaic/src/mosaic-stack is under the DESIGN home /srv/mosaic, and the value
+    comes from sage-3822. It passes the normalized-absolute check at business.mjs:274. A missing project
+    file there only gives a warning in validate (cli.mjs:73-77), so the path doesn't need to exist at
+    install.
+  - Roles are chief (chief-of-staff) and assistant. The assistant is needed because checkLaunch requires
+    `launch.instances` to be nonempty and to exclude the launcher (business.mjs:186-190). BUILD.md names
+    that check, as the brief asks. Both arbiters are chief, under sage-3820. launch.by is chief, which
+    F7 (case1-accept.sh:545-559) reads.
+  - Claude only. `plugins.harness` is [claude-code] and both roles use harness claude-code. There is no
+    pi.
+  - No tracker, no credentials, no library, and no credential value or reference anywhere in the file.
+    Q247 covers the tracker by omission.
+- **The model, provider and effort have sources.**
+  - The model claude-opus-5-5 is Sage's ruling in sage-3822.
+  - The provider mapping anthropic/claude-opus-5-5 matches packages/business/README.md:185.
+  - `thinking: high` is one of the claude-code LEVELS (index.mjs:28) and matches the chief convention at
+    session-launch.test.mjs:83.
+  - With no `launch.limits`, there is no ceiling: limitHit (launch.mjs:137-155) checks only the limits
+    that are defined. That is a valid choice, and N1 records it.
+- **The tests read the shipped bytes.**
+  - DOCUMENT is `REPO/docs/guides/case1-business.mosaic-stack.json`. Case 1 writes those exact bytes,
+    loads them through loadBusiness, checks the bytes didn't change, and then asserts every field.
+  - The validate, install, boot and refusal cases copy the document and change only the project root,
+    under sage-3820. Since an absent root only warns, the copy differs from the shipped file only in a
+    way validate doesn't refuse.
+  - The brief's three tests are all there:
+    - (1) The loader case.
+    - (2) The real case2-install.sh factory profile with `--business-file`, with only stack-copy stubbed.
+    - (3) `bus-tester-off`, the literal library key through the final validate (sage-3820), and the
+      library project through `profile-library-business`.
+  - The boot case also covers the 324 boundary: bootConfig gives no trackers, credentials.status() is
+    [], and the reader's credentials are [].
+- **The tester-switch mutant is a real kill target.**
+  - mutant.py asserts that the needle `"bus.tester": true` occurs exactly once, flips only that value,
+    and restores in a finally block with a byte-equality check.
+  - The value is asserted at test :66. mutant.log shows `not ok 1`, `false !== true`, `# fail 1`, and the
+    restored sha256 85e6b9ac… equals the manifest.
+  - The flip would also make the install case at :95 fail, because the install refuses with
+    bus-tester-off.
+- **The run, as Goldie reported it (sage-3869 CLEAR, 31-byte TMPDIRs, on 571376c30). I didn't rerun it.**
+  - The new file passed 7/7, the business suite 261/261, and the restored file 7/7 again.
+  - The mutant was killed.
+  - The earlier revoke-window red is the tools.sock length limit (session.mjs:278, dda2d07b4). It fails
+    the same way on the bare base dd6cb5872, so it isn't this row's.
+
+## Condition
+
+- C1. Under mos-1561, the cli suite counts only from Sage's full gate on 6a0f0f4f8. This approval
+  depends on that gate passing with no new failures.
+
+## Notes
+
+- N1 (doc). `launch` has no `limits`, so the business has no session ceiling. If Mos wants a cap on .53,
+  it's a later launch-settings edit and doesn't need a new file.
+- N2 (doc). An install on .53 with no project file at /srv/mosaic/src/mosaic-stack still passes. It
+  warns "no project variables" (cli.mjs:76), which the run sheet could mention.
@@ -0,0 +1,56 @@
+# Row 324 round 1 verdict: goldie/row324-r2 dbdfcfd52 (duckworth-0298)
+
+Request: sage-3853 (#1820, comment 31469, round 1, rev 3768/3769). Candidate: dbdfcfd52 on refactor
+3569bf54f, code commit 7e59ba8b3. Brief: docs/plans/2026-10-23_optional-tracker-brief.md.
+Method: static. Git reads of local objects only. No node, no tests, no fetch, no queue reads.
+
+## Verdict: APPROVE (static)
+
+- **The manifest matches.** agents/goldie/work/queue-324/MANIFEST.sha256 hashes to 52874356…2b473d,
+  the digest Sage gave. All 8 listed blobs match the files at dbdfcfd52.
+- **The loader change is narrow.**
+  - business.mjs:239 drops "tracker" from the required-key loop.
+  - business.mjs:296 is `Object.hasOwn(document, "tracker") ? checkTracker(document.tracker, file) : null`.
+    Omission gives `tracker: null`. A present key always goes through checkTracker.
+  - business.mjs:298 guards the role tracker comparison on `tracker &&`. An absent business tracker
+    doesn't waive the role pm tracker check, and the new test covers that.
+- **A present null still refuses.** checkTracker (business.mjs:85) calls requireObject first, so a
+  present null, false, [] or a non-object refuses. {} and {sync:{}} refuse further in. The new
+  refusal test covers each of them.
+- **Every business.tracker reader handles absence.** I read each hit in Goldie's reader-audit.txt and
+  the two outside it in scripts:
+  - bus runtime.mjs:131 registers `<business>/@sync` only under `b.tracker?.sync?.credentials`. An
+    absent tracker registers nothing.
+  - bus runtime.mjs:247 hashes `b.tracker?.sync ?? null`.
+  - broker.mjs:6242 reads `b.tracker?.sync?.bot`. Broker 3969 and 4497 read the role-level tracker
+    only.
+  - cli.mjs:85 and webui reads.mjs:166 use `tracker?.sync?.credentials ?? {}`. The
+    `b.tracker.sync.bot` inside the reads.mjs loop runs only when there are entries.
+  - cli config.mjs:58 trackerFor returns null on an absent tracker before the vars check. bootConfig
+    (config.mjs:138-139) sets config.trackers only for a non-null result.
+  - tasks/adapter.mjs loads only for configured trackers (process.mjs:136), and its settings refuse
+    with tracker-config at :25 before the :35 and :81 reads.
+  - instance-settings.mjs:127 reads `old.tracker?.sync`.
+  - stack-release.sh:2074 and :2120 use `b.tracker?.sync?.credentials`.
+  - launch-settings, resolve, instances.mjs and public/bus.js:785 read role-level trackers only.
+    conversation/controller exec.tracker is a different object.
+- **Writers don't serialize the loader's null.** The setters build `next` from the raw file bytes
+  (organization.mjs:88-93), not from the loaded object, and validate before writing
+  (organization.mjs:201, :208). A business file without a tracker stays without one.
+- **The brief's tests are there.**
+  - business/tests/optional-tracker.test.mjs has 5 tests: omission loads null, CLI validate with the
+    sync file gone, a present tracker preserved and frozen, the refusal set, and the role pm check.
+  - cli/tests/optional-tracker.test.mjs has 4 tests: no trackers from bootConfig with tracker vars
+    set, startBroker with no @sync credential, businessView with no credentials, and a present
+    tracker with a missing token refusing credential-file.
+  - The existing-tracker case runs through business.test.mjs unchanged apart from :98.
+- **The one old-test edit is in bounds.** business.test.mjs:98 drops "tracker" from the
+  required-key loop, as mos-1556 allows.
+- **The run, as Goldie reported it (sage-3850 CLEAR, I didn't rerun it):** 5/5, 4/4 and
+  business.test 21/21. The presence mutant at business.mjs:296 is killed, and the restore matched
+  sha256 e76db421.
+
+## Notes
+
+- N1 (doc). The 'undefined' refusal case only exists in memory. A JSON file can't carry undefined,
+  so on disk it is the same as omission. The test is still correct.
@@ -0,0 +1,171 @@
+# Row 321: F7 wrapper environment and F10 first adoption (#1817)
+
+Owner Gladstone; reviewer Boyd (separate Codex thread); queue/review/landing Sage.
+Authorized by sage-3791. Branch gladstone/row321 starts at fetched origin/refactor
+833ec1cc8d7c11842efb82e57c1a0b256c8d22d7. The row320 branch is unchanged.
+Brief: docs/plans/2026-10-23_host-fixes-1816-brief.md, section
+"Brief: F7, the wrapper step's PATH and umask under sudo", including F10;
+verified blob 7333f94ba9cfd58f87c5a3580d428b84c65845b6 (requested pin 7333f94ba9cf).
+Only the run sheet and this BUILD.md change. No scripts, tests, config, credentials,
+queue state, deployment or live host operation changed. No tests or Node commands run.
+
+## Before and after
+
+F7: sudo secure_path omits the pinned Node directory, so wrapper creation reaches
+instance.sh's bare node and exits127. An inherited umask can leave the bin dir0775.
+The MOSAIC_WRAPPER heredoc now sets umask077 and the sheet's existing pinned Node
+PATH before mkdir. One sentence names secure_path and why the step sets both.
+The existing Mos go remains explicit. No wrapper command is executed here.
+
+F10: first install omits adoption, so the first activate refuses no-pointer.
+The release-transport section now places explicit adoption after both units are
+running (section10) and before any activate/upgrade, run as mosaic on Mos's go by
+Jason or Mos, citing stack-release.sh:14. It uses the configured dev instance and
+external units, with the same pinned Node PATH under sudo.
+Adjacent to the upgrade command, the sheet now says only the first upgrade after
+adopt takes --no-rehearsal: adopt writes no backup; missing flag refuses no-backup;
+later upgrades omit it, because a backup with that flag refuses rehearsal-required.
+Source checks: stack-release.sh pointer_for_business refuses no-pointer and directs
+adopt; stack-upgrade.sh rehearse handles rc3/no-backup and rc0/rehearsal-required.
+This records existing behavior and authority; it adds no requirement or live go.
+
+## Test-reference grep (negative and positive control)
+
+The required negative grep covers both F7 and F10 because neither is read by any
+matched test. The positive control locates the precheck path that the unit/install
+tests actually execute, showing the pathspecs reach their test files.
+
+Negative grep:
+
+```sh
+git grep -n 'host-run-sheet' -- 'packages/*/tests/*' 'scripts/test-*.sh'
+# exit 1
+# no matches
+```
+
+Positive control:
+
+```sh
+git grep -n 'case2-precheck.sh' -- 'packages/*/tests/*' 'scripts/test-*.sh'
+# exit 0
+packages/cli/tests/case1-accept.test.mjs:26:const PRECHECK = `${HOME}/.local/share/mosaic-stack/copies/${COPY}/scripts/case2-precheck.sh`;
+packages/cli/tests/case2-install.test.mjs:2:// scripts/case2-precheck.sh's library checks and --library-status mode. Brief:
+packages/cli/tests/case2-install.test.mjs:23:const PRECHECK = join(REPO, "scripts", "case2-precheck.sh");
+packages/cli/tests/case2-install.test.mjs:271:// ---- case2-precheck.sh, the library profile (D6a) ----
+packages/cli/tests/case2-install.test.mjs:334:// ---- case2-precheck.sh --library-status (D6b) ----
+packages/cli/tests/case2-unit.test.mjs:2:// and scripts/case2-precheck.sh checks the host before they start. Brief: docs/plans/2026-10-20_case2-rows.md
+packages/cli/tests/case2-unit.test.mjs:20:const PRECHECK = join(REPO, "scripts", "case2-precheck.sh");
+packages/cli/tests/case2-unit.test.mjs:588:// ---- case2-precheck.sh ----
+```
+
+## Run-sheet diff against the pinned base (git diff --unified=0)
+
+```diff
+diff --git a/docs/guides/host-run-sheet.md b/docs/guides/host-run-sheet.md
+index d2ba28d7c..96fd4f363 100644
+--- a/docs/guides/host-run-sheet.md
+++ b/docs/guides/host-run-sheet.md
+@@ -209,0 +210,9 @@ sudo -u mosaic -H git clone -q -b refactor /srv/mosaic/incoming/<sha>.bundle /sr
+After a first install, once both units are running (section 10), adopt the installed copy before
+any activate or upgrade. This step runs only on Mos's go, with Jason or Mos running it
+(`scripts/stack-release.sh:14`):
+
+```sh
+sudo -u mosaic -H env PATH=/opt/mosaic-stack/node-<v>/bin:/usr/sbin:/usr/bin:/sbin:/bin \
+  /srv/mosaic/src/mosaic-stack/scripts/stack-release.sh adopt <business> --instance dev --units external
+```
+
+@@ -211,0 +221,4 @@ Each upgrade, before `stack-upgrade.sh upgrade`:
+Only the first upgrade after adopt takes `--no-rehearsal`: append it to the upgrade command below.
+Adopt writes no backup, so omitting the flag then refuses `no-backup`. Subsequent upgrades omit it;
+when a backup exists, supplying it refuses `rehearsal-required`.
+
+@@ -246,0 +260 @@ step requiring Mos's go (`scripts/stack-copy.sh:3`); the install does not create
+The step runs under sudo's `secure_path`, so it sets its own PATH and umask.
+@@ -250,0 +265,2 @@ cd / || exit 1
+umask 077
+PATH=/opt/mosaic-stack/node-<v>/bin:/usr/sbin:/usr/bin:/sbin:/bin; export PATH
+```
+
+## Verification
+
+No matching test reads the changed lines, so the stop condition did not apply.
+No test run or slot is required under sage-3791. Verification is static: the
+required grep and positive control above, exact brief/base pins, scoped diff,
+and git diff --check. Reviewer Boyd and Sage own review/landing; no approval
+or landing is claimed here.
+
+Receipt correction: the first commit embedded ordinary diff context lines that
+contain a single space. git diff --check flagged those as trailing whitespace.
+This follow-up uses the exact zero-context diff instead. The run sheet is
+unchanged, no tests or Node commands run, and no amend or force-push is used.
+
+## F11 addition (sage-3805, mos-1549, ops-0275)
+
+The brief was extended after F7/F10 drafting and re-pinned at revision3733:
+canonical local commit a9bae9af2, same F7 section anchor, full verified blob
+0e684ef2103447dcc2013b6bf81b1c4ca5bbc0bd (requested pin0e684ef21034).
+Read using git show from the canonical checkout; no fetch, rebase or queue write
+is required. This new pin supersedes the earlier brief pin for this follow-up.
+
+Defect: a precheck one second after unit start found no bus.sqlite yet.
+Section10 now requires loopback healthz success after a unit start before any
+case2-precheck.sh, including section9's --library-status. It uses the same
+127.0.0.1:<port>/healthz curl form as scripts/case1-accept.sh:458. The subshell
+tries at most30 times, each curl capped at2 seconds, with1 second between failed
+attempts (at most89 seconds plus scheduling overhead). Exhaustion prints STOP
+and exits only the subshell. The instruction says to stop before precheck/adopt;
+it does not exit the interactive operator shell. The section9 library-gitea row
+now explicitly requires this bounded wait before --library-status. <port> is the
+installed Console unit's --port, not an assumed port or business name.
+No host action, test, Node command or credential access occurred.
+
+Required grep repeated for the widened scope:
+
+```sh
+git grep -n 'host-run-sheet' -- 'packages/*/tests/*' 'scripts/test-*.sh'
+# exit1, no matches
+git grep -n 'case2-precheck.sh' -- 'packages/*/tests/*' 'scripts/test-*.sh'
+# exit0, positive control; output follows
+packages/cli/tests/case1-accept.test.mjs:26:const PRECHECK = `${HOME}/.local/share/mosaic-stack/copies/${COPY}/scripts/case2-precheck.sh`;
+packages/cli/tests/case2-install.test.mjs:2:// scripts/case2-precheck.sh's library checks and --library-status mode. Brief:
+packages/cli/tests/case2-install.test.mjs:23:const PRECHECK = join(REPO, "scripts", "case2-precheck.sh");
+packages/cli/tests/case2-install.test.mjs:271:// ---- case2-precheck.sh, the library profile (D6a) ----
+packages/cli/tests/case2-install.test.mjs:334:// ---- case2-precheck.sh --library-status (D6b) ----
+packages/cli/tests/case2-unit.test.mjs:2:// and scripts/case2-precheck.sh checks the host before they start. Brief: docs/plans/2026-10-20_case2-rows.md
+packages/cli/tests/case2-unit.test.mjs:20:const PRECHECK = join(REPO, "scripts", "case2-precheck.sh");
+packages/cli/tests/case2-unit.test.mjs:588:// ---- case2-precheck.sh ----
+```
+
+No test reads the changed run-sheet lines; the stop condition does not apply.
+No test run is needed under the docs-only brief. Static verification checks both
+locations, retry limit/timeout, the loopback URL, unchanged F7/F10 and scoped diff.
+
+F11 delta against d9400f0d3 (git diff --unified=0):
+
+```diff
+diff --git a/docs/guides/host-run-sheet.md b/docs/guides/host-run-sheet.md
+index 96fd4f363..e9fa87f24 100644
+--- a/docs/guides/host-run-sheet.md
+++ b/docs/guides/host-run-sheet.md
+@@ -322 +322 @@ file with `stat -c '%U %a %n' PATH`, never `cat`. `<business>` is the host's bus
+-| `/srv/mosaic/.config/mosaic-dev/secrets/<business>/` | `library-gitea` | 0600 | mosaic | library | `case2-precheck.sh --business <business> --library-status`, after the bus is up: `library-last-error library-credential-missing` until it's placed, then `library <project> last fetched ...` |
+| `/srv/mosaic/.config/mosaic-dev/secrets/<business>/` | `library-gitea` | 0600 | mosaic | library | After a unit start, wait for loopback `/healthz` with the bounded retry in section 10 before `case2-precheck.sh --business <business> --library-status`: `library-last-error library-credential-missing` until it's placed, then `library <project> last fetched ...` |
+@@ -357,0 +358,16 @@ None by hand. I2's `case2-unit.sh` enables both units, starts the bus, then the
+After a unit start, wait for the Console's loopback `/healthz` to succeed before running
+`case2-precheck.sh`, including `--library-status` in section 9. Replace `<port>` with the installed
+Console unit's `--port`. This retry is bounded to 30 attempts, each with a 2-second timeout, with
+1 second between failed attempts. If it prints STOP, stop here; do not run the precheck or adopt.
+
+```sh
+(
+  attempts=0
+  until curl -fsS --max-time 2 -o /dev/null 'http://127.0.0.1:<port>/healthz'; do
+    attempts=$((attempts + 1))
+    [ "$attempts" -lt 30 ] || { echo "STOP: loopback healthz did not become ready; do not continue" >&2; exit 1; }
+    sleep 1
+  done
+)
+```
+
+```
@@ -0,0 +1,9 @@
+# Glomgold
+
+Builder seat, Codex gpt-6.1-sol, started by Sage under Q246 and mos-1571. Owns row 309, O2 W1: the reviewed local
+thesaurus data (docs/plans/2026-10-21_q195-writing-editor.md, "W1 reviewed local thesaurus data").
+
+No launcher in this directory. The seat runs as a T3 thread and works in its own worktree. It has no credentials of its
+own; it pushes only its own `glomgold/*` branches through the repository credential helper (mos-0981), never `refactor`,
+`main` or another seat's branch. Claude seats orchestrate and give the Opus 5.5 landing review (mos-1571). Registered by
+Sage on 2026-10-24 so the queue can name the seat as row owner (store.mjs isSeatDir).
@@ -0,0 +1,134 @@
+# Row 265 / #1770 — project rooms
+
+Current result: verified under sage-3942; slot returned in goldie-0034. Full bus 957/957, sandbox 10/10, parser 15/15, rooms 18/18, twelve mutants killed, restored files green. Review/push packet below includes mos-1567 closure scope.
+
+Goldie, 2026-10-24. Branch goldie/row265, base ec86f2c847f6154a0677c6ed23c87dabc2c665d0. Brief docs/plans/2026-10-20_case2-rows.md § C2-09b rooms at blob3a5ed91a4fb3462df67e6939ae6f18290ac9b453; design agents/gosalyn/work/case2/DESIGN.md §6. Sage-3915 transfers ownership from Rocko to Goldie and review from Dewey to Boyd. No old test edit authorized. All tests/mutants wait for Sage CLEAR; queued behind Poe, Bentina and Sage's326 gate.
+
+## Design and clarified readings
+
+A room is a bus project. Members are all loaded business instances whose definitions are in THREAD_DEFINITIONS, sorted by key. Canonical room threads have those keys as names and belong to the requesting human. open checks all name/instance/owner collisions before creating anything; it delegates missing inserts to existing thread.create dispatch, including default session metadata. send/read require the complete canonical set. No schema or migration change.
+
+Sage-3921 settles two brief readings: the single captured timestamp applies to the room.send MESSAGE rows; existing route/delivery/event helpers keep their own timestamps in the same dispatch transaction. They are unchanged. A final EOF-terminated @name is a tag, so bare @continuity is invalid-request rather than a broadcast. Leading whitespace is accepted. Pure parseAddress returns {tags,body}, where body is the unaddressed remainder; room.send stores the ORIGINAL input unchanged. Export it from the bus index and expose a separate reusable test table for C2-10c parity.
+
+send resolves tags against current #named results and member instance keys, deduplicates recipients, and refuses multiple member matches. It checks each target's current default-session fence and messaging rule, then inserts one normal INFO message, route and human.input per target under the existing request transaction. All message rows share one at. No tag broadcasts; tags after the first non-tag token remain plain text.
+
+read includes all sessions of the caller's canonical threads, globally ordered by messages.seq. Each entry retains first-message fields plus thread/session/instance and adds ids (every grouped message id) and to (each instance once). Only consecutive human rows with identical at/body/class group, and a repeated instance starts a new entry, so same-millisecond identical sends remain separate. Paging limit counts merged entries (THREAD_PAGE defaults/max); clients continue after the last ids element. Cursor must belong to a room thread. Bounded raw scan limit*memberCount+1 completes requested groups without reading unbounded history. Sage-3921 accepts these routine choices as proposed in goldie-0030.
+
+## Scope / steps
+
+1. Read current thread.create/send/messages, transaction wrapper, naming and messaging helpers; audit source readers/pins. Claim265 via queue after next. Done/read, claim recorded at rev 3814 with op goldie-0265-start-1 (same-op replay confirmed).
+2. Add parser + index export, only three room cases in broker, README verb rows and new bus tests/fixtures. Do not modify existing thread/messaging/ACL/helper behavior.
+3. New tests cover all brief cases, atomicity across message/route/input rows, ownership/projects, permissions, paging/grouping and session fences. No suites or test runs before CLEAR.
+4. Record exact refusal→test→mutant matrix here before requesting the slot; one targeted killed mutant per named refusal, restoration byte-checks. New files whole then bus suite under CLEAR, serial timeout-k10, fresh31-byte mktemp TMPDIR plus UTC/load/busy header.
+5. Before in-review, grep packages/*/tests for broker.mjs/TESTER_VERBS and changed-file pins. Push own branch and hand tip/base/manifest directly to Sage/Boyd. Sage owns request posting/landing.
+
+No Console/Discord/CLI room surface or cross-agent reply visibility added. No tester verb, role, schema or secret change. No host action or credential access.
+
+## New tests and refusal / mutant matrix
+
+Only new test files and a new reusable vector fixture are added. No pre-existing test changes. Parser table: address.test.mjs consumes address-cases.mjs, including final EOF tags, leading whitespace, tags after the first word, repetition and blank/tag-only remainder. Broker cases: rooms.test.mjs covers sorted/reused canonical threads, other-instance and other-owner collisions, all three verbs' human/tester gates, missing projects/member set, partial/foreign/wrong-instance rooms, key and current-name addressing, ambiguity/same-member name+key, unknown/non-member/old-name tags, tags-only bodies, one/many/broadcast targets, original bytes, shared message timestamp, routes/deliveries/human.input, denied last recipient, clearing last session, all-session merged reads, agent reply metadata, merged paging/default/max, foreign/noncanonical/absent cursors, and same-at repeated sends. Synthetic historical rows append valid rows; they do not rewrite evidence or clocks. The same-at batches repeat the first recipient at each boundary, proving identical sends remain distinct.
+
+Each named refusal has one mutation of its enforcement, run against the entire new rooms.test.mjs file. The driver mutants.py stores the exact original→mutant diff in logs/Mxx-*.diff, logs UTC/load/busy/TMPDIR, accepts only Node exit 1 with the named target test failing, and restores/verifies full broker bytes and SHA256 in finally. No mutation is retained. Generic pre-existing request/schema/argument policies are exercised through existing code; the matrix names the refusals added or deliberately inherited by these room cases.
+
+| Mutant | Refusal | Guard relaxed | Required failing new test |
+| --- | --- | --- | --- |
+| M01-human | human-required | remove common room human check | room verbs require the human |
+| M02-tester | tester-refused | add the three room verbs to TESTER_VERBS | room verbs require the human (explicit absence pin) |
+| M03-project | project-not-found | remove room project lookup check | room verbs refuse missing projects |
+| M04-members | thread-instance-missing | allow empty member set | room verbs refuse missing projects |
+| M05-collision | room-thread-name-taken | remove canonical owner/instance collision check | room.open preflights instance collisions |
+| M06-open | room-not-open | remove missing canonical thread check | send/read refuse a missing canonical member |
+| M07-body | invalid-request | allow empty parsed remainder | unknown or non-member addressees and tags-only bodies |
+| M08-unknown | unknown-addressee | allow zero member matches | unknown or non-member addressees and tags-only bodies |
+| M09-ambiguous | addressee-ambiguous | allow multiple member matches | a legacy name colliding with another member key |
+| M10-messaging | message-sender-refused | omit room target messaging check | messaging denial on the last target |
+| M11-cursor | message-not-found | unknown room cursor falls back to seq zero | room.read groups one send, pages |
+| M12-fence | session-clearing | omit room target session fence | a clearing last member fences the whole send |
+
+For M02, the existing human check remains a second barrier: the mutant deliberately relaxes only the tester allowlist; the new explicit absence assertion kills it without loosening or running the old pin. Existing helpers keep their full session-state behavior. No helper or schema mutation ships.
+
+## Reader / hash audit
+
+`rg -n 'broker\.mjs|TESTER_VERBS' packages/*/tests --glob '!fixtures/*'` produced reader-grep.txt (133 hits at audit time). These are imports except the concrete source read at bus/tests/limit-checks.test.mjs:323-326 (forbidden limit-check/token-limit imports) and the tester set assertions at bus/tests/tester-writes.test.mjs:18-32. The latter stays byte-for-byte unchanged. bus/tests/viewer.test.mjs:116 builds its coverage set from exported verb lists; rooms do not widen those lists. No old test needs an edit.
+
+Pin check: recursively inspect packages/*/tests plus scripts/test-*.sh for changed-file mentions (broker.mjs, address.mjs, packages/bus/README.md, packages/bus/src/index.mjs) with literal 64-hex values within eight lines: pin-context-grep.txt records no hits. A direct same-line hash/digest/sha256 grep finds registrySha256 imports only, which hash host registry data rather than broker bytes. The independent channel-proof.test.mjs baselines cover proof/transport files, none changed here. Positive control: pin-positive-control.txt records actual schema.sql / SCHEMA_SHA256 / createHash references in bus/tests/schema.test.mjs and bus/src/store.mjs. Schema bytes are unchanged.
+
+## Requested serialized slot plan (not run)
+
+At each run: fresh `TMPDIR=$(mktemp -d /mnt/storage/scratch/tmp/XXXXXX)`, date -u, uptime, and `bash /mnt/storage/scratch/sage-busy-now.sh 2>/dev/null | tail -1` in the log. No concurrent test runs. Ignored root node_modules symlink targets the canonical checkout; it will not be committed.
+
+1. `timeout -k 10 120 node --test packages/bus/tests/address.test.mjs` whole.
+2. `timeout -k 10 120 node --test packages/bus/tests/rooms.test.mjs` whole.
+3. `timeout -k 10 600 node --test --test-concurrency=1 packages/bus/tests/*.test.mjs` bus suite whole.
+4. `python3 agents/goldie/work/queue-265/mutants.py`: M01 through M12 serially, each runs `timeout -k 10 120 node --test packages/bus/tests/rooms.test.mjs` whole, fresh TMPDIR/header; stop on a live mutant or wrong failure. Record each diff and restoration digest.
+5. Restored address.test.mjs whole and rooms.test.mjs whole separately, same commands as 1/2 and fresh directories/header each.
+
+Estimate 5–10 minutes; bus timeout ceiling 10 minutes, individual new/mutant ceilings 2 minutes each. On first new-test red, record/report it. On any old-test red or need for old-test change, stop and ask Sage. Static node --check for new modules/tests and git diff --check passed; no tests or mutants run yet.
+
+## First slot STOP — sage-3932
+
+2026-10-24T04:27Z: stopped on an old-test red. No old test changed or rerun, no mutant executed, no product adjustment after the failure, no commit/push claiming verification.
+
+| Step | Exit | Counts / disposition | Log |
+| --- | --- | --- | --- |
+| 1 address whole | 0 | 14 pass, 0 fail/skip/cancel; 58.559 ms | logs/01-address.log |
+| 2 rooms whole | 0 | 18 pass, 0 fail/skip/cancel; 1067.524 ms | logs/02-rooms.log |
+| 3 bus whole | 1 (stopped) | partial 619 top-level ok, 1 not ok; not a completed-suite result | logs/03-bus.log |
+| 4 twelve mutants | not run | stop rule | none |
+| 5 restored files | not run | stop rule; no mutations were applied | none |
+
+All three run headers use UTC/date, uptime, helper CLEAR and distinct 31-byte scratch TMPDIRs. Bus began04:25:22Z at load2.80/2.91/2.61, TMPDIR /mnt/storage/scratch/tmp/LaZAaK. Parser used /mnt/storage/scratch/tmp/rqcTH7; rooms has its own header. Explicit TAP reporter was selected for rooms/bus and the mutant driver so failure detection/counts are stable across Node26's default spec reporter; this changes reporting only.
+
+The old red is project-runtime.test.mjs:12, assertion:14, test620, “Broker keeps the sandbox client import closure: only the listed imports, no lazy project import”. Actual imports include the new `import { parseAddress } from './address.mjs';`; the pinned array omits it. ERR_ASSERTION deepStrictEqual; individual duration2.469251ms. The full expected/actual/stack is in 03-bus.log. No other red was observed before stopping.
+
+Reader-audit correction: reader-grep.txt:100 already contains project-runtime.test.mjs:13, a direct broker source read. The earlier prose incorrectly described the import-closure assertion as a normal import; I missed this old source pin during inspection. This is not a hash pin. Follow-up static trace finds seat/src/sandbox.mjs:50-60 RUNNER_FILES includes broker and landing but not address; seat/tests/sandbox.test.mjs:45-53 compares this mount list to the recursively imported source closure. A parser dependency therefore also needs the one new RUNNER_FILES path. Both an old-test pin change and this out-of-owned-files product change require Sage/Mos approval before edits. Recommended bounded change: add only the parser import to the project-runtime expected imports, add only packages/bus/src/address.mjs beside broker in RUNNER_FILES, and leave the generic sandbox closure test unchanged.
+
+Broker bytes remain SHA256 71b32ee4afa322793aad81231441ee7badc3e5aff65ff008c6cc0f7f63b72781. git diff --check still passes. Slot returned in goldie-0032, pending ruling/new CLEAR; no reruns.
+
+## mos-1567 approved closure correction / second slot request
+
+Sage-3940 relays Mos's mos-1567 and widened row scope (sage-3939). Applied exactly the approved pre-existing-file edits: project-runtime.test.mjs adds two lines at17-18, one Row265 comment and the parser import in the pinned array, no other line changed (numstat2 added/0 deleted); seat/src/sandbox.mjs adds only `packages/bus/src/address.mjs` immediately after broker in RUNNER_FILES. seat/tests/sandbox.test.mjs stays byte-for-byte unchanged. The parser remains a separate pure module. A NEW block in address.test.mjs asserts `doesNotMatch(/\bimport\b/)` on its source, with a node:fs import in that new test file; no existing assertion is moved or weakened.
+
+Review packet must explicitly call out the RUNNER_FILES mount-list entry for Boyd's review. This is a read-only source-file mount needed by the broker's static dependency, with no new module dependency or role/verb authority. The first-run import pin failure remains recorded above and in logs/03-bus.log; new logs will have rerun-prefixed names, preserving first-slot bytes.
+
+Requested rerun order, awaiting CLEAR after Bentina: first `timeout -k 10 180 node --test --test-reporter=tap packages/seat/tests/sandbox.test.mjs` whole, then the original five steps again from step1: address whole (now15 cases), rooms whole, bus whole with concurrency1 (includes project-runtime whole), M01–M12 whole-room-file mutants, then restored address and rooms files separately. Explicit TAP reporter is used throughout for stable logs/kill matching; timeouts otherwise120 per new/mutant run and600 for bus. Each run still gets fresh short mktemp TMPDIR, date/uptime/busy header, serialized with the same stop rule. Estimate5–10minutes. Only static node --check and git diff --check run since the STOP; all pass. No new test run yet.
+
+## Verified result — sage-3942 CLEAR, slot returned goldie-0034
+
+All rerun positives exit 0 with zero failures, skips or cancellations. Full bus suite passed 957/957, including the approved project-runtime import pin. The unchanged sandbox test passed 10/10, including its recursive mount/import-closure assertion. New parser cases passed 15/15, rooms 18/18, and both passed again after restoration. No tests run after slot return.
+
+| Run | Exit | Pass / fail | Duration ms | UTC / load / helper | Log |
+| --- | --- | --- | --- | --- | --- |
+| rerun-00-sandbox | 0 | 10 / 0 | 5526.027699 | Sat Oct 24 04:31:35 UTC 2026; 23:31:35 up 10 days, 14:51,  2 users,  load average: 2.83, 2.91, 2.73; CLEAR | [log](logs/rerun-00-sandbox.log.gz) |
+| rerun-01-address | 0 | 15 / 0 | 54.634817 | Sat Oct 24 04:31:45 UTC 2026; 23:31:45 up 10 days, 14:51,  2 users,  load average: 2.54, 2.84, 2.71; CLEAR | [log](logs/rerun-01-address.log.gz) |
+| rerun-02-rooms | 0 | 18 / 0 | 921.788987 | Sat Oct 24 04:31:52 UTC 2026; 23:31:52 up 10 days, 14:51,  2 users,  load average: 2.42, 2.81, 2.70; CLEAR | [log](logs/rerun-02-rooms.log.gz) |
+| rerun-03-bus | 0 | 957 / 0 | 118397.418425 | Sat Oct 24 04:32:01 UTC 2026; 23:32:01 up 10 days, 14:51,  2 users,  load average: 2.28, 2.77, 2.68; CLEAR | [log](logs/rerun-03-bus.log.gz) |
+| rerun-05-restored-address | 0 | 15 / 0 | 54.587943 | Sat Oct 24 04:35:02 UTC 2026; 23:35:02 up 10 days, 14:54,  2 users,  load average: 3.10, 3.07, 2.83; CLEAR | [log](logs/rerun-05-restored-address.log.gz) |
+| rerun-05-restored-rooms | 0 | 18 / 0 | 991.877991 | Sat Oct 24 04:35:11 UTC 2026; 23:35:11 up 10 days, 14:55,  2 users,  load average: 3.17, 3.09, 2.84; CLEAR | [log](logs/rerun-05-restored-rooms.log.gz) |
+
+Mutant driver exit 0; all twelve target tests killed their guard relaxation with Node exit 1. Every mutant log records exact bytes restored to broker SHA256 `71b32ee4afa322793aad81231441ee7badc3e5aff65ff008c6cc0f7f63b72781`. Driver receipt: [rerun-04-mutants-driver.log](logs/rerun-04-mutants-driver.log.gz).
+
+| Mutant | Node exit | Pass / fail | Exact diff | Raw log |
+| --- | --- | --- | --- | --- |
+| M01-human | 1, killed | 16 / 2 | [diff](logs/M01-human.diff) | [log](logs/M01-human.log.gz) |
+| M02-tester | 1, killed | 17 / 1 | [diff](logs/M02-tester.diff) | [log](logs/M02-tester.log.gz) |
+| M03-project | 1, killed | 17 / 1 | [diff](logs/M03-project.diff) | [log](logs/M03-project.log.gz) |
+| M04-members | 1, killed | 17 / 1 | [diff](logs/M04-members.diff) | [log](logs/M04-members.log.gz) |
+| M05-collision | 1, killed | 14 / 4 | [diff](logs/M05-collision.diff) | [log](logs/M05-collision.log.gz) |
+| M06-open | 1, killed | 17 / 1 | [diff](logs/M06-open.diff) | [log](logs/M06-open.log.gz) |
+| M07-body | 1, killed | 17 / 1 | [diff](logs/M07-body.diff) | [log](logs/M07-body.log.gz) |
+| M08-unknown | 1, killed | 16 / 2 | [diff](logs/M08-unknown.diff) | [log](logs/M08-unknown.log.gz) |
+| M09-ambiguous | 1, killed | 17 / 1 | [diff](logs/M09-ambiguous.diff) | [log](logs/M09-ambiguous.log.gz) |
+| M10-messaging | 1, killed | 17 / 1 | [diff](logs/M10-messaging.diff) | [log](logs/M10-messaging.log.gz) |
+| M11-cursor | 1, killed | 17 / 1 | [diff](logs/M11-cursor.diff) | [log](logs/M11-cursor.log.gz) |
+| M12-fence | 1, killed | 17 / 1 | [diff](logs/M12-fence.diff) | [log](logs/M12-fence.log.gz) |
+
+## Final review scope and packet
+
+Boyd reviews the three room cases, pure parser/export, README rows, new parser/room tests, and **the added read-only RUNNER_FILES mount for packages/bus/src/address.mjs**. mos-1567 authorizes that one sandbox source line and the sole old-test delta: project-runtime.test.mjs:17-18 adds exactly the Row265 comment and parser import pin (numstat 2 added / 0 deleted). Byte comparison against base after removing those additions proves all other old-test bytes unchanged. Removing the single RUNNER_FILES addition likewise restores sandbox.mjs to base. sandbox.test.mjs has no byte change. New address.test.mjs block proves the mounted parser source has no import word.
+
+The widened changed-file hash-context audit includes sandbox.mjs: [pin-context-with-sandbox.txt](pin-context-with-sandbox.txt), zero 64-hex-near-reference hits. The original reader and positive-control receipts remain alongside it; the missed source pin and first STOP remain recorded, not concealed. No role/schema/tester allowlist or helper change ships. BUILD-LOG and SESSIONS only append tracking entries.
+
+Base: `ec86f2c847f6154a0677c6ed23c87dabc2c665d0`. Branch: `goldie/row265`. MANIFEST.sha256 lists every changed source/test/tracking/evidence file except itself, with repository-relative paths, and is verified before commit/push. Raw first-red logs are retained separately from green reruns.
+
+Evidence packaging: logs are stored losslessly as `.log.gz`; decompress with `gzip -cd`. Decompression was byte-compared with each raw run log before packing. This preserves the original failure/Node whitespace while keeping the committed diff whitespace-clean. The run driver recreates raw `.log` files when used. Mutant busy-check headers identify only their own Python driver PID3686656 as BUSY; positive runs report CLEAR. The driver held the assigned slot throughout, with serialized child tests.
@@ -0,0 +1,51 @@
+996e9d0c1e7a8436691ce5d5d89b4eb940b07aafb3386f63a9847d203f43d998  BUILD-LOG.md
+26b5821895a152ddac66a26f16585c6c48ec71d99ca7e7c2b9a4d5a71943c5b4  agents/goldie/work/queue-265/BUILD.md
+1289c0f9f4e857590490a0972b5300cc8fb1a86e3ef79fe63e47472709e982f6  agents/goldie/work/queue-265/logs/01-address.log.gz
+bc0ac95454ca4a4478641832e68caeb82bfe8b1fdc9abc0b80f1126ef42b7be5  agents/goldie/work/queue-265/logs/02-rooms.log.gz
+459a45bd772576847338a438b27f4f578a2a660be744e1404fd239d192c6957c  agents/goldie/work/queue-265/logs/03-bus.log.gz
+c30cecb149e98d64f285e81a82d07a0a89dad5ea223f9031b543230615663bb5  agents/goldie/work/queue-265/logs/M01-human.diff
+a75e02d91ff46fbfaf627beea943183b769e417bcb572bf11f778f0fca7fcf29  agents/goldie/work/queue-265/logs/M01-human.log.gz
+b78b1c5b205272411710f56a981acf58dc09c46333369924b98c4c8657dc949c  agents/goldie/work/queue-265/logs/M02-tester.diff
+6a680dcb1db461cce3a3a2e066aa1245e4f84aa6754354058009bc0f6ebf4185  agents/goldie/work/queue-265/logs/M02-tester.log.gz
+02a6cfab404405099fc39eb83413614c67a0c4c3f87cd23c3849a35d1055ddb0  agents/goldie/work/queue-265/logs/M03-project.diff
+8b7cd0c568510e49b61fa14fce7b2680025b773eda884e0a84163d240a124e39  agents/goldie/work/queue-265/logs/M03-project.log.gz
+18b2cb43f2799301cf934e4c327bc1a03e08ff8d11ff590cb9677c86dfd43ff0  agents/goldie/work/queue-265/logs/M04-members.diff
+195f9ec57c9494552566d2f8b87f3b17a210b811f8b556dd65db89814e237816  agents/goldie/work/queue-265/logs/M04-members.log.gz
+a773e214c76acf5285ac4ca17cdd90dd552ddc79157abe75ef6de7f67a0b6a70  agents/goldie/work/queue-265/logs/M05-collision.diff
+1148cda3f6aaa7f6aeaab2f95c932114ddeac5bfd9318a6b77a4148079d486ed  agents/goldie/work/queue-265/logs/M05-collision.log.gz
+56400065c9cdb6305763b2bff8c0e06e9ae1223fa89b4467634a9951622d3fbe  agents/goldie/work/queue-265/logs/M06-open.diff
+b8f9bd9a5c488e604d0afe3feda4a2602359a94a49c7fdbd2f0f6a421b0ca1ce  agents/goldie/work/queue-265/logs/M06-open.log.gz
+2c1b745a15602cdcaf194131e4d6e0f8fa349e9712ce2e8cb6e695699e4ec19d  agents/goldie/work/queue-265/logs/M07-body.diff
+4857461e7a2ceb01a6446acb4708a732949a0d8d1a85fa2f6d10bedde6b9e11b  agents/goldie/work/queue-265/logs/M07-body.log.gz
+e3480e69d016caea6c1fbcdfa022b18214a10e8deca4409d0dc2f72261d2ee92  agents/goldie/work/queue-265/logs/M08-unknown.diff
+3d0f347f21df3c388a4f39679d4694aadc9684ae8b8ad2d30bf0bb316e48dcb0  agents/goldie/work/queue-265/logs/M08-unknown.log.gz
+62420ed20affcab256facee05414b8b760a4c79a60f60be0c06c88abb61ec6ae  agents/goldie/work/queue-265/logs/M09-ambiguous.diff
+14a18d61344df592e885c46ace34e0c59914f4fbe591fa99eeb3d81fa8ef8bf1  agents/goldie/work/queue-265/logs/M09-ambiguous.log.gz
+0671bf77394f82df92252275171fd9edea2e5b2e7143387840d03bda544676bf  agents/goldie/work/queue-265/logs/M10-messaging.diff
+4202215d40999e0d1cc98ebfb5445f0c8fd4688e6ca968e85d225723076ca8a7  agents/goldie/work/queue-265/logs/M10-messaging.log.gz
+042598ecb551e761d37af898f69e17ec137d2f39687dbf81ce5e1eeb98a38202  agents/goldie/work/queue-265/logs/M11-cursor.diff
+deff3d0514c379bd3d9c6f6bbc60db59b9dce2baaafd6fa611711c98cc8365ce  agents/goldie/work/queue-265/logs/M11-cursor.log.gz
+780e70fbcb2328006c8d9ace75aa62fcd0d935b4d758b50b0f5c5d5c55604122  agents/goldie/work/queue-265/logs/M12-fence.diff
+b629b41a39c028b70d4b847c351d248d6d70e8175d6d27f563b0ed8817f89642  agents/goldie/work/queue-265/logs/M12-fence.log.gz
+1b8c3cec31b44ff018a1bc74fef95996bcbdd21d340e2d2605154ba645648040  agents/goldie/work/queue-265/logs/rerun-00-sandbox.log.gz
+d18c5a9432de06ebec36c937da7dfb1a3e79dc397b33ff624058af351eee24dd  agents/goldie/work/queue-265/logs/rerun-01-address.log.gz
+d10b83ccec56e47d8c7c74d8304fc4fc87b8ea92a50098380cd02b8012c32d09  agents/goldie/work/queue-265/logs/rerun-02-rooms.log.gz
+6ff5955fe5c85f51c1cf4daeb8eddd61ef1a30e170221f99bfb08da8304d7e4a  agents/goldie/work/queue-265/logs/rerun-03-bus.log.gz
+eeba0182f06cee0c06cd15ecf7ef43aaeffd7149b2202cc0653078c20bb46198  agents/goldie/work/queue-265/logs/rerun-04-mutants-driver.log.gz
+5fe9fe35af60ef951c5c68b040aa9bb6067d9c746e143bb5782eb428acd4e4fe  agents/goldie/work/queue-265/logs/rerun-05-restored-address.log.gz
+2b3f3305ff5f6926a0269bd6c88d5f2e4a89727eefcf99625bebb51a70abb649  agents/goldie/work/queue-265/logs/rerun-05-restored-rooms.log.gz
+f11ae40d923affad1936fe51d05981ac201a1051bc9f877d75fc1d544c6e38f1  agents/goldie/work/queue-265/mutants.py
+e9cdf16670a16a14f3dd722a69c63a1785e4deb3608ee05d519b0ec8c1a9ca0b  agents/goldie/work/queue-265/pin-context-grep.txt
+491ba3bb25e918049249178f3c6a67b2b4f56a197f0a67059acb2420cd03b73c  agents/goldie/work/queue-265/pin-context-with-sandbox.txt
+784fb42bff187c0eebcf7756942ec3cf56f8faa7b54ce4ad96181b81fe46f0e9  agents/goldie/work/queue-265/pin-positive-control.txt
+766ead519eefbde958bbdbf77bf858b10dd1e3d9dee8ab5d356fe821ce7602fe  agents/goldie/work/queue-265/reader-grep.txt
+6c3c44eb943f33d5bb547f542c77da4d6f04e738056466bc491c2f6fd5f67946  docs/SESSIONS.md
+1ba33af1f42c88a5346d25fe915a44ee70a27fbc6b9ab880db0866cbdad5d45d  packages/bus/README.md
+232a1c77c2f17011c53b55fc6052f70985598210769d41d7c2c0b535328aad23  packages/bus/src/address.mjs
+71b32ee4afa322793aad81231441ee7badc3e5aff65ff008c6cc0f7f63b72781  packages/bus/src/broker.mjs
+ed57d48d2af4a225259e0a44c86a30b12792ec9f725dd9c89251569b7dc89e5a  packages/bus/src/index.mjs
+a6725ffe30d44981a9b9d3a3c319f7e96a46ec7bd74f0c8d869d9a798eca1a81  packages/bus/tests/address-cases.mjs
+fae431bc3743b224f69da33c4cebe376b47257d67f52d25d3ab0cb59f224a607  packages/bus/tests/address.test.mjs
+8594e94384c1c8b7234cfa8bbc17456cff86d9adef936cd1059a0d5a60e4546b  packages/bus/tests/project-runtime.test.mjs
+892c3709393fa8962710bc07565d1097bbd79ea1fbfda34af5f9385db34ed0fa  packages/bus/tests/rooms.test.mjs
+83019fa6b39ad9fd79b84627856b4dec82683d8261b8cba9b9ac840e0c489268  packages/seat/src/sandbox.mjs
@@ -0,0 +1,10 @@
+--- broker.original
+++ M01-human
+@@ -6423,7 +6423,6 @@
+       case 'room.open':
+       case 'room.send':
+       case 'room.read': {
+-        this.#human(s);
+         const opening = verb === 'room.open';
+         const sending = verb === 'room.send';
+         keys(a, opening ? ['project'] : sending ? ['project', 'body'] : ['project', 'after', 'limit'],
@@ -0,0 +1,12 @@
+--- broker.original
+++ M02-tester
+@@ -122,7 +122,8 @@
+ // Row 175 (#1673, Q173): the test system's reads and two writes, name.set and project.create,
+ // each recorded with `tester` as its actor. The organization branch keeps its own list below.
+ // Row 177 (#1675, Q173): the tester's own threads, owner `tester`, and a stop of their runs.
+-export const TESTER_VERBS = Object.freeze(['message.send', 'message.receive', 'message.read', 'inbox', 'agents', 'tasks', 'trail', 'decisions', 'messages', 'replies',
+export const TESTER_VERBS = Object.freeze([
+  'room.open', 'room.send', 'room.read','message.send', 'message.receive', 'message.read', 'inbox', 'agents', 'tasks', 'trail', 'decisions', 'messages', 'replies',
+   'usage', 'names', 'limits', 'plugins', 'instances', 'project.list', 'thread.list', 'name.set', 'project.create', 'credentials',
+   'thread.create', 'thread.open', 'thread.send', 'thread.messages', 'assistant.stop',
+   // Row 194 (#1692, D4.1): launch and terminate, and the read of the requests they make.
@@ -0,0 +1,10 @@
+--- broker.original
+++ M03-project
+@@ -6429,7 +6429,6 @@
+         keys(a, opening ? ['project'] : sending ? ['project', 'body'] : ['project', 'after', 'limit'],
+           sending ? ['project', 'body'] : ['project']);
+         const project = identifier(a.project);
+-        if (!this.#store.get('SELECT 1 FROM projects WHERE id=? AND business=?', project, s.business)) fail('project-not-found');
+         const members = Object.keys(b.roles).filter((instance) => this.#threaded(s.business, instance)).sort();
+         if (!members.length) fail('thread-instance-missing');
+         const owner = this.#owner(s);
@@ -0,0 +1,10 @@
+--- broker.original
+++ M04-members
+@@ -6431,7 +6431,6 @@
+         const project = identifier(a.project);
+         if (!this.#store.get('SELECT 1 FROM projects WHERE id=? AND business=?', project, s.business)) fail('project-not-found');
+         const members = Object.keys(b.roles).filter((instance) => this.#threaded(s.business, instance)).sort();
+-        if (!members.length) fail('thread-instance-missing');
+         const owner = this.#owner(s);
+         // Preflight all collisions/missing threads before open creates or send writes anything.
+         const threads = members.map((instance) => {
@@ -0,0 +1,11 @@
+--- broker.original
+++ M05-collision
+@@ -6436,8 +6436,6 @@
+         // Preflight all collisions/missing threads before open creates or send writes anything.
+         const threads = members.map((instance) => {
+           const t = this.#store.get('SELECT * FROM threads WHERE project=? AND name=?', project, instance);
+-          if (t && (t.instance !== instance || t.owner !== owner))
+-            fail(opening ? 'room-thread-name-taken' : 'room-not-open');
+           if (!t && !opening) fail('room-not-open');
+           return t ?? { instance, name: instance };
+         });
@@ -0,0 +1,10 @@
+--- broker.original
+++ M06-open
+@@ -6438,7 +6438,6 @@
+           const t = this.#store.get('SELECT * FROM threads WHERE project=? AND name=?', project, instance);
+           if (t && (t.instance !== instance || t.owner !== owner))
+             fail(opening ? 'room-thread-name-taken' : 'room-not-open');
+-          if (!t && !opening) fail('room-not-open');
+           return t ?? { instance, name: instance };
+         });
+         if (opening) {
@@ -0,0 +1,10 @@
+--- broker.original
+++ M07-body
+@@ -6450,7 +6450,6 @@
+         if (sending) {
+           string(a.body, 32768);
+           const addressed = parseAddress(a.body);
+-          if (!addressed.body.trim()) fail('invalid-request');
+           const selected = new Set();
+           for (const tag of addressed.tags) {
+             const candidates = new Set([this.#named(s.business, tag), tag].filter((instance) => members.includes(instance)));
@@ -0,0 +1,10 @@
+--- broker.original
+++ M08-unknown
+@@ -6454,7 +6454,6 @@
+           const selected = new Set();
+           for (const tag of addressed.tags) {
+             const candidates = new Set([this.#named(s.business, tag), tag].filter((instance) => members.includes(instance)));
+-            if (!candidates.size) fail('unknown-addressee');
+             if (candidates.size > 1) fail('addressee-ambiguous');
+             selected.add([...candidates][0]);
+           }
@@ -0,0 +1,10 @@
+--- broker.original
+++ M09-ambiguous
+@@ -6455,7 +6455,6 @@
+           for (const tag of addressed.tags) {
+             const candidates = new Set([this.#named(s.business, tag), tag].filter((instance) => members.includes(instance)));
+             if (!candidates.size) fail('unknown-addressee');
+-            if (candidates.size > 1) fail('addressee-ambiguous');
+             selected.add([...candidates][0]);
+           }
+           const targets = threads.filter((t) => !addressed.tags.length || selected.has(t.instance));
@@ -0,0 +1,10 @@
+--- broker.original
+++ M10-messaging
+@@ -6462,7 +6462,6 @@
+           const sessions = targets.map((t) => {
+             const session = this.#defaultSession(t.id);
+             this.#sessionFence(session);
+-            this.#checkMessaging(s.business, 'human', t.instance);
+             return session;
+           });
+           const at = this.#now();
@@ -0,0 +1,11 @@
+--- broker.original
+++ M11-cursor
+@@ -6488,7 +6488,7 @@
+             `SELECT m.seq FROM messages m JOIN message_threads mt ON mt.message=m.id WHERE m.id=? AND m.business=? AND mt.thread IN (${placeholders})`,
+             identifier(a.after), s.business, ...tids,
+           )?.seq;
+-          if (after === undefined) fail('message-not-found');
+          if (after === undefined) after = 0;
+         }
+         // At most one row per instance joins a group; one lookahead row completes the last page.
+         const rows = this.#store.all(
@@ -0,0 +1,10 @@
+--- broker.original
+++ M12-fence
+@@ -6461,7 +6461,6 @@
+           const targets = threads.filter((t) => !addressed.tags.length || selected.has(t.instance));
+           const sessions = targets.map((t) => {
+             const session = this.#defaultSession(t.id);
+-            this.#sessionFence(session);
+             this.#checkMessaging(s.business, 'human', t.instance);
+             return session;
+           });
@@ -0,0 +1,67 @@
+#!/usr/bin/env python3
+"""Slot-only runner. Every mutation restores and verifies the complete broker bytes."""
+from pathlib import Path
+import hashlib, os, re, subprocess, sys
+
+ROOT = Path(__file__).resolve().parents[4]
+SOURCE = ROOT / 'packages/bus/src/broker.mjs'
+OUT = Path(__file__).resolve().parent / 'logs'
+MUTANTS = [
+    ('M01-human', 'human-required', 'room verbs require the human', '        this.#human(s);\n', ''),
+    ('M02-tester', 'tester-refused', 'room verbs require the human', None, None),
+    ('M03-project', 'project-not-found', 'room verbs refuse missing projects', "        if (!this.#store.get('SELECT 1 FROM projects WHERE id=? AND business=?', project, s.business)) fail('project-not-found');\n", ''),
+    ('M04-members', 'thread-instance-missing', 'room verbs refuse missing projects', "        if (!members.length) fail('thread-instance-missing');\n", ''),
+    ('M05-collision', 'room-thread-name-taken', 'room.open preflights instance collisions', "          if (t && (t.instance !== instance || t.owner !== owner))\n            fail(opening ? 'room-thread-name-taken' : 'room-not-open');\n", ''),
+    ('M06-open', 'room-not-open', 'send/read refuse a missing canonical member', "          if (!t && !opening) fail('room-not-open');\n", ''),
+    ('M07-body', 'invalid-request', 'unknown or non-member addressees and tags-only bodies', "          if (!addressed.body.trim()) fail('invalid-request');\n", ''),
+    ('M08-unknown', 'unknown-addressee', 'unknown or non-member addressees and tags-only bodies', "            if (!candidates.size) fail('unknown-addressee');\n", ''),
+    ('M09-ambiguous', 'addressee-ambiguous', 'a legacy name colliding with another member key', "            if (candidates.size > 1) fail('addressee-ambiguous');\n", ''),
+    ('M10-messaging', 'message-sender-refused', 'messaging denial on the last target', "            this.#checkMessaging(s.business, 'human', t.instance);\n", ''),
+    ('M11-cursor', 'message-not-found', 'room.read groups one send, pages', "          if (after === undefined) fail('message-not-found');\n", '          if (after === undefined) after = 0;\n'),
+    ('M12-fence', 'session-clearing', 'a clearing last member fences the whole send', '            this.#sessionFence(session);\n', ''),
+]
+
+def sha(data): return hashlib.sha256(data).hexdigest()
+
+def main():
+    OUT.mkdir(exist_ok=True)
+    original = SOURCE.read_bytes()
+    text = original.decode()
+    start = text.index("      case 'room.open':")
+    end = text.index("      // A thread belongs", start)
+    block = text[start:end]
+    for name, refusal, expected, old, new in MUTANTS:
+        if old is None:
+            needle = 'export const TESTER_VERBS = Object.freeze(['
+            assert text.count(needle) == 1
+            changed = text.replace(needle, needle + "\n  'room.open', 'room.send', 'room.read',", 1)
+        else:
+            assert block.count(old) == 1, (name, block.count(old))
+            changed = text[:start] + block.replace(old, new, 1) + text[end:]
+        # Save conventional original→mutant diff without relying on shell interpolation.
+        import difflib
+        (OUT / f'{name}.diff').write_text(''.join(difflib.unified_diff(text.splitlines(True), changed.splitlines(True), fromfile='broker.original', tofile=name)))
+        tmp = subprocess.check_output(['mktemp', '-d', '/mnt/storage/scratch/tmp/XXXXXX'], text=True).strip()
+        env = {**os.environ, 'TMPDIR': tmp}
+        log = OUT / f'{name}.log'
+        try:
+            SOURCE.write_text(changed)
+            with log.open('w') as stream:
+                for command in [['date', '-u'], ['uptime'], ['bash', '-c', 'bash /mnt/storage/scratch/sage-busy-now.sh 2>/dev/null | tail -1']]:
+                    subprocess.run(command, cwd=ROOT, env=env, stdout=stream, stderr=subprocess.STDOUT, check=True)
+                stream.write(f'TMPDIR={tmp}\nmutant={name} refusal={refusal} original_sha256={sha(original)}\n')
+                stream.flush()
+                result = subprocess.run(['timeout', '-k', '10', '120', 'node', '--test', '--test-reporter=tap', 'packages/bus/tests/rooms.test.mjs'],
+                                        cwd=ROOT, env=env, stdout=stream, stderr=subprocess.STDOUT)
+            output = log.read_text()
+            killed = result.returncode == 1 and re.search(r'(?m)^not ok \d+ - ' + re.escape(expected), output)
+            print(f'{name}: exit={result.returncode} target_killed={bool(killed)} log={log}', flush=True)
+            if not killed: return 1
+        finally:
+            SOURCE.write_bytes(original)
+            assert SOURCE.read_bytes() == original
+            assert sha(SOURCE.read_bytes()) == sha(original)
+            with log.open('a') as stream: stream.write(f'RESTORED sha256={sha(original)}\n')
+    return 0
+
+if __name__ == '__main__': sys.exit(main())
@@ -0,0 +1 @@
+No changed-file mention has a literal 64-hex digest within eight lines.
@@ -0,0 +1 @@
+No changed-product-file mention has a literal 64-hex digest within eight lines.
@@ -0,0 +1,6 @@
+packages/bus/src/store.mjs:15:const ddl = readFileSync(new URL('../schema.sql', import.meta.url), 'utf8');
+packages/bus/src/store.mjs:16:export const SCHEMA_SHA256 = 'a2ba3a46f12e56139ecae9e55227d00847842aedec50c1d92aaae28844ca48e7';
+packages/bus/src/store.mjs:106:const hex = (value) => createHash('sha256').update(value).digest('hex');
+packages/bus/src/store.mjs:107:if (hex(ddl) !== SCHEMA_SHA256) throw Error('schema-source-mismatch');
+packages/bus/tests/schema.test.mjs:17:  db.exec(readFileSync(new URL('../schema.sql', import.meta.url), 'utf8'));
+packages/bus/tests/schema.test.mjs:90:  const hex = (s) => createHash('sha256').update(s).digest('hex');
@@ -0,0 +1,133 @@
+packages/bus/tests/session-compactions.test.mjs:9:import { Broker } from '../src/broker.mjs';
+packages/bus/tests/console-decide.test.mjs:14:import { Broker, CONSOLE_VERBS } from '../src/broker.mjs';
+packages/harness/tests/runner.test.mjs:14:import { Broker, BusError } from "../../bus/src/broker.mjs";
+packages/bus/tests/project-files.test.mjs:8:import { PROJECT_FILE_VERBS } from '../src/broker.mjs';
+packages/cli/tests/lifecycle.test.mjs:19:import { BusError } from "../../bus/src/broker.mjs";
+packages/bus/tests/lifecycle-verbs.test.mjs:11:import { Broker, LIFECYCLE_REQUEST_MS, TESTER_VERBS } from '../src/broker.mjs';
+packages/bus/tests/lifecycle-verbs.test.mjs:74:  for (const verb of ['instance.launch', 'instance.end', 'instance.request']) assert.ok(TESTER_VERBS.includes(verb), verb);
+packages/bus/tests/lifecycle-verbs.test.mjs:75:  assert.equal(TESTER_VERBS.includes('instance.regenerate'), false);
+packages/bus/tests/tasks.test.mjs:9:import { Broker, BusError, TASK_VERBS } from '../src/broker.mjs';
+packages/harness/tests/tools.test.mjs:4:import { ORGANIZATION_KEYS as BROKER_ORGANIZATION_KEYS, TASK_PAGE, TASK_PAGE_MAX } from "../../bus/src/broker.mjs";
+packages/seat/tests/session.test.mjs:11:import { Broker } from "../../bus/src/broker.mjs";
+packages/bus/tests/decision-route.test.mjs:12:import { Broker } from '../src/broker.mjs';
+packages/cli/tests/thread-launch.test.mjs:19:import { BusError } from "../../bus/src/broker.mjs";
+packages/seat/tests/sandbox.test.mjs:15:import { Broker } from "../../bus/src/broker.mjs";
+packages/bus/tests/host-run.test.mjs:16:import { Broker, ORGANIZATION_KEYS } from '../src/broker.mjs';
+packages/bus/tests/host-run.test.mjs:181:  // organization.set reaches the writer as limits.set (broker.mjs:1379).
+packages/cli/tests/helpers.mjs:10:import { BusError, Broker } from "../../bus/src/broker.mjs";
+packages/tasks/tests/fields.test.mjs:10:import { TASK_VERBS } from '../../bus/src/broker.mjs';
+packages/tasks/tests/fields.test.mjs:226:      // decision back to that role (broker.mjs, decision.raise).
+packages/webui/tests/instances.test.mjs:15:import { BusError } from '../../bus/src/broker.mjs';
+packages/cli/tests/tester-threads.test.mjs:14:import { BusError, Broker } from "../../bus/src/broker.mjs";
+packages/bus/tests/staff-request.test.mjs:8:import { Broker } from '../src/broker.mjs';
+packages/tasks/tests/world.mjs:5:import { Broker } from '../../bus/src/broker.mjs';
+packages/cli/tests/processing-cli.test.mjs:7:import { Broker } from '../../bus/src/broker.mjs';
+packages/bus/tests/grant-host.test.mjs:10:import { Broker, registrySha256 } from '../src/broker.mjs';
+packages/business/tests/workflow-roles.test.mjs:115:    // Q169 (broker.mjs END_PROTECTED, #hardWait): revoking the assistant is a hard wait as well.
+packages/business/tests/workflow-roles.test.mjs:136:  // sage-0709: only recordLand spends a decision (broker.mjs #spent). checkLand refuses decision-consumed after
+packages/cli/tests/thread-revoke.test.mjs:18:import { BusError } from "../../bus/src/broker.mjs";
+packages/bus/tests/tester-writes.test.mjs:10:import { Broker, TESTER_VERBS, TESTER_ORGANIZATION_VERBS } from '../src/broker.mjs';
+packages/bus/tests/tester-writes.test.mjs:18:test('row 175: TESTER_VERBS and the organization branch tester set are pinned', () => {
+packages/bus/tests/tester-writes.test.mjs:19:  assert.deepEqual([...TESTER_VERBS], [
+packages/bus/tests/tester-writes.test.mjs:32:  assert.ok(Object.isFrozen(TESTER_VERBS) && Object.isFrozen(TESTER_ORGANIZATION_VERBS));
+packages/cli/tests/stack-release.test.mjs:1993: for(const [f,text] of [['packages/cli/src/cli.mjs',id===A?'// fixture host from before row 163\nprocess.exit(1);\n':script(rHost)],['packages/webui/src/cli.mjs',script(rConsole)],['packages/bus/src/store.mjs',rStore(v,froms)],['packages/bus/src/migrate-schema.mjs',script(rMigrate)],['packages/bus/src/broker.mjs','export class BusError extends Error { constructor(code) { super(code); this.code = code; } }\n']]){mkdirSync(dirname(join(d,f)),{recursive:true});writeFileSync(join(d,f),text)}
+packages/cli/tests/session-cli.test.mjs:94:  const { Broker } = await import('../../bus/src/broker.mjs');
+packages/cli/tests/session-launch.test.mjs:21:import { BusError } from "../../bus/src/broker.mjs";
+packages/cli/tests/revoke-window.test.mjs:19:import { BusError } from "../../bus/src/broker.mjs";
+packages/bus/tests/chief-of-staff.test.mjs:10:import { Broker, ACTIONS } from '../src/broker.mjs';
+packages/cli/tests/instances.test.mjs:13:import { BusError } from "../../bus/src/broker.mjs";
+packages/cli/tests/thread-cli.test.mjs:14:import { BusError, Broker } from "../../bus/src/broker.mjs";
+packages/bus/tests/processing.test.mjs:6:import { Broker } from '../src/broker.mjs';
+packages/cli/tests/idle-stop-race.test.mjs:17:import { BusError } from "../../bus/src/broker.mjs";
+packages/cli/tests/tester-reads.test.mjs:12:import { BusError } from "../../bus/src/broker.mjs";
+packages/cli/tests/session-clear.test.mjs:18:import { BusError } from "../../bus/src/broker.mjs";
+packages/bus/tests/names.test.mjs:8:import { Broker } from '../src/broker.mjs';
+packages/cli/tests/compactions-launch.test.mjs:24:import { BusError } from "../../bus/src/broker.mjs";
+packages/cli/tests/tester.test.mjs:7:import { BusError, Broker } from "../../bus/src/broker.mjs";
+packages/bus/tests/reload.test.mjs:9:import { Broker } from '../src/broker.mjs';
+packages/bus/tests/agents.test.mjs:9:import { Broker } from '../src/broker.mjs';
+packages/bus/tests/end-launch.test.mjs:9:import { Broker } from '../src/broker.mjs';
+packages/webui/tests/decide-browser.test.mjs:14:import { Broker } from '../../bus/src/broker.mjs';
+packages/bus/tests/credential-verbs.test.mjs:11:import { Broker, CREDENTIAL_VERBS } from '../src/broker.mjs';
+packages/webui/tests/send-browser.test.mjs:13:import { Broker } from '../../bus/src/broker.mjs';
+packages/bus/tests/launch-notice.test.mjs:8:import { Broker } from '../src/broker.mjs';
+packages/bus/tests/messages.test.mjs:3:import { Broker } from '../src/broker.mjs';
+packages/bus/tests/workflow-roles.test.mjs:11:import { Broker } from '../src/broker.mjs';
+packages/bus/tests/library-sync.test.mjs:11:import { Broker, LIBRARY_VERBS } from '../src/broker.mjs';
+packages/bus/tests/credential-status.test.mjs:12:import { Broker } from '../src/broker.mjs';
+packages/bus/tests/gitea-grant-docker.test.mjs:15:import { Broker, GRANT_EVIDENCE } from '../src/broker.mjs';
+packages/bus/tests/thread-migration.test.mjs:11:import { Broker } from '../src/broker.mjs';
+packages/bus/tests/comment-cursors.test.mjs:7:import { Broker } from '../src/broker.mjs';
+packages/bus/tests/thread-claims.test.mjs:11:import { Broker } from '../src/broker.mjs';
+packages/bus/tests/state.test.mjs:7:import { Broker, TASK_PAGE } from '../src/broker.mjs';
+packages/bus/tests/access-revoke.test.mjs:14:import { Broker } from '../src/broker.mjs';
+packages/bus/tests/plugins-verb.test.mjs:9:import { Broker } from '../src/broker.mjs';
+packages/bus/tests/transport.test.mjs:8:import { Broker } from '../src/broker.mjs';
+packages/bus/tests/publish.test.mjs:14:import { Broker } from '../src/broker.mjs';
+packages/bus/tests/publish.test.mjs:221:  const { ACTIONS, HARD_WAITS } = await import('../src/broker.mjs');
+packages/bus/tests/tester-threads.test.mjs:11:import { Broker } from '../src/broker.mjs';
+packages/bus/tests/tester-threads.test.mjs:284:  // The row #specNotice (broker.mjs) writes for a human save of the spec in project stack. The save
+packages/bus/tests/approval-binding.test.mjs:7:import { Broker } from '../src/broker.mjs';
+packages/bus/tests/fire-revokes-grants.test.mjs:15:import { Broker, GRANT_EVIDENCE, registrySha256 } from '../src/broker.mjs';
+packages/bus/tests/daily-quota-runtime.test.mjs:10:import { Broker } from '../src/broker.mjs';
+packages/bus/tests/limit-checks.test.mjs:323:  for (const file of ['../src/runtime.mjs', '../src/broker.mjs', '../src/process.mjs']) {
+packages/bus/tests/spec-fixtures.mjs:6:import { Broker } from '../src/broker.mjs';
+packages/bus/tests/decisions.test.mjs:9:import { Broker, RECENT } from '../src/broker.mjs';
+packages/bus/tests/peer-transport.test.mjs:9:import { BusError } from '../src/broker.mjs';
+packages/bus/tests/peer-transport.test.mjs:47: const {TASK_VERBS,BusError}=await import('../src/broker.mjs');
+packages/bus/tests/messaging.test.mjs:8:import { Broker } from '../src/broker.mjs';
+packages/bus/tests/rooms.test.mjs:8:import { Broker, THREAD_PAGE, THREAD_PAGE_MAX, TESTER_VERBS } from '../src/broker.mjs';
+packages/bus/tests/rooms.test.mjs:80:    assert.ok(!TESTER_VERBS.includes(verb));
+packages/bus/tests/web.test.mjs:8:import { Broker, BusError, WEB_UNTRUSTED } from '../src/broker.mjs';
+packages/bus/tests/replies.test.mjs:11:import { Broker, REPLIES } from '../src/broker.mjs';
+packages/bus/tests/thread-shares.test.mjs:14:import { Broker } from '../src/broker.mjs';
+packages/bus/tests/message-citation.test.mjs:6:import { Broker } from '../src/broker.mjs';
+packages/bus/tests/limits.test.mjs:7:import {Broker} from '../src/broker.mjs';
+packages/bus/tests/host-fixtures.mjs:6:import { registrySha256, writeGrantEvent } from '../src/broker.mjs';
+packages/bus/tests/gitea-grant.test.mjs:12:import { Broker, GRANT_EVIDENCE, writeGrantEvent } from '../src/broker.mjs';
+packages/bus/tests/csuite-messaging.test.mjs:12:import { Broker } from '../src/broker.mjs';
+packages/bus/tests/decision-close.test.mjs:9:import { Broker } from '../src/broker.mjs';
+packages/bus/tests/grant-scope.test.mjs:14:import { Broker, GRANT_EVIDENCE, writeGrantEvent } from '../src/broker.mjs';
+packages/bus/tests/project-await.test.mjs:7:import { Broker, BusError } from '../src/broker.mjs';
+packages/bus/tests/launcher-released.test.mjs:8:import { Broker } from '../src/broker.mjs';
+packages/bus/tests/limit-stop.test.mjs:12:import { Broker } from '../src/broker.mjs';
+packages/bus/tests/message-filter.test.mjs:12:import { Broker, REPLIES } from '../src/broker.mjs';
+packages/bus/tests/land.test.mjs:18:import { Broker } from '../src/broker.mjs';
+packages/bus/tests/single-use.test.mjs:7:import { Broker } from '../src/broker.mjs';
+packages/bus/tests/session-clear.test.mjs:10:import { Broker } from '../src/broker.mjs';
+packages/bus/tests/grant-migration.test.mjs:10:import { Broker } from '../src/broker.mjs';
+packages/bus/tests/usage-broker.test.mjs:7:import { Broker } from '../src/broker.mjs';
+packages/bus/tests/project-runtime.test.mjs:13:  const source = readFileSync(new URL('../src/broker.mjs', import.meta.url), 'utf8');
+packages/bus/tests/task-read.test.mjs:7:import { Broker } from '../src/broker.mjs';
+packages/bus/tests/library.test.mjs:8:import { Broker } from '../src/broker.mjs';
+packages/bus/tests/instances-verb.test.mjs:11:import { Broker, LIFECYCLE_HUMAN_VERBS, ORGANIZATION_KEYS, TESTER_ORGANIZATION_VERBS } from '../src/broker.mjs';
+packages/bus/tests/routes-verb.test.mjs:13:import { Broker, ORGANIZATION_KEYS } from '../src/broker.mjs';
+packages/bus/tests/broker.test.mjs:10:const { Broker } = await import('../src/broker.mjs').catch((e) => {
+packages/bus/tests/grant-enroll.test.mjs:10:import { Broker, BusError, writeGrantEvent, registrySha256 } from '../src/broker.mjs';
+packages/bus/tests/hard-waits.test.mjs:7:import { Broker, ACTIONS, HARD_WAITS } from '../src/broker.mjs';
+packages/bus/tests/requirements.test.mjs:10:import { Broker } from '../src/broker.mjs';
+packages/bus/tests/grant-executor.test.mjs:15:import { Broker, registrySha256, writeGrantEvent } from '../src/broker.mjs';
+packages/bus/tests/sessions.test.mjs:10:import { Broker } from '../src/broker.mjs';
+packages/bus/tests/user-principal.test.mjs:14:  Broker, ACTIONS, USER_VERBS, TESTER_VERBS, TASK_VERBS, WEB_VERBS, HOST_VERBS, HOSTS_VERBS, CREDENTIAL_VERBS,
+packages/bus/tests/user-principal.test.mjs:16:} from '../src/broker.mjs';
+packages/bus/tests/user-principal.test.mjs:137:    ...ACTIONS, ...TESTER_VERBS, ...TESTER_ORGANIZATION_VERBS, ...PROJECT_FILE_VERBS, ...LIBRARY_VERBS, ...CREDENTIAL_VERBS, ...HOSTS_VERBS,
+packages/bus/tests/tester.test.mjs:10:import { Broker, TASK_VERBS } from '../src/broker.mjs';
+packages/bus/tests/threads.test.mjs:9:import { Broker, THREAD_PAGE } from '../src/broker.mjs';
+packages/webui/tests/routes-browser.test.mjs:15:import {BusError} from '../../bus/src/broker.mjs';
+packages/bus/tests/creative.test.mjs:8:import { Broker } from '../src/broker.mjs';
+packages/webui/tests/granted-user.test.mjs:16:import { Broker } from '../../bus/src/broker.mjs';
+packages/bus/tests/task-page.test.mjs:7:import { Broker, TASK_PAGE, TASK_PAGE_MAX } from '../src/broker.mjs';
+packages/webui/tests/user-option-swap.test.mjs:14:import { Broker } from '../../bus/src/broker.mjs';
+packages/webui/tests/board-held.test.mjs:20:import { Broker } from '../../bus/src/broker.mjs';
+packages/webui/tests/chat-sessions-access.test.mjs:10:import { Broker } from '../../bus/src/broker.mjs';
+packages/bus/tests/review.test.mjs:14:import { Broker } from '../src/broker.mjs';
+packages/webui/tests/sso-browser.test.mjs:14:import { Broker } from '../../bus/src/broker.mjs';
+packages/bus/tests/revoke-window.test.mjs:13:import { Broker } from '../src/broker.mjs';
+packages/webui/tests/bus.test.mjs:13:import { Broker } from '../../bus/src/broker.mjs';
+packages/bus/tests/viewer.test.mjs:13:  Broker, ACTIONS, USER_VERBS, VIEWER_VERBS, BOARD_VERBS, TESTER_VERBS, TESTER_ORGANIZATION_VERBS, PROJECT_FILE_VERBS,
+packages/bus/tests/viewer.test.mjs:14:} from '../src/broker.mjs';
+packages/bus/tests/viewer.test.mjs:116:  const others = new Set([...ACTIONS, ...TESTER_VERBS, ...TESTER_ORGANIZATION_VERBS, ...PROJECT_FILE_VERBS, ...BOARD_VERBS, 'no.such.verb']);
+packages/webui/tests/tester-fixture.mjs:12:import { Broker, BusError } from '../../bus/src/broker.mjs';
+packages/webui/tests/routes.test.mjs:12:import { BusError } from '../../bus/src/broker.mjs';
+packages/webui/tests/chat.test.mjs:191:  const { Broker } = await import('../../bus/src/broker.mjs');
+packages/webui/tests/bus-browser.test.mjs:11:import { Broker } from '../../bus/src/broker.mjs';
@@ -0,0 +1,69 @@
+# Row 322 / #1818 — F8 and F9
+
+Goldie, 2026-10-23. Branch goldie/row322, base 833ec1cc8d7c11842efb82e57c1a0b256c8d22d7.
+Brief: docs/plans/2026-10-23_host-fixes-1816-brief.md, F8/F9 section at 7333f94ba9cf.
+Issue #1818 is supplied by Sage; no new issue is needed. Reviewer Morgana; Sage owns landing/full gate.
+
+## Implementation and authority
+
+F8 runs the importer from `$COPIES/$COMMIT/scripts/case2-persona-import.mjs`. This uses Node's normal ESM resolution, finding yaml beside the copy and the relative harness module in that same commit. It avoids a custom loader or ambient resolution setting. The copy closure already includes harness/src and business/src, but omitted the importer itself; COPY_PATHS now includes that one script. No new dependency or dependency version change.
+
+F9 selects the first line beginning with an Error type (including TypeError etc.) or ERR_, falling back to the last line for the importer's handled refusal. awk exits after the first matching line and emits exactly one line, keeping the stack and version banner out of the install refusal. Anchoring avoids selecting Node's earlier `throw new ERR_MODULE_NOT_FOUND(...)` source excerpt instead of the actual Error line.
+
+Mos-1550 authorizes the copy-path addition, setup-only additions to world(t), and adding the single new filename to any existing copy-file pin. Existing test edits outside the appended row-322 block:
+
+- case2-install.test.mjs: the fake stack-copy setup gains a loop copying the importer, harness bundle.mjs/tools.mjs, and business vocabulary.mjs; it copies yaml into the fake copy's node_modules. The existing last template-string line is extended to add those setup commands. No existing assertion changes.
+- packages/webui/tests/pinned-copy.test.mjs:76: the scripts file-list assertion gains only `case2-persona-import.mjs`, in sorted order. No other change in this test.
+
+The new append-only block builds a scratch clone outside the repository with no node_modules, real installer and importer, stubbed bootstrap/business validation, and a copy with the real importer, relative module closure and yaml. F8 checks installed persona bytes/mode; F9 removes yaml from that copy to produce a real uncaught Node missing-package error, then checks one refusal line carries the cause and no stack/banner. Existing tests missed F8 because the real importer ran from the development checkout, which has yaml installed; the fake copy held only scripts/mosaic. The old fixtures thus never exercised the dependency boundary or an uncaught importer load error.
+
+## Class check and copy-test audit
+
+Before change:
+
+```
+grep -n 'node "$REPO/' scripts/case2-install.sh scripts/case2-precheck.sh scripts/stack-copy.sh
+scripts/case2-install.sh:185:        out="$(node "$REPO/scripts/case2-persona-import.mjs" ...
+```
+
+After change: same grep has no hits (exit 1). Direct clone-side .mjs entry points in the three scripts with a bare package import: **scripts/case2-persona-import.mjs → yaml**, moved to the copy by F8. No other direct entry point imports a bare package. Precheck's inline Node programs dynamically import cli/src/config.mjs, business/src/index.mjs, library/src/index.mjs and cli/src/cli.mjs; those entry files import builtins/relative modules only. Library reader.mjs uses its own front-matter parser and has no yaml import. stack-copy sources instance.sh, whose mosaic-config.mjs imports builtins only. Installer bootstrap likewise runs mosaic-config.mjs, and business validation runs business/src/cli.mjs, also no direct bare imports. No other product fix made.
+
+Audit commands (read-only):
+
+```
+rg -n 'COPY_PATHS|copy carries|copy.*(hash|sha256|files|file set)|sha256.*copy' packages/*/tests/* scripts/test-*.sh
+rg -n 'COPY_PATHS|stack-copy\.sh|readdirSync|sha256|deepEqual' packages/webui/tests/pinned-copy.test.mjs packages/cli/tests/stack-copy.test.mjs
+```
+
+Relevant hits: cli/tests/stack-copy.test.mjs:35-47 checks harness file closure (positive control: COPY_PATHS at :36), :52 asserts a required-file subset, :248-264 computes hashes/modes and compares bundle/check-out copy trees dynamically, :274 compares another bundle tree. None freezes a complete path list/hash. webui/tests/pinned-copy.test.mjs:75 pins top-level entries (unchanged), :76 pins scripts' exact file set (approved one-path update). Other readdir hits in those files check cleanup/existing-target behavior, not COPY_PATHS identity. Broad initial grep also hits business/tests/helpers.mjs:33, cli/tests/stack-upgrade.test.mjs:295, webui/tests/views.test.mjs:172, cli/tests/stack-release.test.mjs:1751 and :1987; inspected contexts are unrelated comments/UI copy or different fixture copies. No scripts/test-*.sh hit for these path/hash patterns.
+
+## Verification plan
+
+Pending Sage CLEAR before any test: run new tests on fixed build first, then whole case2-install.test.mjs, whole stack-copy.test.mjs and webui pinned-copy.test.mjs. Demonstrate expected failure at 094124b4e with new block applied (baseline importer path), and kill the `$REPO` reversion mutant. Record all outcomes. First unexpected new-test red is recorded/reported under mos-1272; existing-test edits outside mos-1550 or a second unexpected red stop for Sage.
+
+No tests run yet. No commit/push yet. No host changes, live state, secrets, deploy or release actions.
+
+## Verified results — sage-3808 CLEAR, 2026-10-23T22:47Z
+
+All runs were serialized with `TMPDIR=/mnt/storage/scratch/tmp/goldieuQ2664` (created by `mktemp -d /mnt/storage/scratch/tmp/goldieXXXXXX`), using `timeout -k 10 90` for focused tests and `timeout -k 10 180` for whole files/negative-proof driver. Node v26.8.1. Dependencies were read through the ignored, uncommitted node_modules symlink approved by sage-3804; each scratch clone had no node_modules. No /tmp fixture was used.
+
+| Run | Result | Evidence |
+| --- | --- | --- |
+| New tests, first run | 2/2 pass, exit 0 | test-new.log |
+| Whole case2-install.test.mjs | 26/26 pass, exit 0 | test-install.log |
+| Whole stack-copy.test.mjs | 18/18 pass, exit 0 | test-copy.log |
+| Whole webui pinned-copy.test.mjs | 10/10 pass, exit 0 | test-pinned-copy.log |
+| Installer from 094124b4e, new tests | 0/2 pass, exit 1, expected red | baseline-094124b4e.log |
+| F8 mutant: restore `$REPO` importer path only | 0/1 pass, exit 1, killed | mutant-F8.log |
+| F9 mutant: restore tail-only refusal only | 0/1 pass, exit 1, killed | mutant-F9.log |
+| Fixed installer restored, new tests rerun | 2/2 pass, exit 0 | test-restored.log |
+
+The baseline proof temporarily installs the exact installer bytes from `git show 094124b4e:scripts/case2-install.sh`, retaining the newly appended tests and approved fixture setup. Relevant installer/importer/copy/test source paths have no changes between N and the branch base 833ec1cc8 (`git diff 094124b4e 833ec1cc8 --` those paths is empty). It is a targeted baseline proof, not a full checkout/suite run at N. Baseline failures show `persona-import: Node.js v26.8.1`; the F8-only mutant exposes the underlying `Error [ERR_MODULE_NOT_FOUND]: Cannot find package 'yaml'` from the scratch clone. F9-only mutant again prints the banner. All expected failures are deliberate acceptance checks; no unexpected first-run red occurred.
+
+negative-proof.py records each run, checks the expected failure count/exit, restores in a finally block, and verifies fixed installer bytes after each run. Restored SHA-256 each time: `c23a08324528cc29895014093c661948a5c8eb40316c7b2e21c6f833cf5d6462`. Final focused green confirms restoration. git diff --check passed.
+
+`git diff --numstat -- packages/cli/tests/case2-install.test.mjs`: **57 additions, 1 deletion**. Outside the new appended block, original line 70's template-string close moves after four new setup lines: the existing mkdir/empty mosaic/echo command is unchanged, followed by the `for file ...` line, mkdir/cp loop body, `done`, and mkdir/cp yaml line. All pre-existing assertions remain byte-for-byte unchanged. The only pre-existing assertion edit anywhere is the expressly approved one-filename addition at packages/webui/tests/pinned-copy.test.mjs:76.
+
+Sage's full package/script gate and Morgana's review remain pending. This builder ran only the approved three whole test files and targeted acceptance checks. Sage retains queue transition/review posting and integration authority; no PR was created by Goldie.
+
+Evidence log lines have trailing whitespace removed for git diff --check; test content and outcomes are unchanged.
@@ -0,0 +1,4 @@
+c23a08324528cc29895014093c661948a5c8eb40316c7b2e21c6f833cf5d6462  scripts/case2-install.sh
+cb1a4fef997b9696406e324878d7a0e5181892622162c9ce77a8fd625b5cd59a  scripts/stack-copy.sh
+a7b02af4b5df92e6d727fe8c67565ea0483d6d57531765dee68f54fd97e7c23f  packages/cli/tests/case2-install.test.mjs
+2574b414459f4cfb187de64b9a2fbe34ab4b4d64f582caae8baf6a1985e8cd3c  packages/webui/tests/pinned-copy.test.mjs
@@ -0,0 +1,70 @@
+TAP version 13
+# Subtest: row 322 F8: library personas install from the copy with no clone node_modules
+not ok 1 - row 322 F8: library personas install from the copy with no clone node_modules
+  ---
+  duration_ms: 90.885888
+  type: 'test'
+  location: '/home/jwoltje/.t3/worktrees/mosaic-stack/goldie-row322/packages/cli/tests/case2-install.test.mjs:451:1'
+  failureType: 'testCodeFailure'
+  error: |-
+    case2-install: config /mnt/storage/scratch/tmp/goldieuQ2664/case2-install-rQM4ct/home/.config/mosaic-dev/config.json
+    case2-install: copy /mnt/storage/scratch/tmp/goldieuQ2664/case2-install-rQM4ct/home/.local/share/mosaic-stack/copies/cccccccccccccccccccccccccccccccccccccccc
+    case2-install: refused: persona-import: Node.js v26.8.1
+
+
+    1 !== 0
+
+  code: 'ERR_ASSERTION'
+  name: 'AssertionError'
+  expected: 0
+  actual: 1
+  operator: 'strictEqual'
+  stack: |-
+    TestContext.<anonymous> (file:///home/jwoltje/.t3/worktrees/mosaic-stack/goldie-row322/packages/cli/tests/case2-install.test.mjs:454:10)
+    Test.runInAsyncScope (node:async_hooks:226:14)
+    Test.run (node:internal/test_runner/test:1402:25)
+    Test.start (node:internal/test_runner/test:1262:17)
+    startSubtestAfterBootstrap (node:internal/test_runner/harness:387:17)
+  ...
+# Subtest: row 322 F9: importer refusal keeps the error line rather than the Node banner
+not ok 2 - row 322 F9: importer refusal keeps the error line rather than the Node banner
+  ---
+  duration_ms: 91.239243
+  type: 'test'
+  location: '/home/jwoltje/.t3/worktrees/mosaic-stack/goldie-row322/packages/cli/tests/case2-install.test.mjs:462:1'
+  failureType: 'testCodeFailure'
+  error: |-
+    The input did not match the regular expression /persona-import: Error \[ERR_MODULE_NOT_FOUND\]: Cannot find package 'yaml'/. Input:
+
+    'case2-install: config /mnt/storage/scratch/tmp/goldieuQ2664/case2-install-O6VWs2/home/.config/mosaic-dev/config.json\n' +
+      'case2-install: copy /mnt/storage/scratch/tmp/goldieuQ2664/case2-install-O6VWs2/home/.local/share/mosaic-stack/copies/cccccccccccccccccccccccccccccccccccccccc\n' +
+      'case2-install: refused: persona-import: Node.js v26.8.1\n'
+
+  code: 'ERR_ASSERTION'
+  name: 'AssertionError'
+  expected:
+  actual: |-
+    case2-install: config /mnt/storage/scratch/tmp/goldieuQ2664/case2-install-O6VWs2/home/.config/mosaic-dev/config.json
+    case2-install: copy /mnt/storage/scratch/tmp/goldieuQ2664/case2-install-O6VWs2/home/.local/share/mosaic-stack/copies/cccccccccccccccccccccccccccccccccccccccc
+    case2-install: refused: persona-import: Node.js v26.8.1
+
+  operator: 'match'
+  stack: |-
+    refused (file:///home/jwoltje/.t3/worktrees/mosaic-stack/goldie-row322/packages/cli/tests/case2-install.test.mjs:137:10)
+    TestContext.<anonymous> (file:///home/jwoltje/.t3/worktrees/mosaic-stack/goldie-row322/packages/cli/tests/case2-install.test.mjs:469:3)
+    Test.runInAsyncScope (node:async_hooks:226:14)
+    Test.run (node:internal/test_runner/test:1402:25)
+    Test.processPendingSubtests (node:internal/test_runner/test:974:18)
+    Test.postRun (node:internal/test_runner/test:1542:19)
+    Test.run (node:internal/test_runner/test:1467:12)
+    async startSubtestAfterBootstrap (node:internal/test_runner/harness:387:3)
+  ...
+1..2
+# tests 2
+# suites 0
+# pass 0
+# fail 2
+# cancelled 0
+# skipped 0
+# todo 0
+# duration_ms 287.462723
@@ -0,0 +1,37 @@
+TAP version 13
+# Subtest: row 322 F8: library personas install from the copy with no clone node_modules
+not ok 1 - row 322 F8: library personas install from the copy with no clone node_modules
+  ---
+  duration_ms: 90.468116
+  type: 'test'
+  location: '/home/jwoltje/.t3/worktrees/mosaic-stack/goldie-row322/packages/cli/tests/case2-install.test.mjs:451:1'
+  failureType: 'testCodeFailure'
+  error: |-
+    case2-install: config /mnt/storage/scratch/tmp/goldieuQ2664/case2-install-bzVkal/home/.config/mosaic-dev/config.json
+    case2-install: copy /mnt/storage/scratch/tmp/goldieuQ2664/case2-install-bzVkal/home/.local/share/mosaic-stack/copies/cccccccccccccccccccccccccccccccccccccccc
+    case2-install: refused: persona-import: Error [ERR_MODULE_NOT_FOUND]: Cannot find package 'yaml' imported from /mnt/storage/scratch/tmp/goldieuQ2664/case2-install-bzVkal/clone/scripts/case2-persona-import.mjs
+
+
+    1 !== 0
+
+  code: 'ERR_ASSERTION'
+  name: 'AssertionError'
+  expected: 0
+  actual: 1
+  operator: 'strictEqual'
+  stack: |-
+    TestContext.<anonymous> (file:///home/jwoltje/.t3/worktrees/mosaic-stack/goldie-row322/packages/cli/tests/case2-install.test.mjs:454:10)
+    Test.runInAsyncScope (node:async_hooks:226:14)
+    Test.run (node:internal/test_runner/test:1402:25)
+    Test.start (node:internal/test_runner/test:1262:17)
+    startSubtestAfterBootstrap (node:internal/test_runner/harness:387:17)
+  ...
+1..1
+# tests 1
+# suites 0
+# pass 0
+# fail 1
+# cancelled 0
+# skipped 0
+# todo 0
+# duration_ms 194.231229
@@ -0,0 +1,41 @@
+TAP version 13
+# Subtest: row 322 F9: importer refusal keeps the error line rather than the Node banner
+not ok 1 - row 322 F9: importer refusal keeps the error line rather than the Node banner
+  ---
+  duration_ms: 92.814376
+  type: 'test'
+  location: '/home/jwoltje/.t3/worktrees/mosaic-stack/goldie-row322/packages/cli/tests/case2-install.test.mjs:462:1'
+  failureType: 'testCodeFailure'
+  error: |-
+    The input did not match the regular expression /persona-import: Error \[ERR_MODULE_NOT_FOUND\]: Cannot find package 'yaml'/. Input:
+
+    'case2-install: config /mnt/storage/scratch/tmp/goldieuQ2664/case2-install-6HcR0m/home/.config/mosaic-dev/config.json\n' +
+      'case2-install: copy /mnt/storage/scratch/tmp/goldieuQ2664/case2-install-6HcR0m/home/.local/share/mosaic-stack/copies/cccccccccccccccccccccccccccccccccccccccc\n' +
+      'case2-install: refused: persona-import: Node.js v26.8.1\n'
+
+  code: 'ERR_ASSERTION'
+  name: 'AssertionError'
+  expected:
+  actual: |-
+    case2-install: config /mnt/storage/scratch/tmp/goldieuQ2664/case2-install-6HcR0m/home/.config/mosaic-dev/config.json
+    case2-install: copy /mnt/storage/scratch/tmp/goldieuQ2664/case2-install-6HcR0m/home/.local/share/mosaic-stack/copies/cccccccccccccccccccccccccccccccccccccccc
+    case2-install: refused: persona-import: Node.js v26.8.1
+
+  operator: 'match'
+  stack: |-
+    refused (file:///home/jwoltje/.t3/worktrees/mosaic-stack/goldie-row322/packages/cli/tests/case2-install.test.mjs:137:10)
+    TestContext.<anonymous> (file:///home/jwoltje/.t3/worktrees/mosaic-stack/goldie-row322/packages/cli/tests/case2-install.test.mjs:469:3)
+    Test.runInAsyncScope (node:async_hooks:226:14)
+    Test.run (node:internal/test_runner/test:1402:25)
+    Test.start (node:internal/test_runner/test:1262:17)
+    startSubtestAfterBootstrap (node:internal/test_runner/harness:387:17)
+  ...
+1..1
+# tests 1
+# suites 0
+# pass 0
+# fail 1
+# cancelled 0
+# skipped 0
+# todo 0
+# duration_ms 200.516406
@@ -0,0 +1,6 @@
+baseline-094124b4e: exit 1, expected failures 2
+restored sha256 c23a08324528cc29895014093c661948a5c8eb40316c7b2e21c6f833cf5d6462
+mutant-F8: exit 1, expected failures 1
+restored sha256 c23a08324528cc29895014093c661948a5c8eb40316c7b2e21c6f833cf5d6462
+mutant-F9: exit 1, expected failures 1
+restored sha256 c23a08324528cc29895014093c661948a5c8eb40316c7b2e21c6f833cf5d6462
@@ -0,0 +1,39 @@
+"""Run row-322 expected-red proofs, always restoring installer bytes."""
+import hashlib
+import os
+from pathlib import Path
+import subprocess
+
+root = Path(__file__).resolve().parents[4]
+installer = root / 'scripts/case2-install.sh'
+logs = Path(__file__).resolve().parent
+fixed = installer.read_bytes()
+baseline = subprocess.check_output(['git', 'show', '094124b4e:scripts/case2-install.sh'], cwd=root)
+f8 = fixed.replace(b'$COPIES/$COMMIT/scripts/case2-persona-import.mjs', b'$REPO/scripts/case2-persona-import.mjs')
+assert f8 != fixed
+old_error = baseline.splitlines()[185]
+new_error = fixed.splitlines()[185]
+f9 = fixed.replace(new_error, old_error)
+assert f9 != fixed
+try:
+    for label, source, pattern, failures in [
+        ('baseline-094124b4e', baseline, 'row 322', 2),
+        ('mutant-F8', f8, 'row 322 F8', 1),
+        ('mutant-F9', f9, 'row 322 F9', 1),
+    ]:
+        installer.write_bytes(source)
+        result = subprocess.run([
+            'timeout', '-k', '10', '90', 'node', '--test', '--test-reporter=tap',
+            f'--test-name-pattern={pattern}', 'packages/cli/tests/case2-install.test.mjs',
+        ], cwd=root, env=os.environ, text=True, stdout=subprocess.PIPE, stderr=subprocess.STDOUT)
+        (logs / f'{label}.log').write_text(result.stdout)
+        print(f'{label}: exit {result.returncode}, expected failures {failures}', flush=True)
+        assert result.returncode == 1, result.stdout
+        assert f'# fail {failures}\n' in result.stdout, result.stdout
+        assert 'ERR_MODULE_NOT_FOUND' in result.stdout, result.stdout
+        installer.write_bytes(fixed)
+        assert installer.read_bytes() == fixed
+        print('restored sha256 ' + hashlib.sha256(fixed).hexdigest(), flush=True)
+finally:
+    installer.write_bytes(fixed)
+    assert installer.read_bytes() == fixed
@@ -0,0 +1,26 @@
+✔ a copy carries every file the harness modules read from it (891.310838ms)
+✔ shared copy: npm ci, pushed reachability, readonly/existing copy, webui delegation (537.82282ms)
+✔ wrapper preserves Q81 lease and marker, rejects foreign/symlink; check uses effective roots (713.621566ms)
+✔ row 190 N6: check --instance passes only when the wrapper exports the instance's MOSAIC_CONFIG (657.082198ms)
+✔ bus unit copy/pm pins, install refuses all busy states and failed reads, drop-in refusal (799.380065ms)
+✔ missing package manifest refuses before npm; npm failure removes the unpublished temp copy (499.872009ms)
+✔ real pinned install loads bus and Console; same-copy mosaic talk passes proof, other trees refuse (3824.368055ms)
+✔ bus status reads effective copy/pm/drop-ins without writes; check refuses an overridden ExecStart (668.500662ms)
+✔ drop-ins in either override field and malformed metadata refuse; uninstall also checks --no-reload (399.490955ms)
+✔ install never shows a template name on systemd 261; template drop-ins still refuse (318.110324ms)
+✔ unlisted instance drop-in is found in another unit lookup directory; path discovery errors refuse (347.788225ms)
+✔ inherited mosaic-.service.d override refuses without changing the unit (403.142763ms)
+✔ inherited service.d override refuses without changing the unit (384.337811ms)
+✔ inherited drop-in unreadable directory or file refuses before writing (370.630432ms)
+✔ row 232: copy --bundle copies a SHA the bundle's refactor reaches, byte-identical to copy SHA, and refuses the rest (2257.394077ms)
+✔ row 232: wrapper --create writes the first wrapper only, the same bytes wrapper ID writes, and refuses over any file (779.276348ms)
+✔ row 232: check --units external reads the system units, the default reads the user units (641.792634ms)
+✔ Vikunja 614: bundle and checkout copy leave an unreadable caller directory before find (1047.143772ms)
+ℹ tests 18
+ℹ suites 0
+ℹ pass 18
+ℹ fail 0
+ℹ cancelled 0
+ℹ skipped 0
+ℹ todo 0
+ℹ duration_ms 15638.417631
@@ -0,0 +1,34 @@
+✔ the library install writes the business file, personas and slot dir, makes the copy and starts nothing (258.707115ms)
+✔ a library re-run passes and leaves every file as it was (391.278216ms)
+✔ a re-run refuses business-file-differs and leaves the file unchanged (274.686097ms)
+✔ a re-run refuses persona-differs when an installed persona isn't the staged one, and writes nothing (274.084555ms)
+✔ the factory install writes no library mapping, persona or slot dir (175.791904ms)
+✔ the factory install refuses a library project and bus.tester off, before anything is written (72.301025ms)
+✔ the library install refuses bus.tester on and a persona var in the input (76.469642ms)
+✔ the install refuses root, a business id mismatch, another --home and a config dir with group bits (57.89739ms)
+✔ the library install needs --personas (5.495139ms)
+✔ a validate refusal removes the business file this run wrote (230.311754ms)
+✔ N4: a validate refusal on a re-run leaves the matching business file in place, byte for byte (397.123924ms)
+✔ a clean library host passes the precheck with no mirror yet (404.408689ms)
+✔ the library precheck refuses a persona file at 0644 (399.17119ms)
+✔ the library precheck refuses a persona whose digest isn't persona.sha256 (402.47159ms)
+✔ the library precheck refuses a persona dir with group bits (390.108413ms)
+✔ the library precheck refuses a business file at 0644 (402.829663ms)
+✔ the library precheck refuses a changes.jsonl at 0644 (573.861228ms)
+✔ the library precheck refuses a Discord binding (386.405794ms)
+✔ --library-status refuses library-mirror-missing before the bus has made the mirror (309.213305ms)
+✔ --library-status refuses library-never-synced on a fresh mirror (330.922116ms)
+✔ --library-status names a recorded lastError before the null lastFetch it leaves (N3) (335.576032ms)
+✔ --library-status prints each R-problem's path as an escaped JSON string, then the count, and passes (379.69927ms)
+✔ --library-status takes no --profile (5.544173ms)
+✔ Vikunja 614: install preserves the explicit notifier decision bytes and mode and creates none when absent (465.015156ms)
+✔ row 322 F8: library personas install from the copy with no clone node_modules (139.662489ms)
+✔ row 322 F9: importer refusal keeps the error line rather than the Node banner (95.452368ms)
+ℹ tests 26
+ℹ suites 0
+ℹ pass 26
+ℹ fail 0
+ℹ cancelled 0
+ℹ skipped 0
+ℹ todo 0
+ℹ duration_ms 7340.739711
@@ -0,0 +1,10 @@
+✔ row 322 F8: library personas install from the copy with no clone node_modules (178.794273ms)
+✔ row 322 F9: importer refusal keeps the error line rather than the Node banner (101.739988ms)
+ℹ tests 2
+ℹ suites 0
+ℹ pass 2
+ℹ fail 0
+ℹ cancelled 0
+ℹ skipped 0
+ℹ todo 0
+ℹ duration_ms 394.59041
@@ -0,0 +1,18 @@
+✔ copy writes the Console paths at the full id, read-only, and leaves an existing copy alone (872.104795ms)
+✔ copy refuses a commit off refactor, an unknown one, a worktree and a bad copies directory (1245.376299ms)
+✔ copy writes nothing when an archived path is missing at the commit (409.033887ms)
+✔ a copy that loses the rename race leaves no read-only temp directory behind (548.743561ms)
+✔ a copy whose rename fails with no target refuses, writes no copy and leaves no temp directory (534.468073ms)
+✔ a copy that meets a target holding files says exists: and moves nothing into it (541.303916ms)
+✔ a copy that meets an empty target directory replaces it by rename, not by moving into it (547.966283ms)
+✔ serve runs from a copy: /healthz 200, the config check, roles and RELEASE from the copy, the queue from --checkout (856.865742ms)
+✔ serve refuses a --checkout that is not an absolute directory path (274.552284ms)
+✔ consoleReads runs the queue read under queueRoot and reads RELEASE under root (49.311324ms)
+ℹ tests 10
+ℹ suites 0
+ℹ pass 10
+ℹ fail 0
+ℹ cancelled 0
+ℹ skipped 0
+ℹ todo 0
+ℹ duration_ms 6003.825092
@@ -0,0 +1,10 @@
+✔ row 322 F8: library personas install from the copy with no clone node_modules (148.410784ms)
+✔ row 322 F9: importer refusal keeps the error line rather than the Node banner (94.205865ms)
+ℹ tests 2
+ℹ suites 0
+ℹ pass 2
+ℹ fail 0
+ℹ cancelled 0
+ℹ skipped 0
+ℹ todo 0
+ℹ duration_ms 344.990842
@@ -0,0 +1,141 @@
+# Row 323 / #1819 — Case 1 factory business file
+
+Goldie, 2026-10-23. New isolated worktree `/home/jwoltje/.t3/worktrees/mosaic-stack/goldie-row323`, branch `goldie/row323`, base local refactor `da537e7d159be0bf39a36eaaa65cd16c20373b72` (descends from brief commit 68f3bded5). Row322 worktree remains unchanged.
+
+## Sources and input boundary
+
+Read brief docs/plans/2026-10-23_case1-business-file-brief.md, row195 DESIGN.md (host values sections1/2/6/7), installer factory HELPER, precheck profile checks, case1-accept F3/F7, business loader and credentials/launch checks, role definitions and business fixture helpers. No host access or credential read.
+
+DESIGN fixes business `mosaic-stack`, OS user mosaic, home `/srv/mosaic`, config `/srv/mosaic/.config/mosaic-dev`, data `/srv/mosaic/.mosaic-dev`, Claude only, tester on. Human id is explicitly left to the go (:82/:300), no project root is named. Business loader requires at least one project/root (:261-275), tracker.sync bot/botId/Vikunja credential reference (:85-94), launch.models and nonempty launch.instances excluding launcher (:186-193). These host/business values are not supplied by DESIGN. Per sage-3815 and brief, stop configuration rather than guess. Asked Sage in goldie-0008 for exact values.
+
+Recommended minimal role set: chief-of-staff instance chief with claude-code harness plus credential-free assistant solely because launch.instances must contain a declared non-launcher. Both arbiters may reference chief; no additional PM/CTO role credential required. This remains a recommendation pending input, not a written host config.
+
+Literal top-level `library` is ignored by the installer plan and rejected later by business validation as unsupported key; a library project is refused by the factory plan as profile-library-business. Asked Sage which intended refusal assertion to use; recommend covering both through their real paths without a product change.
+
+## Authority and status
+
+Sage-3815 explicitly authorizes claimant queue moves despite brief's generic no-queue-writes boundary. Claim op goldie-0323-start-1 retries every20s on lock contention per sage-3814; no lock touched. Tests and mutant require new Sage CLEAR; none run. No business JSON or test written yet. No commit/push yet. BUILD/SESSIONS/BUILD-LOG notes record investigation only.
+
+## Rulings and static blocker, 23:02Z
+
+Sage-3820 accepts chief + credential-free assistant because launch.instances must be nonempty and exclude chief, both arbiters chief. It accepts literal library-key rejection through final real business validation and library-project rejection through factory planning, no production change. Sage-3822 supplies project mosaic-stack at /srv/mosaic/src/mosaic-stack and model claude-opus-5-5 (provider/thinking to be sourced). Sage-3823 relays Mos-1554: human jason, no real tracker bot, token path must be absent and never created; stop immediately if this refuses boot/launch.
+
+Static trace proves refusal, reported to Sage in goldie-0009:
+
+- cli/src/config.mjs:127 loads business. trackerFor :60 returns null without tracker.baseUrl; :137-138 suppresses only config.trackers, not business tracker.sync.
+- bus/src/runtime.mjs:131 registers business tracker.sync credentials under business/@sync; :157 constructs Credentials regardless of config.trackers.
+- bus/src/credentials.mjs:134-139 eagerly reads every reference. Ordinary ref.file lstat/realpath failure at :225-228 throws credential-file during boot, before chief can launch.
+- The business credential check warns for unset env, but bus/src/credentials.mjs:268 sends undefined to #format; :278 rejects credential-format. An env reference is not a bypass and is outside the brief's file requirement.
+- Install refuses even earlier: business/src/cli.mjs:84-88 checks tracker.sync references, business/src/credentials.mjs:78-83 records a missing ordinary file as a problem, CLI :95-97 exits2. case2-install.sh:217-220 wraps validate refusal and removes the business file it created.
+- business/src/business.mjs:41 requires tracker bot names to begin bot-, :42 requires positive botId. Mos's illustrative no-bot-mosaic-stack-sync would fail that shape; a bot-no-bot marker still cannot solve the absent-file refusal.
+
+Status: real fail-closed product boundary. No business JSON, test, placeholder credential, host action or tests written/run. Await Sage/Mos resolution; do not bypass by inventing a token or expanding product scope. Only investigation notes exist in this worktree. Claim attempts continue separately under the queue window's explicit retry instruction.
+
+## Resumed after Q247 landing — sage-3859
+
+Current base is pushed `dd6cb5872b972bcabb99b82589b2905e4e47dd3e`. Preserved earlier investigation as a notes-only commit, then rebased onto that tip; only append-only BUILD-LOG/SESSIONS conflicts, resolved retaining the entire landed files and appending this row's original suffix. Earlier equivalent local refactor doc commits were skipped by git as already applied. No other row323 source existed before this resume.
+
+Q247 removes the static blocker: this file now omits tracker entirely, with no dummy bot/token/reference. No tracker credential or token file is required or created. The separate Claude session login file remains the operator's run-sheet step, as described in DESIGN section3; this document contains no credential value or reference, and this work reads no credential.
+
+Approved values and minimal role set:
+
+- business mosaic-stack, factory bus.tester true, no library key/project (DESIGN sections1/2/7).
+- human jason (Mos-1554, sage-3823); project mosaic-stack at /srv/mosaic/src/mosaic-stack (sage-3822).
+- chief-of-staff chief and credential-free assistant, both arbiters chief, launch.by chief, launch.instances [assistant] (sage-3820). The loader requires nonempty launch.instances excluding the launcher (business.mjs:186-191), so a chief-only document cannot load. No other role is needed.
+- Both roles use claude-code; plugins.harness enables only claude-code. No pi route or fallback.
+- chief model claude-opus-5-5 is Sage's explicit choice (sage-3822). Provider anthropic/model claude-opus-5-5 is the repository model mapping at packages/business/README.md:185. There is no separate per-model default thinking catalog in the implementation: choose high from the Claude harness's supported LEVELS at packages/plugins/harness/claude-code/index.mjs:28, following the existing chief route convention at packages/cli/tests/session-launch.test.mjs:83. Both roles use that one declared model/effort; no extra model or capacity policy is introduced.
+
+One new file packages/business/tests/case1-business-file.test.mjs has seven cases. It first loads the shipped JSON bytes unchanged from a temporary business-file location (loader checks shape, no host path access). Its runtime/CLI/install cases copy the document into a scratch input and replace only the project root with a scratch fixture root, per sage-3820's instruction to use test fixture paths. The real factory installer takes that input via --business-file and uses its real bootstrap/business validation, with only stack-copy stubbed (no clone/install/network). The boot case uses bootConfig + actual startBroker and asserts no tracker config or credential status. Negative cases cover bus.tester false (bus-tester-off), literal library (final validate unsupported key, per sage-3820), and a library project (factory plan profile-library-business). No pre-existing test changed.
+
+The new tester-switch mutant flips only bus.tester in the shipped JSON, targets the new exact-document assertion, then restores/checks bytes in finally. Prepared but not run. Tests and mutant remain held until Sage CLEAR; only syntax/diff/static JSON checks have run. Row323 claimant is still in-progress from rev3749.
+
+## Field provenance and pre-test commit — sage-3861
+
+Sage-3861 CLEAR explicitly requires committing the draft before any run, so test counts attach to a commit. This is a specific exception to the usual green-before-commit rule. Until recorded below, this commit is untested. No old test is modified.
+
+| Document field | Value and source |
+| --- | --- |
+| businessVersion | 1, business loader's version requirement (business/src/business.mjs:233). Schema value, not a mos-1554 host choice. |
+| id | mosaic-stack, row195 DESIGN section7 (sage-1813), restated by row323 brief. |
+| human | jason, mos-1554 relayed by sage-3823. |
+| arbiters.delivery / arbiters.technical | chief / chief, sage-3820's explicit minimal-role ruling; both reference the chief-of-staff definition. |
+| projects.mosaic-stack.root | /srv/mosaic/src/mosaic-stack, sage-3822's explicit project-id/root decision. DESIGN supplied /srv/mosaic as home but did not supply this root. |
+| vars.bus.tester | true, DESIGN section2 factory profile and installer bus-tester-off requirement. |
+| plugins.harness | [claude-code], brief's Claude-only/P19 mos-0865 boundary and DESIGN section3. |
+| roles.chief.definition | chief-of-staff, brief/roles/chief-of-staff.json; no credential or tracker bot. |
+| roles.assistant.definition | assistant, sage-3820 acceptance of this one extra credential-free role, required because launch.instances must be nonempty and exclude chief. |
+| roles.*.vars.harness | claude-code for both; same Claude-only rule, no fallback route. |
+| roles.*.vars.model | claude-opus-5-5 for both, chief model explicitly chosen in sage-3822; reuse the single declared model for assistant to avoid adding another model decision. |
+| roles.*.vars.thinking | high, supported effort in packages/plugins/harness/claude-code/index.mjs:28; existing chief convention packages/cli/tests/session-launch.test.mjs:83. The repository has no per-model default-effort catalog; this is an explicit supported-convention choice, not an invented catalog default. |
+| launch.by | chief, brief and F7's requirement to name the chief launch; sage-3820. |
+| launch.instances | [assistant], sage-3820 and business.mjs:186-191's nonempty/non-launcher rule. |
+| launch.models.claude-opus-5-5.provider / model | anthropic / claude-opus-5-5, repository model mapping packages/business/README.md:185 and sage-3822. The model id is also the map key so no extra alias is introduced. |
+| Omitted tracker / credentials / library | Q247/mos-1555 and sage-3859 supersede mos-1554's proposed absent-token placeholder; no bot, token path, credential value or library project/key is present. |
+
+Only human=jason is a literal field value supplied by mos-1554. The no-bot intent also comes from mos-1554; Q247 implements it by omission. Other fields deliberately cite the actual design/schema/Sage source rather than attributing them to mos-1554.
+
+Planned runs under sage-3861: new file whole; business suite whole; CLI suite whole; tester-switch mutant; restored new file whole. Fresh scratch TMPDIR and timeout-k10 for each, one process at a time. Existing-test red or any additional old-test edit stops work; first-run new red is recorded and reported. Push remains own branch goldie/row323 after the test sequence/report evidence is concrete.
+
+## First slot result — stopped on existing CLI test red
+
+Committed draft before any test: `571376c30e77f46bbe41069633390cc001f57ac8` (base dd6cb5872b972bcabb99b82589b2905e4e47dd3e), per sage-3861. Fresh TMPDIR `/mnt/storage/scratch/tmp/goldielKvBJv`, allocated by mktemp under the mandated scratch parent. All runs serialized with timeout -k 10. Source and test bytes remained unchanged throughout.
+
+| Run | Command after TMPDIR/timeout | Outcome |
+| --- | --- | --- |
+| New whole file | timeout -k 10 180 node --test --test-reporter=tap packages/business/tests/case1-business-file.test.mjs | 7/7 pass, 0 fail/skip/cancel; test-new.log |
+| Whole business suite | timeout -k 10 600 node --test --test-reporter=tap --test-concurrency=1 packages/business/tests/ | 261/261 pass, 0 fail/skip/cancel; test-business-suite.log |
+| Whole CLI suite | timeout -k 10 1200 node --test --test-reporter=tap --test-concurrency=1 packages/cli/tests/ | Interrupted on existing-test failure; 631 top-level passes/1 failure recorded before termination, no final full-suite totals; test-cli-suite.log |
+| Tester-switch mutant | Not run | Stop rule reached first |
+| Restored new file | Not run | Mutant not run; source already matches manifest |
+
+Existing failure: CLI test579, packages/cli/tests/revoke-window.test.mjs:170: `row 306 REQ-LAUNCH-1 R4 a revoked run whose call lands before the SIGTERM ends stopped/0; a run the human stopped in the same window still ends session-invalid/22`. After 20111.683685ms it failed `no RESULT on 61c275d4-42f9-4a92-8a43-1ae94c25b730`, ask assertion at167, Promise.all index1, test at194. This file has no changes from base. No cause or flakiness claim is established.
+
+On observing the red in the suite log, sent SIGTERM to this run's verified timeout process; the suite ended exit1 with `Interrupted while running: packages/cli/tests/stack-release-external.test.mjs` (it had progressed while output was being inspected). One remaining process was positively identified by an argument under this exact scratch TMPDIR and cleaned with SIGTERM; no live host process/state touched. No further tests or reruns, no old test changes.
+
+Reported immediately to Sage as goldie-0016, returned slot, requested the bounded investigation/retry ruling. JSON/new-test manifest still verifies. Candidate is not verified/ready for review and has not been pushed as such. These failure notes/logs remain local evidence until Sage's ruling; no mutant acceptance claim.
+
+## Mos-1560 isolated rerun — second red, stopped
+
+Sage-3864 CLEAR authorized three whole-file revoke-window runs on unchanged571376c30, followed only on three passes by CLI/mutant/restored runs. Every run had to begin with date -u, uptime and the last line of sage-busy-now.sh. Only run1 occurred; it failed, reaching the second-red stop condition.
+
+Log: revoke-window-run-1.log. Exact start/load lines:
+
+```
+Sat Oct 24 00:24:22 UTC 2026
+ 19:24:22 up 10 days, 10:44,  2 users,  load average: 1.46, 1.68, 2.70
+CLEAR
+TMPDIR=/mnt/storage/scratch/tmp/goldieBObDQ9
+```
+
+Command: `TMPDIR=<fresh mktemp above> timeout -k 10 180 node --test --test-reporter=tap packages/cli/tests/revoke-window.test.mjs`.
+
+Whole file result: 0/1 pass, 1 failure, exit1, no skips/cancellations. Same unchanged row306 R4 test at revoke-window.test.mjs:170 failed after20126.967034ms: `no RESULT on dc4ccc94-4d08-4da1-bc66-2f4fcfc098dc`, ask167, Promise.all index1, test194. No edits, no run2/3, no full CLI rerun, no mutant/restored run. No remaining process with this exact run's scratch path was found after the file finished. Manifest still matches. This proves repeat failure under the recorded CLEAR/load conditions, not a root cause.
+
+Reported to Sage as goldie-0018 with full log path, time/load/busy lines, test and error. Slot returned; holding for root-cause assignment/ruling on base dd6cb5872. Remote goldie/row323 stays the unverified draft571376c30; post-run failure evidence remains local. All row323 product/test sources are still exactly those committed before the first slot.
+
+## Root cause correction and accepted evidence — mos-1561, sage-3869
+
+The repeated revoke-window red was caused by TMPDIR length, not Codex. Sage identified and reproduced it (sage-3869; recorded in their local dda2d07b4): newRun rejects a tools.sock path exceeding107 bytes at packages/seat/src/session.mjs:278. The 37-byte `/mnt/storage/scratch/tmp/goldieXXXXXX` combined with revoke-window's fixture root produces109 bytes, while Sage's35-byte prefix fits107. The test drops the launcher refusal log, so the symptom was a20s no-RESULT wait. The detached base dd6cb5872 also failed0/1 after20106.869486ms with long TMPDIR (log copied as revoke-window-detached-base.log). Prior messages attributing the difference to an unspecified environment are superseded by this diagnosis; no product/old-test fix is needed for row323.
+
+From now on every suite uses `export TMPDIR=$(mktemp -d /mnt/storage/scratch/tmp/XXXXXX)` (31bytes). Under sage-3869 CLEAR, all source/test bytes remained exactly571376c30; each run got its own fresh31-byte TMPDIR and began with date-u, uptime, and busy-helper's last line:
+
+| Run / log | UTC start | Load averages | Busy | Result |
+| --- | --- | --- | --- | --- |
+| revoke-window-short-tmp.log | 2026-10-24 00:36:41 | 1.01,1.34,1.91 | CLEAR | Whole file1/1 pass; test703.937594ms, file838.51754ms; TMPDIR lCsnmg |
+| test-business-short-tmp.log | 2026-10-24 00:36:50 | 1.08,1.35,1.91 | CLEAR | Whole suite261/261 pass, 6415.261266ms; TMPDIR flQGnB |
+| test-new-short-tmp.log | 2026-10-24 00:37:03 | 1.37,1.40,1.92 | CLEAR | Whole new file7/7 pass, 611.516605ms; TMPDIR HNhoti |
+| mutant-driver.log + mutant.log | 2026-10-24 00:37:12 | 1.38,1.41,1.92 | CLEAR | Mutant killed: targeted exact-document test0/1, expected exit1; driver exit0; TMPDIR XAmmxp |
+| test-new-restored.log | 2026-10-24 00:37:25 | 1.61,1.46,1.93 | CLEAR | Restored new file7/7 pass, 616.699665ms; TMPDIR IVLOcQ |
+
+All TMPDIRs above are under /mnt/storage/scratch/tmp/. Every run used timeout-k10 (180s limit, business suite600s), one run at a time. Positive runs have0 failures/skips/cancellations. These are fresh accepted row323 results on committed571376c30. No full CLI rerun was authorized or performed: under mos-1561, Sage's landing gate supplies the CLI suite acceptance/counts, while Goldie's evidence is the business suite, new file and mutant. The earlier partial CLI log remains diagnostic evidence, not a passing-suite claim.
+
+Required tester-switch mutant:
+
+```diff
+-    "bus.tester": true
+    "bus.tester": false
+```
+
+It fails the new committed-document assertion at case1-business-file.test.mjs:66 (`false !== true`). mutant.py restores exact original bytes in finally; restored JSON SHA256 `85e6b9ac62785734fb9d854ea70ea550e171b5060b5cad0417e2f42f0b60c59e`. Both manifest entries verify after restoration, and the whole new file passes again. No pre-existing test or production source changed. git diff --check passes.
+
+Committing these notes and preserved logs is evidence-only on top of the tested571376c30. The product manifest remains the same two paths/digests. Duckworth's static review and Sage's integration/full gate remain their authority. Logs have trailing whitespace removed for git diff --check; substantive output/results are unchanged. Earlier stopped runs remain recorded honestly above and in their logs.
@@ -0,0 +1,2 @@
+85e6b9ac62785734fb9d854ea70ea550e171b5060b5cad0417e2f42f0b60c59e  docs/guides/case1-business.mosaic-stack.json
+aecd1c0f0fe1eb46800a7dea6f1f2f6a965f1daa33a39f9837bb1e2c19e0abfc  packages/business/tests/case1-business-file.test.mjs
@@ -0,0 +1,6 @@
+Sat Oct 24 00:37:12 UTC 2026
+ 19:37:12 up 10 days, 10:57,  2 users,  load average: 1.38, 1.41, 1.92
+CLEAR
+TMPDIR=/mnt/storage/scratch/tmp/XAmmxp bytes=31
+bus.tester mutant: exit 1
+restored sha256 85e6b9ac62785734fb9d854ea70ea550e171b5060b5cad0417e2f42f0b60c59e
@@ -0,0 +1,34 @@
+TAP version 13
+# Subtest: row 323: committed Case 1 document loads unchanged through the business loader
+not ok 1 - row 323: committed Case 1 document loads unchanged through the business loader
+  ---
+  duration_ms: 4.020549
+  type: 'test'
+  location: '/home/jwoltje/.t3/worktrees/mosaic-stack/goldie-row323/packages/business/tests/case1-business-file.test.mjs:57:1'
+  failureType: 'testCodeFailure'
+  error: |-
+    Expected values to be strictly equal:
+
+    false !== true
+
+  code: 'ERR_ASSERTION'
+  name: 'AssertionError'
+  expected: true
+  actual: false
+  operator: 'strictEqual'
+  stack: |-
+    TestContext.<anonymous> (file:///home/jwoltje/.t3/worktrees/mosaic-stack/goldie-row323/packages/business/tests/case1-business-file.test.mjs:66:10)
+    Test.runInAsyncScope (node:async_hooks:226:14)
+    Test.run (node:internal/test_runner/test:1402:25)
+    Test.start (node:internal/test_runner/test:1262:17)
+    startSubtestAfterBootstrap (node:internal/test_runner/harness:387:17)
+  ...
+1..1
+# tests 1
+# suites 0
+# pass 0
+# fail 1
+# cancelled 0
+# skipped 0
+# todo 0
+# duration_ms 113.96636
@@ -0,0 +1,26 @@
+"""Row 323 tester-switch mutant; run only after Sage CLEAR."""
+import hashlib
+import os
+from pathlib import Path
+import subprocess
+
+root = Path(__file__).resolve().parents[4]
+source = root / 'docs/guides/case1-business.mosaic-stack.json'
+fixed = source.read_bytes()
+needle = b'"bus.tester": true'
+assert fixed.count(needle) == 1
+try:
+    source.write_bytes(fixed.replace(needle, b'"bus.tester": false'))
+    result = subprocess.run([
+        'timeout', '-k', '10', '90', 'node', '--test', '--test-reporter=tap',
+        '--test-name-pattern=row 323: committed Case 1 document loads',
+        'packages/business/tests/case1-business-file.test.mjs',
+    ], cwd=root, env=os.environ, text=True, stdout=subprocess.PIPE, stderr=subprocess.STDOUT)
+    Path(__file__).with_suffix('.log').write_text(result.stdout)
+    print(f'bus.tester mutant: exit {result.returncode}', flush=True)
+    assert result.returncode == 1, result.stdout
+    assert '# fail 1\n' in result.stdout and 'false !== true' in result.stdout, result.stdout
+finally:
+    source.write_bytes(fixed)
+    assert source.read_bytes() == fixed
+    print('restored sha256 ' + hashlib.sha256(fixed).hexdigest(), flush=True)
@@ -0,0 +1,39 @@
+Sat Oct 24 00:29:57 UTC 2026
+ 19:29:57 up 10 days, 10:49,  2 users,  load average: 1.29, 1.30, 2.21
+CLEAR
+TMPDIR=/mnt/storage/scratch/tmp/goldieccUVab
+dd6cb5872b972bcabb99b82589b2905e4e47dd3e
+v26.8.1
+/usr/bin/node
+TAP version 13
+# Subtest: row 306 REQ-LAUNCH-1 R4 a revoked run whose call lands before the SIGTERM ends stopped/0; a run the human stopped in the same window still ends session-invalid/22
+not ok 1 - row 306 REQ-LAUNCH-1 R4 a revoked run whose call lands before the SIGTERM ends stopped/0; a run the human stopped in the same window still ends session-invalid/22
+  ---
+  duration_ms: 20106.869486
+  type: 'test'
+  location: '/mnt/storage/scratch/tmp/goldie-base2qHbGq/worktree/packages/cli/tests/revoke-window.test.mjs:170:1'
+  failureType: 'testCodeFailure'
+  error: 'no RESULT on 94ddbce3-5e46-49a7-8f63-60af8995c10d'
+  code: 'ERR_ASSERTION'
+  name: 'AssertionError'
+  expected: true
+  operator: '=='
+  stack: |-
+    ask (file:///mnt/storage/scratch/tmp/goldie-base2qHbGq/worktree/packages/cli/tests/revoke-window.test.mjs:167:10)
+    runNextTicks (node:internal/process/task_queues:65:5)
+    listOnTimeout (node:internal/timers:644:9)
+    process.processTimers (node:internal/timers:618:7)
+    async Promise.all (index 1)
+    async TestContext.<anonymous> (file:///mnt/storage/scratch/tmp/goldie-base2qHbGq/worktree/packages/cli/tests/revoke-window.test.mjs:194:3)
+    async Test.run (node:internal/test_runner/test:1409:7)
+    async startSubtestAfterBootstrap (node:internal/test_runner/harness:387:3)
+  ...
+1..1
+# tests 1
+# suites 0
+# pass 0
+# fail 1
+# cancelled 0
+# skipped 0
+# todo 0
+# duration_ms 20235.90436
@@ -0,0 +1,33 @@
+Sat Oct 24 00:24:22 UTC 2026
+ 19:24:22 up 10 days, 10:44,  2 users,  load average: 1.46, 1.68, 2.70
+CLEAR
+TMPDIR=/mnt/storage/scratch/tmp/goldieBObDQ9
+TAP version 13
+# Subtest: row 306 REQ-LAUNCH-1 R4 a revoked run whose call lands before the SIGTERM ends stopped/0; a run the human stopped in the same window still ends session-invalid/22
+not ok 1 - row 306 REQ-LAUNCH-1 R4 a revoked run whose call lands before the SIGTERM ends stopped/0; a run the human stopped in the same window still ends session-invalid/22
+  ---
+  duration_ms: 20126.967034
+  type: 'test'
+  location: '/home/jwoltje/.t3/worktrees/mosaic-stack/goldie-row323/packages/cli/tests/revoke-window.test.mjs:170:1'
+  failureType: 'testCodeFailure'
+  error: 'no RESULT on dc4ccc94-4d08-4da1-bc66-2f4fcfc098dc'
+  code: 'ERR_ASSERTION'
+  name: 'AssertionError'
+  expected: true
+  operator: '=='
+  stack: |-
+    ask (file:///home/jwoltje/.t3/worktrees/mosaic-stack/goldie-row323/packages/cli/tests/revoke-window.test.mjs:167:10)
+    async Promise.all (index 1)
+    async TestContext.<anonymous> (file:///home/jwoltje/.t3/worktrees/mosaic-stack/goldie-row323/packages/cli/tests/revoke-window.test.mjs:194:3)
+    async Test.run (node:internal/test_runner/test:1409:7)
+    async startSubtestAfterBootstrap (node:internal/test_runner/harness:387:3)
+  ...
+1..1
+# tests 1
+# suites 0
+# pass 0
+# fail 1
+# cancelled 0
+# skipped 0
+# todo 0
+# duration_ms 20266.295192
@@ -0,0 +1,22 @@
+Sat Oct 24 00:36:41 UTC 2026
+ 19:36:41 up 10 days, 10:56,  2 users,  load average: 1.01, 1.34, 1.91
+CLEAR
+TMPDIR=/mnt/storage/scratch/tmp/lCsnmg bytes=31
+TAP version 13
+# usage: {"event":"usage-unknown","business":"acme","run":"r73cb69bf7381","instance":"assistant","turn":"7b64df9d-f571-4f43-a678-dbd5ce7714a9","source":"@none","code":"baseline-unknown"}
+# usage: {"event":"usage-unknown","business":"acme","run":"r89b03e6f1158","instance":"assistant","turn":"aaa36964-0a78-4ba1-9442-d6f0aa35f18e","source":"@none","code":"baseline-unknown"}
+# Subtest: row 306 REQ-LAUNCH-1 R4 a revoked run whose call lands before the SIGTERM ends stopped/0; a run the human stopped in the same window still ends session-invalid/22
+ok 1 - row 306 REQ-LAUNCH-1 R4 a revoked run whose call lands before the SIGTERM ends stopped/0; a run the human stopped in the same window still ends session-invalid/22
+  ---
+  duration_ms: 703.937594
+  type: 'test'
+  ...
+1..1
+# tests 1
+# suites 0
+# pass 1
+# fail 0
+# cancelled 0
+# skipped 0
+# todo 0
+# duration_ms 838.51754
@@ -0,0 +1,56 @@
+Sat Oct 24 00:37:25 UTC 2026
+ 19:37:25 up 10 days, 10:57,  2 users,  load average: 1.61, 1.46, 1.93
+CLEAR
+TMPDIR=/mnt/storage/scratch/tmp/IVLOcQ bytes=31
+TAP version 13
+# Subtest: row 323: committed Case 1 document loads unchanged through the business loader
+ok 1 - row 323: committed Case 1 document loads unchanged through the business loader
+  ---
+  duration_ms: 3.816879
+  type: 'test'
+  ...
+# Subtest: row 323: real business validate accepts the Case 1 fixture without tracker credentials
+ok 2 - row 323: real business validate accepts the Case 1 fixture without tracker credentials
+  ---
+  duration_ms: 70.395579
+  type: 'test'
+  ...
+# Subtest: row 323: real factory install accepts the document's scratch input and writes it unchanged
+ok 3 - row 323: real factory install accepts the document's scratch input and writes it unchanged
+  ---
+  duration_ms: 164.092704
+  type: 'test'
+  ...
+# Subtest: row 323: the Case 1 business boots without a tracker or @sync credential
+ok 4 - row 323: the Case 1 business boots without a tracker or @sync credential
+  ---
+  duration_ms: 48.455987
+  type: 'test'
+  ...
+# Subtest: row 323: factory install refuses bus.tester false before writing
+ok 5 - row 323: factory install refuses bus.tester false before writing
+  ---
+  duration_ms: 32.684801
+  type: 'test'
+  ...
+# Subtest: row 323: literal library key refuses through final business validation
+ok 6 - row 323: literal library key refuses through final business validation
+  ---
+  duration_ms: 147.619094
+  type: 'test'
+  ...
+# Subtest: row 323: a library project refuses through the factory profile plan
+ok 7 - row 323: a library project refuses through the factory profile plan
+  ---
+  duration_ms: 37.280986
+  type: 'test'
+  ...
+1..7
+# tests 7
+# suites 0
+# pass 7
+# fail 0
+# cancelled 0
+# skipped 0
+# todo 0
+# duration_ms 616.699665
@@ -0,0 +1,56 @@
+Sat Oct 24 00:37:03 UTC 2026
+ 19:37:03 up 10 days, 10:56,  2 users,  load average: 1.37, 1.40, 1.92
+CLEAR
+TMPDIR=/mnt/storage/scratch/tmp/HNhoti bytes=31
+TAP version 13
+# Subtest: row 323: committed Case 1 document loads unchanged through the business loader
+ok 1 - row 323: committed Case 1 document loads unchanged through the business loader
+  ---
+  duration_ms: 4.019742
+  type: 'test'
+  ...
+# Subtest: row 323: real business validate accepts the Case 1 fixture without tracker credentials
+ok 2 - row 323: real business validate accepts the Case 1 fixture without tracker credentials
+  ---
+  duration_ms: 71.809045
+  type: 'test'
+  ...
+# Subtest: row 323: real factory install accepts the document's scratch input and writes it unchanged
+ok 3 - row 323: real factory install accepts the document's scratch input and writes it unchanged
+  ---
+  duration_ms: 158.271252
+  type: 'test'
+  ...
+# Subtest: row 323: the Case 1 business boots without a tracker or @sync credential
+ok 4 - row 323: the Case 1 business boots without a tracker or @sync credential
+  ---
+  duration_ms: 47.408675
+  type: 'test'
+  ...
+# Subtest: row 323: factory install refuses bus.tester false before writing
+ok 5 - row 323: factory install refuses bus.tester false before writing
+  ---
+  duration_ms: 33.173372
+  type: 'test'
+  ...
+# Subtest: row 323: literal library key refuses through final business validation
+ok 6 - row 323: literal library key refuses through final business validation
+  ---
+  duration_ms: 157.331263
+  type: 'test'
+  ...
+# Subtest: row 323: a library project refuses through the factory profile plan
+ok 7 - row 323: a library project refuses through the factory profile plan
+  ---
+  duration_ms: 31.660009
+  type: 'test'
+  ...
+1..7
+# tests 7
+# suites 0
+# pass 7
+# fail 0
+# cancelled 0
+# skipped 0
+# todo 0
+# duration_ms 611.516605
@@ -0,0 +1,52 @@
+TAP version 13
+# Subtest: row 323: committed Case 1 document loads unchanged through the business loader
+ok 1 - row 323: committed Case 1 document loads unchanged through the business loader
+  ---
+  duration_ms: 4.475258
+  type: 'test'
+  ...
+# Subtest: row 323: real business validate accepts the Case 1 fixture without tracker credentials
+ok 2 - row 323: real business validate accepts the Case 1 fixture without tracker credentials
+  ---
+  duration_ms: 60.93225
+  type: 'test'
+  ...
+# Subtest: row 323: real factory install accepts the document's scratch input and writes it unchanged
+ok 3 - row 323: real factory install accepts the document's scratch input and writes it unchanged
+  ---
+  duration_ms: 166.799569
+  type: 'test'
+  ...
+# Subtest: row 323: the Case 1 business boots without a tracker or @sync credential
+ok 4 - row 323: the Case 1 business boots without a tracker or @sync credential
+  ---
+  duration_ms: 48.481068
+  type: 'test'
+  ...
+# Subtest: row 323: factory install refuses bus.tester false before writing
+ok 5 - row 323: factory install refuses bus.tester false before writing
+  ---
+  duration_ms: 33.722908
+  type: 'test'
+  ...
+# Subtest: row 323: literal library key refuses through final business validation
+ok 6 - row 323: literal library key refuses through final business validation
+  ---
+  duration_ms: 151.757296
+  type: 'test'
+  ...
+# Subtest: row 323: a library project refuses through the factory profile plan
+ok 7 - row 323: a library project refuses through the factory profile plan
+  ---
+  duration_ms: 33.339369
+  type: 'test'
+  ...
+1..7
+# tests 7
+# suites 0
+# pass 7
+# fail 0
+# cancelled 0
+# skipped 0
+# todo 0
+# duration_ms 613.804933
@@ -0,0 +1,90 @@
+# Optional business tracker (Q247) implementation plan — row 324 / #1820
+
+Goldie, 2026-10-23. Base 860afc2b66e7bbd045e9d5e25d227ef12f62c55b, approved row298 candidate. New worktree /home/jwoltje/.t3/worktrees/mosaic-stack/goldie-row324, branch goldie/row324. Spec: git object f375f4e92:docs/plans/2026-10-23_optional-tracker-brief.md, section Brief: tracker becomes optional in the business file. Sage-3836 and mos-1555/Q247 authorize optional tracker; Duckworth reviews credential registration.
+
+## Goal and design
+
+A raw business document may omit tracker. Normalize omission to tracker:null, consistent with existing optional launch/role-tracker representations. A present tracker (including null, false, malformed objects) must continue through checkTracker and its existing refusals; distinguish absence with Object.hasOwn rather than a truthiness check. Keep checkTracker unchanged. Required top-level keys no longer include tracker. Only compare role bots with the sync bot when a checked business tracker exists. Role definitions needing vikunja still require their own tracker and credentials unchanged.
+
+CLI validate collects sync credential refs only when tracker is present. bootConfig's trackerFor returns null before interpreting tracker variables when business tracker is absent, so an old tracker.baseUrl variable cannot accidentally create sync/task adapter configuration. Console businessView emits no sync credential rows for absent tracker. Runtime registration, fixed-configuration reload comparison, instance-settings bot collision checks and broker credential display already use optional chaining on the row298 base; preserve those checks. The tasks adapter remains fail-closed for an explicitly inconsistent raw adapter config, and no-tracker bootConfig never configures it for this business.
+
+## Reader audit (before implementation)
+
+Command: git grep -n -E 'tracker\.sync|\.tracker\b' -- 'packages/*/src/*'. Every result is grouped here, with base line numbers:
+
+| Reader | Absent business tracker behavior / action |
+| --- | --- |
+| business/src/business.mjs:85-96,296-300 | checkTracker remains exact for present input; add omission normalization and guard own-sync-bot comparison. |
+| business/src/business.mjs:143-150 | Per-role tracker, independent of business tracker. Keep requirement/collision checks unchanged. |
+| business/src/cli.mjs:85 | Guard Object.values sync credential refs; absent contributes zero. |
+| business/src/instance-settings.mjs:108,120,126-127,133,223 | Role add/change and bot collision/retirement: old.tracker?.sync already skips absent sync; role trackers unchanged. No edit needed. |
+| business/src/launch-settings.mjs:161,235-236 | Per-role tracker assistant view/update, independent of business tracker; no edit. |
+| business/src/resolve.mjs:93 | Per-role tracker in resolved output; no edit. |
+| bus/src/runtime.mjs:131 | Existing b.tracker?.sync?.credentials check registers no @sync when absent; preserve and exercise with new boot test. |
+| bus/src/runtime.mjs:243,247 | Reload compares per-role tracker/null and canonical business sync/null; safe already, no edit. |
+| bus/src/broker.mjs:3969-3970 | Optional per-role tracker bot map; independent, no edit. |
+| bus/src/broker.mjs:4497 | Optional per-role tracker returned from instance write; independent, no edit. |
+| bus/src/broker.mjs:6242 | Credential display resolves optional sync bot; no @sync row exists on trackerless boot. Safe already. |
+| cli/src/config.mjs:57-60,137-138 (trackerFor; not caught by literal grep) | Add business-tracker absence guard; do not configure tracker adapter even if tracker.baseUrl remains set. |
+| cli/src/instances.mjs:118 | Builds per-role tracker update request only when user supplies bot; unrelated to business tracker. |
+| tasks/src/adapter.mjs:25,28-30,35,45,81 | settings rejects missing sync with controlled tracker-config before dereferencing labels/botId; files uses optional chaining. Factory iterates only configured trackers; absent business never configured by bootConfig. Preserve explicit-inconsistent-config refusal. |
+| webui/src/reads.mjs:164,166 | Role credentials independent; guard sync credential display at166 so trackerless Console does not throw. |
+| webui/src/public/bus.js:785 | Per-role editor tracker patch; independent of business tracker. |
+| conversation/src/controller.mjs:443,502,748,807,820,831,888,935,961,997,1008,1021,1048,1056,1268,1308,1330,1334,1413,1447 | Different execution-tracking object/class, unrelated to business/Vikunja config. No change. |
+
+Positive control: grep finds business.mjs:296 and webui reads:166, the unsafe business-tracker readers. Review focus: present null/malformed tracker still refuses; per-role Vikunja trackers still required; stale tracker variables do not enable sync; Console credential view remains usable; no @sync registration during runtime boot/reload.
+
+## Steps and evidence plan
+
+1. Document design and full reader list (this file); claim row324 in-progress as Goldie.
+2. Add new tests for absent tracker loader+CLI validate, malformed/present preservation, per-role tracker requirement, stale-variable bootConfig behavior, actual bus boot with empty credential list/no @sync, and Console business view. New test files only unless Mos expressly approves old-test change below.
+3. Make the minimal four-source-file change (business loader, business CLI, cli config, webui reads). Existing runtime/instance-settings/broker optional checks require coverage, not gratuitous edits.
+4. Static diff checks. Push untested candidate only as expressly ordered by sage-3836, then ask Sage for CLEAR. No tests before CLEAR.
+5. On CLEAR, new test files whole, applicable existing whole files/suites, then a mutant removing loader presence check. Restore and check source bytes. Record outputs; full landing gate is Sage's. Duckworth review follows.
+
+## Pre-existing test boundary
+
+Inspection finds packages/business/tests/business.test.mjs:98 loops over [human,arbiters,projects,tracker,roles] and :99 asserts deletion of each refuses. Q247 directly invalidates the tracker iteration. Proposed sole old-test edit: remove just the tracker string from that required-key list, leaving all other iterations/assertions intact, and add explicit tracker-omission coverage in a new test file. This requires Mos OK under mos-1272; stop implementation and report before editing existing tests. No tests have run.
+
+
+## Implementation draft and old-test ruling
+
+Sage-3840 relays Mos mos-1556: mos-1272 OK to remove only tracker from business.test.mjs's required-key list, preserving the four other keys and the assertion. Done exactly, one addition/one deletion at original line98; no other old test edited. All positive/negative coverage is in two new files: business/tests/optional-tracker.test.mjs and cli/tests/optional-tracker.test.mjs. The latter covers Console businessView as required by sage-3840.
+
+Design now implemented in the four source files identified above; README explains omission versus literal null. New tests cover loader/CLI absence, present value preservation, malformed/present undefined or null refusal, unchanged role-bot requirement, stale business/project tracker variables, actual runtime startup with no credential files or @sync reference, Console view, and continued missing-token refusal for a present tracker. Runtime test uses useFile on unknown @sync to distinguish an unregistered reference from a registered but unavailable credential; callback must never run. Fixture project tracker.project is set, so removing trackerFor's presence guard would actually configure sync instead of passing accidentally through the no-project guard.
+
+No tests run. New node_modules symlink points to canonical checkout dependencies and is ignored; it will not be committed. Sage-3836 expressly requests push before any tests; that specific sequencing overrides the usual green-before-commit default only for this draft push. Status is untested until CLEAR. Claim wrote goldie-0324-start-1 revision3759, briefed→in-progress. Row323 remains paused at the product boundary until324 lands.
+
+Static verification: node --check passed for all four edited source modules and both new test files; git diff --check passed. No node --test or shell suite was run. reader-audit.txt captures the requested grep on the draft. MANIFEST.sha256 pins README, four source files, the one existing test and both new tests. mutant.py prepares the required omission-presence mutant and restores/checks bytes in finally; it has not run.
+
+Proposed CLEAR run order: new business optional-tracker.test.mjs whole (5 tests), new cli optional-tracker.test.mjs whole (4 tests), existing business.test.mjs whole, then the targeted presence mutant and restored new tests. Broaden to business/CLI/Console/bus package gates only when Sage assigns that scope/slot. All test runs use timeout -k 10 and an explicitly allocated TMPDIR under /mnt/storage/scratch/tmp.
+
+## Rebased verification — sage-3850 CLEAR
+
+Rebased c4b14952e onto pushed refactor `3569bf54f53870fcd4e92cdbbb95e3412f629f3a` as `7e59ba8b3d6f63c30a0fa308c0607dfc1e47dd12`. The landing range has no changes in this row's business/config/Console source paths. Only BUILD-LOG.md and docs/SESSIONS.md conflicted: retained the entire landed file then appended this row's original suffix. All eight manifest-pinned files remain byte-equal to the draft; range-diff differences are log context only. To obey no-force-push while preserving the published draft, the rebased candidate is published on `goldie/row324-r2`; original remote goldie/row324 remains at c4b14952e.
+
+Scratch TMPDIR was created by `mktemp -d /mnt/storage/scratch/tmp/goldieXXXXXX`: `/mnt/storage/scratch/tmp/goldieOdgIjr`. All runs were serialized, with timeout -k 10 (120s new files/mutant driver, 180s existing whole file). Node v26.8.1. No test used /tmp or a real host configuration/credential.
+
+| Order | Whole file / check | Result | Evidence |
+| --- | --- | --- | --- |
+| 1 | packages/business/tests/optional-tracker.test.mjs | 5/5 pass, exit0 | test-business-optional.log |
+| 2 | packages/cli/tests/optional-tracker.test.mjs | 4/4 pass, exit0 | test-cli-optional.log |
+| 3 | packages/business/tests/business.test.mjs | 21/21 pass, exit0 | test-business-existing.log |
+| 4 | Presence-check mutant, targeted omission test | 0/1 pass, exit1, killed as expected | mutant.log, mutant-driver.log |
+| 5 | Restored new business file whole | 5/5 pass, exit0 | test-business-restored.log |
+| 6 | Restored new CLI file whole | 4/4 pass, exit0 | test-cli-restored.log |
+
+No unexpected first-run red or old-test red. The Console absent-tracker read test is the third test in the new CLI file and passed on both whole-file runs. There is no separate edited webui test file; the only test files touched by this row are the three whole files above. Existing fixture preservation is covered by the whole business.test.mjs, including its untouched fixture, role bot, credential, sync bot collision and example checks. Broader package/script gates remain Sage's.
+
+Required mutant diff (business/src/business.mjs:296):
+
+```diff
+-  const tracker = Object.hasOwn(document, "tracker") ? checkTracker(document.tracker, file) : null;
+  const tracker = checkTracker(document.tracker, file);
+```
+
+The new omission test fails with BusinessError `tracker must be a JSON object`. mutant.py restores in finally and checks exact bytes. Restored business.mjs SHA256: `e76db42158f396ec6a44f97320355d6c2254dccb5fc53cd04e8ac42843b0d60a`. Full manifest check passes after restoration. git diff --check passes. The full reader list remains above; reader-audit.txt is its raw grep receipt.
+
+The only pre-existing test delta still is exactly one list entry removed at business.test.mjs:98, under mos-1556: tracker is removed; human/arbiters/projects/roles and the assertion remain. No production/test source changed during verification. Only evidence and append-only log notes follow the tested rebased commit. Slot is returned in the completion report; Duckworth review and Sage's full landing gate remain pending.
+
+Evidence log trailing whitespace is normalized for git diff --check; test results and output content are unchanged.
@@ -0,0 +1,8 @@
+ecd63bcbeae04236c445e74493d425e4a5d1bfb723d72fb58446e1d020e4d429  packages/business/README.md
+e76db42158f396ec6a44f97320355d6c2254dccb5fc53cd04e8ac42843b0d60a  packages/business/src/business.mjs
+afef5c581beb26d0b0797faeb2acd3597597d48c0ce03cf31cce8d9e9b2690b9  packages/business/src/cli.mjs
+2ec0c80361f12c0d90669a3c149dfc5c9607fc9dbad98ccd30d24cf14c0de9b6  packages/cli/src/config.mjs
+46defeb3b4be0e1a22e4b89445872ad6b15cdee182076e9e6222219ae29997f4  packages/webui/src/reads.mjs
+3f99c2d7e41b37f82c3f9edeac3bc795f982dac9a3728f7694cfd5668e944691  packages/business/tests/business.test.mjs
+e92a976bcd6bf97c1cf7832d9e3fe4dec350d92809f26f7b43b938bad7e5dc49  packages/business/tests/optional-tracker.test.mjs
+7723e299fb9a11cf313d3b26df8c0270b15982731dfc0af2463c96f23e1582a2  packages/cli/tests/optional-tracker.test.mjs
@@ -0,0 +1,2 @@
+presence mutant: exit 1
+restored sha256 e76db42158f396ec6a44f97320355d6c2254dccb5fc53cd04e8ac42843b0d60a
@@ -0,0 +1,32 @@
+TAP version 13
+# Subtest: Q247: omitting tracker loads as null and preserves independent role bots
+not ok 1 - Q247: omitting tracker loads as null and preserves independent role bots
+  ---
+  duration_ms: 4.653674
+  type: 'test'
+  location: '/home/jwoltje/.t3/worktrees/mosaic-stack/goldie-row324/packages/business/tests/optional-tracker.test.mjs:21:1'
+  failureType: 'testCodeFailure'
+  error: '/mnt/storage/scratch/tmp/goldieOdgIjr/mosaic-business-IHRJco/config/businesses/acme.json tracker must be a JSON object'
+  code: 'ERR_TEST_FAILURE'
+  name: 'BusinessError'
+  stack: |-
+    refuse (file:///home/jwoltje/.t3/worktrees/mosaic-stack/goldie-row324/packages/business/src/errors.mjs:12:9)
+    requireObject (file:///home/jwoltje/.t3/worktrees/mosaic-stack/goldie-row324/packages/business/src/util.mjs:11:30)
+    checkTracker (file:///home/jwoltje/.t3/worktrees/mosaic-stack/goldie-row324/packages/business/src/business.mjs:87:3)
+    validateBusinessDocument (file:///home/jwoltje/.t3/worktrees/mosaic-stack/goldie-row324/packages/business/src/business.mjs:296:19)
+    loadBusiness (file:///home/jwoltje/.t3/worktrees/mosaic-stack/goldie-row324/packages/business/src/business.mjs:325:10)
+    TestContext.<anonymous> (file:///home/jwoltje/.t3/worktrees/mosaic-stack/goldie-row324/packages/business/tests/optional-tracker.test.mjs:25:13)
+    Test.runInAsyncScope (node:async_hooks:226:14)
+    Test.run (node:internal/test_runner/test:1402:25)
+    Test.start (node:internal/test_runner/test:1262:17)
+    startSubtestAfterBootstrap (node:internal/test_runner/harness:387:17)
+  ...
+1..1
+# tests 1
+# suites 0
+# pass 0
+# fail 1
+# cancelled 0
+# skipped 0
+# todo 0
+# duration_ms 54.363835
@@ -0,0 +1,27 @@
+"""Q247 targeted presence-check mutant; run only in an approved test slot."""
+import hashlib
+import os
+from pathlib import Path
+import subprocess
+
+root = Path(__file__).resolve().parents[4]
+source = root / 'packages/business/src/business.mjs'
+fixed = source.read_bytes()
+needle = b'Object.hasOwn(document, "tracker") ? checkTracker(document.tracker, file) : null'
+assert fixed.count(needle) == 1
+mutant = fixed.replace(needle, b'checkTracker(document.tracker, file)')
+try:
+    source.write_bytes(mutant)
+    result = subprocess.run([
+        'timeout', '-k', '10', '90', 'node', '--test', '--test-reporter=tap',
+        '--test-name-pattern=Q247: omitting tracker',
+        'packages/business/tests/optional-tracker.test.mjs',
+    ], cwd=root, env=os.environ, text=True, stdout=subprocess.PIPE, stderr=subprocess.STDOUT)
+    Path(__file__).with_suffix('.log').write_text(result.stdout)
+    print(f'presence mutant: exit {result.returncode}', flush=True)
+    assert result.returncode == 1, result.stdout
+    assert '# fail 1\n' in result.stdout and 'tracker' in result.stdout, result.stdout
+finally:
+    source.write_bytes(fixed)
+    assert source.read_bytes() == fixed
+    print('restored sha256 ' + hashlib.sha256(fixed).hexdigest(), flush=True)
@@ -0,0 +1,62 @@
+packages/bus/src/broker.mjs:3969:        .filter(([, r]) => r.tracker?.botId !== undefined)
+packages/bus/src/broker.mjs:3970:        .map(([role, r]) => [r.tracker.botId, role]),
+packages/bus/src/broker.mjs:4497:    return { transaction: out.transaction, retry: false, ...(out.tracker ? { bot: out.tracker.bot } : {}) };
+packages/bus/src/broker.mjs:6242:              bot = sync ? b.tracker?.sync?.bot : service === 'vikunja' ? b.roles?.[role]?.tracker?.bot : null;
+packages/bus/src/runtime.mjs:131:      if (b.tracker?.sync?.credentials) references[business + '/@sync'] = b.tracker.sync.credentials;
+packages/bus/src/runtime.mjs:243:      tracker: r?.tracker ?? null,
+packages/bus/src/runtime.mjs:247:      sync: canonicalJson(b.tracker?.sync ?? null),
+packages/business/src/business.mjs:89:  requireObject(tracker.sync, `${where}.sync`);
+packages/business/src/business.mjs:90:  rejectUnknownKeys(tracker.sync, ["bot", "botId", "credentials"], `${where}.sync`);
+packages/business/src/business.mjs:92:    ...checkBot({ bot: tracker.sync.bot, botId: tracker.sync.botId }, `${where}.sync`),
+packages/business/src/business.mjs:93:    credentials: checkCredentialMap(tracker.sync.credentials, ["vikunja"], `${where}.sync.credentials`),
+packages/business/src/business.mjs:143:      if (entry.tracker === undefined) refuse(`${at} needs "tracker" with its Vikunja bot, because ${entry.definition} uses vikunja`);
+packages/business/src/business.mjs:144:      tracker = checkBot(entry.tracker, `${at}.tracker`);
+packages/business/src/business.mjs:145:      if (bots.has(tracker.bot)) refuse(`${at}.tracker.bot ${tracker.bot} is used by another instance`);
+packages/business/src/business.mjs:146:      if (botIds.has(tracker.botId)) refuse(`${at}.tracker.botId ${tracker.botId} is used by another instance`);
+packages/business/src/business.mjs:149:    } else if (entry.tracker !== undefined) {
+packages/business/src/business.mjs:296:  const tracker = Object.hasOwn(document, "tracker") ? checkTracker(document.tracker, file) : null;
+packages/business/src/business.mjs:298:    if (tracker && role.tracker && (role.tracker.bot === tracker.sync.bot || role.tracker.botId === tracker.sync.botId)) {
+packages/business/src/business.mjs:299:      refuse(`${file} tracker.sync must use its own bot, not the one roles.${instance} uses`);
+packages/business/src/cli.mjs:85:    ...Object.values(business.tracker?.sync?.credentials ?? {}),
+packages/business/src/instance-settings.mjs:108:// needs a bus restart, then row 199's issue. A vikunja definition needs args.tracker, an existing
+packages/business/src/instance-settings.mjs:120:      tracker = checkBot(args.tracker, "tracker");
+packages/business/src/instance-settings.mjs:126:    const taken = Object.entries(old.roles).filter(([name, entry]) => name !== instance && entry.tracker).map(([name, entry]) => [name, entry.tracker]);
+packages/business/src/instance-settings.mjs:127:    if (old.tracker?.sync) taken.push(["tracker.sync", old.tracker.sync]);
+packages/business/src/instance-settings.mjs:133:    out.tracker = tracker;
+packages/business/src/instance-settings.mjs:223:      const bot = old.roles[instance]?.tracker?.bot;
+packages/business/src/launch-settings.mjs:161:        definition: entry.definition, vars: entry.vars ?? {}, tracker: entry.tracker ?? null,
+packages/business/src/launch-settings.mjs:235:        if (entry.tracker === null) delete next.roles[instance].tracker;
+packages/business/src/launch-settings.mjs:236:        else if (Object.hasOwn(entry, "tracker")) next.roles[instance].tracker = entry.tracker;
+packages/business/src/resolve.mjs:93:    tracker: entry.tracker,
+packages/cli/src/config.mjs:58:  if (!b.tracker) return null;
+packages/cli/src/instances.mjs:118:  if (bot) args.tracker = { bot: values["--bot"], botId: Number(values["--bot-id"]) };
+packages/conversation/src/controller.mjs:443:    exec.tracker = new Tracker({
+packages/conversation/src/controller.mjs:502:    if (exec.link.poisoned || exec.tracker.overlapped || this.closers.has("uncertain")) return;
+packages/conversation/src/controller.mjs:748:      return { fence: true, closer, fenceIdx: this.exec?.tracker.idx ?? 0 };
+packages/conversation/src/controller.mjs:807:        seam: { replay: "unavailable", streamEpoch: exec?.streamEpoch ?? null, fromSequence: (exec?.seq ?? 0) + 1, reconcile: true, quiet: !exec?.tracker.current && !exec?.tracker.slot },
+packages/conversation/src/controller.mjs:820:    if (exec?.tracker.slot) return refused(BUSY);
+packages/conversation/src/controller.mjs:831:    exec.tracker.attach(slot);
+packages/conversation/src/controller.mjs:888:    const tr = slot.exec.tracker;
+packages/conversation/src/controller.mjs:935:    const tr = exec.tracker;
+packages/conversation/src/controller.mjs:961:    const exec = slot.exec, tr = exec.tracker;
+packages/conversation/src/controller.mjs:997:    this.#settleFailure(exec.tracker.slot, RUN_OVERLAP);
+packages/conversation/src/controller.mjs:1008:    this.evidence.gaps.push({ kind, detail, idx: exec.tracker.idx });
+packages/conversation/src/controller.mjs:1021:    const tr = exec.tracker;
+packages/conversation/src/controller.mjs:1048:    const tr = exec.tracker;
+packages/conversation/src/controller.mjs:1056:    const tr = exec.tracker, s = tr.slot;
+packages/conversation/src/controller.mjs:1268:    const exec = this.exec, tr = exec?.tracker;
+packages/conversation/src/controller.mjs:1308:    const tr = exec.tracker;
+packages/conversation/src/controller.mjs:1330:    exec.tracker.clearWindow = Math.max(0, exec.tracker.clearWindow - 1);
+packages/conversation/src/controller.mjs:1334:    const { exec, stop } = ctx, tr = exec.tracker;
+packages/conversation/src/controller.mjs:1413:    const { exec } = ctx, tr = exec.tracker;
+packages/conversation/src/controller.mjs:1447:    const { exec, stop } = ctx, tr = exec.tracker;
+packages/tasks/src/adapter.mjs:25:  if (!positive(b.tracker?.sync?.botId)) throw new BusError('tracker-config');
+packages/tasks/src/adapter.mjs:28:    if (r.tracker) {
+packages/tasks/src/adapter.mjs:29:      if (!positive(r.tracker.botId) || typeof r.definition !== 'string') throw new BusError('tracker-config');
+packages/tasks/src/adapter.mjs:30:      roles[role] = { definition: r.definition, botId: r.tracker.botId };
+packages/tasks/src/adapter.mjs:35:  for (const [title, id] of Object.entries(b.tracker.labels ?? {})) {
+packages/tasks/src/adapter.mjs:45:  if (b.tracker?.sync?.credentials?.vikunja?.file) out['@sync'] = b.tracker.sync.credentials.vikunja.file;
+packages/tasks/src/adapter.mjs:81:        bots: new Set([businesses[name].tracker.sync.botId, ...Object.values(s.roles).map((r) => r.botId)]),
+packages/webui/src/public/bus.js:785:      if(f==='tracker'&&text.trim()===''){patch.tracker=null;continue;}
+packages/webui/src/reads.mjs:164:    for (const [service, ref] of Object.entries(r.credentials)) credentials.push(credential(service, ref, service === 'vikunja' ? r.tracker?.bot ?? null : null, instance, now));
+packages/webui/src/reads.mjs:166:  for (const [service, ref] of Object.entries(b.tracker?.sync?.credentials ?? {})) credentials.push(credential(service, ref, b.tracker.sync.bot, 'tracker sync', now));
@@ -0,0 +1,136 @@
+TAP version 13
+# Subtest: C2-04: library mappings load without roots, remain frozen, and retain mapping refusals
+ok 1 - C2-04: library mappings load without roots, remain frozen, and retain mapping refusals
+  ---
+  duration_ms: 10.358877
+  type: 'test'
+  ...
+# Subtest: C2-04: an otherwise valid publish grant cannot name a library repo
+ok 2 - C2-04: an otherwise valid publish grant cannot name a library repo
+  ---
+  duration_ms: 1.405968
+  type: 'test'
+  ...
+# Subtest: config directory and file path follow MOSAIC_CONFIG
+ok 3 - config directory and file path follow MOSAIC_CONFIG
+  ---
+  duration_ms: 0.194682
+  type: 'test'
+  ...
+# Subtest: the fixture business validates and comes back frozen
+ok 4 - the fixture business validates and comes back frozen
+  ---
+  duration_ms: 0.883527
+  type: 'test'
+  ...
+# Subtest: two instances may share a definition
+ok 5 - two instances may share a definition
+  ---
+  duration_ms: 0.869413
+  type: 'test'
+  ...
+# Subtest: top-level refusals
+ok 6 - top-level refusals
+  ---
+  duration_ms: 2.622608
+  type: 'test'
+  ...
+# Subtest: arbiters and projects
+ok 7 - arbiters and projects
+  ---
+  duration_ms: 3.523393
+  type: 'test'
+  ...
+# Subtest: role instances
+ok 8 - role instances
+  ---
+  duration_ms: 2.015683
+  type: 'test'
+  ...
+# Subtest: Vikunja bots
+ok 9 - Vikunja bots
+  ---
+  duration_ms: 4.64219
+  type: 'test'
+  ...
+# Subtest: a role without Vikunja takes no tracker block
+ok 10 - a role without Vikunja takes no tracker block
+  ---
+  duration_ms: 5.70969
+  type: 'test'
+  ...
+# Subtest: credential references match the definition's services
+ok 11 - credential references match the definition's services
+  ---
+  duration_ms: 1.94586
+  type: 'test'
+  ...
+# Subtest: launch
+ok 12 - launch
+  ---
+  duration_ms: 6.957271
+  type: 'test'
+  ...
+# Subtest: REQ-THREAD-2 REQ-LAUNCH-1 launch.threadIdleSeconds: absent is the default, a positive integer is used, anything else refuses
+ok 13 - REQ-THREAD-2 REQ-LAUNCH-1 launch.threadIdleSeconds: absent is the default, a positive integer is used, anything else refuses
+  ---
+  duration_ms: 3.58016
+  type: 'test'
+  ...
+# Subtest: loadBusiness: file checks
+ok 14 - loadBusiness: file checks
+  ---
+  duration_ms: 1.772126
+  type: 'test'
+  ...
+# Subtest: loadBusiness: not a regular file
+ok 15 - loadBusiness: not a regular file
+  ---
+  duration_ms: 40.121918
+  type: 'test'
+  ...
+# Subtest: loading writes nothing
+ok 16 - loading writes nothing
+  ---
+  duration_ms: 1.07771
+  type: 'test'
+  ...
+# Subtest: names that are Object.prototype properties don't count as declared
+ok 17 - names that are Object.prototype properties don't count as declared
+  ---
+  duration_ms: 3.194384
+  type: 'test'
+  ...
+# Subtest: the shipped example refuses as written and validates once filled in
+ok 18 - the shipped example refuses as written and validates once filled in
+  ---
+  duration_ms: 0.919964
+  type: 'test'
+  ...
+# Subtest: persona vars: agent layer, creative definition only, both or neither
+ok 19 - persona vars: agent layer, creative definition only, both or neither
+  ---
+  duration_ms: 7.866405
+  type: 'test'
+  ...
+# Subtest: row 194 keep, noHire and retired validate, and a file without them loads as before
+ok 20 - row 194 keep, noHire and retired validate, and a file without them loads as before
+  ---
+  duration_ms: 1.704708
+  type: 'test'
+  ...
+# Subtest: row 194 each bad keep, noHire or retired entry refuses
+ok 21 - row 194 each bad keep, noHire or retired entry refuses
+  ---
+  duration_ms: 5.095541
+  type: 'test'
+  ...
+1..21
+# tests 21
+# suites 0
+# pass 21
+# fail 0
+# cancelled 0
+# skipped 0
+# todo 0
+# duration_ms 159.214713
@@ -0,0 +1,40 @@
+TAP version 13
+# Subtest: Q247: omitting tracker loads as null and preserves independent role bots
+ok 1 - Q247: omitting tracker loads as null and preserves independent role bots
+  ---
+  duration_ms: 5.298841
+  type: 'test'
+  ...
+# Subtest: Q247: real business validate passes without a sync credential reference or file
+ok 2 - Q247: real business validate passes without a sync credential reference or file
+  ---
+  duration_ms: 71.475563
+  type: 'test'
+  ...
+# Subtest: Q247: present tracker retains its values and validation without mutating the input
+ok 3 - Q247: present tracker retains its values and validation without mutating the input
+  ---
+  duration_ms: 2.384907
+  type: 'test'
+  ...
+# Subtest: Q247: present null, undefined and malformed trackers still refuse
+ok 4 - Q247: present null, undefined and malformed trackers still refuse
+  ---
+  duration_ms: 3.746
+  type: 'test'
+  ...
+# Subtest: Q247: absent business tracker does not waive a role's Vikunja bot requirement
+ok 5 - Q247: absent business tracker does not waive a role's Vikunja bot requirement
+  ---
+  duration_ms: 0.804648
+  type: 'test'
+  ...
+1..5
+# tests 5
+# suites 0
+# pass 5
+# fail 0
+# cancelled 0
+# skipped 0
+# todo 0
+# duration_ms 135.467249
@@ -0,0 +1,40 @@
+TAP version 13
+# Subtest: Q247: omitting tracker loads as null and preserves independent role bots
+ok 1 - Q247: omitting tracker loads as null and preserves independent role bots
+  ---
+  duration_ms: 5.02203
+  type: 'test'
+  ...
+# Subtest: Q247: real business validate passes without a sync credential reference or file
+ok 2 - Q247: real business validate passes without a sync credential reference or file
+  ---
+  duration_ms: 68.916604
+  type: 'test'
+  ...
+# Subtest: Q247: present tracker retains its values and validation without mutating the input
+ok 3 - Q247: present tracker retains its values and validation without mutating the input
+  ---
+  duration_ms: 2.414133
+  type: 'test'
+  ...
+# Subtest: Q247: present null, undefined and malformed trackers still refuse
+ok 4 - Q247: present null, undefined and malformed trackers still refuse
+  ---
+  duration_ms: 3.820979
+  type: 'test'
+  ...
+# Subtest: Q247: absent business tracker does not waive a role's Vikunja bot requirement
+ok 5 - Q247: absent business tracker does not waive a role's Vikunja bot requirement
+  ---
+  duration_ms: 0.873886
+  type: 'test'
+  ...
+1..5
+# tests 5
+# suites 0
+# pass 5
+# fail 0
+# cancelled 0
+# skipped 0
+# todo 0
+# duration_ms 135.196828
@@ -0,0 +1,34 @@
+TAP version 13
+# Subtest: Q247: bootConfig omits tracker setup even with tracker variables left in the business
+ok 1 - Q247: bootConfig omits tracker setup even with tracker variables left in the business
+  ---
+  duration_ms: 5.854825
+  type: 'test'
+  ...
+# Subtest: Q247: trackerless business boots and registers no @sync credential
+ok 2 - Q247: trackerless business boots and registers no @sync credential
+  ---
+  duration_ms: 48.935736
+  type: 'test'
+  ...
+# Subtest: Q247: Console business read works with tracker absent and shows no sync credential
+ok 3 - Q247: Console business read works with tracker absent and shows no sync credential
+  ---
+  duration_ms: 1.663483
+  type: 'test'
+  ...
+# Subtest: Q247: a present tracker with a missing token still refuses bus boot
+ok 4 - Q247: a present tracker with a missing token still refuses bus boot
+  ---
+  duration_ms: 11.355417
+  type: 'test'
+  ...
+1..4
+# tests 4
+# suites 0
+# pass 4
+# fail 0
+# cancelled 0
+# skipped 0
+# todo 0
+# duration_ms 226.91643
@@ -0,0 +1,34 @@
+TAP version 13
+# Subtest: Q247: bootConfig omits tracker setup even with tracker variables left in the business
+ok 1 - Q247: bootConfig omits tracker setup even with tracker variables left in the business
+  ---
+  duration_ms: 5.203349
+  type: 'test'
+  ...
+# Subtest: Q247: trackerless business boots and registers no @sync credential
+ok 2 - Q247: trackerless business boots and registers no @sync credential
+  ---
+  duration_ms: 46.033814
+  type: 'test'
+  ...
+# Subtest: Q247: Console business read works with tracker absent and shows no sync credential
+ok 3 - Q247: Console business read works with tracker absent and shows no sync credential
+  ---
+  duration_ms: 1.547096
+  type: 'test'
+  ...
+# Subtest: Q247: a present tracker with a missing token still refuses bus boot
+ok 4 - Q247: a present tracker with a missing token still refuses bus boot
+  ---
+  duration_ms: 11.051525
+  type: 'test'
+  ...
+1..4
+# tests 4
+# suites 0
+# pass 4
+# fail 0
+# cancelled 0
+# skipped 0
+# todo 0
+# duration_ms 195.359585
@@ -0,0 +1,48 @@
+# Row 325 / #1821 — Case 1 project key
+
+Goldie, 2026-10-24. Branch goldie/row325, base99930362e4b8a64d5425b10ca087b2d1f93ae538. Separate worktree /home/jwoltje/.t3/worktrees/mosaic-stack/goldie-row325. Brief pinned at60d78e44e:docs/plans/2026-10-24_case1-project-key-brief.md, section Brief: re-key the Case1 project to stack. Mos-1563 fixes the business document and preserves project id. Reviewer Gladstone; Sage owns review posting/landing. No queue writes authorized or performed.
+
+## Defect and change
+
+The real .mosaic/project.json declares id stack; the Case1 business document incorrectly keyed its project mosaic-stack. Real business validation checks equality at packages/business/src/cli.mjs:80, so the install refused once the host held the project file. Row323's scratch execution root omitted that file and exercised only the warning/absent branch, missing the deployment mismatch.
+
+Only the projects object's key changes to stack in docs/guides/case1-business.mosaic-stack.json. Business id stays mosaic-stack, root stays /srv/mosaic/src/mosaic-stack, and every other field is unchanged. No .mosaic/project.json edit or product/schema/role change.
+
+The new packages/business/tests/case1-project-key.test.mjs reads the repo's real .mosaic/project.json bytes, asserts exactly one matching Case1 key, copies those bytes unchanged into a scratch project root, and calls the actual business CLI validate path with a temporary system/business config. Positive output must report the project valid, not absent. Negative coverage re-keys the same fixture to mosaic-stack and requires exit2 plus the real project-id mismatch message; missing-file warnings cannot stand in for validation.
+
+Mos-1564 (mos-1272) authorizes exactly one pre-existing test line: case1-business-file.test.mjs:70's expected key changes to stack; all other bytes/assertions remain unchanged. No other old test is touched. This is explicitly the obsolete expectation caused by the product correction, not a relaxed assertion.
+
+## Verification plan / state
+
+No tests run before Sage CLEAR. Static node --check, JSON parse and diff checks only. On CLEAR, one run at a time: new test file whole, business suite whole (includes the one updated old test), one old-key mutant, restored whole new file to verify restoration. Every run gets fresh `export TMPDIR=$(mktemp -d /mnt/storage/scratch/tmp/XXXXXX)`, timeout-k10, and the established UTC/load/busy-helper log header. Stop/report on any other old-test red; no further old-test edits. First unexpected new-test red is recorded/reported under the continuing mos-1272 rule.
+
+mutant.py changes only the projects key back to mosaic-stack, runs the new exact-key assertion, requires expected exit1/fail1, then restores/checks bytes in finally. Prepared, not run. Sage's landing gate supplies CLI suite counts.
+
+The dependency setup is an ignored root node_modules symlink to /mnt/storage/src/mosaic-stack/node_modules; no dependency installation/pin change. MANIFEST.sha256 covers business JSON, the one old test, new test, and real project document as an unchanged reference. Final review report goes to both Sage and Gladstone with tip/base/manifest. No host contact, credential access, queue write or refactor push.
+
+## Verification — sage-3882 CLEAR
+
+All four runs were serial on the same final source bytes, using timeout-k10, fresh31-byte TMPDIRs from /mnt/storage/scratch/tmp/XXXXXX, and date-u/uptime/busy-helper headers. Node v26.8.1. No first-run new-test red and no old-test red. No CLI suite run; Sage's landing gate supplies that scope.
+
+| Run / log | UTC start | Load averages | Busy | Result / TMPDIR |
+| --- | --- | --- | --- | --- |
+| test-new.log | 2026-10-24 01:13:40 | 1.34,1.60,2.50 | CLEAR | Whole new file3/3 pass, 172.161691ms; hchZu2 |
+| test-business.log | 2026-10-24 01:13:50 | 1.36,1.59,2.49 | CLEAR | Whole business suite264/264 pass, 6478.924028ms; yWVbwY |
+| mutant-driver.log + mutant.log | 2026-10-24 01:14:04 | 1.36,1.58,2.47 | CLEAR | Old-key mutant killed, targeted new test0/1, expected exit1; driver exit0; YsOE6N |
+| test-restored.log | 2026-10-24 01:14:14 | 1.15,1.53,2.44 | CLEAR | Restored new file3/3 pass, 169.948442ms; Y43Jju |
+
+All TMPDIRs are under /mnt/storage/scratch/tmp/. New/restored/mutant driver limits180s, business600s, each timeout-k10. Positive runs have0 failures/skips/cancellations. The business suite includes the entire old case1-business-file.test.mjs, with only the mos-1564-approved key assertion changed.
+
+Mutant diff in business JSON:
+
+```diff
+   "projects": {
+-    "stack": {
+    "mosaic-stack": {
+```
+
+The exact-key new test fails deepStrictEqual (actual mosaic-stack, expected stack); raw evidence is mutant.log. mutant.py restores in finally and checks exact bytes. Restored JSON SHA256 `9e43bfef326e568488aaa4f0d8882e9b932750aeb39f587a113a226bfb30cf0f`; all4 MANIFEST.sha256 entries verify, including unchanged .mosaic/project.json. Whole new file passed again after restoration. git diff --check passed.
+
+Final source accounting: business JSON1+/1-, only projects key; old test1+/1-, only expected key at70; new test file with3 cases; no other old-test line touched. Business id/root remain unchanged. Root-cause gap is now covered by byte-identical real project fixture plus required valid result and old-key refusal. No host action, credentials, queue writes, refactor push or unapproved scope change.
+
+Logs have trailing whitespace normalized for git diff --check, with substantive output/results unchanged. The slot is returned in the report accompanying the pushed candidate; Gladstone first review and Sage landing gate remain pending.
@@ -0,0 +1,4 @@
+9e43bfef326e568488aaa4f0d8882e9b932750aeb39f587a113a226bfb30cf0f  docs/guides/case1-business.mosaic-stack.json
+9c3bf7f349d0ee8626743e1388b9a596c7f3c274beaedad5106db5f2ff8f65e7  packages/business/tests/case1-business-file.test.mjs
+b543ac6afbfb336c5566f359ff357904b36f413d5f75fcd54a5a8b72aef1dbd6  packages/business/tests/case1-project-key.test.mjs
+044714a37c267b70279977ea8ca429df7a28463271b884afd79a01bc27afa259  .mosaic/project.json
@@ -0,0 +1,6 @@
+Sat Oct 24 01:14:04 UTC 2026
+ 20:14:04 up 10 days, 11:33,  2 users,  load average: 1.36, 1.58, 2.47
+CLEAR
+TMPDIR=/mnt/storage/scratch/tmp/YsOE6N bytes=31
+old-key mutant: exit 1
+restored sha256 9e43bfef326e568488aaa4f0d8882e9b932750aeb39f587a113a226bfb30cf0f
@@ -0,0 +1,40 @@
+TAP version 13
+# Subtest: row 325: the Case 1 project's sole key matches the repository project id
+not ok 1 - row 325: the Case 1 project's sole key matches the repository project id
+  ---
+  duration_ms: 2.058961
+  type: 'test'
+  location: '/home/jwoltje/.t3/worktrees/mosaic-stack/goldie-row325/packages/business/tests/case1-project-key.test.mjs:38:1'
+  failureType: 'testCodeFailure'
+  error: |-
+    Expected values to be strictly deep-equal:
+    + actual - expected
+
+      [
+    +   'mosaic-stack'
+    -   'stack'
+      ]
+
+  code: 'ERR_ASSERTION'
+  name: 'AssertionError'
+  expected:
+    0: 'stack'
+  actual:
+    0: 'mosaic-stack'
+  operator: 'deepStrictEqual'
+  stack: |-
+    TestContext.<anonymous> (file:///home/jwoltje/.t3/worktrees/mosaic-stack/goldie-row325/packages/business/tests/case1-project-key.test.mjs:42:10)
+    Test.runInAsyncScope (node:async_hooks:226:14)
+    Test.run (node:internal/test_runner/test:1402:25)
+    Test.start (node:internal/test_runner/test:1262:17)
+    startSubtestAfterBootstrap (node:internal/test_runner/harness:387:17)
+  ...
+1..1
+# tests 1
+# suites 0
+# pass 0
+# fail 1
+# cancelled 0
+# skipped 0
+# todo 0
+# duration_ms 44.416722
@@ -0,0 +1,26 @@
+"""Row 325 old-project-key mutant; run only in Sage's test slot."""
+import hashlib
+import os
+from pathlib import Path
+import subprocess
+
+root = Path(__file__).resolve().parents[4]
+source = root / 'docs/guides/case1-business.mosaic-stack.json'
+fixed = source.read_bytes()
+needle = b'"projects": {\n    "stack": {'
+assert fixed.count(needle) == 1
+try:
+    source.write_bytes(fixed.replace(needle, b'"projects": {\n    "mosaic-stack": {'))
+    result = subprocess.run([
+        'timeout', '-k', '10', '90', 'node', '--test', '--test-reporter=tap',
+        '--test-name-pattern=row 325: the Case 1 project',
+        'packages/business/tests/case1-project-key.test.mjs',
+    ], cwd=root, env=os.environ, text=True, stdout=subprocess.PIPE, stderr=subprocess.STDOUT)
+    Path(__file__).with_suffix('.log').write_text(result.stdout)
+    print(f'old-key mutant: exit {result.returncode}', flush=True)
+    assert result.returncode == 1, result.stdout
+    assert '# fail 1\n' in result.stdout and 'mosaic-stack' in result.stdout, result.stdout
+finally:
+    source.write_bytes(fixed)
+    assert source.read_bytes() == fixed
+    print('restored sha256 ' + hashlib.sha256(fixed).hexdigest(), flush=True)
@@ -0,0 +1,32 @@
+Sat Oct 24 01:13:40 UTC 2026
+ 20:13:40 up 10 days, 11:33,  2 users,  load average: 1.34, 1.60, 2.50
+CLEAR
+TMPDIR=/mnt/storage/scratch/tmp/hchZu2 bytes=31
+TAP version 13
+# Subtest: row 325: the Case 1 project's sole key matches the repository project id
+ok 1 - row 325: the Case 1 project's sole key matches the repository project id
+  ---
+  duration_ms: 4.262251
+  type: 'test'
+  ...
+# Subtest: row 325: real business validate reports the copied repository project valid
+ok 2 - row 325: real business validate reports the copied repository project valid
+  ---
+  duration_ms: 67.962164
+  type: 'test'
+  ...
+# Subtest: row 325: the old mosaic-stack project key refuses against those same project bytes
+ok 3 - row 325: the old mosaic-stack project key refuses against those same project bytes
+  ---
+  duration_ms: 57.926665
+  type: 'test'
+  ...
+1..3
+# tests 3
+# suites 0
+# pass 3
+# fail 0
+# cancelled 0
+# skipped 0
+# todo 0
+# duration_ms 172.161691
@@ -0,0 +1,32 @@
+Sat Oct 24 01:14:14 UTC 2026
+ 20:14:14 up 10 days, 11:34,  2 users,  load average: 1.15, 1.53, 2.44
+CLEAR
+TMPDIR=/mnt/storage/scratch/tmp/Y43Jju bytes=31
+TAP version 13
+# Subtest: row 325: the Case 1 project's sole key matches the repository project id
+ok 1 - row 325: the Case 1 project's sole key matches the repository project id
+  ---
+  duration_ms: 4.401838
+  type: 'test'
+  ...
+# Subtest: row 325: real business validate reports the copied repository project valid
+ok 2 - row 325: real business validate reports the copied repository project valid
+  ---
+  duration_ms: 60.555647
+  type: 'test'
+  ...
+# Subtest: row 325: the old mosaic-stack project key refuses against those same project bytes
+ok 3 - row 325: the old mosaic-stack project key refuses against those same project bytes
+  ---
+  duration_ms: 63.16989
+  type: 'test'
+  ...
+1..3
+# tests 3
+# suites 0
+# pass 3
+# fail 0
+# cancelled 0
+# skipped 0
+# todo 0
+# duration_ms 169.948442
@@ -0,0 +1,56 @@
+# Row 326 / #1822 — five run-sheet gaps
+
+Goldie, 2026-10-24. Branch goldie/row-run-sheet in /home/jwoltje/.t3/worktrees/mosaic-stack/goldie-row-run-sheet. Base local refactor4ec279dc43922b338a94718a2afdaba87ef89c15, explicitly assigned by sage-3893. Brief docs/plans/2026-10-24_run-sheet-doc-brief.md at4ec279dc4, blobce3e24fa, section Brief: five run-sheet gaps. Reviewer Gladstone; Sage posts review and owns landing/full gate.
+
+## Before / after and choices
+
+Before: the sheet omitted proof bytes/newline handling, treated render refusal without distinguishing metadata/content, omitted missing-project warning consequences and a pre-install key check, offered no first-install retry form, and omitted the bus-relative backup checksum form.
+
+After: the sheet covers all five cases in their existing sections6/9. Numbered section headings are unchanged. Only this BUILD.md and docs/guides/host-run-sheet.md are edited, per the brief's explicit two-file boundary. Session/build-phase registration and the manifest are recorded here rather than adding changes to SESSIONS.md, BUILD-LOG.md or a third manifest file. No host action or credential read. No suite or product command executed, and no CLEAR needed for this doc-only row (decision137).
+
+| Gap / claim | Source read and how it supports the text |
+| --- | --- |
+| Proof format, optional LF | webui/src/serve.mjs:257-267 opens no-follow, checks regular/uid/mode600-or400, strips exactly one trailing LF at263, then requires32+ ASCII base64url chars at264. Table states the allowed alphabet and one optional trailing LF. Extra newline/CR is outside that alphabet. |
+| Render versus start | case2-unit.sh:397-408 explicitly stats/realpaths the proof and never opens it. webui/src/serve.mjs:267 throws the content error; webui/src/cli.mjs:138-140 catches and sets exit2. Table now distinguishes metadata refusal at render from bad bytes at Console start. |
+| Missing project warning | business/src/cli.mjs:74-78 reports absent plus the no-project-variables warning, then continues. case2-install.sh:217-221 captures validate output and prints business-validates on success. Text makes that incomplete install possible and tells operators to stop on the missing-file warning, per Duckworth row323 N2. |
+| Pre-install key check | business/src/cli.mjs:71-82 checks every file-backed project, skips kind library, and requires loaded id==business key at80. Read-only inline Node uses only builtins and section2's pinned node, as mosaic. It reads the exact intended business input and files under each project's root, prints a match, and exits nonzero with STOP for read/JSON/id failure. Expected .53 output comes from .mosaic/project.json:3 and case1-business.mosaic-stack.json:10-11. Fixing business rather than project id is mos-1563. |
+| Why check before install | case2-install.sh:178 makes the copy before validation at217. New check is explicitly before case2-install.sh and needs no existing Mosaic config, npm modules or installed wrapper. |
+| Refused first-install residue | case2-install.sh:172/174 creates/bootstraps the config; bootstrap.sh:13 dispatches to mosaic-config.mjs, whose412-424 creates config.json or validates an existing one without rewriting it. case2-install.sh:200-211 may create businesses/file and library slots. case2-persona-import.mjs:300-308 may create library personas. Validation cleanup at case2-install.sh:217-219 removes only this run's new business file, retaining dirs. Copy may already exist under the path at install:80/178; stack-copy.sh:68 reuses an existing copy. |
+| Retry paths / refs | Mos-1565/ops-0291, as pinned in the brief, names exactly root checkout, mosaic clone and default config dir to move aside. UTC-suffixed mv is root-only documentation; no delete, chown or chmod. Destination collision/move failure prints STOP. Retry starts section6's first-install block again. The existing upgrade fetch targets only refs/remotes/origin/refactor; stack-copy.sh:44-48 requires reachability from both it and refs/heads/refactor. |
+| Credential re-placement | Existing sheet section9 names claude-session.env, library proof and library-gitea with owner/mode. Moving config aside preserves them but the new config needs Jason to re-place any already-filled files, under mos-1565. Existing per-agent slots still require credentials issue/Approve, never hand placement. No value or command to read a credential added. |
+| Backup hand check | stack-release.sh:475-482 creates activation/bus and writes SHA256SUMS from inside bus. restore at502 and rehearsal at2244 cd bus and check ../SHA256SUMS. New hand command does the same as mosaic, without --quiet so the expected bus.sqlite:OK is visible; ops-0292 records why checking in activation itself fails. |
+
+## Read-only grep gate
+
+Executed after editing, with no test/suite run:
+
+```
+git grep -n host-run-sheet -- 'packages/*/tests/*' 'scripts/*'
+# no output, exit1
+
+git grep -n case1-business.mosaic-stack.json -- 'packages/*/tests/*' 'scripts/*'
+packages/business/tests/case1-business-file.test.mjs:13:const DOCUMENT = join(REPO, "docs/guides/case1-business.mosaic-stack.json");
+packages/business/tests/case1-project-key.test.mjs:9:const CASE1 = join(REPO, "docs/guides/case1-business.mosaic-stack.json");
+# exit0: positive control, same command form, both tests read this document
+
+git grep -n -E '(host-run-sheet.*[0-9a-f]{64}|[0-9a-f]{64}.*host-run-sheet)' -- 'packages/*/tests/*'
+# no output, exit1: no 64-hex test pin beside the sheet name
+```
+
+An earlier positive control with case2-install.sh also found the real installer spawn in case1-business-file.test.mjs:39 and the CLI installer tests. The sheet-name search finds no reference at all in tests/scripts, stronger than just finding no same-line pin. No read/pin blocker.
+
+Static syntax only: extracted the three new shell snippets, replaced only the version placeholder for parsing, and ran bash-n3/3. Extracted Node heredoc parsed with node --check --input-type=module. No snippet body executed. git diff --check passes. Source citations checked against this base; no new em dash and section numbering unchanged.
+
+## Session / claimant receipt
+
+2026-10-24 | Goldie a13dd6d5-5e73-4b7d-8318-02abeff24940 | Row326/#1822 doc-only build | Five gaps documented with source lines and grep control; no suites/host/credential action. Claim goldie-0326-start-1 rev3793, briefed→in-progress. In-review follows the pushed candidate; expected tokenless pre-send failure will be handed to Sage.
+
+## Inline manifest
+
+Only the sheet needs a content pin; BUILD.md is this receipt in the same candidate commit. An inline manifest honors the brief's two-file limit:
+
+```
+e4c14516edff3bfbc81ea553a5a6ccebb6154942473540659d4681c2d56c9711  docs/guides/host-run-sheet.md
+```
+
+Reviewer validates the five source chains and operational order. Sage's landing gate owns suites. No code row265 work started; its brief comes separately.
@@ -0,0 +1,10 @@
+# Gyro
+
+Builder seat, Codex gpt-6.1-sol, started by Sage under Q246 and mos-1571, as the W2 brief names. Owns row 310, O2 W2:
+the WordCraft source import and reproducible restricted web build (docs/plans/2026-10-21_q195-writing-editor.md,
+"W2 WordCraft source import and reproducible restricted web build").
+
+No launcher in this directory. The seat runs as a T3 thread and works in its own worktree. It has no credentials of its
+own; it pushes only its own `gyro/*` branches through the repository credential helper (mos-0981), never `refactor`,
+`main` or another seat's branch. Claude seats orchestrate and give the Opus 5.5 landing review (mos-1571). Registered by
+Sage on 2026-10-24 so the queue can name the seat as row owner (store.mjs isSeatDir).
@@ -0,0 +1,592 @@
+# Row 310 W2 WordCraft restricted source build
+
+Started 2026-10-24 by Gyro, T3 thread 4c520dc8-238f-4f76-a973-28f2ef87310d.
+Issue #1824; branch gyro/row310; base d16958bcf.
+
+## Authority and constraints
+
+Sage dispatch sage-3970 implements the approved W2 brief under Q246/mos-1571.
+Read AGENTS.md, agents/gyro/README.md, D2/F4/D6-D9/G1/S0/W2 in
+`docs/plans/2026-10-21_q195-writing-editor.md`, S0 report/inventory and CSP
+measurement using `git show 74ec32013:<path>`, and Louie's pinned evaluation.
+S0 is evidence, never modified. Protected source is read-only at
+`e05b7fe86f3b85454000dffc321de638d7009817`, WordCraft 0.9.0.
+No source checkout builds, live services/configuration, credentials, private books,
+frame routes, shell CSP changes, policy expansion or dependency/tool changes.
+All build/test runs need Sage CLEAR and use low priority, at most four jobs,
+and TMPDIR freshly allocated beneath /mnt/storage/scratch/tmp.
+No commit before applicable checks pass; report source/vendor bytes before commit
+and every product binary path/size before first push. Push gyro/* only after ruling.
+
+## Implementation plan
+
+The existing approved design fixes the approach: immutable original import plus a
+reviewable patch applied to isolated build roots, offline vendor inputs and pinned
+tool hashes. An edited upstream import would lose the original-source receipt;
+Louie's built files cannot substitute for a reproducible source build.
+
+- [ ] Inventory original tracked input paths/bytes/hashes; import via git archive
+  into third_party/wordcraft/upstream. Inventory 209 reviewed packages and exact
+  git pins from S0; vendor only approved inputs with license/source receipts.
+- [ ] Write provenance/build refusal tests first: changed/missing inputs, extra
+  dependencies, wrong tools, non-offline build, unshipped runtime dependency,
+  inline bootstrap/styles and stale output manifests must refuse.
+- [ ] Implement build.mjs/toolchain.json/PROVENANCE.json/NOTICE and source patch.
+  Build from copied owned source with path remapping, stable environment and
+  manifest verification; external frame HTML/CSS/module bootstrap; package all
+  runtime files under src/public/wordcraft without serving them.
+- [ ] Carry M1-M14 explicitly through patch and acceptance inventory. Host hooks
+  replace rfd/picker/download/print; block raw drops, local font enumeration,
+  persisted prose/fonts and direct outbound navigation. W6 owns production
+  bridge/routes, host import watchdog/sandbox and malformed corpus integration;
+  no placeholder is counted as passing mitigation evidence.
+- [ ] Request CLEAR for each build/test stage. Build twice at different absolute
+  roots offline with the pinned tools. Compare every integration output hash,
+  record bytes/tool hashes/timings and run each touched test file independently,
+  affected WebUI suite and required repository checks on the assigned slot.
+- [ ] Use scratch fixtures to measure exact Q234 style-src 'self' CSP with full
+  function coverage including host-owned Print, zero violations, no rfd/file
+  picker/download fallback and no external traffic. Preserve plain-text receipts.
+- [ ] Report source/vendor totals and product binary inventory to Sage. After
+  checks/ruling, commit, push gyro/row310 through helper, send Sage and Gladstone
+  base/tip plus sha256 for every changed path. Move only row 310 to in-review;
+  Sage posts Gitea request. Filbert rechecks inventory once at landing.
+
+## Acceptance risks to resolve
+
+1. Vendor resolution must match reviewed normal/build closure, while preserving
+   original Cargo.lock and accounting for workspace-only dependency resolution.
+2. Tool identity includes Rust target std and actual Trunk/wasm helper executables;
+   installed versions alone cannot establish tool identity.
+3. Removing one Services hook leaves UI/engine fallbacks; trace all before patching.
+4. Root-independent WASM includes generated build metadata; wasm-bindgen-shared's
+   git probing and absolute source paths need deterministic inputs/remapping.
+5. W2 scratch host coverage must be real bytes/function behavior; W6 mitigation
+   gates remain explicit where production bridge authority is not yet available.
+
+## Activity and evidence
+
+- Initial worktree clean; HEAD d16958bcf, correct branch. Protected source HEAD
+  matches pin and git status is clean. No build or test has run.
+- `scripts/mosaic queue next gyro` correctly refused in linked worktree. Retried
+  through canonical checkout as documented; operation still running at this note.
+- Sage CLEAR sage-3973 covers new test red/green, offline metadata/tree/vendor prep
+  and one restricted release build with nice 19 / four jobs / fresh TMPDIR.
+- Retried identical queue op gyro-0001 after Glomgold released lock: success,
+  revision 3857, row 310 briefed -> in-progress.
+- Count reconciliation: F4's 199 counts third-party normal dependency edges for
+  wordcraft-web/wasm32-unknown-unknown. S0 adds 10 build-only dependencies, hence
+  209 third-party source/notice inputs, plus 15 local crates = 224 records.
+  These are distinct closures, not a dependency expansion. Current vendor is
+  exactly those 209 package identities, 10,499 files / 130,737,232 bytes before
+  final packaging corrections; upstream is 612 files / 26,913,076 bytes.
+- New provenance/build tests ran individually under CLEAR; each has 2 expected
+  first-run failures because the owned verifier/builder does not exist yet.
+- First offline metadata probe caught an error in my git-manifest normalization:
+  replacing version.workspace as a substring also changed rust-version.workspace.
+  No upstream input changed. Correcting anchored substitutions before repeating.
+
+### Build-only manifest reduction (sage-3974)
+
+- Cargo.toml: members reduced to the 15 reviewed local crates; default member wordcraft-web. No runtime feature changes.
+- crates/doc/Cargo.toml: remove [dev-dependencies] from isolated build copy; excluded dev/test or native-only resolution.
+- crates/docbin/Cargo.toml: remove [dev-dependencies] from isolated build copy; excluded dev/test or native-only resolution.
+- crates/docx/Cargo.toml: remove [dev-dependencies] from isolated build copy; excluded dev/test or native-only resolution.
+- crates/engine/Cargo.toml: remove [target.'cfg(not(target_arch = "wasm32"))'.dependencies] from isolated build copy; excluded dev/test or native-only resolution.
+- crates/engine/Cargo.toml: remove [dev-dependencies] from isolated build copy; excluded dev/test or native-only resolution.
+- crates/formats/Cargo.toml: remove [dev-dependencies] from isolated build copy; excluded dev/test or native-only resolution.
+- crates/pdf/Cargo.toml: remove [dev-dependencies] from isolated build copy; excluded dev/test or native-only resolution.
+- crates/proof/Cargo.toml: remove [dev-dependencies] from isolated build copy; excluded dev/test or native-only resolution.
+- crates/render/Cargo.toml: remove [target.'cfg(not(target_arch = "wasm32"))'.dependencies] from isolated build copy; excluded dev/test or native-only resolution.
+- crates/ui-egui/Cargo.toml: remove [target.'cfg(target_os = "linux")'.dependencies] from isolated build copy; excluded dev/test or native-only resolution.
+- crates/ui-egui/Cargo.toml: remove [dev-dependencies] from isolated build copy; excluded dev/test or native-only resolution.
+- crates/zotero/Cargo.toml: remove [dev-dependencies] from isolated build copy; excluded dev/test or native-only resolution.
+- sage-3976 permits proven-false target-section removal in THIRD-PARTY manifests
+  only in isolated build copies, with matching checksum rewrites. A three-valued
+  cfg analysis keeps unknown/custom flags/features unchanged and identifies 26
+  manifests / 57 false-target dependency sections; target-filter-plan.json lists
+  every crate/cfg/dependency. This is below the ~30-manifest stop boundary.
+- The scratch-only filtered source still refuses: wgpu-core's dormant `angle`
+  feature references its removed Apple-only dependency. Stopped at the explicit
+  feature-definition boundary and sent gyro-0006 to Sage. No feature edited.
+- Tool versions match all five pins; toolchain.json records their binary hashes
+  and the Rust compiler driver/wasm target support files. No release build yet.
+- Current notice bundle includes 209 third-party package mappings, local source
+  license/attribution/font texts and self_cell/ryu Apache-2.0 elections. Source
+  verifier green: 2/2. Output/build acceptance remains red/unimplemented.
+
+### Original-source subset (sage-3976)
+
+Excluded whole directories assets/app-icon/, docs/images/ and packaging/macos/: web frame serves no icon; screenshots and macOS packaging are never build inputs. Every license/notice/copyright remains. Included files remain byte-identical; no vendor file removed. Exact excluded paths:
+
+- assets/app-icon/hicolor/128x128/apps/ai.storyteller.wordcraft.png
+- assets/app-icon/hicolor/16x16/apps/ai.storyteller.wordcraft.png
+- assets/app-icon/hicolor/24x24/apps/ai.storyteller.wordcraft.png
+- assets/app-icon/hicolor/256x256/apps/ai.storyteller.wordcraft.png
+- assets/app-icon/hicolor/32x32/apps/ai.storyteller.wordcraft.png
+- assets/app-icon/hicolor/48x48/apps/ai.storyteller.wordcraft.png
+- assets/app-icon/hicolor/512x512/apps/ai.storyteller.wordcraft.png
+- assets/app-icon/hicolor/64x64/apps/ai.storyteller.wordcraft.png
+- assets/app-icon/hicolor/scalable/apps/ai.storyteller.wordcraft.svg
+- assets/app-icon/wordcraft-1024.png
+- assets/app-icon/wordcraft-macos-512.png
+- assets/app-icon/wordcraft.icns
+- assets/app-icon/wordcraft.ico
+- assets/app-icon/wordcraft.svg
+- docs/images/backstage.png
+- docs/images/dark.png
+- docs/images/design.png
+- docs/images/hero.png
+- docs/images/layout.png
+- docs/images/references.png
+- docs/images/review.png
+- packaging/macos/Info.plist.in
+- packaging/macos/dmg/README.md
+- packaging/macos/dmg/background.svg
+- packaging/macos/dmg/background.tiff
+- packaging/macos/dmg/dmg-layout.DS_Store
+- packaging/macos/dmg/generate.py
+- packaging/macos/entitlements.plist
+- packaging/macos/import-cert.sh
+- packaging/macos/package.sh
+- sage-3982 approved the 103 enumerated feature items across eight manifests,
+  mechanical script only, build copies only. Scratch application completed;
+  original vendor unchanged. A committed reproducible generator/test is pending
+  the packaging decision; no third-party source/feature edits are hand-applied.
+- sage-3983 permits custom cfg fuzzing/loom/miri false under a sanitized,
+  refusing release environment. Third-party target inventory is now 28 manifests
+  / 59 sections. It narrows the feature gate to root-specific package/selected
+  feature closure equality: S0's workspace-unified 293-node feature metadata is
+  context, not an equality target. Exact 199 normal /209 normal+build identities
+  remain the acceptance sets.
+- Following that reduction, metadata refuses on encoding_rs/simdutf8 under a
+  target_feature=simd128 cfg. Pinned rustc default cfg has no simd128. The filter
+  retained target-feature flags as unknown. Scope stop per sage-3983: one-page
+  PACKAGING-BOUNDARY.md and complete survey sent to Sage in gyro-0010. No further
+  cfg/dependency category changed. No release build, commit, push or live change.
+- Mos mos-1572/1573 via sage-3979: landing held pending Jason/Vikunja618; gyro
+  review-branch push is allowed after validation, with full binary listing.
+  Whole-row and runtime-only pack-size measurements are required after a local
+  verified commit; offline tool availability/provenance/timing also requested.
+
+## Measured-cfg reduction under sage-3984g
+
+Pinned rustc cfg is rustc-wasm32-cfg.txt. releaseEnvironment refuses inherited flag variables and forwards only an allowlist to the cfg measurement. Filter evaluator and mechanical feature cleanup are in build.mjs; no optional normal dependency removed.
+
+- aes-0.9.3: remove dependencies under cfg(any(target_arch = "aarch64", target_arch = "x86_64", target_arch = "x86")); dependencies cpufeatures.
+- bytes-1.12.1: remove dev-dependencies under cfg(loom); dependencies loom.
+- cmov-0.5.4: remove dev-dependencies under cfg(any(unix, windows)); dependencies proptest.
+- eframe-0.36.2: remove dependencies under cfg(any(target_os = "macos")); dependencies objc2.
+- eframe-0.36.2: remove dependencies under cfg(any(target_os = "macos")); dependencies objc2-app-kit.
+- eframe-0.36.2: remove dependencies under cfg(any(target_os = "macos")); dependencies objc2-foundation.
+- eframe-0.36.2: remove dependencies under cfg(any(target_os = "windows")); dependencies windows-sys.
+- eframe-0.36.2: remove dependencies under cfg(not(target_arch = "wasm32")); dependencies egui-wgpu.
+- eframe-0.36.2: remove dependencies under cfg(not(target_arch = "wasm32")); dependencies egui-winit.
+- eframe-0.36.2: remove dependencies under cfg(not(target_arch = "wasm32")); dependencies glutin.
+- eframe-0.36.2: remove dependencies under cfg(not(target_arch = "wasm32")); dependencies glutin-winit.
+- eframe-0.36.2: remove dependencies under cfg(not(target_arch = "wasm32")); dependencies image.
+- eframe-0.36.2: remove dependencies under cfg(not(target_arch = "wasm32")); dependencies pollster.
+- eframe-0.36.2: remove dependencies under cfg(not(target_arch = "wasm32")); dependencies winit.
+- eframe-0.36.2: remove dev-dependencies under cfg(not(target_arch = "wasm32")); dependencies directories.
+- eframe-0.36.2: feature accesskit removes egui-winit/accesskit; dependency egui-winit removed under cfg(not(target_arch = "wasm32")).
+- eframe-0.36.2: feature android-game-activity removes egui-winit/android-game-activity; dependency egui-winit removed under cfg(not(target_arch = "wasm32")).
+- eframe-0.36.2: feature android-native-activity removes egui-winit/android-native-activity; dependency egui-winit removed under cfg(not(target_arch = "wasm32")).
+- eframe-0.36.2: feature default removes winit/default; dependency winit removed under cfg(not(target_arch = "wasm32")).
+- eframe-0.36.2: feature glow removes dep:glutin-winit; dependency glutin-winit removed under cfg(not(target_arch = "wasm32")).
+- eframe-0.36.2: feature glow removes dep:glutin; dependency glutin removed under cfg(not(target_arch = "wasm32")).
+- eframe-0.36.2: feature links removes egui-winit/links; dependency egui-winit removed under cfg(not(target_arch = "wasm32")).
+- eframe-0.36.2: feature persistence removes egui-winit/serde; dependency egui-winit removed under cfg(not(target_arch = "wasm32")).
+- eframe-0.36.2: feature wayland removes egui-winit/wayland; dependency egui-winit removed under cfg(not(target_arch = "wasm32")).
+- eframe-0.36.2: feature wayland removes glutin?/wayland; dependency glutin removed under cfg(not(target_arch = "wasm32")).
+- eframe-0.36.2: feature wayland removes glutin-winit?/wayland; dependency glutin-winit removed under cfg(not(target_arch = "wasm32")).
+- eframe-0.36.2: feature wgpu_no_default_features removes dep:pollster; dependency pollster removed under cfg(not(target_arch = "wasm32")).
+- eframe-0.36.2: feature x11 removes egui-winit/x11; dependency egui-winit removed under cfg(not(target_arch = "wasm32")).
+- eframe-0.36.2: feature x11 removes glutin?/x11; dependency glutin removed under cfg(not(target_arch = "wasm32")).
+- eframe-0.36.2: feature x11 removes glutin?/glx; dependency glutin removed under cfg(not(target_arch = "wasm32")).
+- eframe-0.36.2: feature x11 removes glutin-winit?/x11; dependency glutin-winit removed under cfg(not(target_arch = "wasm32")).
+- eframe-0.36.2: feature x11 removes glutin-winit?/glx; dependency glutin-winit removed under cfg(not(target_arch = "wasm32")).
+- encoding_rs-0.8.42: remove dependencies under cfg(all(any(target_arch = "x86_64", target_arch = "x86"), not(all(target_feature = "avx2", target_feature = "bmi1")))); dependencies multiversion.
+- encoding_rs-0.8.42: remove dependencies under cfg(any(target_arch = "x86_64", target_arch = "x86")); dependencies core_detect.
+- encoding_rs-0.8.42: remove dependencies under cfg(any(target_arch = "x86_64", target_arch = "x86", target_arch = "aarch64", all(target_arch = "wasm32", target_feature = "simd128"))); dependencies simdutf8.
+- encoding_rs-0.8.42: feature std removes dep:multiversion; dependency multiversion removed under cfg(all(any(target_arch = "x86_64", target_arch = "x86"), not(all(target_feature = "avx2", target_feature = "bmi1")))).
+- getrandom-0.3.4: remove dependencies under cfg(all(any(target_os = "linux", target_os = "android"), not(any(all(target_os = "linux", target_env = ""), getrandom_backend = "custom", getrandom_backend = "linux_raw", getrandom_backend = "rdrand", getrandom_backend = "rndr")))); dependencies libc.
+- getrandom-0.3.4: remove dependencies under cfg(all(target_arch = "wasm32", any(target_os = "unknown", target_os = "none"), target_feature = "atomics")); dependencies js-sys.
+- getrandom-0.3.4: remove dependencies under cfg(all(target_arch = "wasm32", target_os = "wasi", target_env = "p2")); dependencies wasip2.
+- getrandom-0.3.4: remove dependencies under cfg(all(target_os = "uefi", getrandom_backend = "efi_rng")); dependencies r-efi.
+- getrandom-0.3.4: remove dependencies under cfg(any(target_os = "dragonfly", target_os = "freebsd", target_os = "hurd", target_os = "illumos", target_os = "cygwin", all(target_os = "horizon", target_arch = "arm"))); dependencies libc.
+- getrandom-0.3.4: remove dependencies under cfg(any(target_os = "haiku", target_os = "redox", target_os = "nto", target_os = "aix")); dependencies libc.
+- getrandom-0.3.4: remove dependencies under cfg(any(target_os = "ios", target_os = "visionos", target_os = "watchos", target_os = "tvos")); dependencies libc.
+- getrandom-0.3.4: remove dependencies under cfg(any(target_os = "macos", target_os = "openbsd", target_os = "vita", target_os = "emscripten")); dependencies libc.
+- getrandom-0.3.4: remove dependencies under cfg(target_os = "netbsd"); dependencies libc.
+- getrandom-0.3.4: remove dependencies under cfg(target_os = "solaris"); dependencies libc.
+- getrandom-0.3.4: remove dependencies under cfg(target_os = "vxworks"); dependencies libc.
+- getrandom-0.3.4: feature wasm_js removes dep:js-sys; dependency js-sys removed under cfg(all(target_arch = "wasm32", any(target_os = "unknown", target_os = "none"), target_feature = "atomics")).
+- half-2.7.1: remove dependencies under cfg(target_arch = "spirv"); dependencies crunchy.
+- harfrust-0.12.0: remove dev-dependencies under cfg(target_vendor = "apple"); dependencies objc2-core-foundation.
+- harfrust-0.12.0: remove dev-dependencies under cfg(target_vendor = "apple"); dependencies objc2-core-text.
+- harfrust-0.13.3: remove dev-dependencies under cfg(target_vendor = "apple"); dependencies objc2-core-foundation.
+- harfrust-0.13.3: remove dev-dependencies under cfg(target_vendor = "apple"); dependencies objc2-core-text.
+- hashbrown-0.17.1: remove dependencies under cfg(any()); dependencies serde.
+- hashbrown-0.17.1: remove dev-dependencies under cfg(unix); dependencies libc.
+- hashbrown-0.17.1: feature serde removes dep:serde; dependency serde removed under cfg(any()).
+- indexmap-2.14.2: remove dependencies under cfg(any()); dependencies serde.
+- indexmap-2.14.2: feature serde removes dep:serde; dependency serde removed under cfg(any()).
+- parking_lot_core-0.9.12: remove dependencies under cfg(target_os = "redox"); dependencies redox_syscall.
+- parking_lot_core-0.9.12: remove dependencies under cfg(unix); dependencies libc.
+- parking_lot_core-0.9.12: remove dependencies under cfg(windows); dependencies windows-link.
+- png-0.18.1: remove dev-dependencies under cfg(not(target_arch = "wasm32")); dependencies criterion.
+- rfd-0.17.2: remove dependencies under cfg(any(target_os = "linux", target_os = "freebsd", target_os = "dragonfly", target_os = "netbsd", target_os = "openbsd")); dependencies glib-sys.
+- rfd-0.17.2: remove dependencies under cfg(any(target_os = "linux", target_os = "freebsd", target_os = "dragonfly", target_os = "netbsd", target_os = "openbsd")); dependencies gobject-sys.
+- rfd-0.17.2: remove dependencies under cfg(any(target_os = "linux", target_os = "freebsd", target_os = "dragonfly", target_os = "netbsd", target_os = "openbsd")); dependencies gtk-sys.
+- rfd-0.17.2: remove dependencies under cfg(any(target_os = "linux", target_os = "freebsd", target_os = "dragonfly", target_os = "netbsd", target_os = "openbsd")); dependencies libc.
+- rfd-0.17.2: remove dependencies under cfg(any(target_os = "linux", target_os = "freebsd", target_os = "dragonfly", target_os = "netbsd", target_os = "openbsd")); dependencies percent-encoding.
+- rfd-0.17.2: remove dependencies under cfg(any(target_os = "linux", target_os = "freebsd", target_os = "dragonfly", target_os = "netbsd", target_os = "openbsd")); dependencies pollster.
+- rfd-0.17.2: remove dependencies under cfg(any(target_os = "linux", target_os = "freebsd", target_os = "dragonfly", target_os = "netbsd", target_os = "openbsd")); dependencies wayland-backend.
+- rfd-0.17.2: remove dependencies under cfg(any(target_os = "linux", target_os = "freebsd", target_os = "dragonfly", target_os = "netbsd", target_os = "openbsd")); dependencies wayland-client.
+- rfd-0.17.2: remove dependencies under cfg(any(target_os = "linux", target_os = "freebsd", target_os = "dragonfly", target_os = "netbsd", target_os = "openbsd")); dependencies wayland-protocols.
+- rfd-0.17.2: remove dependencies under cfg(target_os = "macos"); dependencies block2.
+- rfd-0.17.2: remove dependencies under cfg(target_os = "macos"); dependencies dispatch2.
+- rfd-0.17.2: remove dependencies under cfg(target_os = "macos"); dependencies objc2.
+- rfd-0.17.2: remove dependencies under cfg(target_os = "macos"); dependencies objc2-app-kit.
+- rfd-0.17.2: remove dependencies under cfg(target_os = "macos"); dependencies objc2-core-foundation.
+- rfd-0.17.2: remove dependencies under cfg(target_os = "macos"); dependencies objc2-foundation.
+- rfd-0.17.2: remove dependencies under cfg(target_os = "windows"); dependencies windows-sys.
+- rfd-0.17.2: feature common-controls-v6 removes windows-sys/Win32_UI_Controls; dependency windows-sys removed under cfg(target_os = "windows").
+- rfd-0.17.2: feature gtk3 removes gtk-sys; dependency gtk-sys removed under cfg(any(target_os = "linux", target_os = "freebsd", target_os = "dragonfly", target_os = "netbsd", target_os = "openbsd")).
+- rfd-0.17.2: feature gtk3 removes glib-sys; dependency glib-sys removed under cfg(any(target_os = "linux", target_os = "freebsd", target_os = "dragonfly", target_os = "netbsd", target_os = "openbsd")).
+- rfd-0.17.2: feature gtk3 removes gobject-sys; dependency gobject-sys removed under cfg(any(target_os = "linux", target_os = "freebsd", target_os = "dragonfly", target_os = "netbsd", target_os = "openbsd")).
+- rfd-0.17.2: feature wayland removes wayland-backend; dependency wayland-backend removed under cfg(any(target_os = "linux", target_os = "freebsd", target_os = "dragonfly", target_os = "netbsd", target_os = "openbsd")).
+- rfd-0.17.2: feature wayland removes wayland-client; dependency wayland-client removed under cfg(any(target_os = "linux", target_os = "freebsd", target_os = "dragonfly", target_os = "netbsd", target_os = "openbsd")).
+- rfd-0.17.2: feature wayland removes wayland-protocols; dependency wayland-protocols removed under cfg(any(target_os = "linux", target_os = "freebsd", target_os = "dragonfly", target_os = "netbsd", target_os = "openbsd")).
+- rfd-0.17.2: feature xdg-portal removes pollster; dependency pollster removed under cfg(any(target_os = "linux", target_os = "freebsd", target_os = "dragonfly", target_os = "netbsd", target_os = "openbsd")).
+- serde_core-1.0.229: remove dependencies under cfg(any()); dependencies serde_derive.
+- serde_json-1.0.151: remove dependencies under cfg(any()); dependencies serde.
+- sha1-0.11.0: remove dependencies under cfg(any(target_arch = "aarch64", target_arch = "x86", target_arch = "x86_64")); dependencies cpufeatures.
+- sha2-0.11.0: remove dependencies under cfg(any(target_arch = "aarch64", target_arch = "x86_64", target_arch = "x86")); dependencies cpufeatures.
+- sys-locale-0.3.2: remove dependencies under cfg(target_os = "android"); dependencies libc.
+- uuid-1.27.0: remove dependencies under cfg(all(target_arch = "wasm32", any(target_os = "unknown", target_os = "none"), target_feature = "atomics")); dependencies js-sys.
+- uuid-1.27.0: remove dependencies under cfg(not(all(target_arch = "wasm32", any(target_os = "unknown", target_os = "none")))); dependencies getrandom.
+- uuid-1.27.0: remove dependencies under cfg(not(all(target_arch = "wasm32", any(target_os = "unknown", target_os = "none")))); dependencies rand.
+- uuid-1.27.0: remove dev-dependencies under cfg(not(target_arch = "wasm32")); dependencies gungraun.
+- uuid-1.27.0: feature fast-rng removes dep:rand; dependency rand removed under cfg(not(all(target_arch = "wasm32", any(target_os = "unknown", target_os = "none")))).
+- uuid-1.27.0: feature js removes dep:js-sys; dependency js-sys removed under cfg(all(target_arch = "wasm32", any(target_os = "unknown", target_os = "none"), target_feature = "atomics")).
+- uuid-1.27.0: feature rng removes dep:getrandom; dependency getrandom removed under cfg(not(all(target_arch = "wasm32", any(target_os = "unknown", target_os = "none")))).
+- uuid-1.27.0: feature rng-getrandom removes dep:getrandom; dependency getrandom removed under cfg(not(all(target_arch = "wasm32", any(target_os = "unknown", target_os = "none")))).
+- uuid-1.27.0: feature rng-rand removes dep:rand; dependency rand removed under cfg(not(all(target_arch = "wasm32", any(target_os = "unknown", target_os = "none")))).
+- uuid-1.27.0: feature std removes js-sys?/std; dependency js-sys removed under cfg(all(target_arch = "wasm32", any(target_os = "unknown", target_os = "none"), target_feature = "atomics")).
+- wasm-bindgen-0.2.129: remove dev-dependencies under cfg(all(target_os = "emscripten", wasm_bindgen_unstable_tokio)); dependencies tokio.
+- wasm-bindgen-0.2.129: remove dev-dependencies under cfg(target_arch = "wasm64"); dependencies paste.
+- wasm-bindgen-0.2.129: remove dev-dependencies under cfg(target_arch = "wasm64"); dependencies serde_derive.
+- wasm-bindgen-futures-0.4.79: remove dependencies under cfg(all(target_os = "emscripten", wasm_bindgen_unstable_tokio)); dependencies tokio.
+- web-time-1.1.0: remove dev-dependencies under cfg(all(target_family = "wasm", target_feature = "atomics")); dependencies futures-channel.
+- web-time-1.1.0: remove dev-dependencies under cfg(all(target_family = "wasm", target_feature = "atomics")); dependencies futures-util.
+- web-time-1.1.0: remove dev-dependencies under cfg(all(target_family = "wasm", target_feature = "atomics")); dependencies web-sys.
+- web-time-1.1.0: remove dev-dependencies under cfg(not(target_family = "wasm")); dependencies pollster.
+- wgpu-30.0.1: remove dependencies under cfg(not(target_arch = "wasm32")); dependencies smallvec.
+- wgpu-30.0.1: remove dependencies under cfg(not(target_arch = "wasm32")); dependencies wgpu-core.
+- wgpu-30.0.1: remove dependencies under cfg(not(target_arch = "wasm32")); dependencies wgpu-hal.
+- wgpu-30.0.1: remove dependencies under cfg(not(target_has_atomic = "64")); dependencies portable-atomic.
+- wgpu-30.0.1: remove dependencies under cfg(target_os = "emscripten"); dependencies smallvec.
+- wgpu-30.0.1: remove dependencies under cfg(target_os = "emscripten"); dependencies wgpu-core.
+- wgpu-30.0.1: remove dependencies under cfg(target_os = "emscripten"); dependencies wgpu-hal.
+- wgpu-core-30.0.1: remove dependencies under cfg(any(windows, target_os = "linux", target_os = "android", target_os = "freebsd")); dependencies wgpu-core-deps-windows-linux-android.
+- wgpu-core-30.0.1: remove dependencies under cfg(not(target_has_atomic = "64")); dependencies portable-atomic.
+- wgpu-core-30.0.1: remove dependencies under cfg(target_os = "emscripten"); dependencies wgpu-core-deps-emscripten.
+- wgpu-core-30.0.1: remove dependencies under cfg(target_vendor = "apple"); dependencies wgpu-core-deps-apple.
+- wgpu-core-30.0.1: feature angle removes wgpu-core-deps-apple/angle; dependency wgpu-core-deps-apple removed under cfg(target_vendor = "apple").
+- wgpu-core-30.0.1: feature drm removes wgpu-core-deps-windows-linux-android/drm; dependency wgpu-core-deps-windows-linux-android removed under cfg(any(windows, target_os = "linux", target_os = "android", target_os = "freebsd")).
+- wgpu-core-30.0.1: feature dx12 removes wgpu-core-deps-windows-linux-android/dx12; dependency wgpu-core-deps-windows-linux-android removed under cfg(any(windows, target_os = "linux", target_os = "android", target_os = "freebsd")).
+- wgpu-core-30.0.1: feature gles removes wgpu-core-deps-windows-linux-android/gles; dependency wgpu-core-deps-windows-linux-android removed under cfg(any(windows, target_os = "linux", target_os = "android", target_os = "freebsd")).
+- wgpu-core-30.0.1: feature gles removes wgpu-core-deps-emscripten/gles; dependency wgpu-core-deps-emscripten removed under cfg(target_os = "emscripten").
+- wgpu-core-30.0.1: feature metal removes wgpu-core-deps-apple/metal; dependency wgpu-core-deps-apple removed under cfg(target_vendor = "apple").
+- wgpu-core-30.0.1: feature portable-atomic removes dep:portable-atomic; dependency portable-atomic removed under cfg(not(target_has_atomic = "64")).
+- wgpu-core-30.0.1: feature renderdoc removes wgpu-core-deps-windows-linux-android/renderdoc; dependency wgpu-core-deps-windows-linux-android removed under cfg(any(windows, target_os = "linux", target_os = "android", target_os = "freebsd")).
+- wgpu-core-30.0.1: feature vulkan removes wgpu-core-deps-windows-linux-android/vulkan; dependency wgpu-core-deps-windows-linux-android removed under cfg(any(windows, target_os = "linux", target_os = "android", target_os = "freebsd")).
+- wgpu-core-30.0.1: feature vulkan-portability removes wgpu-core-deps-apple/vulkan-portability; dependency wgpu-core-deps-apple removed under cfg(target_vendor = "apple").
+- wgpu-hal-30.0.1: remove dependencies under cfg(all(unix, not(target_vendor = "apple"), not(target_family = "wasm"))); dependencies drm.
+- wgpu-hal-30.0.1: remove dependencies under cfg(all(windows, not(target_arch = "aarch64"), target_env = "msvc")); dependencies mach-dxcompiler-rs.
+- wgpu-hal-30.0.1: remove dependencies under cfg(any(not(target_has_atomic = "64"), not(target_has_atomic = "ptr"))); dependencies portable-atomic.
+- wgpu-hal-30.0.1: remove dev-dependencies under cfg(not(any(target_arch = "wasm32", target_os = "ios", target_os = "visionos", target_env = "ohos"))); dependencies glutin.
+- wgpu-hal-30.0.1: remove dev-dependencies under cfg(not(any(target_arch = "wasm32", target_os = "ios", target_os = "visionos", target_env = "ohos"))); dependencies glutin-winit.
+- wgpu-hal-30.0.1: remove dependencies under cfg(not(target_arch = "wasm32")); dependencies ash.
+- wgpu-hal-30.0.1: remove dependencies under cfg(not(target_arch = "wasm32")); dependencies gpu-allocator.
+- wgpu-hal-30.0.1: remove dependencies under cfg(not(target_arch = "wasm32")); dependencies khronos-egl.
+- wgpu-hal-30.0.1: remove dependencies under cfg(not(target_arch = "wasm32")); dependencies libloading.
+- wgpu-hal-30.0.1: remove dependencies under cfg(not(target_arch = "wasm32")); dependencies renderdoc-sys.
+- wgpu-hal-30.0.1: remove dependencies under cfg(not(target_arch = "wasm32")); dependencies smallvec.
+- wgpu-hal-30.0.1: remove dependencies under cfg(not(target_has_atomic = "ptr")); dependencies portable-atomic-util.
+- wgpu-hal-30.0.1: remove dependencies under cfg(target_os = "android"); dependencies android_system_properties.
+- wgpu-hal-30.0.1: remove dependencies under cfg(target_os = "android"); dependencies ndk-sys.
+- wgpu-hal-30.0.1: remove dependencies under cfg(target_os = "emscripten"); dependencies khronos-egl.
+- wgpu-hal-30.0.1: remove dependencies under cfg(target_os = "emscripten"); dependencies libloading.
+- wgpu-hal-30.0.1: remove dependencies under cfg(target_vendor = "apple"); dependencies block2.
+- wgpu-hal-30.0.1: remove dependencies under cfg(target_vendor = "apple"); dependencies bytemuck.
+- wgpu-hal-30.0.1: remove dependencies under cfg(target_vendor = "apple"); dependencies objc2.
+- wgpu-hal-30.0.1: remove dependencies under cfg(target_vendor = "apple"); dependencies objc2-core-foundation.
+- wgpu-hal-30.0.1: remove dependencies under cfg(target_vendor = "apple"); dependencies objc2-core-graphics.
+- wgpu-hal-30.0.1: remove dependencies under cfg(target_vendor = "apple"); dependencies objc2-foundation.
+- wgpu-hal-30.0.1: remove dependencies under cfg(target_vendor = "apple"); dependencies objc2-metal.
+- wgpu-hal-30.0.1: remove dependencies under cfg(target_vendor = "apple"); dependencies objc2-quartz-core.
+- wgpu-hal-30.0.1: remove dependencies under cfg(target_vendor = "apple"); dependencies raw-window-metal.
+- wgpu-hal-30.0.1: remove dependencies under cfg(unix); dependencies libc.
+- wgpu-hal-30.0.1: remove dependencies under cfg(unix); dependencies wayland-sys.
+- wgpu-hal-30.0.1: remove dependencies under cfg(windows); dependencies bit-set.
+- wgpu-hal-30.0.1: remove dependencies under cfg(windows); dependencies glutin_wgl_sys.
+- wgpu-hal-30.0.1: remove dependencies under cfg(windows); dependencies once_cell.
+- wgpu-hal-30.0.1: remove dependencies under cfg(windows); dependencies range-alloc.
+- wgpu-hal-30.0.1: remove dependencies under cfg(windows); dependencies windows.
+- wgpu-hal-30.0.1: remove dependencies under cfg(windows); dependencies windows-core.
+- wgpu-hal-30.0.1: remove dependencies under cfg(windows); dependencies windows-result.
+- wgpu-hal-30.0.1: feature dx12 removes dep:bit-set; dependency bit-set removed under cfg(windows).
+- wgpu-hal-30.0.1: feature dx12 removes dep:gpu-allocator; dependency gpu-allocator removed under cfg(not(target_arch = "wasm32")).
+- wgpu-hal-30.0.1: feature dx12 removes dep:libloading; dependency libloading removed under cfg(not(target_arch = "wasm32")) / cfg(target_os = "emscripten").
+- wgpu-hal-30.0.1: feature dx12 removes dep:once_cell; dependency once_cell removed under cfg(windows).
+- wgpu-hal-30.0.1: feature dx12 removes dep:range-alloc; dependency range-alloc removed under cfg(windows).
+- wgpu-hal-30.0.1: feature dx12 removes dep:windows-core; dependency windows-core removed under cfg(windows).
+- wgpu-hal-30.0.1: feature dx12 removes gpu-allocator/d3d12; dependency gpu-allocator removed under cfg(not(target_arch = "wasm32")).
+- wgpu-hal-30.0.1: feature dx12 removes once_cell/std; dependency once_cell removed under cfg(windows).
+- wgpu-hal-30.0.1: feature dx12 removes windows/Win32_Devices_DeviceAndDriverInstallation; dependency windows removed under cfg(windows).
+- wgpu-hal-30.0.1: feature dx12 removes windows/Win32_Devices_Display; dependency windows removed under cfg(windows).
+- wgpu-hal-30.0.1: feature dx12 removes windows/Win32_Graphics_Direct3D_Dxc; dependency windows removed under cfg(windows).
+- wgpu-hal-30.0.1: feature dx12 removes windows/Win32_Graphics_Direct3D_Fxc; dependency windows removed under cfg(windows).
+- wgpu-hal-30.0.1: feature dx12 removes windows/Win32_Graphics_Direct3D; dependency windows removed under cfg(windows).
+- wgpu-hal-30.0.1: feature dx12 removes windows/Win32_Graphics_Direct3D12; dependency windows removed under cfg(windows).
+- wgpu-hal-30.0.1: feature dx12 removes windows/Win32_Graphics_DirectComposition; dependency windows removed under cfg(windows).
+- wgpu-hal-30.0.1: feature dx12 removes windows/Win32_Graphics_Dxgi_Common; dependency windows removed under cfg(windows).
+- wgpu-hal-30.0.1: feature dx12 removes windows/Win32_Graphics_Gdi; dependency windows removed under cfg(windows).
+- wgpu-hal-30.0.1: feature dx12 removes windows/Win32_Security; dependency windows removed under cfg(windows).
+- wgpu-hal-30.0.1: feature dx12 removes windows/Win32_System_Diagnostics_Debug; dependency windows removed under cfg(windows).
+- wgpu-hal-30.0.1: feature dx12 removes windows/Win32_System_Kernel; dependency windows removed under cfg(windows).
+- wgpu-hal-30.0.1: feature dx12 removes windows/Win32_System_Performance; dependency windows removed under cfg(windows).
+- wgpu-hal-30.0.1: feature dx12 removes windows/Win32_System_Threading; dependency windows removed under cfg(windows).
+- wgpu-hal-30.0.1: feature dx12 removes windows/Win32_UI_WindowsAndMessaging; dependency windows removed under cfg(windows).
+- wgpu-hal-30.0.1: feature gles removes dep:glutin_wgl_sys; dependency glutin_wgl_sys removed under cfg(windows).
+- wgpu-hal-30.0.1: feature gles removes dep:khronos-egl; dependency khronos-egl removed under cfg(not(target_arch = "wasm32")) / cfg(target_os = "emscripten").
+- wgpu-hal-30.0.1: feature gles removes dep:libloading; dependency libloading removed under cfg(not(target_arch = "wasm32")) / cfg(target_os = "emscripten").
+- wgpu-hal-30.0.1: feature gles removes dep:ndk-sys; dependency ndk-sys removed under cfg(target_os = "android").
+- wgpu-hal-30.0.1: feature gles removes dep:objc2; dependency objc2 removed under cfg(target_vendor = "apple").
+- wgpu-hal-30.0.1: feature gles removes dep:wayland-sys; dependency wayland-sys removed under cfg(unix).
+- wgpu-hal-30.0.1: feature gles removes dep:windows-result; dependency windows-result removed under cfg(windows).
+- wgpu-hal-30.0.1: feature gles removes windows-result/std; dependency windows-result removed under cfg(windows).
+- wgpu-hal-30.0.1: feature gles removes windows/Win32_Graphics_Gdi; dependency windows removed under cfg(windows).
+- wgpu-hal-30.0.1: feature gles removes windows/Win32_Graphics_OpenGL; dependency windows removed under cfg(windows).
+- wgpu-hal-30.0.1: feature gles removes windows/Win32_System_LibraryLoader; dependency windows removed under cfg(windows).
+- wgpu-hal-30.0.1: feature gles removes windows/Win32_UI_WindowsAndMessaging; dependency windows removed under cfg(windows).
+- wgpu-hal-30.0.1: feature metal removes dep:block2; dependency block2 removed under cfg(target_vendor = "apple").
+- wgpu-hal-30.0.1: feature metal removes dep:libloading; dependency libloading removed under cfg(not(target_arch = "wasm32")) / cfg(target_os = "emscripten").
+- wgpu-hal-30.0.1: feature metal removes dep:objc2; dependency objc2 removed under cfg(target_vendor = "apple").
+- wgpu-hal-30.0.1: feature metal removes dep:objc2-core-foundation; dependency objc2-core-foundation removed under cfg(target_vendor = "apple").
+- wgpu-hal-30.0.1: feature metal removes dep:objc2-core-graphics; dependency objc2-core-graphics removed under cfg(target_vendor = "apple").
+- wgpu-hal-30.0.1: feature metal removes dep:objc2-foundation; dependency objc2-foundation removed under cfg(target_vendor = "apple").
+- wgpu-hal-30.0.1: feature metal removes dep:objc2-metal; dependency objc2-metal removed under cfg(target_vendor = "apple").
+- wgpu-hal-30.0.1: feature metal removes dep:objc2-quartz-core; dependency objc2-quartz-core removed under cfg(target_vendor = "apple").
+- wgpu-hal-30.0.1: feature metal removes dep:smallvec; dependency smallvec removed under cfg(not(target_arch = "wasm32")).
+- wgpu-hal-30.0.1: feature metal removes dep:raw-window-metal; dependency raw-window-metal removed under cfg(target_vendor = "apple").
+- wgpu-hal-30.0.1: feature portable-atomic removes dep:portable-atomic; dependency portable-atomic removed under cfg(any(not(target_has_atomic = "64"), not(target_has_atomic = "ptr"))).
+- wgpu-hal-30.0.1: feature portable-atomic removes dep:portable-atomic-util; dependency portable-atomic-util removed under cfg(not(target_has_atomic = "ptr")).
+- wgpu-hal-30.0.1: feature renderdoc removes dep:libloading; dependency libloading removed under cfg(not(target_arch = "wasm32")) / cfg(target_os = "emscripten").
+- wgpu-hal-30.0.1: feature renderdoc removes dep:renderdoc-sys; dependency renderdoc-sys removed under cfg(not(target_arch = "wasm32")).
+- wgpu-hal-30.0.1: feature static-dxc removes dep:mach-dxcompiler-rs; dependency mach-dxcompiler-rs removed under cfg(all(windows, not(target_arch = "aarch64"), target_env = "msvc")).
+- wgpu-hal-30.0.1: feature vulkan removes dep:android_system_properties; dependency android_system_properties removed under cfg(target_os = "android").
+- wgpu-hal-30.0.1: feature vulkan removes dep:ash; dependency ash removed under cfg(not(target_arch = "wasm32")).
+- wgpu-hal-30.0.1: feature vulkan removes dep:libc; dependency libc removed under cfg(unix).
+- wgpu-hal-30.0.1: feature vulkan removes dep:libloading; dependency libloading removed under cfg(not(target_arch = "wasm32")) / cfg(target_os = "emscripten").
+- wgpu-hal-30.0.1: feature vulkan removes dep:raw-window-metal; dependency raw-window-metal removed under cfg(target_vendor = "apple").
+- wgpu-hal-30.0.1: feature vulkan removes dep:smallvec; dependency smallvec removed under cfg(not(target_arch = "wasm32")).
+- wgpu-hal-30.0.1: feature vulkan removes dep:windows; dependency windows removed under cfg(windows).
+- wgpu-hal-30.0.1: feature vulkan removes gpu-allocator/vulkan; dependency gpu-allocator removed under cfg(not(target_arch = "wasm32")).
+- wgpu-hal-30.0.1: feature vulkan removes windows/Win32; dependency windows removed under cfg(windows).
+- wgpu-hal-30.0.1: feature vulkan removes windows/Win32_Devices_Display; dependency windows removed under cfg(windows).
+- wgpu-hal-30.0.1: feature vulkan removes windows/Win32_Foundation; dependency windows removed under cfg(windows).
+- wgpu-hal-30.0.1: feature vulkan removes windows/Win32_Graphics_Dxgi; dependency windows removed under cfg(windows).
+- wgpu-hal-30.0.1: feature vulkan removes windows/Win32_Graphics_Dxgi_Common; dependency windows removed under cfg(windows).
+- wgpu-hal-30.0.1: feature vulkan removes windows/Win32_Graphics_Gdi; dependency windows removed under cfg(windows).
+- zerocopy-0.8.61: remove dependencies under cfg(any()); dependencies zerocopy-derive.
+- zip-3.0.0: remove dependencies under cfg(fuzzing); dependencies arbitrary.
+
+Count correction: 28 changed manifests /121 individual TOML dependency table sections /109 feature items. Earlier57/59 counted grouped cfg+kind sections, not individual dependency tables. Initial indexmap failure exposed my filter treating a dev-dependency as preserving an optional normal dependency; fixed only that bookkeeping bug with a failing then passing regression. No inventory expansion.
+
+Resolution stop: vello_cpu0.1.0 optional normal glifo ^0.2.0 (locked0.2.0) is outside reviewed209 (reviewed glifo is0.3.0). No cfg-filtered section controls it. Stopped per sage-3984g; no import/fetch. Offline size receipt full-lock-cache-size.json: 538 third-party lock records =534 registry +4 git. Default cache175 present/359 missing,16,666,072 archive bytes; existing Louie toolchain cache534 present/0 missing,85,234,501 bytes; S0 cache412 present/122 missing,44,438,740 bytes. Sent Sage gyro-0011. Root closure/release/CSP acceptance is unproved.
+
+## Full-lock scratch measurement — sage-3992
+
+Scope is measurement only, entirely under
+`/mnt/storage/scratch/gyro-full-lock-measure-95ntu6t0`. No additional source,
+outputs or tool binaries imported into the repository; no commit/push. The
+restricted-runtime/security/CSP gates remain open. No further manifest surgery.
+
+Extraction from Louie's pre-existing cache verified every registry archive
+against the ORIGINAL Cargo.lock checksum, with no fetch. All four git lock
+records were excluded from this extraction. Registry results (534 packages):
+
+- Original archive total: 85,234,501 bytes.
+- Extracted archive content: 24,844 files / 611,577,974 bytes.
+- Including 534 generated Cargo checksum files: 25,378 files / 614,049,226 bytes.
+- Beyond the reviewed 209, the full 538 lock set adds 329 packages: 328 registry
+  plus one git package. The additional registry content alone is 15,005 files /
+  484,646,629 bytes including generated checksums. The fourth git package was
+  neither fetched nor copied. Full details: full-lock-extracted-size.json.
+
+For the measurement build, three ALREADY REVIEWED git packages were copied from
+owned cargo-vendor into scratch after registry extraction. No new git source
+was imported. Source is the owned source copy with the already approved local
+15-member workspace reduction and unchanged vendor manifests/features. The exact
+pinned original icon was restored only in scratch for the original Trunk index.
+This builds the baseline for size/timing; it is not the restricted adapter and
+cannot count as M1-M14 or zero-CSP evidence.
+
+Before compiling, offline cargo tree with normal edges exactly matched S0's
+199 third-party +15 local packages; normal,build exactly matched 209+15. The
+comparison refused on any added/missing pair. Scratch metadata/tree commands and
+the release command each run with unshare --user --map-root-user --net, nice19,
+four Cargo jobs, isolated HOME/CARGO_HOME and a fresh scratch TMPDIR. There is no
+connected network interface in these namespaces, only loopback; Cargo and Trunk
+also have offline enabled and Trunk update checks disabled. Inherited Rust flags
+are refused and none are set for this measurement. Release build started after
+those package-closure checks; result/timing/output pack measurement pending.
+
+Tool availability/provenance on this host:
+
+- rustc/Cargo 1.99.1 and wasm32-unknown-unknown std: existing isolated rustup
+  stable toolchain under Louie's evaluation toolchain directory, installed Oct21;
+  rustup settings and target manifests identify it. No install repeated.
+- Trunk0.22.0: existing isolated cargo install; .crates.toml records the exact
+  version and crates.io origin. No install repeated.
+- wasm-bindgen0.2.129 and wasm-opt131: existing Trunk versioned helper cache,
+  copied to isolated scratch cache/PATH. No download. Their original download
+  commands are not present in Louie's evaluation report.
+- Five executable versions/hashes and Rust support hashes: toolchain.json.
+  All required tools are already present; this build needs no network.
+
+### Measurement environment correction and retry
+
+The first measurement command succeeded in 388.757578 seconds (06:02:17.598Z
+through 06:08:46.356Z). The requested `nice -n19` was relative to inherited
+negative priority; compiler workers were initially nice15. I detected and set
+only this build's processes/threads absolutely to19 during compilation, then
+retained this result as a LIMITED timing, not a whole-run nice19 sample.
+Receipt: full-lock-release-limited.json and measurement-priority-correction.json.
+No baseline source change was made. Sage was told in gyro-0012 before retry.
+
+The one environment retry authorized in sage-3992 establishes absolute nice19
+before child spawn, uses a fresh target-retry directory, CARGO_BUILD_JOBS=4,
+BINARYEN_CORES=4 and a four-CPU affinity inherited by all build children.
+measurement-retry-priority.jsonl confirms Trunk/Cargo/rustc at19 on those CPUs.
+The harness separately reprioritizes the waiting Python launcher, so launcher
+priority alone is not the build-child measurement. The network namespace,
+offline flags and isolated source/vendor/tool environment are unchanged.
+
+### Full-lock measurement results (sage-3992)
+
+The valid environment retry succeeded, exit0, in **397.864805 seconds** (06:09:38.409Z–06:16:16.274Z), from a fresh target directory. Actual Trunk/Cargo/rustc/wasm-opt children were nice19, four-CPU affinity; Cargo jobs4 and Binaryen cores4. The waiting Python launcher was independently reprioritized to-4 by the harness; that is recorded separately and does not describe build child priority. Evidence: full-lock-release-measurement.json, measurement-retry-priority.jsonl and measurement-release.log. Three existing engine dead-code warnings; no build error.
+
+| Baseline measurement output | Bytes | SHA-256 |
+|---|---:|---|
+| index.html | 1604 | 299b76f4004bbc65204d561cc381b3fbb249d10069eaa50e88c7fba3b6c63cb8 |
+| wordcraft-fa59e09a3f921e03.ico | 18378 | 53a23dcf66260f44d87d4d143d633395f3e967f391eda47e6e9cc3a52f820225 |
+| wordcraft-web-832240fdc6ce872b_bg.wasm | 43957877 | c1c15050a9b394c21e7540aa57c9292b86d32bfea2476094a9976304dacf1de0 |
+| wordcraft-web-88f7089f25a3b338.js | 164941 | 866a1de6a33eff2ded8ae9588fd049aeacfc42557a3863ccd2107b3faf4d691e |
+
+Total runtime output: **44142800 bytes**. Output blobs alone pack to **16720159 bytes** using Git2.55.0: hash-object -w into a NEW scratch bare repo, sorted four blob IDs through pack-objects --stdout --threads=4. No git gc, no object writes in the Mosaic repository; count-objects receipts are in measurement-output-pack.json. The empty internal .trunk-lock is excluded. This is an independent four-blob pack, not a cross-version delta estimate and not the whole-row pack. Whole-row pack measurement remains unavailable because this work is not committed.
+
+**Network access was disabled:** every Cargo/Trunk command ran in a new isolated user/network namespace with no connected interface; the topology receipt shows only zero-traffic loopback. Cargo and Trunk offline flags and disabled Trunk version checks were also enforced. No fetch/install was needed. No host HOME, Cargo config or credentials were passed into the build environment.
+
+Read-only metadata observation: the unfiltered scratch resolver has238 package records; root tree joins give exactly214 normal and224 normal+build (199/209 third-party +15 local). Fourteen metadata-only extra packages total14,523,104 extracted bytes. measurement-resolution-extra-packages.json lists them for the packaging decision; no smaller vendor experiment/import was performed, and this does not clear additional source for landing.
+
+Both requested scratch measurements are complete. No full-lock vendor source or runtime output entered the repository, no commit/push, no serving route or live change. The packaging choice still waits on Mos/Jason; M1–M14, restricted adapter, two-root reproducibility, CSP/browser and full package checks are unproved. Row310 stays in-progress, not in-review.
+
+## 223-source measurement — sage-4008 and sage-4010
+
+Mos mos-1574 requested the209+14 comparison before Jason chooses (Vikunja618). Scratch only: /mnt/storage/scratch/gyro-223-measure-mzbp0x23. The source includes exactly223 packages: owned reviewed209 plus14 checksum-verified registry archives from the existing cache. No other package, no fetch, no source adoption. Original vendor manifests are preserved for sizing.
+
+| Pristine source set | Files incl checksums | Bytes incl checksums | Independent Git blob pack bytes |
+|---|---:|---:|---:|
+| Extra14 | 702 | 14523104 | 1720566 |
+| Total223 | 11201 | 145260334 | 26538894 |
+
+Packs use the prior output-pack method: source files hash-object -w --no-filters into a NEW scratch bare repository, then sorted unique blob IDs to pack-objects --stdout --threads=4, at nice19. No gc, tree/commit objects or cross-version delta estimate. Pack/input digests and count-objects: measurement-223-source-packs.json and measurement-223-input-manifest.json. Sizes include all original package files (no vendor pruning), plus generated .cargo-checksum.json.
+
+### Resolution and lock result
+
+Unfiltered223 with the original pin lock: metadata --offline --locked exits101 on missing native-only cpufeatures (exact error in measurement-223-unfiltered-resolution.json). Existing packet filterVendorManifest was then applied mechanically to the scratch copy:31 manifests /155 individual false-target dependency table sections /133 dangling feature items, including3 additional changed manifests from the14. No new algorithm or hand edits. Original reviewed209 source remains untouched. Filtered metadata --offline --locked exits101: cannot update Cargo.lock because --locked prevents this. Original lock remains06b745e43c13df3df7f048fa6a1981625ce7a5fe4cd484bc6254d0913d865b0b.
+
+sage-4010 separately authorized one cargo metadata --offline run WITHOUT --locked in another scratch source copy. It exited0 and generated a lock with226 entries against the original558: **332 removed,0 added,0 changed** when comparing name/version/source/checksum entry by entry. Pruned SHA2563401363e100783dc70c8f5ba09324947c0b6f8562f1ac1cbbc61a0497200c17f. Exact diff and generated lock are measurement-223-lock-diff.json and measurement-223-pruned-Cargo.lock.txt. The original source lock was not modified, and there were no manual lock edits.
+
+CLEAR request gyro-0015 covers one release measurement under --locked/--frozen with that generated lock, nice19,4 jobs/cores, isolated netns, fresh HOME/CARGO_HOME/TMPDIR/target and one environment-fault retry. sage-4011 approves the description but withholds CLEAR until row327 landing gate finishes (roughly06:45–06:55Z). **No223 release build has run.** Packaging choice and row310 remain held. Shipping a pruned lock is itself a packaging change needing S0 reviewer and Jason's choice; this measurement does not adopt it.
+
+### Fourteen-package source and notice inventory
+
+Every source is registry+https://github.com/rust-lang/crates.io-index. Exact archive SHA256/size and notice-file SHA256/size: measurement-223-inputs.json; all present notice text: measurement-14-notices.txt. No election or license approval is asserted.
+
+| Package | Version | Declared license expression | Notice/license files present |
+|---|---|---|---|
+| cursor-icon | 1.2.0 | MIT OR Apache-2.0 OR Zlib | LICENSE-APACHE, LICENSE-MIT, LICENSE-ZLIB |
+| dpi | 0.1.2 | Apache-2.0 AND MIT | LICENSE, LICENSE-LIBM-MIT |
+| futures-macro | 0.3.34 | MIT OR Apache-2.0 | LICENSE-APACHE, LICENSE-MIT |
+| glifo | 0.2.0 | Apache-2.0 OR MIT | LICENSE-APACHE, LICENSE-MIT |
+| ordered-float | 5.5.0 | MIT | LICENSE-MIT |
+| pin-project | 1.1.13 | Apache-2.0 OR MIT | LICENSE-APACHE, LICENSE-MIT |
+| pin-project-internal | 1.1.13 | Apache-2.0 OR MIT | LICENSE-APACHE, LICENSE-MIT |
+| smol_str | 0.2.2 | MIT OR Apache-2.0 | LICENSE-APACHE, LICENSE-MIT |
+| spirv | 0.4.0+sdk-1.4.341.0 | Apache-2.0 | **None present** |
+| termcolor | 1.4.1 | Unlicense OR MIT | COPYING, LICENSE-MIT, UNLICENSE |
+| tracing | 0.1.44 | MIT | LICENSE |
+| tracing-attributes | 0.1.31 | MIT | LICENSE |
+| tracing-core | 0.1.36 | MIT | LICENSE, src/spin/LICENSE |
+| winit | 0.30.13 | Apache-2.0 | LICENSE |
+
+spirv has no license/notice file in its archive despite declaring Apache-2.0; this needs Gladstone's notice review before adoption. dpi declares Apache-2.0 AND MIT and includes LICENSE-LIBM-MIT; tracing-core includes an additional src/spin/LICENSE. Both are inventoried, not flattened to a single default text. No source code or binaries from any crate are included in this plain-text evidence commit.
+
+Plain-text packet hygiene: trailing spaces in Node assertion transcripts normalized before commit (filter-dev-red.txt, cfg-red.txt, filter-red.txt); test outcomes and source/notice hashes unchanged.
+
+## 223 release result and notice supplement — sage-4014
+
+sage-4014 CLEAR supersedes the earlier slot hold. Build started06:31:53.099Z and finished06:38:13.773Z, exit0, **380.674036 seconds**. No retry used. Frozen+locked generated lock remains3401363e100783dc70c8f5ba09324947c0b6f8562f1ac1cbbc61a0497200c17f; original06b745e4... remains unchanged. Actual Trunk/Cargo/rustc/wasm-opt at nice19, CPUs12–15, Cargo jobs4/Binaryen cores4; fresh HOME/CARGO_HOME/TMPDIR/target; isolated netns with no external interface and offline/update-check-disabled tooling. No network access or fetch. Three existing engine dead-code warnings; no build error. Slot released to Sage for Bradford in gyro-0018 immediately after completion.
+
+Frozen/offline cargo-tree preflight exactly matches S0:214 normal and224 normal+build records (199/209 third-party plus15 local), no added/missing package identities. measurement-223-build-preflight.json records this.
+
+| Scratch baseline output | Bytes | SHA-256 |
+|---|---:|---|
+| index.html | 1604 | 28ce55d5c017d545aaac91bbd96f22e6ebd3b35af8d856315cdcb150a2a4a57d |
+| wordcraft-fa59e09a3f921e03.ico | 18378 | 53a23dcf66260f44d87d4d143d633395f3e967f391eda47e6e9cc3a52f820225 |
+| wordcraft-web-88f7089f25a3b338.js | 164941 | 866a1de6a33eff2ded8ae9588fd049aeacfc42557a3863ccd2107b3faf4d691e |
+| wordcraft-web-8e80c8f64c8671f7_bg.wasm | 43952335 | 0322beb9e58b9abeed6b6e05125879bfb3eccbebb05094e191df3542a74007ea |
+
+Total output **44137258 bytes**. The WASM SHA256 **does not equal** the full-lock build c1c15050a9b394c21e7540aa57c9292b86d32bfea2476094a9976304dacf1de0. No reproducibility or functional/CSP equivalence is asserted. Source roots and packaging differ; this run does not isolate the reason for the hash difference. Full result, child priority observations and log: measurement-223-build.json, measurement-223-build-priority.jsonl, measurement-223-release.log.
+
+### Gladstone supplemental review and notice response
+
+gladstone-0026 (06:37:48Z) independently checked the14 original archive checksums and original manifest/source/license inventory:10 supplemental PASS /4 CONCERN. This is not adoption or candidate approval. Checked flags: winit has one cfg-alias build script; futures-macro, pin-project-internal and tracing-attributes are proc-macros; winit has native cfg paths and Worker/Blob source. None of14 appears in the measured normal/build target closure. Source-level Worker/native flags do not imply permission to select those paths or relax Q234.
+
+The filename-only notice collector missed embedded W3C terms in cursor-icon/src/lib.rs and winit/src/keyboard.rs. After re-reading those actual headers, measurement-14-notices.txt now includes each complete embedded license, short notice, source document URI and attribution. measurement-14-notice-supplement.json records original source hashes/line spans and extracted text hashes. The added W3C form remains an explicit S0/license-adoption review gate, not silently folded into the root SPDX expressions.
+
+dpi remains **Apache-2.0 AND MIT** for the full-source inventory: both root LICENSE and LICENSE-LIBM-MIT retained, plus README feature explanation and complete libm copyright header added to the notice packet. No Apache-only election. tracing-core retains root LICENSE and distinct src/spin/LICENSE. spirv has no text file in its archive; supplemental mapping explicitly supplies the standard Apache-2.0 text from the pinned WordCraft LICENSE-APACHE, following S0 M13 missing-file treatment, with its source pin/hash recorded. This is an evidence mapping, not a shipping approval.
+
+measurement-14-binary-inputs.json now lists all four winit example PNGs: examples/data/cross.png159B, cross2.png129B, gradient.png229B, icon.png2950B, each with SHA256. No other non-UTF8/NUL payload among14. They remain scratch source inputs; no binary is in this evidence commit.
+
+All runtime outputs and all223 crate sources remain scratch-only. Only plain-text results/notices/metadata are committed. Shipping the pruned lock, the14 additions, new W3C notice form and repository size still require S0 reviewer/owner choices. Row310 stays held for Vikunja618; restricted adapter, M1–M14, two-root reproducibility and CSP/browser acceptance remain unproved.
+
+## Supplemental notice recheck — gladstone-0027
+
+Gladstone rechecked the collection delta at9522d2356 against1716f5a22 on
+2026-10-24T06:44:42Z. All four prior notice-collection/mapping gaps now PASS as
+supplemental evidence: cursor-icon embedded W3C text/attribution, dpi full-source
+conjunction/copyrights, spirv explicit standard Apache-2.0 text mapping, and
+winit embedded W3C text plus four example PNG records. The earlier ten package
+source/notice PASS results stand. tracing-core root/spin license texts remain
+complete. No additional collection gap was found in this requested delta.
+
+Reviewer independently verified original header/source hashes and extracted
+notice hashes, PNG/archive bytes, all12 incremental path hashes and changed-path
+set, UTF8/no-NUL boundary and diff whitespace check. Bundle SHA256
+4d8e2aac5de85d3f3145d5d3945924436d1c30bc043fb3e2d4391cd98b1adbde also matches
+this worktree's fresh hash check.
+
+This recheck is **not adoption or candidate approval**. New W3C terms still need
+explicit M13/license/owner adoption review; dpi conjunction and spirv mapping
+must carry into any shipped M13 bundle; PNG classification and future selection
+of Worker/native paths remain explicit gates. Gladstone did not rerun or
+functionally/CSP-validate the WASM. Its differing hash, the pruned lock and
+packaging/size choice remain uncleared. S0 M1–M14, Jason's choice/Vikunja618 and
+the row310 hold remain in force. No further build, source, notice-text or runtime
+change was made to record this result.
@@ -0,0 +1,57 @@
+# W2 offline packaging decision — 2026-10-24
+
+Sage requested this consolidated stop report in sage-3983. No additional
+category has been applied. No release build, commit or push has run.
+
+The original source/lock resolve packages outside the reviewed WASM target.
+The imported vendor tree contains exactly S0's 209 third-party identities:
+199 normal plus 10 build-only; the web root adds 15 local crates. Original
+source lock has 538 third-party records; S0 workspace metadata has 293 total
+resolved packages after target filtering. These are different sets.
+
+Approved and exercised only in scratch:
+
+- Local workspace: 15 members/default web root; remove 12 dev/native sections.
+  Original included upstream bytes stay identical to the source pin. The local
+  manifest deltas are currently in source-build.patch and BUILD.md.
+- Third-party target filtering: 28 manifests / 59 sections after adding explicit
+  false custom cfgs fuzzing/loom/miri (sage-3983); 26/57 before that ruling.
+  All other unknown cfgs remain unknown. target-filter-plan.json is the list.
+- Dangling feature lists: 103 removed items across 8 manifests (sage-3982),
+  mechanically applied in scratch from dangling-features.json. Original vendor
+  bytes/checksums stay intact; scratch checksum updates touch only Cargo.toml.
+- Release flags must refuse inherited RUSTFLAGS/CARGO_ENCODED_RUSTFLAGS/
+  RUSTDOCFLAGS/CARGO_TARGET_*_RUSTFLAGS/CARGO_BUILD_RUSTFLAGS. Not yet implemented.
+- Gate narrowing from sage-3983: compare root-specific resolved package/selected
+  feature closures before/after packaging, not complete workspace-unified S0
+  feature text. Both package closures must match the 199/209 S0 sets. Still
+  unproved: pristine 209-only vendor itself cannot resolve the broader lock.
+
+The next refusal is an unresolved cfg category: encoding_rs 0.8.42 declares
+`simdutf8` 0.1.5 under cfg(any(x86_64,x86,aarch64,all(wasm32,simd128))).
+The default pinned wasm target has no simd128 feature, but the conservative
+filter retains unknown target_feature conditions rather than treating every
+potential target feature as false. No target_feature-based removal was made.
+The latest command/error is in offline-resolution.txt. Beyond that exact
+refusal, a static survey identifies 176 unconditional optional dependency
+entries (110 names across 82 manifests) absent from the 209; see
+unselected-dependency-resolution.json. These are not current errors and no
+such dependency was removed. They show why continued iterative reduction may
+require another category. This is a lower-bound survey, not a claim that
+removing all of those would make resolution succeed.
+
+Decision requested: continue reducing target-feature and unselected optional dependency metadata,
+or adopt the full-lock vendor tree with a separately identified resolution-only
+inventory. I recommend the full-lock vendor approach: it preserves upstream
+manifests/features and makes before/after root-closure comparison possible
+without accumulating more manifest surgery. It adds source/notice review and
+size; no extra package should enter the compiled web closure. This is not
+permission to fetch/import extra sources. Sage decides that boundary.
+
+Current tree sizes: upstream 582 files / 21,021,869 bytes; vendor 209 packages /
+10,499 files / 130,737,230 bytes; combined 151,759,099 bytes. Upstream exclusions
+are the authorized 30 icon/screenshot/macOS packaging paths, all enumerated in
+BUILD.md/PROVENANCE.json. No license/notice/copyright is omitted; no vendor file
+is dropped. Binary path/size inventory is binary-inputs.json (18 upstream and
+74 vendor non-text files). Source subset/integrity checks pass 3/3; build test
+is 1/2, with runtime-output check expected red because nothing is built yet.
@@ -0,0 +1,370 @@
+[
+  {
+    "path": "packages/webui/third_party/wordcraft/upstream/assets/fonts/Inter-Medium.ttf",
+    "bytes": 417300
+  },
+  {
+    "path": "packages/webui/third_party/wordcraft/upstream/assets/fonts/Inter-Regular.ttf",
+    "bytes": 411640
+  },
+  {
+    "path": "packages/webui/third_party/wordcraft/upstream/assets/fonts/Inter-SemiBold.ttf",
+    "bytes": 419744
+  },
+  {
+    "path": "packages/webui/third_party/wordcraft/upstream/assets/fonts/JetBrainsMono-Regular.ttf",
+    "bytes": 270224
+  },
+  {
+    "path": "packages/webui/third_party/wordcraft/upstream/assets/fonts/SourceSans3-Bold.ttf",
+    "bytes": 428176
+  },
+  {
+    "path": "packages/webui/third_party/wordcraft/upstream/assets/fonts/SourceSans3-It.ttf",
+    "bytes": 315812
+  },
+  {
+    "path": "packages/webui/third_party/wordcraft/upstream/assets/fonts/SourceSans3-Regular.ttf",
+    "bytes": 431196
+  },
+  {
+    "path": "packages/webui/third_party/wordcraft/upstream/assets/fonts/SourceSans3-Semibold.ttf",
+    "bytes": 425904
+  },
+  {
+    "path": "packages/webui/third_party/wordcraft/upstream/assets/fonts/SourceSerif4-Bold.ttf",
+    "bytes": 271568
+  },
+  {
+    "path": "packages/webui/third_party/wordcraft/upstream/assets/fonts/SourceSerif4-BoldIt.ttf",
+    "bytes": 191832
+  },
+  {
+    "path": "packages/webui/third_party/wordcraft/upstream/assets/fonts/SourceSerif4-It.ttf",
+    "bytes": 187808
+  },
+  {
+    "path": "packages/webui/third_party/wordcraft/upstream/assets/fonts/SourceSerif4-Regular.ttf",
+    "bytes": 261868
+  },
+  {
+    "path": "packages/webui/third_party/wordcraft/upstream/assets/fonts/SourceSerif4-Semibold.ttf",
+    "bytes": 272088
+  },
+  {
+    "path": "packages/webui/third_party/wordcraft/upstream/assets/hyphenation/en-us.dic",
+    "bytes": 432905
+  },
+  {
+    "path": "packages/webui/third_party/wordcraft/upstream/docs/brand/artcraft-logo-white.png",
+    "bytes": 32161
+  },
+  {
+    "path": "packages/webui/third_party/wordcraft/upstream/docs/brand/artcraft-logo.png",
+    "bytes": 31302
+  },
+  {
+    "path": "packages/webui/third_party/wordcraft/upstream/docs/brand/artcraft-mark-black.png",
+    "bytes": 26793
+  },
+  {
+    "path": "packages/webui/third_party/wordcraft/upstream/docs/brand/artcraft-mark.png",
+    "bytes": 24715
+  },
+  {
+    "path": "packages/webui/third_party/wordcraft/cargo-vendor/aes-0.9.3/tests/data/aes128.blb",
+    "bytes": 27420
+  },
+  {
+    "path": "packages/webui/third_party/wordcraft/cargo-vendor/aes-0.9.3/tests/data/aes192.blb",
+    "bytes": 41324
+  },
+  {
+    "path": "packages/webui/third_party/wordcraft/cargo-vendor/aes-0.9.3/tests/data/aes256.blb",
+    "bytes": 49596
+  },
+  {
+    "path": "packages/webui/third_party/wordcraft/cargo-vendor/brotli-decompressor-5.0.3/src/bin/ipsum.brotli",
+    "bytes": 1752
+  },
+  {
+    "path": "packages/webui/third_party/wordcraft/cargo-vendor/cfb-0.15.0/tests/infinite_loops_fuzzed/loop_in_alloc",
+    "bytes": 14106
+  },
+  {
+    "path": "packages/webui/third_party/wordcraft/cargo-vendor/cfb-0.15.0/tests/infinite_loops_fuzzed/loop_in_chain",
+    "bytes": 16959
+  },
+  {
+    "path": "packages/webui/third_party/wordcraft/cargo-vendor/cfb-0.15.0/tests/infinite_loops_fuzzed/loop_in_directory",
+    "bytes": 13954
+  },
+  {
+    "path": "packages/webui/third_party/wordcraft/cargo-vendor/cfb-0.15.0/tests/infinite_loops_fuzzed/loop_in_minialloc",
+    "bytes": 14336
+  },
+  {
+    "path": "packages/webui/third_party/wordcraft/cargo-vendor/cfb-0.15.0/tests/infinite_loops_fuzzed/loop_in_minichain",
+    "bytes": 13992
+  },
+  {
+    "path": "packages/webui/third_party/wordcraft/cargo-vendor/cfb-0.15.0/tests/infinite_loops_fuzzed/loop_in_open_1",
+    "bytes": 1049
+  },
+  {
+    "path": "packages/webui/third_party/wordcraft/cargo-vendor/cfb-0.15.0/tests/infinite_loops_fuzzed/loop_in_open_2",
+    "bytes": 13830
+  },
+  {
+    "path": "packages/webui/third_party/wordcraft/cargo-vendor/cfb-0.15.0/tests/panics_fuzzed/alloc_panic",
+    "bytes": 16928
+  },
+  {
+    "path": "packages/webui/third_party/wordcraft/cargo-vendor/cfb-0.15.0/tests/panics_fuzzed/minialloc_panic",
+    "bytes": 16909
+  },
+  {
+    "path": "packages/webui/third_party/wordcraft/cargo-vendor/cipher-0.5.2/tests/data/dummy_stream_cipher.blb",
+    "bytes": 84
+  },
+  {
+    "path": "packages/webui/third_party/wordcraft/cargo-vendor/digest-0.11.3/tests/data/fixed_hash_serialization.bin",
+    "bytes": 16
+  },
+  {
+    "path": "packages/webui/third_party/wordcraft/cargo-vendor/eframe-0.36.2/data/icon.png",
+    "bytes": 12052
+  },
+  {
+    "path": "packages/webui/third_party/wordcraft/cargo-vendor/epaint_default_fonts-0.36.2/fonts/Hack-Regular.ttf",
+    "bytes": 309408
+  },
+  {
+    "path": "packages/webui/third_party/wordcraft/cargo-vendor/epaint_default_fonts-0.36.2/fonts/NotoEmoji-Regular.ttf",
+    "bytes": 418804
+  },
+  {
+    "path": "packages/webui/third_party/wordcraft/cargo-vendor/epaint_default_fonts-0.36.2/fonts/Ubuntu-Light.ttf",
+    "bytes": 361676
+  },
+  {
+    "path": "packages/webui/third_party/wordcraft/cargo-vendor/epaint_default_fonts-0.36.2/fonts/emoji-icon-font.ttf",
+    "bytes": 324132
+  },
+  {
+    "path": "packages/webui/third_party/wordcraft/cargo-vendor/fdeflate-0.3.7/tests/input-chunking-sensitivity-example1.zz",
+    "bytes": 207
+  },
+  {
+    "path": "packages/webui/third_party/wordcraft/cargo-vendor/fdeflate-0.3.7/tests/input-chunking-sensitivity-example2.zz",
+    "bytes": 41
+  },
+  {
+    "path": "packages/webui/third_party/wordcraft/cargo-vendor/fdeflate-0.3.7/tests/input-chunking-sensitivity-example3.zz",
+    "bytes": 52
+  },
+  {
+    "path": "packages/webui/third_party/wordcraft/cargo-vendor/flate2-1.1.10/examples/hello_world.txt.gz",
+    "bytes": 33
+  },
+  {
+    "path": "packages/webui/third_party/wordcraft/cargo-vendor/flate2-1.1.10/tests/good-file.gz",
+    "bytes": 6766
+  },
+  {
+    "path": "packages/webui/third_party/wordcraft/cargo-vendor/flate2-1.1.10/tests/multi.gz",
+    "bytes": 53
+  },
+  {
+    "path": "packages/webui/third_party/wordcraft/cargo-vendor/hmac-0.13.0/tests/data/hmac_md5_rfc2104.blb",
+    "bytes": 246
+  },
+  {
+    "path": "packages/webui/third_party/wordcraft/cargo-vendor/hmac-0.13.0/tests/data/hmac_sha1_wycheproof.blb",
+    "bytes": 4877
+  },
+  {
+    "path": "packages/webui/third_party/wordcraft/cargo-vendor/hmac-0.13.0/tests/data/hmac_sha224_rfc4231.blb",
+    "bytes": 804
+  },
+  {
+    "path": "packages/webui/third_party/wordcraft/cargo-vendor/hmac-0.13.0/tests/data/hmac_sha256_rfc4231.blb",
+    "bytes": 832
+  },
+  {
+    "path": "packages/webui/third_party/wordcraft/cargo-vendor/hmac-0.13.0/tests/data/hmac_sha256_wycheproof.blb",
+    "bytes": 6155
+  },
+  {
+    "path": "packages/webui/third_party/wordcraft/cargo-vendor/hmac-0.13.0/tests/data/hmac_sha384_rfc4231.blb",
+    "bytes": 944
+  },
+  {
+    "path": "packages/webui/third_party/wordcraft/cargo-vendor/hmac-0.13.0/tests/data/hmac_sha384_wycheproof.blb",
+    "bytes": 7859
+  },
+  {
+    "path": "packages/webui/third_party/wordcraft/cargo-vendor/hmac-0.13.0/tests/data/hmac_sha512_rfc4231.blb",
+    "bytes": 1063
+  },
+  {
+    "path": "packages/webui/third_party/wordcraft/cargo-vendor/hmac-0.13.0/tests/data/hmac_sha512_wycheproof.blb",
+    "bytes": 9650
+  },
+  {
+    "path": "packages/webui/third_party/wordcraft/cargo-vendor/hmac-0.13.0/tests/data/hmac_streebog256_gost.blb",
+    "bytes": 85
+  },
+  {
+    "path": "packages/webui/third_party/wordcraft/cargo-vendor/hmac-0.13.0/tests/data/hmac_streebog512_gost.blb",
+    "bytes": 118
+  },
+  {
+    "path": "packages/webui/third_party/wordcraft/cargo-vendor/krilla-0.8.2/icc/sGrey-v2-magic.icc",
+    "bytes": 616
+  },
+  {
+    "path": "packages/webui/third_party/wordcraft/cargo-vendor/krilla-0.8.2/icc/sGrey-v4.icc",
+    "bytes": 360
+  },
+  {
+    "path": "packages/webui/third_party/wordcraft/cargo-vendor/krilla-0.8.2/icc/sRGB-v2-magic.icc",
+    "bytes": 736
+  },
+  {
+    "path": "packages/webui/third_party/wordcraft/cargo-vendor/krilla-0.8.2/icc/sRGB-v4.icc",
+    "bytes": 480
+  },
+  {
+    "path": "packages/webui/third_party/wordcraft/cargo-vendor/pdf-writer-0.15.0/examples/bear-1280x720.jpg",
+    "bytes": 67710
+  },
+  {
+    "path": "packages/webui/third_party/wordcraft/cargo-vendor/pdf-writer-0.15.0/examples/bear-1280x720.mp4",
+    "bytes": 715963
+  },
+  {
+    "path": "packages/webui/third_party/wordcraft/cargo-vendor/pdf-writer-0.15.0/examples/rhino.png",
+    "bytes": 215287
+  },
+  {
+    "path": "packages/webui/third_party/wordcraft/cargo-vendor/pdf-writer-0.15.0/examples/sRGB_v4.icc",
+    "bytes": 60960
+  },
+  {
+    "path": "packages/webui/third_party/wordcraft/cargo-vendor/pdf-writer-0.15.0/examples/tiger-cmyk.jpg",
+    "bytes": 945216
+  },
+  {
+    "path": "packages/webui/third_party/wordcraft/cargo-vendor/sha1-0.11.0/tests/data/sha1_kat.blb",
+    "bytes": 235
+  },
+  {
+    "path": "packages/webui/third_party/wordcraft/cargo-vendor/sha1-0.11.0/tests/data/sha1_serialization.bin",
+    "bytes": 92
+  },
+  {
+    "path": "packages/webui/third_party/wordcraft/cargo-vendor/sha2-0.11.0/tests/data/sha224_kat.blb",
+    "bytes": 179
+  },
+  {
+    "path": "packages/webui/third_party/wordcraft/cargo-vendor/sha2-0.11.0/tests/data/sha224_serialization.bin",
+    "bytes": 104
+  },
+  {
+    "path": "packages/webui/third_party/wordcraft/cargo-vendor/sha2-0.11.0/tests/data/sha256_kat.blb",
+    "bytes": 191
+  },
+  {
+    "path": "packages/webui/third_party/wordcraft/cargo-vendor/sha2-0.11.0/tests/data/sha256_serialization.bin",
+    "bytes": 104
+  },
+  {
+    "path": "packages/webui/third_party/wordcraft/cargo-vendor/sha2-0.11.0/tests/data/sha384_kat.blb",
+    "bytes": 239
+  },
+  {
+    "path": "packages/webui/third_party/wordcraft/cargo-vendor/sha2-0.11.0/tests/data/sha384_serialization.bin",
+    "bytes": 208
+  },
+  {
+    "path": "packages/webui/third_party/wordcraft/cargo-vendor/sha2-0.11.0/tests/data/sha512_224_kat.blb",
+    "bytes": 179
+  },
+  {
+    "path": "packages/webui/third_party/wordcraft/cargo-vendor/sha2-0.11.0/tests/data/sha512_224_serialization.bin",
+    "bytes": 208
+  },
+  {
+    "path": "packages/webui/third_party/wordcraft/cargo-vendor/sha2-0.11.0/tests/data/sha512_256_kat.blb",
+    "bytes": 191
+  },
+  {
+    "path": "packages/webui/third_party/wordcraft/cargo-vendor/sha2-0.11.0/tests/data/sha512_256_serialization.bin",
+    "bytes": 208
+  },
+  {
+    "path": "packages/webui/third_party/wordcraft/cargo-vendor/sha2-0.11.0/tests/data/sha512_kat.blb",
+    "bytes": 290
+  },
+  {
+    "path": "packages/webui/third_party/wordcraft/cargo-vendor/sha2-0.11.0/tests/data/sha512_serialization.bin",
+    "bytes": 208
+  },
+  {
+    "path": "packages/webui/third_party/wordcraft/cargo-vendor/tiff-0.11.3/tests/decodedata-rgb-3c-8b.tiff",
+    "bytes": 30180
+  },
+  {
+    "path": "packages/webui/third_party/wordcraft/cargo-vendor/ttf-parser-0.25.1/examples/wasm/TTC.ttc",
+    "bytes": 2608
+  },
+  {
+    "path": "packages/webui/third_party/wordcraft/cargo-vendor/ttf-parser-0.25.1/tests/fonts/bitmap.otb",
+    "bytes": 2072
+  },
+  {
+    "path": "packages/webui/third_party/wordcraft/cargo-vendor/ttf-parser-0.25.1/tests/fonts/colr_1.ttf",
+    "bytes": 21568
+  },
+  {
+    "path": "packages/webui/third_party/wordcraft/cargo-vendor/ttf-parser-0.25.1/tests/fonts/colr_1_variable.ttf",
+    "bytes": 53096
+  },
+  {
+    "path": "packages/webui/third_party/wordcraft/cargo-vendor/ttf-parser-0.25.1/tests/fonts/demo.ttf",
+    "bytes": 400
+  },
+  {
+    "path": "packages/webui/third_party/wordcraft/cargo-vendor/unicode-ident-1.0.26/tests/fst/xid_continue.fst",
+    "bytes": 78779
+  },
+  {
+    "path": "packages/webui/third_party/wordcraft/cargo-vendor/unicode-ident-1.0.26/tests/fst/xid_start.fst",
+    "bytes": 69927
+  },
+  {
+    "path": "packages/webui/third_party/wordcraft/cargo-vendor/vello_common-0.1.0/assets/probe.png",
+    "bytes": 877
+  },
+  {
+    "path": "packages/webui/third_party/wordcraft/cargo-vendor/vello_common-0.1.0/assets/probe.rgba",
+    "bytes": 10404
+  },
+  {
+    "path": "packages/webui/third_party/wordcraft/cargo-vendor/vello_common-0.2.0/assets/probe.png",
+    "bytes": 877
+  },
+  {
+    "path": "packages/webui/third_party/wordcraft/cargo-vendor/vello_common-0.2.0/assets/probe.rgba",
+    "bytes": 10404
+  },
+  {
+    "path": "packages/webui/third_party/wordcraft/cargo-vendor/zlib-rs-0.6.8/src/deflate/test-data/inflate_buf_error.dat",
+    "bytes": 67008
+  },
+  {
+    "path": "packages/webui/third_party/wordcraft/cargo-vendor/zlib-rs-0.6.8/src/deflate/test-data/paper-100k.pdf",
+    "bytes": 102400
+  }
+]
@@ -0,0 +1,27 @@
+✔ release build refuses a missing or mismatched pinned tool before compilation (4.631422ms)
+✖ shipped runtime is self-contained and matches every output receipt (0.349349ms)
+ℹ tests 2
+ℹ suites 0
+ℹ pass 1
+ℹ fail 1
+ℹ cancelled 0
+ℹ skipped 0
+ℹ todo 0
+ℹ duration_ms 48.123956
+
+✖ failing tests:
+
+test at packages/webui/tests/wordcraft-build.test.mjs:14:1
+✖ shipped runtime is self-contained and matches every output receipt (0.349349ms)
+  Error: ENOENT: no such file or directory, open '/home/jwoltje/.t3/worktrees/mosaic-stack/gyro-row310/packages/webui/wordcraft/BUILD.json'
+      at readFileSync (node:fs:621:20)
+      at readJSON (file:///home/jwoltje/.t3/worktrees/mosaic-stack/gyro-row310/packages/webui/wordcraft/build.mjs:9:37)
+      at verifyOutputs (file:///home/jwoltje/.t3/worktrees/mosaic-stack/gyro-row310/packages/webui/wordcraft/build.mjs:61:19)
+      at TestContext.<anonymous> (file:///home/jwoltje/.t3/worktrees/mosaic-stack/gyro-row310/packages/webui/tests/wordcraft-build.test.mjs:17:18)
+      at async Test.run (node:internal/test_runner/test:1409:7)
+      at async Test.processPendingSubtests (node:internal/test_runner/test:974:7) {
+    errno: -2,
+    code: 'ENOENT',
+    syscall: 'open',
+    path: '/home/jwoltje/.t3/worktrees/mosaic-stack/gyro-row310/packages/webui/wordcraft/BUILD.json'
+  }
@@ -0,0 +1,46 @@
+✖ release build refuses a missing or mismatched pinned tool before compilation (0.932948ms)
+✖ shipped runtime is self-contained and matches every output receipt (0.1963ms)
+ℹ tests 2
+ℹ suites 0
+ℹ pass 0
+ℹ fail 2
+ℹ cancelled 0
+ℹ skipped 0
+ℹ todo 0
+ℹ duration_ms 48.311391
+
+✖ failing tests:
+
+test at packages/webui/tests/wordcraft-build.test.mjs:7:1
+✖ release build refuses a missing or mismatched pinned tool before compilation (0.932948ms)
+  AssertionError [ERR_ASSERTION]: owned builder must exist
+      at TestContext.<anonymous> (file:///home/jwoltje/.t3/worktrees/mosaic-stack/gyro-row310/packages/webui/tests/wordcraft-build.test.mjs:8:10)
+      at Test.runInAsyncScope (node:async_hooks:226:14)
+      at Test.run (node:internal/test_runner/test:1402:25)
+      at Test.start (node:internal/test_runner/test:1262:17)
+      at startSubtestAfterBootstrap (node:internal/test_runner/harness:387:17) {
+    generatedMessage: false,
+    code: 'ERR_ASSERTION',
+    actual: false,
+    expected: true,
+    operator: '==',
+    diff: 'simple'
+  }
+
+test at packages/webui/tests/wordcraft-build.test.mjs:14:1
+✖ shipped runtime is self-contained and matches every output receipt (0.1963ms)
+  AssertionError [ERR_ASSERTION]: owned builder must exist
+      at TestContext.<anonymous> (file:///home/jwoltje/.t3/worktrees/mosaic-stack/gyro-row310/packages/webui/tests/wordcraft-build.test.mjs:15:10)
+      at Test.runInAsyncScope (node:async_hooks:226:14)
+      at Test.run (node:internal/test_runner/test:1402:25)
+      at Test.processPendingSubtests (node:internal/test_runner/test:974:18)
+      at Test.postRun (node:internal/test_runner/test:1542:19)
+      at Test.run (node:internal/test_runner/test:1467:12)
+      at async startSubtestAfterBootstrap (node:internal/test_runner/harness:387:3) {
+    generatedMessage: false,
+    code: 'ERR_ASSERTION',
+    actual: false,
+    expected: true,
+    operator: '==',
+    diff: 'simple'
+  }
Author	SHA1	Message	Date
jason.woltje	1749728ca6	docs(gyro): record supplemental notice collection recheck	2026-10-24 01:45:35 -05:00
jason.woltje	9522d2356b	docs(gyro): record 223 release measurement and supplemental notices	2026-10-24 01:41:42 -05:00
jason.woltje	1716f5a22d	docs(gyro): measure row 310 223-package source and pruned lock	2026-10-24 01:29:58 -05:00
jason.woltje	d16958bcfd	docs: W brief D2 lets O2 rows build before 10-27 and land only on an idle slot, Opus 5.5 review once at landing (mos-1571); register Codex seats Glomgold (row 309, W1) and Gyro (row 310, W2); doc only	2026-10-24 00:26:11 -05:00
jason.woltje	48f1627be2	queue: revs 3789-3844 (sage briefs/reviewer moves 157/208/265, requests, notes and done for 208/326/265; goldie 265 and 326; poe 208; bentina 157 r1/r2; gladstone 208 approve; boyd 157 r1 changes, r2 approve, 265 approve; duckworth 208 approve; darkwing 157 r2 approve)	2026-10-24 00:19:05 -05:00
jason.woltje	17f056787f	docs: brief template, landed evidence is plain text with no gzip or binary waiver (mos-1570); doc only	2026-10-24 00:16:26 -05:00
jason.woltje	200dd396c4	feat(bus): add human project rooms with addressed sends (cherry picked from commit `ef4c938532`)	2026-10-23 23:57:31 -05:00
jason.woltje	537902d261	docs: DEFERRED closes ops-0282 B2-2 (row 326 landed) and carries row 208 N1, the 5 s user.js re-render; doc only	2026-10-23 23:56:43 -05:00
jason.woltje	f58049de02	duckworth: row 208 (193d) second review approve (static, guards) on `4a4bef6c1`, no bus change, every hidden control has a broker refusal, grant hint per-grant and self-only, N1 (duckworth-0302) (cherry picked from commit c36a0dc0d0a9f762bc74078dd53cce53df75642a)	2026-10-23 23:30:38 -05:00
jason.woltje	33f49f7d5a	docs(host): close five first-install run-sheet gaps (#1822 ) (cherry picked from commit `a1b13c60e1`)	2026-10-23 23:30:30 -05:00
jason.woltje	4a4bef6c13	feat(webui): shared threads and per-grant viewer read-only (193d)	2026-10-23 23:22:19 -05:00
jason.woltje	ec86f2c847	docs: register Codex builder seats Bentina (row 157, I2) and Poe (row 208, 193d) under Q246 and mos-1566; doc only	2026-10-23 22:50:59 -05:00
jason.woltje	4ec279dc43	docs: run-sheet doc row brief, five operator gaps (mos-1566, ops-0282, ops-0291, ops-0292)	2026-10-23 22:47:34 -05:00
jason.woltje	3d2569ce25	queue: revs 3779-3788 (sage 323 note/done, 325 add/briefed/request; goldie 325 start/in-review/outcome; gladstone 325 approve record)	2026-10-23 20:33:27 -05:00
jason.woltje	3a20f29d66	docs: row 325 brief, re-key the Case 1 project to stack (ops-0288, mos-1563, mos-1564) (cherry picked from commit 60d78e44e1e66cfb506bbae7399abc581729c97e)	2026-10-23 20:31:38 -05:00
jason.woltje	c5f96836d5	fix(case1): match factory project key to repository id (#1821 )	2026-10-23 20:14:55 -05:00
jason.woltje	99930362e4	queue: revs 3766-3778 (goldie 324/323 in-review and outcomes, sage 324 request/note/done and 42 note and 323 request, duckworth 324 and 323 approve records)	2026-10-23 19:59:07 -05:00
jason.woltje	579720e84a	duckworth: row 323 round 1 approve (static) on `6a0f0f4f8`, manifest 903ef022 matches, fields sourced, tests read shipped bytes, tester mutant real, C1 Sage gate cli, N1-N2 doc (duckworth-0300) (cherry picked from commit 6ed9dc76df0f73f0488ceee801ee21cb7d137bf3)	2026-10-23 19:55:04 -05:00
jason.woltje	c25799928d	docs: brief template TMPDIR rule and DEFERRED revoke-window socket-path entry (row 323, mos-1561); doc only (cherry picked from commit dda2d07b48b82821f85f73d7c5a3d9958bd9ce93)	2026-10-23 19:54:55 -05:00
jason.woltje	6a0f0f4f80	docs: record row 323 verification and TMPDIR root cause	2026-10-23 19:38:25 -05:00
jason.woltje	571376c30e	feat(case1): add trackerless factory business file (#1819 )	2026-10-23 19:12:43 -05:00
jason.woltje	6002698c32	docs: preserve row 323 investigation and no-tracker boundary	2026-10-23 19:08:37 -05:00
jason.woltje	dd6cb5872b	duckworth: row 324 round 1 approve (static) on `dbdfcfd52`, manifest 52874356 matches, every business.tracker reader handles absence, present null refuses, no @sync when absent, N1 doc (duckworth-0298) (cherry picked from commit bd0fbdcf29fabec89338c5d49e6293b6d6ec8cc8)	2026-10-23 19:06:25 -05:00
jason.woltje	64ea540838	docs: DEFERRED B2-2 (run sheet proof format, ops-0282, mos-1557) and Sage session line; doc only (cherry picked from commit 720b1fed89d0f278393435ef4ad63c529efff388)	2026-10-23 18:50:19 -05:00
jason.woltje	854b783cda	queue: revs 3733-3765. Rows 298, 322, 321 landed in `3569bf54f` and done (sage 3760-3765); 324 filed and briefed (sage 3755-3756), Goldie claim 3759. Sage 3733-3736 3738 3742 3748 3750-3753 3755-3756 3760-3765; boyd 3737 3739 3740 3757; goldie 3741 3743 3744 3749 3759; gladstone 3745-3747; dewey 3754; morgana 3758 (cherry picked from commit fb49fa63ef2f081b755a60bc4fa4b1f1d32046a7)	2026-10-23 18:50:05 -05:00
jason.woltje	dbdfcfd52c	docs: record row 324 rebased verification and mutant evidence	2026-10-23 18:44:35 -05:00
jason.woltje	7e59ba8b3d	feat(business): allow businesses without a tracker (#1820 )	2026-10-23 18:43:08 -05:00
jason.woltje	3569bf54f5	docs(row321): wait for loopback health before precheck (#1817 , F11) (cherry picked from commit `9aae73ade2`)	2026-10-23 18:15:16 -05:00
jason.woltje	3fd5307e1e	docs(row321): remove whitespace from the embedded diff receipt (#1817 ) (cherry picked from commit `d9400f0d36`)	2026-10-23 18:15:16 -05:00
jason.woltje	5283d3745f	docs(row321): set wrapper environment and explain first adoption (#1817 ) (cherry picked from commit `b5d4d79031`)	2026-10-23 18:15:16 -05:00
jason.woltje	467b05fe2b	fix(case2): import library personas from the pinned copy (#1818 ) (cherry picked from commit `7b4ea42171`)	2026-10-23 18:15:16 -05:00
jason.woltje	dca5831e7e	docs: brief for row 324, tracker optional in the business file (#1820 , Q247, mos-1555, sage-3831); doc only (cherry picked from commit f375f4e9253bb02642ee15c4099b208a4d235360)	2026-10-23 18:14:32 -05:00
jason.woltje	021422e921	docs: DEFERRED, ops-0275 O2 (writer.lock pid is the forked broker, by design) and O3 (npm 12 skips the three install scripts; refuse them in allowScripts at the next package.json row) (mos-1549); doc only (cherry picked from commit da537e7d159be0bf39a36eaaa65cd16c20373b72)	2026-10-23 18:14:32 -05:00
jason.woltje	920b691263	docs: brief for the Case 1 factory business file for .53 (#1819 , #414 stage 2, ops-0277, sage-3807); doc only (cherry picked from commit 68f3bded561d3fc0c8a6055b2ed35e8fb87ee611)	2026-10-23 18:14:32 -05:00
jason.woltje	8d40ed20a8	docs: add F11 to the F7 brief (#1817 ): wait for the loopback healthz 200 before a precheck after unit start (ops-0275, mos-1549); doc only (cherry picked from commit a9bae9af269c84a3bd6d37a38b64fe80d05590bb)	2026-10-23 18:14:31 -05:00
				`@@ -0,0 +1 @@`
				`No changed-file mention has a literal 64-hex digest within eight lines.`
				`@@ -0,0 +1 @@`
				`No changed-product-file mention has a literal 64-hex digest within eight lines.`