row 245: slot results in the packet: singles 23/0, mutants 16/16 killed, gate cli 664/0 and selftests 429/0 (sage-1961, #1693 )

row 245: the N1-N3 notes move to the row 245 packet; DESIGN.md:336-338 recorded as superseded by gosalyn-0087, unedited (sage-1877, #1693 )
row 195 follow-up: F9 runs node as root only at the pinned, root-only path; header lists root's commands; F6 refuses .. (Duckworth N1-N3, #1693 )
2026-10-21 06:43:52 -05:00 · 2026-10-21 05:09:28 -05:00 · 2026-10-21 05:09:03 -05:00 · 2026-10-21 05:03:21 -05:00 · 2026-10-21 05:01:46 -05:00 · 2026-10-21 04:58:30 -05:00
194 changed files with 19879 additions and 6869 deletions
@@ -5174,3 +5174,6 @@ Before: managed project/thread verbs had no Console conversation area. After: fi
 2026-10-20 04:44:54 UTC | Row 178 round 2 preparation | Before: Dewey C1 five render guards lacked killing tests. Added independent refusal fixtures, a temporary uid+1 id stub with cleanup, and empty loopback proof case; activation ordering recorded in r2 BUILD. Product unchanged; syntax/text preflight only, no test or mutant execution. Pending row 181 rebase and Sage slot.

 2026-10-20 05:10:34 UTC | Row 178 #1676 round 2 verified | Before: C1 render refusals lacked killing tests and row 181 base was pending. Rebased onto 931651f2d, kept all COUNTED/count code and tests, appended T178 tail; added independent owner/collision/absolute/charset/header and empty-loopback proof tests. Four files singly 156/156, all 24 mutants killed, metadata and sandbox fixture probes pass; scratch sweep empty. Packet agents/rocko/work/queue-178/r2/, candidate 9300a670, inventory d0dcde7b (59/59), scan 58 files no findings; in-review revs 2166-2167, expected no-token request failure. No live actions or commits.
+2026-10-21T01:28:05Z | Darkwing | row 232 #1734 installer I1 build, round 1 in review | Before: stack-release.sh managed only user units (systemctl --user), and stack-copy.sh had no bundle copy. After: --units external (adopt, activate, rollback --to, status, confirm, revert, gate --since, AWAITING-UNITS, stale-start, external-pm, --plan --expect-from) and stack-copy check --units external, copy --bundle FILE SHA, wrapper ID --create; user mode byte-identical to the base by test. First build 0af0c73c6 on 00d4cc1f6; rebased onto row 200 (cb5fdb064) as a0ffabc3f on darkwing/row232-r1; --sso refused under external (D9), row 200 config_checks run under external (D10). Gate on Sage's slot (sage-1618): cli 561/0, every scripts/test-*.sh green; 17/17 mutants killed. Results commit 84f1a91e6 (pushed, seat branch only). Manifest 7a3b4ea1 (9 paths), queue revs 2595-2596, request comment 29825, reviewer Filbert. Packet agents/darkwing/work/queue-232/BUILD.md.
+2026-10-21T04:50:44Z | Darkwing | row 233 #1735 installer I3 build, round 1 in review | Before: root had no upgrade driver for root-owned units and no host run sheet; stack-release.sh had no rehearse --backup last and no external plan refusals. After: scripts/stack-upgrade.sh upgrade and rollback (r6 A1-A5, A2f, R1-R4) with 20 tests, docs/guides/host-run-sheet.md, TOOLS.md lines, and on Sage's rulings stack-release.sh --backup last, BACKUP_STORE and the --plan refusals open-activation and migrate-required (3 tests). Base e65a3ab4d (row 232's landing). Gate on Sage's slot (sage-1704) on d99166ade: cli 616/0, every scripts/test-*.sh green, 1201/0 summed by awk; m1-m8 8/8 killed. Correction: the process sweep after the gate found an orphaned sleep 60 from the lock test's flock holder (N1); 08db6ac3f fixes it test only, Sage ruled the gate stands (sage-1707), rerun c0 20/0 and m1 killed with 0 left (sage-1708). Tip 1a1dc80ca (pushed, seat branch only). Manifest 464ce9eb (7 paths), queue revs 2644 and 2647, request comment 29901, reviewer Filbert. Packet agents/darkwing/work/queue-233/BUILD.md.
+2026-10-21T06:37:41Z | Darkwing | row 240 #1746 installer I4 build, round 1 in review | Before: root had no host check for the bwrap AppArmor profile, its pins or a boot unit, and stack-upgrade.sh exited 1 args-failed when the args move after A5 failed, while exit 1 means the old copy runs. After: scripts/case1-hostcheck.sh (seven items, --check, --enforce, --upstream), scripts/case1-pins.sh, mosaic-hostcheck.service and 16 tests; the args move failure exits 5 args-failed, documented in TOOLS.md and run sheet section 6 and tested; run sheet section 3 puts the pinned npm on PATH and names the bin/claude.exe --claude path; sections 8 and 10 have precheck lines. Verification: slot run r1 on 47ec9fe2f failed at the singles (the new N1 test's after hook threw ENOENT after the fixture cleanup removed the root); b45852daa drops the hook; r2 on b45852daa green: singles 16/0 and 21/0, c0 plus M1-M8 8/8 killed, cli 639/0, scripts 585/0. Candidate darkwing/row240-r3 ad1b23ab2 on c771a36f4, manifest 573ece95 (9 paths), revs 2694 and 2695, comment 29943.
@@ -86,7 +86,8 @@ The layers each adapter relies on, and what they don't cover, are in
 ### A role's skills (row 64)

 A managed session's skills reach both adapters as text in the bundle's
-`prompt.md`, which they pass with `--system-prompt`. Neither adapter loads a
+`prompt.md`, which they pass as a file: `pi` with `--system-prompt <path>`
+and `claude` with `--system-prompt-file <path>` (row 213). Neither adapter loads a
 skill of its own: `pi` keeps `--no-skills`, since role sessions never get
 `MOSAIC_SKILLS`, and `claude` keeps `--disable-slash-commands` and
 `--restricted`. Sage chose this on 2026-10-19 from a probe, recorded in
@@ -104,5 +105,8 @@ skill of its own: `pi` keeps `--no-skills`, since role sessions never get

 The cost is prompt size: a role's skill text is in every turn, where the
 other routes load a skill when it's used. The bundle caps a role's skills at
-64 KiB together, since `claude` passes `prompt.md` as one argument and Linux
-caps one argument at 128 KiB.
+64 KiB together. The cap dates from when `claude` passed `prompt.md` as one
+argument, which Linux caps at 128 KiB; row 213 passes the file instead, so no
+local user reads the prompt in `/proc/<pid>/cmdline`. Pi 0.85.1 uses the path
+string itself as the prompt when the file is missing or can't be read, so the
+pi adapter exits 2 unless the path is a readable regular file.
@@ -27,6 +27,11 @@ need MOSAIC_CLAUDE_MCP_CONFIG
 for f in "$MOSAIC_SYSTEM_PROMPT_FILE" "$MOSAIC_CLAUDE_SETTINGS" "$MOSAIC_CLAUDE_MCP_CONFIG"; do
    [ -r "$f" ] || { echo "claude adapter: not readable: $f" >&2; exit 2; }
 done
+PROMPT_FILE=$MOSAIC_SYSTEM_PROMPT_FILE
+case "$PROMPT_FILE" in
+    /*) ;;
+    *) PROMPT_FILE="$(pwd)/$PROMPT_FILE" ;;
+esac
 [ "${MOSAIC_INTERACTIVE:-}" != "1" ] || { echo "claude adapter: interactive mode isn't supported" >&2; exit 2; }
 CLAUDE=claude
 if [ -n "${MOSAIC_CLAUDE_BIN:-}" ]; then
@@ -56,7 +61,10 @@ fi
 # Flags:
 #   -p                       one-shot: print the answer and exit
 #   --output-format text     stdout is the answer only
-#   --system-prompt          the generated prompt replaces the default
+#   --system-prompt-file     the generated prompt replaces the default, given
+#                            as a file so no local user reads it in
+#                            /proc/<pid>/cmdline (row 213); absolute, since
+#                            the cd above changed the working directory
 #   --effort                 the instance's thinking var (row 65; 2.1.302 takes
 #                            low, medium, high, xhigh, max)
 #   --restricted             no user/project/local settings files; --settings
@@ -76,10 +84,9 @@ fi
 #                            text in the system prompt (row 64)
 ALLOWED=mcp__mosaic
 [ -z "${MOSAIC_TOOLS:-}" ] || ALLOWED="$MOSAIC_TOOLS,mcp__mosaic"
-PROMPT_CONTENT="$(cat "$MOSAIC_SYSTEM_PROMPT_FILE")"
 "$CLAUDE" -p "$MOSAIC_REQUEST" \
    --output-format text \
-    --system-prompt "$PROMPT_CONTENT" \
+    --system-prompt-file "$PROMPT_FILE" \
    --model "$MOSAIC_MODEL" \
    --effort "$MOSAIC_THINKING" \
    --restricted \
@@ -8,7 +8,17 @@
 set -eu

 [ -n "${MOSAIC_SYSTEM_PROMPT_FILE:-}" ] || { echo "pi adapter: MOSAIC_SYSTEM_PROMPT_FILE is required" >&2; exit 2; }
-[ -r "$MOSAIC_SYSTEM_PROMPT_FILE" ] || { echo "pi adapter: system prompt not readable: $MOSAIC_SYSTEM_PROMPT_FILE" >&2; exit 2; }
+# Row 213 (C2-08): pi gets the prompt as a path, so no local user reads it in /proc/<pid>/cmdline.
+# Pi 0.85.1 reads --system-prompt as a file only when the path exists and reads, and otherwise
+# uses the path string itself as the prompt, without a warning for a missing file
+# (dist/core/resource-loader.js resolvePromptInput). So the path must be a regular readable
+# file here, and is made absolute before the cd below, since pi resolves it from its own cwd.
+PROMPT_FILE=$MOSAIC_SYSTEM_PROMPT_FILE
+case "$PROMPT_FILE" in
+    /*) ;;
+    *) PROMPT_FILE="$(pwd)/$PROMPT_FILE" ;;
+esac
+[ -f "$PROMPT_FILE" ] && [ -r "$PROMPT_FILE" ] || { echo "pi adapter: system prompt not readable: $MOSAIC_SYSTEM_PROMPT_FILE" >&2; exit 2; }
 # MOSAIC_AGENT_NAME is optional in headless mode (identity section is then
 # omitted); interactive launches always set it via scripts/agent.sh.

@@ -94,7 +104,8 @@ fi
 # All flags documented in the pi package README (CLI Reference):
 #   -p/--print     one-shot mode: print the response and exit (omitted in
 #                  interactive TUI mode)
-#   --system-prompt  replace the default prompt with the generated one
+#   --system-prompt  replace the default prompt with the generated one, given
+#                  as the file's absolute path (checked above), never its text
 #   --no-*         no ambient context/skills/extensions/templates/themes
 #   EXT_FLAGS      the explicitly provided extensions only (-e)
 #   SESSION_FLAGS  ephemeral | persistent | forked (per env)
@@ -103,7 +114,6 @@ fi
 #   --offline      no startup network operations (update checks/telemetry)
 #   --no-approve   ignore project-local .pi/ files (settings, SYSTEM.md)
 #                  whatever trust is saved for the workspace
-PROMPT_CONTENT="$(cat "$MOSAIC_SYSTEM_PROMPT_FILE")"
 set -- \
    --offline \
    --no-approve \
@@ -118,7 +128,7 @@ set -- \
    --provider "$PI_PROVIDER" \
    --model "$PI_MODEL" \
    $THINKING_FLAG \
-    --system-prompt "$PROMPT_CONTENT"
+    --system-prompt "$PROMPT_FILE"
 # One-shot mode appends -p and the request (both safely quoted);
 # interactive mode appends nothing - clean TUI.
 [ "$INTERACTIVE" = "1" ] || set -- "$@" -p "$MOSAIC_REQUEST"
@@ -0,0 +1,161 @@
+# Row 195 build: `scripts/case1-accept.sh`
+
+Row 195 (#1693), the Case 1 install on 10.1.1.53. Design r7 at 5425ea2f3, approved by Duckworth
+(duckworth-0087, `agents/duckworth/work/row195/REVIEW-r7.md` at 58d930f89; Gitea 29962). Sage's go to build
+is sage-1817.
+
+## What this commit holds
+
+- `scripts/case1-accept.sh` (new, 100755): section 5's acceptance, F1-F11 and P1-P11.
+- `packages/cli/tests/case1-accept.test.mjs` (new): section 5's cases.
+- `docs/TOOLS.md`: the `case1-accept.sh` entry after the hostcheck entry.
+- This file.
+- `DESIGN.md`, doc-only fixes Sage named in sage-1817, with no new design round:
+  - Duckworth's N1. Section 1's human-id row cited `broker.mjs:245`; the check is `broker.mjs:321`.
+  - Row 226's state at :21 and :326. It said "unclaimed"; 226 is assigned to Gosalyn, briefed and not
+    started (sage-1814).
+  - :340 said I'd send the section 6 items to Gosalyn once 226 was claimed. I sent them on 2026-10-21
+    and Gosalyn acknowledged (gosalyn-0085), so the line now says that.
+
+Nothing else changes. No `case2-*.sh`, `stack-upgrade.sh`, `stack-release.sh`, `case1-hostcheck.sh` or run
+sheet edit, and nothing touches .53 (sage-1809).
+
+## Deviations from section 5, and choices it left open
+
+1. P4's mark is the single token `accepted Q182+Q183`. Section 5 lists `accepted Q182` and `accepted
+   Q183` as marks and gives P4 both. One line can carry one mark, and P4 is the only Q182 path, so the
+   count list has `accepted Q182+Q183` in place of `accepted Q182`.
+2. The test seam replaces `getent`. Under `--root`, the script reads `DIR/etc/passwd` and `DIR/etc/group`
+   with awk. Without it, the same helper calls `getent`. The groups of a user are its primary gid, then
+   each group whose member list names it, which is what `id -G` prints. So there is no fake `id`, and
+   the script never calls `id` for another user.
+3. P10 reads the port floor from `/proc/sys/net/ipv4/ip_unprivileged_port_start` rather than calling
+   `sysctl`, so the seam covers it the way hostcheck's item 7 is covered. There is no fake `sysctl`.
+4. There is no fake `bwrap`, `claude`, `node` or `hostcheck.sh` on PATH. The script runs each by the
+   absolute path the args file or the install names, so the test puts stubs at those paths under
+   `--root`, and the fake `sudo` runs the stack's user's commands from the tree.
+5. The args file must say `--profile factory` and name `--business`. Both are new refusals beyond
+   `stack-upgrade.sh`'s rules. A library file, or one for another business, would make F4 and F7
+   check the wrong thing. After `--`, `--port` and `--tester-port` must be numeric. The args file is the
+   only source of the ports.
+6. F8, F9 and F11 read file metadata as root: `stat`, `-L` and `find -maxdepth 1 -name '*.json'`. None
+   opens the credential. F9 parses `managed-settings.json` with the pinned node, run by root: that node
+   and that file are both root's own, installed by ops-01.
+7. F7 reads `launch.by` from `$HOME/.config/mosaic-dev/businesses/<id>.json` as the stack's user. That
+   path is `businessFilePath(id)` under the default config, which is what the unit uses. It doesn't load
+   the copy's `business.mjs` as `stack-release.sh`'s `plugins launchby` does. The user runs the whole
+   check and prints one line, and root accepts only `ok <instance> run <run>` (sage-1653: root doesn't
+   parse the user's output beyond a fixed pattern).
+8. F5 names a process claude when its argv0's basename or its `comm` starts with `claude`. The window
+   confirms this against a real role session. If the bwrap'd claude shows another name, F5 fails closed
+   and the fix is this match, not the label check.
+9. F3 and F5 run together. `talk` goes out in the background under `timeout 330`, and the `/proc` scan
+   repeats every half second until it finds a labelled pair or `talk` exits. F3's line prints first, then
+   F4, then F5, so the output keeps id order. F3 passes on exit 0 with the `sent` line and a reply line,
+   both counted on stdout only (`cli.mjs:395` and the `formatMessage` write); talk's error goes to stderr.
+12. `--claude` must match `^/[A-Za-z0-9/._+@-]+$`. The `@` is for `node_modules/@anthropic-ai/...`;
+    `stack-upgrade.sh` doesn't check `--claude` at all.
+10. F1 requires all four uids in `/proc/<MainPID>/status` (real, effective, saved, filesystem) to be the
+    user's.
+11. Evidence text the stack's user controls (talk's last line, the precheck's last line, F6's and F10's
+    `--version`) is cut to printable ASCII, one line, 200 bytes.
+
+## Tests
+
+`packages/cli/tests/case1-accept.test.mjs`, 22 tests. Every case builds a scratch host with every F check
+passing and every P check closed or accepted, then changes one thing:
+- all pass: exit 0, ids in order, each P mark, the count lines match the check lines, and the stand-in
+  credential's value appears nowhere;
+- each F check failing alone exits 1 with only its line failing;
+- F3 on exit 0 with only the `sent` line, and its evidence taking talk's stderr;
+- F1 on a failed unit and on `User=root`; F2 on healthz failing and on another pid holding the port;
+- F5 on `unpriv_bwrap (enforce)`, `bwrap//&unpriv_bwrap (complain)`, a trailing space on either label,
+  no bwrap of the user's, and passing on `comm` alone;
+- F6 on a stub that prints nothing and on a path outside `claude-<pin>`;
+- F7 on two live PM launches, a live one for another business, and no `launch.by`;
+- F8 on 0640, on another owner and on a symlink, never printing the credential;
+- F9 on a group-writable mode, another owner and a number for the flag;
+- F11 on one `*.json` under `discord/`, and passing on an empty directory;
+- each P check's unnamed mark, with the line count each fault makes: P6 one line per member, P9 one per
+  missing item; P2, P5, P10 and P11 in more than one way;
+- every P check unnamed at once still exits 0;
+- nine bad args files refuse with exit 2 before any command runs, each with its own refusal text;
+- usage errors, and a user's run without `--root`, exit 2;
+- every in-instance call goes through `sudo -u mosaic -H env PATH=<node dir>:/usr/local/bin:/usr/bin:/bin`,
+  read from the fake `sudo`'s argv, and root's other `sudo` calls are exactly `-l -U mosaic`,
+  `-l -U localadmin` and the jarvis bwrap probe;
+- the host check records `--check` and never `--enforce`.
+
+## Mutants
+
+Section 5's twelve, each one exact replacement in `scripts/case1-accept.sh`, run by
+`/mnt/storage/scratch/darkwing-195-out/mutants.py` in Sage's slot (sage-1865). All twelve were killed.
+After each one the script's bytes were restored, and the final sha256 matched (`d434f15ff638...`). The
+killers below are the tests that failed in each mutant's saved log.
+
+| # | Mutant | Killed by |
+|---|---|---|
+| 1 | F1 passes on a MainPID owned by root | each F alone |
+| 2 | F2 accepts a listener on 0.0.0.0 | each F alone |
+| 3 | F3 passes without a reply | each F alone; F3 exit 0 with no reply line |
+| 4 | F5 matches a substring | F5 labels (the trailing space) |
+| 5 | F6 skips the `--version` check | each F alone; F6 stub and path |
+| 6 | F8 skips the owner check | F8 0640, owner and symlink |
+| 7 | F11 ignores `discord/` | each F alone; F11 `*.json` |
+| 8 | P1 closes on any output | P unnamed; every P unnamed |
+| 9 | P5 maps to `closed` with jarvis in docker | P unnamed; every P unnamed; P2 and P5 names docker |
+| 10 | P9 drops the jarvis item | P unnamed; P9 per item |
+| 11 | P11 accepts any `Before=` | P unnamed; every P unnamed |
+| 12 | a P check's `unnamed` sets the exit to 1 | P unnamed; every P unnamed; P10 and P11; P2 and P5; P9 per item |
+
+Mutant 1 survived the F1 variants test (a failed unit, `User=root`), because those faults fail F1 on the
+unit's state and `User=`, not on the uid line. Each F alone covers the uid line.
+
+## Pre-slot read review
+
+Since every test run is slot work, a read-only subagent traced each case through the script before the
+first slot run, executing nothing. It found four defects, all fixed in this commit:
+- The `--claude` regex had no `@`, so every run refused the args file, the real .53 one included.
+- The fake `stat` logged the args-file call, so the bad-args test's "no command ran" check would fail.
+- The P5 and P6 faults each rewrote `etc/group` from the constant, so applying both lost P5's change.
+- F3 counted stderr into its line count, so a mutant dropping the exit check survived. F3 now counts
+  stdout only, and a `sent`-only case covers the line count.
+
+## Run environment
+
+The build commit ddf7dce6c sits on base 4ced5e63d (origin/refactor when it was pushed). It was first built
+on c515273db as 4a51d392c. Row 238 then changed `docs/TOOLS.md`, so I cherry-picked the three commits onto
+4ced5e63d as `darkwing/row195-b`. `git range-diff` shows all three identical. node v26.8.1 on dragon-lin,
+every run behind my busy check and Sage's, chained with `&&`.
+
+- Step 1, sage-1829 (07:41:54Z to 07:42:05Z), TMPDIR `/tmp/dw195`:
+  `node --test packages/cli/tests/case1-accept.test.mjs`, 22 pass, 0 fail, 11.0 s.
+- Step 2, sage-1865 (08:34:27Z to 08:36:21Z), TMPDIR `/mnt/storage/scratch/tmp/r195`: the twelve mutants
+  above, all killed.
+- Step 3, the gate (08:36:21Z to 08:47:06Z), same TMPDIR, `COMPOSE_PROJECT_NAME=darkwing-r195`:
+
+| Suite | Result |
+|---|---|
+| packages/cli (`node --test tests/*.test.mjs`) | 662 pass, 0 fail, 0 skipped |
+| test-auth.sh | 15 passed, 0 failed |
+| test-conductor.sh | 17 passed, 0 failed |
+| test-config.sh | 31 passed, 0 failed |
+| test-discord.sh | 78 passed, 0 failed |
+| test-extension-package.sh | 18 passed, 0 failed |
+| test-foundation.sh | 44 passed, 0 failed |
+| test-land-work.sh | 86 passed, 0 failed |
+| test-queue.sh | 156 node pass, 0 fail; 28 passed, 0 failed |
+| test-release.sh | 14 passed, 0 failed |
+| test-task.sh | 98 passed, 0 failed |
+
+Summed: 818 node tests passed with 0 failed, and 429 selftests passed with 0 failed. The compose network
+was removed afterwards, and the sweep found no process left in the worktree, the output directory or the
+TMPDIR. This file's results are a doc-only commit on top of the build, so nothing that ran has changed.
+
+## Correction to deviation 6 (follow-up, 2026-10-21)
+
+Deviation 6 says the node F9 runs is root's own. At 37171f65b the script didn't check that. F9 ran
+`--node` as root before F10's path check, so the header's "root itself only reads" was false
+(Duckworth's N1, `agents/duckworth/work/row195/REVIEW-m1.md` at 6afcee2a5). A host installed as designed
+was safe, because `case2-unit.sh` refused a non-root-owned `--node`. Row 245 carries the fix and its
+tests: `agents/darkwing/work/queue-245/BUILD.md`.
@@ -0,0 +1,388 @@
+# Row 195 design: the Case 1 install on 10.1.1.53 (r7)
+
+Darkwing, 2026-10-21. Brief: `docs/plans/2026-10-20_hub-own-uid.md`, blob 45be7f09afc1, section "Brief: the
+Case 1 install on 10.1.1.53 (row 195)". Gitea #1693. Reviewer Duckworth, gate owner Sage. Branch
+`darkwing/row195-r7` on c515273db. r6 (b7239bb66 on `darkwing/row195`, approved duckworth-0055) is the base,
+carried unchanged as 7398b7dd7. The r6 text is in that commit and in b7239bb66.
+
+## Changes from r6
+
+Q187 (mos-1108) made install and upgrade product commands, and mos-1118 split r6 into the installer rows
+(`docs/plans/2026-10-20_installer-rows.md`). That brief says row 195 "shrinks to the factory profile's
+values and the Case 1 acceptance". So r7 is mostly a cut. What r6 designed now ships elsewhere:
+
+| r6 piece | Now | State |
+|---|---|---|
+| `stack-release.sh --units external`: `confirm`, `revert`, `gate`, `rollback --to`, external `adopt` and `status`; `stack-copy.sh check --units external` and bundle copies | row 232, I1 | landed |
+| `case1-repin.sh` (A1-A5, A2f, R1-R4) | `scripts/stack-upgrade.sh`, row 233, I3 | landed |
+| the host steps 2a, 2a', 2a'' and the window's root steps | `docs/guides/host-run-sheet.md` sections 1-10, row 233 | landed |
+| `case1-hostcheck.sh`, `case1-pins.sh`, `mosaic-hostcheck.service` (the drift stop, r6 B2) | row 240, I4 | landed c515273db |
+| the unit render, `--profile factory`, `--pm`, `--claude`, the factory serve flags, the precheck | row 230, C2-13a, I2 | landed |
+| the install as `mosaic`: bootstrap, business file, copy | row 226, C2-13b, I2, `scripts/case2-install.sh` | assigned to Gosalyn, briefed, not started |
+| `docs/guides/case1-install.md` | the host run sheet, plus section 6 of this file | |
+
+Other changes:
+
+- Claude moves under `/opt` (sage-1522, run sheet section 3). `--claude` is
+  `/opt/mosaic-stack/claude-<pin>/node_modules/@anthropic-ai/claude-code/bin/claude.exe`, root's, and root
+  installs and upgrades it. r6's `/srv/mosaic/.local/bin/claude` is gone. F6 reads the new path.
+- The args file is `/etc/mosaic-stack/dev.args` (run sheet section 7), not `case1-unit.args`. It holds
+  `--copy` too, and `stack-upgrade.sh` rewrites only that line, after confirm passes.
+- Both units are `WantedBy=multi-user.target` and start at boot (Q189, mos-1122). r6's "the Console has no
+  `[Install]`, root starts it by hand after a reboot" no longer holds.
+- The business id is stated, with the DEFERRED 240 N1 reasoning (sage-1809, sage-1813). Section 7.
+- The window can't run until row 226 lands. Sage added 226 to row 195's after list at rev 2718
+  (sage-1813). Section 6 lists what row 195 needs from 226's install.
+- The acceptance runs as root through ops-01, not as `localadmin`. `aa-status`, `sudo -l -U`,
+  `systemd-run --uid` and the hostcheck all need root. It gains four functional checks for items the run
+  sheet marks "precheck line missing" (F8-F11) and one host line (P11). Section 5.
+- The Discord row in section 2 changed. The precheck's "no Discord binding" line is C2-13b's and is
+  library-only, so for the factory it's F11 in the acceptance.
+
+What row 195 still builds: `scripts/case1-accept.sh` and its test (section 5). The rest of this file is
+inputs, the window order and the record the reviewer checks.
+
+## 0. What I checked on the host
+
+Read only, as `localadmin` over ssh, 2026-10-20 between 20:40Z and 21:51Z. Nothing in r7 touched .53
+(sage-1809). The window's first step re-reads these, since they can drift in a day: unattended-upgrades
+runs daily.
+
+| Item | 10.1.1.53 on 2026-10-20 | Needed |
+|---|---|---|
+| OS | Ubuntu 24.04.5, kernel 6.8.0-124, x86_64, 12 cores, 94 GiB, 217 GiB free on `/` | fits |
+| `mosaic` user, group, `/srv/mosaic` | absent | run sheet section 1 |
+| node | `/usr/local/bin/node` v22.22.2, root-owned | 24 or later, under `/opt` (run sheet section 2) |
+| claude | not on localadmin's PATH | under `/opt` (run sheet section 3) |
+| bwrap | absent; apt candidate `bubblewrap 0.9.0-1ubuntu0.3` | run sheet section 4 |
+| user namespaces | `kernel.apparmor_restrict_unprivileged_userns = 1`, apparmor 4.0.1, no bwrap profile loaded | run sheet section 4 |
+| profiles that name bwrap | none (`grep -rlw bwrap /etc/apparmor.d` exits 1) | hostcheck item 3 |
+| `fs.protected_hardlinks` | 1 | hostcheck item 6 |
+| `net.ipv4.ip_unprivileged_port_start` | 1024 | run sheet section 5 |
+| listeners below 1024 | 22 (sshd) and 53 (the resolver); 732 is free | the Console's port |
+| ports 7330-7333 | free | 7333 is the tester port |
+| `localadmin` | NOPASSWD sudo (#423 step 1, mos-1066, mos-1077) | ops-01's root path |
+| `jarvis` | groups sudo, docker, lxd, adm | #423 step 4 removes them (P5) |
+| unattended-upgrades | on, with the security pocket, which carries bubblewrap | the drift stop (row 240) |
+| journald | `SplitMode=uid` | the PM check reads `launches list`, not the journal (row 232) |
+
+## 1. The factory profile's values
+
+Instance `dev`, row 190's default (mos-1118 choice 4). `~` is `mosaic`'s home.
+
+| Input | Value | Who gives it |
+|---|---|---|
+| user | `mosaic`, primary group `mosaic` with no other member | fixed |
+| home | `/srv/mosaic`, 0700 | fixed |
+| config dir | `/srv/mosaic/.config/mosaic-dev` | row 190 |
+| data root | `/srv/mosaic/.mosaic-dev`, marker `{"instanceVersion":1,"name":"dev"}` | row 190 |
+| business | `mosaic-stack`, file `<configDir>/businesses/mosaic-stack.json` | fixed (section 7) |
+| profile | `factory` for `case2-install.sh`, `case2-unit.sh` and `case2-precheck.sh` | fixed |
+| roles | the factory set from `roles/`, with a chief that has a harness var | the go names the set (section 2) |
+| human id | Jason's, not `tester` (`broker.mjs:321`) | the go |
+| model credential | `<configDir>/secrets/claude-session.env`, `mosaic` 0600, one line `CLAUDE_CODE_OAUTH_TOKEN=...` | Jason places it (section 3) |
+| token slot path | none | section 2 |
+| node | `/opt/mosaic-stack/node-<v>/bin/node`, `<v>` 24 or later | the go names `<v>` and its sha256 |
+| claude | `/opt/mosaic-stack/claude-<pin>/node_modules/@anthropic-ai/claude-code/bin/claude.exe`, `<pin>` 2.1.304 unless the go names a newer one | the go |
+| PM | on (`--pm`) | fixed |
+| Console | `--port 732` on 127.0.0.1, with the unit's `CAP_NET_BIND_SERVICE` | fixed |
+| tester | `--tester-port 7333` on 127.0.0.1 (P10) | fixed |
+| board | none | fixed |
+| release | a git bundle of `refs/heads/refactor` and the 40-hex commit (run sheet section 6) | the go names both and the bundle's sha256 |
+
+The args file. `/etc/mosaic-stack/dev.args`, `root:root` 0644, one argument per line (run sheet section 7):
+
+```
+--profile
+factory
+--user
+mosaic
+--home
+/srv/mosaic
+--business
+mosaic-stack
+--copy
+<40-hex commit>
+--node
+/opt/mosaic-stack/node-<v>/bin/node
+--claude
+/opt/mosaic-stack/claude-<pin>/node_modules/@anthropic-ai/claude-code/bin/claude.exe
+--pm
+--
+--port
+732
+--business
+mosaic-stack
+--tester-port
+7333
+```
+
+`case2-unit.sh` takes exactly these before `--` (`scripts/case2-unit.sh:54`), and `stack-upgrade.sh`
+refuses `args-unreadable` on anything else (`scripts/stack-upgrade.sh:126-148`). The factory profile
+refuses the preview trio, `--send` and the proof pair (`case2-unit.sh:169`). .53 has no proxy, and Jason
+reaches the Console with `ssh -L` (sage-1451 Q3). Changing a serve flag is a re-install with its own go,
+not an upgrade.
+
+Why the port is 732 (r6, mos-1101 item 5). Role sessions share the host's network namespace
+(`packages/seat/src/sandbox.mjs:67`), so while the Console is down a session could bind a port above the
+floor and answer in its place. Below 1024 only the Console unit can bind, through its capability. The
+tester port can't go below 1024 (`packages/webui/src/cli.mjs:33`), so P10 records it.
+
+PATH for `mosaic`'s steps. `sudo -u mosaic -H` resets PATH to sudo's `secure_path`, which finds
+`/usr/local/bin/node`, v22. So every `mosaic` step runs as
+`sudo -u mosaic -H env PATH=/opt/mosaic-stack/node-<v>/bin:/usr/local/bin:/usr/bin:/bin ...`, the list
+`case2-unit.sh` renders as the units' PATH. `stack-upgrade.sh` builds it from the args file's `--node`.
+
+## 2. Where Case 1 differs from Case 2
+
+| Case 2 (library) | Case 1 (factory) | Reason |
+|---|---|---|
+| business file with the library mapping | `mosaic-stack` with no `library` key. The precheck refuses a library project under `factory` (`profile-library-business`, `case2-precheck.sh:127-128`) | the factory has no books repo |
+| `bean`, `chet`, persona vars and files, specialists | the factory roles from `roles/`, with a chief that has a harness var | the go names the set. I haven't read Jason's live business file and won't. The acceptance needs only the chief (F3); a chief with no harness var answers `no-route`. The human adds roles later with `instances.set`, no new row |
+| token slot `library-gitea` | none | the factory's per-agent git identity is row 199's credential store (Megavolt, #1697). Until it lands, git work stays on dragon-lin (Q182) |
+| `bus.tester` off | on; the precheck refuses it off under `factory` (`case2-precheck.sh:135`) | the acceptance and the Q173 test system need the tester |
+| persona modes and digests, `library.sync`, `library.status` | skipped | no persona files, no library (C2-13b brief, `factory` profile) |
+| `ZAI_API_KEY` in `claude-session.env` | not checked; the file holds `CLAUDE_CODE_OAUTH_TOKEN` | no instance has provider `zai` (run sheet section 9) |
+| no Discord binding (C2-13b, library only) | none either. F11 checks that `<dataRoot>/discord/` holds no binding | the factory's connector stays on dragon-lin. Two connectors on one bot token would split its events |
+| the claude marker prompt | runs, since the chief's harness is claude-code | |
+| serve flags: preview trio, `--send`, proof pair | `--port 732`, `--business mosaic-stack`, `--tester-port 7333` | no proxy on .53 |
+| bus: no `--pm`, no `MOSAIC_CLAUDE_BIN` | `--pm`, and `Environment=MOSAIC_CLAUDE_BIN=<--claude>` | the PM dispatches the factory's work; without the path the bus finds no claude on the unit's PATH |
+| Console proof file (run sheet section 9, .54) | none | no proof pair |
+
+All of these are inputs to the landed scripts. Row 230 implemented the four factory items r6 asked for
+(serve flags, `--pm`, `--claude`, row 190's tokens), and nothing in them hardcodes a Case 1 value.
+
+## 3. Model access
+
+Q185: Case 1 uses the account the factory uses today, the Claude subscription behind dragon-lin's
+`claude-session.env`. No script copies that file and none reads its value. In the window, Jason, or the
+person he names under the Q173 secrets rule, makes a credential for .53 from that account and writes it
+to `/srv/mosaic/.config/mosaic-dev/secrets/claude-session.env` as `mosaic`, mode 0600 (run sheet
+section 9). Nobody prints it. The check is `stat -c '%U %a %F' PATH` only (F8).
+
+The bus unit reads it through `EnvironmentFile=-` (`case2-unit.sh:243`). The leading `-` means a missing
+file doesn't stop the bus, so the chief's first launch would fail instead. The window places the file
+before the units start (section 6, W9), and the precheck's claude marker prompt then proves it works
+without printing it.
+
+Quota: the factory on dragon-lin and on .53 share one subscription. Q185's "use existing" accepts that.
+The pi harness stays off on .53 until P19 #383 settles (mos-0865). The business file names claude only.
+
+## 4. Upgrade, rollback and backup on .53
+
+All three are `scripts/stack-upgrade.sh` (row 233), run as root by ops-01 from `/root/mosaic-stack` at the
+reviewed commit. Usage, exits and the step log are in `docs/TOOLS.md`, "Root's upgrade driver", and run
+sheet section 6.
+
+| Action | Command | Who | Go |
+|---|---|---|---|
+| upgrade | `stack-upgrade.sh upgrade --instance dev --bundle /srv/mosaic/incoming/<sha>.bundle --sha <sha>` after run sheet section 6's per-upgrade lines | ops-01 | Mos per run; `--migrate` also needs Jason present (decision 96) |
+| rollback | `stack-upgrade.sh rollback --instance dev --to <copy> [--restore <ACT> [--events N]]` | ops-01 | Mos per run. Mos or Sage picks `<copy>` from `stack-release.sh status mosaic-stack --units external`, read as `mosaic`. The plan refuses unless it is the previous distinct copy |
+| backup of the store | A3's `backup_store` into `<dataRoot>/backups/stack/<ACT>`, inside every upgrade | the driver | the upgrade's |
+| rehearsal | `stack-release.sh rehearse` against the log's newest backup, before anything stops, on `--rehearse-port`, default 7339, which section 0 found free | the driver | the upgrade's |
+| backup of the VM | a PBS backup of VM 1008 before the install window and before any `--migrate` | ops-01 | the window's go (Q182, Q183: agents keep PBS) |
+
+Three .53 specifics:
+
+1. The first upgrade after install needs `--no-rehearsal` in its go. The install's adopt takes no backup,
+   so the log records none, the rehearsal exits 3 (`no-backup`), and the driver goes on only with the
+   flag (`stack-upgrade.sh:323-324`). Every later upgrade refuses the flag (`rehearsal-required`).
+2. Exit 5 (`args-failed`): the new stack is live and confirmed, but `dev.args` still names the old copy.
+   ops-01 moves the file the result line names into place with `mv -f`, and nothing else (run sheet
+   section 6).
+3. Exit 2 leaves both units stopped and the activation open. ops-01 sends Mos the exit and the last
+   lines of `/var/log/mosaic-stack/upgrade-dev.log`, and Jason or Mos settles it with `confirm` or `revert`
+   as on dragon-lin. A unit that doesn't stop within `--timeout` ends here on purpose (A2f's
+   `stale-start`, duckworth-0055 N1, now in run sheet section 6).
+
+The store backup doesn't hold the config dir or the credential. PBS backups of VM 1008 hold the whole disk,
+the credential included (P4). A restore swaps only the store and leaves `claude-session.env` in place.
+
+Re-install, for a serve flag or role change, is not an upgrade. It needs its own go and runs: stop the
+Console, then the bus; rewrite `dev.args` with the same `--copy`; `case2-unit.sh` with it; both units start
+again from the render. Row 230 N1 (webby-0046) holds here: a re-render with the units running leaves each on
+its old copy, so ops-01 stops both first. `stack-upgrade.sh` already stops both before it renders.
+
+## 5. Acceptance: `scripts/case1-accept.sh`
+
+New in this row. ops-01 runs it as root on .53, from `/root/mosaic-stack`:
+
+```
+case1-accept.sh --business mosaic-stack --args /etc/mosaic-stack/dev.args --claude-pin <pin> --node-pin <v>
+```
+
+It reads the user, home, node, claude and ports from the args file and refuses (exit 2) when that file
+fails `stack-upgrade.sh`'s rules. Every check inside the instance runs as
+`sudo -u mosaic -H env PATH=<node dir>:/usr/local/bin:/usr/bin:/bin`. It changes nothing on the host
+except what F3's message writes to the store. It prints one line per check, `<id> <path> <mark>
+<evidence>`, then a count of each mark. Marks: `closed`, `accepted Q182`, `accepted Q183`, `accepted
+mos-1096`, `accepted mos-1101`, and `unnamed`, which means "not named in Q182, Q183 or a Mos ruling".
+It exits 1 when any F check fails and 0 otherwise. A P check never changes the exit. Each `unnamed`
+line goes to Mos, who takes it to Jason (R8 N1). Duckworth reads the whole output.
+
+It prints no value from `claude-session.env` and never opens it.
+
+Functional checks. Any failure fails the row:
+
+| Id | Check | How |
+|---|---|---|
+| F1 | the units run as `mosaic` | for `[email protected]` and `mosaic-webui.service`: active, `User=mosaic`, and the uid in `/proc/<MainPID>/status` is `mosaic`'s |
+| F2 | the Console answers on 127.0.0.1:732 only | `curl -fsS http://127.0.0.1:732/healthz` succeeds, and `ss -Hltnp` shows 732 bound to 127.0.0.1 only, by the Console's MainPID. Jason reaches it with `ssh -L 7332:127.0.0.1:732 [email protected]`. A LAN listener waits for Q175 SSO (sage-1451 Q3) |
+| F3 | one tester message gets a reply | as `mosaic`: `mosaic talk chief <marker> --business mosaic-stack --tester --wait 300`. A stored reply to the marked message passes. The inbox shows decisions only, so it isn't used |
+| F4 | the precheck passes | `case2-precheck.sh --business mosaic-stack --profile factory` as `mosaic` exits 0 |
+| F5 | a role session runs under bwrap with the profile | while F3's reply is pending: a `/usr/bin/bwrap` process owned by `mosaic` has a claude child. Its `/proc/<pid>/attr/current` equals `bwrap (enforce)` and the child's equals `bwrap//&unpriv_bwrap (enforce)`, exact strings after the trailing newline is cut |
+| F6 | claude is the pin | the args file's `--claude` path sits under `/opt/mosaic-stack/claude-<pin>/`, and its `--version` as `mosaic` prints `<pin> (Claude Code)` |
+| F7 | the PM run is live | `launches list --json` as `mosaic` has exactly one live entry for the PM's instance (`launch.by`), the check `confirm` runs |
+| F8 | the credential's file | `stat -c '%U %a %F'` on `claude-session.env` reads `mosaic 600 regular file`, and it isn't a symlink. Run sheet section 9 marks this "precheck line missing" |
+| F9 | the autoupdater is off | `/etc/claude-code/managed-settings.json` is `root:root` 0644 and its `env.DISABLE_AUTOUPDATER` is `"1"`. Run sheet section 3 marks this "precheck line missing" |
+| F10 | node is the pin | the args file's `--node` is `/opt/mosaic-stack/node-<v>/bin/node` with `<v>` the `--node-pin`, and its `--version` prints `<v>`. Run sheet section 2 marks this "precheck line missing" |
+| F11 | no Discord binding | `/srv/mosaic/.mosaic-dev/discord/` is absent or holds no `*.json` (section 2) |
+
+Host paths. These report and never fail the row:
+
+| Id | Path | Mark | Evidence |
+|---|---|---|---|
+| P1 | `mosaic` has sudo | closed only when `sudo -l -U mosaic` prints "is not allowed to run sudo"; any other output is unnamed | the `sudo -l` result |
+| P2 | `mosaic` has supplementary groups or a key | closed when `id -G mosaic` is one entry and `~mosaic/.ssh/authorized_keys` is absent or empty | `id`, file state |
+| P3 | `localadmin` NOPASSWD sudo, reached with the dragon-lin key | accepted Q183 | `sudo -l -U localadmin` |
+| P4 | root on pve over VM 1008, and PBS backups that hold `/srv/mosaic` with the credential | accepted Q182 and Q183 | a fixed line; the script can't see pve |
+| P5 | `jarvis`, which runs Hermes, reaches `/srv/mosaic` through sudo, docker or lxd | closed when `jarvis` is in none of the three; unnamed otherwise. #423 step 4 removes all four groups before the install (mos-1091 4c) | `id jarvis` |
+| P6 | other members of sudo, docker, lxd | closed when sudo holds only `localadmin` and docker and lxd are empty; each other member is its own unnamed line | `getent group` lines |
+| P7 | a file under `/etc/sudoers.d` naming `mosaic` | closed when none | file names |
+| P8 | the Console or tester reachable from the LAN | closed when 732 and 7333 are bound to 127.0.0.1 only, each by the Console's MainPID, and nothing listens on 7331 | listener table |
+| P9 | a user namespace through `/usr/bin/bwrap` | accepted mos-1096 only while all eight hold, unnamed otherwise: hostcheck items 1 to 6, read from `/usr/local/lib/mosaic-stack/hostcheck.sh --check`'s own `ok N` lines (item 7 is P10's floor); `sudo -u jarvis /usr/bin/bwrap --version` fails with "Permission denied"; `getent group mosaic` lists no member and no other account has its gid. F5 adds the label of a real role session | the hostcheck lines and each item |
+| P10 | a session binds the tester port 7333 while the Console is down | accepted mos-1101 while the port floor is above 732 and 7333 is held by the Console's MainPID | the floor, the owner pid |
+| P11 | the boot check runs before the bus | closed when `mosaic-hostcheck.service` is enabled and `systemctl show -p Before` on it names `mosaic-bus@<business>.service` for the args file's business; unnamed otherwise (section 7) | the `Before=` value |
+
+P9 reads hostcheck's output, which root's own script prints, by matching `^ok [1-6] ` lines. It runs `--check` only,
+never `--enforce`, so the acceptance can't close bwrap.
+
+Tests, in `packages/cli/tests/case1-accept.test.mjs`. The script takes a test seam, `--root DIR`, for
+`/proc`, `/etc`, `/srv/mosaic` and `getent`, and refuses it when run as root, as the hostcheck does. Fake
+`systemctl`, `curl`, `ss`, `sudo`, `bwrap`, `sysctl`, `stat`, `claude`, `node` and `hostcheck.sh` on PATH.
+Nothing reaches .53 or dragon-lin's live state, and no test reads a real credential. Cases:
+- every check passing exits 0, with the counts matching the lines;
+- each F check failing alone exits 1 with its line;
+- F5 fails on `unpriv_bwrap (enforce)`, `bwrap//&unpriv_bwrap (complain)` and a trailing space;
+- F6 fails on a stub `claude.exe` that prints nothing and on a path outside `claude-<pin>`;
+- F8 fails on mode 0640, on another owner and on a symlink, and the stand-in credential's value never
+  appears in the output;
+- F11 fails on one `*.json` under `discord/`;
+- each P check in each of its marks: P1 with output that grants nothing but lacks the refusal text
+  (unnamed), P9 unnamed once for each item missing, P10 unnamed with the floor at 700 and with 7333 held
+  by another pid, P11 unnamed with `Before=` naming another business;
+- every P check `unnamed` still exits 0;
+- a bad args file refuses with exit 2 before any check;
+- every in-instance call goes through `sudo -u mosaic -H env PATH=<node dir>:...`, read from the fake
+  `sudo`'s recorded argv;
+- the hostcheck fake records `--check` and never `--enforce`.
+
+Mutants, each killed by a named case:
+1. F1 passes on a MainPID owned by root.
+2. F2 accepts a listener on 0.0.0.0.
+3. F3 passes without a reply.
+4. F5 matches a substring.
+5. F6 skips the `--version` check.
+6. F8 skips the owner check.
+7. F11 ignores `discord/`.
+8. P1 closes on any output.
+9. P5 maps to `closed` with `jarvis` in docker.
+10. P9 drops the jarvis item.
+11. P11 accepts any `Before=`.
+12. A P check's `unnamed` sets the exit to 1.
+
+## 6. The .53 window
+
+Nothing in this row touches .53 (sage-1809). Every root step below is ops-01's, over
+`ssh [email protected]` with `sudo`, and waits on a Jason decision (mos-1086). The window needs:
+- row 226 landed;
+- Jason's or Mos's go naming the commit, the bundle's sha256, the node and claude pins, the role set and
+  Jason's human id;
+- a backup first;
+- a STATE report after.
+
+| # | Step | Runs as | Source |
+|---|---|---|---|
+| W0 | re-read section 0's items; stop on any change and report it | `localadmin`, read only | section 0 |
+| W1 | PBS backup of VM 1008 | ops-01 on pve | section 4 |
+| W2 | the stack's user and home | root | run sheet 1 |
+| W3 | node under `/opt` | root | run sheet 2 |
+| W4 | claude under `/opt`, managed settings | root | run sheet 3 |
+| W5 | bubblewrap, the profile, the statoverride, the no-new-privs test, the drift stop; `hostcheck.sh --check` exits 0 with item 7 at 1023 | root | run sheet 4 |
+| W6 | the port floor (read) | root | run sheet 5 |
+| W7 | the bundle, root's checkout at `<sha>`, `mosaic`'s clone | root, then `sudo -u mosaic -H` | run sheet 6 |
+| W8 | `case2-install.sh --profile factory` with section 1's inputs: bootstrap, the business file, roles, human id, the copy | `sudo -u mosaic -H env PATH=...` | row 226 |
+| W9 | place `claude-session.env` | Jason, or who he names | run sheet 9, section 3 |
+| W10 | write `dev.args` (section 1); `case2-unit.sh` from it, which enables both units and starts the bus, then the Console | root | run sheet 7, 10 |
+| W11 | `case2-precheck.sh --business mosaic-stack --profile factory` exits 0; `hostcheck.sh --check` exits 0 with item 7 at 732 | `mosaic`; root | row 230, 240 |
+| W12 | `stack-release.sh adopt mosaic-stack --units external`, unless row 226's install does it | `sudo -u mosaic -H` | row 232 |
+| W13 | `case1-accept.sh` (section 5); the output to Duckworth, then Mos confirms | root | this row |
+| W14 | STATE report to Mos | ops-01 | brief |
+
+Install rollback, any step before W13 passes. Stop and disable both units, remove their files and
+`dev.args`, then the run sheet's rollbacks for sections 4, 3 and 2 in that order. Removing the user and
+home (`userdel -r mosaic`) needs its own Mos go, since it deletes the home. W1's backup covers the rest.
+
+What row 195 needs from row 226. Row 226 is assigned to Gosalyn, briefed and not started, so I'm listing what the window
+needs from its design, not designing it:
+
+1. `--profile factory` writes the business file with `bus.tester` on and no `library` key, and the roles
+   the go names.
+2. It writes no token slot and no persona files (its brief says so).
+3. It runs before the unit render, since the copy must exist for `case2-unit.sh --copy`, and it starts no
+   unit.
+4. Who writes `dev.args`. The C2-13b brief says the install doesn't write unit files, and the run sheet
+   says "I2's install writes it". `mosaic` can't write `/etc/mosaic-stack`. So either root's part of I2
+   writes it, or ops-01 writes it from section 1 at W10. Either works for row 195. The file's content is
+   fixed above.
+5. Whether it runs `adopt`. If it doesn't, W12 does.
+
+I sent these to Gosalyn on 2026-10-21 (gosalyn-0085 acknowledged), and the run sheet takes whichever answer 226 gives.
+
+## 7. The business id
+
+.53's business id is `mosaic-stack` (sage-1813). It appears in:
+- the args file, twice;
+- the bus unit `[email protected]`;
+- the business file name;
+- `case1-accept.sh --business`.
+
+The landed boot unit `packages/cli/systemd/mosaic-hostcheck.service` has
+`[email protected]`. So at boot the drift stop runs before .53's bus, and DEFERRED 240
+N1 (da3051ccc: `After=mosaic-hostcheck.service` in `mosaic-bus.service.in`) doesn't bind this row.
+
+If a go ever names another id for .53, the window stops before W8, and the N1 fix lands first as its own
+reviewed row. P11 is the check on the host. It reads `unnamed` when the boot unit's `Before=` doesn't
+name the installed bus.
+
+DEFERRED 240 N2 (the apt hook goes in before the first `--check`) is a run sheet order note. This row
+doesn't edit the run sheet, so it stays deferred.
+
+## 8. Rulings this design rests on
+
+- sage-1451: Q1 system units; Q3 the Console on 127.0.0.1 with `ssh -L`; Q4 a rebase goes to a new branch
+  name (#426(a), mos-1086).
+- mos-1091, mos-1096, mos-1098, mos-1101: the bwrap path, its profile and P9; the port squat and P10; .53
+  runs the PM. Their r6 sections stand, and rows 232, 233, 240 and 230 implemented them.
+- mos-1108 (Q187) and mos-1118: the installer rows and the scope cut. mos-1122 (Q189): both units start at
+  boot.
+- sage-1522: claude under `/opt`, root-owned.
+- sage-1809: no step on .53, root steps named and left to ops-01, the business id stated.
+- sage-1813: 226 in the after list (rev 2718); the id is `mosaic-stack` and 240 N1 doesn't apply.
+- Q185: the factory's model account. Q173: credentials placed by Jason or his named person.
+
+## 9. Manifest (planned)
+
+- `scripts/case1-accept.sh` (new), mode 100755.
+- `packages/cli/tests/case1-accept.test.mjs` (new). Section 5's cases and mutants.
+- `docs/TOOLS.md`: a `case1-accept.sh` entry with usage, marks and exits, beside the hostcheck entry.
+- `agents/darkwing/work/queue-195/BUILD.md` (new): run environment, the mutant results, deviations.
+- No change to `case2-*.sh`, `stack-upgrade.sh`, `stack-release.sh`, `case1-hostcheck.sh` or the run
+  sheet. Two follow-ups stay out of this row:
+  - row 230 r2 N1. The "still on copy" line reads the id from the unit file. On .53 neither the install
+    nor `stack-upgrade.sh` reaches that line, since both start from stopped units.
+  - DEFERRED 240 N2.
+- No change to `~/.mosaic-dev`, `~/.config/mosaic-dev`, dragon-lin's units or `~/.mosaic`.
+
+Gate: Duckworth approves this design, then the manifest; the cli suite and every `scripts/test-*.sh`
+green on Sage's gate; section 5's twelve mutants killed in a slot Sage grants.
@@ -0,0 +1,287 @@
+# Row 232 (I1): stack-release external units and bundle copies
+
+Brief: `docs/plans/2026-10-20_installer-rows.md` section I1, blob `f35e7e57daee` (commit ad6f0be7a). Gitea
+#1734, Vikunja P19 #432. Owner Darkwing, reviewer Filbert, gate owner Sage. Design input: row 195 DESIGN r6,
+`agents/darkwing/work/queue-195/DESIGN.md` at b7239bb66 (approved in duckworth-0055). Where the brief and
+r6 differ, the brief wins. sage-1561 ruled where the stack user's `stack-release.sh` runs: from its own
+clone of the release bundle, so `check_target`, the plan's commit list and status drift are unchanged and
+nothing adds `safe.directory`.
+
+## Files
+
+Base: cb5fdb064 (row 199's landing, on top of row 200's 9e1085816). Branch `darkwing/row232-r1`. The first
+build, 0af0c73c6 on `darkwing/row232`, sat on 00d4cc1f6 (row 190); row 200 landed first, so this one is
+rebased onto it (see D9 and D10).
+
+- `scripts/stack-release.sh`: `--units user|external`, the `sc` and `jctl` backend, `confirm`, `revert`,
+  `gate --since`, `rollback --to`, `--plan --expect-from`, the external gate (start floor, PM check from
+  `launches list`), `external-pm`, and the `awaiting units:` status line.
+- `scripts/stack-copy.sh`: `check --units external`, `copy --bundle FILE SHA`, `wrapper ID --create`.
+- `packages/cli/tests/stack-release-external.test.mjs` (new, 25 tests).
+- `packages/cli/tests/stack-release-fixture.mjs` (new): the helpers `stack-release.test.mjs` defined, moved
+  so both files share them. See deviation D1.
+- `packages/cli/tests/stack-release.test.mjs`: the helpers leave and one import line comes in. The 74 tests
+  have the same names and the same bodies as on the base.
+- `packages/cli/tests/stack-copy.test.mjs`: three new `row 232:` tests and a wider `node:fs` import.
+- `docs/TOOLS.md`: the stack-copy usage block and three paragraphs, the stack-release usage block, and a new
+  subsection "Root-owned units (`--units external`, row 232)".
+- `packages/cli/README.md`: one paragraph.
+- This file.
+
+The worktree's `node_modules` symlink is not part of the candidate.
+
+## User mode is unchanged
+
+Every `systemctl` call goes through `sc` and every `journalctl` call through `jctl`. Under `user` they
+are `systemctl --user "$@"` and `journalctl --user "$@"`. Under `external`, `sc` allows only `show`,
+`is-active` and `list-units`, and `jctl` returns 1, so an external run can't start, stop, install or read
+the journal even through a path the tests miss.
+
+Two tests hold the brief's "every command line and every byte of output":
+
+- `user mode: every systemctl call carries --user, and activate, rollback and check make the base's
+  calls`. A fixture repo gets the base's two scripts from `git show cb5fdb064:`. The same activate,
+  rollback and `stack-copy.sh check` run from both trees, and the recorded argv (with the fixture root and
+  port replaced by placeholders) must match line for line. Every call carries `--user`.
+- `user mode: a default activate --plan prints the base's bytes`, for four plans.
+
+The base output is produced live from the base blobs, not stored as a fixture file. See deviation D3.
+
+## r6 section 7, test by test
+
+All in `stack-release-external.test.mjs` unless named.
+
+| r6 :742-812 item | Test |
+|---|---|
+| `units-running` (N4), store, log and TAKEN left | `units-running (N4) refuses while a unit is active...`; also checks that `failed` counts as down and that the Console is checked first |
+| activate leaves the pointer, writes `AWAITING-UNITS` and a backup | `activate stages: ...`, which also checks the set's file list, `UNITS.sha256`, no `--user`, no journal call and `status` |
+| `open-activation` with zero, two, the wrong copy, one not open | `confirm and revert refuse open-activation ...` |
+| `confirm` polls: 3 s fails at `--timeout 1`, passes at `--timeout 10` | `confirm polls: bus status good after 3 s fails ...` and `confirm polls to a pass ...` |
+| `stale-start` floor with `started` at .900 | `stale-start: @1792540799 fails ...` and `stale-start is a gate code ...` |
+| `confirm` pass writes pointer, ok, removes marker; timeout writes `FAILED` and exits 1 | the two polling tests |
+| `activation-failed` when `FAILED` exists | `confirm polls: ... FAILED then refuses activation-failed` |
+| lines carry the started op, from, to, activation and backup | `sameAsStarted` in every confirm test, and sequence 7 |
+| `gate` (N2) with and without `--since` | `gate (N2, A2f): ...` and the usage test |
+| `--plan --expect-from` (N5), activate and `rollback --to` | sequence 7 |
+| A3 order: capture-failed, marker-failed, wrapper failure after migrate | `A3 order: ...` and sequence 2 |
+| refusals log no activation; `interrupted` unchanged | `open-activation` test and sequence 5 |
+| PM check: one, none, two, early, not live, other business, other instance; no journal call | `the external PM check reads launches list ...` (modes '', coder, none, twolive, early, dead, other) and `journalCalls` in every external test |
+| `external-pm` | `pm-on and activate --pm-after-harness refuse external-pm` |
+| `revert` restores TAKEN only after a migration | `revert puts the wrapper back and leaves the store ...` and sequences 2 and 8 |
+| `confirm --rollback` per cause, `unrecorded`, `rollback-failed`, mismatch | sequences 1, 2, 3, 5 and 8, and `confirm --rollback refuses rollback-mismatch, and logs rollback-failed ...` |
+| sequences 1-8 | `sequence 1:` to `sequence 8:`, each ending with the `closed` check (one started and one result line, empty `interrupted`, no marker or `FAILED`, a following `--plan` that doesn't refuse `interrupted-run`) |
+| `rollback --to` refuses not-previous; `rollback --restore` finds an external backup | sequence 7, and `confirm --rollback after a --restore swap ...` |
+| `gate` writes nothing | the `gate (N2, A2f)` test and sequence 4 compare the log, the pointer and the state tree |
+| `confirm`, `revert`, `gate`, `--to` refuse without `--units external` | `confirm, revert, gate, --to and --expect-from need --units external ...` |
+| default path: every call carries `--user`; default `--plan` bytes | the two user-mode tests above |
+
+The brief's additions, in `stack-copy.test.mjs`:
+
+- `row 232: copy --bundle copies a SHA the bundle's refactor reaches, byte-identical to copy SHA, and
+  refuses the rest`: a short SHA, a missing file, a symlink, a bundle that fails `git bundle verify`, a
+  bundle with no `refs/heads/refactor`, a SHA not in the bundle, and a SHA the bundle carries on another
+  branch that refactor doesn't reach. The bundle copy's tree matches `copy SHA`'s byte for byte, and the
+  `release:` and `bundle sha256:` lines are checked.
+- `row 232: wrapper --create writes the first wrapper only, the same bytes wrapper ID writes, and refuses
+  over any file`, a symlink included. Without `--create` a missing wrapper still refuses.
+- `row 232: check --units external reads the system units, the default reads the user units`.
+
+## Mutants
+
+`mutants.sh` in my scratch (not committed, it edits the worktree), 17 mutants: r6's re-pin list (:817-838)
+minus the three `case1-repin.sh` ones, plus the brief's two. Each one applies exact replacements after a
+checked backup, runs `bash -n`, runs its named killers, restores the file and checks its sha256. Two
+controls run first with no change: the whole external file, and stack-copy's `row 232:` tests.
+
+| Mutant | Killers |
+|---|---|
+| m01 `confirm` writes the pointer on a gate failure | `confirm polls: bus status` |
+| m02 `gate_once` in place of `gate` | `confirm polls to a pass`, `stale-start is a gate code` |
+| m03 PM check counts any instance | `external PM check` |
+| m04 PM check drops the `startedAt` bound | `external PM check` |
+| m05 `confirm` takes the newest `AWAITING-UNITS` | `open-activation` |
+| m06 `rollback --to` skips the comparison | `sequence 7:` |
+| m07 the default path drops `--user` from one call (`is-active`) | `user mode: every systemctl` |
+| m08 the timeout writes r4's interim `rollback pending` line | `confirm polls: bus status`, `sequence 1:`, `sequence 5:` |
+| m09 `AWAITING-UNITS` last, after the wrapper | `sequence 2:` |
+| m10 a refusal names the open activation | `sequence 5:`, `open-activation` |
+| m11 `stale-start` is a refusal | `stale-start is a gate code` |
+| m12 `revert` restores without `MIGRATING` | `revert puts the wrapper back` |
+| m13 `confirm` logs op `confirm` | `sequence 7:`, `confirm polls to a pass` |
+| m14 `MIGRATING` after the migration | `sequence 8:` |
+| m15 `gate` takes its floor from the log without `--since` | `gate (N2` |
+| m16 `copy --bundle` skips the reachability check | stack-copy `row 232:` |
+| m17 `wrapper --create` overwrites | stack-copy `row 232:` |
+
+## Deviations and choices
+
+D1. The shared helpers moved to a new file, `packages/cli/tests/stack-release-fixture.mjs`. The brief's
+files list names `stack-release.test.mjs` "where a shared helper moves" but not a destination. Importing
+from the other test file would run its 74 tests twice, so the helpers need a module of their own.
+
+D2. The fixture's T17 check (what a run may never remove) now exempts a rollback set's `AWAITING-UNITS` and
+`FAILED`. `confirm` removes both when it closes the activation (r6 A5 and R4). User mode writes neither, so
+user-mode runs check exactly what they did.
+
+D3. The user-mode argv and `--plan` tests read the base's scripts with `git show cb5fdb064:` rather than
+storing their output as a fixture file. A later row that changes user-mode output on purpose moves the
+`BASE` constant in the test to its own base, or the test fails. I chose this over a stored fixture because
+a stored copy can drift from the base without anyone noticing.
+
+D4. `marker-failed` is reached by making `state/stack-rollback` unwritable. r6 says "an existing `$RS`", but
+`next_activation` never picks a taken name, so no test can make the run meet an existing `$RS`. The
+exclusive `mkdir` is still what refuses.
+
+D5. The stale-start polling case turns the enter time to `@1792540800`, not r6's `@1792540805`, with the
+started line at 1792540800.900. That also checks that the floor is the whole second, so .900 doesn't push it
+to 1792540801.
+
+D6. No fake `sudo` or `case2-unit.sh`. r6's sequences ran under them because r6 had `case1-repin.sh` drive
+the steps, and that script is I3's. Here the test plays root: it stops and starts the fake system units and
+installs with the existing `bus-service.sh` and `webui-service.sh` stand-ins, between the real
+`stack-release.sh` calls, on one log.
+
+D7. The fake marker in the `open-activation` test is named `20000101T000000Z-<C1 prefix>` so it sorts
+before the real one. A marker that sorted after it would leave m05 (newest marker) alive.
+
+D8. m10 sets `ACT` inside `open_activation`, where r6's wording ("ACT set before the checks") lands in this
+code. `ACT` is set only after every check in `confirm`.
+
+D9. Row 200's `--sso` is a usage error under `--units external`, with the proof flags, `--no-proof` and
+`--no-send`. It is a Console flag, and root's Console unit carries the Console flags; the script under
+external renders no Console line and never calls `console_for_target`, so `sso_checks` doesn't run there
+either. The usage text, the TOOLS.md bullet and the external usage test name it.
+
+D10. Row 200's `config_checks` runs under `--units external` too, after `plugin_checks`, in both the
+`--plan` and run paths of `activate` and `rollback --to`. It checks the target's loader against the stack
+user's `config.json`, which the bus on a VM still reads, so a `console` key the target refuses would break
+root's bus start the same way. The cost is one more refusal (`config-console-key`) an external run can
+print; I took it over a bus that fails after root's start. The rebase changed no user-mode line: the
+conflicts were the `SSO=0` globals line, the `plan` body (row 200's `SSO_PLAN` line sits in the user
+branch) and the two `--plan` lines that gained `config_checks`. In the tests, row 200's fixture lines
+(the loaders, `sso-config.mjs` and the `--sso` cli.mjs line for C1 and C) moved into
+`stack-release-fixture.mjs` with the rest of the copy setup, and the `ALGS` import stays in
+`stack-release.test.mjs`, which T57 uses.
+
+## duckworth-0055's notes on r6 (brief line 169)
+
+Duckworth's r6 approval (REVIEW-r5.md at 23f5520b5) carried two notes.
+
+- N1, A2's stop timeout under `gate --since`. A unit that never stopped keeps its old `ActiveEnterTimestamp`,
+  so `gate --since` fails it with `stale-start`, and the run ends at exit 2 with root stopping the units.
+  That is intended: a unit that won't stop is a fair reason to stop. In I1 this is the gate code and its
+  polling (`stale-start: @1792540799 fails ...`, `gate (N2, A2f)`, m11). The run sheet's A2f line and the
+  re-pin test that points "exits 1 with OLD's gate passing" at an A3 exit 3 belong to I3, which owns
+  `scripts/stack-upgrade.sh` and `docs/guides/host-run-sheet.md`. I'll name both in the I3 build.
+- N2, the claude path under `/opt/mosaic-stack` (gosalyn-0058, sage-1522). I1 doesn't touch it. Under
+  `--units external` the script checks no claude pin of its own (`no-claude-pin` applies only to user
+  mode), because root's unit carries it. The `--claude` value, the managed-settings reasoning, F6 and the
+  run sheet's claude step go to I2 and I3.
+
+## Run environment
+
+Worktree `/mnt/storage/scratch/darkwing-r232`, `TMPDIR=/mnt/storage/scratch/tmp/r232`, node from PATH.
+One external file run takes about 94 s.
+
+## Results
+
+Singles on the rebased candidate, before the gate:
+
+| File | Tests | Pass | Fail |
+|---|---|---|---|
+| `packages/cli/tests/stack-release-external.test.mjs` | 25 | 25 | 0 |
+| `packages/cli/tests/stack-copy.test.mjs` | 16 | 16 | 0 |
+| `packages/cli/tests/stack-release.test.mjs` (row 200's T57 included) | 192 | 192 | 0 |
+| `packages/cli/tests/stack-instances.test.mjs` | 23 | 23 | 0 |
+| `packages/webui/tests/pinned-copy.test.mjs` | 10 | 10 | 0 |
+| `packages/cli/tests/channel-recovery.test.mjs` (imports `channel-fixture.mjs`, which names the scripts) | 1 | 1 | 0 |
+| `packages/cli/tests/host.test.mjs` (reads `packages/cli/README.md`) | 42 | 42 | 0 |
+
+These are every test file that reads `stack-release.sh` or `stack-copy.sh` (a grep of `packages/*/tests` and
+`scripts/`). None of them pins a sha256 of a changed file. `packages/cli/tests/host.test.mjs` reads
+`packages/cli/README.md` for a unit file name; this row only adds a paragraph there. The grep and the runs
+were repeated on the rebased tree on 2026-10-21; the reader set is the same. A dry run of `mutants.sh`
+matches each of the 17 replacements once on the rebased scripts.
+
+### Gate, 2026-10-21, Sage's slot (sage-1618)
+
+Candidate a0ffabc3f on `darkwing/row232-r1`, run by `~/darkwing-scratch/r232/gate.sh`: the cli suite, then
+every `scripts/test-*.sh`, one after another, stopping at the first failure. busy.sh passed at 01:07:49Z
+after Launchpad's single `stack-release.test.mjs` run ended. The gate stopped at the first one, so the
+chain waited for that PID to exit and checked again. The EXIT trap removed the compose network; no
+container was left.
+
+| Step | Time (UTC) | Result |
+|---|---|---|
+| `packages/cli`, `node --test tests/*.test.mjs` | 01:07:50 to 01:17:53 | 561 pass, 0 fail, 0 skipped |
+| `scripts/test-auth.sh` | 01:17:53 to 01:17:54 | 15 passed, 0 failed |
+| `scripts/test-conductor.sh` | 01:17:54 to 01:18:00 | 17 passed, 0 failed |
+| `scripts/test-config.sh` | 01:18:00 to 01:18:02 | 31 passed, 0 failed |
+| `scripts/test-discord.sh` | 01:18:02 to 01:18:12 | 78 passed, 0 failed |
+| `scripts/test-extension-package.sh` | 01:18:12 to 01:18:13 | 18 passed, 0 failed |
+| `scripts/test-foundation.sh` | 01:18:13 to 01:19:01 | 44 passed, 0 failed |
+| `scripts/test-land-work.sh` | 01:19:01 to 01:19:14 | 86 passed, 0 failed |
+| `scripts/test-queue.sh` | 01:19:14 to 01:19:37 | 156 node tests pass, queue suite 28 passed, 0 failed |
+| `scripts/test-release.sh` | 01:19:37 to 01:19:51 | 14 passed, 0 failed |
+| `scripts/test-task.sh` | 01:19:51 to 01:20:44 | 98 passed, 0 failed |
+
+### Mutants, 2026-10-21, same slot
+
+`~/darkwing-scratch/r232/mutants.sh`, right after the gate. Both controls (the external file whole, and
+stack-copy's `^row 232: ` tests) exited 0 on the unmutated tree. Each mutant was applied after a checked
+backup and a syntax check, ran its killers from the table above, and was put back with its sha256
+checked. The script stops on any restore mismatch, and it ran to its end.
+
+| Mutant | Killer exit | Result |
+|---|---|---|
+| m01 pointer on gate failure | 1 | killed |
+| m02 gate once | 1 | killed |
+| m03 PM from any instance | 1 | killed |
+| m04 no startedAt check | 1 | killed |
+| m05 newest marker | 1 | killed |
+| m06 --to not compared | 1 | killed |
+| m07 one call without --user | 1 | killed |
+| m08 interim pending line | 1 | killed |
+| m09 marker written last | 1 | killed |
+| m10 refusal names the open activation | 1 | killed |
+| m11 stale-start refuses | 1 | killed |
+| m12 revert always restores | 1 | killed |
+| m13 confirm op | 1 | killed |
+| m14 MIGRATING after migrate | 1 | killed |
+| m15 gate floor from the log | 1 | killed |
+| m16 bundle reachability unchecked | 1 | killed |
+| m17 --create overwrites | 1 | killed |
+
+17 of 17 killed, 01:22:16 to 01:24:32Z. I read the logs for m01 and m09, two of the quick kills: each failed on
+its named test's assertion (m09 on `AWAITING-UNITS` in sequence 2), not on a load error.
+
+## Round 2: rebase onto 8fede5fc6 (sage-1673)
+
+Rebase only. Before the landing gate, a check of BASE..HEAD on the manifest paths found that row 230
+(c8bc5cf4c) had changed one of them after the round 1 base, cb5fdb064. Sage ruled a re-round with a
+scoped review, the same shape as row 210 round 3.
+
+Branch `darkwing/row232-r2`: the two round 1 commits, a0ffabc3f and 84f1a91e6, cherry-picked onto
+8fede5fc6 with no conflict, then this section. No code or test changed.
+
+- `git merge-tree --write-tree origin/refactor darkwing/row232-r1` (refactor at 8fede5fc6) gives tree
+  837bde79236c with no conflict. The cherry-picked tip before this section has the same tree.
+- `packages/cli/README.md` is a clean 3-way merge. Row 230's hunk is at lines 710-717 (the session credential
+  paragraph); this row's is a new paragraph at 773. With `git patch-id --stable`, the README diff from r1 to
+  r2 is 02b679e2, the same as row 230's README diff `cb5fdb064..8fede5fc6`. This row's README diff is
+  c395ecd2 on both bases (`cb5fdb064..r1` and `8fede5fc6..r2`).
+- The seven code, test and doc paths other than the README hash the same as in manifest 7a3b4ea1, which
+  Filbert approved in round 1: `docs/TOOLS.md`, `packages/cli/tests/stack-copy.test.mjs`,
+  `packages/cli/tests/stack-release-external.test.mjs`, `packages/cli/tests/stack-release-fixture.mjs`,
+  `packages/cli/tests/stack-release.test.mjs`, `scripts/stack-copy.sh`, `scripts/stack-release.sh`.
+  This file also matched until this section was appended. Its other lines are unchanged.
+- The one test that reads the README, `host.test.mjs:855`, looks for the unit's `EnvironmentFile=` line.
+  That line is unchanged context in row 230's hunk.
+- No row 230 test reads `stack-release.sh` or `stack-copy.sh`, and no test of this row reads a row 230 file.
+
+Nothing was run for this round. The landing gate runs on the r2 tip on Sage's slot.
+
+Follow-up, doc-only (sage-1673): `scripts/case2-unit.sh:108` and `scripts/case2-precheck.sh:157` cite
+`scripts/stack-copy.sh:8` and `:22` for `COPIES` and `copy_root`. With this row those lines are `:10` and
+`:26`. Only comments are affected and no test reads them. Row 233 doesn't touch those scripts, so the fix
+goes on the #1732 carry list.
@@ -0,0 +1,249 @@
+# Row 233 (I3): root's upgrade driver and the host run sheet
+
+Brief: `docs/plans/2026-10-20_installer-rows.md` section I3, blob `e61291bcf1c6` (commit a0e3d7cfd), re-pinned
+by Sage (sage-1685, rev 2631) from `f35e7e57daee` (ad6f0be7a). The later blob only appends I4; the I3 text
+is the same. Gitea #1735, Vikunja P19
+#432. Owner Darkwing, reviewer Filbert, gate owner Sage. Design input: row 195 DESIGN r6,
+`agents/darkwing/work/queue-195/DESIGN.md` at b7239bb66, sections 2, 4 and 7. Where the brief and r6
+differ, the brief wins. Sage's rulings during the build: sage-1650 and sage-1652 (`--backup last`, the
+`--no-rehearsal` mapping, `--rehearse-port`, hostcheck), and sage-1653 (`from_log newest`, the two external
+plan refusals, the `BACKUP_STORE` line).
+
+## Files
+
+Base: e65a3ab4d, row 232's landing, on `darkwing/row233-r1`. The build started on ea1e85c7b
+(`darkwing/row233`, row 232's candidate e6ca230d2 and its BUILD.md) before row 232 landed. The three row 232
+files this row changes are identical on the two bases, so the uncommitted diff moved across unchanged.
+
+- `scripts/stack-upgrade.sh` (new): `upgrade` and `rollback`, root's side of r6 A1-A5, A2f and R1-R4.
+- `packages/cli/tests/stack-upgrade.test.mjs` (new, 20 tests).
+- `docs/guides/host-run-sheet.md` (new).
+- `docs/TOOLS.md`: a new subsection "Root's upgrade driver (`scripts/stack-upgrade.sh`, row 233)", plus the
+  row 232 lines below.
+- Row 232 files, changed on Sage's rulings (the brief's files list doesn't name them):
+  - `scripts/stack-release.sh`:
+    - `rehearse --backup last` takes the newest backup the log records (`from_log newest`) and prints
+      `PASS backup-last`. With none it fails `no-backup`, exits 3 and makes no rehearsal directory.
+      A newest backup that isn't an activation id aborts `backup-unreadable`, exit 1.
+    - The rehearsal prints `BACKUP_STORE <activation id> schema <version>` before its migration step.
+    - `--plan` under `--units external` refuses `open-activation` when any rollback set holds
+      `AWAITING-UNITS`, and `migrate-required` for a migrating target without `--migrate`. Root reads
+      only the plan's exit, so these two have to be refusals there. User mode prints the same bytes.
+  - `packages/cli/tests/stack-release.test.mjs`: three new `row 233:` tests for `--backup last`.
+  - `docs/TOOLS.md`: `--backup ACTIVATION|PATH|last` in the rehearse usage, a paragraph on `last`, and a
+    paragraph on the two external plan refusals.
+- This file.
+
+## The brief, item by item
+
+| Brief item | Where |
+|---|---|
+| Root runs from a root-owned checkout, never a copy | `head-mismatch` (A1); TOOLS.md; run sheet section 6 |
+| I2's render with `/etc/mosaic-stack/<instance>.args`, `--copy` the one changed value | `read_args`, `args_with`; the args test |
+| The args file changes only after a confirmed run | `prepare_args` before A2, `mv` after A5; sequences 1 and 7, m6 |
+| `copy --bundle` as the stack's user before A1 | the `fetch`, `ff`, `copy` steps; sequence 1's sudo keys |
+| A rehearsal before A2, a failed one refuses with nothing stopped | `rehearse`; three rehearsal tests, m4 |
+| The root lock, held to the end, rollback included | `flock -n 9`; the lock test and sequence 3's probe, m1, m2 |
+| A1 refuses `open-activation` | stack-release.sh's external plan; the AWAITING-UNITS test, m3 |
+| `migrate-required` without `--migrate` | stack-release.sh's external plan; its test, m5 |
+| The step log, 0640, one line per step | `logl`, `step`; every test checks lines against `STEP` |
+| Exit codes 0-3 | `finish`, `refuse`; exit 4 is usage |
+| duckworth-0055's notes | the next section |
+| Root parses no stack user output beyond exits | the step log test; the one exception is sage-1653's `BACKUP_STORE` |
+| The host run sheet | `docs/guides/host-run-sheet.md` |
+
+## duckworth-0055's notes on r6 (brief line 169)
+
+- N1, A2's stop timeout under `gate --since`. Row 232's BUILD.md left two pieces to I3. The run sheet's
+  A2f line is in section 6 ("When a run doesn't exit 0", exit 2). The test is `N1: a bus that outlives
+  A2's timeout keeps its old start`: a bus that ignores `stop` keeps its old `ActiveEnterTimestamp`,
+  `wait-down` logs `rc=1 ... state: active`, A2f restarts and gates, the gate fails `stale-start`, and the
+  driver stops both units and exits 2. Sequence 4 is the other half: an A3 exit 3 goes to A2f and exits
+  1 with the old copy's gate passing.
+- N2, the claude path under `/opt/mosaic-stack`. Run sheet section 3 installs it there as root with
+  managed settings. The args file's `--claude` carries it, and `case2-unit.sh` already refuses a binary
+  that isn't root's or sits under the home. The driver passes the args file through and adds no claude
+  check of its own. F6 is I2's.
+
+## Sage's rulings during the build
+
+- sage-1650 and sage-1652. Root always runs the rehearsal and maps its exit:
+  - 0 goes on, or refuses `rehearsal-required` with `--no-rehearsal`.
+  - 3 refuses `no-backup`, or with `--no-rehearsal` logs `rehearsal-skipped` and goes on.
+  - Anything else refuses `rehearsal-failed`.
+
+  `--rehearse-port N`, default 7339. Hostcheck: a missing file or a nonzero `--check` refuses
+  `profile-drift`.
+- sage-1653. `from_log newest`, and the external plan refusals `open-activation` and `migrate-required`.
+  Residual: the `BACKUP_STORE` id and schema land in root's step log, but nothing ties that backup to the
+  one the activation's own backup step takes later. A stopped backup before the upgrade would close that
+  gap; it's a later row, not this one.
+
+## Tests
+
+`stack-upgrade.test.mjs` runs the driver as the test's user against a scratch root, with the test seams
+`STACK_UPGRADE_*`. The stand-ins are a fake `sudo` (logs its argv, checks the driver's form, then runs the
+real command as the test's user, r6's B1 pattern), a fake `case2-unit.sh` render that installs and starts
+the fixture units, a fake `systemctl` for root's system units, and a shell `hostcheck.sh`. The stack's
+user's steps run the real `stack-release.sh` and `stack-copy.sh` from a clone made from a real bundle. The
+units, copies and store are `stack-release-fixture.mjs`'s.
+
+| Test | Covers |
+|---|---|
+| sequence 1 | confirm fails healthz, rollback with `--cause A5`, exit 1; every sudo call in the driver's form |
+| sequence 2 | `activate --migrate` fails at the wrapper, store restored, `--cause A3`, exit 1 |
+| sequence 3 | render fails, `--cause A4`; a probe run during `render-old` refuses `upgrade-running` |
+| sequence 4 | stage exits 3, A2f restarts and gates the old units, exit 1 |
+| N1 | a unit that won't stop: A2f's gate fails `stale-start`, exit 2, units stopped |
+| sequence 5 | confirm of the wrong copy refused, `--cause A5`, exit 1 |
+| sequence 6 | revert fails, exit 2; the next run refuses `interrupted-run` at its plan |
+| sequence 7 | two upgrades and a `rollback --to` with `--restore`; the args file after each confirm; `to-not-previous` |
+| sequence 8 | a migration that writes and fails, store back byte for byte, exit 1 |
+| lock | a second run while the lock is held: one log line, no call |
+| open-activation | any `AWAITING-UNITS` refuses at A1, nothing stopped |
+| migrate-required | refused without `--migrate`, no rehearsal, nothing stopped |
+| rehearsal-failed | the rehearsal's argv, exit 3, nothing stopped |
+| `BACKUP_STORE` | the line after a match; four malformed lines log `BACKUP_STORE none` |
+| no-backup | the real rehearsal with no backup refuses; `--no-rehearsal` logs the skip and goes on |
+| backup-last | the real rehearsal names the newest backup; `--no-rehearsal` with one refuses `rehearsal-required` |
+| args file | group write, other write, two `--copy`, an unknown flag, a symlink, `args-differ` |
+| hostcheck | nonzero `--check` and a missing file refuse `profile-drift` before the plan |
+| head-mismatch | checkout not at `--sha`; a commit the clone can't fast-forward to refuses `fetch-failed` |
+| usage | twelve bad argvs exit 4 with no log and no lock |
+
+The step log check (`STEP`) runs in every test that reads the log: each line must be a step line or the
+result line, and none may hold the stack user's output (`stack-release:`, `PASS `, `FAIL `, `REHEARSAL`,
+the fake rehearsal's text).
+
+## Mutants
+
+`~/darkwing-scratch/r233/mutants.sh`, not committed because it edits the worktree. It has the brief's six
+mutants and two for sage-1650's mapping. The method is row 232's: a checked backup, exact replacements, a
+syntax check, the named killers, then the file put back with its sha256 checked. One control runs first:
+the whole `stack-upgrade.test.mjs` with no change. `DRY=1` matched each replacement once on the candidate
+(2026-10-21).
+
+| Mutant | File | Killers |
+|---|---|---|
+| m1 drop the flock | stack-upgrade.sh | `a second run while the lock is held`, `sequence 3:` |
+| m2 release the lock when the rollback starts | stack-upgrade.sh | `sequence 3:` |
+| m3 skip A1's open-activation check | stack-release.sh | `A1 refuses open-activation` |
+| m4 skip the rehearsal | stack-upgrade.sh | `the rehearsal runs after the plan`, `sequence 1:` |
+| m5 accept a migrating target without `--migrate` | stack-release.sh | `migrate-required` |
+| m6 write the args file before confirm | stack-upgrade.sh | `sequence 7:`, `sequence 1:` |
+| m7 `--no-rehearsal` accepted with a backup | stack-upgrade.sh | `refuses rehearsal-required` |
+| m8 drop the `rehearsal-skipped` line | stack-upgrade.sh | `a real rehearsal with no backup` |
+
+## Deviations
+
+D1. The brief has A1 refuse `open-activation` for an open `AWAITING-UNITS` or a non-empty `interrupted`
+set. The interrupted case refuses with row 232's existing code, `interrupted-run`; only `AWAITING-UNITS`
+gives `open-activation`. Both reach root as `plan-refused`, exit 3 (sequence 6, the open-activation test).
+
+D2. Root copies one line of the stack user's output into its log, `BACKUP_STORE`, on sage-1653. It
+matches a fixed pattern first, takes the last match, logs `BACKUP_STORE none` otherwise, and decides
+nothing on it.
+
+D3. The stack user's steps carry no `--instance`. The driver takes `--instance dev` only, row 190's default
+instance, which the stack user's commands select with no flag. A named instance's units are a later row.
+
+D4. Most tests fake the rehearsal in the fake `sudo`: the fixture's stub copies can't pass a real one. Two
+tests run the real rehearsal (`faults/real-rehearse`): no-backup and backup-last. `stack-release.test.mjs`
+covers `--backup last` itself.
+
+D5. Any nonzero `--plan` exit refuses `plan-refused`, exit 3, whatever the code. The stack user's output
+above it names the refusal; root doesn't parse it.
+
+D6. `rollback --restore ACT` is accepted without `--events`, as `stack-release.sh rollback` accepts it.
+The brief's usage pairs them. `--events` without `--restore` is a usage error.
+
+D7. The refusal of any `STACK_UPGRADE_*` seam when run as root has no test, because the tests don't run
+as root. It is three lines at the top of the script.
+
+D8. The fake `sudo` keeps the test's environment, where real `sudo` resets it. The driver passes
+everything the stack user needs through `env PATH=...` and `-H`, and the fake checks that form.
+
+D9. Exit 3 means nothing stopped, not nothing changed. A refusal after `fetch` leaves the stack user's
+clone fast-forwarded and the new copy made. Both are the user's own state, and the next run reuses them.
+TOOLS.md and the run sheet say so.
+
+D10. The brief's usage has neither `--no-rehearsal` nor `--rehearse-port`. Both come from sage-1650 and
+sage-1652.
+
+## Decisions
+
+- `rollback` has no HEAD check. Its target is an older copy than root's checkout, which already exists.
+  It fetches, copies and rehearses nothing (sequence 7).
+- The new args file is written next to the old one (`.dev.args.XXXXXX`, same mode) before A2, so a full
+  `/etc` refuses before anything stops. It moves into place after A5. A2f and the rollback remove it; a failed move keeps it and names it.
+- Every stack user step gets `--copies` explicitly, so the copies directory comes from the args file's
+  `--home`, never from the user's environment.
+- The stack's user does the fetch, the fast-forward and the copy, so root never runs git on a tree that
+  user can write.
+- A4 is the render, and `case2-unit.sh` starts the bus, then the Console. The forward path has no
+  `systemctl start` of its own; only A2f does.
+
+## Run environment
+
+Worktree `/mnt/storage/scratch/darkwing-r233`, `TMPDIR=/mnt/storage/scratch/tmp/r233`, node from PATH. One
+whole `stack-upgrade.test.mjs` run takes about 56 s.
+
+## Results
+
+### Singles, run 1, 2026-10-21, Sage's slot (sage-1689)
+
+`~/darkwing-scratch/r233/singles.sh` on `darkwing/row233-r1` (base e65a3ab4d, uncommitted tree), 03:48:20Z
+to 03:59:00Z. These are the test files that read a changed script. `stack-instances.test.mjs` reads
+`stack-release.sh`, so it joined the three named in the plan.
+
+| File | Result |
+|---|---|
+| `stack-upgrade.test.mjs` | 20 pass, 0 fail |
+| `stack-release.test.mjs` | 194 pass, 1 fail |
+| `stack-release-external.test.mjs` | 25 pass, 0 fail |
+| `stack-instances.test.mjs` | 23 pass, 0 fail |
+
+The failure was my test, not the script. "row 233: --backup last takes the newest backup..." compares
+`untouched(e)` before and after the run, and `untouched` includes `existsSync(e.log)`. The test took its
+before snapshot ahead of `rlog()`, which writes the log, so that flag went from false to true. Every hash in
+the snapshot matched. The fix takes the snapshot after `rlog()`. No other row 233 test calls `untouched`.
+
+### Singles, run 2
+
+`~/darkwing-scratch/r233/rerun.sh` on aacfa2d7a, Sage's slot (sage-1695), 04:13:05Z to 04:21:28Z:
+`stack-release.test.mjs` whole, 195 pass, 0 fail, 0 skipped. The fixed test passed. The other three files
+did not change after run 1. The gate and the mutants run next, in Sage's slot.
+
+### Gate and mutants, 2026-10-21, Sage's slot (sage-1704)
+
+`~/darkwing-scratch/r233/gate.sh` then `mutants.sh`, chained behind `busy.sh`, on d99166ade (code
+aacfa2d7a; d99166ade changes only this file). Counts are an awk sum over `gate-r1.out`.
+
+| Part | Time (UTC) | Result |
+|---|---|---|
+| cli suite (`node --test tests/*.test.mjs`) | 04:29:01-04:37:27 | 616 pass, 0 fail, 0 skipped |
+| the 10 `scripts/test-*.sh` | 04:37:27-04:39:38 | selftests 429 passed, 0 failed; `test-queue`'s node part 156 pass, 0 fail |
+| gate total | | 1201 pass, 0 fail, 11 suites, `GATE_PASSED` |
+| c0 control | 04:39:38-04:40:35 | exit 0 |
+| m1-m8 | 04:40:35-04:41:25 | 8 of 8 killed, every one exit 1 |
+
+Every restore passed its sha256 check, and `git diff` was clean at d99166ade afterwards. The EXIT trap
+removed the `darkwing-r233_default` network.
+
+N1, found in the process sweep after the run: a `sleep 60` was left with its cwd in `packages/cli`.
+`stack-upgrade.test.mjs:312` spawns `flock LOCK sleep 60`, and its `t.after` SIGKILLs only the flock, so
+flock's child outlives the test by up to 60 s. It exited on its own. Row 232's T20
+(`stack-release.test.mjs:370`) spawns its holder `detached` and kills the group with `process.kill(-pid)`.
+The fix is the same two lines. That test is one of m1's killers.
+
+Sage ruled it a fix now (sage-1707), and 08db6ac3f makes it, test only. After the gate's d99166ade
+the only change outside this file is that test:
+
+```
+$ git diff --stat d99166ade 08db6ac3f
+ packages/cli/tests/stack-upgrade.test.mjs | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+```
+
+The gate stands on Sage's ruling. The rerun is the whole `stack-upgrade.test.mjs` singly plus m1, in
+Sage's slot, with a sweep for a leftover `sleep` afterwards.
@@ -0,0 +1,173 @@
+# Row 240 (I4): root's host check, its pins and the boot unit
+
+Brief: `docs/plans/2026-10-20_installer-rows.md` section I4, blob `4a5a65020f00` (commit b00d7d94d, rev 2665,
+the pin row 240 carries; the I3 carry items came in with it). Sage split it out of I3 (sage-1650). Gitea #1746, Vikunja P19 #432. Owner Darkwing, reviewer Filbert, gate owner Sage.
+Design: row 195 DESIGN r6 B2, `agents/darkwing/work/queue-195/DESIGN.md` at b7239bb66, :262-303 (the script,
+the three callers) and :839-860 (files, test cases, mutants). Where the brief and r6 differ, the brief wins.
+
+## Files
+
+Drafted on `darkwing/row240-r1` from d99166ade (row 233's candidate) while row 233's gate ran, then applied
+as one patch onto row 233's landing, 57f59e0c3, on `darkwing/row240-r2` (sage-1753). It applied cleanly; between
+the two bases the only change on this row's paths is 233's N1 test fix in `stack-upgrade.test.mjs`. Row 234
+then landed as c771a36f4 on 57f59e0c3. Sage preferred that the gate run with it in the tree (sage-1773), so both
+commits were picked onto c771a36f4 as `darkwing/row240-r3`. That was a clean pick: the 42 paths changed from
+57f59e0c3 to c771a36f4 share none with this row's 9.
+
+- `scripts/case1-pins.sh` (new, 0644): `PIN_PROFILES_VERSION`, `PIN_PROFILE_SHA256`, `PIN_BUBBLEWRAP_VERSION`,
+  r6 section 0's values.
+- `scripts/case1-hostcheck.sh` (new, 0755): the seven items and `--check`, `--enforce`, `--upstream`.
+- `packages/cli/systemd/mosaic-hostcheck.service` (new): the boot oneshot.
+- `packages/cli/tests/case1-hostcheck.test.mjs` (new, 16 tests). The cli suite's `tests/*.test.mjs` glob picks
+  it up.
+- `docs/guides/host-run-sheet.md` section 4: the install lines that replace "Install them from row 240's run
+  sheet lines once it lands", plus rollback, drift recovery and `--upstream` before a re-pin window. Sections
+  3, 6, 8 and 10 for the I3 carry items below.
+- `scripts/stack-upgrade.sh` and `packages/cli/tests/stack-upgrade.test.mjs`: I3 N1 below.
+- `docs/TOOLS.md`: a new subsection "Root's host check (`scripts/case1-hostcheck.sh`, row 240)" after the
+  upgrade driver's.
+
+Brief line 257 said I3's `stack-upgrade.sh` doesn't change. Sage's ruling sage-1727 widened the row to it for
+N1 alone. Its default `STACK_UPGRADE_HOSTCHECK=/usr/local/lib/mosaic-stack/hostcheck.sh` is where the run
+sheet installs this script.
+
+## Carried from I3
+
+Filbert's row 233 approve (Gitea 29922) left five notes. Sage ruled N1, N4 and N5 into this row and N2 and N3
+to DEFERRED.md (sage-1727).
+
+| Note | Change |
+|---|---|
+| N1: `stack-upgrade.sh` exits 1 `args-failed` when the args move after A5 fails, but exit 1 means the old copy runs | The move's failure exits 5 `args-failed`. The header, TOOLS.md's step 5 and exit line, and run sheet section 6's exit list name exit 5 and what root does: move the new file the result line names into place. Test `row 240: I3 N1: a failed args move after A5 exits 5 ...` makes `/etc/mosaic-stack` read-only at confirm and checks exit 5, the step names, `args rc=1`, the result line, both units on the new copy, the old args file's bytes and the new file beside it. The step log regex takes `exit=5`. Mutant M8. |
+| N4: section 3's `npm install` has no npm on root's PATH, and the `--claude` path is unnamed while `node_modules/.bin/claude` is a symlink `case2-unit.sh:140` refuses | The install line runs with section 2's pinned node first on PATH (the postinstall runs `node` too). The `--claude` path is `node_modules/@anthropic-ai/claude-code/bin/claude.exe`, and a `--version` line catches the postinstall's 500-byte stub. |
+| N5: sections 8 and 10 lack precheck lines | Each gets "Precheck line: none" and its missing line. |
+
+Exit 5 is new rather than 2 because 2 means both units are stopped, and here both run. Exit 4 stays usage.
+
+The `claude.exe` path comes from the 2.1.304 package itself: `npm view` gives `bin.claude` as `bin/claude.exe`,
+and its `install.cjs` hardlinks the platform binary over that placeholder, or copies it across devices, then
+sets 0755. I downloaded the tarball into `/mnt/storage/scratch/tmp/r240/cc304` and read it; nothing ran. The
+run sheet says a newer pin needs the same check.
+
+## The brief, item by item
+
+| Brief line | Where |
+|---|---|
+| 247 `case1-pins.sh` holds the three pins | `scripts/case1-pins.sh`; the pins test checks the values against r6's |
+| 248-249 seven items, `--check` exits 0 or 1 | `items()` and the final dispatch; the check tests |
+| 250-251 `--enforce`: `apparmor_parser -R`, `root:root 0700`, `DRIFT`, a log line, exit 0 | `enforce()` and `stop_bwrap()`; the four enforce tests |
+| 252 `--upstream` compares the current deb to the pin | `upstream()`; the upstream test |
+| 253 the boot oneshot | `mosaic-hostcheck.service`; the boot unit test |
+| 254-255 fakes for every host tool, r6's seven case groups, seven mutants | the test file; Tests and Mutants below |
+| 257 the I3 run sheet item points here | run sheet section 4 |
+
+## Tests
+
+Fakes on PATH, each logging its argv to `$HC/calls.log`: `aa-status`, `dpkg`, `dpkg-statoverride`,
+`apparmor_parser`, `systemd-run`, `stat`, `chown`, `chmod`, `apt-get`, `dpkg-deb`. `host(t)` builds a scratch
+root (`/etc`, `/proc/sys`, `/usr/bin/bwrap`, `/var/log`) and a lib dir with a copy of the script and fixture
+pins that hold the fixture profile's sha256. Every run passes `--root`.
+
+r6's case groups (:843-856) against the tests:
+
+| r6 case | Tests |
+|---|---|
+| `--check` exits 0 with all seven, 1 with each failing alone, its line naming it | `check: exits 0 ...`, `check: exits 1 with each item failing alone ...`, plus one test per item for the item's edge cases |
+| item 3: a second file naming `bwrap` as a word, `/{usr/,}bin/bwrap` included; passes with the profile alone | `check: item 3 ...` |
+| item 4: `unpriv_bwrap (enforce)` or a trailing space fails; the argv carries `-p NoNewPrivileges=yes` and the 2a' properties | `check: item 4 ...` checks the whole argv |
+| item 7: the floor at 732 fails | `check: item 6 ...; item 7 ...` (733 passes as the control) |
+| `--enforce` exits 0 on a pass and every failure; unload, close, `DRIFT`, one log line; `DRIFT` present with every item passing still closes | `enforce: a pass ...`, `enforce: each failure ...`, `enforce: with DRIFT present ...` |
+| `--enforce` never calls `dpkg-statoverride` with `--update`, `--add` or `--remove` | `enforce: no unload ...; never writes the statoverride` (every call is `--list /usr/bin/bwrap`) |
+| a bubblewrap version other than the pin is a line, not a failure | `check: a bubblewrap version other than the install pin ...` |
+| `--upstream` against a differing deb prints the difference, exits 0 | `upstream: ...` (also: a match, a deb with no profile, a failed download) |
+| the unit: `Type=oneshot`, `After=apparmor.service`, `[email protected]`, runs `--enforce` | `boot unit: ...` |
+
+The last test also checks that the repo script reads `scripts/case1-pins.sh` beside it, that bad usage exits
+2, and that a non-root run without `--root` refuses.
+
+Singles are the two files that run a changed script: `case1-hostcheck.test.mjs` and `stack-upgrade.test.mjs`.
+Sage asked (sage-1759) whether `stack-release.test.mjs` or `stack-release-external.test.mjs`, which share
+`stack-release-fixture.mjs`, run `stack-upgrade.sh` or `case1-pins.sh`. They don't. `grep -cF` for
+`stack-upgrade`, `case1-pins`, `case1-hostcheck` and `hostcheck` gives 0 in all three files; the control
+`stack-release.sh` gives 2 in the fixture and 8 in `stack-release.test.mjs`. `scripts/stack-release.sh` names
+`stack-upgrade.sh` once, in a comment (:2061). The gate's cli suite runs both files anyway.
+
+## Mutants
+
+r6's seven (:858-860) and one for I3 N1, scripted in `~/darkwing-scratch/r240/mutants.sh` with r233's method: a checked backup,
+an exact replacement that must match once, `bash -n`, the named killer by `--test-name-pattern`, the restore
+and a sha256 check. A dry run matched all eight once each. Results below.
+
+| Mutant | Change | Killer |
+|---|---|---|
+| M1 | `--enforce` exits 1 after the stop | `enforce: each failure exits 0 ...` |
+| M2 | `[ ! -e "$DRIFT" ] \|\| had=1` becomes `true \|\| had=1` | `enforce: with DRIFT present ...` |
+| M3 | item 1's `dpkg -S` becomes `owner=""; rc=1` | `check: item 1 fails when a package owns ...` |
+| M4 | item 3's `grep -rlw bwrap` becomes `grep -rlF /usr/bin/bwrap` | `check: item 3 ...` |
+| M5 | item 4's `[ "$label" = "$LABEL" ]` becomes a substring match | `check: item 4 ...` |
+| M6 | item 4 drops `-p NoNewPrivileges=yes` | `check: item 4 ...` (argv) |
+| M7 | item 7's `-gt` becomes `-ge` | `check: item 6 ...; item 7 fails with the floor at 732 ...` |
+| M8 | `stack-upgrade.sh`'s `finish 5 args-failed` becomes `finish 1 args-failed` (I3 N1) | `row 240: I3 N1: a failed args move ...` |
+
+## Deviations
+
+- Repo name `scripts/case1-hostcheck.sh` (r6), installed as `/usr/local/lib/mosaic-stack/hostcheck.sh`, the
+  name in brief line 239 and I3's `stack-upgrade.sh` default. r6's apt hook line says `case1-hostcheck.sh`;
+  the run sheet's hook uses the installed name.
+- `stat` is a fake too. r6 lists seven fakes; a test can't make a root-owned file, so item 5's `stat` reads a
+  fixture.
+- Item 7 with no Console unit installed reads the port as 1023 and says so ("1023, because no Console unit
+  is installed"). Until I2 installs the unit the floor must be above 1023. A unit with no `--port` fails.
+- Item 4 runs under `timeout 60`. A hung `systemd-run` would otherwise hang the apt hook and the boot unit.
+
+## Decisions
+
+- Fail closed where r6 is silent:
+  - pins with no 64-hex sha fail item 1;
+  - `dpkg -S` exit 1 (no owner) passes, exit 0 fails with the owner, any other exit fails with the code;
+  - a failed `aa-status` fails item 2 and counts as loaded, so `--enforce` tries the unload.
+- `--root DIR` is the test seam (r6 :840). Root refuses it; a non-root user needs it. Both exit 2. Root runs
+  with `PATH=/usr/sbin:/usr/bin:/sbin:/bin`.
+- `DRIFT` is append-only (`<stamp> <failed line>`), and `--enforce` never removes it. The log line is written
+  only when the stop runs: `<stamp> enforce stop items=<ids or none> drift-before=<0|1> unload=<rc=N|no-file|skipped> chown=N chmod=N`.
+- `--upstream` exits 1 when the download or the unpack fails, since it then compared nothing. A deb without
+  the profile file is a difference (exit 0), per r6 :302-303.
+- The bubblewrap note reads the version from `dpkg -s bubblewrap`.
+- The run sheet's recovery steps (`chown root:mosaic`, `chmod 0750`, `apparmor_parser -r`, then `--check`
+  before root removes `DRIFT`) are mine. r6 says only that root removes `DRIFT` in a reviewed step.
+
+## Run environment
+
+Worktree `/mnt/storage/scratch/darkwing-r240b`, branch `darkwing/row240-r3` on c771a36f4, with `node_modules`
+linked to the canonical checkout's. Node v26.8.1, kernel 7.2.2-1-cachyos, 16 CPUs, TMPDIR
+`/mnt/storage/scratch/tmp/r240`, compose project `darkwing-r240b`. Sage's slot (sage-1773, 06:16Z). Each run is
+one chain behind `busy.sh`, launched from `/`: `~/darkwing-scratch/r240/run-all.sh` checks the HEAD pin and a
+clean tree, runs the singles, then the mutants (8 killed, none surviving, the tree clean after), then the gate
+(the cli suite and every `scripts/test-*.sh`), each stopping the chain on failure, then sweeps `/proc` cwd links
+for anything left in the r240 trees.
+
+## Results
+
+Run r1, 06:17:10Z on 47ec9fe2f, failed at the singles. `case1-hostcheck.test.mjs` passed 16/0/0, and
+`stack-upgrade.test.mjs` went 20 pass, 1 fail. The failure was the N1 test's own `t.after` hook, which ran
+`chmodSync(e.etc, 0o755)` after the fixture's cleanup had already removed the scratch root, so it threw ENOENT.
+Every assertion in the test body had passed, exit 5 included. The fixture's cleanup runs `chmod -R u+w` on the
+root before `rmSync`, so the 0555 dir never needed the hook. b45852daa drops it and changes nothing else. The
+mutants and the gate didn't run. The sweep found nothing left. Sage counted r1 as this slot's one failure
+(sage-1788).
+
+Run r2, 06:20:41Z to 06:33:28Z on b45852daa, passed. The counts come from awk over the .out files
+(`~/darkwing-scratch/r233/sum.sh`):
+
+| Step | Result |
+|---|---|
+| `case1-hostcheck.test.mjs` | 16/0/0 |
+| `stack-upgrade.test.mjs` | 21/0/0 |
+| c0 control | exit 0 |
+| M1-M8 | 8/8 killed, none survived, every restore's sha256 matched, tree clean after |
+| `packages/cli` suite | 639/0/0 |
+| `scripts/test-*.sh` | auth 15, conductor 17, config 31, discord 78, extension-package 18, foundation 44, land-work 86, queue 156 node + 28 selftest, release 14, task 98; 585 pass, 0 fail |
+| Gate total | 11 suites, 1224 pass, 0 fail |
+| Sweep | nothing left in the r240 trees; the compose network was removed |
+
+This commit adds only these BUILD.md lines. No test reads BUILD.md.
@@ -0,0 +1,91 @@
+# Row 245 build: Duckworth's N1-N3 on `scripts/case1-accept.sh` (row 195 follow-up)
+
+Duckworth approved row 195's manifest round 1 (duckworth-0088, `agents/duckworth/work/row195/REVIEW-m1.md`
+at 6afcee2a5) with three notes that don't block. Row 195's code landed as b65014647, and the notes are in
+`docs/plans/DEFERRED.md` (d6cff0cdd). Row 245 carries them: brief `docs/plans/2026-10-20_hub-own-uid.md` §
+"Row 195 follow-up" at 62ddc96cc, owner Darkwing, reviewer Duckworth, gate owner Sage (sage-1923).
+
+The branch is `darkwing/row245`, on 62ddc96cc. Its first commit is a cherry-pick of `darkwing/row195-n1`
+1e3c4767c, which was written on 37171f65b and never run. The script, test and TOOLS.md blobs are the same
+as in 1e3c4767c, and none of those paths changed between 37171f65b and 62ddc96cc.
+
+## What changes
+
+N1. F9 ran `$ROOT$NODE` as root (`case1-accept.sh:298` at 37171f65b) before F10 checked that `--node` is
+the pinned path. Duckworth offered two fixes: F9's parse through `AS_USER`, or F10's path check first. I
+took the path check, plus one more:
+- F9 now runs node only when `--node` equals `/opt/mosaic-stack/node-<--node-pin>/bin/node`.
+- Then `not_root_only` walks from that file up to `/`. Each entry must be the running user's (root's on the
+  host) with no group or other write, the rule `case2-unit.sh` `root_only` applied when it rendered the
+  units. A symlink fails it, because its mode is 777. The first entry that breaks the rule goes in the
+  evidence.
+
+I didn't run the parse through `AS_USER`. That would hand a check about a root file to the stack's user,
+and a process running as `mosaic` shares that node's uid. Whether it could change what node prints then
+turns on the host's ptrace setting, and the root-only check doesn't depend on that. Sage agreed in
+sage-1877. Rechecking ownership costs one loop and doesn't depend on
+how the host was installed.
+
+N2. The header (:9-15) and the `docs/TOOLS.md` entry now list what root runs: `systemctl show` and
+`is-enabled` (F1, P11), `curl` on the loopback healthz (F2), `sudo -l` (P1, P3), `sudo -u jarvis bwrap
+--version` and `hostcheck.sh --check` (P9), and node for F9 under the rule above.
+
+N3. F6 matched `--claude` by prefix, so `/opt/mosaic-stack/claude-<pin>/../claude-2.0.9/...` passed the
+path check. F6 now fails on any `..` segment, before it runs `--version`. F10 compares for equality, so
+it needed no change.
+
+Row 195's BUILD.md gets a correction entry for deviation 6. Row 195's DESIGN.md is unchanged. Its "either
+works" wording at `DESIGN.md:336-338` is superseded by gosalyn-0087 (root writes `dev.args` at W10), and
+it stays in place: an approved design isn't edited (sage-1877).
+
+## Tests
+
+`packages/cli/tests/case1-accept.test.mjs`:
+- The node stub touches `node-as-root` in the state directory when something runs it outside the fake
+  `sudo` (which sets HOME to the stack's home). `host()` sets the node file's directories and the scratch
+  root to 0755, so the umask can't fail F9.
+- "every check passing" also asserts that root ran the pinned node.
+- New: "F9 won't run --node as root off the pin path or with a writable directory above it". Another node
+  path fails F9 and F10, with no root run. A group-writable `bin/` and a symlinked node each fail F9
+  alone, with the bad path in the evidence and no root run.
+- The F6 test gains a `..` case: a path under `claude-<pin>/` by prefix that names 2.0.9's binary, which
+  prints the pin. F6 alone fails, with "has a .. segment".
+
+That makes 23 tests. All 23 pass on Sage's slot (results below).
+
+## Mutants
+
+The twelve from row 195 still apply, unchanged. These four are new, each one exact replacement:
+
+| # | Mutant | Expected killer |
+|---|---|---|
+| 13 | F9 runs any `--node` (the pin check becomes `true`) | F9 won't run (another node) |
+| 14 | F9 skips the ownership walk (`bad=""`) | F9 won't run (writable `bin/`, symlink) |
+| 15 | `not_root_only` checks only the file, not the directories above it | F9 won't run (writable `bin/`) |
+| 16 | F6 accepts a `..` segment | F6 stub, path and `..` |
+
+The brief's gate asks for a mutant for each of N1 and N3. Mutants 13-15 are N1's, and 16 is N3's.
+
+## Slot plan
+
+Same shape as row 195's steps, on this row's tip: the single test file, then the sixteen mutants, then
+the gate (the cli suite and every `scripts/test-*.sh`), each behind the busy checks and chained with
+`&&`. The scripts are in `/mnt/storage/scratch/darkwing-245-out/`.
+
+## Slot results (grant sage-1961, 2026-10-21)
+
+All three steps ran on 0590a29fc with node v26.8.1, launched from `/`. Both busy checks were CLEAR
+before each step.
+
+- Singles, 11:27:46-11:27:59Z: `case1-accept.test.mjs` passed 23, failed 0.
+- Mutants, 11:28:10-11:31:20Z: all 16 killed, each with exit 1. The runner restored the script, and
+  its sha256 875bb5b7 matches the committed blob. Rows 1-12 died as in row 195. 13, 14 and 15 died on
+  "F9 won't run --node as root off the pin path or with a writable directory above it". 16 died on
+  "F6 fails on a stub that prints nothing, on a path outside claude-<pin> and on a .. segment".
+- Gate, 11:31:20-11:42:51Z: the cli suite passed 664, failed 0, skipped 0. Every `scripts/test-*.sh`
+  exited 0: auth 15, conductor 17, config 31, discord 78, extension-package 18, foundation 44,
+  land-work 86, queue 28 (its node part 156/0), release 14, task 98. That's 429 selftests, none failed.
+- Afterwards no process had its cwd in the worktree, the out dir or TMPDIR, and the
+  `darkwing-r245_default` network was gone.
+
+Logs: `/mnt/storage/scratch/darkwing-245-out/` (`step1.log`, `mut.out`, `mut/m1-16.log`, `gate.out`).
@@ -0,0 +1,310 @@
+# Row 234 (#436a row a, Gitea #1740): host enrollment, store records and bus schema 3i to 3j
+
+Gizmoduck, 2026-10-21. Reviewer Duckworth, gate owner Sage. Lands by 10-25, before the .53 and .54 installs
+(mos-1134).
+
+- Brief: `docs/plans/2026-10-20_host-credentials.md`, section "Machine grant row a: enrollment, store records
+  and migration 3i-3j", blob 64451be5 (queue rev 2617).
+- Design: `agents/gizmoduck/work/machine-grant/DESIGN.md` r6, f9039682e on `gizmoduck/machine-grant-design`,
+  approved by Duckworth (duckworth-0064, REVIEW-r6.md at 8ea792256). Not reopened here. Cites "r6:" are lines
+  of that file.
+- Grant event rule: #436b section 7, fa5658941 on `megavolt/row199`,
+  `agents/megavolt/work/436b/DESIGN.md:431-490`, file sha256
+  96510b83778e79a71b33d0d5f6fd0c806dfe74f6de315ff4a9f1fbe5620f6c69, approved by Duckworth (duckworth-0067).
+- Base: origin/refactor 8fede5fc6, with rows 199 (cb5fdb064) and 210 (f5753c0e8) landed. Branch
+  `gizmoduck/row234`. Code cites are `path:line` at 8fede5fc6 unless they say otherwise.
+
+## Names: r6 against section 7
+
+r6's `grant.*` and `host.enroll.*` names are `body.action` values on `action.allowed` events, not event
+kinds. The `events` kind CHECK isn't rebuilt. Four r6 names move under `grant.`:
+
+| r6 | This row |
+|---|---|
+| `host.enroll.step` | `grant.host.enroll.step` |
+| `host.enrolled` | `grant.host.enrolled` |
+| `host.checked` | `grant.host.checked` |
+| `host.removed` | `grant.host.removed` |
+
+Only the consume record carries `decision`: `{operation: 'grant.host-enroll', decision}`. Every other
+guarded body names the decision `grantDecision`, so r6's `decision` field in step, enrolled and failed bodies
+is `grantDecision` here. The actor of every guarded event is `actor_role` NULL with `actor_run` 'grant',
+and `body.by` names the caller the broker checked.
+
+## Split (r6 section 12 Q-S4)
+
+Row a builds:
+
+1. **Schema 3i to 3j.** `migrations/3i-3j.sql` adds `hosts` and `host_grants` (r6 S1, primary keys
+   (business, host) and (business, agent, host)) and the guard trigger: an `action.allowed` whose
+   `body.action` or `body.operation` GLOBs `'grant.*'` aborts unless the actor is (NULL, 'grant').
+   `SCHEMA_VERSION` 3j, a migration test with a step that fails partway.
+2. **Grant event writer.** A private session-less broker writer for guarded events. `#event` doesn't change.
+   `recordEvent` refuses `reserved-event` for the guarded namespace.
+3. **The `grant` raise frame.** `decision.raise` takes `grant` only with `credential.mint`, only from the chief
+   (`grant-chief-only`), and in row a only with `method: 'host-enroll'`. Any other method refuses
+   `invalid-request` until row b adds `host`. E1's checks, the `ssh-keyscan` set compare before the raise
+   transaction, and the rendered block.
+4. **Enrollment executor.** `#consumeGrant`, the start on the human's cli yes (X1), E2 steps 1 to 4, the
+   installer key at `<configDir>/secrets/hosts/<business>/<hostId>/installer`, the failure cleanup, and the
+   start reconcile for enrollments: the `registry` step undo, and a resolved-yes unspent enrollment ending
+   `grant.failed interrupted` (X3).
+5. **`hosts.check` and `hosts.remove`** (E4), with `mosaic hosts status|check|remove`.
+6. **`tools/host/`**: `mosaic-keys`, `mosaic-keys-write`, `mosaic-keys.sudoers`, `mosaic-keys.sshd.conf` (E3).
+7. **`host.run` on the store** (X4 first and third bullets): it reads the `hosts` and `host_grants` records
+   and the Approve record check, and at start the runtime gives `Credentials` a reference per `host_grants`
+   record. The loader refuses `hosts` at the top level and in a role (S1). Row 210's tests move to store
+   fixtures.
+8. **Reader filter** (duckworth-0067 N1): every grant-evidence reader in this row (status, the start
+   reconcile, `openGrantDecisions`) filters `kind = 'action.allowed' AND actor_role IS NULL AND actor_run =
+   'grant'`, with a test that an `action.refused` look-alike and a session-written one are ignored.
+   `hosts.remove`'s `hostLineLeft` reader is one of them (duckworth-0079 M4).
+
+Row b keeps the `host` method's raise binding (R4), the grant executor (X2), the grant rows of X3, X5,
+`Credentials.register`/`claim`/`abortClaim`, revoke (section 6) and `sweep`. So row a has no way to make a
+`host_grants` record outside a test fixture, and from its landing to row b's no agent holds a host grant
+(r6 N9, the run sheet strips row 210's keys).
+
+Tests in row a (r6 section 10): G1 and G5 for the `host-enroll` raise, G6 and G10 for the enrollment
+executor, G11's enrollment cases, G14, G15, G16, G17, G18, G20, G21 (its `host-line-left` case reads an
+event fixture until row b writes `hostLineLeft`), G25, the migration test, the trigger cases, the reader
+filter test, and row 210's T-tests on store fixtures. Row b: G2 to G4, G7 to G9, G11's grant cases, G12,
+G13, G19, G22 to G24, G26 to G28.
+
+## Early check items (duckworth-0079, REVIEW-build-split.md 10672772e on `duckworth/reviews`)
+
+Moves into row a:
+- M1. G4 for the `host-enroll` block (r6:240-242): a question can't forge the block, and the 4096-character
+  limit holds with the block appended. G4 for the `host` block stays in row b.
+- M2. The tag function (r6:265-266), because E2 step 2 tags the installer line. G24's first sentence moves
+  here: names of 64 characters with `.` and `_` give distinct tags of the fixed length. The `sweep` half
+  stays in row b.
+- M3. A store-fixture test that `host.run` refuses `host-not-granted` for no record, an unresolved decision,
+  a decision resolved by an arbiter, the tester or an agent or not via cli, a consume record with operation
+  `grant.host-enroll` in place of `grant.host`, and an unspent decision (X4 first bullet, r6:593-596). A
+  restart test that a `host_grants` fixture gives `Credentials` a reference (X4 third bullet).
+
+G21's `host-line-left` case:
+- F1. The fixture goes through this row's private grant writer in the real shape: `action.allowed`, actor
+  (NULL, 'grant'), `body.action` 'grant.failed', `body.host`, `body.hostLineLeft`. No raw SQL around the
+  trigger.
+- F2. `hosts.remove` reads `body.hostLineLeft` from any guarded body, not only `grant.failed`.
+- F3. Decided: a guarded body that carries `hostLineLeft` also carries `host`. Row b adds `host` to
+  `grant.revoke.closed`, so its body is `{tag, host, hostLineLeft}` (r6:716 has `{tag, hostLineLeft}`).
+  The reader matches on `body.host`, and doesn't map tags back to hosts through `grant.step`. A direct
+  field is one equality in SQL, and a tag lookup would add a second reader that the N1 filter also has to
+  cover.
+- F4. Row b carry: "no later `sweep` cleared it" (r6:403) needs `grant.sweep`, which only row b writes. Row
+  b adds the sweep clear to `hosts.remove` with a G21 case, and its G8 or G13 shows `hosts.remove`
+  refusing after a real `hostLineLeft` write, not only after the fixture. Until then row a's check is "any
+  guarded `hostLineLeft` for this host refuses".
+
+## Mutants (r6:838-883, numbered here)
+
+Row a, killed on this row's tree:
+
+| # | Mutant |
+|---|---|
+| A1 | drop the chief check |
+| A2 | start the executor on a `credential.mint` with no `grant` |
+| A3 | start it on an arbiter resolve |
+| A3b | start it on a `cli` yes by someone other than the human (duckworth-0083 N8) |
+| A4 | start it on `no` |
+| A5 | skip the keyscan compare |
+| A6 | compare only one key |
+| A7 | write the private key into the event body |
+| A8 | drop the "not yet enrolled" check in E2 step 1 |
+| A9 | drop the `hosts` primary key |
+| A10 | skip the start check for a resolved, unspent enrollment decision |
+| A11 | `host.run` reads the business file instead of the grant record |
+| A12 | build the tag without the business |
+| A13 | drop `from=` in the writer |
+| A14 | let the writer touch a line outside the tag pattern |
+| A15 | drop `O_NOFOLLOW` on the user file |
+| A16 | drop one group from the writer's refused list |
+| A17 | drop the user pattern check before the path use |
+| A18 | treat a `privileged` entry as enough without `users` |
+| A19 | let the writer accept a sudo user not in `privileged` |
+| A20 | trigger: drop the `body.operation` arm, so the consume record passes from a session |
+| A21 | trigger: accept actor_role NULL with any actor_run |
+| A22 | a grant reader drops the `kind = 'action.allowed'` or actor filter. The runner splits it: A22a drops the kind, and G21's `action.refused` look-alikes kill it. A22b drops the actor, which the trigger can't stand in for, because 3i-3j adds the trigger without checking old rows. Its killer is the grant-migration test "A22b, sage-1703": a session-written `grant.host.removed` with `hostLineLeft` and a `grant.host-enroll` row from 3i, migrated to 3j, where `hosts.remove` still removes the host and `reconcileGrants` ends nothing |
+| A23 | `host.run` skips the Approve record check (any `host_grants` record is enough) |
+
+Row b keeps the rest of r6's list: the `ready` check, the three hash compares, the definition check, the
+install and record order, `remove` on a verify failure, both start sweeps, the reconcile's remote `remove`,
+the `grant.step` before install, revoke leaving the record, `register` before `issue`, the abort check and
+the `await` before `issue`, revoke and an unreferenced claim, `sweep` and any `mosaic-` line, revoke's host
+step order, claim before consume, the resolved unspent grant decision, an async `commit`, `hosts.revoke`
+through `credential-verbs.mjs`, the revoke marker reconcile, the upsert, the undo past `grant.revoked`, the
+abort after step 5 and a missing `bus.tester` as dev.
+
+## Broker functions this row touches (sage-1677)
+
+For row 236 (Megavolt), which rebuilds on this landing. Old lines are `packages/bus/src/broker.mjs` at
+8fede5fc6, new lines are at the last commit that changed this file (they moved by 10 after `runEnrollment`
+went in). The planned list is kept in this file's history (827b89ea6).
+
+Changed:
+- `constructor` (:279): one more option, `hostGrant`, the object `host-grant.mjs` builds.
+- `recordEvent` (old :1243-1251, new :1606): one more refusal. An `action.allowed` whose `body.action` or
+  `body.operation` is a `grant.*` name refuses `reserved-event`.
+- `request()` (old :1362, new :1726): two routes ahead of the sync path, a `decision.raise` with `grant` to
+  `#raiseGrant` and the `hosts.*` verbs to `#requestHosts`. Both are async.
+- `requestHost` (old :1712-1795, new :2079): the business-file lookups (old :1730-1736) become one
+  `#hostAccess` call, in the same transaction as `#agent`. `commands` and `entry` come from it.
+- `#dispatch` (old :1796, new :2160) gets a fifth parameter, `enroll`, which only `#raiseGrant` passes.
+  - `decision.raise` (new :2244): `grant` joins the allowed keys, and `grant` without `enroll` (or the
+    reverse) refuses `invalid-request`. The `host.sudo` block reads `#hostAccess` in place of `b.hosts`
+    and the role's `hosts`, and an undefined `target` still refuses `host-unknown`. `validArgv` and
+    `validStdin` now run after the access check, so a malformed argv for an ungranted host refuses
+    `host-not-granted` first. The enrollment block is appended to the question before `string(question)`,
+    so the 4096 cap counts it (M1). The decision's raise body carries `grant: enroll`.
+  - `decision.resolve` (new :2409): when `op` is `resolved`, `#approvedGrant` reads the decision, and a
+    `host-enroll` grant starts `#runEnrollment` from `setImmediate`, after the transaction commits. The
+    result adds `grant: 'started'`.
+
+New, all private but two:
+- `#grantEvent` (:657), the writer of guarded events. It runs the secret check, then `writeGrantEvent`.
+- `#approvedGrant` (:667), `#consumeGrant` (:678). `#consumeGrant` sits after `#approvedGrant`, not next
+  to `#consumeAuthority` as planned.
+- `#hostRecord` (:685), `#hostAccess` (:692), `#grantNotice` (:708), `#enrollFailed` (:736),
+  `#runEnrollment` (:750), `#openGrantDecisions` (:823).
+- `runEnrollment` (:745), public, a trusted entry to `#runEnrollment` for G10. No verb reaches it.
+- `reconcileGrants` (:833), public, which `runtime.mjs` calls once at start.
+- `#raiseGrant` (:866), `#hostsCaller` (:886), `#requestHosts` (:900), `#hostLinesLeft` (:964).
+
+Module level, new (:184-230): `GRANT_RUN`, `grantName`, `GRANT_EVIDENCE` (the N1 filter as SQL),
+`registrySha256`, `writeGrantEvent` (exported, the one writer of guarded events, which test fixtures use
+for F1), `HOSTS_VERBS`, `fingerprintOf`, `INSTALLER_COMMENT`.
+
+Unchanged: `#event`, `#spent`, `#consumeAuthority`.
+
+Other `src` files:
+- `bus/src/host-grant.mjs`, new: the keyscan, the installer key pair, and `hosts.check`'s `list`.
+- `bus/src/runtime.mjs`: builds `hostGrant`, calls `reconcileGrants` before the server starts, and adds
+  the `host_grants` references before `new Credentials` (X4 third bullet).
+- `bus/src/host-run.mjs`: `runHost` takes `command`, sent as is in place of the sudo argv, for the
+  installer's `list`.
+- `bus/src/server.mjs`: the `hosts.*` verbs and a raise with `grant` go down the async path.
+- `bus/src/store.mjs`: the 3i-3j step, `SCHEMA_VERSION` 3j. `bus/src/credentials.mjs` exports
+  `privateDir`.
+- `business/src/business.mjs` and `business/src/hosts.mjs`: the loader refuses `hosts` (S1).
+  `checkHosts` and `checkHostGrants` are gone.
+- `cli/src/hosts.mjs`, new, routed from `cli.mjs` and `scripts/mosaic`.
+
+## Decisions taken in the build
+
+- **`#hostAccess` binds the agent and the host.** X4 says the Approve record check passes when the
+  decision is an approved `host` grant with a `grant.host` consume. The check also requires the grant's
+  `agent` to equal the session's role and its `host` to equal the requested host. Without that, an
+  approved grant for one agent and host would vouch for any `host_grants` row that names its decision.
+  Cost: none for row b, whose executor writes the row from the same grant.
+- **Store fixtures are written the real way.** `bus/tests/host-fixtures.mjs` inserts the decision rows by
+  SQL, but every guarded event goes through `writeGrantEvent`, so the trigger sees it (F1). An enrollment
+  fixture writes `grant.host.enrolled`, or the start reconcile reads it as interrupted.
+- **The resolver test for host kinds is gone.** `business/tests/hosts.test.mjs` lost its D5 case, because
+  the loader now refuses `host.<id>` credential refs. The `isHostKind` filter in `business/src/resolve.mjs`
+  can't be reached now. I left it in, since row b may want it back, and it's one line.
+- **Store before Credentials.** The runtime already opened the store before `Credentials`. The
+  `host_grants` references depend on that order, and the comment there says so.
+- **CLI.** `mosaic hosts` prints tab lines, and `--json` prints the bus rows. Usage errors exit 4 and bus
+  refusals exit 2, as `mosaic credentials` does. There is no enroll command: enrollment is the chief's raise.
+- **Host tools tests live in the bus suite.** `bus/tests/host-tools.test.mjs` loads the writer by path
+  through a Python harness under `python3 -B -I`. The harness passes its own key dir, config dir, owner
+  uid and user, group and sudo lookups, and runs `mosaic-keys` from a copy with stub `sudo` and `logger`.
+  The gate runs the bus suite, so G16 and G25 run there. The real `pwd`, `grp` and `sudo -l` paths are
+  checked on the #433 VM, not here. The test also runs `visudo -c` on the sudoers file and `sshd -T` on
+  the drop-in.
+- **Writer details the design left open.** The `from` file must hold exactly one value matching
+  `[0-9A-Za-z.:/*?!_-]+(,[0-9A-Za-z.:/*?!_-]+)*`, so it can't close the quote. `users`, `privileged` and `from` must be
+  regular, owned by the owner uid and not group or world writable, and are opened without following a
+  symlink. Lines starting with `#` are comments. A refusal exits 1 with its code on stderr and in syslog.
+  `add` of a tag that is already there exits 0 and writes nothing.
+- **`runEnrollment` is public for G10 (duckworth-0081 B1).** G10 needs a second start for a spent
+  decision, and the resolve path can't give one: a second resolve refuses `decision-closed`
+  (broker.mjs:2416) before the executor runs. So
+  `#runEnrollment` returns its code (`enrolled`, `host-enrolled` or the refusal), and a public
+  `runEnrollment` calls it, as `reconcileGrants` is public. The test checks a spent
+  decision gives `decision-consumed`, and an open or agent-resolved one gives `not-authorized`, with
+  nothing written. That second case also reaches the `via` and `by` checks in `#approvedGrant`, so A3 is
+  no longer vacuous (N1).
+  Who can call it (sage-1692): only code holding the `Broker` object, which is the bus process and the
+  tests. The one `new Broker` in `src` is `runtime.mjs:126`, and no `src` file calls `runEnrollment`;
+  the resolve path calls the private `#runEnrollment` from `setImmediate` (broker.mjs:2445). A seat
+  holds no `Broker`. It reaches the bus only over `broker.sock`, where `server.mjs` calls a fixed set of
+  methods by name (`request` at :134 and :140, `identity`, `disconnect`). `request()` routes on the verb
+  through the `#dispatch` switch, and neither file looks a method up by name (no `this[` in either), so no
+  verb string can reach `runEnrollment`.
+- **A `sudo -l` that times out refuses `user-sudo` (N2).** `_sudo` returns an empty answer on
+  `TimeoutExpired`, which isn't the expected line, so `main` logs the refusal and exits 1.
+- **Keyscan comment (N3).** A scan that can't start refuses `host-failed`. One that runs and finds no key
+  returns no lines, and the raise refuses `host-key-mismatch`. The comment in `host-grant.mjs` now says so.
+- **No tag on in-run `grant.failed` (N4).** r6:578 tags only the `interrupted` one, so the code follows it.
+- **Run sheet (N5).** The writer refuses `config-privileged` when the file is missing, so each host needs an
+  empty, root-owned `/etc/mosaic-keys/privileged` (0644) before the first enrollment.
+
+## Mutant results (Sage's slot, 2026-10-21)
+
+All 25 killed: A1 to A23, with A3b added for duckworth-0083 N8 and A22 split into A22a and A22b. The
+runner is `mutants.py` outside the repo. Each mutant gets its own session, a 420 s limit with a group kill,
+and a byte restore checked against git status. None hung. Run 1 (04:24Z, on 95f966b1c) killed A1 to A22a
+and stopped at A22b, which survived. Run 2 (04:43Z, on 097892741) killed A22b and A23.
+
+- Each kill comes from a named assertion in the mutant's own test files, except A9. Dropping the `hosts`
+  primary key leaves `host_grants`' foreign key with no parent key, so the store refuses to open
+  ("foreign key mismatch") and 28 of 29 tests fail at setup. That's a structural kill, not the S1 test.
+  The schema can't exist without the key (sage-1709).
+- A22b drops the actor filter from `GRANT_EVIDENCE`. The trigger can't stand in for it, because a 3i store
+  can hold a session-written grant row that the 3i-3j step keeps. The grant-migration test "A22b,
+  sage-1703" kills it (see the A22 row above).
+
+Follow-up, not in row a: G18's control calls `runHost` directly, so nothing runs `hg.check` end to end
+with a good pin (duckworth-0083 N9). The #433 VM run covers it.
+
+## Status at 097892741
+
+Done: every Split item, 1 to 8, duckworth-0081 B1 to B3, duckworth-0083 N8, and all 25 mutants killed.
+
+Single files in the slot, all exit 0, 178 pass and 0 fail by an awk sum over 23 logs: bus grant-enroll
+24, host-run 24, grant-migration 6, host-tools 6, account-migration 3, chief-of-staff 18,
+comment-migration 5, hard-waits 13, name-migration 1, project-runtime 3, spec-migration 1,
+thread-migration 3, usage-migration 1, project-files 8, spec-socket 6, spec-review 12, land 17, spec 4;
+harness spec-tools 2, raise-domain 2; business hosts 4; cli hosts 5; seat sandbox 10.
+
+Left: Sage runs the whole bus, business and cli suites and every `scripts/test-*.sh` at the landing gate,
+after Duckworth approves.
+
+## Round 3 (sage-1742): two tests that count the schema
+
+The landing gate failed `packages/bus/tests/schema.test.mjs:522`. It counts the tables and triggers that
+`schema.sql` creates, and row a adds two tables and a trigger, so the counts go from 16 to 18 tables and
+from 70 to 71 triggers. My singles didn't run it because I took it for a test of other rows' tables.
+
+I grepped `packages/*/tests/*` for `sqlite_master` and `schema.sql`, with `schema.test.mjs:517` as the
+positive control. That turned up one more test that would fail: T46 in
+`packages/cli/tests/stack-release.test.mjs:910`. It puts every schema table in exactly one of four lists, and
+hosts and host_grants were in none. I'd left the stack-release tests out of the r2 singles on the claim that
+they don't load the bus, but T46 reads `schema.sql`. Both tables go in its untimed list (Sage's ruling,
+sage-1745: the message_threads pattern). Neither has an `at` column. Row a writes hosts at five lines,
+and each runs in one store transaction with a `grant.*` events row, which the restore guard counts.
+`#grantEvent` (broker.mjs:657) writes that row through `writeGrantEvent` (:201, INSERT INTO events at
+:212).
+
+- :737 DELETE, in `#enrollFailed`, with grant.failed at :738. Both callers wrap it in a transaction,
+  :816 and :849.
+- :763 INSERT, in the step 1 transaction (:754), with grant.host.enroll.step at :761.
+- :783 UPDATE installer_fingerprint, in the step 4 transaction (:780), with grant.host.enrolled at :784.
+- :932 DELETE, in the hosts.remove transaction (:927), with grant.host.removed at :933.
+- :950 UPDATE state ready, in the hosts.check transaction (:944), with grant.host.checked at :951.
+
+Row a writes no host_grants rows. It only reads them (broker.mjs:695, :930, runtime.mjs:103). Row b adds
+the writes, and each must share a transaction with a `grant.*` event the same way. That goes on row
+235's carry list. The other hits pin an older schema
+(account, comment, name, spec, thread and usage migrations, chief-of-staff 3c) or count only their own
+tables (state.test.mjs:106 reads every table but pins no list, threads.test.mjs:129).
+
+hosts and host_grants are mutable by design, so the refused-labels loop above `schema.test.mjs:517` gets no
+entry for them. hosts.check updates a host to ready. hosts.remove and a failed enrollment delete the
+record. Row b updates and deletes grant records. Neither table has append-only triggers. The one new
+trigger, events_grant_actor, guards events. grant-migration.test.mjs tests it, and it killed mutants
+A20 and A21.
@@ -0,0 +1,53 @@
+# Row 212 build notes, C2-01 packages/library (#1713, Vikunja #416)
+
+## Rounds
+
+- Round 1: bdf18272a on gosalyn/c2-01, base 32b54ac3b. Webby approved it in Gitea comment 29704.
+- Round 2: d3c7bbf839d9c3bf50f154b18e7e4472fbd005ed on gosalyn/c2-01-r2, rebased onto 9b5362018 after row 232 drifted three paths (sage-1714). Webby approved it at merge scope, rev 2666 against comment 29921 (webby-0052).
+- Round 3: this commit on gosalyn/c2-01-r3, one commit on the row 234 landing c771a36f4 (sage-1736, sage-1779, mos-1160). Row 234 changed scripts/mosaic, so round 3 review covers that one file.
+
+## Round 2 merge
+
+range-diff 32b54ac3b..bdf18272a against 9b5362018..d3c7bbf83 shows one change, the context line where upstream added `credentials` to the scripts/mosaic case line. Patch-id moved from 8f80dfa3 to 175f45c6 for that reason only. All three drifted hunks keep both sides:
+
+- scripts/stack-copy.sh COPY_PATHS reads `packages/queue/src packages/library/src`. Row 232's bundle, --create, --units and instance code is unchanged.
+- scripts/mosaic runs the `library survey` exec block before the case line, and the case line keeps `credentials`.
+- packages/cli/tests/stack-copy.test.mjs adds `packages/library/src/index.mjs` to the copy file list.
+
+## Round 2 singles, evidence for the 19 paths other than scripts/mosaic
+
+Run on d3c7bbf83 in Sage's slot (sage-1723) from 2026-10-21T05:00:09Z to 05:11:29Z. The HEAD and a clean tree were checked first. The counts are an awk sum over the 23 logs: 481 passed, 0 failed, 0 skipped, 0 cancelled, and every file exited rc=0.
+
+| Package | File | Pass |
+|---|---|---|
+| library | links | 6 |
+| library | mapping | 7 |
+| library | reader | 11 |
+| library | render | 11 |
+| library | survey | 4 |
+| cli | app | 30 |
+| cli | case2-unit | 30 |
+| cli | credentials | 5 |
+| cli | host | 42 |
+| cli | instances | 5 |
+| cli | project | 4 |
+| cli | stack-copy | 16 |
+| cli | stack-instances | 23 |
+| cli | stack-release-external | 25 |
+| cli | stack-release | 192 |
+| cli | tester-reads | 6 |
+| cli | tester-threads | 5 |
+| cli | usage | 2 |
+| queue | dispatch | 4 |
+| runs | task-cli | 9 |
+| webui | pinned-copy | 10 |
+| webui | service | 31 |
+| webui | views | 3 |
+
+The file list comes from the library tests plus every test that names scripts/mosaic or stack-copy.sh, by basename and by join() path. No 64-hex pin in the tests names a merged path.
+
+## Round 3 scripts/mosaic
+
+The only path both row 234 and this row change is scripts/mosaic. Row 234 added `hosts` to the cli case line and changed nothing else in the file. Round 3 takes the landed blob cce1fdee4 and adds this row's six-line `library survey` block before the case line by hand, so `hosts` stays. The mode stays 100755. The other 19 paths are byte-identical to d3c7bbf83. Against d3c7bbf83 the only difference is the `hosts` context line.
+
+Round 3 runs only the tests that read scripts/mosaic, in Sage's slot. Their counts go to Sage in T3 and onto #1713, since this file can't hold them and stay one commit. Those tests are library survey, cli app, case2-unit, credentials, hosts, host, instances, project, stack-copy, stack-release, stack-release-external, stack-upgrade, tester-reads, tester-threads and usage, queue dispatch, runs task-cli, webui pinned-copy, service and views, plus scripts/test-queue.sh. hosts.test.mjs is new with row 234.
@@ -0,0 +1,104 @@
+# Row 230: C2-13a unit render and host precheck
+
+Gitea #1732. Vikunja #416 (track T2). Brief: docs/plans/2026-10-20_case2-rows.md, section "C2-13a",
+blob f6b4933f0f47 (01b40d357, sage-1562). Base: 00d4cc1f6 (row 190). Reviewer: Webby. Gate: the cli
+suite plus every scripts/test-*.sh.
+
+## What ships
+
+`scripts/case2-unit.sh` renders `[email protected]` and `mosaic-webui.service` from the two existing
+templates into the system unit directory, for the default instance only. It writes each unit through
+a temp file at mode 0644, runs `daemon-reload`, enables both units, starts the bus and then the
+Console. If the bus fails to start, the script refuses and leaves the Console unstarted. Both units
+get `WantedBy=multi-user.target`, and neither gets `After=` or `Wants=`. The script never links a unit
+file into place. A re-install refuses unless each installed unit passes the same checks, both units
+name one copy, and each equals the render apart from the copy id.
+
+`--profile library` (the default) refuses `--pm`, `--claude`, `--tester-port` and `--sso`, and needs
+the preview proxy flags plus the proof pair. `--profile factory` refuses the six proxy flags and takes
+`--pm` and `--claude`. Both refuse `--checkout` and `--board`.
+
+`scripts/case2-precheck.sh --business ID [--profile factory|library]` runs as `<user>`. It prints one
+`ok` or `REFUSED` line per check and exits 1 if any check refused. It prints variable names only,
+never values.
+
+`packages/cli/README.md:713` now says nothing creates the session env file, only the Case 2 precheck
+reads it, and the precheck prints only variable names (webby-0034 N2, webby-0035).
+
+## Deviations for review
+
+Sage accepted all six for the build (sage-1570). Webby rules on each.
+
+1. The precheck takes `--business ID`. The brief names no other way to find the business file.
+2. A run root `<dataRoot>/launches/<business>` that doesn't exist passes, with a note that the first
+   launch creates it at 0700 (session.mjs:47 and newRun). A symlink refuses, and so does an existing
+   entry that isn't a 0700 directory.
+3. The claude marker check passes when the reply holds the marker and input plus cache tokens are at
+   most 2000. **The 2000 ceiling is unmeasured.** The tests use fakes at 40 and 9000 tokens. Measuring
+   it on a real claude belongs to row 195's install run, not this row.
+4. A non-root test can't create a root-owned proof file. For the "proof not owned by the user" case,
+   the fake getent reports another uid for the user, so the user's own file reads as someone else's.
+5. The unit script refuses `%h` left in any unit, rendered or installed. A system unit expands `%h`
+   to root's home. The render replaces every `%h`, so the test edits an installed unit to reach it.
+6. With `--auth-header X-Authentik-Uid`, the allowed user must be 64 lower-case hex characters (lead
+   decision 101). The test covers both the refusal and the pass.
+
+## Tests (packages/cli/tests/case2-unit.test.mjs, 30 cases after round 2)
+
+The tests use a scratch unit directory and a scratch home, plus fake systemctl, getent, sudo, id,
+node, bwrap and claude. They never touch /etc/systemd, ~/.mosaic-dev, ~/.config/mosaic-dev or a
+live unit. Every precheck case asserts its output doesn't hold the fixture key.
+
+- Unit: the clean library render, PATH for a node outside the default list and for /usr/bin/node, the
+  systemctl order, a failed bus start, no `systemctl link`, factory `--pm` and `--claude` rendered and
+  absent, re-install to another copy, edits to an installed unit, template restrictions,
+  EnvironmentFile placement, unknown tokens, PermissionsStartOnly and `+`/`-+` Exec prefixes,
+  symlinked unit paths, bad `--node`, re-install drift, a split copy pair, bad copy ids, every library
+  and factory flag refusal, and bad `--claude`.
+- Precheck: a good host, node older than 24, more than one group, sudo succeeding, XDG_DATA_HOME,
+  HOME mismatch, a run root mode, a bad config, bwrap failing, the port floor at or below the Console
+  port, a missing Console unit, bus.tester per profile, profile-library-business, the claude check
+  (no route, replaces, appends, missing, the unit's MOSAIC_CLAUDE_BIN beating PATH), and the session
+  env file (missing, 0644, symlink, empty, emptied by a later line, quoted).
+- Bind (mos-1100): inside `binds()` plus `sandboxArgv()`, a bind on port 980 gets EACCES, and a bind
+  on a free port of 1024 or above succeeds. The test fails if the host's floor is at or below 980.
+
+## Verification
+
+Round 1 singles, run before the gate: case2-unit.test.mjs passes 28/28 with no skips, and host.test.mjs (it
+reads the cli README) passes 42/42. No test pins a hash of the README. No other test reads the two
+scripts.
+
+## Round 2 (webby-0046, sage-1589, sage-1590, sage-1591)
+
+Base: origin/refactor (rebased from 00d4cc1f6; the 15 commits between touch none of the five paths
+or the two unit templates). Branch gosalyn/c2-13a-r2.
+
+B1. The precheck now has a case for each refusal Webby named: the user missing from passwd (:77),
+a business file that is unparsable, missing or fails the schema (:137), a run root that is a symlink
+to a 0700 directory (:151), a Console ExecStart with no --port (:179), an unreadable port floor
+(:180), a claude reply without the marker (:223) and a claude reply that isn't JSON (:224). The fake
+claude gained `nomarker` and `text` kinds. The no-claude-code case and the missing-claude case share
+a PATH without `/usr/bin/claude` (`pathWithoutClaude`), so the no-claude-code case now shows a host
+with no claude passes.
+
+N1 (ruled in for this round). Before writing, `case2-unit.sh` asks `systemctl is-active` for both
+units. For each unit that was running, it prints that the unit is still on its old copy, never
+"started", and then that the bus and Console must restart together to reach the new copy. A unit
+that wasn't running gets "started ... on copy". A fresh install prints the round 1 line. The script
+still restarts nothing. The new test covers both units running and only the Console running.
+
+N4. The README line at :713 is rewrapped.
+
+Mutants, run in Sage's slot on a scratch worktree, one branch each: :77, :137, :151, :179, :180,
+:223, :224, a precheck that refuses with no claude on PATH (for the no-claude-code case), and an
+install that prints "started" for a running unit (sage-1591).
+
+## Carry items for row 195
+
+- N1's restart. Row 195 restarts the bus and Console together after a re-install over running
+  units, as the install line now asks.
+- N2. A system drop-in check like `bus-service.sh:122-145`, so a drop-in under
+  `[email protected]/` or `mosaic-webui.service.d/` can't change what the checked unit runs.
+- N3. The precheck finds claude on the shell PATH. The bus unit's `PATH=` is what a session uses
+  when `MOSAIC_CLAUDE_BIN` is unset, so the check should search that PATH.
@@ -1,757 +0,0 @@
-# Row 194 build notes
-
-Design r4 approved: DESIGN.md sha256 824ef884 at 7d0788236 (Webby webby-0014, review at e1e64ff01 on
-webby/reviews; Mos mos-1042; Sage sage-1387 "build now"). Build base: refactor aa1bd209e merged into
-honker/row194 at fa9eaa4c3.
-
-## Build notes from the approval (each gets a test and a mutant)
-
- W-N1 (webby-0014 N1): launch refuses `instance-firing` while I has a `fire.stopped` with no `fire.done`.
-  Test case in T9c. Mutant M59: the check is dropped.
- W-N2 (webby-0014 N2): the broker's hire-time check requires roleVersion 2, so a definition with no
-  action lists refuses. Test case in T8b. Mutant M60: the version check is dropped.
- Grace (sage-1387): 5 s, one constant shared with row 191.
-
-## Chain state (2026-10-20T19:45Z)
-
-Rows 190, 191 and 193 have no product commits yet (rocko/row191 and darkwing/row190 sit at da230ca48, the
-brief commit). Slices that don't need row 191 build first. S6 waits for row 191's candidate.
-
-## Slices
-
-| Slice | Scope | Tests | State |
-|---|---|---|---|
-| S1 | business: vocabulary (role.hire, role.fire hard waits, HIRE_ALLOWED), role.mjs `hireable`, business.mjs keep/noHire/retired, instance-settings delete and veto ops, chief-of-staff.json `hireable: []` | T6 (business), T7, T8c, T17, D2.2 writer | done, see below |
-| S2 | bus: reloadBusiness and runtime callback, instance.launch/end/regenerate requests, instances.set delete, veto.set, instance.hire/fire, keep checks, D4 hook, tester checks | T8-T10, T9c, T12-T14, T18 | S2a (D3), S2b (veto, hook, keep, T13), S2c (requests, terminate, delete) and S2d (hire, fire, W-N1) and S2e (PRD 1.7 routing, sage-1471) done |
-| S3 | cli: launcher lifecyclePass, host ops, `business instance` verbs | T1-T6, T11 | S3a (launcher pass) and S3b (verbs, veto, end to end, T2a, T4, T6, T11) done |
-| S4 | harness: launch tool schema, hire and fire tools | T8 (D3 item 5) | done, see S4 notes |
-| S5 | webui: Agents section and routes | T16 | done, see S5 notes. The "still running after fire" flag waits for S6 |
-| S6 | row 191 chain: halted checks, fire SIGKILL through row 191's stop | T9a, T9b, T15 | waits on row 191 |
-| S7 | brief item 7 (rev 2547, sage-1586): a created agent's credential entry, the restart route | T19 (new) | waits on row 199 landing, see item 7 plan |
-| S8 | brief item 8 (rev 2556, sage-1588): fire and delete revoke the agent's credentials before the file changes | T20 (new) | waits on row 199 landing, see item 8 plan |
-
-## Changed assertions (D3 item 4, N4)
-
-Listed here as the build changes them.
-
- `packages/business/tests/instance-settings.test.mjs:53, :67, :72`: the row 165 read and add views
-  gain `kept: false` (D1, the read gains `kept` per instance). No other field changed.
- `packages/business/tests/instance-settings.test.mjs:70` (`added.restart` true to false) and `:91`
-  (`redefined.restart` true to false): the writer no longer asks for a restart. The bus decides,
-  after its reload (D3 items 2-3). The two test names say so.
- `packages/cli/tests/instances.test.mjs`: `setup` boots the bus from the file through `bootConfig`, as
-  the unit does, instead of a one-role stub. The add test (T1) now expects the "no restart" line and
-  binds `sec-1` on the running bus. The `RESTART_NEEDED` text pins moved, unchanged, to a new test that
-  boots the old stub (`setup(t, { stub: true })`). Its coder has no credential references and the
-  file's has, so the bus doesn't reload, prints `RESTART_NEEDED` and doesn't bind `sec-1` (D3 item 3).
- `packages/webui/tests/instances.test.mjs:25`: the fake writer's default answer is `restart: false`,
-  the usual answer now. The real-broker test boots through `bootConfig` and expects `restart: false`
-  (`:71`) and the log line `done restart=false` (`:74`). The answer-shape rows at `:140-145` keep
-  `restart: true`. Each row tests another field, or `restart: 'yes'`, so the value is not what they
-  check.
- `packages/bus/tests/instances-verb.test.mjs` T12 (S2c): the human delete now answers `{request}`
-  where S2b refused `invalid-request`. The stub writer answers `instances.check` with the revision,
-  and the calls list gains that one check, actor `jason`. Nothing else in the test changed.
- `packages/bus/tests/tester-writes.test.mjs:19` (row 175 pin): TESTER_VERBS gains `instance.launch`,
-  `instance.end` and `instance.request` (D4.1). TESTER_ORGANIZATION_VERBS is unchanged.
- `packages/bus/tests/instances-verb.test.mjs:78` keeps `restart: true`, now for a D3 item 3 reason:
-  its boot copy is a stub without the file's credential references. A comment there says so.
-  `reload.test.mjs` covers the reload from a file boot.
- `packages/bus/tests/hard-waits.test.mjs:38` (S2d): the every-hard-wait loop gives `role.hire` and
-  `role.fire` a target and `arguments`, which their raise now requires (D2.1). The class and route it
-  checks are unchanged.
- S2e (PRD 1.7 REQ-COS-3) takes back the S2d entry above. `role.hire` and `role.fire` left the hard
-  waits, so `packages/bus/tests/hard-waits.test.mjs` and `packages/business/tests/hard-waits.test.mjs`
-  drop them from WAITS, and the bus file's every-hard-wait loop is back to its S2c form. The business
-  file gains a test that both are routed and not in GATED_ONLY.
- `packages/bus/tests/reload.test.mjs` (S2e): its hard-wait example used `role.hire`, now routed. It
-  uses `spend`. The check is unchanged.
- `packages/business/tests/chief-of-staff.test.mjs` (S2e): the chief's pinned authority and the test
-  name gain `role.hire` and `role.fire`. `packages/business/tests/role.test.mjs` gains the check that
-  no other shipped role holds either.
- `packages/harness/tests/tools.test.mjs` and `packages/harness/tests/bundle.test.mjs` (S2e): the
-  chief's pinned tool lists gain `hire` and `fire`. Every held action needs a typed tool
-  (`untypedActions`), so the tools come forward from S4.
- `packages/bus/tests/chief-of-staff.test.mjs` (S2e): the S2d decision-form tests are rewritten to the
-  reason form (below). The S2d raise tests with `arguments` are gone with the key.
- `packages/bus/tests/lifecycle-verbs.test.mjs` V5 retry (S3a): `lifecycleDelete` on a retry now
-  answers `{transaction, retry: true}` with the failed delete's transaction, where S2c answered
-  `{transaction: null, retry: true}`. The launcher needs it to name `.retired/I-<transaction>`. The
-  test checks the value and that the retry still neither checks nor writes the file.
- `packages/harness/tests/tools.test.mjs:48` (S4): the launch tool's `instance` was an enum of the
-  start-time listing. It is now `{type: "string", description, pattern: ID_PATTERN.source}`, and the
-  listing moves to the tool description, which the test matches. `:107` (the pm test's chief check)
-  asserts there is no enum and the description names `chief.launch.instances`.
- `packages/business/tests/chief-of-staff.test.mjs` (S4): the contract test gains a match on the new
-  sentence that a hire is listed for `launch` at once but runs only after the human sets its route.
-
- `packages/webui/tests/browser.test.mjs:21-22` (S5): the page's script list pins the scripts in
-  order. It now has `/agents.js` between `/chat.js` and `/bus.js`, and the comment names row 194.
-
-## S1 notes
-
- Tests: `tests/lifecycle-settings.test.mjs` (new) holds T6's business part (V5 order, last listed,
-  clean delete, retired refusals for add and hire), T7 (V6) and the writer's hire and fire (D2.2).
-  T8c is in `role.test.mjs`, T17 in `business.test.mjs`.
- `deleteRefusal`'s entry half (`entry.tracker`, `entry.credentials`) follows V5's wording "holds
-  credentials or a tracker bot". In a file that validates it is the same as the definition check: a
-  definition with no credential refuses an entry tracker or credentials at load. So no test reaches it
-  alone, and no mutant is listed for it.
- END_PROTECTED is `assistant` only. The chief's own instance refuses delete and fire as
-  `organization-instance-referenced` (launch.by), not as protected.
- The writer refuses an `assistant` hire `organization-definition-refused` through `definitionFor`, as
-  row 165's add does.
- PRD draft: 69544f342 (sha256 c1f52d98…), sage-1395: adding to the fixed list is a PRD change.
-
-## S2a notes (D3 live reload)
-
- `Broker.reloadBusiness(id, doc)` runs the boot check (`checkBusiness`, moved out of the
-  constructor unchanged) on a clone, then refuses a changed `human` and swaps the document in.
- The runtime reloads after every committed write, through the chain `bootConfig` uses
-  (`loadBusiness`, `resolveInstance` with `organization.system`, `busBusiness`). Then `limits.refresh`
-  runs. `instances.set` answers `restart: !live`. Any other verb name now throws `invalid-request`
-  where it used to fall through to `plugins.set`.
- D3 item 3 check: a role in the boot copy must keep its credential references and tracker bot. A role
-  not in the boot copy must have neither. The tracker sync block must match. Otherwise no reload and
-  `restart: true`. The first version compared one fingerprint over all roles, so every create failed
-  it. T14's create test caught that.
- Consumers checked against item 3 (`runtime.mjs` startBroker):
-  - The Credentials store takes the role and sync references and the project roots it protects at
-    start. The tasks adapter takes the bots at start. All of these are compared.
-  - Limits read `settings.current` at each ask. The human proof reads `human` from the boot copy,
-    and `reloadBusiness` refuses a changed human, so the two agree.
-  - Web grants: the broker reads `roles.<I>.web` from its own document (`broker.mjs:1545`), so a
-    reload carries the grant. A hireable definition has no `web` tool.
-  - Usage loads its `usage-source` plug-ins from `b.plugins` at start. That was already so before
-    this row (`plugins.set` never restarted them). A reload doesn't change it, and it isn't compared.
- Instance-running: `instances.set` op change with a `definition` on a declared instance with a
-  claim holder (or thread holders for a thread instance) refuses `instance-running` before the
-  writer. A vars or launch change still passes.
- Tests: `packages/bus/tests/reload.test.mjs` (T14, 6 tests).
-
-## S2b notes (veto.set, the D4 hook, keep checks)
-
- `LIFECYCLE_HUMAN_VERBS` (exported from `broker.mjs`) has one entry per verb and per `instances.set`
-  op: `instance.launch`, `instance.end`, `instance.regenerate`, `veto.set`, `instances.set add`,
-  `instances.set change`, `instances.set delete`. Choice: `#mayHuman(s, verb, target)` refuses
-  `human-required` for an entry missing from the list. So the list and the calls can't drift apart,
-  and T12 shows the hook got the exact entry: each listed human call passes. The tradeoff is that a
-  new human verb has to join the list before it works, which is what row 193 needs anyway.
- `bindHuman` already refuses any human but the owner, so the hook's owner check can't fail on any
-  path today. It is the body row 193 replaces.
- M46 (`veto.set` skips `#human`) is equivalent while the generic check runs first: no session
-  without `s.human` gets past `human-required`, and only `bindHuman` sets `s.human`, always with
-  `via: 'cli'` and `outsideAgent: true`. T18 shows the refusal. `#human` stays as the design asks.
- `instances.set` now checks `op` in the broker (`add`, `change`, `delete`, else `invalid-request`).
-  The tester's delete refuses `tester-refused` (B6). Until S2c records the delete request, a human
-  delete refuses `invalid-request` after the hook. Without that, the writer's `set` op `delete` would
-  commit with no running or starting check and no workspace rename.
- Keep: the `role.revoke` reason branch refuses `instance-kept` for any caller, not only the chief.
-  Only the chief holds `role.end` today, so this is the same set. A caller with `role.end` added
-  later is held to the forbid too. The `organization.set` check refuses when any key of
-  `args.instances` is kept, before the writer and before the grant is spent. The human's `limits.set`
-  isn't checked: the human owns the forbid.
- T13 needed no code. `organization.set` and `limits.set` take only `ORGANIZATION_KEYS`, and
-  `limits` and `models` write only `launch.limits` and `launch.models`.
- Tests: `chief-of-staff.test.mjs` T10 (reason end, decision end, model write), T13 and T18's
-  veto.set and instances.set paths on a stub writer. T18's file-bytes check and its hire and fire
-  cases come with S2d. `instances-verb.test.mjs` T12 (sessions, tester, hook). `reload.test.mjs`
-  gains veto.set.
-
-## S2c notes (lifecycle requests, terminate, delete)
-
- A request is an `action.allowed` event, action `lifecycle.launch`, `.regenerate`, `.delete` or
-  `.end`, body `{action, request, via, by, ...}`. The human's also gets `human.input {kind: 'admin'}`.
-  The tester's gets none. Steps are `lifecycle.taken`, `lifecycle.done {request, run?, transaction?,
-  refusal?}` and `lifecycle.cancelled {request, by}`, with no role or run in the session. No new
-  table or event kind, so no migration.
- Host ops for the launcher pass (S3), each in LAUNCH_OPS: `lifecycleRequests`, `lifecycleTake`,
-  `lifecycleDelete`, `lifecycleDone`. Choice: `lifecycleDelete` commits through the bus's own
-  organization callback, so the D3 reload runs after it as after any other write. The tradeoff is
-  one more host op instead of the launcher calling the writer.
- The take re-checks: request-expired (60 s, `LIFECYCLE_REQUEST_MS`), then launch-revoked and
-  instance-retired for launch and regenerate only, then tester-off for a tester request. A refused
-  take writes `lifecycle.done` with the refusal, so the request closes. `lifecycle.end` never
-  expires: the runs it names still need the signal.
- instance-starting counts any taken request of I, and any open one still under 60 s, delete
-  included. An open request past 60 s can only close request-expired, so it doesn't count. The end
-  request doesn't count.
- Delete order at the verb (V5): keys and identifier, the 64-hex revision, the retired-name retry
-  gate, then `instances.check` (the writer's plan and validation, no write). A named organization
-  refusal fails at once. A BusinessError (the last-listed refusal) is held until instance-running
-  and instance-starting have passed, then answers invalid-request. Then revision-conflict, then the
-  request with `{revision}`. `lifecycleDelete` checks running and starting again after the take
-  (other requests only), then calls `instances.set` op delete with actor = the request's `by`.
- Retry: a retired name that isn't in roles deletes again only when its last delete closed
-  `workspace-rename-failed`. The request carries `retry: true`, and `lifecycleDelete` answers
-  `{transaction: null, retry: true}` with no check and no write. The launcher (S3) retries the rename.
- `lifecycleDone` carries `transaction`, so the delete's done names the commit the rename used.
- Terminate (V3): every claim holder of I, or every thread holder for a thread instance, is revoked
-  with the reason (default "ended by the human" or "ended by the tester"). The answer names the held
-  runs plus the bound runs of I not yet ended, cancels open requests of I and lists taken ones. With
-  none of these it refuses not-held. The tester ends only its own threads and cancels only its own
-  requests.
- The tester's business scope needs no check: its cap is bound to one business (M19), so another
-  business's instance answers unknown-role. `instance.request` needs no tester-file check: a tester
-  reads only requests it made.
- The tester switch is read through a `testerOn` option. The runtime reads `bus.tester` from the
-  live file through `settings.current`, so a change applies with no restart. Anything but `true`,
-  or a read error, is off.
- Refactor: the organization error mapping moved into `#organizationFail(e, verb)`, shared by the
-  organization verbs and `lifecycleDelete`. Same mapping as before.
- Deferred: the halted checks (S6, row 191) and W-N1 (S2d with fire).
- Tests: `packages/bus/tests/lifecycle-verbs.test.mjs` (12 tests: T12 lifecycle part, T12a, V2-V5,
-  the take and the runtime delete end to end). Probe mutants on the expiry, starting (verb and
-  take), the take's expiry and tester checks, the retry gate, the tester's own-request read and
-  not-held all died. They are not the M-list run.
-
-## S2d notes (the chief's hire and fire, W-N1)
-
- Still hard waits (PRD 1.6). Under PRD 1.7 they move to ROUTED in S2e, with the reason form.
- The raise: `decision.raise` takes `arguments`, only for `role.hire` (`{name, definition, vars?}`)
-  or `role.fire` (`{name, reason}`), and requires it for those. `target` must equal
-  `arguments.name`. The raise event records it, and the human's decision view shows it under
-  `authorization.arguments`. The shape checks are the call's (`#hireFireArgs`): identifiers, not
-  `human` or `tester`, vars only `model` and `limits.*`, reason 1-500 characters.
- The call: `instance.hire {name, definition, vars?, decision}` and `instance.fire {name, reason,
-  decision}`, from a chief session only. Order: tester-refused, read-only and agent-required
-  (`#agent`), keys, `role-not-chief` (launch.by), not-configured, decision-mismatch for a decision of
-  another business, `#checkAuthority`, the call's arguments against the raise's (canonical JSON,
-  decision-mismatch), decision-consumed, instance-kept. The writer gets the chief as actor
-  (`chief-of-staff.chief`) and the context `{instance, run, decision}`, which changes.jsonl records.
- Hire: `#hireable` loads the definition and the chief's own role file through the new `roleFile`
-  option (the runtime passes `loadRole(rolesDir, name)`). Version 1, any action off HIRE_ALLOWED
-  (`unhireableAction`), not on the chief's `hireable` list, on `noHire` or no file all refuse
-  definition-not-hireable before the writer. Then the writer's hire, then the consume with
-  `{transaction}`. Without `roleFile` a hire refuses not-configured.
- Fire, before step A: instance-kept, unknown-role, organization-definition-refused (END_PROTECTED),
-  organization-instance-referenced (launch.by), and invalid-request for the last listed name.
-  Step A, one transaction: revoke the claims with the decision and reason, cancel open requests,
-  list taken ones, write `lifecycle.end {via: 'chief', by, runs, reason, kill: true}` when runs exist,
-  and `fire.stopped {cites, request}`. Step B: the writer's fire (already delisted is done). Step C,
-  one transaction: the consume with `{reason, transaction}` and `fire.done {cites, transaction}`.
- The fire's own events cite the decision under `cites`, not `decision`, so `#spent` counts only the
-  consume. A failure at B or C leaves the decision unspent, so the repeat runs.
- Choice: a repeat after a failed B or C asks for the kill again for any run of I still bound. A
-  revoked run stays bound until the launcher reports it ended, and a second signal to a dead
-  process does nothing. The tradeoff is a duplicate `lifecycle.end` against a run that may outlive
-  the first one.
- W-N1 `#firing`: a `fire.stopped` with no `fire.done` for the same `cites`. It refuses
-  instance-firing at the human and tester verbs (`#launchable`), at the take of a launch or
-  regenerate (`#takeRefusal`), and at the chief's `role.launch` (`#authorityFor`).
- `#organizationFail` passes the writer's own definition-not-hireable and instance-kept through by
-  name for hire and fire. They come from the file as it stands, after the broker's checks passed.
- `lifecycleView` shows `kill: true` when the request carries it.
- Deferred: the kill escalation in the launcher (S3, S6).
- Tests: `packages/bus/tests/chief-of-staff.test.mjs`, 16 new (T8 x5, T8a, T8b x2, T9 x2, T9c x2,
-  T10, T18, the runtime end to end, W-N1 at the take). 39 in the file pass. Probe mutants on 21
-  lines (the arguments check, each W-N1 site, M60's version check, keep, the other-business check,
-  last-listed, kill, the chief's list, noHire, role-not-chief, the pre-check consume, both consumes'
-  events, the raise's argument rules, the revoke, the cancel, the pass-through, the view's kill) all
-  died. They are not the M-list run.
-
-## S2e notes (PRD 1.7 REQ-COS-3 routing, sage-1471, mos-1089)
-
- Role-policy change, for Webby to review on its own: `roles/chief-of-staff.json` withinRole gains
-  `role.hire` and `role.fire`. `packages/business/src/vocabulary.mjs` and `packages/bus/src/broker.mjs`
-  move both from the hard waits to ROUTED. `roles/chief-of-staff.md` and `roles/pm.md` drop them from
-  the hard-wait list, which `workflow-roles.test.mjs:113` pins to GATED_ONLY. No other shipped role
-  gains either action, and `role.test.mjs` pins that.
- The call takes the reason form, as `role.end` does: `instance.hire {name, definition, vars?, reason}`
-  and `instance.fire {name, reason}`, with no decision. The reason is 1-500 characters for both.
- Choice: the decision form is gone, not kept beside the reason form. A within-role raise closes at
-  once, so a decision there adds an event and no check. The `decision.raise` `arguments` key from S2d
-  goes with it. Tradeoff: if a later PRD gates hire again, the raise path comes back as new code.
- Choice: hire takes a reason too. The PRD logs every hire and fire with its reason.
- Order: tester-refused, read-only and agent-required, keys, `role-not-chief` (launch.by),
-  not-configured, `#checkAuthority` with `{target: name}`, instance-kept. `role-not-chief` comes before
-  the authority check, so a non-chief role refuses `role-not-chief` even when its file grants the
-  actions. A chief whose file lacks the grant refuses `decision-required`.
- The writer gets only its own keys. The reason goes in the change context `{instance, run, reason}`,
-  which changes.jsonl records. The hire's consume detail is `{reason, transaction}`.
- W-N1 `#firing` now goes by order, since the reason form has no decision id: a `fire.stopped` of the
-  subject with no later `fire.done` (`seq` after it) for the same subject. `fire.stopped` carries
-  `{action, request}` and `fire.done` `{action, transaction}`.
- Harness: the typed `hire` and `fire` tools (verbs `instance.hire` and `instance.fire`) come forward
-  from S4, because a held action with no typed tool fails `untypedActions`. Each tool follows its own
-  grant. `roles/chief-of-staff.md` already names them. The rest of the S4 contract text and the runner
-  end to end for hire and fire stay in S4.
- Going live is a later re-pin step with Mos (sage-1471). Landing the change doesn't put it on the live
-  stack.
- Correction to S2d (found in S2e): S2d's broker imported `business/src/role.mjs`, which is not in
-  `seat/src/sandbox.mjs` RUNNER_FILES. The runner imports broker.mjs, so a session died with
-  ERR_MODULE_NOT_FOUND: cli `launcher.test.mjs` failed 15 of 29 and seat `sandbox.test.mjs` 4 of 10 at
-  089b92ca3. A bisect showed S2c passes 29 of 29. I had not run those two files for S2d. Fix:
-  `unhireableAction` moves into vocabulary.mjs, which is mounted, and role.mjs re-exports it.
-  RUNNER_FILES is unchanged, so the sandbox boundary does not widen. Rule from here (sage-1497): a
-  change to broker.mjs imports, or those of any RUNNER_FILES file, runs these four singly: seat
-  `sandbox.test.mjs`, cli `launcher.test.mjs`, cli `thread-launch.test.mjs` and cli
-  `git-socket.test.mjs`.
- Mutant (sage-1497): broker.mjs imports `unhireableAction` from role.mjs again. Killed: sandbox.test
-  fails 4 of 10 (role.mjs outside RUNNER_FILES), launcher.test 15 of 29, thread-launch 7 of 11. git-socket
-  passes 24 of 24 under it, so it does not catch this one and stays on the list for its own sandbox runs.
- Tests: `packages/bus/tests/chief-of-staff.test.mjs` S2d block rewritten to the reason form (39 pass),
-  with new tests for the reason bounds, `role-not-chief` with the grant, `decision-required` for a chief
-  without each grant, W-N1 by order, and the runtime end to end with the reason in the receipt context.
-  `packages/harness/tests/tools.test.mjs` gains the hire and fire tool shape test, and that no coder,
-  reviewer or pm gets either tool.
- Probe (not the M-list run): 16 mutants, all killed. ROUTED drops of each action in the broker and in
-  vocabulary, the role file drops of each, `#firing` without the order and without the subject, the
-  reason unchecked, the writer given the reason, the context without it, no `#checkAuthority`, no
-  `role-not-chief`, the consume without the reason, the hire tool's reason optional, and the fire tool
-  gated on the hire grant. The last one survived at first and a one-grant check in tools.test killed it.
-
-## S3a notes (the launcher's lifecycle pass)
-
- `packages/cli/src/launcher.mjs` `lifecyclePass` runs on the tick after the thread and land passes.
-  It lists the open requests (host op `lifecycleRequests`) and carries each under `serialize`: the
-  take, the act, then `lifecycleDone`. A take that answers no closes nothing more here. A refusal
-  goes in the launch log as `refused` with the request id. A done that throws leaves the request
-  taken with no done, which S3b's CLI reports as `outcome-unknown`. The log line names a run that
-  did start.
- Launch: `check()` and `start()` gain `human`. The human's request may name any declared instance,
-  as V2 asks. The listing limits the chief. launch.by still takes the `pm` branch (N8). A tester
-  request launches with `launchedBy: "tester"`.
- End: SIGTERM to each run the verb named and to any other run of the instance in the registry,
-  each after the start-time check, with a `lifecycle-end` entry. The exit handler writes the one
-  `end` record. A thread instance's end signals only the runs the verb named, so the tester's end
-  leaves the human's threads alone. No SIGKILL escalation here: that is row 191's stop (S6).
- Regenerate: the end's signals, then a wait until the old run leaves the registry, then a launch.
-  The wait runs under `serialize`, so no other start runs meanwhile. Past the request's mark
-  (`at` + 60 s, `lifecycleRequestMs` for tests) it closes `regenerate-timeout` and starts nothing. A
-  closing host closes it `host-closing`. Tradeoff: one stuck regenerate holds other starts for up to
-  60 s. The other choice, a second pass that comes back for it, needed state across ticks for the
-  same result.
- Delete (V5 steps 1-3): `instance-running` against the registry first, then `lifecycleDelete` (the
-  writer's commit), then the rename of `workspaces/<b>/I/` to `workspaces/<b>/.retired/I-<tx>/`,
-  both 0700. The file goes first, so a failed rename can't leave a launchable name on the old
-  workspace. A failed rename closes `workspace-rename-failed` with the transaction. A later delete of
-  the name is the retry, and the broker now answers the failed transaction, so the rename target is
-  the same (changed assertion above). No workspace means nothing to rename.
- `--no-launch` (row 163): the ticker now runs on a no-launch host, but only the lifecycle pass, and
-  `act` closes each request `launches-disabled` before any signal, start or rename. The thread and
-  land passes stay off, so `launcher.test.mjs`'s no-launch tests pass unchanged.
- Tests: new `packages/cli/tests/lifecycle.test.mjs`, 9 tests on the in-process host of
-  thread-launch.test.mjs, with ticks called by the test: T2 (unlisted and launch.by launches, a
-  request past 60 s, a check refusal with its code in the log), T3 (`--no-launch`, `capacity-full`
-  with the limit in the log, `instance-running`), T4 (end at the verb, the signal, one end record,
-  the cancelled request never runs), T5 (a new run on the same workspace, `regenerate-timeout`
-  with a SIGSTOPped runner, `regenerate-thread` at the verb), V5 (a failed rename then the retry,
-  modes 0700, no workspace).
- Singles at S3a: seat sandbox 10/10, cli launcher 29/29, thread-launch 11/11, git-socket 24/24,
-  bus lifecycle-verbs 12/12, cli instances 6/6, cli lifecycle 9/9, bus process 8/8. broker.mjs
-  imports did not change, and the four must-run files ran anyway.
-
-## S3b notes (the CLI verbs)
-
- `packages/cli/src/instances.mjs`: `business instance launch|regenerate BUSINESS I [--wait S]
-  [--tester]`, `terminate BUSINESS I [--reason TEXT] [--tester]`, `delete BUSINESS I --revision REV
-  [--wait S]` and `business veto BUSINESS keep|unkeep INSTANCE|nohire|hire DEFINITION --revision
-  REV`. `--wait` takes 0 to 600 s and defaults to 30. Every usage error exits 4 before any bus call.
-  add and set refuse `--wait` and `--reason`.
- Launch, regenerate and delete print the request id on stderr, then poll `instance.request` every
-  200 ms. Closed with a run or a transaction prints it and exits 0. A refusal prints its reason, the
-  request id and any transaction. A cancel prints who cancelled it. Still open at `--wait` says so and
-  names the 60 s expiry. Taken with no done is `outcome-unknown` and points at the launch log.
-  Terminate doesn't wait: it prints the revoked runs, the cancelled requests and any taken request
-  past cancelling.
- Exit codes: every lifecycle outcome that isn't done (refusal, cancel, still open, outcome unknown)
-  exits 3, as the design's `--wait` timeout does. Tradeoff: errors.mjs has 1 for an unknown outcome
-  elsewhere. One code lets a script treat "the request did not do it" as one case, and the message
-  says which. A refusal at the verb keeps the transport's code (2), as add and set do.
- The bus `instances` read gains `running` per instance (`#running`, from the claims), so the CLI
-  and S5 can show it without a second verb. An answer with no instances map passes through as
-  before. `bus instances-verb.test.mjs`'s stub writer answers `{ok: true}` and caught the first
-  version, which threw. The CLI view marks `kept` and `running r1, r2` and adds `retired:` and
-  `the chief may not hire:` lines.
- `scripts/mosaic` sends `business veto` to packages/cli with instances and instance.
- Tests: cli `instances.test.mjs` +8: the V6 veto ops and kept-delete refusal, the `running` read,
-  launch and regenerate printing the run, a closed refusal with its id (exit 3), `--wait 0` still
-  open and taken `outcome-unknown`, request-cancelled, terminate output and `not-held`, delete to
-  its transaction and `workspace-rename-failed` naming it, usage errors (exit 4, no call), and the
-  scripts/mosaic veto route. The existing route test gains the veto assertions. cli
-  `lifecycle.test.mjs` +5: the CLI end to end through the pass (launch, regenerate, `capacity-full`
-  with the request id, terminate, delete), T2a (`launch-revoked` at the take with no process, a
-  done that fails once leaves the request taken and the next pass starts nothing), T4 (a spawned
-  run the bus never bound is signalled, a mismatched start time is not), T6 (run evidence bytes
-  unchanged by a delete, the launch log only grows, a create and a launch of the retired name
-  refuse), T11 (two roots with business `acme`: a launch, a terminate and a delete in one leave the
-  other's files byte-identical). bus `chief-of-staff.test.mjs` +1: T11's bus half, a chief on a bus
-  with two businesses hires and fires only in its own.
- Not covered here: T6's `instance-starting` and the V5 refusal order are bus tests from S2c.
-  `check()` refusing a retired name is shown through the verb and the take, since `check()` reads a
-  file that no longer lists the name.
- Singles at S3b: cli instances 14/14, cli lifecycle 14/14, bus lifecycle-verbs 12/12, bus
-  instances-verb 3/3 (after the fix), bus chief-of-staff 40/40, webui instances 5/5, seat sandbox
-  10/10, cli launcher 29/29, thread-launch 11/11, git-socket 24/24, usage 2/2, project 4/4, app
-  30/30, host 42/42, tester-threads 5/5, tester-reads 6/6, stack-copy 12/12, queue dispatch 4/4,
-  runs task-cli 9/9, webui pinned-copy 10/10, service 31/31, views 3/3. The broker change adds no
-  import. The four must-run files ran while the `instances` guard was being written, and the guard
-  touches only the read. No test pins a hash of scripts/mosaic.
-
-## S4 notes (the launch tool takes a hire, D3 item 5)
-
- `packages/harness/src/tools.mjs`: the launch tool's `instance` is a string with the ID_PATTERN
-  pattern, not an enum fixed when the bundle was built. The start-time listing stays in the
-  description. The host checks the listing at each launch (`instance-not-listed`), so the chief
-  launches its own hire in the same session. The hire and fire tools came forward in S2e.
- The runner does not enforce a tool's schema pattern. A bad name reaches the host and refuses
-  `instance-not-listed`, so the end-to-end test asserts that. M15 (the enum kept) is killed by the
-  tools.test shape assertion, not by the end-to-end test.
- `packages/cli/tests/lifecycle.test.mjs` gains the T8 end to end: the chief's session hires
-  `sec-2` (definition chief-information-security-officer, the shipped definition `hireable` accepts:
-  message.send and record.write, no credential) with `TOOL hire`, a launch refuses `no-route`, the
-  human sets the route with `instances.set` op change, the same session launches it (launchedBy
-  chief), `NOT A NAME` and `reviewer` refuse `instance-not-listed`, then `TOOL fire` ends its run,
-  leaves it `launched: false` and a later launch refuses `instance-not-listed`.
- Route gap, raised with Sage (honker-0027): harness, model and thinking are agent-layer vars
-  (`business/src/vars.mjs:142-147`) and hire vars allow only model and limits.* (N3). So a hire runs
-  only after the human sets harness and thinking. D3 item 5 says the same session launches it, and
-  it does, after that human step. Letting hire vars carry the route would widen the chief's
-  authority, a policy change that is not mine to make. As built the human step stays, and
-  `roles/chief-of-staff.md` says so. Sage ruled (b) in sage-1521: the human route step stays, and
-  the manifest notes say that launch refuses `no-route` until the human sets the route.
- sage-1521 also keeps exit 3 for every lifecycle outcome but done (outcome-unknown included, the
-  S3b tradeoff line above stands for Webby) and the S3a choices (a `--no-launch` host runs only the
-  lifecycle pass, `lifecycleDelete` answers the transaction on a retry). `roles/chief-of-staff.md`
-  is role policy: the manifest names it and the review request flags it as a policy change.
- `roles/chief-of-staff.md` (role policy, named in the manifest): one paragraph on the hire's route
-  step and on a fired instance staying in the file off the list.
- Singles, each run alone: business chief-of-staff 10/10, spec-review-contracts 3/3, role 19/19,
-  resolve 10/10, harness bundle 22/22, tools 23/23, runner 34/34, pi-session 8/8, seat sandbox
-  10/10, cli launcher 29/29, thread-launch 11/11, git-socket 24/24, lifecycle 15/15, webui reads
-  11/11. No test pins a hash of tools.mjs or roles/chief-of-staff.md. tools.mjs gains an import from
-  vocabulary.mjs, already in RUNNER_FILES, and the four must-run files passed after it.
-
-## Rebase onto row 192 (2026-10-20T22:10Z)
-
-Row 192 (4429a104f, Q175 phase 1 SSO) changed webui `serve.mjs`, `cli.mjs`, `app.js` and
-`index.html`, the files S5 changes. Before S5 the branch was rebased onto origin/refactor
-f41729178 as `honker/row194-b2`. `honker/row194` stays at f70b4da50 (no force-push). The only file
-both sides changed was `PRD-1.7-DRAFT.md`, whose blob was the same on both (9bfc6f76), so its five
-draft commits dropped as already upstream. The tree check: the rebased tip differs from f70b4da50
-by exactly the base's changes. Every test file the branch changes, the four must-run files and
-webui sso, service and reads were run again singly on the new base: 23 files, all pass.
-
-## S5 notes (the Console's Agents section, D7)
-
- `packages/webui/src/public/agents.js` (new, `window.MosaicAgents.section`): Settings draws it after
-  the role instances, from the same instances read. The table has instance, definition, launched, kept
-  and running runs, and each row has Launch, a reason box and Terminate. A human also gets Regenerate,
-  Keep or Unkeep, and Delete. The protected assistant has no Delete. Each definition has a No-hire or
-  Allow-hiring button, and a Create form adds an instance of an accepted definition. Retired names show
-  as one line. D7's "retired" column is that line, since a retired name has no instance row.
- Regenerate and Delete take a second click. The confirm says what happens: for Delete, "Its evidence
-  and its workspace under .retired stay." Cancel asks nothing.
- Choice: every answer that names a request is followed at `/api/agent/request` every 2 s, up to 90
-  reads, until the request closes. D7 names launch and regenerate. Delete and terminate also answer a
-  request (S2c), so the page follows them too, and the receipt shows the close or its refusal reason.
-  A failed read is shown and the poll goes on. The request is never sent again. Past 90 reads the page
-  says the request is still open and asks for a fresh read. A sign-out stops the poll.
- With `send` false the section shows "Agent actions are unavailable here. Use mosaic business instance
-  from the instance CLI." and every control is disabled. The tester sees Launch and Terminate only.
- `serve.mjs`: `/api/instances` takes op `delete` with the revision and the instance alone and answers
-  the request. `/api/agent/launch`, `/regenerate`, `/terminate` and `/api/veto` each have
-  `instanceSend`'s boundary and one call to `agentWrite`, with only the route's keys. A reason is never
-  logged. `GET /api/agent/request?id=` takes one request id and adds the reason for a closed refusal or
-  a cancel. Every refusal code the S2/S3 verbs answer has a reason line (`AGENT_REASONS`), and a code
-  missing there shows as itself. No route has a `--send` exception.
- `cli.mjs`: `agentWrite` reaches only `instance.launch`, `instance.regenerate`, `instance.end`,
-  `veto.set` and `instance.request` (`agentCaller` throws for any other). The tester listener gets
-  launch, end and request only (D4.1).
- D4.1 at the webui: the tester listener lets launch and terminate through and refuses regenerate and
-  veto with no call. A tester delete on `/api/instances` is refused in `instanceSend` with no call
-  (`tester-refused`). The bus refuses it too (broker tester-refused), and this keeps the webui from
-  asking. The agents test covers it, and with the guard removed that test fails (control run).
- Deferred to S6: the "still running after fire" flag needs the `lifecycle.end.alive` event, which
-  comes with row 191's stop.
- Tests: webui `agents.test.mjs` (new, 8: actions and logs, boundary refusals, read-only, refusal and
-  unknown outcomes, the request read, delete, tester routes, agents.js served) and
-  `agents-browser.test.mjs` (new, 1: read-only, launch followed to close, confirms, terminate reason,
-  refusal, keep and unknown outcome).
- Singles, each run alone, after the last code change: webui agents 8/8, agents-browser 1/1, browser
-  1/1, instances 5/5, instances-browser 1/1, serve 4/4, service 31/31, sso 28/28, sso-browser 2/2,
-  routes 5/5, routes-browser 1/1, tester-listener 10/10, tester-browser 2/2, tester-cli 2/2,
-  settings-write 4/4, send 13/13, send-browser 2/2, shell 5/5, cli launcher 29/29, thread-launch
-  11/11, git-socket 24/24, stack-copy 12/12, cli stack-release 174/174, seat sandbox 10/10. No test
-  pins a hash of a file S5 changes. shell.test reads bus.js strings and its POST count, which S5 leaves
-  alone because agents.js holds the section's writes.
-
-## Item 7 plan (brief rev 2547, sage-1586, from row 199 N2, duckworth-0068)
-
-Choice: create states that the agent needs a restart before `issue`. It doesn't register the entry with
-the running bus.
-
- Today create and hire refuse a definition that declares credentials (`organization-credentials-out-of-
-  scope`, `instance-settings.mjs:75-77`). So no created agent has a credential entry, and item 7 has nothing
-  to act on until row 199 lands. Row 199's D13 (origin/megavolt/row199-on-190
-  `agents/megavolt/work/queue-199/DESIGN.md:295-307`) has row 194 lift that refusal for the human's create
-  only. The agent is created with `store` references and no files. Hire stays uncredentialed.
- The runtime already treats credential references as fixed at start (`runtime.mjs:115-134`). A file whose
-  references differ from the boot copy isn't reloaded, and `instances.set` answers `restart: true`
-  (`runtime.mjs:182`). The CLI prints RESTART_NEEDED (`packages/cli/src/instances.mjs:59, 235`), and the
-  Console's instances section prints RESTART_TEXT (`packages/webui/src/public/bus.js:691, 733`). So after the
-  lift, a human create of a credentialed definition answers `restart: true` with no new runtime code.
-  `credentials.issue` then refuses `credential-unknown`, because the broker's copy of the business doesn't
-  hold the agent (`broker.mjs:1443` on row 199) and Credentials has no reference for it
-  (`credentials.mjs:148-150, 157`).
- Why not register: registering means a new path in row 199's Credentials that adds references to a running
-  store, plus a change to the fixed-at-start rule that row 194's D3 review accepted. The restart route changes
-  neither. It costs one bus restart per credentialed create, which the human already makes for any credential
-  change.
- Build, after row 199 lands and this branch moves onto it (new branch name, no force):
-  1. `instance-settings.mjs`: a human `add` of a credentialed definition writes `store` references with the
-     date fields row 199 requires and no files. Hire keeps the refusal. The human's create is
-     `instances.set` op `add` (agents.js posts it to /api/instances), so it already answers `restart`. The
-     runtime comment at `runtime.mjs:115-116` ("Create and hire add neither") changes to say a human create
-     can.
-  2. `agents.js` createAgent: the receipt carries the answer's restart text, as bus.js does. Today it says
-     "Created X." and drops `restart`.
-  3. T19, bus test: a human create of a credentialed definition answers `restart: true`. Issue refuses
-     `credential-unknown` before a restart. After a bus restart over the same directories, issue works and the
-     status reads `valid`. Hire of the same definition still refuses. A browser assertion covers the restart
-     text in the Agents receipt.
-  4. Mutants: M61 the create refusal stays for the human (T19 fails at create). M62 `fixedRole` ignores
-     `credentials`, so the reload goes live and answers `restart: false` (T19 fails). M63 the Agents receipt
-     drops the restart text.
- D13's revoke on fire and delete: Sage put it in row 194 as brief item 8 (sage-1588). See the item 8 plan.
-
-## Item 8 plan (brief rev 2556, 722136772, sage-1588, row 199 D13)
-
-`fire` and `delete` call `credentials.revoke(business, agent, {reason, actor})` before they change the
-business file. A failed revoke stops the verb with `credential-revoke-failed` and leaves the file unchanged.
-
- Order: the verb's own checks, then the revoke, then the write. A verb its checks refuse revokes nothing.
-  Fire's checks are `instance-settings.mjs:254-265` (unknown, kept, end-protected, launch.by, last name).
-  Delete's are `planDelete` (`instance-settings.mjs:189-193`). A delete writes in the launcher's pass,
-  through `set` op `delete` after the take (comment at `instance-settings.mjs:187-188`), so its revoke goes
-  there, after `planDelete` and before the commit. The write runs under the same revision the
-  checks read, so a revision race refuses as today, after the revoke. That leaves an agent revoked with its
-  file unchanged, which is the safe side: Jason runs `issue` again if they still want it.
- Where: the business package doesn't import the bus. The runtime passes the instance writer a revoke
-  callback, and fire and delete call it between the checks and the write. With no Credentials store (no
-  row 199 config) the callback is absent and nothing changes.
- A fire of a name that isn't in `launch.instances` writes nothing (`instance-settings.mjs:262`) and calls
-  no revoke.
- A revoke for an agent the running bus has no entry for (sage-1592): `credential-unknown` counts as
-  nothing to revoke only when the agent has no token file under the store, `secrets/agents/<business>/
-  <agent>/`. If a file is there while the bus doesn't know the entry (a file issued before a restart that
-  dropped the entry), the verb stops with `credential-revoke-failed`, so no agent is fired with its token
-  still on disk. Every other refusal stops the verb too.
- Row 199 as of 86963d281 (origin/megavolt/row199-on-190) doesn't cover that case. `revoke(instance,
-  service)` calls `#known` first (`credentials.mjs:197-198`), and `#known` refuses `credential-unknown`
-  from the boot-time entries alone (`credentials.mjs:148-150`). It never looks at the disk. The store path
-  is `<storeRoot>/<business>/<agent>/<service>` (`credentials.mjs:71-76`), with storeRoot
-  `<configDir>/secrets/agents` (`credentials.mjs:40`). So the extra check stays: on `credential-unknown`,
-  look for any entry in the agent's store directory. Recheck at landing. If the landed revoke deletes or
-  refuses in that case, cite the line and drop the check.
- Also to recheck at landing: D13's call reads `credentials.revoke(business, agent, {reason, actor})`, but
-  the class method is per service, `revoke(instance, service)`, and `remove(instance)` revokes every
-  service and then clears the agent's directory (`credentials.mjs:211-218`). The broker verb
-  `credentials.revoke` takes `agent, service, reason` (`broker.mjs:1437`). The build uses whatever the
-  landed code offers for every service of one agent, and records which.
- Sage's pick (sage-1593): fire calls `revoke(instance, service)` for each service in the agent's entry
-  and keeps the directory, so the status still reads revoked and Jason deletes the Gitea or Vikunja token
-  (199 A5). Delete calls `remove(instance)`. Both count as the revoke for the order, the refusal on
-  failure, T20 and M64-M67. If the landed code differs from 86963d281, follow it and note the difference
-  here.
- What that does to the sage-1592 check, as of 86963d281: `remove` takes its services from the boot-time
-  entries, so for an unknown agent it revokes nothing and doesn't refuse. It then lists the agent's store
-  directory and unlinks every token and tmp file, refusing `credential-file` for any other name
-  (`credentials.mjs:211-224`). So delete already leaves no token on disk, and the extra check applies to
-  fire only (sage-1592: cite the line and drop it). T20's delete case with a file and no entry expects the
-  file gone and the delete done. M67 runs against fire only. Recheck all of this at landing.
- The reason: fire carries the chief's reason from the change context. Delete carries the human's request
-  reason. The actor is the verb's actor.
- T20, bus tests, each for fire and for delete:
-  - With a credentialed agent: the revoke runs, the status reads revoked, and the file changes.
-  - With a revoke that fails (a stub store that throws): the verb refuses `credential-revoke-failed`, the
-    file's revision is unchanged, and the agent is still listed.
-  - The revoke runs before the write. The stub records the file revision it saw, and that revision is the
-    old one.
-  - With no entry in the running bus but a token file in the agent's store directory: the verb refuses
-    `credential-revoke-failed` and the file's revision is unchanged. With no entry and no file: the verb
-    goes on and the file changes (sage-1592).
- Mutants: M64 drop the revoke call (the success case fails, the status isn't revoked). M65 move the revoke
-  after the write (the order check fails). M66 ignore the revoke's failure (the failing case writes the
-  file). M67 treat any `credential-unknown` as nothing to revoke (the token-on-disk case writes the file).
-  M64-M66 run against fire and delete, M67 against fire only (see sage-1593 above): M64a-b to M66a-b, M67.
-
-
-## b3 notes (items 7 and 8 on row 199's landing cb5fdb064, sage-1601)
-
-Branch `honker/row194-b3`, a new name per sage-1601. Its first commit 589ae2c1d squashes honker/row194-b2
-85edab7c7 onto cb5fdb064. A rebase of b2's commits stopped on the same five files many times, so I
-squashed. The five conflicts kept both sides:
-
- broker imports, constructor, dispatch, and the credential and lifecycle verbs
- runtime imports
- the organization write, which takes detail and context
- cli credentials and veto dispatch
- the vocabulary comment, as row 199 wrote it
-
-Line numbers below are the b3 tip's.
-
-### Deviations from brief 722136772 and plan 85edab7c7
-
-1. Item 7 dates, sage-1605 pick (a). The human create writes the UTC create day as `rotateBy` and `expires`
-   (`instance-settings.mjs:118-120`). `checkCredentialRef` skips both date checks only for a store
-   reference with no file (ENOENT), and keeps the "not issued" warning (`business/src/credentials.mjs:73,
-   79-81, 110-113`). Every other reference keeps the checks. Tests: `business/tests/cli.test.mjs` "validate:
-   a not-issued store agent dated today passes, and an issued one with a past expiry fails", and T19 in
-   `instance-settings.test.mjs` (validate exits 0 with "not issued").
-2. fixedRole, sage-1605. A reference compares by kind and path only (`runtime.mjs:154-167`), because row
-   199's issue rewrites the date in the file outside the reload. Test: T19 in `bus/tests/reload.test.mjs`
-   (add, restart, issue, then a vars change goes live with restart false). The T14 date-only test stays.
-3. Delete takes all-store references, sage-1605. `deleteRefusal` refuses only when some reference isn't
-   `store: true` (`instance-settings.mjs:43-49`). A file or env reference refuses
-   `organization-credentials-out-of-scope` at the request, before any take (T20 delete case 2).
-4. Fire on a file or env reference revokes in memory, sage-1605. The result's `credentials.outsideStore`
-   names the services whose reference is outside the store (`runtime.mjs:122-124, 141-142`). T20 fire
-   case 1 checks `outsideStore: ['vikunja']` for coder.
-5. The `credential-revoke-failed` store-dir check stays, sage-1605 (`runtime.mjs:132-140`). It now runs after
-   delete's `remove` too. `remove` already leaves no token, so on delete it only refuses a name `remove`
-   would itself have refused.
-6. Tracker on add, honker-0049 and sage-1610 (a). A human add takes an optional `tracker: {bot, botId}`.
-   It is required for a definition with a vikunja credential (`organization-tracker-required`) and refused
-   for any other (`invalid-request`). checkBot and the bot uniqueness rule (other instances and
-   `tracker.sync`) run on the add path (`instance-settings.mjs:88-124`, `organization-tracker-bot-taken`).
-   `change` with a tracker refuses (`instance-settings.mjs:214`). The broker passes `tracker` through
-   (`broker.mjs:193-194`). CLI: `instance add ... [--bot BOT --bot-id N]` (`cli/src/instances.mjs:13, 73,
-   87-90, 107`, reasons at 22-27). The Console doesn't take a tracker: `INSTANCE_KEYS` in serve.mjs is
-   unchanged, the Agents and Settings forms still list credentialed definitions as not accepted, and a
-   vikunja add from the Console answers `organization-tracker-required` with a reason that names the CLI
-   (`webui/src/serve.mjs:332-333`, `webui/tests/instances.test.mjs`).
-7. Delete with a tracker bot, sage-1610 (b). The delete's result names the bot and says to remove the
-   Vikunja bot user and any token by hand (199 A5) (`instance-settings.mjs:199-202`). `lifecycleDelete`
-   returns `bot` (`broker.mjs:1386-1387`), the launcher carries it to `lifecycleDone`
-   (`cli/src/launcher.mjs:752-767`), `lifecycleDone` takes `bot` checked against BOT_NAME
-   (`broker.mjs:132, 1392-1393`), and `lifecycleView` shows it (`broker.mjs:147`). The CLI line
-   (`cli/src/instances.mjs:177-180`) and the Agents receipt (`webui/src/public/agents.js:113-115`) name it.
-   Tests: T20 bus delete case 1, T20 in `cli/tests/lifecycle.test.mjs`, and `agents-browser.test.mjs`.
-8. No Vikunja account. The create makes none and the delete removes none. Q188 and the `account.create`
-   hard wait aren't touched (sage-1610).
-9. The tester's add keeps the credential refusal. Row 175 W2 (`bus/tests/tester-writes.test.mjs:91`)
-   says the tester refuses credentials, and items 7 and sage-1610 name the human's add. The writer lifts
-   the refusal only when the actor isn't `tester` (`instance-settings.mjs` add, the `definitionFor` call).
-   The broker reserves that name: no human or role may be called `tester` (`broker.mjs:234, 237`). W2 has a
-   new case, a tester add with a valid tracker, which still refuses `organization-credentials-out-of-scope`.
-10. The commit hook is `beforeWrite` (`instance-settings.mjs:332-360`). A first draft named it `before`
-    beside a `let before`, a SyntaxError, so I renamed it.
-11. A failed delete revokes first. `Credentials.remove` revokes every service it knows before it reads the
-    directory (row 199 `bus/src/credentials.mjs` remove). When the directory then holds a name `remove`
-    refuses, the delete stops with the business file unchanged and the tokens already gone. That is the safe
-    side and matches item 8's note on a revision race. T20 delete case 1 asserts it.
-12. T20 uses real failures, not a stub store: a 0500 agent directory (fire) and a foreign file in the
-    store (delete). The revoke-before-write order is checked by the failing cases: a revoke after the write
-    would leave the file changed (M65).
-
-### Hunks for Duckworth's scoped check (sage-1605)
-
- `packages/business/src/credentials.mjs`: 12 (DATE_KEY exported), 73, 79-81 (notIssued), 110-113 (the
-  no-file skip).
- Credential verbs: `packages/bus/src/credential-verbs.mjs` and `bus/src/credentials.mjs` are unchanged from
-  cb5fdb064. The broker's `#requestCredential` (`broker.mjs:1679-1709`) is row 199's text as merged in the
-  589ae2c1d squash. b3's own credential hunks: the runtime revoke callback (`runtime.mjs:109-143`) and the
-  broker's `credential-revoke-failed` mapping (`broker.mjs:1816-1817`).
- fixedRole: `packages/bus/src/runtime.mjs:154-167`.
-
-### Mutants to run on Sage's slot (after M1-M60)
-
- M61 the human create keeps the credential refusal (T19 business and bus fail at create).
- M62 `fixedRole` ignores `credentials` (bus T19 fails: restart false).
- M63 the Agents create receipt drops the restart text (agents-browser fails).
- M64a/b drop the revoke call on fire and delete (T20 success cases fail).
- M65a/b move the revoke after the write (T20 failing cases see the file changed).
- M66a/b ignore the revoke's failure (T20 failing cases write the file).
- M67 any `credential-unknown` counts as nothing to revoke, with the store-dir check dropped (T20 fire
-  case 2 writes the file).
- M68 fixedRole compares the whole reference, dates included (bus T19 fails: restart true after issue).
- M69 `checkCredentialRef` drops the no-file condition (the issued-past-expiry validate test passes wrongly).
- M70 drop the vikunja tracker requirement (T19 business and the CLI tracker-required case fail).
- M71 `deleteRefusal` refuses a tracker bot again (T20 delete cases and CLI T20 fail).
- M72 skip checkBot on the add path (T19 business bad name and bad botId fail).
- M73 the tester's add binds credentials too (tester-writes W2 fails on both reviewer-2 cases).
-
-### Pins and a missed failure
-
- `bus/tests/channel-proof.test.mjs` pins `webui/src/bus.mjs`. b3 adds two STATUS entries, so it is repinned
-  with a comment, as rows 165 and 171 did. No proof or transport change.
- `bus/tests/project-runtime.test.mjs` pins the broker's vocabulary import. b2 imported `unhireableAction`
-  and never updated the pin, so the test fails on b2 too. I have no log of it running on b2. b3 fixes the pin.
- `bus/tests/tester-writes.test.mjs` W2 caught the tester binding credentials through a tracker add. The
-  writer now lifts the credential refusal only when the actor is not `tester` (deviation 9), and W2 has a
-  case with a valid bot that still refuses.
-
-### b3 singles (2026-10-21T01:02Z)
-
-Every test file under `packages/{business,bus,harness,cli,webui}/tests`, run singly with `node --test`:
-158 files, 1501 pass, 0 fail. The first pass failed channel-proof, project-runtime and tester-writes (fixed
-above). After the fixes and the tester change in `instance-settings.mjs`, 17 files reran singly: 167 pass,
-0 fail. The total uses the rerun counts for those 17, summed by awk over the logs. Suites and mutants
-M1-M73 wait on Sage's slot.
-
-### sage-1620 (2026-10-21T01:05Z)
-
- W2 reading confirmed. Each refused W2 case now asserts the log length as well as the bytes and revision
-  (`bus/tests/tester-writes.test.mjs`, inside the loop). M73 stays in the batch.
- Deviation 11 accepted. The refusal text says a retry is safe: `credential-revoke-failed` has a reason in
-  the CLI (`cli/src/instances.mjs` REASONS) and in the Console (`webui/src/serve.mjs` AGENT_REASONS, shown on
-  a closed request's read). CLI T20 now fails a delete with a foreign file in rev-2's store, checks the text
-  and the unchanged revision, then clears the file and deletes. Console agents.test checks the read's reason.
- Mutants for the slot: M74 drops the CLI reason (CLI T20 fails); M75 drops the Console reason (agents.test
-  fails).
- Seat: every `packages/seat/tests` file singly (164 pass, 0 fail, 7 files) and the seat suite whole
-  (`node --test tests/`, 164 pass, 0 fail), for the broker import change (row 210's gate finding).
-  Touched files singly after this change: tester-writes 8, cli lifecycle 16, cli instances 14, webui agents
-  8, agents-browser 1, all pass.
-
-### Follow-up for 194: N1, a revoke that succeeds before a failed write (sage-1630, 2026-10-21T01:15Z)
-
-Duckworth's N1 (#1692 comment 29818), noted here as a follow-up with no b3 change. When the revoke succeeds
-and the write then refuses `revision-conflict` or `outcome-unknown`, the business file is unchanged and the
-tokens are gone, but neither refusal says so. Only `credential-revoke-failed` has the retry-safe text.
-
- Order: `business/src/instance-settings.mjs:361` runs `beforeWrite` (the revoke), then `:362` runs
-  `writer.write`, which checks the revision under its lock (`business/src/organization.mjs:188`) and again
-  before publication (`:215`).
- Fire reads a fresh revision (`instance-settings.mjs:311`), so a conflict there needs a concurrent write.
- Delete is not a race. It commits with the revision the request recorded at raise time
-  (`bus/src/broker.mjs:1855`, checked against the file then), passed at `broker.mjs:1382` and
-  `instance-settings.mjs:193-198`. Any organization write between the raise and the take makes that
-  revision stale, and nothing compares it before the revoke. So a delete taken after such a write revokes
-  the agent's tokens and then refuses `revision-conflict` with the instance still listed.
- Fix options: compare the request's revision with the fresh read before `beforeWrite` (the writer still
-  re-checks under its lock); or run `beforeWrite` inside `writer.write` after the `:188` check; and in
-  either case give `revision-conflict` and `outcome-unknown` text that says tokens may already be revoked
-  when a revoke ran.
-
-### sage-1634: N1 fixed in b3 (2026-10-21T01:20Z)
-
-Sage ruled N1 a blocker for 194: it is the row's own code in files the row already changes. Option 1 is in.
-The section above stays as written; this entry supersedes its "no b3 change".
-
- `business/src/instance-settings.mjs` `commit()`: before `beforeWrite`, compare the requested revision with
-  `writer.read(business).revision` and refuse `revision-conflict` on a difference, without calling
-  `beforeWrite`. It runs for every caller (add, set, veto, hire, fire, delete). Every caller already read the
-  file with `writer.read` (it validates), so a file that went invalid in between refuses `BusinessError`,
-  also before any revoke.
- Fire reads its revision fresh (`:311`) in the same synchronous call, so it reaches a stale revision only
-  through another process writing between that read and `commit()`. No test makes that happen without an
-  injected writer; the check is the same line, and the delete test kills both mutants.
- Test: bus `lifecycle-revoke.test.mjs` T21. A delete raised on revision R and taken; a credential issue for
-  rev-3 writes the file; the delete refuses `revision-conflict`. The business file's bytes and rev-2's
-  Credentials entry are unchanged, the vikunja token file is still there with its bytes, the store holds only
-  it, and the status reads valid.
- Refusal text: `revision-conflict` says the file changed since that revision (CLI `instances.mjs` REASONS,
-  Console `serve.mjs` INSTANCE_REASONS). Neither says anything was revoked, so no change. The Console's
-  AGENT_REASONS has no entry for it.
- Mutants for the slot: M76 drops the early check (T21 fails: the token file is removed); M77 moves it after
-  `beforeWrite` (T21 fails the same way, then refuses).
- Runs, singly or whole as Sage asked: business whole 207 pass, bus whole 525 pass, seat whole 164 pass
-  (sandbox.test included), cli instances 14, cli lifecycle 16, webui agents 8, all 0 fail.
-
-Follow-up (option 2, not in b3): run `beforeWrite` inside `writer.write`, under its lock and after the
-`organization.mjs:188` check. Until then a window remains: a write landing between the early read and the
-writer's lock still lets a fire or delete revoke and then refuse `revision-conflict`, and an `outcome-unknown`
-after a revoke still doesn't say the tokens are gone.
@@ -1,707 +0,0 @@
-# Row 194 design: agent lifecycle from the Console and the CLI, with a per-agent veto
-
-Brief: `docs/plans/2026-10-20_agent-lifecycle.md` (blob a907109409ac). Gitea #1692. MVP T1 item 5 (mos-0974,
-mos-0977, DECISIONS Q176). Owner Honker, reviewer Webby, gate owner Sage. Base: refactor at 53bb59462.
-Branch `honker/row194`.
-
-Related designs read: row 190 `agents/darkwing/work/queue-190/DESIGN.md` (r2, after mos-0986), row 191
-`agents/rocko/work/queue-191/DESIGN-r2.md`. Row 193 is still in design. All line numbers below are at
-53bb59462.
-
-## Summary
-
- One verb family on the CLI, `mosaic business instance <verb> BUSINESS INSTANCE`, and one Console section.
-  Create and delete change the business file. Launch, terminate and regenerate act on runs.
- Every human verb goes through the bus with the human proof. Launch, regenerate and delete are requests the
-  launcher takes once and carries out under `serialize`. Launches go through the one `start()`, so
-  `--no-launch`, the limits, `launch.revoke` and row 191's switch all apply.
- The chief hires (adds and lists an instance) and fires (ends its runs and delists it). It never deletes.
-  `role.hire` and `role.fire` are new hard waits, so Jason resolves each one (Mos, mos-1017). The routed
-  form waits on a PRD 1.7 draft in this packet.
- A hire allowlist in code: the chief can hire only a definition whose every action is on `HIRE_ALLOWED`
-  (message, record, review request, assigned-task updates, and two actions that matter after row 199).
-  Launch, end, organization, naming, hire, verdict, merge and every later action stay out.
- The per-agent forbid is two lists in the business file that only the human writes: `launch.keep`
-  (instances the chief can't fire, replace or end) and `launch.noHire` (definitions the chief can't hire).
- The broker reloads a business from its file after each committed write. Create, delete, hire, fire and
-  veto changes then count without a bus restart. Hand edits still need one, except `bus.tester`.
- No bus schema change and no migration. Named for review: two new vocabulary actions (hard waits), the
-  role-file `hireable` key, `"hireable": []` in `roles/chief-of-staff.json`, and three business-file keys.
-
-## What exists today (checked at 53bb59462)
-
-| # | Fact | Where |
-|---|---|---|
-| E1 | Instances are keys of the business file's `roles`. `launch.instances` lists those the chief may launch. The list must be non-empty | `business.mjs:121-132` |
-| E2 | The human adds an instance and changes its definition, vars and listing. No delete. Credentialed definitions are refused | `instance-settings.mjs:1-5, 22-31, 75-156` |
-| E3 | The broker copies the businesses once at start and refuses a role it doesn't know | `broker.mjs:208, 446` |
-| E4 | The chief launches over `launch.sock`. `fromSession` checks identity, then `check()` (which reloads the file), then `authorizeLaunch`, then `start()` | `launcher.mjs:232-327, 624-668` |
-| E5 | The chief's `launch` tool takes an enum of the instances listed when its bundle was built | `harness/src/tools.mjs:116-119` |
-| E6 | The chief ends a run with `role.revoke` plus a reason (`role.end`). Ending then launching again is already a replace | `broker.mjs:1601-1628`, `tools.mjs:167` |
-| E7 | `mosaic stop RUN` is a same-uid SIGTERM. It has no bus call and no human proof | `cli.mjs:447-454`, `seat/src/session.mjs:249-270` |
-| E8 | The Console stops only the assistant (`assistant.stop`) and writes instances through `instances.set` | `serve.mjs:282-289, 315-363, 535` |
-| E9 | The launcher already starts runs for the human on its 2 s tick: threads with pending messages, and merge holders | `launcher.mjs:133, 487-597` |
-| E10 | `launch.revoke` and `launch.restore` are human-only. A revoked business refuses `role.launch` | `broker.mjs:770-774, 2087-2095` |
-| E11 | Only the assistant is END_PROTECTED. Coder, reviewer, pm and cto all declare gitea and vikunja credentials | `vocabulary.mjs:135`, `roles/*.json` |
-
-The chief's veto today comes from the human-only membership in E2. The chief can only launch what the human
-listed. It has no way to create an instance, and the human has no way to stop the chief ending a given
-instance's runs.
-
-## D1. The verbs
-
-All of them are human verbs. Each is a broker verb behind `#human(s)` and then the D4 hook. Each logs its
-actor. The CLI usage joins `INSTANCES_USAGE` (`cli/src/instances.mjs:9`).
-
-| Verb | CLI | Bus verb | Effect |
-|---|---|---|---|
-| V1 create | `business instance add B I --definition DEF [--vars FILE] [--launch] --revision REV` | `instances.set` op `add` | as today, with no restart (D3) |
-| V2 launch | `business instance launch B I [--wait SECONDS]` | `instance.launch` | one run, through the launcher |
-| V3 terminate | `business instance terminate B I [--reason TEXT]` | `instance.end` | ends every run of I and cancels I's open requests |
-| V4 regenerate | `business instance regenerate B I [--wait SECONDS]` | `instance.regenerate` | V3, then V2 once the run has exited |
-| V5 delete | `business instance delete B I --revision REV [--wait SECONDS]` | `instances.set` op `delete` | a request. The launcher removes I from the business file and renames its workspace |
-| V6 veto | `business veto B (keep\|unkeep) I` and `business veto B (nohire\|hire) DEF`, each `--revision REV` | `veto.set` | edits `launch.keep` and `launch.noHire` |
-
-`mosaic business instances B` (read) gains, per instance: `running` (run ids from the bus claims), `kept`
-and `retired`. The top level gains `noHire`. `mosaic stop RUN` stays as it is. It is the same-uid operator
-tool, and V3 is the human verb.
-
-### D1.1 Requests (V2, V4, V5)
-
-The broker never starts a process or touches a workspace. Launch, regenerate and delete are requests the
-launcher carries out, as E9 already does for the human's threads. A request has three states, open, taken
-and closed, all recorded as `action.allowed` events with reserved action names:
-
-| Event | Written by | Body |
-|---|---|---|
-| `lifecycle.launch`, `lifecycle.regenerate`, `lifecycle.delete` | the broker, at the verb | `{ request, via }`, subject I, actor the human or `tester`. A `human.input` event goes with it, as `launch.revoke` does |
-| `lifecycle.taken` | host op `lifecycleTake` | `{ request }` |
-| `lifecycle.done` | host op `lifecycleDone` | `{ request, run? , refusal? }` |
-| `lifecycle.cancelled` | V3, for each open request of I | `{ request, by }` |
-
-1. The launcher's new `lifecyclePass` runs on the same tick as `threadPass` and `landPass`. It lists open
-   requests with host op `lifecycleRequests`.
-2. For each one, under `serialize`, it calls `lifecycleTake(request)`. That op runs in one store
-   transaction. It re-checks, in order: the request is still open (not taken, cancelled or closed), it is
-   less than 60 s old (else it closes as `request-expired`), the business isn't revoked (`launch_state`,
-   `launch-revoked`), I isn't retired, row 191's switch is off (`processing-halted`) for launch and
-   regenerate, and for a tester request `bus.tester` is true in the file (D4.1). Any failure closes the
-   request with that code. Otherwise it writes `lifecycle.taken` and answers go.
-3. Only after go does the pass act: `check(I, { human: true })` then `start()` for a launch, the V5 steps
-   for a delete.
-4. The pass then calls `lifecycleDone`. A taken request never runs again, whatever happens after the take.
-   If `lifecycleDone` throws, the request stays taken with no done event. The CLI reports that as
-   `outcome-unknown` with the request id, and the launcher log names the run.
-5. The CLI polls a read verb, `instance.request`, until the request closes or `--wait` runs out (default
-   30 s). A timeout exits 3 with the request id. An untaken request can still be taken within its 60 s.
-
-So the human's `launch.revoke` stops every untaken request, not only new ones (B4), and a bus restart
-can't start a request older than 60 s.
-
-### V2 launch
-
-1. At the verb the broker checks that I exists, isn't a thread instance (`not-thread-launch`: threads start
-   on a message), isn't retired, and that the business isn't revoked and, with row 191, isn't halted. These
-   repeat at the take (D1.1 item 2).
-2. After the take, `check(I, { human: true })` and `start({ instance: I, launchedBy })`, where
-   `launchedBy` is the business human or `tester`. `human: true` lets the human launch an instance that
-   isn't in `launch.instances`. The listing limits the chief, not the human. `launch.by` still goes through
-   the `pm: true` branch (`launcher.mjs:235`), as `--pm` does today. Every other step of `check()` and
-   `start()` is unchanged.
-
-### V3 terminate
-
-1. The broker revokes every claim I holds (`#claimEnd(s, h, 'revoke', null, reason, actor)`). A thread
-   instance has all its thread claims revoked, which is exactly `assistant.stop`.
-2. In the same transaction it writes `lifecycle.cancelled` for every open (untaken) request of I, so no
-   launch the human asked for before the terminate starts after it (B5).
-3. It writes `lifecycle.end` with the runs. The launcher pass sends SIGTERM to each run's runner after
-   checking its start time, as the idle stop does (`launcher.mjs:526`). It also signals any run of I in the
-   launcher's registry that has spawned but not yet bound, which holds no claim yet. The existing exit
-   handler records the end, so the launch journal and `session.ended` are unchanged.
-4. Nothing held, nothing open and nothing in the registry answers `not-held`.
-5. Terminate is allowed while row 191's switch is on. It starts nothing.
-
-A taken launch request is past cancelling. Its run reaches the registry under `serialize`, and the next
-terminate ends it. The CLI's terminate output says so when a taken request exists.
-
-There is no SIGKILL escalation in this row. A run that ignores SIGTERM keeps running. `mosaic stop` and the
-limits are the operator's tools for it (N6).
-
-### V4 regenerate
-
-A fresh session with the same identity and role. It is V3 then V2 under one request. The pass takes the
-request, waits for the old run's exit handler, then runs `check()` and `start()`. The workspace stays, as
-it does across every launch today. The session is new because every non-thread launch gets a new run dir
-(`seat/src/session.mjs:107`, newRun). If the old run hasn't exited by the request's 60 s mark, the request
-closes as `regenerate-timeout`, nothing starts, and the old run is still running (N6).
-
-A thread instance (the assistant) refuses `regenerate-thread`. Its context lives in the thread's session
-directory, and clearing that is T1 item 7 (clear context). This row doesn't take it.
-
-### V5 delete
-
-`instances.set` gains op `delete`. At the verb the broker and the writer refuse, in this order:
-
-| Refusal | When |
-|---|---|
-| `tester-refused` | the caller is the tester (B6) |
-| `organization-definition-refused` | I is END_PROTECTED |
-| `organization-instance-referenced` | I is `launch.by` or an arbiter. The message names the reference |
-| `organization-instance-kept` | I is in `launch.keep`. The human runs `veto unkeep` first. Delete never clears a veto silently |
-| `organization-credentials-out-of-scope` | I holds credentials or a tracker bot. That stays a hand edit until the credentials row (row 199) |
-| `instance-running` | the broker sees a claim for I. The human terminates first |
-| `instance-starting` | an open or taken request for I has no done event |
-| BusinessError | I is the last name in `launch.instances` (E1). The message says so |
-
-The checks pass with no write, and the broker records a `lifecycle.delete` request. After the take, the
-launcher pass, under `serialize` so no `start()` of I runs alongside it:
-
-1. Re-checks the registry for I (`instance-running`) and re-runs the writer's checks against the file as it
-   stands. The `--revision` the human gave must still match, else `revision-conflict`.
-2. Commits the file through the organization writer. It removes `roles.I` and the references that exist
-   only for I: its `launch.instances` entry, its `launch.limits.tokens.instances` entry and its
-   per-instance model entry. It adds I to a new top-level list, `retired`. The build lists every place
-   `validateBusinessDocument` reads a role instance name and puts each one in one of the two groups (refuse
-   or remove). A reference the table doesn't name stops the build and goes back to Webby.
-3. Renames `workspaces/<b>/I/` to `workspaces/<b>/.retired/I-<transaction>/`, mode 0700. No workspace is
-   no rename.
-4. Calls `lifecycleDone` with the transaction.
-
-The file goes first. Once it is committed, `check()` refuses I as unknown, so no launch can open the old
-workspace even if step 3 fails. A failed rename closes the request with `workspace-rename-failed`, the
-transaction and the path left behind. A second `delete` of a retired name skips steps 1 and 2 and retries
-step 3 only. The file and evidence are already right, so this is the whole recovery.
-
-What stays:
-
- Run evidence (`launches/<b>/<run>/`, `launches/<b>.jsonl`) and bus rows are untouched. They are
-  write-once.
- The workspace, under `.retired`. This row deletes no file. A prune with a receipt is a later act.
- `retired` stops a later create or hire from reusing the name. Decisions bind to the role instance and
-  outlive restarts (`broker.mjs:783-788`). A new `coder` would otherwise inherit an approval raised by the
-  old one. The tradeoff is a name that can't come back without a hand edit. I chose that over voiding
-  decisions, which would touch a second store.
-
-### V6 veto
-
-`veto.set` args: `{ revision, op: "keep" | "unkeep" | "nohire" | "hire", name }`. It goes through the
-organization writer, so it is logged with actor and diff in `changes.jsonl`. `keep` needs a declared,
-non-END_PROTECTED instance. `nohire` needs a name that matches the id pattern. A no-op answers
-`organization-no-change`. It is human-only and isn't in `TESTER_ORGANIZATION_VERBS`.
-
-## D2. Chief hire and fire
-
-### D2.1 Authority (Mos, mos-1015 and mos-1017, through Sage, sage-1362 and sage-1365)
-
-This row adds `role.hire` and `role.fire` to `ACTIONS` (`vocabulary.mjs:11`). Under PRD REQ-WAIT-3 a new
-action is a hard wait until a PRD version says it isn't (`vocabulary.mjs:52-57`), so both ship as hard
-waits. Jason resolves each one. There is no PRD change and no grant in a role file: `role.mjs:42` refuses
-a withinRole that lists a hard wait, and REQ-WAIT-2 forbids it.
-
-The flow in this row:
-
-1. The chief raises a `role.hire` or `role.fire` decision whose body carries the arguments (business,
-   name, definition, vars, or name and reason). A hard wait goes to the human only. No arbiter resolves it.
-2. Jason resolves it in the Console or the CLI.
-3. The chief calls `instance.hire` or `instance.fire` citing the decision. The broker checks it with
-   `#consumeAuthority(s, 'role.hire', { decision, target })`, as the `role.revoke` decision branch does,
-   and the arguments must equal the decision body field by field (N1, webby-0010). For hire that is
-   `name`, `definition` and `vars` (vars compared with `canonicalJson`, absent equal to absent only). For
-   fire it is `name` and `reason`. A key in the call that the body lacks, or a body key the call lacks,
-   refuses `decision-mismatch`. Every check below runs again at this call, so a veto set after the resolve
-   still refuses.
-
-The routed form, where the chief hires and fires without a decision each time, needs a PRD version that
-moves both actions to `ROUTED`. My draft is `agents/honker/work/queue-194/PRD-1.7-DRAFT.md`. It quotes
-TARGET.md line 66 and carries Mos's bounds. Jason approves it as a `prd.approve` decision in the Console,
-and Sage opens that decision. When it lands, a later commit adds the two actions to both `ROUTED` lists
-(`vocabulary.mjs`, `broker.mjs:43-69`) and to `roles/chief-of-staff.json` withinRole. The broker then
-takes the `reason` form instead of a decision. The verbs and every check below stay the same. This row
-builds and tests the hard-wait form only. It writes the `hireable` key and its allowlist now (D2.3), because
-both forms use them.
-
-### D2.2 What the chief may do
-
-| Act | Bus verb | Rule |
-|---|---|---|
-| launch | `launch` (host) | as today: listed instances only |
-| end a run | `role.revoke` + reason | as today, and refused `instance-kept` when the target is kept (D2.4) |
-| hire | `instance.hire { name, definition, vars?, decision }` | adds and lists an instance. Refusals below |
-| fire | `instance.fire { name, reason, decision }` | ends I's runs, cancels I's open requests, and removes I from `launch.instances`. Refusals below |
-
-Only the business's chief, the instance named by `launch.by`, may call either verb. Any other caller
-refuses `role-not-chief`, even with a resolved decision, as `#classification` already limits
-`role.launch`. The broker reads `hireable` from that chief's own role file. Both act only in the chief's
-own business. Neither verb takes a business argument. The broker uses the
-cap's business, and a decision raised in another business refuses `decision-mismatch`. Row 191's switch
-refuses both while halted (D6). Every hire and fire writes `changes.jsonl` through the organization writer
-with actor the chief's instance and run, and the decision id.
-
-Hire refuses, in order:
-
-1. `definition-not-hireable` when the definition holds an action outside `HIRE_ALLOWED` (D2.3), whatever
-   any list says.
-2. `definition-not-hireable` when the definition isn't in the chief role file's `hireable` list, or is in
-   the business's `launch.noHire`.
-3. `organization-definition-refused` for END_PROTECTED, `organization-credentials-out-of-scope` for a
-   credentialed definition (until the credentials row, row 199), `invalid-request` for version 1.
-4. `organization-instance-retired` when the name is retired.
-5. When the name exists: a fired instance (in `roles`, not listed) is listed again only if `definition`
-   equals its current one and `vars` is absent. Any other definition or vars refuses
-   `organization-instance-exists`, and so does a listed name. A re-hire never moves an instance's
-   decisions to a different role (B3).
-
-Hire's `vars` may hold only the keys the chief can already set on an instance through `organization.set`
-(the model key, `broker.mjs:1266-1269`) and narrowing `limits.*` keys. Anything else, such as `harness`
-or a route, refuses `invalid-request`. The human sets those (N3).
-
-Fire refuses `instance-kept` for a kept instance, `organization-definition-refused` for END_PROTECTED,
-`organization-instance-referenced` for `launch.by`, and a BusinessError for the last listed instance. A
-fired instance stays in `roles`. The chief never deletes. Delete stays a human act because it retires the
-name.
-
-Fire ends the fired instance's processes, not only its claims (F4, Megavolt through sage-1374). Every run
-gets the shared model token at start: `ENV_ALLOW` (`packages/seat/src/session.mjs:83-94`) passes
-`ANTHROPIC_API_KEY`, `CLAUDE_CODE_OAUTH_TOKEN` and the other provider variables into the sandbox. A revoke
-can't take that token back, so a fired agent whose process lives on still holds it.
-
-The delist is a business file commit through the organization writer, and the revoke and events are store
-rows. No transaction covers both (webby-0011 B2), so fire runs in a fixed order, store side first:
-
-A. One store transaction: steps 1 to 3 below, plus `fire.stopped` with the decision id. The decision isn't
-   consumed yet.
-B. The delist through the organization writer (`launch.instances` loses I, logged in `changes.jsonl`).
-C. One store write consuming the decision and recording `fire.done`.
-
-If B or C fails, fire answers the step's code and the decision stays unconsumed. A second fire citing the
-same decision runs again. A finds nothing to revoke, cancel or stop, and that isn't a refusal for fire
-(unlike V3's `not-held`). B finds I already delisted and counts as done. C consumes. So a fire is safe to
-repeat until it's consumed. The other order would leave a delisted agent with a live process and its model
-token when the store step fails, which is the case F4 exists to stop. A halt between A and B doesn't stop
-B or C, because neither starts anything. A second fire while halted refuses (D6), and the halt's own stop
-covers the runs.
-
-Steps 1 to 3 are V3's, with one change:
-
-1. It revokes every claim the instance holds.
-2. It writes `lifecycle.cancelled` for each of the instance's open requests.
-3. It writes `lifecycle.end` with the runs and `kill: true`. The launcher pass stops each runner, spawned
-   but unbound registry runs included, with escalation (sage-1380 item 1):
-   - SIGTERM after the identity check.
-   - After the grace, SIGKILL to any runner still alive, after the same identity check again, and
-     `lifecycle.end.killed` with the run and pid.
-   - A runner still alive after SIGKILL and the observe wait gets `lifecycle.end.alive`. The Console's
-     Agents section shows it to the human.
-   A runner whose identity no longer matches is never signalled. Every check, the recheck after the
-   grace included, uses the identity (start ticks plus boot id), never a bare pid, so a reused pid never
-   counts as the fired run (webby-0011 N2).
-
-Fire's answer lists the runs it is stopping. The delist stops any new chief launch (`launch` takes listed
-instances only). A human launch request already taken is past cancelling, as in V3. The human made it, the
-fire answer names it, and the human's terminate ends its run.
-
-The stop is row 191's per-run stop, not a second one, so the two can't fight (sage-1380 item 1). Row 191's
-design r2 (`agents/rocko/work/queue-191/DESIGN-r2.md`, "Stop policy and completion") sends SIGTERM, waits
-5 s, sends SIGKILL to verified groups and namespaces, and observes for 2 s. Its identity check is start
-ticks plus boot id, which replaces the start-time check at `launcher.mjs:526`. Fire calls that routine for
-one instance's runs and uses its constants, so the grace is row 191's 5 s, not the 10 s in r3. The order:
-
- Fire is refused while halted (D6), so a halt sweep never meets a fire that started after it.
- A halt that comes during a fire's stop finds those runs already stopping. Each run has one stop receipt
-  (row 191's), and the first stop owns it. The halt sweep joins it instead of sending a second SIGTERM or
-  restarting the deadline, and counts the run in its remaining or quiescent totals.
- The record says which stop owned it: reason `fire` with the decision, or row 191's `kill-switch` with
-  its generation.
-
-V3 terminate is unchanged. It still sends SIGTERM only (N6). Only fire escalates, because only a fired
-agent must lose the token at once. If row 191 hasn't landed when this row builds, the build chains on its
-candidate (Q177), as D6 already says.
-
-### D2.3 The hire allowlist (B2, sage-1365 item 4, webby-0010 B1)
-
-r2 and r3 had a deny list, `HIRE_FLOOR`. Webby's B1 showed it missed routed actions (`git.merge.protected`,
-which `roles/merge-gate.json` holds with no credentials, `decision.resolve.technical`, `policy.change`,
-`prd.approve`), and that any action added later would be hireable by default. That isn't fail-closed. r4
-replaces it with an allowlist.
-
-A definition is hireable only if every action in its withinRole and crossRole is on `HIRE_ALLOWED`:
-
-| Allowed action | Held today by |
-|---|---|
-| `message.send`, `record.write` | every v2 role file |
-| `review.request`, `task.update.assigned` | coder, cto, pm, reviewer |
-| `task.scope.change`, `git.push.working` | coder, cto, pm (credentialed, so they matter only after row 199) |
-
-Everything else in `ACTIONS` fails, including the actions of the old floor (`role.launch`, `role.end`,
-`role.revoke`, `organization.change`, `instance.name`, `review.verdict`, `role.hire`, `role.fire`) and those
-B1 named. An action added to `ACTIONS` later fails until a reviewed commit adds it here.
-`git.push.remote` (row 199, routed to coder by PRD 1.7) isn't on the list. A coder holding it stays
-unhireable until a reviewed commit adds it, after the credentials bound is lifted.
-
-Against today's role files: chief-of-staff, cto, merge-gate, pm, reviewer and security-reviewer fail.
-Assistant, researcher, coder and the five C-suite files pass the allowlist. Assistant is END_PROTECTED and
-coder is credentialed, so D2.2 item 3 refuses them. The C-suite files hold only `message.send` and
-`record.write`, so hiring one gives no authority beyond its name. `hireable` still has to list it.
-
-The list is a constant in `business/src/vocabulary.mjs`, `HIRE_ALLOWED`. It is checked twice:
-
- At load. `role.mjs` validates the chief role file's `hireable` list: distinct definition names, each
-  present in `rolesDir`, version 2, and every action on `HIRE_ALLOWED`. A list naming one that isn't refuses
-  the role file (`hireable names <def>, which holds <action>`). The check reads only the named file's authority lists,
-  never its `hireable`, so a list can't recurse. `hireable` is an optional key on any role file. This is a
-  role schema change, named for review.
- At hire, in the broker, against the definition as loaded then. A role file edited after load is caught
-  here.
-
-`hireable` in `roles/chief-of-staff.json` stays empty in this row (`[]`, Q4, sage-1374). Naming the first
-role kind is a separate policy commit in `roles/`, made after Jason resolves the `prd.approve` decision, as
-AGENTS.md invariant 7 requires. With an empty list the chief can hire nothing, even with Jason's resolve,
-until that commit. The row's tests use scratch role files whose `hireable` names a kind.
-
-### D2.4 The per-agent forbid and the veto (sage-1365 item 3)
-
-TARGET.md line 66: "Chief of staff agent has hire/fire authority for agents as needed; unless user forbids
-per agent". The forbid is two lists in the business file that only the human writes:
-
- `launch.keep`: instance names. The chief can't fire, replace or end a kept instance. The broker refuses
-  `instance-kept` for every chief act aimed at it except launch:
-  - `instance.fire`, even with a resolved `role.fire` decision. Mos's limit is that Jason's veto applies
-    to every hire and fire, so the human unkeeps before a fire.
-  - a hire of that name.
-  - `role.revoke` in the reason branch (`broker.mjs:1607-1613`). End then launch is a replace (E6).
-  - an `organization.set` write of that instance's model key (B7). A model change is a replace at the next
-    launch.
-
-  The `role.revoke` decision branch (`broker.mjs:1614-1615`) still ends a kept run. It ends a run, it
-  doesn't fire or replace, and it cites a decision the human resolved (Webby's Q2 ruling). The human's V3
-  and the limits also still end a kept run.
- `launch.noHire`: definition names the chief can't hire into this business (D2.2 item 2).
-
-Why the chief can't change the forbid:
-
- Only `veto.set` writes the lists. It is human-only (`#human(s)` then the D4 hook) and refuses the tester.
- `organization.set`, the chief's one write verb, reaches only `ORGANIZATION_KEYS` (`broker.mjs:145`),
-  which exclude `launch` and `retired`.
- `instances.set` is human or tester only (`broker.mjs:1248-1298`).
- Hire and fire carry no field that writes either list.
-
-T18 tests each of those paths from a chief session and checks the business file bytes are unchanged.
-
-END_PROTECTED instances can't be kept (N7). That is intended: Q169 lets the chief end the assistant's
-runs, and the assistant's own stop is `assistant.stop`. Default, per "unless user forbids": nothing is
-kept and nothing is on `noHire`.
-
-### D2.5 Where it lives and how the broker enforces it
-
-The forbid lives in the business file, under `launch`, beside the membership it limits:
-`launch.keep: [instance]`, `launch.noHire: [definition]`, and top-level `retired: [instance]`. `hireable`
-lives in the chief's role file, because it bounds the role, not one business.
-
-`checkLaunch` (`business.mjs:118`) gains the two keys. Each list is distinct. `keep` names declared,
-non-protected instances. `noHire` entries need only the id pattern (N2). A stale deny entry is harmless,
-and a reviewed commit that removes a role file must not stop every business that lists it. `retired`
-names none of `roles`. This is the business-file schema change for review. Old files without the keys load
-unchanged. An old bus loader rejects a file that has them (`rejectUnknownKeys`), so a rollback past this
-row needs the keys removed first. The activation plan has to say so (R4).
-
-The broker enforces from its live copy of the business, which D3 keeps current. The checks sit in the
-`role.revoke` reason branch, in `organization.set`'s model write and in the two chief verbs, before any
-write.
-
-## D3. Live changes
-
-Today the broker's `#businesses` is fixed at start (E3), and `instances.set` answers `restart: true` for
-add and redefine.
-
-1. `Broker.reloadBusiness(id, document)` swaps in one business's validated document. It is synchronous, so
-   no request sees half of it. It refuses an unknown id and a document whose `human` changed (that is row
-   193's ground).
-2. The runtime's organization callback (`runtime.mjs:121-133`) calls it in one place, after every verb
-   that commits a write, whatever the verb (N1). Today that is `limits.set`, `instances.set`, `routes.set`
-   and `plugins.set`, and after this row `veto.set`, `instance.hire`, `instance.fire` and the launcher's
-   delete through the same writer. It loads from the file through the loader `bootConfig` uses
-   (`cli/src/config.mjs:88-105`), so the broker holds exactly what a restart would give it. Then
-   `limits.refresh(id)` runs, as `plugins.set` does now.
-3. Other startup consumers of `businesses` in `startBroker` (`runtime.mjs:75-81`): credential references,
-   usage, the web services and the tasks adapter's bots. A create or hire adds no credentials, no tracker
-   bot and no web grant, because credentialed definitions are refused. The build checks each consumer
-   against that claim. Any change that would need one of them still answers `restart: true` and doesn't
-   reload.
-4. A definition change on a running instance refuses `instance-running`. A live cap must not change
-   authority under its run. This is new: today the change waits for the restart. Existing tests that pin
-   `restart: true` change with it (N4): `business/tests/instance-settings.test.mjs`,
-   `bus/tests/instances-verb.test.mjs`, `cli/tests/instances.test.mjs:76-94` (the `RESTART_NEEDED` text and
-   the restart line) and `webui/tests/instances.test.mjs:25, 71, 74, 140-145`. The build names each
-   changed assertion in its manifest.
-5. The chief's `launch` tool (E5) takes `instance` as a string with the id pattern instead of the start-time
-   enum. Its description says the host refuses an unlisted instance. `check()` already refuses one
-   (`launcher.mjs:235`). Without this, the chief can't launch its own hire until its session restarts.
-   `tools.mjs` may carry hash pins in tests. The build greps for them (R5).
-6. Hand edits of the business file still need a restart. Nothing watches the file. The one exception is
-   `bus.tester` (D4.1), read from the file at each tester call.
-
-After this, `restart` is false for create, delete, hire, fire and veto changes, and true only under item 3.
-
-## D4. RBAC until row 193
-
-Every human verb above calls `#human(s)` and then one hook, `#mayHuman(s, verb, target)`. Until row 193
-lands, the hook passes for the business's one `human`, which is the owner. The verbs are listed once, in
-an exported `LIFECYCLE_HUMAN_VERBS` (`instance.launch`, `instance.end`, `instance.regenerate`, `veto.set`,
-and `instances.set` ops `add`, `change`, `delete`), so row 193 maps each verb to the human roles that may
-use it. Row 193 replaces the hook body and nothing else.
-
-### D4.1 The tester (Sage, sage-1355)
-
-What the tester may do after this row:
-
-| Verb | Tester |
-|---|---|
-| `instance.launch`, `instance.end` | yes, new |
-| `instances.set` ops `add`, `change` | yes, as today (row 175, `broker.mjs:103`, `serve.mjs:537`) |
-| `instances.set` op `delete` | no, `tester-refused` in the broker (B6) |
-| `instance.regenerate`, `veto.set` | no, `tester-refused` |
-
-The tester's cap is bound to one business, and only when that business sets `bus.tester` to true
-(`broker.mjs:542-546`). That stays Jason's switch, and no bus verb writes it. Two checks run on each tester
-lifecycle call, before any effect, and again at the take (D1.1):
-
-1. The request's business is the cap's business. Any other refuses `tester-refused`.
-2. `bus.tester` is exactly true in the business file as it stands, read through `settings.current(id)` as
-   `harnessOn` does (`runtime.mjs:136-142`), not from the broker's copy (B8). An unreadable file refuses
-   `tester-off`. So a hand edit turning testing off counts at the next tester call, without a restart.
-
-The request and done events record actor `tester`. The tester's Q173 tests of the Agents section then cover
-launch and terminate on a scratch business, and the rest through fixtures.
-
-## D5. One stack instance
-
-Row 190 carries the stack instance as the config `MOSAIC_CONFIG` names. These verbs take no instance name.
-The CLI reaches the broker socket under that config's `dataRoot`. The broker acts on its own businesses,
-launcher and data root. A business id that exists in two stack instances is two separate businesses. A test
-runs two scratch roots with the same business id and shows a launch, a terminate and a delete in one leave
-the other byte-identical (T11).
-
-## D6. The kill switch
-
- Launch and regenerate end in `start()`, which row 191 gates (its D3 inventory, `launcher.mjs:329-457`).
-  The new pass adds no second start path.
- The broker refuses `instance.launch` and `instance.regenerate` with `processing-halted` while the switch
-  is on (V2 step 1), and the take checks again (D1.1), so no request is waiting when a human resumes.
- `instance.hire` and `instance.fire` are agent work verbs, so row 191's default refuses them while halted.
-  The build adds them to row 191's work table, not its read list. A hire Jason resolved before a halt
-  still refuses while halted, and the chief calls it again after the resume.
- Terminate, create, delete and veto start nothing and stay allowed.
- If row 191 hasn't landed when this row builds, the build chains on its candidate (Q177). The two halted
-  checks are written against its reader and tested with its fixture.
-
-## D7. The Console
-
-A new Settings section, "Agents", in its own `agents.js` file. Settings itself isn't rewritten. It lists
-each instance with definition, listed, kept, retired and running runs, and flags a run with a
-`lifecycle.end.alive` event as "still running after fire" (D2.2). It has these actions:
-
- Create (definition select, from `definitions`), Delete (with a confirm naming what stays: the evidence
-  and the workspace under `.retired`).
- Launch, Terminate (with an optional reason), Regenerate (with a confirm).
- Keep and Unkeep per instance, and a No-hire toggle per definition.
-
-The routes are `POST /api/instances` (op `delete` joins `add` and `change`), `POST /api/agent/launch`,
-`/api/agent/terminate`, `/api/agent/regenerate` and `POST /api/veto`. Each uses `instanceSend`'s boundary:
-signed-in user, exact Origin, same-origin Fetch Metadata, JSON within 16 KiB, strict keys, one bus call
-through the human transport, and `outcome-unknown` on an unexpected answer. Launch and regenerate show the
-request, then poll `GET /api/agent/request?id=` until it closes.
-
-`agents.js` joins the static file list (`serve.mjs:28`) and `index.html` (N5).
-
-When `/api/config` says `send` is false, every action button shows as unavailable with the text "Agent
-actions are unavailable here. Use mosaic business instance from the instance CLI." This is the live state
-until Q175 phase 2. Every write test uses a fixture server and fixture writers, as rows 165 and 191 do. No
-route gets a `--send` exception.
-
-## D8. Tests
-
-Every test uses scratch roots under `TMPDIR` and the existing fixtures (`business/tests/helpers.mjs`,
-`cli/tests/helpers.mjs`, `webui/tests/tester-fixture.mjs`). None touches `~/.mosaic-dev`,
-`~/.config/mosaic-dev`, a live unit or a slot file.
-
-| Test | Shows | File |
-|---|---|---|
-| T1 | V1 create on a running bus: a launch of the new instance binds with no restart, and the answer says `restart: false` | cli `instances.test.mjs` |
-| T2 | V2: a human launch of an unlisted instance runs. `launch.by` goes through the `pm` branch (N8). A thread instance, a retired one and a revoked business refuse at the verb. A request older than 60 s never launches. A refused `check()` closes the request with its code | cli `lifecycle.test.mjs` (new) |
-| T2a | Take: a `launch.revoke` between the request and the pass closes it `launch-revoked` with no process. A `lifecycleDone` that throws once leaves the request taken, and the next tick starts nothing. A taken request is never taken twice | same |
-| T3 | V2 with `--no-launch` and with each limit refusal: no process, request closed with the code | same |
-| T4 | V3: claims revoked, runner SIGTERMed after the start-time check, one end record. A mismatched start time sends no signal. An open request is cancelled and never starts. A spawned, unbound run in the registry is signalled | same |
-| T5 | V4: the new run starts only after the old exit, with a new run dir and the same workspace. A run that ignores SIGTERM closes the request `regenerate-timeout` with nothing started. The assistant refuses `regenerate-thread` | same |
-| T6 | V5: each refusal in the V5 table, in order, including `instance-starting` with an open request. A clean delete leaves the evidence bytes unchanged, commits the file before the rename, adds `retired`, and a create or hire of the same name refuses. A failed rename closes `workspace-rename-failed`, `check()` refuses the name, and a second delete renames only | business `instance-settings.test.mjs` and cli `lifecycle.test.mjs` |
-| T7 | V6: each op, the no-op refusal, an unknown `noHire` name accepted, and a `changes.jsonl` entry with actor `human` | business |
-| T8 | Chief hire (hard-wait form): no decision refuses. A decision raised by the chief goes to the human only, no arbiter. After the resolve, the hire adds and lists the instance, logs actor and decision, and the same chief session launches it (D3 item 5). Arguments that differ from the decision body refuse. A non-chief caller with a resolved decision refuses `role-not-chief`. Outside `hireable`, in `noHire`, credentialed, END_PROTECTED, retired, and extra vars each refuse | bus `chief-of-staff.test.mjs` |
-| T8a | Re-hire (B3): a fired name with the same definition and no vars is listed again. Another definition or vars refuses `organization-instance-exists` | same |
-| T8b | Hire allowlist (D2.3): one case per action in `ACTIONS` that is neither on `HIRE_ALLOWED` nor a hard wait (`role.mjs` already refuses those), looped from the lists, not typed by hand. A fixture definition, clean when the chief's role file loads and listed in `hireable`, is rewritten to hold that action before the hire. The hire refuses `definition-not-hireable`. A definition holding one allowed and one refused action refuses. One holding only allowed actions hires. A pin test fixes `HIRE_ALLOWED` to the six actions | same |
-| T8c | Allowlist at load: a role file whose `hireable` names a definition holding each refused action refuses at `loadRole`, one case per action, looped the same way. The mixed case refuses. A clean list loads. A missing, version 1 or duplicate name refuses | business `role.test.mjs` |
-| T9 | Chief fire: runs end, open requests cancelled, delisted, still in `roles`. Kept (even with a resolved decision), END_PROTECTED, `launch.by` and last-listed refuse | bus `chief-of-staff.test.mjs` |
-| T9a | Fire ends processes (F4, sage-1380 item 1): with a bound run and a spawned but unbound registry run of I, both fixture runners holding a stand-in model variable, fire answers both runs. After the launcher pass, neither runner pid is alive and I holds no claim. A fixture runner that ignores SIGTERM gets SIGKILL after the grace, is gone, and has `lifecycle.end.killed` with its run and pid. A stand-in whose kill is stubbed to fail gets `lifecycle.end.alive`. A runner whose identity changed before the SIGTERM, or between SIGTERM and SIGKILL, gets no signal. V3 terminate of a SIGTERM-ignoring runner sends no SIGKILL | cli `launcher.test.mjs` |
-| T9b | Fire and row 191's halt: a halt during a fire's stop sends no second SIGTERM, keeps the fire's deadline, writes one stop receipt with reason `fire` and the decision, and counts the run in its totals. A fire while halted refuses (D6) | cli `launcher.test.mjs`, on row 191's fixture |
-| T9c | Fire order (webby-0011 B2): the organization writer stubbed to fail after A commits. Fire answers the writer's code, I's claims are revoked and its runs stopped, I is still listed, and the decision is unconsumed. A second fire citing the same decision delists I and consumes it. A third fire refuses `decision-consumed`. With C stubbed to fail, the second fire finds I delisted and only consumes | bus `chief-of-staff.test.mjs` |
-| T10 | Keep: chief `role.revoke` with a reason, fire, hire of that name and an `organization.set` model write aimed at a kept instance each refuse `instance-kept`. A `role.revoke` citing a human-resolved decision ends the kept run (Q2). The human's V3 works | same |
-| T11 | Two scratch stack instances with the same business id: V2, V3 and V5 in A leave B's root and config byte-identical. A chief of business A can't hire into business B on the same bus | cli `lifecycle.test.mjs`, bus |
-| T12 | Agent and reader sessions refuse every human verb before any effect. The tester gets exactly the D4.1 table, including `tester-refused` for `instances.set` op `delete` (B6). The D4 hook is called with the verb | bus `instances-verb.test.mjs` |
-| T12a | Tester launch and terminate work on the cap's business with `bus.tester` true, record actor `tester`, and refuse `tester-refused` for a second business on the same bus. A file edit setting `bus.tester` to false, with no restart, refuses the next call and the take `tester-off`. An unreadable file refuses `tester-off` | bus `instances-verb.test.mjs` |
-| T13 | `organization.set` with `launch`, `retired`, `keep` or `noHire` keys refuses | bus |
-| T14 | Live reload: after each committed verb, `plugins.set` and `routes.set` included, the broker answers from the new document. A definition change on a running instance refuses `instance-running` | bus |
-| T15 | Kill switch (with row 191's fixture): launch and regenerate refuse `processing-halted` at the verb and at the take, hire and fire refuse, terminate works | bus and cli |
-| T16 | Console: each route's boundary refusals, a fixture write per action, `outcome-unknown` on a bad shape, unavailable buttons when `send` is false, request polling, and `agents.js` served from the static list | webui `agents.test.mjs` (new) |
-| T17 | Business file: the new keys validate, each bad entry refuses, and a file without them loads byte for byte as before | business `business.test.mjs` |
-| T18 | The forbid can't be changed by the chief (D2.4): from a chief session, `veto.set`, `organization.set` with each list key, `instances.set`, and hire and fire with extra fields all refuse, and the business file bytes are unchanged | bus `chief-of-staff.test.mjs` |
-
-### Mutants
-
-Each one must fail at least one test. They run against the candidate, and the file is restored and its
-sha256 checked after each one.
-
-| # | Change | Killer |
-|---|---|---|
-| M1 | `instance.launch` skips `#human` | T12 |
-| M2 | the pass calls `check()` without `human: true` | T2 |
-| M3 | the take accepts a request older than 60 s | T2 |
-| M4 | the take skips the `launch_state` check | T2a |
-| M5 | terminate signals without the start-time check | T4 |
-| M6 | regenerate starts before the old exit | T5 |
-| M7 | delete skips the running check | T6 |
-| M8 | delete skips `retired` | T6 |
-| M9 | delete clears `keep` instead of refusing | T6 |
-| M10 | delete removes the workspace instead of renaming it | T6 |
-| M11 | the `keep` check is removed from the `role.revoke` reason branch | T10 |
-| M12 | `noHire` is not read by hire | T8 |
-| M13 | fire deletes the instance from `roles` | T9 |
-| M14 | `reloadBusiness` isn't called after `instances.set` | T1, T14 |
-| M15 | the tool enum is kept | T8 |
-| M16 | the halted check is dropped from `instance.launch` | T15 |
-| M17 | the Console route skips the Origin check | T16 |
-| M18 | `veto.set` joins `TESTER_ORGANIZATION_VERBS` | T12 |
-| M19 | the tester's business scope check is dropped | T12a |
-| M20 | the tester's `bus.tester` file read is dropped | T12a |
-| M21 | hire skips the role file's `hireable` list | T8 |
-| M22 | the take doesn't write `lifecycle.taken`, so a request can be taken twice | T2a |
-| M23 | terminate doesn't cancel open requests | T4 |
-| M24 | delete skips the `instance-starting` check | T6 |
-| M25 | delete renames before it commits the file | T6 |
-| M26 | the tester's `instances.set` op `delete` refusal is dropped | T12 |
-| M27 | the `keep` check is dropped from `organization.set`'s model write | T10 |
-| M28 | the `keep` check is added to the `role.revoke` decision branch | T10 |
-| M29 | a re-hire accepts a different definition | T8a |
-| M30 to M36 | the broker's hire check accepts one action outside `HIRE_ALLOWED`, one mutant per action: `role.launch`, `role.end`, `organization.change`, `instance.name`, `review.verdict`, `git.merge.protected`, `decision.resolve.technical` | T8b |
-| M37 to M43 | the same seven, accepted by the load check in `role.mjs` only | T8c |
-| M44 | fire skips `instance-kept` when a decision is cited | T9 |
-| M45 | `instance.hire` skips the `launch.by` caller check | T8 |
-| M46 | `veto.set` skips `#human` | T18 |
-| M47 | the broker's hire check needs some action on `HIRE_ALLOWED` instead of every action | T8b |
-| M48 | the same in `role.mjs` only | T8c |
-| M49 | fire revokes the claims but writes no `lifecycle.end`, so no runner is signalled | T9a |
-| M50 | fire's signal skips spawned but unbound registry runs | T9a |
-| M51 | fire's stop drops the SIGKILL escalation | T9a |
-| M52 | SIGKILL is sent without the second identity check | T9a |
-| M53 | a killed runner gets no `lifecycle.end.killed` | T9a |
-| M54 | V3 terminate escalates to SIGKILL as fire does | T9a |
-| M55 | the halt sweep sends its own SIGTERM and restarts the deadline on a run fire is stopping | T9b |
-| M56 | fire delists before the store step | T9c |
-| M57 | fire consumes the decision in step A | T9c |
-| M58 | a second fire with nothing to revoke refuses `not-held` | T9c |
-
-## Scope and boundaries
-
- In the row: the verbs and passes above in `business` (vocabulary, role validation, instance-settings,
-  business validation), `bus` (broker verbs, reload, runtime callback), `cli` (instances command, launcher
-  pass, host ops), `harness` (the launch tool's schema, and the hire and fire tools), `webui` (routes and
-  the Agents section), the tests, the package READMEs and the PRD draft in this packet. `docs/TOOLS.md`
-  text goes to Sage.
- Named for review:
-  - Vocabulary: `role.hire` and `role.fire` join `ACTIONS` as hard waits, under REQ-WAIT-3. The commit
-    message names them as hard waits, as REQ-WAIT-3 requires.
-  - Role schema: the optional `hireable` key, validated in `role.mjs` (D2.3).
-  - Role file: `roles/chief-of-staff.json` gains `"hireable": []`. No authority change.
-  - Business file schema: `launch.keep`, `launch.noHire`, `retired` (D2.5).
- Not in the row: the routed form (after PRD 1.7), filling `hireable`, credentialed hires and deletes (row
-  199), clear context for the assistant (T1 item 7), human roles (row 193), SIGKILL escalation, and any
-  live activation or Console start.
-
-## Risks
-
- R1. Case 1's working roles (coder, reviewer, pm, cto) all declare credentials (E11), and pm, cto and
-  reviewer fail the hire allowlist anyway. Neither the human verb nor the chief can create or delete credentialed
-  roles until the credentials row (row 199). That is the largest gap against Case 1, and it isn't this
-  row's to close.
- R2. The human proof is path-bound and same-uid (P19 333). Any same-uid process that runs the tree's
-  `human-cli.mjs` can launch and delete. Row 190b's separate uid and row 193 narrow it. This row adds no
-  check of its own.
- R3. The 60 s request window means a slow `check()` (checkouts) can still start a run up to that point
-  after the CLI gave up. The CLI says so on timeout.
- R4. Rollback past this row needs `keep`, `noHire` and `retired` removed from each business file, and
-  `hireable` from the role file, or the old loaders refuse them. The activation plan states this.
- R5. `tools.mjs`, `serve.mjs`, `broker.mjs`, `vocabulary.mjs` and `role.mjs` may carry sha256 pins in
-  other packages' tests. The build greps the tests for every changed path plus a 64-hex value before
-  in-review, without a `head`.
- R6. With `hireable` empty, the chief can hire nothing until the policy commit in `roles/` that follows
-  the `prd.approve` resolve names a kind (Q4). Case 1's "as needed" waits on that commit and on PRD 1.7.
- R7. Fire's SIGKILL closes the SIGTERM-ignoring case (sage-1380). A runner still alive after SIGKILL
-  (an unkillable process, or a stop whose identity check fails) keeps the shared model token until the
-  human acts on `lifecycle.end.alive`. Only a per-agent model token (row 199 Q-M4, a later proxy row)
-  would let a fire revoke the token itself.
-
-## Questions and rulings
-
- Q1, ruled by Mos (mos-1015, mos-1017, through sage-1365): `role.hire` and `role.fire` ship as hard
-  waits Jason resolves. The routed form needs PRD 1.7, drafted in `PRD-1.7-DRAFT.md`. D2.1.
- Q2, ruled by Webby (webby-0003): keep blocks the chief's `role.revoke` reason branch, not its decision
-  branch. D2.4.
- Q3, ruled by Sage (sage-1355): launch and terminate are tester verbs scoped to the tester's own
-  business, behind `bus.tester`. D4.1.
- Q4, ruled by Sage (sage-1374): `hireable` stays empty in this row. Naming the first role kind is a
-  separate policy commit in `roles/` after Jason resolves the `prd.approve` decision. Tests use scratch role
-  files that name a kind. D2.3.
-
-## r2 changes against webby-0003
-
-| Finding | Where |
-|---|---|
-| B1 | D2.1: hard waits under REQ-WAIT-3, no role grant. The routed form is PRD 1.7 (packet draft) |
-| B2 | D2.3: the floor from sage-1365 item 4, checked at load and at hire, T8b, T8c, M30 to M43 (an allowlist since r4) |
-| B3 | D2.2 hire item 5: a re-hire keeps the definition, T8a, M29 |
-| B4 | D1.1: one `lifecycleTake` transaction re-checks and writes `lifecycle.taken`, T2a, M4, M22 |
-| B5 | V3 cancels open requests and signals unbound runs. V5 refuses `instance-starting`, runs under `serialize`, commits the file before the rename, and states the recovery. T4, T6, M23 to M25 |
-| B6 | V5 table and D4.1: the tester's delete refuses, T12, M26 |
-| B7 | D2.4: keep covers `organization.set`'s model write, T10, M27 |
-| B8 | D4.1: `bus.tester` is read from the file at each call and at the take, T12a, M20 |
-| Q2 | D2.4, T10, M28 |
-| N1 | D3 item 2: one reload after every committed write |
-| N2 | D2.5: `noHire` takes any id-pattern name |
-| N3 | D2.2: hire's vars limited to the model key and narrowing `limits.*` |
-| N4 | D3 item 4 names the tests that change |
-| N5 | D7 and T16: `agents.js` joins `serve.mjs:28` and `index.html` |
-| N6 | V3 and V4: no SIGKILL, `regenerate-timeout` |
-| N7 | D2.4: intended, Q169 |
-| N8 | V2 item 2 and T2 |
-
-## r3 changes against sage-1374, sage-1377 and Megavolt's F4
-
-| Item | Where |
-|---|---|
-| Q4 ruled: `hireable` stays empty, the first kind is a later policy commit in `roles/` | D2.3, R6, Questions |
-| `instance.name` joins the floor (Webby B2, mos-1023 item 6) | D2.3 table, T8b, T8c, M47, M48 |
-| F4: fire ends the fired agent's processes, since `ENV_ALLOW` gives every run the shared model token | D2.2, D7, T9a, M49 to M51, R7 |
-| `git.push.remote` routed to coder only (mos-1028 item 3, row 199 r3) | `PRD-1.7-DRAFT.md`, REQ-LAND-2 and the REQ-WAIT-3 append |
-
-## r4 changes against webby-0010, sage-1380 and megavolt-0008
-
-| Item | Where |
-|---|---|
-| webby-0010 B1: the deny-list floor becomes the allowlist `HIRE_ALLOWED`, so merge-gate, `decision.resolve.technical`, `policy.change`, `prd.approve` and any later action are refused | D2.3, Summary, R1, T8b, T8c, M30 to M43, M47, M48, PRD REQ-COS-3 bound |
-| webby-0010 N1: field-by-field compare of the call against the decision body, extra or missing keys refuse | D2.1 item 3 |
-| webby-0010 N2: the model write is in REQ-COS-3's text | `PRD-1.7-DRAFT.md` |
-| sage-1380 item 1: fire escalates to SIGKILL through row 191's per-run stop, and the order against a halt is fixed | D2.2, T9a, T9b, M51 to M55, R7 |
-| sage-1380 item 2 and megavolt-0008: REQ-LAND-2 binds one commit oid, and Megavolt's three text changes against row 199 r4 (e1aa6216c) | `PRD-1.7-DRAFT.md` |
-| webby-0011 B1: same as webby-0010 B1, M47 and M48 now allowlist mutants | D2.3 |
-| webby-0011 B2: fire runs store side first, then the delist, then the consume, safe to repeat | D2.2 order A to C, T9c, M56 to M58 |
-| webby-0011 N1: the remote-owner host check at each push | sent to Megavolt for row 199 |
-| webby-0011 N2: identity, not bare pid, at every check | D2.2 step 3 |
-| Q4: Webby's view matches Sage's ruling (empty) | no change |
@@ -1,327 +0,0 @@
-# PRD 1.8 draft: trusted actions within role guardrails, the manual mode, and grants the chief of staff
-# requests and the user approves
-
-Draft by Honker for Vikunja #434, under Mos's assignment mos-1117 (through Sage, sage-1525). Not approved.
-It changes nothing until Jason approves it as a `prd.approve` decision. Sage opens that decision and sends
-Mos its id. Base: `docs/prd/mosaic-stack.md` version 1.6 at 008746b6e, plus the version 1.7 text Jason
-approved (PRD-1.7-DRAFT.md r2, 9ba31b5b3, decision d52febb5, mos-1089). Where 1.7 is not yet written into
-the PRD file, this draft's anchors name 1.7's sections.
-
-Revision 2 makes Mos's edits a to f (mos-1124, through Sage, sage-1534) and fixes Duckworth's B1 and B2
-with notes N1 to N6 (duckworth-0057) on r1 at 3c30f1036. Revision 3 fixes Duckworth's C1 and takes
-notes N1 and N2 (duckworth-0058) on r2 at 60f5ca8fa, with Gizmoduck's enrollment wording
-(gizmoduck-0067). Revision 4 makes Mos's rulings on duckworth-0057 (mos-1129, through Sage, sage-1538)
-on r3 at d16ccdb91: only an Approve creates a grant, one decision for a grant that makes an account, and
-the arbiter route for `host.sudo`. Revision 5 fixes two stale notes from Duckworth's r4 check
-(duckworth-0061 N1), with no change to the requirement text. Revision 6 makes Mos's wording for those
-notes and adds two items for Jason at approval (mos-1138, through Sage, sage-1548), again with no change
-to the requirement text.
-
-For Jason at approval: "The main agent or chief of staff" in Q10 is read as one role under two names,
-the chief of staff. So only the chief raises a grant request, and your assistant passes your own request
-to the chief. That reading is Mos's (mos-1124). To change it, say so when you approve, and REQ-GRANT-1
-changes before the text goes into the PRD.
-
-Also for Jason at approval:
-
- Only an Approve creates a grant. A grant written into the business file by hand makes nothing. An agent
-  that runs as the same OS user as the stack can still write the stack's own store. That is the B7
-  residual (Q182 on dragon-lin, #423 on .53 and .54), and this version doesn't close it.
- Who decides a root command on another host changes. Once `host.sudo` is routed, a raise for it that
-  cites the spec and isn't within-role goes to the arbiter for its domain, as version 1.7 set for
-  `git.push.remote`, not to you. The grant and its allowlist still limit the command. In manual mode the
-  decision comes to you (REQ-TRUST-2).
- Revoke: Q188 says "you, Mos or the tester". "Mos" is read as your assistant (REQ-ROLE-4), limited to
-  grants in its own organization, and the tester may revoke only on a dev instance. That reading is Mos's
-  (mos-1124 d, mos-1132). To change it, say so when you approve, and REQ-GRANT-4 changes before the text
-  goes into the PRD.
- The broker enforces only that the chief of staff raised a grant request. The rest of the chain of
-  command is the messaging lists and the role contracts, not a broker check (REQ-GRANT-1).
-
-## What it changes
-
-Today an agent acts without a raise only on actions its role file grants within-role, and the role
-files grant few. Every other use of a tool or command waits on a decision. Row 210 builds `host.sudo` as a
-hard wait, so Jason would decide each command run on another machine. Grants themselves are hand work:
-Jason makes every token and key from a runbook (REQ-CRED-1).
-
-Jason's ruling Q188 turns this around. Roles set what each agent may do, and by default agents do it at
-will within their sandbox and guardrails. A per-use raise happens only in a manual mode. No agent creates
-a grant. The chief of staff brings a grant request to the user's inbox, the user clicks Approve or Deny, and
-protected stack code does every step of making the grant. The user's own tokens are entered once in the
-WebUI and never reach an agent.
-
-This version adds:
-
-1. Trusted actions within role guardrails as the default mode (REQ-TRUST-1).
-2. Manual mode, a list of actions that each need a decision per use: who sets it, where it lives and what
-   it changes (REQ-TRUST-2).
-3. Grant requests, raised only by the chief of staff through the chain of command (REQ-GRANT-1).
-4. Approve and the protected grant code, with three grant methods: machine key, Gitea and GitHub
-   (REQ-GRANT-2).
-5. The user's tokens, entered in the WebUI and used only by the grant code (REQ-GRANT-3).
-6. Row 210's REQ-CRED-4, generalized from `host.sudo` to every role-listed action that uses a grant
-   (REQ-CRED-4).
-7. Instant revoke (REQ-GRANT-4).
-
-The hard waits stay with the user (Mos, mos-1117): spending money, deleting data, new external accounts,
-messages outside the fleet and the rest of REQ-WAIT-1. Approving a grant is the user resolving one of
-those hard waits, `credential.mint`. A grant that makes an account, such as a seat's own Gitea user
-(Q190), is the same one decision: its method says it makes an account, and the inbox shows the account
-name before Approve. So no hard wait moves to an agent.
-
-When this version lands, reviewed commits:
-
-1. add the manual-mode list to the organization file schema, written only on the human's path
-   (REQ-TRUST-2), and make the broker classify a listed action as needing a decision for each use, before
-   any other routing.
-2. add the grant request: a decision the chief of staff raises with action `credential.mint`, naming the
-   agent, the method and target, the exact rights and, when the method makes an account, the account
-   name (REQ-GRANT-1). The broker refuses a `credential.mint` raise from any other role. An
-   `account.create` raise isn't a grant request and routes as it does in version 1.7, such as a PM's
-   sign-up for a service.
-3. add the grant code that runs on a resolved Approve, one method at a time, and the grant record it
-   writes (REQ-GRANT-2, Vikunja #435 and #436).
-4. add the user's token store, written from the WebUI (or the CLI until the Console knows the signed-in
-   human) and read only by the grant code (REQ-GRANT-3).
-5. move `host.sudo` into both `ROUTED` lists, as row 199 does for `git.push.remote`, and route it under
-   REQ-CRED-4, with the arbiter route version 1.7 set for `git.push.remote`. Which definitions list it
-   within-role is a separate reviewed role commit in `roles/`.
-6. update the role contracts that list the hard waits: `roles/chief-of-staff.md:75` raises grant
-   requests with the REQ-GRANT-1 fields, and `roles/pm.md:55` asks the chief of staff for a grant instead
-   of raising `credential.mint` itself (line numbers on origin/refactor). Other roles that list the hard
-   waits get the same line as the PM. A role's messaging list carries the chain of command.
-
-## Text for the PRD
-
-Status line, appended to the current paragraph:
-
-> Version 1.8 records Jason's ruling Q188 of 2026-10-20: trusted actions within role guardrails by
-> default, a manual mode for per-use raises, and grants the chief of staff requests and the user
-> approves, approved by Jason in decision <prd.approve decision id>.
-
-Source, two new bullets above "Version 1.7 source":
-
-> - Version 1.8 source, Jason's ruling Q188 (DECISIONS, 2026-10-20), his answers to Q8 and Q10, in part.
->   Q8: "I would rather grant the grant right to an agent that runs with strict guardrails. That agent
->   presents the final authorization for the user. Upon approval, the grant is created programmatically.
->   I see this as: User configures their PATs, API tokens, authorizations within the WebUI. The agent
->   presents the request for grant with X rights for another agent. The user reviews, then clicks
->   Approve/Deny. Click of Approve fires off protected mechanical methods to handle the grants on Github,
->   Gitea, .... services as needed. The tooling would need to exist and must be guarded." And "Disallowing
->   the agents to create grants autonomously is a necessary evil for better security. Requiring the user
->   to manually perform the steps is a no-fly." Q10: "Agents should have tools and command access based on
->   roles. Those roles dictate the allowed tools and commands. The use of a tool or command should not be
->   raised to the user unless the system is configured with a manual mode that requires user
->   interaction. By default I want to have the agents capable of running commands and tools at will
->   within their sandbox/guardrails. This allows autonomous actions by agents within their lanes. Perhaps
->   a "Trusted actions within approved guardrails" methodology." And "The main agent or chief of staff
->   would be responsible for surfacing the request to the user's inbox for approval. Not all agents are
->   capable or authorized to request directly. It must follow the chain of command properly." He agreed
->   with Mos's Q10 points 3 to 6: protected stack code does every step on Approve, his tokens are entered
->   in the WebUI and agents never see them, a command on the approved list runs without a click and any
->   other is refused, and he, Mos or the tester can revoke a grant at once.
-> - Version 1.8 source, Jason's ruling Q190 (DECISIONS, 2026-10-20), his answer "Q12: O1": each agent seat
->   gets its own account on his Gitea, created through the Q188 approval path once the Gitea grants exist.
-
-Under "Decisions", after REQ-DEC-6, a new section:
-
-> ### Trusted actions
->
-> Added in version 1.8 (Q188).
->
-> - **REQ-TRUST-1.** Agents act within their role guardrails without asking. The default mode is
->   "trusted actions within approved guardrails". An action a role file grants within-role is done at
->   will, inside the agent's sandbox, its tool limit and its grants, and is logged. It raises nothing to
->   the user. An action the file doesn't grant within-role still routes by REQ-DEC-2, and a hard wait
->   still goes to the user (REQ-WAIT-1). Only a reviewed role change adds an action to a role file, and
->   REQ-WAIT-2 still keeps every hard wait out of every role file.
-> - **REQ-TRUST-2.** The user can put chosen actions in manual mode. The organization file holds the list
->   of actions in manual mode, empty by default. While an action is on the list, every use of it by any
->   role becomes a decision for that use, raised to the user, and the action waits until the user
->   resolves it. A decision denied, or not resolved, refuses the action. Each decision is used once. For a
->   command on another host, the decision names the host, the command and its input. Actions not on the
->   list are unchanged. Only the user changes the list, through the WebUI or the CLI. The chief of
->   staff's organization writes (REQ-ROLE-3) can't change it, and no agent can. Every change is logged
->   with who made it. A change applies to the next use, and a run already in progress keeps no
->   exemption.
-
-Under "Credentials", after REQ-CRED-3 (version 1.7):
-
-> Added in version 1.8 (Q188):
->
-> - **REQ-CRED-4.** An action a role definition lists within-role, and that uses a grant, runs without a
->   decision for each use only when all of these hold:
->   - the definition declares the credential kind the action uses;
->   - a grant names that agent, and that host or service;
->   - for a command, the command matches the grant's allowlist. A grant lists exact argv prefixes. A
->     wildcard grant is refused;
->   - the agent's key or token for that grant is issued and not revoked.
->
->   A command off the allowlist is refused, and adding one takes a new grant request (REQ-GRANT-1). An
->   action whose definition doesn't list it within-role still needs a decision for each use. Only a
->   reviewed role change adds an action to a definition. `host.sudo` routes under this requirement.
-> - **REQ-GRANT-1.** No agent creates or writes a grant. A grant request follows the chain of command,
->   and only the chief of staff raises it to the user's inbox. Any other role that needs a grant for
->   itself or for an agent it directs asks the chief of staff, through its chain: a worker role through its
->   PM, the PM and the CTO directly. The assistant passes the user's own request to the chief of staff
->   (REQ-ASSIST-1). The request names the agent, the grant method and its target, the exact rights, and a
->   rotate-by or expiry date. The chief raises one only for an agent whose reviewed role definition
->   allows that kind of credential, and the broker refuses any other. A grant can't name a wildcard, a
->   shell or an empty command. The request is a decision with the action `credential.mint`, so it goes
->   to the user as a hard wait (REQ-WAIT-1). A grant whose method makes an account, such as a seat's own
->   Gitea user (Q190), is the same one decision: the method in the grant says it makes an account, the
->   request names the account, and the inbox shows the account name before Approve. The user's one
->   resolution covers the account and its credential, so the hard-waits list doesn't change. An
->   `account.create` raise isn't a grant request and routes as version 1.7 has it. The broker checks
->   only that the chief of staff raised the request. The chain of command before that is in the
->   messaging lists and the role contracts, not a broker check.
-> - **REQ-GRANT-2.** The user approves or denies each grant request in the inbox. Approve is the only thing
->   that creates a grant, and the code uses a grant only when it has a matching Approve record. No agent
->   creates a grant. A grant written into the business file by hand makes nothing. Row 210's hand-written
->   grants stay a test path until Vikunja #436a moves `host.run` to grants made by Approve. On Approve,
->   protected stack code does every step, not an agent and not the user: it records the grant, makes the
->   key or token, installs it on the machine or creates it on the service, and logs each step. On Deny
->   nothing is made, and the denial is logged. The grant methods are:
->   - machine key: a key for one agent on one enrolled host, with the command allowlist of REQ-CRED-4. A
->     host's identity comes from the host side when the user approves its enrollment, never from a first
->     connection. A host user with sudo receives a grant only after the user approved that user by name;
->   - Gitea: a token for one agent, and for an agent seat its own Gitea user (Q190), with an expiry. The
->     all scope and the admin scope are never granted;
->   - GitHub: a grant for one agent.
->
->   The Gitea and GitHub rights units come in a later design that Jason approves.
->
->   The approval binds the exact rights the user saw and the target or its enrolled identity. A change to
->   the agent, its definition, the target, the target's identity or the rights after the raise voids it. An
->   approval is used once. A grant the code couldn't finish is undone at once on the stack's side, so it
->   is never used. What it left on the host or service stays visible as pending until it is removed, as
->   for a revoke (REQ-GRANT-4). A new grant needs a new approval, never an automatic retry. The grant
->   code runs only on a request the user resolved. A request resolved by an arbiter, the tester or any
->   agent makes nothing. A `credential.mint` decision raised before version 1.8, or without the fields of
->   REQ-GRANT-1, makes nothing when it is approved. Until the Console
->   knows the signed-in human (Vikunja #412), Approve is `mosaic decide` in the CLI (REQ-DEC-3).
-> - **REQ-GRANT-3.** The user enters their own personal access tokens and API tokens in the WebUI, or the
->   CLI. Only the grant code reads them, to make grants. No agent ever sees a token value or a key's
->   private half. Values appear in no event, log, message, prompt or agent file, and no agent can read
->   them back (REQ-VAR-2). Until the Console knows the signed-in human, they are entered through the
->   CLI.
-> - **REQ-GRANT-4.** A grant can be revoked at once by the user, by the assistant for a grant in its own
->   organization, or by the tester on a dev instance (Q173). A revoke needs no decision and no new trust.
->   It takes effect at once on the stack's side, without waiting on the network, so the next use is
->   refused. Removing the key or token at the host or service follows. Until that removal is done it stays
->   visible as pending. A revoke while the grant is being made stops it, and nothing it made stays usable.
->   Every revoke is logged with who made it.
-
-REQ-CRED-1, appended:
-
-> Since version 1.8, a token or key for a grant is made by the grant code on the user's Approve
-> (REQ-GRANT-2), not by hand. Tokens that exist stay as they are.
-
-REQ-WAIT-3, appended:
-
-> `host.sudo` was added as a hard wait and routes under REQ-CRED-4 since version 1.8.
-
-Under "Risks and open questions", a new bullet:
-
-> - Trusted mode lets an agent run its allowed commands at will. On another host, an allowed command that
->   writes a file as root or starts a shell can plant a key, and the seat sandbox doesn't confine the
->   network, so root can outlive the grant and a revoke. The allowlist narrows this. A seat sandbox with
->   its own network namespace closes it. Until then the host's own audit log is the check after the fact
->   (row 210 design section 6).
-
-## Notes for the reviewer and for Mos
-
- REQ-TRUST-1 restates what REQ-DEC-2 already does for within-role actions ("routine and within-role
-  decisions are logged") and names it as the default mode. It grants nothing new by itself. What widens
-  is the role files, one reviewed commit at a time.
- The hard waits stay with the user (mos-1117). REQ-GRANT-1 makes the grant request a `credential.mint`
-  decision, already a hard wait under REQ-WAIT-1, so Approve is the user resolving it. REQ-WAIT-2 stands:
-  no role file grants `credential.mint`. The grant code acts on the user's resolution, not on a role
-  grant. A grant that makes an account, such as a seat's Gitea user under Q190, is the same one
-  `credential.mint` decision. So 1.8 doesn't change the hard-waits list (mos-1124 a, mos-1129 N4).
- Manual mode: Sage asked who sets it, where it lives and what it changes. Mos accepted these choices
-  (mos-1124 b), and Jason can change them: a list of actions in the organization file, empty by
-  default, changed only by the user, outside the chief's organization writes. A list rather than one
-  switch follows Gizmoduck's #436 draft section 7 (gizmoduck/machine-grant-design f6b6a04b6), so Jason
-  can make host commands manual without making every action manual. Listing every within-role action
-  gives the whole-organization manual mode. Row 210's per-call `host.run` decision, bound to host, argv
-  and stdin and spent once, is this mode's decision for a host command (Q188, Mos's reading).
- Gizmoduck's draft proposes REQ-CRED-5 (section 8) for the machine grant. Its content is in REQ-GRANT-1
-  to REQ-GRANT-4 here, generalized to all three methods, so 1.8 has no REQ-CRED-5. Their bounds in
-  gizmoduck-0062 items 4a to 4g are in the text: the chief raises only for an allowed definition, the
-  approval binds the rights shown, it is used once with no automatic retry, no value is ever seen, revoke
-  is at once on the stack's side with the host or service removal visible until done, every grant has a
-  rotate-by or expiry date, and the host identity comes from the host side. Duckworth has reviewed their
-  design r1 to r4 (duckworth-0056 and duckworth-0060), so a later change there may need a change here.
- B1 (duckworth-0057, mos-1129): a grant the code couldn't finish is undone at once on the stack's side.
-  What it left on the host or service stays visible as pending until it is removed, as for a revoke.
- B2 (duckworth-0057, mos-1129): Mos chose Duckworth's second option. Only an Approve creates a grant,
-  and the code uses a grant only when it has a matching Approve record. A grant written by hand makes
-  nothing. Jason's Q188 gives the reason: "Disallowing the agents to create grants autonomously is a
-  necessary evil for better security" and "Upon approval, the grant is created programmatically." Row
-  210's hand-written grants stay a test path until #436a moves `host.run` to grants made by Approve. r2
-  and r3 had a hand path in the business file, and r4 takes it out, with r3's load check on hand grants
-  (duckworth-0058 N1) and the note that a revoke never rewrites the user's file (duckworth-0058 N2).
-  The same-uid write to the stack's own store stays the B7 residual, and the top of this draft names it
-  for Jason.
- C1 (duckworth-0058, sage-1538): `account.create` is the hard wait for any new external account, not
-  only a grant (REQ-WAIT-1, `vocabulary.mjs:43-46`, `roles/pm.md:55`). It stays as version 1.7 has it.
-  Only `credential.mint` is chief-only, and a grant that makes an account is a `credential.mint`
-  decision (N4), so a PM's sign-up for a service routes as before.
- Gizmoduck's machine-grant r2 (eb4c756a1, gizmoduck-0067): enrollment is a request the user approves
-  and the stack runs (mos-1120), and a host user with sudo is enrolled by name, the user's Approve
-  covering that user (mos-1125). REQ-GRANT-2's machine key says both. Their design r3 and r4 (1c5705d6d
-  section 6) give revoke to the user, the assistant in its own organization and the tester on a dev
-  instance, as REQ-GRANT-4 does (mos-1124 d).
- N1 (duckworth-0057, mos-1129): the approval binds the target or its enrolled identity.
- N2 (duckworth-0057, mos-1129): a revoke during creation stops it, and nothing it made stays usable.
- N3 (duckworth-0057, mos-1129): landing step 6 lists the role contract updates (`roles/pm.md:55`,
-  `roles/chief-of-staff.md:75`). A `credential.mint` decision raised before 1.8, or one without the
-  grant fields, makes nothing when it is approved.
- N4 (duckworth-0057, mos-1129): a decision carries one action (`a.action`, broker.mjs:1678 on
-  origin/refactor). A grant that makes an account is one `credential.mint` decision: the method in the
-  grant says it makes an account, and the inbox shows the account name before Approve. The user clicks
-  once, and there is no separate `account.create` action for it. Gizmoduck's machine-grant r2 reads it
-  the same way.
- N5 (duckworth-0057, mos-1129): `host.sudo` keeps the arbiter route version 1.7 set for
-  `git.push.remote`. A raise for it that cites the spec and isn't within-role goes to the arbiter for
-  its domain (broker.mjs:1677-1678 on origin/refactor), and the grant and its allowlist still limit the
-  command. In manual mode the decision goes to the user. The top of this draft names this for Jason as a
-  change in who decides a root command on another host.
- N6 (duckworth-0057, mos-1129): the broker enforces only that the chief of staff raised a grant request.
-  The rest of the chain of command is the messaging lists and the role contracts (step 6 of "When this
-  version lands"). REQ-GRANT-1 says so.
- Approving a grant doesn't by itself let a command run without a click. That needs REQ-CRED-4 and
-  `host.sudo` in the routed lists, step 5 of "When this version lands" (gizmoduck-0062 item 4i).
- Which roles may request: Q188 says "Not all agents are capable or authorized to request directly. It
-  must follow the chain of command properly." The text makes the chief of staff the only role that raises,
-  the PM and the CTO ask it directly, and worker roles ask through their PM. Jason's words also name "the
-  main agent", but REQ-ASSIST-1 keeps the assistant out of directing agents, so it passes the user's
-  request to the chief rather than raising one. Mos accepted this (mos-1124 c) and reads "the main agent
-  or chief of staff" as one role under two names. That reading is Mos's, so the top of this draft puts it
-  to Jason at approval.
- REQ-CRED-4 keeps row 210's conditions (origin/gizmoduck/row210-on-199-r2,
-  agents/gizmoduck/work/queue-210/DESIGN.md:376-392): the definition declares the kind, the grant names the
-  agent, an exact argv-prefix allowlist with wildcards refused, the key issued, and only a reviewed role
-  change adds the action. Row 210 put the grant in a hand-edited business file, which stays a test path until
-  #436a. Under 1.8 the grant is what Approve records, so "the business file grants that agent that host"
-  becomes "a grant names that agent and that host".
- Revoke: Q188 says "you, Mos or the tester". Mos is Jason's assistant (REQ-ROLE-4), so the text says the
-  assistant, limited to grants in its own organization, and the tester only on a dev instance (Q173).
-  Mos accepted this with those limits (mos-1124 d).
- Approve in the Console needs the Console to know the signed-in human (Q175 phase 2, #412). Until then
-  Approve is `mosaic decide`, which REQ-DEC-3 already allows (mos-1124 e). This draft doesn't take
-  REQ-WEB-2, which stays with the Console decide buttons amendment (Vikunja 19/266). That amendment, or a
-  later version, moves Approve into the Console.
- Roles already use a scoped Gitea token (`<read|write>:<category>`, all and admin never granted,
-  `packages/business/src/vocabulary.mjs:105-106` on origin/refactor). It is a likely Gitea unit, not a settled
-  one. Only the machine key is designed so far. Gitea and GitHub are a later #436 draft, and minting a Gitea
-  token needs an admin credential the user enters, which is a design of its own (Gizmoduck's draft section
-  11). GitHub's rights unit isn't settled. So the text leaves both units to a later design Jason approves
-  (mos-1124 f), and keeps only the bounds: an expiry, and never the all or admin scope. The PRD names outcomes
-  and checks, not the grant code's steps, as REQ-CRED-3 does.
- Jason expects the inbox Approve and the Gitea and GitHub grants by 10-27 (Q188 point 6). That is a
-  delivery date, so it is in the source and not in the requirement text.
- This draft follows the PRD's own style: plain words, no semicolons in new sentences, and the status
-  paragraph never edited in place except to append.
@@ -0,0 +1,75 @@
+# Row 237: one decision publishes once (#1743)
+
+Megavolt, 2026-10-21 (from `date -u`). Brief: `docs/plans/2026-10-20_agent-credentials.md`
+§ "row 199 follow-up N1", blob dca67d310e1b. Source: Duckworth's row 199 round 1 note N1
+(duckworth-0068). Base: `cb5fdb064` (row 199's landing). Reviewer Duckworth, gate owner Sage.
+
+## The defect
+
+`checkPublish` opens a ticket after checking the decision is unspent. The decision is spent only at
+`recordPublish`, which runs after the bus process has pushed. Two `checkPublish` calls on one decision
+therefore both get tickets, and both push. With different branches, the commit lands on two fork refs:
+`refs/heads/<user>/feat` and `refs/heads/<user>/other`. The second `recordPublish` then refuses
+`decision-consumed`, but by then its push has already reached the fork.
+
+## The fix, and why this option
+
+`checkPublish` refuses `publish-busy` when an open ticket in `#publishes` holds the same business and
+decision (`packages/bus/src/broker.mjs:1038-1040`). It runs after the authority and fact checks, so a
+spent decision still refuses `decision-consumed` first.
+
+The brief's other option, rechecking `#spent` in `publishTarget`, doesn't close the race. Both tickets
+reach `publishTarget` before either push ends, and nothing is spent until `recordPublish`. So both
+rechecks pass and both pushes run. The only state that exists while the first push runs is the open
+ticket, so the check reads that.
+
+A refusal (`publishRefused`) drops the ticket and leaves the decision unspent, so a retry on the same
+decision gets a new ticket. That is row 199's behaviour, unchanged. A within-role publish has no
+decision and isn't affected.
+
+## Tests
+
+- `packages/bus/tests/publish.test.mjs:186`. A second ticket refuses `publish-busy`, on the same branch
+  and on another. After `publishRefused` the retry gets a ticket and a third refuses busy. After
+  `recordPublish` there is one `action.allowed` for git.push.remote and the next call refuses
+  `decision-consumed`. Another agent's decision on the same task isn't held.
+- `packages/cli/tests/publish-socket.test.mjs:269`. End to end through the git socket, the bus runtime
+  and the TLS fake Gitea. While the first publish holds its ticket, a second publish on the same
+  decision to branch `other` gets `publish-busy`. The fake Gitea gets exactly one `git-receive-pack`,
+  the fork has only `refs/heads/coder/feat`, and there is one `action.allowed`.
+
+Runs on this branch, single files:
+- publish.test.mjs: 13/13.
+- publish-socket.test.mjs: 8/8.
+
+## Mutant
+
+M1 removes the `publish-busy` line. Both tests fail:
+- The bus test fails at the first busy assert.
+- The cli test fails because the second publish answers `ok: true` with `ref: refs/heads/coder/other`.
+  That is the defect: two refs on the fork.
+
+Logs are in `/mnt/storage/scratch/megavolt-r237/` (m1-bus.log, m1b-cli.log). `cmp` confirmed
+broker.mjs matched the saved copy after the restore. The first cli mutant run (m1-cli.log) was against
+a hook that recursed on every checkPublish. I fixed the hook to fire only for branch `feat` and reran
+it (m1b-cli.log).
+
+## Residuals, not fixed here
+
+1. **A ticket that never ends holds its decision until the bus restarts.** `#publishes` is in memory.
+   That happens when the host dies between checkPublish and recordPublish or publishRefused. It fails
+   closed (`publish-busy`), and a restart clears it.
+2. **publish-timeout (sage-1440).** The socket files `publishRefused` and drops the ticket, but the bus
+   process's push may still be running. A retry on the same decision can then open a ticket while that
+   push is live. This is the same residual the socket already logs ("the bus process's push may still
+   reach the fork"). Closing it means the runtime's `remotes` must keep the decision busy until its push
+   settles, which reaches into runtime.mjs. That is beyond the brief's two options.
+3. **checkLand has the same shape.** `#landings` takes a ticket per call and the decision is spent at
+   `recordLand`. Whether two landings on one decision can both reach main isn't checked here. That's a
+   follow-up for Sage to row or dismiss.
+
+## Gate
+
+Per the brief: Duckworth approves the manifest, the bus suite and every `scripts/test-*.sh` are green
+on Sage's gate, and M1 is killed. This row also changes a cli test file, so the cli suite (or that file
+alone) should run on the gate too.
@@ -0,0 +1,71 @@
+# Row 241: one decision lands once (#1747, P19 441)
+
+Megavolt, 2026-10-21 (from `date -u`). Brief: `docs/plans/2026-10-20_agent-credentials.md`
+§ "Brief: row 237 follow-up, one decision lands once, with tests at the broker", c25785d3d. Source:
+row 237 residual 3, megavolt-0068, megavolt-0069 and sage-1651. Base: origin/refactor f5753c0e8, row 210's landing.
+Reviewer Duckworth, gate owner Sage. Tests only; no source changes.
+
+## Why landing has no row 237 race
+
+Row 237 fixed publish: two tickets on one decision both pushed, because the decision is spent only
+after the push, and a push to a remote fork can't be taken back. Landing has the same ticket shape
+(`checkLand` opens a ticket, `recordLand` spends the decision), but three guards keep one decision
+from landing twice:
+
+1. **land-busy, the outer guard.** `doLand` in `packages/cli/src/git-socket.mjs:351` refuses
+   `land-busy` while another landing runs. The slot is taken before the first await, and freed only
+   when the landing ends. There is one git socket per launcher, and one host per dataRoot (host.lock).
+   So through the socket two landings never overlap, and a later one stops at `checkLand` with
+   `decision-consumed`. Even past that, applying the same reviewed patch to the new main fails
+   `base-conflict` in `prepareLand`.
+2. **The CAS on main.** `finishLand` (`packages/seat/src/working.mjs:391`) moves main with
+   `update-ref main <commit> <old>`, so a landing prepared on a tip that has since moved refuses
+   `base-moved` and writes nothing.
+3. **The recordLand recheck.** `finishLand` calls `record()`, which is `recordLand`, under the same
+   repository lock. `recordLand` runs `#landFacts` again (`packages/bus/src/broker.mjs:963`), which
+   refuses `decision-consumed` once the decision is spent. When `record()` throws, `finishLand` moves
+   main back.
+
+Guards 2 and 3 can't be reached end to end, because guard 1 stops a second landing first. So they are
+pinned below the socket, and no test bypasses land-busy.
+
+### The unrecorded-commit window
+
+Between the `update-ref` and the end of `record()`, main names the squash, which isn't recorded yet.
+That window is under the repository's lock, so no other push, review or landing in this host sees
+it. If `record()` refuses, main moves back. If moving back fails, `finishLand` refuses
+`rollback-failed` and main keeps naming an unrecorded commit (tested at `working.test.mjs:555`, the
+main.lock case). That is existing behaviour, unchanged here.
+
+## The test
+
+`packages/bus/tests/land.test.mjs:312`. Two tickets pass `checkLand` on one decision before either
+records. `recordLand` on the first lands. `recordLand` on the second refuses `decision-consumed`
+(:319), and leaves one merge `action.allowed`, one RESULT and no `action.refused`. `landRefused`, as
+the socket would call it, then files the refusal and ends the ticket.
+
+**The assert that pins the recordLand recheck is :319.** The `#spent` line is shared with
+`checkLand`, so dropping it also fails :144 (a `checkLand` after the decision is spent). Only :319
+shows the recheck at record time.
+
+Single file on this branch: land.test.mjs 18/18.
+Whole suites on this branch before in-review: bus 500/500, seat 164/164, cli 565/565 (02:52 to 03:01Z).
+
+## Mutants
+
+| Mutant | Change | Killed by |
+|---|---|---|
+| M1 | drop the `#spent` line in `#landFacts` (broker.mjs:963) | land.test.mjs: :312 at :319, and :94 at :144 (16/2) |
+| M2 | drop `land.old` from the `update-ref` in `finishLand` (working.mjs:391) | working.test.mjs:555 at :567, the `base-moved` assert (25/1) |
+| M3 | drop the `land-busy` throw (git-socket.mjs:351) | git-socket.test.mjs:812 at :825, the `land-busy` assert (23/1) |
+
+Each run was one test file on base f5753c0e8 (row 210's landing, which moved the `#spent` line from
+:945 to :963), 2026-10-21 02:51Z. Each assert failed with "Missing expected exception" or "rejection".
+`cmp` confirmed each source matched its saved copy after the restore. M2 is killed by the existing
+working.test:555, so per the brief working.test.mjs isn't changed. Logs: `/mnt/storage/scratch/megavolt-r241/`
+(m1.log to m3.log, with each diff).
+
+## Gate
+
+Per the brief: Duckworth approves the manifest; the bus, seat and cli suites and every
+`scripts/test-*.sh` are green on Sage's gate; the three mutants are killed.
@@ -0,0 +1,108 @@
+# Row 242 build: a retry after publish-timeout pushes once
+
+Row 242, #1748, P19 440. Brief: docs/plans/2026-10-20_agent-credentials.md, "Brief: row 237
+follow-up N1, a retry after publish-timeout pushes once" (9d165be8c). Base: origin/refactor
+8fede5fc6 (row 210 landed f5753c0e8).
+
+## The defect
+
+The git socket polls publishResult until publishDeadlineMs, then refuses publish-timeout
+(packages/cli/src/git-socket.mjs:433) while the bus process's push (runtime publishPush) can
+still be running. The socket then calls publishRefused, which went straight to
+broker.publishRefused: it filed the refusal and deleted the ticket. checkPublish no longer saw an
+open ticket on the decision, so a retry got a new ticket and pushed a second ref while the first
+push was still on its way to the fork.
+
+## Fix chosen: hold the decision until the push ends, then record a push that reached the fork
+
+packages/bus/src/runtime.mjs, `publishRefused` and `settle`:
+
+- If the bus has no push for the ticket, publishRefused goes to the broker as before.
+- If the push is still running, the refusal code is held on the entry and the ticket stays open.
+  checkPublish refuses another publish on the decision with publish-busy (row 237's check),
+  the same as when the socket is still polling.
+- When the push ends, `settle` runs:
+  - A push that reached the fork is recorded with broker.recordPublish, which spends the
+    decision. The bus logs `pushed after the git socket refused <code>; recorded`.
+  - A push that failed is filed as publishRefused with the socket's code.
+  - If recordPublish refuses with a BusError, that code is filed instead.
+- If the push has already ended when the refusal arrives, it's settled at once. The sage-1440 test
+  relies on this: its push fails fast, so publish-timeout is filed once, immediately, as before.
+
+Why hold rather than kill. Killing the git client doesn't undo a push the fork has already
+received: receive-pack can update the ref after the client dies. After a kill the bus would have
+to ls-remote the fork to learn what landed, and the result could still race the server. Holding
+waits for the push's own outcome. Each git run in publishRemote already has its own limit
+(publishRemote defaults to checkout.mjs GIT_LIMITS), so a hold is bounded. Holding also reuses the existing publish-busy
+state, and the refusal text is unchanged.
+
+Why record and not only hold. If the hold just filed publish-timeout once the push ended, the
+ticket would close and the decision would be free again with a ref on the fork. A retry would then
+push a second ref. Recording the late push spends the decision, so the retry gets
+decision-consumed.
+
+The publish-timeout refusal text is unchanged (brief condition).
+
+## Test
+
+packages/cli/tests/publish-socket.test.mjs:302, "row 242: a retry after publish-timeout refuses
+publish-busy while the bus process's push runs; the late push is recorded and the decision pushes
+once".
+
+- publishDeadlineMs 150 and a store token. The fork's pre-receive hook writes `held`, then loops
+  until the test writes `release`.
+- The first publish gives publish-timeout. The test waits for `held`.
+- A retry to branch `other` gives publish-busy (:322). Refused events: ["publish-busy"]. No
+  git.push.remote allowed event.
+- The test writes `release` and waits until there is exactly one allowed event, with ref
+  refs/heads/coder/feat and the work commit.
+- The next retry gives decision-consumed (:330).
+- Exactly one git-receive-pack request reached the fake Gitea, and the fork has only
+  refs/heads/coder/feat. Refused events: ["publish-busy", "decision-consumed"]. No TOKEN appears in
+  events or logs.
+
+Fail fast (sage-1681): the body is wrapped in try/finally, and the finally writes `release`. Under
+the first mutant run, the assert at the retry failed and the hook was never released. setup's
+teardown waits for the fake Gitea, which waited for the held push, so the file hung until I stopped
+it. Now a failed assert ends the hook and the run. Each wait is bounded at 10 s with an assert.fail.
+
+## Mutants
+
+Script: /mnt/storage/scratch/megavolt-r242/mutants.sh. Each mutant: save, one-line sed, run
+publish-socket.test.mjs whole, restore, cmp.
+
+| Mutant | Change | Expected kill |
+|---|---|---|
+| M1 | export `publishRefused: (ticket, args) => broker.publishRefused(ticket, args)` again (removes the fix) | :302 at :322: the retry gets a new ticket and its own push, so publish-timeout, not publish-busy (seen in the stopped 03:06Z run) |
+| M2 | `settle` files publishRefused without trying recordPublish (hold only) | :302 at the wait for one allowed event, then :330 |
+
+Results (Sage's slot, sage-1686, 2026-10-21T03:35:00Z to 03:35:15Z): both killed, both restored
+(cmp ok).
+
+- M1: publish-socket 8/1, the row 242 test fails at :322 in 0.5 s.
+- M2: publish-socket 8/1, the row 242 test fails at :327, the wait for one allowed event, through
+  the assert.fail inside `until` (:311) after its 10 s bound, in 10.3 s.
+
+## Suites
+
+On Sage's slot (sage-1686), on base 8fede5fc6 plus this row:
+
+- bus `node --test tests/*.test.mjs`: 499/499, 03:35:20Z to 03:35:34Z. This is one fewer than
+  Sage's 241 gate (500) because the base predates row 241's land.test case.
+- cli `node --test tests/*.test.mjs`: 566/566, 03:35:34Z to 03:43:47Z. That's 565 plus the
+  row 242 test.
+
+Singles before the slot: publish-socket.test.mjs 9/9, bus publish.test.mjs 13/13. The seat suite
+and scripts/test-*.sh are left for Sage's landing gate.
+
+## Residuals
+
+- The agent was told publish-timeout, but the push is recorded later and the run isn't
+  notified. The allowed event and the bus log line are the only trace. A later publish on the
+  decision gets decision-consumed, which tells the agent the decision was used. Whether the run
+  should get a RESULT for a late record is a follow-up question for Sage.
+- A late push whose recordPublish refuses (Duckworth N2) is filed with that code: the ref stays on
+  the fork and the decision is not spent, the same residual as an in-band push whose record
+  refuses.
+- The hold lives in the bus process's memory, like the broker's open tickets. A bus restart during
+  a hold drops both, the same as today for any publish in flight.
@@ -0,0 +1,252 @@
+# Row 213 (C2-08) build: creative roles, persona file and block, M1, M2, M6, M10, prompt by file
+
+Morgana (Opus 5.5), 2026-10-20. Queue row 213, Gitea #1714. Brief: `docs/plans/2026-10-20_case2-rows.md`
+§ C2-08 (on `refactor` from 32b54ac3b). Design: Gosalyn's Case 2 design r10, sections 4 and 5.
+Reviewer Webby, gate owner Sage. Base: `base.txt` (088087ac9). Manifest: `candidate-manifest.sha256`.
+D1 and D2 approved as deviations in sage-1492.
+
+## What it is
+
+1. **Six creative roles** (`roles/<name>.json` and `.md`, roleVersion 2): companion and research get
+   read and web, with network api-only. ideas, proofreader, fact-checker and continuity get read only, with
+   network none. All six get withinRole `["message.send"]`, no credentials, and messaging that sends to and
+   receives from `human` only. `vocabulary.mjs` names them in `CREATIVE_DEFINITIONS`, plus `CREATIVE_KINDS`,
+   `CREATIVE_TOOLS` and `THREAD_DEFINITIONS`. `END_PROTECTED` becomes `THREAD_DEFINITIONS`.
+2. **M1** (`role.mjs` `checkCreative`): a creative role file is refused if it names a tool outside
+   `CREATIVE_TOOLS`, holds any authority but withinRole `message.send`, lacks `messaging`, names anyone but
+   `human` in messaging, or is version 1.
+3. **M2**: since the role files name no write, edit or bash tool, the existing gate refuses write, edit and
+   bash on pi and Write, Edit and Bash on claude-code for each creative role. No gate code changed. The
+   test pins it.
+4. **M6**: `tools.mjs` leaves `raise_decision` out for a creative definition. `broker.mjs` refuses
+   `decision.raise` from a creative session with `decision-not-allowed`, after `#secretCheck` and before
+   the spec-cited path, so a cited raise is refused too.
+5. **M10**: a creative instance belongs to the human.
+   - `launch-settings.mjs` `creativeHumanOnly` gives `organization-creative-human-only` to any other actor.
+     It covers: a `models` key that a creative instance's `model` or `fallback.model` var names (changed or
+     removed), `setRoutes` for the instance, and the `instances` key. The `instances` key is refused for
+     every actor with `organization-creative-instance`, because the model changes through `instances.set`
+     or `routes.set`.
+   - `instance-settings.mjs`: add, change and redefine to or from a creative definition are the human's.
+     A creative definition is `END_PROTECTED`, so the new `closed()` lets this writer still add and change
+     one. `accepted` and `protected` use `closed()` too, so the human's Console form offers the creative
+     definitions and marks those instances as editable.
+6. **Persona** (design 4): vars `persona.name` (one line, max 40) and `persona.sha256` (64 lowercase hex),
+   agent layer. The file lives at `<configDir>/personas/<business>/<instance>.md`.
+   - `bundle.mjs` `readPersona` opens it with O_NOFOLLOW and refuses with `persona-invalid` when the file
+     is missing, a symlink, not a regular file, owned by another uid, carries group or other mode bits, is
+     over 8000 characters, is not UTF-8, or holds `</persona-file>` or a line starting `# ` or `## `.
+   - It refuses with `persona-mismatch` when the bytes don't match the digest.
+   - A file present with no `persona.sha256` var is ignored. A digest with no `personaDir` refuses.
+   - The block sits between the contract and `## This session`, wrapped in
+     `<persona-file instance=... sha256=...>`.
+7. **Web**: `webPlan` refuses `web-source-not-allowed` when a creative definition is on
+   `harness-builtin`, so every creative fetch goes through the broker.
+8. **Prompt by file**: claude passes `--system-prompt-file <path>`, and pi passes `--system-prompt <path>`.
+   Both make the path absolute. The prompt text no longer appears in `/proc/<pid>/cmdline`.
+   `adapters/README.md` says so.
+
+## Refusal codes
+
+`persona-invalid`, `persona-mismatch`, `web-source-not-allowed`, `organization-creative-human-only` and
+`organization-creative-instance` are new. `decision-not-allowed` is named in the brief but is also new in
+code. My morgana-0021 message called it an existing code, which was wrong.
+
+## Deviations (sage-1492)
+
+- **D1** `packages/business/src/business.mjs`: `checkPersonaVars`, plus one call line at the end of
+  `checkRoles`'s per-instance block. The persona vars are accepted only on an instance of a creative
+  definition, and only both together. Without D1, any instance's agent layer could carry a persona
+  digest, and the bundle would read a persona file for a pm or chief.
+  Test: `business.test.mjs` "persona vars: agent layer, creative definition only, both or neither". It
+  covers the business layer, pm and chief, one key alone and malformed values. `instance-settings.test.mjs`
+  also covers it: changing a persona-carrying companion to security-reviewer is refused.
+  Mutants: D1a, D1b, D1c.
+- **D2** `packages/cli/src/launcher.mjs`: one line, `personaDir: join(configDir(env), "personas"),` in the
+  `buildBundle` call. Without it a creative instance with a persona can never launch.
+  Test: `launcher.test.mjs` "row 213 a creative instance's persona is read from <configDir>/personas: off
+  its digest the launch fails with the mismatch as its reason". Mutant: D2.
+
+- **Adapter tests' file** (webby-0040 N1). Brief line 68 puts the adapter tests in `claude-session.test.mjs`
+  and `pi-session.test.mjs`. They are in `harness/tests/creative.test.mjs` instead, next to the other row 213
+  harness tests, so the row's adapter cases sit in one file and the two session test files stay unchanged.
+  Same cases: argv holds the absolute prompt path and no marker, and pi refuses a missing, unreadable or
+  directory prompt.
+
+The checkRoles change sits in its own block and the launcher change is one line, so the rebase over rows
+194 and 199 (both touch `business.mjs`, and 199 touches `launcher.mjs`) stays small.
+
+## Pinned-test edits and the pi tightening (sage-1492, named here)
+
+1. `packages/bus/tests/project-runtime.test.mjs:26`: the pinned broker import line gains
+   `CREATIVE_DEFINITIONS` (M6 reads it).
+2. `packages/harness/tests/skills.test.mjs:170`: the test checked the prompt text in argv after
+   `--system-prompt`. Each adapter now passes a path, so the test looks up the flag for each harness,
+   checks that the next argument is the bundle's prompt file, and reads the MARKED and chief checks from
+   that file.
+3. `adapters/pi/adapter.sh`: `[ -f "$PROMPT_FILE" ] && [ -r "$PROMPT_FILE" ]`, exit 2 otherwise. Pi 0.85.1
+   uses the path string as the prompt when it can't read the file. Test: `harness/tests/creative.test.mjs`
+   "pi refuses a missing, unreadable or directory prompt" (pi never runs). Mutant: A1.
+
+One more pinned assertion changed: `business/tests/assistant.test.mjs` REQ-HARN-2 expected only the
+assistant to hold `web`. Companion and research now hold it too.
+
+## Files
+
+Source: `packages/business/src/{vocabulary,role,vars,business,launch-settings,instance-settings}.mjs`,
+`packages/harness/src/{bundle,tools}.mjs`, `packages/bus/src/broker.mjs`, `packages/cli/src/launcher.mjs`,
+`adapters/{pi,claude}/adapter.sh`, `adapters/README.md`, `roles/{companion,research,ideas,proofreader,
+fact-checker,continuity}.{json,md}`.
+
+Tests changed: `business/tests/{role,business,launch-settings,instance-settings,assistant}.test.mjs`,
+`harness/tests/skills.test.mjs`, `bus/tests/project-runtime.test.mjs`, `cli/tests/launcher.test.mjs`.
+New: `harness/tests/creative.test.mjs` (7), `bus/tests/creative.test.mjs` (3).
+
+I grepped `packages/*/tests` and `scripts/` for each changed source path next to a 64-hex string. The hits
+are `thread-migration.test.mjs` (a DDL digest, not a pin on `broker.mjs`; 3/3 pass) and discord's own
+`tools.mjs`. No test pins a changed file.
+
+## Evidence
+
+Each file alone from its package with `node --test --test-reporter=tap <file>`, 2026-10-20, all fail 0:
+
+- Touched: business role 17, business 17, launch-settings 16, instance-settings 12, assistant 11; harness
+  creative 7, skills 10, bundle 22; bus creative 3, project-runtime 3; cli launcher 30. Round 2 reran
+  bus creative, instance-settings, business, launch-settings, role, harness creative and bundle, bus
+  tester-writes 8 and chief-of-staff 18, and the vars readers business vars 7, discord context 7 and git 12.
+- Other files that read a changed path: business hard-waits, record-grants, token-limit-settings,
+  workflow-roles, chief-of-staff, project-repo, plugin-settings; harness bundle 22, tools 22,
+  claude-session 8, pi-session 8, raise-domain, spec-tools, claude-gate, mcp-server, gate, runner 34,
+  git-tools; bus hard-waits, launch-notice, tester-writes, business, broker 16, workflow-roles, web 19,
+  task-page, thread-migration 3; discord git, web, setspark, engine, tools; plugins harness, loader; seat
+  working, sandbox, session; cli launch-limit-checks, limits, git-socket, launch-account, thread-launch,
+  launch-limits, launch-routes, instances, stack-copy, stack-release 174; webui limits-browser, editor,
+  settings-form, tester-browser.
+
+Suites, `scripts/test-*.sh` and the mutants are not run yet. They need Sage's slot.
+
+Drift: `git diff --stat 088087ac9 305857c8f` over the 35 manifest paths is empty (2026-10-20, sage-1501).
+Row 192's async `scripts/mosaic-config.mjs` and `webui-service.sh` are outside the manifest. The broker's
+new import comes from `vocabulary.mjs`, which it already imported, so `RUNNER_FILES` doesn't change.
+
+Mutants: `mutants.py` in this directory, 31 mutants over 11 files. It backs up each file to scratch first,
+aborts on a bad backup or any anchor count other than one (all 31 checked as unique without editing), runs
+the named test files per mutant, restores each file after its mutant and again in `finally`. Log:
+`mutants.log`, written on the run. The brief's `models` mutant is L1.
+
+| Mutant | File | Tests |
+|---|---|---|
+| D1a/b/c persona vars check (D1) | business.mjs | business, instance-settings |
+| D2 no personaDir (D2) | launcher.mjs | launcher |
+| L1 models key by anyone (the `models` mutant) | launch-settings.mjs | launch-settings |
+| L2 fallback.model not checked | launch-settings.mjs | launch-settings |
+| L3 instances key allowed | launch-settings.mjs | launch-settings |
+| L4 setRoutes by anyone | launch-settings.mjs | launch-settings |
+| L5 creativeHumanOnly never refuses | launch-settings.mjs | launch-settings, instance-settings |
+| I1/I2/I3 add, change, redefine by anyone | instance-settings.mjs | instance-settings |
+| R1/R2/R3 checkCreative off, wider tools, non-human messaging | role.mjs | role |
+| B1-B8 mode bits, digest, headings, symlink, char cap, block, no dir, builtin web | bundle.mjs | harness creative |
+| T1 raise_decision offered | tools.mjs | harness creative |
+| K1 broker raise check off | broker.mjs | bus creative |
+| K2/K3 chief or tester session reaches the writer as the human (round 2, B1) | broker.mjs | bus creative |
+| V1 persona.name line separators accepted (round 2, N3) | vars.mjs | business |
+| A1 pi without -f; A2/A3 relative path kept | adapters | harness creative, skills |
+
+## Residuals
+
+- `ID_PATTERN` allows dots, so a human id could read like `<definition>.<instance>`. That is only cosmetic:
+  `creativeHumanOnly` compares the actor with `document.human`.
+- TOCTOU between pi's `[ -f ] && [ -r ]` and pi's own read of the bundle's prompt file.
+- The other-uid owner check in `readPersona` can't be tested without root.
+- O_NOFOLLOW covers only the last path component, so a symlinked `personas/` or `personas/<business>/` is
+  followed (webby-0040 N2). The digest still refuses any bytes but the pinned ones. A comment in
+  `bundle.mjs` says so.
+- The claude adapter checks the prompt file with `[ -r ]` only, and pi checks `-f` and `-r`. The brief asks
+  for pi's check (webby-0040 N4).
+- **Launch-failed mapping.** A BundleError thrown from `buildBundle` inside `start()` becomes the Refusal
+  `launch-failed`, with the code's message in the log's `why`. That holds for the persona codes and for
+  webPlan's `web-source-not-allowed`. By then the run dir `launches/<business>/<run>/` exists with only
+  `session/`, and no bundle is written. Only `check()`'s readSkills preflight surfaces bundle codes. The
+  D2 test pins both facts. I kept the launcher change to one line, as sage-1492 asked.
+
+## Follow-ups (not in this row)
+
+- A persona preflight in launcher `check()`, so a bad persona refuses with its own code before a run dir
+  exists. Sage agreed it as a follow-up (sage-1501) and files it after this row lands.
+- The webui `bus.mjs` code-to-HTTP map lacks the new codes.
+- webby-0053 N1: `checkCreative` doesn't refuse `credentials`, so a later role-file commit could give a
+  creative instance a gitea credential. All six creative role files have `credentials: []` today. A
+  one-line refusal and a `role.test.mjs` case close it.
+- The cli `instances.mjs` message wording for the creative refusals.
+
+## Round 2 (webby-0040, round 1 CHANGES on bb5f4600)
+
+- **B1**: `bus/tests/creative.test.mjs` adds "M10 through the broker". It runs on a real organization file
+  and writer behind `startBroker`, with a claimed chief session, a bound tester session and the human.
+  - The chief's `organization.set` of bean's `launch.models` key is refused with
+    `organization-creative-human-only`. Its `instances` key is refused with `organization-creative-instance`.
+  - The tester's `organization.set` and `limits.set` are refused `tester-refused` (N5: the broker refuses
+    first). Its `instances.set` (change bean, add an ideas instance) and `routes.set` for bean reach the
+    writer as `tester` and are refused with `organization-creative-human-only`.
+  - The file bytes are unchanged and no committed log entry exists after all of these.
+  - The human's `limits.set` of the same change lands, and the one committed entry names `jason`.
+  - Mutants K2 and K3 change the broker's actor naming for a role or tester session.
+- **B2**: `instance-settings.test.mjs` asserts the mode of `writer.logFile("acme")` (0600) and that it sits
+  in the history dir. It lives at `.history/acme/changes.jsonl`, so the round 1 loop over that dir already
+  covered it, but no line named it.
+- **N1**: listed under Deviations. **N2**: comment and residual. **N3**: `persona.name` now refuses U+2028
+  and U+2029, with two values added to the business test and mutant V1. **N4**: noted under residuals.
+
+- Drift: `git diff --stat 088087ac9 f41729178` over the 35 manifest paths is empty. Round 2 manifest
+  digest b5ff0ac0e754cb1e5891417f4ab1da9597f5cf49fb2fe2d5f0fbf066f821c43a.
+
+## Round 3 (sage-1715): rebase onto 9b5362018
+
+Rows 199 (cb5fdb064), 237 (d7d943199) and 210 (f5753c0e8) landed on six manifest paths after the round 2
+approval. Round 3 rebases the three commits onto origin/refactor 9b5362018 on a new branch,
+`morgana/row213-r3`. The round 2 branch stays as it was. Nothing else changed.
+
+- Five files conflicted. Each resolution keeps both sides:
+  - `bus/src/broker.mjs` and `bus/tests/project-runtime.test.mjs`: the vocabulary import keeps rows 199
+    and 210's names (forkProblem, forkUrl, credentialKind, validArgv, commandAllowed) and adds
+    CREATIVE_DEFINITIONS last. The pinned import line in the test carries the same list. RUNNER_FILES
+    is unchanged, since the import is still the vocabulary file only.
+  - `business/src/business.mjs`: one vocabulary import with row 199's names plus CREATIVE_DEFINITIONS.
+    The `checkRoles(roles, file, rolesDir, business, hosts)` signature is row 199's. `checkPersonaVars`
+    runs after row 199's identity and publish checks.
+  - `business/src/role.mjs`: the import keeps row 210's HOST_SERVICE and adds CREATIVE_DEFINITIONS and
+    CREATIVE_TOOLS.
+  - `business/src/vocabulary.mjs`: the creative constants and `END_PROTECTED = THREAD_DEFINITIONS` come
+    before row 199's Gitea URL parse, which is kept whole.
+- `cli/src/launcher.mjs` merged without a conflict.
+- `git range-diff 088087ac9..aee32d185 9b5362018..morgana/row213-r3`: commits 2 and 3 are `=`. Commit 1
+  differs only in the conflict hunks above.
+- None of the new base's added lines name END_PROTECTED, THREAD_DEFINITION, CREATIVE_* or the creative
+  refusal codes, apart from docs. All 31 mutant anchors still count 1. The hash-pin grep finds no
+  64-hex pin on a manifest path.
+- The manifest is rebuilt from the round 3 tree. It has the same 35 paths, and six digests changed: the
+  six drifted files. `base.txt` is 9b5362018.
+- Singles of every touched test file, plus the seat sandbox and bus project-runtime tests (RUNNER_FILES
+  rule), wait on Sage's slot. They are recorded here when run.
+
+## Round 4 (sage-1778, mos-1160): one commit on row 234's landing c771a36f4
+
+Row 234 landed as c771a36f4 after the round 3 approval (webby-0053). Round 4 is one commit on c771a36f4,
+on the new branch `morgana/row213-r4`. It is the round 3 change applied onto the landed blobs. The round 3
+branch stays as it was.
+
+- Overlap, `git diff --name-only 9b5362018 c771a36f4` against the round 3 paths: `business/src/business.mjs`,
+  `bus/src/broker.mjs` and `bus/tests/project-runtime.test.mjs`. Each starts from the landed blob, and the
+  row 213 edits are merged by hand. No landed hunk is reverted (sage-1760).
+  - `broker.mjs` and the pinned `project-runtime` import line: row 234's list with `HOST_ID`, then
+    `CREATIVE_DEFINITIONS`. The test keeps both rows' comments. The import still names only
+    `vocabulary.mjs`, so RUNNER_FILES is unchanged.
+  - `business.mjs`: row 234's import (no `HOST_PREFIX`, no `hosts.mjs`) plus `CREATIVE_DEFINITIONS`.
+    `checkPersonaVars` sits before row 234's `HOSTS_MOVED` and its four-argument `checkRoles`, and still
+    runs after the identity and publish checks.
+- Check: the removed and added non-packet lines of `diff c771a36f4..r4` and `diff 9b5362018..2d2ad2760`
+  differ only in those three import lines. All 31 mutant anchors count 1.
+- Row 234's hosts verbs: `#hostsCaller` admits the human, the tester or the chief definition
+  (`grant-chief-only`), so a creative role can't reach them and M1 stays as narrow.
+- The manifest has the same 35 paths. The three overlap files changed digest. `base.txt` is c771a36f4.
+- Singles and the 31 mutants wait on Sage's slot. They are recorded here when run.
@@ -0,0 +1 @@
+c771a36f4bd0b6c359282425c668996a90072f93
@@ -0,0 +1,35 @@
+37cc5d74636465c592c9eb8f3d9b66c2632299be922444737b32d3d3be43c239  adapters/claude/adapter.sh
+1e0487ab682ff97e974a9fed4765994f70ee362058bd0aa6aee32c2a7891e0d2  adapters/pi/adapter.sh
+2cb62d90f4f52f17ca606e57d4714b872520d0224cd94fd116308becee864b71  adapters/README.md
+ee5521840784d9ff3603c22cc6b5f090ac062e8575946a071972fedc089724d1  packages/business/src/business.mjs
+a93b4efe213750b35730d6391594f3e26ffe667040a5d7baf5262b83341164b1  packages/business/src/instance-settings.mjs
+3e957579bcfdf5f88e60f7235b7ead4fb27cb455e34b7588f4e22b8ab5542bec  packages/business/src/launch-settings.mjs
+6b84018c202ff08e59b4e946556703d199fe75ef97e9e6ac4a390c89705ac796  packages/business/src/role.mjs
+f6b15ee8dad2d985c0ae66b1f106ca46cb56ec86ac8cd5dec8a05c887596a421  packages/business/src/vars.mjs
+814ba93ca7403ad77ea2e7fb7bc21c2b40846bf8a3c2eae53b32446278af061c  packages/business/src/vocabulary.mjs
+b67917c5c7bb270b82f1cbd97071a195b79a57c9a343acbc5feae2a877fb9e8f  packages/business/tests/assistant.test.mjs
+b4606af3288624475e23ca506f7dea084a1e606efce4b1556d132b03230c2be1  packages/business/tests/business.test.mjs
+2b80070db1e1d72b82a32cec75711c59a9383188b5a659854fd0ba8ae2dc0f5b  packages/business/tests/instance-settings.test.mjs
+647b4835836566070c7b859b2bbcaf3fd748030fe88c8f20e990f5038ec65e88  packages/business/tests/launch-settings.test.mjs
+0c9f082d8c05582382dc646c74aa60a46b89804717f828db9fadde51f2e258a8  packages/business/tests/role.test.mjs
+15f530d49eaf25167113f84b743d7057c17a273e56731d8937bad26196325bfc  packages/bus/src/broker.mjs
+21946cdecab263ae65791977eb4599594340c8e049b3c216e3181610638f0952  packages/bus/tests/creative.test.mjs
+4b1c6688beba124492cf130247a2ff93fdd6d18594990cde84709139964d0b5b  packages/bus/tests/project-runtime.test.mjs
+a968a19d1b32416aecb2488c7fb9768db7d5160374f1b790166380d41acea894  packages/cli/src/launcher.mjs
+7933f256e5f097999ff36cc7e48b0c417385c6c3727919f38437bd501aecc438  packages/cli/tests/launcher.test.mjs
+2c1aad8d8be1a03be12eca93b4da36c656236ad38d09bfdc314e42a68240afc3  packages/harness/src/bundle.mjs
+22f9e3c1dce25e5eb6713306ccdf22dc77a4ccf0c99e9186f2e16602f58aeb49  packages/harness/src/tools.mjs
+305be35111c432a663d5671a4dac9bfe5bbb1a9b34ace77087e12c6f687602a1  packages/harness/tests/creative.test.mjs
+3d68294493e41db3b647cd71cd94436c28fc531c64a8b1589be7644c3bf59f94  packages/harness/tests/skills.test.mjs
+9425a319ec8966712fc38027bc62f7fbf52a216e30b9520cbd877386990c92d6  roles/companion.json
+2533b3ec4dfa78cd81b254c167865b984a6edf6b00454911363012ab5ac1e4c1  roles/companion.md
+cb2512590330efe4514c88eb31d09e3e3b159943803e462a224b77010c249de7  roles/continuity.json
+193c82fa803a85ee4c4b2f946ce2d69e94a192c00c5093d4db91cc274a5d11ed  roles/continuity.md
+7a59218d903b26174c51f0118a347b0b14e187e2d0c229ca43c98dad357f3435  roles/fact-checker.json
+8895fbe1d7961bbb98b272cd888250d6ef44f74986948032719b44dc3dc56579  roles/fact-checker.md
+3a932eefe3af967d046d5e241d59f5b2700bd5ad4ef236d6a937011500200b5f  roles/ideas.json
+8ce05e198cefb29f2aea53a25a2cd6599782b34c7a0815a2b6d26272c0fdae50  roles/ideas.md
+cb117d44e48f288048a4e697ee237b445b8fcea21bb95f9723e91b17ab542a3f  roles/proofreader.json
+a2214ab481ef27d24c20da9e5e7bbc86c6ea769cacc8a163330813e75a20ec15  roles/proofreader.md
+95f5fc2bd2a0593177c21ca1898317c671ad04334e5c561c29917fe2ceae2c51  roles/research.json
+7a602b0efe44669028e52fc6aca83f00bd3dd32a105d0729538f2ed357f6ecd3  roles/research.md
@@ -0,0 +1,91 @@
+#!/usr/bin/env python3
+# Row 213 (C2-08) mutants across the changed sources. Run from the row213 worktree root, in Sage's slot.
+# Each mutant changes one anchor (count must be 1), runs the named test files alone, then restores.
+import os, shutil, subprocess, sys
+BAK = "/mnt/storage/scratch/morgana-r213/mutant-backups"  # any scratch path outside the tree
+BIZ = "packages/business/src/business.mjs"
+LS = "packages/business/src/launch-settings.mjs"
+IS = "packages/business/src/instance-settings.mjs"
+ROLE = "packages/business/src/role.mjs"
+BUNDLE = "packages/harness/src/bundle.mjs"
+TOOLS = "packages/harness/src/tools.mjs"
+BROKER = "packages/bus/src/broker.mjs"
+LAUNCHER = "packages/cli/src/launcher.mjs"
+PI = "adapters/pi/adapter.sh"
+CLAUDE = "adapters/claude/adapter.sh"
+T_BIZ = [("business", "tests/business.test.mjs")]
+T_LS = [("business", "tests/launch-settings.test.mjs")]
+T_IS = [("business", "tests/instance-settings.test.mjs")]
+T_ROLE = [("business", "tests/role.test.mjs")]
+T_HC = [("harness", "tests/creative.test.mjs")]
+T_BUS = [("bus", "tests/creative.test.mjs")]
+T_LAUNCH = [("cli", "tests/launcher.test.mjs")]
+T_ADAPT = [("harness", "tests/creative.test.mjs"), ("harness", "tests/skills.test.mjs")]
+ABS = '    *) PROMPT_FILE="$(pwd)/$PROMPT_FILE" ;;'
+MUTANTS = [
+  # D1 (deviation): persona vars only on a creative definition, both or neither.
+  ("D1a persona vars check not called", BIZ, "    checkPersonaVars(out[instance].vars, entry.definition, at);\n", "", T_BIZ + T_IS),
+  ("D1b any definition may carry persona vars", BIZ, "  if (!CREATIVE_DEFINITIONS.includes(definition)) refuse(", "  if (false) refuse(", T_BIZ + T_IS),
+  ("D1c one persona var alone accepted", BIZ, "  if (set.length === 1) refuse(", "  if (false) refuse(", T_BIZ),
+  # D2 (deviation): the launcher hands buildBundle the persona directory.
+  ("D2 launcher passes no persona directory", LAUNCHER, '      personaDir: join(configDir(env), "personas"),', "      personaDir: null,", T_LAUNCH),
+  # M10: the human's settings.
+  ("L1 models-key change by anyone", LS, "          if (was !== is) creativeHumanOnly(", "          if (false) creativeHumanOnly(", T_LS),
+  ("L2 fallback.model key not checked", LS, '        for (const key of [vars.model, vars["fallback.model"]]) {', "        for (const key of [vars.model]) {", T_LS),
+  ("L3 instances key allowed for a creative instance", LS, "        if (CREATIVE_DEFINITIONS.includes(next.roles[instance].definition)) {\n          throw new OrganizationError(\"organization-creative-instance\"", "        if (false) {\n          throw new OrganizationError(\"organization-creative-instance\"", T_LS),
+  ("L4 setRoutes by anyone", LS, "      creativeHumanOnly(old.document, actor, instance, next.roles[instance].definition);", "", T_LS),
+  ("L5 creativeHumanOnly never refuses", LS, "  if (CREATIVE_DEFINITIONS.includes(definition) && actor !== document.human) {", "  if (false) {", T_LS + T_IS),
+  ("I1 add of a creative instance by anyone", IS, "      creativeHumanOnly(old, actor, instance, args.definition);\n      definitionFor(rolesDir, args.definition);\n      next.roles[instance] =", "      definitionFor(rolesDir, args.definition);\n      next.roles[instance] =", T_IS),
+  ("I2 change of a creative instance by anyone", IS, "      creativeHumanOnly(old, actor, instance, entry.definition);\n", "", T_IS),
+  ("I3 redefine to creative by anyone", IS, "        creativeHumanOnly(old, actor, instance, args.definition);\n", "", T_IS),
+  # M1: role files.
+  ("R1 checkCreative not called", ROLE, "CREATIVE_DEFINITIONS.includes(role.name) ? checkCreative(role) : role", "role", T_ROLE),
+  ("R2 wider tools accepted", ROLE, "  if (wider.length > 0) refuse(", "  if (false) refuse(", T_ROLE),
+  ("R3 non-human messaging accepted", ROLE, '    if (role.messaging[key].some((entry) => entry !== "human")) {', "    if (false) {", T_ROLE),
+  # Persona file and block.
+  ("B1 group/other mode bits accepted", BUNDLE, "    if (stat.mode & 0o077) throw", "    if (false) throw", T_HC),
+  ("B2 digest not checked", BUNDLE, "  if (sha256(data) !== digest) {", "  if (false) {", T_HC),
+  ("B3 headings and end tag accepted", BUNDLE, "  if (text.includes(PERSONA_END) || /^##? /m.test(text)) {", "  if (false) {", T_HC),
+  ("B4 symlink followed", BUNDLE, "constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK", "constants.O_RDONLY | constants.O_NONBLOCK", T_HC),
+  ("B5 character cap off", BUNDLE, "  if ([...text].length > PERSONA_CHARS) throw", "  if (false) throw", T_HC),
+  ("B6 persona block dropped", BUNDLE, "    ...personaSection(resolved, persona),\n", "", T_HC),
+  ("B7 no personaDir with a digest accepted", BUNDLE, "    if (digest === undefined) return null;\n    throw new BundleError(", "    return null;\n    throw new BundleError(", T_HC),
+  ("B8 creative role on harness-builtin web", BUNDLE, '  if (granted && source === "harness-builtin" && CREATIVE_DEFINITIONS.includes(resolved.definition)) {', "  if (false) {", T_HC),
+  # M6.
+  ("T1 raise_decision offered to creative roles", TOOLS, '  if (!CREATIVE_DEFINITIONS.includes(resolved.definition)) add("raise_decision"', '  add("raise_decision"', T_HC),
+  ("K1 broker creative raise check off", BROKER, "      if (request.verb === 'decision.raise' && !s.human && !s.tester &&\n          CREATIVE_DEFINITIONS", "      if (false &&\n          CREATIVE_DEFINITIONS", T_BUS),
+  # B1 (webby-0040): the broker names the writer's actor from the session.
+  ("K2 chief session reaches the writer as the human", BROKER, 'actor = this.#business(s.business).roles[s.role].definition + "." + s.role;', 'actor = "jason";', T_BUS),
+  ("K3 tester session reaches the writer as the human", BROKER, 'let actor = s.tester ? "tester" : s.human;', 'let actor = s.tester ? "jason" : s.human;', T_BUS),
+  ("V1 persona.name line separators accepted (N3)", "packages/business/src/vars.mjs", "\\u007f\\u2028\\u2029]", "\\u007f]", T_BIZ),
+  # Prompt by file (adapters).
+  ("A1 pi prompt check without -f", PI, '[ -f "$PROMPT_FILE" ] && [ -r "$PROMPT_FILE" ] ||', '[ -r "$PROMPT_FILE" ] ||', T_ADAPT),
+  ("A2 pi relative prompt path kept", PI, ABS, "    *) ;;", T_ADAPT),
+  ("A3 claude relative prompt path kept", CLAUDE, ABS, "    *) ;;", T_ADAPT),
+]
+os.makedirs(BAK, exist_ok=True)
+files = sorted({m[1] for m in MUTANTS})
+orig = {}
+for f in files:
+  bak = os.path.join(BAK, f.replace("/", "__"))
+  shutil.copyfile(f, bak)
+  orig[f] = open(bak).read()
+  if orig[f] != open(f).read(): sys.exit(f"backup mismatch for {f}, abort")
+for name, f, a, b, _ in MUTANTS:
+  if orig[f].count(a) != 1: sys.exit(f"{name}: anchor count {orig[f].count(a)}, abort")
+killed = 0
+try:
+  for name, f, a, b, tests in MUTANTS:
+    open(f, "w").write(orig[f].replace(a, b))
+    failing = []
+    for pkg, t in tests:
+      p = subprocess.run(["node", "--test", "--test-reporter=tap", t], cwd=f"packages/{pkg}", capture_output=True, text=True, timeout=600)
+      failing += [f"{pkg}/{t.split('/')[-1]}: {l[7:]}" for l in p.stdout.splitlines() if l.startswith("not ok")]
+    open(f, "w").write(orig[f])
+    status = "KILLED" if failing else "SURVIVED"
+    killed += bool(failing)
+    print(f"{status} {name}", flush=True)
+    for line in failing: print(f"    {line}", flush=True)
+finally:
+  for f in files: open(f, "w").write(orig[f])
+print(f"killed {killed}/{len(MUTANTS)}; restored: {all(open(f).read() == orig[f] for f in files)}")
@@ -0,0 +1,8 @@
+# PRD 1.8 r7: no in-Stack raise (mos-1154)
+
+Sage, 2026-10-21T01:20:06Z. Jason approved PRD 1.8 in T3 (thread 38bc4c81, before 2026-10-21T01:16:55Z), verbatim:
+"PRD 1.8: I am preemptively approving it. Do not surface in the Mosaic Stack board. Just proceed."
+Mos records it as DECISIONS Q192 (mos-1154). The [mos test] raise request drafted here was dropped
+unsent, and the template is deleted. Jason closed 3a6c8fb9 himself at 01:05:45Z (no, "superseded by r7").
+Scope (Mos's reading): r7 at 47c2cb33c plus 82df17347, 342 lines, sha256
+de079281ff2760911039276379ec4b190287b2ce2e4e8a79c9459939727440cd, Duckworth duckworth-0073 (pass, no findings).
@@ -196,3 +196,37 @@ a piece. It passed, so the "pm doesn't answer" branch does not apply and
 no defect is filed.

 Piece 1 is Jason's next real Mosaic Stack request to pm. It is not open yet.
+
+## 2026-10-21T01:14Z dates (sage-1622, Mos mos-1148, Vikunja #442)
+
+Mos accepted the plan with changes C1 and C2. The dates are latest-by markers (Q111).
+
+1. Pieces 1-5 open by 2026-10-23 23:59Z. Mos gives Jason the plain command after tonight's open items with him
+   (Q13 on PRD 1.8, the 1012 and 1008 boot). I don't ask again.
+2. C1: no piece is pinned to a copy. A piece runs on whatever copy is live when Jason sends it. For each piece
+   this log records the activation id at send. A piece still open across a window gets the new activation id
+   recorded too.
+3. C2: neither the Q175 phase 2 window (10-23) nor the 10-24 re-pin window rolls back or restores while a piece
+   has history, unless that window has failed. If a restore happens anyway, this log names the pieces to redo.
+4. All five closed and reviewed by 2026-10-26 18:00Z. Jason reads the five trails at his gate on 10-26 or
+   10-27. A pass starts merge plan step 1 under decision 146, and step 4 stays his.
+5. Fallback: if fewer than five pieces are open by 10-23, the gate moves to 10-28. No agent opens a piece in
+   Jason's place.
+
+When Jason sends a piece, I tell Mos its message id.
+
+Correction (2026-10-21T01:06Z): the heading above says 01:14Z. The clock read 2026-10-21T01:05:56Z when I wrote that entry, so 01:06Z is the right time.
+
+## 2026-10-21T01:20Z Jason's pre-S7 checks (mos-1154)
+
+Between 01:11:06Z and 01:13:03Z Jason sent pm five requests with `mosaic talk pm`: ed9e1e14, 51c19692,
+94f5d62c, 0645a3b7, f75449c0 (bus seq 1583 to 1591). pm run rc9e993da24cf answered each in 4 to 16 s. They were
+two jokes, the sandwich, the purpose of Mosaic Stack and pm's mission. pm made no task and raised no decision
+for any of them, and said so each time. Mos's reading, which I take: none is a piece, because a piece has to
+become work that gets closed and reviewed. They are recorded as Jason's pre-S7 checks. The five pieces are
+still open, latest-by 10-23 23:59Z. Activation at send: copy 4429a104f, as in the 01:06Z entry (C1). Source: Mos
+(mos-1154) read the bus. I didn't read the message bodies.
+
+pm also told Jason that its state snapshot lists only the first 50 of 198 open tasks and that it pages the rest
+with list_tasks. That is the row 109 (#1603) design: broker.mjs `state` returns `cap: TASK_PAGE` (50) with
+`total`, and list_tasks pages up to TASK_PAGE_MAX (200).
@@ -0,0 +1,60 @@
+// Sage, 2026-10-21: re-plan comments on P19 405-408 and 411 (due 10-22). Sage's own key (bot user 13); the sync key reads back. Comments only: no task edits.
+// Checks each task's title before posting. Prints no secret.
+// Usage: node comment-p19-405-411-replan.mjs https://tasks.woltje.com SAGE_TOKEN_FILE SYNC_TOKEN_FILE OUT_JSON
+import { readFileSync, writeFileSync, existsSync } from "node:fs";
+const [ORIGIN, KEY, SYNC, OUT] = process.argv.slice(2);
+if (!/^https:\/\/tasks\.woltje\.com$/.test(ORIGIN)) throw new Error("tasks.woltje.com only");
+if (!OUT || existsSync(OUT)) throw new Error("OUT_JSON missing or exists; refusing");
+const PROJECT = 19;
+const PSIG = "Posted by Sage (T3 1ef1e4f8) with Sage's own key (bot user 13).";
+const esc = (s) => s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
+const ps = (xs) => xs.map((x) => `<p>${esc(x)}</p>`).join("") + `<p>${esc(PSIG)}</p>`;
+const POSTS = [
+  { id: 405, title: /^stack-release --plan: no test plans a missing store/, body: [
+    "Re-plan (Sage, 2026-10-21, due 10-22). Tasks 405, 406, 407, 408 and 411 become one queue row, a stack-release follow-up row. All five touch scripts/stack-release.sh, scripts/webui-service.sh or docs/TOOLS.md, and rows 232 (Darkwing) and 238 (Launchpad) are changing stack-release.sh now. So I brief the row after 232 and 238 land, from their landing, which avoids base drift (the row 68 rule). It lands after the 10-24 window, because that window holds the four service scripts at NEW (P5). 411's hold was the Part B window, and Part B is superseded (Q175, mos-0970), so that hold is gone. Each item keeps the test and mutant its task names. I'll name the owner when I brief it, either the seat that frees up first of Darkwing and Launchpad, or me.",
+  ] },
+  { id: 406, title: /^stack-release --plan: backup line printed/, body: [
+    "Re-plan (Sage, 2026-10-21, due 10-22). Tasks 405, 406, 407, 408 and 411 become one queue row, a stack-release follow-up row. All five touch scripts/stack-release.sh, scripts/webui-service.sh or docs/TOOLS.md, and rows 232 (Darkwing) and 238 (Launchpad) are changing stack-release.sh now. So I brief the row after 232 and 238 land, from their landing, which avoids base drift (the row 68 rule). It lands after the 10-24 window, because that window holds the four service scripts at NEW (P5). 411's hold was the Part B window, and Part B is superseded (Q175, mos-0970), so that hold is gone. Each item keeps the test and mutant its task names. I'll name the owner when I brief it, either the seat that frees up first of Darkwing and Launchpad, or me.",
+  ] },
+  { id: 407, title: /^stack-release\.sh: the proof_for_target comment/, body: [
+    "Re-plan (Sage, 2026-10-21, due 10-22). Tasks 405, 406, 407, 408 and 411 become one queue row, a stack-release follow-up row. All five touch scripts/stack-release.sh, scripts/webui-service.sh or docs/TOOLS.md, and rows 232 (Darkwing) and 238 (Launchpad) are changing stack-release.sh now. So I brief the row after 232 and 238 land, from their landing, which avoids base drift (the row 68 rule). It lands after the 10-24 window, because that window holds the four service scripts at NEW (P5). 411's hold was the Part B window, and Part B is superseded (Q175, mos-0970), so that hold is gone. Each item keeps the test and mutant its task names. I'll name the owner when I brief it, either the seat that frees up first of Darkwing and Launchpad, or me.",
+  ] },
+  { id: 408, title: /^docs\/TOOLS\.md: the row 178 paragraph/, body: [
+    "Re-plan (Sage, 2026-10-21, due 10-22). Tasks 405, 406, 407, 408 and 411 become one queue row, a stack-release follow-up row. All five touch scripts/stack-release.sh, scripts/webui-service.sh or docs/TOOLS.md, and rows 232 (Darkwing) and 238 (Launchpad) are changing stack-release.sh now. So I brief the row after 232 and 238 land, from their landing, which avoids base drift (the row 68 rule). It lands after the 10-24 window, because that window holds the four service scripts at NEW (P5). 411's hold was the Part B window, and Part B is superseded (Q175, mos-0970), so that hold is gone. Each item keeps the test and mutant its task names. I'll name the owner when I brief it, either the seat that frees up first of Darkwing and Launchpad, or me.",
+  ] },
+  { id: 411, title: /^stack-release\.sh and webui-service\.sh: the proof file repository check/, body: [
+    "Re-plan (Sage, 2026-10-21, due 10-22). Tasks 405, 406, 407, 408 and 411 become one queue row, a stack-release follow-up row. All five touch scripts/stack-release.sh, scripts/webui-service.sh or docs/TOOLS.md, and rows 232 (Darkwing) and 238 (Launchpad) are changing stack-release.sh now. So I brief the row after 232 and 238 land, from their landing, which avoids base drift (the row 68 rule). It lands after the 10-24 window, because that window holds the four service scripts at NEW (P5). 411's hold was the Part B window, and Part B is superseded (Q175, mos-0970), so that hold is gone. Each item keeps the test and mutant its task names. I'll name the owner when I brief it, either the seat that frees up first of Darkwing and Launchpad, or me.",
+  ] },
+];
+const key = readFileSync(KEY, "utf8").trim(), sync = readFileSync(SYNC, "utf8").trim();
+async function api(method, path, body, auth) {
+  const r = await fetch(ORIGIN + path, { method, headers: { Authorization: `Bearer ${auth}`, "Content-Type": "application/json" }, body: body === undefined ? undefined : JSON.stringify(body), redirect: "error" });
+  const t = await r.text(); let json = null; try { json = JSON.parse(t); } catch {}
+  return { status: r.status, json };
+}
+const list = (j) => j?.items ?? (Array.isArray(j) ? j : []);
+const rec = { at: new Date().toISOString(), comments: [], problems: [] };
+const save = () => {
+  const out = JSON.stringify(rec, null, 1) + "\n";
+  if (out.includes(key) || out.includes(sync)) throw new Error("secret in the record; not written");
+  writeFileSync(OUT, out);
+};
+for (const P of POSTS) {
+  const t = await api("GET", `/api/v2/tasks/${P.id}`, undefined, sync);
+  if (t.status !== 200 || t.json?.project_id !== PROJECT || !P.title.test(t.json?.title ?? "")) throw new Error(`task ${P.id}: ${t.status}, title check failed; nothing posted`);
+}
+writeFileSync(OUT, "", { flag: "wx" });
+for (const P of POSTS) {
+  const c = await api("PUT", `/api/v1/tasks/${P.id}/comments`, { comment: ps(P.body) }, key);
+  const e = { task: P.id, status: c.status, id: c.json?.id ?? null };
+  rec.comments.push(e);
+  if (c.status >= 300 || !Number.isSafeInteger(c.json?.id)) { rec.problems.push(`comment ${P.id}: ${c.status} ${c.json?.message ?? ""}`); save(); continue; }
+  const back = await api("GET", `/api/v2/tasks/${P.id}/comments?per_page=50`, undefined, sync);
+  const found = list(back.json).find((x) => x.id === c.json.id);
+  Object.assign(e, { readBack: back.status, found: Boolean(found) });
+  if (back.status !== 200 || !found) rec.problems.push(`comment ${P.id} read-back: ${back.status}`);
+  save();
+}
+save();
+process.stdout.write(JSON.stringify(rec, null, 1) + "\n");
+if (rec.problems.length) process.exit(2);
@@ -0,0 +1,53 @@
+// Sage, 2026-10-21: landing comments on P19 412 (row 200) and 424 (row 199), per mos-0882. Sage's own key (bot user 13); the sync key reads back. Comments only: no task edits.
+// Checks each task's title before posting. Prints no secret.
+// Usage: node comment-r200-r199-landed.mjs https://tasks.woltje.com SAGE_TOKEN_FILE SYNC_TOKEN_FILE OUT_JSON
+import { readFileSync, writeFileSync, existsSync } from "node:fs";
+const [ORIGIN, KEY, SYNC, OUT] = process.argv.slice(2);
+if (!/^https:\/\/tasks\.woltje\.com$/.test(ORIGIN)) throw new Error("tasks.woltje.com only");
+if (!OUT || existsSync(OUT)) throw new Error("OUT_JSON missing or exists; refusing");
+const PROJECT = 19;
+const PSIG = "Posted by Sage (T3 1ef1e4f8) with Sage's own key (bot user 13).";
+const esc = (s) => s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
+const ps = (xs) => xs.map((x) => `<p>${esc(x)}</p>`).join("") + `<p>${esc(PSIG)}</p>`;
+const POSTS = [
+  { id: 412, title: /^Console SSO: zero-trust OIDC verification/, body: [
+    "Row 200 landed on refactor as 9e1085816 (Gitea #1698, closed): stack-release.sh activate --sso, the phase 2 prerequisite. Launchpad built it and Webby approved r3. Sage's run killed 13 of 14 mutants (M12 is the equivalent ruled in round 2). Gate: 15 package suites and 10 scripts/test-*.sh suites, all green, at 00:07:57Z.",
+    "Follow-up N1 is row 238 (Gitea #1744, Launchpad, Webby). The sso-config hint will carry --instance NAME for a named instance. Nothing is live until a window activates a copy that includes 9e1085816.",
+  ] },
+  { id: 424, title: /^Credential store: per-agent host access/, body: [
+    "Row 199 landed on refactor as cb5fdb064 (Gitea #1697, closed). It adds the per-agent credential store, the agent's own git identity and pushes to a remote. Megavolt built it and Duckworth approved r1 (comment 29779). Gate on 9e1085816 plus the patch: packages 2735/0, scripts 429/0.",
+    "Row 210 (Gizmoduck) now rebases onto cb5fdb064 on a new branch (mos-1135, mos-1137). Rows 234 and 235 follow it. Rows 190, 199 and 210 go live together in the 10-24 window with the 3i-3j migration, backup first, under Q173 (mos-1145).",
+  ] },
+];
+const key = readFileSync(KEY, "utf8").trim(), sync = readFileSync(SYNC, "utf8").trim();
+async function api(method, path, body, auth) {
+  const r = await fetch(ORIGIN + path, { method, headers: { Authorization: `Bearer ${auth}`, "Content-Type": "application/json" }, body: body === undefined ? undefined : JSON.stringify(body), redirect: "error" });
+  const t = await r.text(); let json = null; try { json = JSON.parse(t); } catch {}
+  return { status: r.status, json };
+}
+const list = (j) => j?.items ?? (Array.isArray(j) ? j : []);
+const rec = { at: new Date().toISOString(), comments: [], problems: [] };
+const save = () => {
+  const out = JSON.stringify(rec, null, 1) + "\n";
+  if (out.includes(key) || out.includes(sync)) throw new Error("secret in the record; not written");
+  writeFileSync(OUT, out);
+};
+for (const P of POSTS) {
+  const t = await api("GET", `/api/v2/tasks/${P.id}`, undefined, sync);
+  if (t.status !== 200 || t.json?.project_id !== PROJECT || !P.title.test(t.json?.title ?? "")) throw new Error(`task ${P.id}: ${t.status}, title check failed; nothing posted`);
+}
+writeFileSync(OUT, "", { flag: "wx" });
+for (const P of POSTS) {
+  const c = await api("PUT", `/api/v1/tasks/${P.id}/comments`, { comment: ps(P.body) }, key);
+  const e = { task: P.id, status: c.status, id: c.json?.id ?? null };
+  rec.comments.push(e);
+  if (c.status >= 300 || !Number.isSafeInteger(c.json?.id)) { rec.problems.push(`comment ${P.id}: ${c.status} ${c.json?.message ?? ""}`); save(); continue; }
+  const back = await api("GET", `/api/v2/tasks/${P.id}/comments?per_page=50`, undefined, sync);
+  const found = list(back.json).find((x) => x.id === c.json.id);
+  Object.assign(e, { readBack: back.status, found: Boolean(found) });
+  if (back.status !== 200 || !found) rec.problems.push(`comment ${P.id} read-back: ${back.status}`);
+  save();
+}
+save();
+process.stdout.write(JSON.stringify(rec, null, 1) + "\n");
+if (rec.problems.length) process.exit(2);
@@ -0,0 +1,66 @@
+// Sage, 2026-10-21: files row 237's review follow-ups N1 and N3 (duckworth-0069, #1743 comment 29810) as two P19 tasks.
+// Sage's own key (bot user 13); the sync key reads back. No labels, assignees, due dates or bucket moves. Refuses if
+// the title exists. Prints no secret.
+// Usage: node file-r237-followups.mjs https://tasks.woltje.com SAGE_TOKEN_FILE SYNC_TOKEN_FILE OUT_JSON
+import { readFileSync, writeFileSync, existsSync } from "node:fs";
+const [ORIGIN, KEY, SYNC, OUT] = process.argv.slice(2);
+if (!/^https:\/\/tasks\.woltje\.com$/.test(ORIGIN)) throw new Error("tasks.woltje.com only");
+if (!OUT || existsSync(OUT)) throw new Error("OUT_JSON missing or exists; refusing");
+const PROJECT = 19;
+const SIG = "Created by Sage (T3 1ef1e4f8) with Sage's own key (bot user 13).";
+const esc = (s) => s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
+const ps = (sig, xs) => xs.map((x) => `<p>${esc(x)}</p>`).join("") + `<p>${esc(sig)}</p>`;
+const TASKS = [
+  {
+    title: "Bus publish: a retry after publish-timeout can push a second fork ref while the first push still runs (row 237 N1)",
+    description: ps(SIG, [
+      "Duckworth's row 237 review N1 (#1743 comment 29810, duckworth-0069). Row 237 makes checkPublish refuse publish-busy while an open ticket holds the same business and decision. publishRefused drops the ticket on publish-timeout, but the bus process's push may still be running, so a retry to another branch can push a second ref to the fork.",
+      "The fix belongs in packages/bus/src/runtime.mjs, in `remotes`: either keep the ticket until the push process exits, or kill the push on timeout and wait for it. A test should start a slow push, time it out, retry to another branch, and expect one ref on the fork. Not in row 237's scope. Megavolt's BUILD.md residual 2 (agents/megavolt/work/queue-237/BUILD.md). Needs a queue row once 237 lands.",
+    ]),
+  },
+  {
+    title: "Bus land: check whether checkLand has the same open-ticket race that row 237 fixed in checkPublish (row 237 N3)",
+    description: ps(SIG, [
+      "Row 237 residual 3 (Megavolt's BUILD.md) and Duckworth's N3 (#1743 comment 29810): checkLand has the same ticket shape as checkPublish had before row 237. Two lands on the same decision may both pass the check before either records. Duckworth didn't check it.",
+      "First step: read checkLand and its ticket code in packages/bus/src/broker.mjs against row 237's fix (broker.mjs:1038-1043). If the race exists, file a queue row with a race test like publish-socket.test.mjs's; if not, record why and close this task.",
+    ]),
+  },
+];
+const key = readFileSync(KEY, "utf8").trim(), sync = readFileSync(SYNC, "utf8").trim();
+async function api(method, path, body, auth) {
+  const r = await fetch(ORIGIN + path, { method, headers: { Authorization: `Bearer ${auth}`, "Content-Type": "application/json" }, body: body === undefined ? undefined : JSON.stringify(body), redirect: "error" });
+  const t = await r.text(); let json = null; try { json = JSON.parse(t); } catch {}
+  return { status: r.status, json };
+}
+const list = (j) => j?.items ?? (Array.isArray(j) ? j : []);
+async function existing() {
+  const out = [];
+  for (let page = 1; page < 20; page++) {
+    const r = await api("GET", `/api/v2/projects/${PROJECT}/tasks?per_page=50&page=${page}`, undefined, sync);
+    if (r.status !== 200) throw new Error(`list tasks: ${r.status}`);
+    out.push(...list(r.json));
+    if (list(r.json).length < 50) return out;
+  }
+  throw new Error("more than 19 pages");
+}
+const rec = { at: new Date().toISOString(), project: PROJECT, created: null, problems: [] };
+const save = () => {
+  const out = JSON.stringify(rec, null, 1) + "\n";
+  if (out.includes(key) || out.includes(sync)) throw new Error("secret in the record; not written");
+  writeFileSync(OUT, out);
+};
+const have = await existing();
+for (const T of TASKS) if (have.some((t) => t.title === T.title)) throw new Error("title exists; refusing");
+writeFileSync(OUT, "", { flag: "wx" });
+rec.created = [];
+for (const T of TASKS) {
+  const r = await api("PUT", `/api/v1/projects/${PROJECT}/tasks`, { title: T.title, description: T.description }, key);
+  const c = { status: r.status, id: r.json?.id ?? null };
+  rec.created.push(c);
+  if (r.status >= 300 || !Number.isSafeInteger(r.json?.id)) { rec.problems.push(`create: ${r.status} ${r.json?.message ?? ""}`); continue; }
+  const back = await api("GET", `/api/v2/tasks/${r.json.id}`, undefined, sync);
+  Object.assign(c, { readBack: back.status, done: back.json?.done });
+  if (back.status !== 200 || back.json?.title !== T.title || back.json?.done) rec.problems.push(`read-back differs for ${r.json.id}`);
+}
+save();
+console.log(JSON.stringify(rec));
@@ -0,0 +1,41 @@
+{
+ "at": "2026-10-21T01:06:25.071Z",
+ "comments": [
+  {
+   "task": 405,
+   "status": 201,
+   "id": 416,
+   "readBack": 200,
+   "found": true
+  },
+  {
+   "task": 406,
+   "status": 201,
+   "id": 417,
+   "readBack": 200,
+   "found": true
+  },
+  {
+   "task": 407,
+   "status": 201,
+   "id": 418,
+   "readBack": 200,
+   "found": true
+  },
+  {
+   "task": 408,
+   "status": 201,
+   "id": 419,
+   "readBack": 200,
+   "found": true
+  },
+  {
+   "task": 411,
+   "status": 201,
+   "id": 420,
+   "readBack": 200,
+   "found": true
+  }
+ ],
+ "problems": []
+}
@@ -0,0 +1,20 @@
+{
+ "at": "2026-10-21T00:28:32.038Z",
+ "comments": [
+  {
+   "task": 412,
+   "status": 201,
+   "id": 414,
+   "readBack": 200,
+   "found": true
+  },
+  {
+   "task": 424,
+   "status": 201,
+   "id": 415,
+   "readBack": 200,
+   "found": true
+  }
+ ],
+ "problems": []
+}
@@ -0,0 +1,19 @@
+{
+ "at": "2026-10-21T00:38:47.170Z",
+ "project": 19,
+ "created": [
+  {
+   "status": 201,
+   "id": 440,
+   "readBack": 200,
+   "done": false
+  },
+  {
+   "status": 201,
+   "id": 441,
+   "readBack": 200,
+   "done": false
+  }
+ ],
+ "problems": []
+}
@@ -0,0 +1,16 @@
+// Sage, 2026-10-21: read-only. Prints id, done, title, the last update and the description as plain text for the
+// given P19 tasks, with the sync key. Writes nothing. Prints no secret.
+// Usage: node read-tasks.mjs https://tasks.woltje.com SYNC_TOKEN_FILE ID...
+import { readFileSync } from "node:fs";
+const [ORIGIN, SYNC, ...IDS] = process.argv.slice(2);
+if (!/^https:\/\/tasks\.woltje\.com$/.test(ORIGIN)) throw new Error("tasks.woltje.com only");
+const sync = readFileSync(SYNC, "utf8").trim();
+const text = (h) => (h ?? "").replace(/<\/p>|<br\s*\/?>|<\/li>/g, "\n").replace(/<[^>]+>/g, "").replace(/&lt;/g, "<").replace(/&gt;/g, ">").replace(/&amp;/g, "&").trim();
+for (const id of IDS) {
+  const r = await fetch(`${ORIGIN}/api/v2/tasks/${id}`, { headers: { Authorization: `Bearer ${sync}` }, redirect: "error" });
+  const j = await r.json().catch(() => null);
+  if (r.status !== 200 || j?.project_id !== 19) { console.log(`== ${id}: status ${r.status}, not P19`); continue; }
+  const out = `== ${id} done=${j.done} updated=${j.updated}\n${j.title}\n${text(j.description)}\n`;
+  if (out.includes(sync)) throw new Error("secret in output");
+  console.log(out);
+}
@@ -0,0 +1,90 @@
+# 10-24 window: re-pin 4429a104f to the row 234 landing, with the 3i-3j migration (draft 0)
+
+Sage, 2026-10-21T01:05Z, draft 0, for mos-1145 under DECISIONS Q173. This is the skeleton. NEW isn't fixed yet,
+so Mos doesn't check this draft. Draft 1 names NEW and goes to Mos for the P0 check. The step layout follows
+`repin-4429a104f.md`. Steps that match are named, not copied.
+
+## Scope (mos-1145, mos-1134)
+
+- One window carries the code of rows 190, 199 and 210, plus row 234 (row a) with its schema step 3i to 3j
+  through `activate --migrate`, agent-run under Q173, backup first.
+- Row a lands before the .53 and .54 installs, by 10-25 (mos-1134). If row 234 hasn't landed by 10-24 12:00Z,
+  I ask Mos whether to run the window without it (no migration) or to move it.
+- Jason has no step. Nobody acts as Jason. No pi (P19 383). No Save, no `mosaic name`. Nothing is pruned.
+- `--sso` stays off. Row 200's `activate --sso` is in NEW as a tool. Turning it on changes who reaches the Console
+  from outside, so that's Jason's (Q173 exclusion). It has its own window, the Q175 phase 2 window on 10-23
+  (mos-1148). That window runs first, so this window's OLD may be the phase 2 copy, and P1 reads it from
+  `status`.
+
+## Names
+
+- OLD, live: `4429a104f6d65ccf165f6c83b5d1dce3147dfde0`, schema 3i, pointer `pm: true` (record 99a406ed3).
+  P1 re-reads the activation id and the Console flags from `status`. I don't copy them from the last window.
+- NEW: `c771a36f4bd0b6c359282425c668996a90072f93`, the row 234 landing (2026-10-21 06:16Z), unless Mos rules a
+  later code landing. 194 is the open candidate. 210, 237, 232, 241, 242, 233 and 234 have landed.
+- REPO, `P`, `WIN=agents/sage/work/window-repin-<NEW12>/`, `SNAP`: as in `repin-4429a104f.md`, with the
+  sha checks at P0 and before S1, S2 and any D3.
+
+## What NEW carries over OLD (refactor c771a36f4)
+
+`git log --first-parent 4429a104f..HEAD`, path-limited to packages, scripts, roles, contracts, adapters, skills
+and the package files:
+
+| Row | Commit | Live effect to check |
+|---|---|---|
+| 201 | afad4993f | business: access.json loader. Check: the live business has no access.json, and load stays LOAD_OK (P1). |
+| 204 | d0bbc5c1c | business: 193a viewer level. Same check. |
+| 190 | 00d4cc1f6 | Several instances per host. Touches `stack-release.sh`, `webui-service.sh`, `bus-service.sh`, `stack-copy.sh`. The default instance must render the same units: P2 diffs the rendered units OLD vs NEW for `mosaic-stack`, and any difference stops the window until it's explained. |
+| 200 | 9e1085816 | Tool: `activate --sso`. Off here. `--plan` must show no `--sso` line. |
+| 199 | cb5fdb064 | Credential store per agent. Check: bus start with no store entries for the live agents changes nothing, and the chief's and pm's launches still pass. The P3 rehearsal covers start. |
+| N3 | 390ea5261 | README only. |
+| 230 | c8bc5cf4c | Case 2 scripts, tools only. Not run live. |
+| 210 | f5753c0e8 | Host access. The live business has no `hosts`, so nothing is granted. Bus start runs the host-run sweep (M34d). P3 must show it removes nothing. |
+| 237 | d7d943199 | Publish busy check (199 N1). |
+| 232 | e65a3ab4d | Installer I1: `stack-release.sh --units external` and `stack-copy.sh copy --bundle`, `wrapper --create`. Both are opt-in, and this window uses neither. The default units path must render the same units, so the P2 unit diff covers it with row 190. P0 checks that no window command line carries `--units external`. |
+| 241 | 5d4a61776 | Test only (bus land.test.mjs). No live effect. |
+| 242 | 5fb736b92 | Bus publish hold: after publish-timeout the bus holds the decision until its push ends, then records a late push. The live business has no publish in flight at W1, and P3 shows none open. Its follow-up fc1cb856b is comments only (git-socket.mjs). |
+| 233 | 57f59e0c3 | Installer I3: new tool `scripts/stack-upgrade.sh` and a `stack-release.sh` change. This window doesn't run `stack-upgrade.sh`. The P2 unit diff covers the `stack-release.sh` change with rows 190 and 232. |
+| 234 | c771a36f4 | Machine grant row a and the 3i to 3j schema step (new tables `hosts` and `host_grants`). `--plan` must say `migration: 3i -> 3j`. |
+| PRD 1.7+1.8 | 0adf8ddfe | `docs/prd/mosaic-stack.md` and `packages/tasks/requirements.json` move to version 1.8 (mos-1154, mos-1156, DECISIONS Q192). The live pm cites 1.6 until this window. Check after: the pm's requirements read answers version 1.8. |
+
+Service script drift OLD to HEAD is 415+/91- over the four scripts, mostly row 190. P5 holds them at NEW.
+
+## Backups and the migration
+
+- W5: the stopped store backup that every activate takes (row 185), with SHA256SUMS, SCHEMA 3i and STAMP,
+  plus the rollback set. Before `--migrate` writes, I check that SCHEMA reads 3i and the backup SHA256SUMS hash.
+- W0b: the business file copy, as in the last window.
+- Rollback after a migration isn't the plain rollback. OLD is 3i and the store is 3j, so going back needs
+  `--restore <W5 activation>`, and that loses the events written after W5. The row 181 restore guard counts
+  11 tables, and the untimed ones need the D3 snapshot. Row 234 adds `hosts` and `host_grants` to the untimed
+  list (T46), so at 3j the D3 snapshot covers them too. Draft 1 recounts the list from NEW. Mos decides any restore past W5, as before.
+- Grant look-alikes (row 234 A22b, gizmoduck-0107). `3i-3j.sql` adds `events_grant_actor` but doesn't check
+  rows already in the store, so after the migration only the actor filter in `GRANT_EVIDENCE` (actor_role NULL,
+  actor_run 'grant') ignores an old session-written row. P3, and again just before `--migrate`: on the
+  backup copy, count the `action.allowed` events whose body.action or body.operation starts with `grant.`, or
+  whose body has `hostLineLeft`. Expect 0, since no grant code has run live. Any nonzero count stops the window
+  until I've read those rows.
+- P3 is the rehearsal with `--migrate` on a copy of the live backup. It must show the 3j step and the row
+  counts before and after.
+
+## Row 42 (S7) interaction
+
+Row 42's pieces may be in flight at window start (sage-1622, mos-1148 C1 and C2). W1 adds: list open pm tasks, and either pm
+finishes or parks them before W5, or I record which piece crosses the window. No restore while a piece has
+history unless the window fails.
+
+## Open before draft 1
+
+- Q1, ruled by mos-1161: draft 1 doesn't wait for 194. NEW is the latest code landing when I cut draft 1. If
+  194 has landed with a green full gate (15 packages, ten script suites), NEW is the 194 landing and P3 also runs
+  the lifecycle verbs once on the backup copy and gets one pm reply under the new roles/chief-of-staff files. A
+  P3 failure that traces to 194 drops NEW back to c771a36f4 before anything touches live, and the window goes on.
+  Otherwise NEW is c771a36f4 and 194 rides a later window.
+- Q2, settled by mos-1148: phase 2 is its own window on 10-23. Draft 1 takes OLD and the Console flags,
+  `--sso` included, from `status` after that window.
+- Q3: who operates. If Darkwing is free, Darkwing operates and I check. Otherwise I operate as in the last
+  window.
+- The P-step evidence list for rows 199 and 210 at bus start. Both have landed (cb5fdb064, f5753c0e8), so
+  it's due in draft 1. I take each log line and exit code from a P3 rehearsal run, not from the code.
+- Rows 241 and 242 (bus): P3 shows no publish or land decision open before W5.
@@ -1390,3 +1390,21 @@ are never rewritten or removed; corrections are new entries.
 2026-10-20T23:21:32Z | Dewey (Opus 5.5, 84fb346c) | row 66 (#1559) round 3 review, rebase of r2 onto c40d846cb (sage/row66-r3 2369c00e3, manifest 42e3876ca168) | APPROVE 29771, rev 2529: patch-id 6d085621 equals r2, range-diff =, 23 manifest hashes match, no drift past the base, four drifted files sit beside rows 190/192 cleanly, no hash pins; singles are Sage's (not rerun). Also #436b Q-B4 answered by mos-1147, verdict addendum
 2026-10-20T23:31:31Z | Dewey (Opus 5.5, 84fb346c) | #436b design r3 review (megavolt-0050, DESIGN.md fa5658941) | CHANGES: restart reconcile spends step 0 refusals (#436a r6 X3 conflict), settle unknown id keeps unverified token in use; N7 secretCheck; B1-B3, N1-N6, D12 closed; verdict design-r3-verdict.md 4c87d859; dewey-0759 Megavolt, dewey-0760 Sage |
 2026-10-20T23:32:42Z | Sage (Claude Opus 5.5, 1ef1e4f8) | machine grant rows, slot relay, queue sweep | rows 234 (#1740, 3i-3j) and 235 (#1741) added, row 206 moved to 3j-3k after 234 (f519fb1d2); row 199 r1 request as jarvis 29778 (manifest 35f900fd rebuilt from git objects); #436b r3 item 1 ruled (b), sage-1578; queue-commit 1c46d0abf revs 2456-2539; slot Megavolt to Gosalyn row 230
+2026-10-21T01:28:05Z | Darkwing (Opus 5.5, 7525c8e4) | row 232 I1 build (sage-1558, sage-1561 ruling a) | rebased onto cb5fdb064 (row 200), gate green and 17/17 mutants killed on Sage's slot; in review round 1, manifest 7a3b4ea1 at 84f1a91e6 on darkwing/row232-r1, comment 29825, revs 2595-2596; Filbert woken
+2026-10-21T01:34:13Z | Filbert (Opus 5.5, 048f3c63) | row 232 installer I1 review r1 (#1734, manifest 7a3b4ea133cc) | APPROVE, Gitea 29829, queue rev 2600 (left for Sage's queue-commit); static review, gate and mutants are Darkwing's receipts; 3 non-blocking notes
+2026-10-21T01:49:55Z | Sage (Opus 5.5, 1ef1e4f8) | row 237 landed d7d943199 (#1743, gate green, M1 killed); PRD 1.7+1.8 landed 0adf8ddfe (Honker 2884ee496, Duckworth approve bf52628f9, tasks 97/0 bus 478/0 on the tip, DECISIONS Q192); rows 239 (#1745) and 240 (#1746) added; 233 briefed; queue revs 2540-2603 committed 584e2bd82 | landed, push next
+2026-10-21T02:51:46Z | Sage (Opus 5.5, 1ef1e4f8) | row 210 landing (r5 0485384e9, Duckworth r3 29851) | landed f5753c0e8, patch-id 723b1c83 = r5 diff, manifest 688d38b9 OK; gate 2796/0 packages, 429/0 scripts; mutants 52/53 (M22b equivalent); #1707 closed (29853), Vikunja 424 comment 429; queue revs 2604-2617 c084d8d42; row 234 briefed; Megavolt has the slot for 241 (sage-1668)
+2026-10-21T03:01:43Z | Filbert (Opus 5.5, 048f3c63) | row 232 installer I1 review r2, rebase scope (#1734, manifest 7af3c94308e0, da2da2f6c on 8fede5fc6) | APPROVE, Gitea 29865, queue rev 2622 (left for Sage's queue-commit); README = predicted 3-way blob 89a95b32, 7 blobs same as r1, BUILD.md +31/-0; corrected my r1 reader claim (host.test.mjs:855 reads cli README)
+2026-10-21T04:14:49Z | Sage (Opus 5.5, 1ef1e4f8) | lead: rows 241 and 242 landed, slot order | row 241 landed 5d4a61776 (#1747 closed 29883, M1-M3 killed, gate 2797/0 + 429/0); row 242 landed 5fb736b92 (#1748 closed 29894, Duckworth approve 29889, gate 2826/0 + 429/0); late-record notice ruled a follow-up (Vikunja 440 c432); row 233 brief re-pinned rev 2631; carry items on #1744 (29885) and #1734 (29886); queue revs 2628-2638 committed 96bac588f
+2026-10-21T04:50:44Z | Darkwing (Opus 5.5, 7525c8e4) | row 233 I3 gate, mutants and review request (sage-1704, sage-1707, sage-1708) | gate green on d99166ade (1201/0, cli 616/0) and m1-m8 8/8 killed; N1 flock-holder orphan fixed test-only in 08db6ac3f, rerun c0 20/0 + m1 killed, sweep 0 left; in review round 1, manifest 464ce9eb at 1a1dc80ca on darkwing/row233-r1, comment 29901, revs 2644 and 2647 (lock race resolved); Filbert woken
+2026-10-21T04:58:01Z | Filbert (Opus 5.5, 048f3c63) | row 233 (I3, #1735) review round 1 on manifest 464ce9eb177a (1a1dc80ca) | APPROVE, Gitea 29922, rev 2659 (left for Sage); static, no slot; 5 non-blocking notes N1-N5 (args-failed exit 1, REPO ownership, signals, run sheet npm/claude path, sections 8/10 precheck)
+2026-10-21T05:47:45Z | Sage (Opus 5.5, 1ef1e4f8) | rows 233+234 landing gate, row 233 landing, 240 brief, drift sweep (sage-1742..1758) | combined gate stopped on two row 234 failures (bus schema.test.mjs:522 counts, cli stack-release T46 restore-guard lists; mos-0823); 233 landed alone 57f59e0c3 (patch-id b16ac924, verify-commit ok, cli 617/0, scripts 585/0), pushed with b00d7d94d, 5465fd52d and riders 642a9b87d, 16019b80e; #1735 closed 29931, done rev 2675, Vikunja 432 comment 436; 240 briefed rev 2676; 234 r3 c783d5e39 rebuilt on the landing in Gizmoduck's slot; 197 and 238 drifted, rebase sent (sage-1754, 1755, 1757 stash fix)
+2026-10-21T06:20:30Z | Sage (Opus 5.5, 1ef1e4f8) | row 234 r3 landing gate (2890/0 packages, 585/0 scripts) and landing c771a36f4, pushed 06:16Z; #1740 closed 29938, Vikunja 436 c437; 235 briefed rev 2686, rotateBy ruling; 238/228/197 rebuilt on 234, slot order Darkwing 240 then 238, 228, 197; 10-24 draft NEW c771a36f4 (sage-1766..1787) | landed
+2026-10-21T06:37:41Z | Darkwing (Opus 5.5, 7525c8e4) | row 240 I4 build, slot run and review request (sage-1759, sage-1773, sage-1788, sage-1795) | r1 on 47ec9fe2f stopped at singles (stack-upgrade 20/1: the N1 test's own after hook threw ENOENT once the fixture removed the root), b45852daa drops it; r2 green: singles 37/0, M1-M8 8/8 killed, cli 639/0, scripts 585/0; darkwing/row240-r3 pushed at ad1b23ab2 on c771a36f4, manifest 573ece95 (9 paths), in-review revs 2694 and 2695, request comment 29943 on #1746, Filbert woken | in review
+2026-10-21T06:41:13Z | Filbert (Opus 5.5, 048f3c63) | row 240 (I4, #1746) round 1 review on manifest 573ece95 (ad1b23ab2) | approve, Gitea 29945, rev 2696; 233 carries N1/N4/N5 present; notes N1 boot unit Before= names one business, N2 doc-only, N3 info
+2026-10-21T07:15:48Z | Darkwing (Opus 5.5, 7525c8e4) | row 195 (#1693) DESIGN r7, Case 1 install on .53 after the installer split | darkwing/row195-r7 5425ea2f3 pushed (r6 carried as 7398b7dd7 on c515273db), DESIGN.md blob 17dfbad95ba5; business id mosaic-stack named in §7, so DEFERRED 240 N1 doesn't apply (sage-1813); root steps left to ops-01, nothing run on .53 (sage-1809); Duckworth review requested 07:14Z, Gitea 29960; row 226 items (dev.args writer, adopt) sent to Gosalyn and copied to Sage per sage-1814; r7 :21 and :326 still say 226 is unclaimed, to fix next revision
+2026-10-21T07:29:11Z | Sage (Opus 5.5, 1ef1e4f8) | row 240 landing gate (cli 639/0, scripts 585/0) and landing c515273db with DEFERRED da3051ccc; 238 r3/r4 and 228 r3 requests posted as jarvis; combined 228+238 gate (seat 165/0, cli 640/0, scripts 585/0, 238 mutant killed), landings 86249ac55 and d49b1f2bd, DEFERRED e7078e6a8; #1746, #1729, #1744 closed; 197 r2 request posted (29961), r5 rebuild on 238; 195 after 226, Duckworth r7 note posted (29962); slots Herb 197, Gosalyn 212 (sage-1788..1826) | landed
+2026-10-21T08:29:39Z | Filbert (Opus 5.5, 048f3c63) | row 215 (C2-04) manifest review, herb/row215 6a508804f | CHANGES REQUESTED, static: B1 cli config.mjs:61 trackerFor projectFilePath skip, B2 refuse publish naming a library entry, B3 sync-to-read window in the shared state contract; N1-N3; sent to Herb and Sage 08:29Z
+2026-10-21T08:37:47Z | Filbert (Opus 5.5, 048f3c63) | row 215 (C2-04) manifest r2 review, herb/row215 2522025af | APPROVE, static: B1-B3 and N1-N2 resolved per sage-1860/1862; build notes on lock file creation, mirror metadata allowlist and flock dependency; sent to Herb and Sage 08:37Z
+2026-10-21T08:52:06Z | Darkwing (Opus 5.5, 7525c8e4) | row 195 (#1693) build and manifest round 1 in review (rev 2756, request comment 29985, results 29987) | darkwing/row195-b 37171f65b on 4ced5e63d (ddf7dce6c build: scripts/case1-accept.sh, case1-accept.test.mjs, TOOLS.md entry, DESIGN r7 doc fixes per sage-1817; 37171f65b BUILD.md results); slot: single 22/22 (sage-1829), 12/12 mutants killed and gate cli 662/0 plus scripts 429/0 selftests (sage-1865), green per sage-1870; Duckworth reviews (sage-1872); Gosalyn 0087 Q4/Q5 match W10/W12; flock goes to DEFERRED with 215 (sage-1871); nothing touched .53
+2026-10-21T09:20:46Z | Sage (Opus 5.5, 1ef1e4f8) | 212+197 combined landing gate (node 981/0, selftests 429/0, 08:51-09:03Z); 197 lane proof stopped after two failures (try 1 lane-image base inspect, N7; try 3 solo-a process.test.mjs:82 under umask 077), recovered cf48efccf083; mos-1162: row 212 landed alone as ee7b2f137 (paths match a2c72ac95, patch-id ea84d3e35470), #1713 closed 29996, revs 2759-2760; DEFERRED N7 plus brief docs/plans/2026-10-21_gate-env-rows.md at fefd54e13, rows 243 (chmod) and 244 (fixture PI_AUTH_FILE) revs 2761-2762; row 66 rebuilt as sage/row66-r4b 49ad61963 on fefd54e13 (manifest 99cab8275af4, not yet requested); slots: Herb 215 focused 26/0, Gosalyn 231 singles 60/0, Herb 197 r6 focused granted; kept root ga-8I3iZc removed (sage-1827..1893) | in progress
@@ -408,8 +408,9 @@ exposure of a named Console waits for Jason after Q175 SSO.

 ```
 scripts/stack-copy.sh copy COMMIT [--copies DIR] [--allow-worktree]
-scripts/stack-copy.sh wrapper ID [--instance NAME] [--copies DIR] [--bin DIR]
-scripts/stack-copy.sh check [--instance NAME] [--copies DIR] [--bin DIR] [--business ID]
+scripts/stack-copy.sh copy --bundle FILE SHA [--copies DIR]
+scripts/stack-copy.sh wrapper ID [--instance NAME] [--copies DIR] [--bin DIR] [--create]
+scripts/stack-copy.sh check [--instance NAME] [--copies DIR] [--bin DIR] [--business ID] [--units user|external]
 ```

 One read-only tree supplies the bus, Console and human CLI (row 85,
@@ -423,6 +424,14 @@ renames beside the target. A published existing copy stays unchanged.
 Dependencies use the exact lock and carry Pi's installed lock record.
 Failure publishes nothing and removes the temporary tree.

+`copy --bundle FILE SHA` (row 232) is for a host with no refactor checkout.
+SHA is a full 40-character id. The bundle must pass `git bundle verify`,
+carry `refs/heads/refactor`, and reach SHA from it; each miss refuses and
+writes nothing. The copy is then made from SHA as `copy` makes it, and the
+script prints `release:` with the RELEASE value at SHA and `bundle sha256:`
+with the bundle's digest. That pair is the release identity on such a host.
+Without `--bundle`, `copy`'s reachability rule is unchanged.
+
 `wrapper` is a live switching step, reserved for Jason or Mos. It accepts
 only an existing copy and a regular non-symlink mosaic wrapper with the
 Q81 marker on line 2 and its exact lease line to mosaic-old. It preserves
@@ -430,11 +439,16 @@ both lines, adds comments naming the copy root and Q81's mosaic-old lease
 probe, and atomically replaces the wrapper's final exec with the
 copy's scripts/mosaic. --bin is a fixture override; the default is
 ~/.npm-global/bin. Neither the Q81 worktree nor mosaic-old is removed.
+`wrapper ID --create` (row 232) writes the first wrapper on a new host, the
+same file `wrapper` writes. It refuses when anything is at the wrapper path,
+a symlink included, and never replaces it. Without `--create`, a missing
+wrapper still refuses.
 `check` changes nothing: it reads effective systemd WorkingDirectory and
 ExecStart (including drop-ins) for the bus and Console, plus the wrapper
 exec. It prints all three paths and succeeds only on the same existing
 copy; absent/failed reads and a mismatched ExecStart fail. Business defaults
-to mosaic-stack. Queue work continues on the canonical scripts/mosaic.
+to mosaic-stack. `check --units external` (row 232) reads root's system units
+with `systemctl show`, without `--user`. Queue work continues on the canonical scripts/mosaic.

 Bus render/install accept --copy ID, --copies DIR, --pm and the unchanged
 --claude pin. Without --copy the rendered unit stays the checkout unit.
@@ -455,7 +469,10 @@ scripts/stack-release.sh activate ID BUSINESS [--pm | --pm-after-harness] [--mig
 scripts/stack-release.sh pm-on BUSINESS [--timeout S]
 scripts/stack-release.sh rollback BUSINESS [--restore ACTIVATION [--events N]] [--timeout S] [--plan]
 scripts/stack-release.sh status BUSINESS
-common options: --copies DIR, --bin DIR, --instance NAME
+scripts/stack-release.sh confirm ID BUSINESS --units external [--rollback OLD --cause A3|A4|A5] [--timeout S]
+scripts/stack-release.sh revert ID BUSINESS --units external
+scripts/stack-release.sh gate ID BUSINESS --units external --since EPOCH [--timeout S]
+common options: --copies DIR, --bin DIR, --instance NAME, --units user|external
 --events N is the total of the per-table counts the post-backup-events refusal prints: events and
 every table in COUNTED.
 ```
@@ -582,7 +599,8 @@ error. Before anything stops, a run whose Console flags hold `--sso` refuses
 `sso-target` for a target Console without it, `sso-config` when the target's own
 `checkConsole` refuses the config's `console` key (or there is none, in which
 case, from another copy, it names the first step: activate the target without
-`--sso`, then write `console.sso`), and `sso-slot` for each provider's slot file
+`--sso`, then write `console.sso`; on a named instance both commands carry
+`--instance NAME`), and `sso-slot` for each provider's slot file
 that is missing, a symlink, not a regular file, not owned by this uid, has group
 or other bits, resolves inside the repository or the copies, or is empty. It
 uses `lstat`, `stat` and `realpath` on the slot and never reads it. `--plan`
@@ -652,7 +670,7 @@ pinned copy](../packages/cli/README.md#one-pinned-copy-row-85-1579)).
 #### Rehearsal on a scratch root (D2, row 163)

 ```
-scripts/stack-release.sh rehearse ID BUSINESS --backup ACTIVATION|PATH --port N [--timeout S]
+scripts/stack-release.sh rehearse ID BUSINESS --backup ACTIVATION|PATH|last --port N [--timeout S]
 ```

 `rehearse` starts the target copy's bus host and Console on a copy of a
@@ -663,7 +681,11 @@ runs it against live data. It stops and starts no unit and writes no pointer
 or log line.

 `--backup` takes an activation id under `<dataRoot>/backups/stack/` or an
-absolute path. `--port` is the scratch Console's loopback port, 1024 to
+absolute path. `--backup last` (row 233) takes the newest backup the
+activation log records and prints `PASS backup-last` naming it. With none in
+the log it fails `no-backup`, exits 3 and makes no directory. After the
+backup's checks it prints `BACKUP_STORE <activation id> schema <version>`.
+`--port` is the scratch Console's loopback port, 1024 to
 65535. The run refuses `port-reserved` for 7332, 7333 and the pointer's
 `--port` and `--tester-port`, and `port-in-use` for a port something holds;
 it never picks another port. `--timeout` (default 60 seconds) bounds the
@@ -711,6 +733,203 @@ Usage exits 4. Nothing prunes rehearsal directories.
 starts no thread ticker, and leaves an earlier host's `sessions.json` and
 its runs alone. No unit passes it, and `--pm` with it is a usage error.

+#### Root-owned units (`--units external`, row 232)
+
+On a host whose bus and Console are root's system units, the stack user runs
+`stack-release.sh` with `--units external` from its own clone of the release
+bundle (sage-1561). The script then calls `systemctl show`, `is-active` and
+`list-units` without `--user` and reads no journal. It starts, stops and
+installs nothing. Root does those steps, and the I3 driver calls the verbs
+below in order. Without `--units`, every command line and every byte of
+output is what it was before row 232. `confirm`, `revert`, `gate`, `--to`
+and `--expect-from` are usage errors without `--units external`.
+
+- `adopt`, `status`, `activate ID` and `rollback --to ID` take the flag.
+  `rollback` then needs `--to`, and `--to` must be the copy `rollback` alone
+  would pick from the log, or it refuses `to-not-previous`.
+- `--plan --expect-from OLD` refuses `pointer-differs` when the pointer
+  names a copy other than OLD.
+- `pm-on` and `activate --pm-after-harness` refuse `external-pm`; the PM
+  flag is in root's bus unit. `--pm`, `--tester-port`, the proof flags,
+  `--no-proof`, `--no-send` and `--sso` are usage errors; root's Console
+  unit carries the Console flags.
+- `activate` and `rollback` refuse `units-running` unless both units read
+  inactive or failed and the store is closed. They make the rollback set
+  with an exclusive `mkdir`, write `AWAITING-UNITS` (the target copy) first,
+  capture the pointer, the wrapper and both units' show output and unit file
+  sums, back up and migrate or restore the store, and write the wrapper.
+  They write no pointer and start nothing. The last line says the run is
+  staged and names `confirm`. A failure after the capture writes `FAILED`
+  with its code, logs nothing more and exits 1; the activation stays open.
+- `confirm ID BUSINESS` needs exactly one `AWAITING-UNITS` for copy ID whose
+  activation the log holds open, or it refuses `open-activation`. It gates
+  the start root made and writes the pointer and an `ok` line with the
+  started line's op, from, to and backup.
+  `confirm --rollback OLD --cause A3|A4|A5` gates OLD after root put the old
+  units back and logs `failed` or `gate-failed` with `rollback ok` (exit 1)
+  or `rollback-failed` (exit 2). Either removes `AWAITING-UNITS` and `FAILED`.
+- `revert ID BUSINESS` puts the saved wrapper back and, when the run had
+  started a migration, restores the backup taken before it. It writes no log
+  line and can run again.
+- `gate ID BUSINESS --since EPOCH` gates a copy with no open activation,
+  takes no lock and writes nothing: 0 on a pass, 1 otherwise. EPOCH is root's
+  clock before root started the units.
+
+The gate under `--units external` replaces the journal read. The bus unit's
+`ActiveEnterTimestamp`, in whole seconds, must be at or after the started
+line's second (`confirm`) or `--since` (`gate`); an older start fails
+`stale-start`, so a unit that never stopped can't pass. With the PM on, the
+gate reads `launches list --json` for exactly one live launch of the PM's
+instance (the business's `launch.by`), for this business, whose run started at
+or after the floor. `status` adds an
+`awaiting units:` line for an open activation.
+
+Under `--units external`, `activate --plan` also refuses `open-activation`
+while any rollback set holds `AWAITING-UNITS`, and `migrate-required` when
+the target migrates the store and the run lacks `--migrate` (row 233). Under
+`--units user` the plan's bytes are unchanged.
+
+#### Root's upgrade driver (`scripts/stack-upgrade.sh`, row 233)
+
+```
+scripts/stack-upgrade.sh upgrade --instance dev --bundle FILE --sha SHA [--migrate] [--no-rehearsal]
+    [--rehearse-port N] [--timeout S]
+scripts/stack-upgrade.sh rollback --instance dev --to ID [--restore ACT [--events N]] [--timeout S]
+```
+
+Root runs it from a root-owned checkout of the reviewed commit, never from a
+copy, because the stack's user can write the copies. Each run needs Mos's go,
+and `--migrate` needs Jason present (decision 96). The host must be prepared
+first (`docs/guides/host-run-sheet.md`). Only the default instance, `dev`, is
+accepted; a named instance's units are a later row.
+
+The unit values come from `/etc/mosaic-stack/dev.args`, which I2's install
+writes: one `case2-unit.sh` argument per line, the serve flags after `--`,
+owned by root with no group or other write, exactly one `--copy`, and that
+copy the one both installed units run. Otherwise the run refuses
+`args-unreadable` or `args-differ`. The driver writes the new copy id into
+that file only after `confirm` passes.
+
+`upgrade`, in order. Every stack user step runs as
+`sudo -u USER -H env PATH=<node dir>:/usr/local/bin:/usr/bin:/bin` from the
+user's clone `<home>/src/mosaic-stack`:
+
+1. Takes `flock -n` on `/run/mosaic-stack/upgrade-dev.lock` and holds it to
+   the end, rollback included. A second run refuses `upgrade-running`, and
+   a lock it can't open refuses `lock-failed`.
+2. Fetches the bundle's `refactor` into the clone and fast-forwards it to
+   SHA (`fetch-failed`), then `stack-copy.sh copy --bundle FILE SHA`
+   (`copy-failed`).
+3. A1: this checkout's HEAD is SHA (`head-mismatch`), the copy exists
+   (`copy-missing`), `/usr/local/lib/mosaic-stack/hostcheck.sh --check`
+   exits 0 (`profile-drift`, row 240), both units name one copy
+   (`units-unreadable`, `units-disagree`) and it is the args file's
+   (`args-differ`), and
+   `activate SHA BUSINESS --units external --plan --expect-from OLD` exits 0
+   (`plan-refused`, which covers `open-activation`, `migrate-required` and
+   `pointer-differs`).
+4. The rehearsal, `rehearse SHA BUSINESS --backup last --port 7339`
+   (`--rehearse-port`). Exit 0 goes on. Exit 3 means no backup in the log
+   and goes on only with `--no-rehearsal`, logging `rehearsal-skipped`;
+   without the flag it refuses `no-backup`. Exit 0 with `--no-rehearsal`
+   refuses `rehearsal-required`; any other exit refuses `rehearsal-failed`.
+5. A2 stops the Console, then the bus, and waits for both to read inactive
+   or failed. A3 is `activate --units external`, A4 the render with the new
+   `--copy` (which also starts the bus, then the Console), A5 `confirm`.
+   The driver writes the new args file beside the old one before A2
+   (`args-failed`, exit 3) and moves it into place after A5. A failed move
+   exits 5 `args-failed`: the new copy is live and confirmed, the args file
+   still names the old one, and root moves the new file (the result line
+   names it) into place by hand.
+
+A failure in A2 or a stage that exits 3 starts the old units again and gates
+them (A2f). A later failure stops both units, runs `revert`, renders the old
+copy and runs `confirm --rollback OLD --cause A3|A4|A5`. `rollback` is the
+same from A1 on, with `rollback BUSINESS --to ID`, no fetch, no copy and no
+rehearsal; `--restore` and `--events` pass through.
+
+Root reads no output the stack user wrote except exit codes and the
+rehearsal's `BACKUP_STORE` line, which it copies into its log after a match
+against a fixed pattern (`BACKUP_STORE none` otherwise). The step log
+`/var/log/mosaic-stack/upgrade-dev.log`, 0640, gets one
+`<time> <step> rc=N argv: ...` line per step and a last
+`<time> result exit=N <code> <text>` line.
+
+Exit 0 ok, 1 failed with the old stack running and gated, 2 rollback-failed
+with both units stopped, 3 refused with nothing stopped, 4 usage, 5
+args-failed with the new stack live and confirmed. A refusal
+after step 2 leaves the user's clone fast-forwarded and the new copy made. After exit
+2 the activation stays open, so the next run's plan refuses until root
+finishes it.
+
+#### Root's host check (`scripts/case1-hostcheck.sh`, row 240)
+
+```
+/usr/local/lib/mosaic-stack/hostcheck.sh --check | --enforce | --upstream
+```
+
+Installed from `scripts/case1-hostcheck.sh` as `hostcheck.sh`, with
+`scripts/case1-pins.sh` beside it (`docs/guides/host-run-sheet.md` section 4).
+The pins are the profile's sha256, the `apparmor-profiles` version it came
+from and the bubblewrap install pin; changing one is a reviewed commit.
+Seven items, one `ok N` or `FAIL N` line each: the profile file matches the
+pin and no package owns it; `aa-status` has `bwrap` and `unpriv_bwrap` in
+enforce mode and no `mosaic-bwrap`; no other file under `/etc/apparmor.d`
+names `bwrap`; a bwrap child under the units' no-new-privs reads
+`bwrap//&unpriv_bwrap (enforce)`; `/usr/bin/bwrap` is `root mosaic 0750` by
+the statoverride and by `stat`; the user-namespace restriction and
+`fs.protected_hardlinks` are 1; `net.ipv4.ip_unprivileged_port_start` is
+above the Console unit's `--port`, or above 1023 with no unit. A `note` line
+says whether bubblewrap is the install pin and never fails.
+
+`--check` exits 0 or 1; `stack-upgrade.sh` refuses `profile-drift` on 1.
+`--enforce` exits 0. On a failure, or while `/etc/mosaic-stack/DRIFT` exists,
+it unloads the profile if loaded, sets `/usr/bin/bwrap` to `root:root` 0700,
+appends the failed items to `DRIFT` and one line to
+`/var/log/mosaic-stack/hostcheck.log`. It never writes the statoverride. The
+apt hook runs it after every package run, and `mosaic-hostcheck.service`
+(`packages/cli/systemd/`) at boot before the bus. `--upstream` compares the
+`apparmor-profiles` candidate's profile to the pin, prints any difference
+and exits 0, or 1 when the download fails. Exit 2 is usage or a refusal:
+root takes no `--root` (the test seam), and other users run only with it.
+
+#### Root's acceptance run (`scripts/case1-accept.sh`, row 195)
+
+```
+case1-accept.sh --business ID --args FILE --claude-pin PIN --node-pin vN.N.N
+```
+
+Root runs it on the Case 1 host after the install window, from a root-owned
+checkout. It reads the user, home, copy, node, claude and both ports from the
+args file (`/etc/mosaic-stack/dev.args` on .53), which must pass
+`stack-upgrade.sh`'s rules, say `--profile factory` and name `--business`.
+Every command that runs the stack's code runs as
+`sudo -u USER -H env PATH=<node dir>:/usr/local/bin:/usr/bin:/bin` from `/`.
+Root itself reads `ss`, `/proc`, the account database and file metadata. It
+runs `systemctl show` and `is-enabled`, `curl` on the Console's loopback
+`/healthz`, `sudo -l`, `sudo -u jarvis bwrap --version`, `hostcheck.sh
+--check`, and node to parse `managed-settings.json` for F9. F9 runs node only
+when `--node` is the `--node-pin` path, and the file and every directory above
+it are root's with no group or other write. The one write is F3's message and
+its reply, and it never opens `claude-session.env`.
+
+It prints one line per check, `<id> <path> <mark> <evidence>`, then
+`count <mark> N` for each mark and a result line. The functional checks
+F1-F11 are `pass` or `FAIL`: both units active as the user, the Console on
+127.0.0.1 only, a tester message to chief answered, `case2-precheck.sh
+--profile factory`, the bwrap labels of a live role session, the claude and
+node pins, one live PM launch, the credential file's owner and mode, the
+autoupdater off, no Discord binding. The host paths P1-P11 are `closed`,
+`accepted <ruling>` (Q182, Q183, mos-1096, mos-1101) or `unnamed`, which means
+no ruling names the path; each `unnamed` line goes to Mos. P9 runs
+`hostcheck.sh --check`, never `--enforce`.
+
+Exit 0 when every F check passes, 1 when one fails, 2 on usage or a refusal:
+a bad args file, or `--root` misused. A P check never changes the exit.
+`--root DIR` is the test seam for `packages/cli/tests/case1-accept.test.mjs`;
+root takes none, and other users run only with it. Design: row 195 r7
+section 5 (`agents/darkwing/work/queue-195/DESIGN.md`).
+
 ## Console service (`scripts/webui-service.sh`)

 ```bash
@@ -0,0 +1,281 @@
+# Host run sheet: preparing a host for the stack
+
+ops-01 runs this on a fresh host before install (I2), and once per host for enrollment. Jason places the
+credentials in section 9. Brief: `docs/plans/2026-10-20_installer-rows.md`, I3 (row 233, #1735). The
+host design is Darkwing's r6 (`agents/darkwing/work/queue-195/DESIGN.md`, section 2) as the brief
+changes it.
+
+The hosts are .53 (profile `factory`) and .54 (profile `library`). Both get every section unless a
+section says otherwise. Every command runs as root unless it starts with `sudo -u mosaic`.
+
+Each item names the `scripts/case2-precheck.sh` line that verifies it. Install's precheck runs as the
+stack's user with `--business ID --profile factory|library`. Where no precheck line checks an item, the
+item says "precheck line missing", and Gosalyn adds the line to I2. Today's precheck (C2-13a) has these
+gaps; C2-13b adds the library lines (`library.sync`, persona modes, no Discord binding).
+
+## 1. The stack's user and its home
+
+```sh
+useradd --system --user-group --home-dir /srv/mosaic --create-home --shell /usr/sbin/nologin mosaic
+chmod 0700 /srv/mosaic
+install -d -o root -g root -m 0755 /etc/mosaic-stack
+install -d -o root -g root -m 0750 /var/log/mosaic-stack
+```
+
+`mosaic` gets no sudo rule and no supplementary group. Check with `sudo -l -U mosaic` (expect "not allowed
+to run sudo") and `id -G mosaic` (one number).
+
+Precheck lines:
+- `ok      HOME is /srv/mosaic`
+- `ok      sudo -n true fails as mosaic`
+- `ok      id -G prints one group (<gid>)`
+- `/srv/mosaic` at 0700: precheck line missing.
+
+## 2. node, pinned under /opt
+
+The pin is the version and sha256 the window names. `<v>` below is that version, for example `v24.x.y`.
+
+```sh
+install -d -o root -g root -m 0755 /etc/mosaic-stack/node-keys /opt/mosaic-stack
+cd "$(mktemp -d)"
+curl -fsSLO https://nodejs.org/dist/<v>/node-<v>-linux-x64.tar.xz
+curl -fsSLO https://nodejs.org/dist/<v>/SHASUMS256.txt
+curl -fsSLO https://nodejs.org/dist/<v>/SHASUMS256.txt.asc
+gpg --no-default-keyring --keyring /etc/mosaic-stack/node-keys/pubring.kbx --verify SHASUMS256.txt.asc SHASUMS256.txt
+grep " node-<v>-linux-x64.tar.xz\$" SHASUMS256.txt | sha256sum -c -
+echo "<pinned sha256>  node-<v>-linux-x64.tar.xz" | sha256sum -c -
+tar -xJf node-<v>-linux-x64.tar.xz --no-same-owner
+mv node-<v>-linux-x64 /opt/mosaic-stack/node-<v>
+chown -R root:root /opt/mosaic-stack/node-<v>
+chmod -R go-w /opt/mosaic-stack/node-<v>
+```
+
+The keyring holds the Node release keys from the nodejs/release-keys repository, nothing else. Stop on any
+failed check; don't unpack. Rollback: `rm -r /opt/mosaic-stack/node-<v>`.
+
+Precheck lines:
+- `ok      node <v>` (version 24 or later only).
+- The `--node` path in the args file must be a root-owned regular file outside the home. `case2-unit.sh`
+  refuses otherwise at render, which is not a precheck line.
+- The installed version equals the pin: precheck line missing.
+
+## 3. claude, factory only (.53)
+
+Root installs it under `/opt`, never under the stack's home (this replaces r6's `/srv/mosaic/.local/bin`).
+The pin is 2.1.304 unless the window names a newer one.
+
+```sh
+install -d -o root -g root -m 0755 /opt/mosaic-stack/claude-<pin> /etc/claude-code
+PATH=/opt/mosaic-stack/node-<v>/bin:/usr/sbin:/usr/bin:/sbin:/bin \
+  npm install --prefix /opt/mosaic-stack/claude-<pin> @anthropic-ai/claude-code@<pin>
+chown -R root:root /opt/mosaic-stack/claude-<pin>
+/opt/mosaic-stack/claude-<pin>/node_modules/@anthropic-ai/claude-code/bin/claude.exe --version
+printf '%s\n' '{"env":{"DISABLE_AUTOUPDATER":"1"}}' > /etc/claude-code/managed-settings.json
+chown root:root /etc/claude-code/managed-settings.json
+chmod 0644 /etc/claude-code/managed-settings.json
+```
+
+Rollback: `rm -r /opt/mosaic-stack/claude-<pin> /etc/claude-code/managed-settings.json`.
+
+Root's PATH has no npm, so the install line puts section 2's pinned node first; the package's postinstall
+also runs `node`. The `--version` line must print `<pin> (Claude Code)`. Anything else means the postinstall
+left its 500-byte stub in `bin/claude.exe` (no native package for the platform, or scripts were off): stop and
+roll back.
+
+The args file's `--claude` is
+`/opt/mosaic-stack/claude-<pin>/node_modules/@anthropic-ai/claude-code/bin/claude.exe`, the regular file the
+postinstall hardlinks or copies the native binary to. Not `node_modules/.bin/claude`: that is npm's symlink
+to it, and `case2-unit.sh` refuses a symlink, as it does anything that isn't a root-owned regular file outside
+the home. Checked against the 2.1.304 package's `install.cjs`; a newer pin needs the same check.
+
+Precheck lines:
+- `ok      claude replaces its prompt with --system-prompt-file (<n> input tokens)`. It runs the claude the bus
+  unit's `MOSAIC_CLAUDE_BIN` names, so it needs the model credential from section 9.
+- Managed settings present with the autoupdater off: precheck line missing.
+
+## 4. bubblewrap, AppArmor and the drift stop
+
+Both hosts. These are r6's items, unchanged.
+
+```sh
+apt-get install bubblewrap=0.9.0-1ubuntu0.3
+stat -c '%U:%G %a' /usr/bin/bwrap > /etc/mosaic-stack/bwrap.orig    # expect root:root 755
+
+cd "$(mktemp -d)"
+apt-get download apparmor-profiles=4.0.1really4.0.1-0ubuntu0.24.04.9
+dpkg-deb --fsys-tarfile apparmor-profiles_*.deb | tar -x ./usr/share/apparmor/extra-profiles/bwrap-userns-restrict
+echo "11d39094f044f0cda0febb3ad517b830301da6b2ce929664af09ee9e4dd264f9  usr/share/apparmor/extra-profiles/bwrap-userns-restrict" | sha256sum -c -
+install -o root -g root -m 0644 usr/share/apparmor/extra-profiles/bwrap-userns-restrict /etc/apparmor.d/bwrap-userns-restrict
+apparmor_parser -r /etc/apparmor.d/bwrap-userns-restrict
+
+dpkg-statoverride --update --add root mosaic 0750 /usr/bin/bwrap
+```
+
+`aa-status` then lists `bwrap` and `unpriv_bwrap` in enforce mode. Install the one profile file, never the
+whole `apparmor-profiles` package, whose 20 other profiles would load at the next boot. Rollback, in
+reverse order: `dpkg-statoverride --remove /usr/bin/bwrap`, then `chown` and `chmod` to the values in
+`bwrap.orig`; `apparmor_parser -R /etc/apparmor.d/bwrap-userns-restrict`, then `rm` it;
+`apt-get remove bubblewrap`.
+
+The no-new-privs test must print `bwrap//&unpriv_bwrap (enforce)`:
+
+```sh
+systemd-run --wait --pipe --uid=mosaic --gid=mosaic -p NoNewPrivileges=yes -p ProtectSystem=strict \
+  -p ProtectHome=yes -p PrivateTmp=yes \
+  /usr/bin/bwrap --unshare-user --unshare-pid --ro-bind / / cat /proc/self/attr/current
+```
+
+The P9 checks: another user's `/usr/bin/bwrap --version` fails with Permission denied, `getent group mosaic`
+lists no member, and `sysctl fs.protected_hardlinks` prints 1. `sysctl
+kernel.apparmor_restrict_unprivileged_userns` prints 1 too (Ubuntu 24.04's default); leave it, so nothing
+else on the host gains user namespaces.
+
+The drift stop (row 240, I4, #1746) goes in last, after the profile and the statoverride. As root, from
+the root-owned checkout of the reviewed commit:
+
+```sh
+install -d -o root -g root -m 0755 /usr/local/lib/mosaic-stack
+install -o root -g root -m 0755 scripts/case1-hostcheck.sh /usr/local/lib/mosaic-stack/hostcheck.sh
+install -o root -g root -m 0644 scripts/case1-pins.sh /usr/local/lib/mosaic-stack/case1-pins.sh
+printf '%s\n' 'DPkg::Post-Invoke { "/usr/local/lib/mosaic-stack/hostcheck.sh --enforce || true"; };' \
+  > /etc/apt/apt.conf.d/80mosaic-hostcheck
+install -o root -g root -m 0644 packages/cli/systemd/mosaic-hostcheck.service /etc/systemd/system/
+systemctl daemon-reload && systemctl enable mosaic-hostcheck.service
+/usr/local/lib/mosaic-stack/hostcheck.sh --check
+```
+
+`--check` prints one `ok` line for each of its seven items and exits 0. Item 7 reads 1023 as the port
+until I2 installs the Console unit (section 10), then the unit's `--port`. `stack-upgrade.sh` runs `--check`
+before its plan and refuses `profile-drift` on any exit but 0, a missing file included. Rollback:
+`systemctl disable mosaic-hostcheck.service`, then `rm` the unit, the hook file and
+`/usr/local/lib/mosaic-stack`.
+
+On drift, `--enforce` (the apt hook after every package run, and the unit at boot) unloads the profile,
+closes `/usr/bin/bwrap` to `root:root` 0700, appends the failed items to `/etc/mosaic-stack/DRIFT` and logs
+a line in `/var/log/mosaic-stack/hostcheck.log`. Every role session then refuses to start. ops-01 reads the
+log in each STATE report and sends any `DRIFT` to Mos. Only root removes `DRIFT`, in a reviewed step with
+a new pin or a Mos go. After that, `chown root:mosaic /usr/bin/bwrap`, `chmod 0750 /usr/bin/bwrap` and
+`apparmor_parser -r /etc/apparmor.d/bwrap-userns-restrict` put bwrap back, and `--check` must exit 0.
+
+Before each re-pin window, ops-01 runs `/usr/local/lib/mosaic-stack/hostcheck.sh --upstream`. It
+downloads the `apparmor-profiles` candidate and compares its `bwrap-userns-restrict` to the pin. A
+`DIFFERS` line goes to Mos as a new-pin request; it refuses nothing.
+
+Precheck lines:
+- `ok      bwrap --unshare-all runs`
+- The AppArmor profile, the statoverride, the no-new-privs result and the P9 checks: precheck line missing.
+  `/usr/local/lib/mosaic-stack/hostcheck.sh --check` covers them (row 240).
+
+## 5. The port floor
+
+Leave `net.ipv4.ip_unprivileged_port_start` at its default (1024) or higher. The Console's port is below
+it and the unit gets `CAP_NET_BIND_SERVICE`, so no other `mosaic` process can bind that port.
+
+Precheck line: `ok      net.ipv4.ip_unprivileged_port_start <n> is above the Console's port <port>`.
+
+## 6. The release transport
+
+A release is a git bundle of `refs/heads/refactor` plus the 40-character commit id (I1, mos-1118 choice 2).
+Mos's go names both, with the bundle's sha256. `<sha>` below is that id.
+
+First install:
+
+```sh
+# Copy the bundle in, then check it before anything reads it.
+echo "<bundle sha256>  /root/<sha>.bundle" | sha256sum -c -
+git bundle verify /root/<sha>.bundle
+
+# Root's checkout. stack-upgrade.sh and case2-unit.sh run from here, never from a copy.
+git clone -q -b refactor /root/<sha>.bundle /root/mosaic-stack
+git -C /root/mosaic-stack checkout -q --detach <sha>
+git -C /root/mosaic-stack rev-parse HEAD        # must print <sha>
+
+# The stack's user's copy of the bundle, and its own clone.
+install -d -o mosaic -g mosaic -m 0700 /srv/mosaic/incoming /srv/mosaic/src
+install -o mosaic -g mosaic -m 0600 /root/<sha>.bundle /srv/mosaic/incoming/<sha>.bundle
+sudo -u mosaic -H git clone -q -b refactor /srv/mosaic/incoming/<sha>.bundle /srv/mosaic/src/mosaic-stack
+```
+
+Each upgrade, before `stack-upgrade.sh upgrade`:
+
+```sh
+echo "<bundle sha256>  /root/<sha>.bundle" | sha256sum -c -
+git bundle verify /root/<sha>.bundle
+git -C /root/mosaic-stack fetch -q /root/<sha>.bundle refs/heads/refactor:refs/remotes/origin/refactor
+git -C /root/mosaic-stack checkout -q --detach <sha>
+install -o mosaic -g mosaic -m 0600 /root/<sha>.bundle /srv/mosaic/incoming/<sha>.bundle
+/root/mosaic-stack/scripts/stack-upgrade.sh upgrade --instance dev --bundle /srv/mosaic/incoming/<sha>.bundle --sha <sha>
+```
+
+The driver fetches the bundle into the stack's user's clone and makes the copy itself. It refuses
+`head-mismatch` when root's checkout isn't at `<sha>`. Usage, exits and the step log are in
+`docs/TOOLS.md`, under "Root's upgrade driver". Each run needs Mos's go, and `--migrate` needs Jason present
+(decision 96).
+
+When a run doesn't exit 0, send Mos the exit and the last lines of `/var/log/mosaic-stack/upgrade-dev.log`:
+- Exit 3: refused before anything stopped. The last line names the code. The stack's user's clone and the
+  new copy may already hold the new commit; the units still run the old one.
+- Exit 1: the old copy runs and passed its gate. Either the driver restarted it after A2 or a refused A3
+  (A2f), or it rolled back after A3, A4 or A5.
+- Exit 2: both units are stopped and the activation stays open, so the next run refuses at its plan until
+  it is finished with `confirm` or `revert`. One way here: a unit that doesn't stop within `--timeout`
+  keeps its old start time, A2f's gate fails it `stale-start`, and the driver stops both (duckworth-0055
+  N1). That is on purpose; a unit that won't stop is a reason to stop.
+- Exit 5: `args-failed`. The new copy is live and passed confirm, but `/etc/mosaic-stack/dev.args` still names
+  the old copy. The next run refuses `args-differ`, and a render from that file would put the old copy back.
+  Move the file the result line names into place with `mv -f`. The two differ only in the `--copy` value.
+
+Precheck lines: none. Root's checkout at `<sha>` and the stack's user's clone: precheck line missing.
+After install, `stack-copy.sh check --units external` reads the copy the units run.
+
+## 7. The args file
+
+`/etc/mosaic-stack/dev.args` holds the `case2-unit.sh` arguments, one per line, with the serve flags after a
+line holding `--`. I2's install writes it; ops-01 doesn't write it by hand. It must be root's, with no group
+or other write (`chmod 0644` or tighter). Before `--` it takes only `--user`, `--home`, `--business`,
+`--copy` (exactly once), `--node`, `--profile`, `--claude` and `--pm`. `stack-upgrade.sh` changes only the
+`--copy` line, and only after confirm passes.
+
+Precheck line: none. `stack-upgrade.sh` refuses `args-unreadable` on any of these rules.
+
+## 8. Enrollment, once per host
+
+The machine-grant enrollment is Gizmoduck's design r6, commit f9039682e, section 3, steps E1-E4. ops-01's
+Q-O1 is answered (mos-1125). The host side is the `tools/host/` files: `mosaic-keys`, `mosaic-keys-write`,
+their sudoers line and the sshd drop-in `/etc/ssh/sshd_config.d/<nn>-mosaic-keys.conf`. The verbs that run
+it (`hosts.enroll`, the `host-enroll` decision) are rows 234 and 235, not yet on refactor. This item has no
+commands until they land.
+
+Precheck line: none. The enrolled host's key and its `mosaic-keys` sudoers line: precheck line missing.
+
+## 9. Credential slots
+
+Jason places these, all in one sitting per host. No value appears here or in any message. Check a placed
+file with `stat -c '%U %a %n' PATH`, never `cat`. `<business>` is the host's business id.
+
+### .53, factory
+
+| Path | File | Mode | Owner | Profile | Precheck line |
+|---|---|---|---|---|---|
+| `/srv/mosaic/.config/mosaic-dev/secrets/` | `claude-session.env`, one line `CLAUDE_CODE_OAUTH_TOKEN=...` (Q185) | 0600 | mosaic | factory | `claude replaces its prompt with --system-prompt-file` runs claude with it. The file's mode and owner: precheck line missing. |
+| `/srv/mosaic/.config/mosaic-dev/secrets/agents/<business>/<agent>/` | one file per service | 0600, dirs 0700 | mosaic | both | none. Filled only by `mosaic credentials issue`, or Approve after #436. Never by hand. |
+
+### .54, library
+
+| Path | File | Mode | Owner | Profile | Precheck line |
+|---|---|---|---|---|---|
+| `/srv/mosaic/.config/mosaic-dev/secrets/` | `claude-session.env`, one line `ZAI_API_KEY=...` | 0600 | mosaic | library | `<path> sets ZAI_API_KEY` |
+| `/srv/mosaic/.config/mosaic-dev/secrets/` | the Console's proof file, the path the args file's `--proof-file` names | 0600 or 0400 | mosaic | library | none. `case2-unit.sh` refuses at render. Precheck line missing. |
+| `/srv/mosaic/.config/mosaic-dev/secrets/<business>/` | `library-gitea` | 0600 | mosaic | library | C2-13b's `library.sync` (not landed) |
+| `/srv/mosaic/.config/mosaic-dev/secrets/agents/<business>/<agent>/` | one file per service | 0600, dirs 0700 | mosaic | both | none. Filled only by `mosaic credentials issue`, or Approve after #436. Never by hand. |
+
+The installer key, `<configDir>/secrets/hosts/<business>/<hostId>/installer`, is not a slot anyone places.
+Enrollment (section 8) writes it under the enrolling stack's config directory and deletes it when the host
+leaves.
+
+## 10. Console start
+
+None by hand. I2's `case2-unit.sh` enables both units, starts the bus, then the Console (Q189, mos-1122).
+`stack-upgrade.sh` stops and starts both units itself.
+
+Precheck line: none. Both units active after the render: precheck line missing.
@@ -102,3 +102,45 @@ plus a mutant that removes the check.

 Gate: Duckworth approves the manifest. The bus suite and every `scripts/test-*.sh` are green on Sage's gate,
 and the mutant is killed.
+
+## Brief: row 237 follow-up, one decision lands once, with tests at the broker
+
+Sage, 2026-10-21, from Megavolt's checkLand analysis (megavolt-0068, megavolt-0069) and sage-1651. Owner
+Megavolt, reviewer Duckworth, gate owner Sage. Builds on row 237's landing d7d943199. Vikunja P19 441.
+
+Landing already has three guards against one decision landing twice. `land-busy` at
+`packages/cli/src/git-socket.mjs:351` allows one landing per socket at a time. `finishLand` moves main by
+compare-and-swap (`packages/seat/src/working.mjs:391`, refusing `base-moved`). `recordLand` reruns
+`#landFacts`, which refuses `decision-consumed` (`packages/bus/src/broker.mjs:945`). So no end-to-end race
+exists, and no code change is planned. What's missing is a test that pins each guard.
+
+- In `packages/bus/tests/land.test.mjs`, add a test where two tickets pass `checkLand` on one decision. The
+  first `recordLand` succeeds and the second refuses `decision-consumed`, with nothing recorded for it.
+- Run three mutants and list them in BUILD.md: drop the `#spent` line in `#landFacts`, drop the old value
+  from the CAS `update-ref` in `finishLand`, and drop the `land-busy` throw at git-socket.mjs:351. Each must
+  be killed by a named test. If the CAS mutant survives `packages/seat/tests/working.test.mjs:555`, add a
+  test to working.test.mjs that kills it. Otherwise leave that file alone.
+- If a mutant survives with no test that can reach it, stop and send me the analysis. Don't change source
+  to make a test reach it.
+
+Gate: Duckworth approves the manifest. The bus, seat and cli suites and every `scripts/test-*.sh` are green
+on Sage's gate, and the three mutants are killed.
+
+## Brief: row 237 follow-up N1, a retry after publish-timeout pushes once
+
+Sage, 2026-10-21, from Duckworth's row 237 note N1 (#1743 comment 29810, duckworth-0069) and Megavolt's
+row 237 BUILD.md residual 2. Owner Megavolt, reviewer Duckworth, gate owner Sage. Builds on row 237's landing
+d7d943199. Vikunja P19 440.
+
+The git socket gives up with `publish-timeout` (`packages/cli/src/git-socket.mjs:433`) while the bus
+process's push may still be running (`publishPush` in `packages/bus/src/runtime.mjs`, entry `running`).
+`publishRefused` then drops the ticket, so row 237's `publish-busy` check no longer holds the decision. A
+retry to another branch can then push a second ref to the fork.
+
+Pick one fix and say why in BUILD.md. Either keep the decision held until the bus's push ends, or kill the
+push on timeout and wait for it to exit before the ticket goes. Add a test that starts a slow push, times
+it out, retries to another branch, and finds exactly one ref on the fork. Add a mutant that removes the
+fix. Don't change the `publish-timeout` refusal text.
+
+Gate: Duckworth approves the manifest. The bus and cli suites and every `scripts/test-*.sh` are green on
+Sage's gate, and the mutant is killed.
@@ -55,3 +55,24 @@ code.

 Webby approves DESIGN.md, then the manifest. The bus, cli, business and webui suites and every
 `scripts/test-*.sh` are green on Sage's gate, and the design's mutants are killed.
+
+## Brief: row 194 follow-up, the revoke under the writer's lock and a fire test
+
+Sage, 2026-10-21, from Duckworth's row 194 b3 N1 (duckworth-0070, duckworth-0074) and Mos's ruling mos-1158.
+Owner Honker, reviewer Duckworth, gate owner Sage. Builds on row 194's landing.
+
+Row 194 b3 checks the revision in `instance-settings.mjs` `commit()` before `beforeWrite`, which is the revoke on
+fire and delete. A window is still open. If a write lands between that read and the writer's lock, a fire or
+delete revokes and then refuses `revision-conflict`. An `outcome-unknown` after a revoke also doesn't say the
+tokens are gone. Two changes:
+
+1. Run `beforeWrite` inside `writer.write`, under its lock, after the `organization.mjs:188` revision check. A
+   refusal after a revoke that ran says the tokens may already be revoked. That covers `revision-conflict` and
+   `outcome-unknown`, in the CLI and the Console texts. A refusal before any revoke keeps today's text.
+2. Add a fire test for a stale revision, using an injected writer or whatever the design picks. The test checks
+   that nothing is revoked and the business file is unchanged. Keep T21 for delete.
+
+Mutants: run `beforeWrite` before the lock. Drop the fire refusal. Drop the "may already be revoked" text.
+
+Gate: Duckworth approves the manifest. The bus, business, cli and webui suites and every `scripts/test-*.sh`
+are green on Sage's gate, and the mutants are killed.
@@ -106,4 +106,18 @@ X5). At start, after the grant reconcile, the bus unlinks every `host.<id>` key
 `host_grants` record (r6 N1, G27). It adds no schema step. If it needs one, Sage re-briefs it first and
 assigns the next free step (#436b holds 3j to 3k, row 206 3k to 3l).

-Gate: as row a, with section 10's row b tests and mutants, G27, G28 and the upsert mutant included.
+Creative roles get no host grant (mos-1163, from Webby's N2 on row 213 r4). Since row 234, a role
+definition's credentials no longer gate host access, so the host grant writer itself refuses a grant whose
+agent is a `CREATIVE_DEFINITIONS` role (row 213), with a named reason and a test. The Case 2 hub runs
+creative agents on .54, and without this a creative role has a path to `host.run`. Duckworth's review checks
+it, and answers from the code whether a decision raised by another role can be spent by a creative one.
+
+`host.run` refuses too, at spend time, when the agent's current definition is a `CREATIVE_DEFINITIONS` role
+(sage-1908, accepted in mos-1164). That covers a grant written before the role became creative. The refusal
+leaves the grant record in place, so `hosts.revoke` still finds it. Each path, the writer refusal at raise
+and at the step 1 recheck and the spend refusal, gets its own test and its own mutant.
+`CREATIVE_DEFINITIONS` comes from row 213, so row 213 lands before row b. If that order can't hold, Sage
+tells Mos before row b lands.
+
+Gate: as row a, with section 10's row b tests and mutants, G27, G28 and the upsert mutant included, and
+the creative refusal tests and mutants (writer and spend).
@@ -64,3 +64,31 @@ mos-1081 item 1). No new provider account.
 Duckworth approves DESIGN.md, then the manifest. Any repository change is green on Sage's gate (cli suite and
 every `scripts/test-*.sh`), with the design's mutants killed. The row is done when the window's acceptance
 run passes on .53, Duckworth reads its output, and Mos confirms.
+
+## Row 195 follow-up: Duckworth's N1-N3 on the Case 1 acceptance script
+
+Sage, 2026-10-21. Row 195's code landed as b65014647. Duckworth's manifest notes N1-N3 (REVIEW-m1 6afcee2a5)
+are recorded in docs/plans/DEFERRED.md (d6cff0cdd). Owner Darkwing, reviewer Duckworth, gate owner Sage.
+
+- N1: F9 runs the `--node` binary as root (`scripts/case1-accept.sh:298`) before F10 checks its path
+  (:303-304). Root must never run a binary the script hasn't checked yet: run F9's parse as `AS_USER`, or move
+  F10's path check ahead of it.
+- N2: the header (:10) and the TOOLS.md entry must list everything root runs, not just "reads".
+- N3: F6's prefix match (:261) must refuse a `--claude` path with `..` after `claude-<pin>/`.
+- Build on a new branch from the refactor tip, starting from Darkwing's `darkwing/row195-n1` 1e3c4767c. That
+  commit hasn't been run.
+
+Gate: Duckworth approves the manifest. The cli suite and every `scripts/test-*.sh` are green on Sage's gate,
+and a mutant for each of N1 and N3 is killed. This row lands before the .53 window row below.
+
+## Row 195 window: the Case 1 acceptance run on 10.1.1.53
+
+Sage, 2026-10-21. This row carries row 195's done condition from the Gate section above. Sage moved row 195
+to done at its code landing (rev 2790), which was early, and done rows can't change, so the condition
+continues here. Owner Darkwing, reviewer Duckworth, gate owner Sage. It waits on row 226 and on the N1-N3
+follow-up landing.
+
+The window needs a Jason or Mos go. It takes a backup first where state exists and gives a STATE report
+after. The Boundaries above apply unchanged.
+
+Gate: the window's acceptance run passes on .53, Duckworth reads its output, and Mos confirms.
@@ -227,3 +227,51 @@ host prep into the command is #437.

 Filbert approves the manifest. The test file, the cli suite and every `scripts/test-*.sh` are green on
 Sage's gate, with the mutants killed. Target: in review 10-24, landed 10-25 (sage-1528 line 12).
+
+## I4 hostcheck: the bwrap profile check, pins and boot unit
+
+Sage, 2026-10-21, split out of I3 (darkwing row 233 G2, sage-1650). Owner Darkwing, reviewer Filbert, gate
+owner Sage. Darkwing builds it right after I3, and it must land before the ops-01 proof.
+
+### Problem
+
+The host run sheet (I3, line 182 above) lists r6's `hostcheck` among the host items for any host that runs
+bwrap, and I3's A1 refuses `profile-drift` unless `/usr/local/lib/mosaic-stack/hostcheck.sh --check` exits 0.
+No hostcheck exists on refactor. It's r6 B2 (row 195 DESIGN.md at b7239bb66, :262-303 and :839-860), sized at
+150-200 lines of bash and 350-450 of test. That's work separate from the upgrade sequence: the root-side bwrap
+stop and a network fetch.
+
+### What ships
+
+r6 B2 as designed:
+- `case1-pins.sh` holds the pins: the profile sha256, the apparmor-profiles version and the bubblewrap pin.
+- `hostcheck.sh` covers the seven items in three modes:
+  - `--check` exits 0 or 1.
+  - `--enforce` stops bwrap: `apparmor_parser -R`, then `root:root 0700` on `/usr/bin/bwrap`. It writes
+    `/etc/mosaic-stack/DRIFT` and a `hostcheck.log` line, and exits 0.
+  - `--upstream` compares the current apparmor-profiles deb to the pin.
+- `mosaic-hostcheck.service`, a boot oneshot.
+- `case1-hostcheck.test.mjs` uses fakes for every host tool and covers r6's seven case groups and seven
+  mutants.
+
+The I3 run sheet's hostcheck item points at this row. I3's A1 and its fake don't change.
+
+### Carried from the I3 review (Filbert 29922 on #1735, sage-1727)
+
+Row 233 lands with three non-blocking notes that must be fixed before ops-01. This row takes them, and that
+widens its paths to `scripts/stack-upgrade.sh` and `packages/cli/tests/stack-upgrade.test.mjs`:
+- N1: after A5 confirms, a failed rename of the new args file calls `finish 1 args-failed` while the new copy
+  is live (`stack-upgrade.sh:280-282` at 1a1dc80ca). TOOLS.md and the run sheet define exit 1 as "the old copy
+  runs". Give this case its own exit code, add it to the exit table in TOOLS.md and the run sheet, and add a
+  test that makes the rename fail after A5 and expects the new code.
+- N4: run sheet section 3 doesn't put the pinned node's npm on root's PATH and doesn't name the `--claude`
+  path. The npm symlink `node_modules/.bin/claude` is what `case2-unit.sh:140` refuses. The sheet must name
+  the path the check accepts.
+- N5: run sheet sections 8 and 10 get their precheck lines.
+
+Filbert's N2 and N3 (no `$REPO` check, no signal handling between A2 and A5) are in DEFERRED.md, not here.
+
+### Gate
+
+Filbert approves the manifest. The test file, the cli suite and every `scripts/test-*.sh` are green on
+Sage's gate, with the mutants killed. Target: in review 10-25, landed 10-26, before the ops-01 proof.
@@ -0,0 +1,35 @@
+# Gate environment rows (2026-10-21)
+
+Sage, from the row 197 lane proof that stopped on 2026-10-21 (sage-1881, mos-1162). Two small rows.
+Each lands after row 197.
+
+## The startup token refusal test sets its file mode
+
+`packages/bus/tests/process.test.mjs:76` writes the "too open" token file with
+`writeFileSync(file, secret, { mode: 0o644 })`, and `:82` expects the broker to refuse it.
+`writeFileSync` applies the process umask to that mode. Under `umask 077` the file is 0600,
+`packages/bus/src/credentials.mjs:205` accepts it, and the test fails. That happened in the row 197 lane
+proof, where `scripts/testing/gate-lane.sh:3` set 077 for the test steps.
+
+- Change: the test calls `chmodSync(file, 0o644)` after the write, so its result no longer depends on the
+  umask.
+- Sweep: look in `packages/*/tests` for other tests that expect a refusal of a too-open mode set
+  through `writeFileSync` or `mkdirSync`, and fix those the same way. List what the sweep found in
+  BUILD.md, including when it found none.
+- Test: run the file whole twice, once under `umask 022` and once under `umask 077`. Both runs pass.
+- Order: Mos ruled (mos-1162) that this lands after row 197 r6. Then r6's proof runs on the unchanged
+  test, so it shows the umask fix itself works.
+
+## Gate runs use a fixture pi auth file
+
+The `docs/plans/DEFERRED.md` entry "Gate runs mount the host's pi auth file" (059577886, Webby N4 on the
+row 197 proof driver, traced by Herb in herb-0051) gets its own row here.
+
+- Change: every gate step that reaches Compose gets a fixture `PI_AUTH_FILE`. That covers the
+  `test-task.sh` cases that call `scripts/run-task.sh`, `test-release.sh` through `release.sh`
+  `health_check`, and row 197's lane `cleanEnv` in `scripts/testing/gate-lane.mjs`. Either the suites
+  or the lane's `cleanEnv` can set it.
+- Test: no gate step mounts the host default `/home/jwoltje/.pi/agent/auth.json`. The test reads
+  the Compose arguments or the environment that each step passes. It does not read the host file.
+- Not in scope: `compose.yaml`'s default for real runs stays as it is.
+- At landing, the DEFERRED entry moves to Done with the landing commit.
@@ -216,6 +216,105 @@ at every gate. Started 2026-09-12 during the control board MVP.
  READMEs, `docs/TOOLS.md` and Sage's suite recipe should use the glob
  form wherever Node 24 is a target. Darkwing, S1 packet. (2026-10-04,
  #1518)
+- **`stack-upgrade.sh` doesn't check `$REPO`.** Nothing confirms the
+  source checkout is root-owned or that its tree is clean before the
+  upgrade builds from it. Filbert N2 on row 233 (29922, #1735).
+  (2026-10-21)
+- **`stack-upgrade.sh` has no signal handling between A2 and A5.** A HUP,
+  INT or TERM in that stretch leaves the run failed closed, but recovery
+  is by hand. A trap that writes the stop point and the recovery step to
+  the log would make it a sheet step. Filbert N3 on row 233 (29922,
+  #1735). (2026-10-21)
+- **`checkCreative` doesn't refuse `credentials`.** Row 213's
+  `checkCreative` (packages/business/src/role.mjs:143 at 2d2ad2760)
+  limits a creative role's tools, authority and messaging, but a role
+  file that gave companion or research a credential would still load.
+  The business file could then map a credential to that instance
+  (business.mjs:157). Nobody has traced whether a mapped credential
+  reaches the run's environment. The decision paths stay closed (M6),
+  but a creative role with `web` holding a live token is a wider channel
+  than design 4 means. The fix: refuse any `credentials` in
+  `checkCreative`, with a role.test.mjs case. It goes after row 213
+  lands, as a follow-up row or in the next row that edits role.mjs.
+  Webby N1 on row 213 r3 (REVIEW-r3.md, 3ab3c010b), mos-1160.
+  (2026-10-21)
+- **The boot host check orders only one business's bus.**
+  `mosaic-hostcheck.service` (row 240) has
+  `[email protected]`. `case2-unit.sh` enables the
+  bus as `mosaic-bus@<business>.service`, so on a host whose business id
+  isn't `mosaic-stack` nothing orders the two. The bus can start before
+  the boot stop runs, and after a boot-time drift role sessions can use
+  bwrap until it does. The fix: `After=mosaic-hostcheck.service` in
+  `packages/cli/systemd/mosaic-bus.service.in`, which orders every
+  instance and does nothing where the unit isn't installed. It goes in
+  before the first install whose business id isn't `mosaic-stack`.
+  Filbert N1 on row 240 (29945, #1746). (2026-10-21)
+- **The run sheet writes the apt hook before the first `--check`.**
+  Section 4 installs `80mosaic-hostcheck`, then runs
+  `hostcheck.sh --check`. If that check fails, the next package run
+  closes bwrap before anyone has read the failure. It fails closed, but
+  it surprises an installer. The fix: run `--check` first, or say what a
+  failure at that step means. Doc-only, for the next row that edits
+  `docs/guides/host-run-sheet.md`. Filbert N2 on row 240 (29945, #1746).
+  Filbert's N3, that a closed bwrap appends to `DRIFT` on every later
+  apt run and boot, is by design; ops-01's STATE read should expect the
+  repeats. (2026-10-21)
+- **The sso-config first-step hint has no business.** When the target
+  copy has no `console.sso`, `stack-release.sh` (`:938`) refuses with
+  "activate $TO without --sso first, then ... activate $TO --sso". The
+  usage line is `activate ID BUSINESS` (`:47`), so pasting either command
+  as printed gives a usage error, not the first step. It fails safe,
+  since the usage error changes nothing. The fix: add `$BUSINESS`
+  (set at `:2138`) to both commands, and the business (`acme`)
+  to the three expected strings in `stack-release.test.mjs`
+  (`:1538`, `:1689`, `:1691`). For a later row that edits
+  `stack-release.sh`. Webby N1 on row 238 r1 (REVIEW-r1.md, 433a95292,
+  #1744). (2026-10-21)
+- **Gate runs mount the host's pi auth file.** `compose.yaml:43` mounts
+  `${PI_AUTH_FILE:-/home/jwoltje/.pi/agent/auth.json}` read-only into
+  the agent container. No suite sets `PI_AUTH_FILE`, so the
+  `test-task.sh` cases that call `scripts/run-task.sh`, and
+  `test-release.sh` through `release.sh` `health_check` (`:41-54`), run
+  Compose with the host file. Row 197's lane `cleanEnv`
+  (`scripts/testing/gate-lane.mjs:109`) keeps the default too: it neither
+  sets nor passes `PI_AUTH_FILE`. The mount is read-only, and the legacy
+  gate already worked this way before row 197. `test-auth.sh` uses its
+  own fixtures but calls `auth.sh`, not Compose. The fix: a fixture
+  `PI_AUTH_FILE` for the Compose-reaching cases, set by the suites or by
+  the lane's `cleanEnv`, and a test that no gate step mounts the host
+  default. It needs its own row. Webby N4 on the row 197 proof driver
+  (bba870ee9), traced by Herb (herb-0051). (2026-10-21)
+- **Lane image prep inspects a base that BuildKit never tagged.**
+  (N7 of the row 197 proof.) After the Compose build,
+  `scripts/testing/lane-image.mjs:41` (`prepareImage`) runs
+  `docker image inspect node:24-bookworm-slim` to put the base digest
+  in the receipt. BuildKit resolves the base from the registry
+  without tagging it in the local store, so on a host without the tag
+  the inspect throws "No such image" after a good build. That
+  happened in Sage's proof try 1 (2026-10-21 09:03Z, run cf48efccf083).
+  The throw fails closed: the run's terminal record is unclean, both
+  lanes quarantine, and `gate-lane.sh recover` clears them. Pulling the
+  base first fixes it, and the receipt digest then matches what the
+  build used (91acba91 both ways). The fix: before the build, inspect
+  the base and refuse with a named reason if it's missing, or pull it.
+  After the build, refuse if the base digest changed. Add a test with a
+  fake Docker that has no base tag. Kept out of row 197 r6 by Sage
+  (sage-1883). Mos asked for this record in mos-1162. (2026-10-21)
+- **Case 1 acceptance script: root parses with the node it's checking, and the header says less than root does.**
+  (Duckworth N1-N3 on the row 195 manifest, REVIEW-m1 6afcee2a5.)
+  N1: F9 runs `$ROOT$NODE` as root (`scripts/case1-accept.sh:298`)
+  before F10 checks that `--node` is the `/opt/mosaic-stack/node-<pin>`
+  path (:303-304). On a host installed as designed, `case2-unit.sh:128-133`
+  refused a non-root-owned `--node` and the args file is root's, so no
+  escalation path exists today. Run F9's parse through `AS_USER`, or
+  apply F10's path check first. N2: the header (:10) and the TOOLS.md
+  entry say root only reads, but root also runs `curl` (F2), `sudo -l`
+  (P1, P3), the jarvis probe (P9), `hostcheck.sh --check` and
+  `systemctl`. Doc-only. N3: F6's prefix match (:261) accepts a
+  `--claude` with `..` after `claude-<pin>/`. That claude runs only as
+  `mosaic`, and F10 uses equality. Darkwing has a follow-up on
+  `darkwing/row195-n1` 1e3c4767c, not yet run; it gets its own row now
+  that 195 has landed (b65014647), Duckworth reviews. (2026-10-21)

 ## Queue

@@ -33,7 +33,7 @@ Gaps found while working go to `docs/plans/DEFERRED.md`, not here.

 <!-- mosaic-queue:begin -->

-Generated from `docs/plans/queue.json` revision 2539 by `queue render`. Do not edit between the markers; change the queue with `scripts/mosaic queue`.
+Generated from `docs/plans/queue.json` revision 2641 by `queue render`. Do not edit between the markers; change the queue with `scripts/mosaic queue`.

 | # | Piece | Owner | Issues | State | After | Gate | Brief | Note |
 |---|---|---|---|---|---|---|---|---|
@@ -230,23 +230,23 @@ Generated from `docs/plans/queue.json` revision 2539 by `queue render`. Do not e
 | 191 | one kill switch for the bus, every run, Discord and new launches, from the CLI and the Console (MVP T1.4, mos-0974, Vikunja #414) | rocko; reviewers dewey | #1689 | in-progress | — | Dewey approves DESIGN.md then the manifest; cli, bus, discord and webui suites and every scripts/test-*.sh green on Sage's gate; the mutants killed (sage) | `docs/plans/2026-10-20_kill-switch.md` § Brief: one kill switch for the bus, every run, Discord and new launches | — |
 | 192 | Q175 phase 1: the Console verifies SSO itself (--sso), OIDC RP with oauth4webapi 3.8.8, no live change (MVP T1.2, #412) | launchpad; reviewers webby | #1690 | done | — | Webby approves the manifest; webui and cli suites, scripts/test-config.sh and every scripts/test-*.sh green on Sage's gate; design section 9 mutants killed (sage) | `docs/plans/2026-10-20_sso-phase1.md` § Brief: Q175 phase 1, the Console verifies SSO itself (--sso) | Landed 4429a104f on refactor (squash of launchpad/row192 53bb59462..37582e820, round 2 manifest 6f8cee14...7787). patch-id 4a4869026 matches the reviewed diff on all 18 paths. Gate on 088087ac9: package suites 2758/0, scripts 429/0, mutants 22 of 23 killed (#23 equivalent, sage-1407). npm ci in canonical, oauth4webapi 3.8.8. Live re-pin is a window with Mos (mos-1099 item 3). |
 | 193 | many humans per business, human roles, private and shared threads, one access.json store (MVP T1.3, Vikunja #414/#415) | morgana; reviewers duckworth | #1691 | in-progress | — | Duckworth approves DESIGN.md then the manifest; bus, business, cli and webui suites and every scripts/test-*.sh green on Sage's gate; the mutants killed (sage) | `docs/plans/2026-10-20_human-users.md` § Brief: many humans per business, human roles, private and shared threads | — |
-| 194 | agent lifecycle from the Console and the CLI (create, launch, terminate, regenerate, delete) with a per-agent hire/fire veto (MVP T1.5, Vikunja #414/#415) | honker; reviewers webby | #1692 | in-progress | — | Webby approves DESIGN.md then the manifest; bus, cli, business and webui suites and every scripts/test-*.sh green on Sage's gate; the mutants killed (sage) | `docs/plans/2026-10-20_agent-lifecycle.md` § Brief: agent lifecycle from the Console and the CLI, with a per-agent hire/fire veto | — |
+| 194 | agent lifecycle from the Console and the CLI (create, launch, terminate, regenerate, delete) with a per-agent hire/fire veto (MVP T1.5, Vikunja #414/#415) | honker; reviewers webby | #1692 | in-progress | — | Webby approves DESIGN.md then the manifest; bus, cli, business and webui suites and every scripts/test-*.sh green on Sage's gate; the mutants killed (sage) | `docs/plans/2026-10-20_agent-lifecycle.md` § Brief: agent lifecycle from the Console and the CLI, with a per-agent hire/fire veto | sage-1610 (honker-0049): a human add takes tracker {bot, botId}, required for a vikunja definition, refused otherwise, checked by checkBot and bot uniqueness; CLI and API only. Delete accepts a tracker bot when all credentials are store refs, and its result names the bot for removal by hand in Vikunja. No Vikunja account is created (Q188 untouched). Mutants: drop the requirement, refuse the bot on delete, skip checkBot on add. |
 | 195 | row 195: the Case 1 install on 10.1.1.53 as mosaic under /srv/mosaic, reusing C2-13's scripts by input under row 190's canon (Q181, Q182/Q183, Q185; ops-01 root steps under #423 step 1) | darkwing; reviewers duckworth | #1693 | briefed | 190 done, 233 done | Duckworth approves DESIGN.md then the manifest; cli suite and every scripts/test-*.sh green on Sage's gate; the mutants killed (sage) | `docs/plans/2026-10-20_hub-own-uid.md` § Brief: the Case 1 install on 10.1.1.53 (row 195) | sage-1439: rewritten to Case 1 on .53 (f24f2cd40). Chains on C2-13's candidate too once C2-13 is queued. Darkwing starts DESIGN.md after row 190's mutants. |
 | 196 | the human boundary across uids and humans: Console, tester listener, broker.sock and the path-bound human proof (P19 333, before federation R3, mos-0989) | gander; reviewers duckworth | #1694 | in-progress | — | Duckworth approves DESIGN.md then the manifest; bus, webui and cli suites and every scripts/test-*.sh green on Sage's gate; the mutants killed (sage) | `docs/plans/2026-10-20_human-boundary.md` § Brief: the human boundary across uids and humans (P19 333) | — |
 | 197 | a second gate lane: two full gates at once on dragon-lin, design first (mos-0977 item 6) | herb; reviewers webby | #1695 | in-review, round 1, request posted | — | Webby approves DESIGN.md then the manifest; cli suite and every scripts/test-*.sh green on Sage's gate, singly and in the two-lane proof (sage) | `docs/plans/2026-10-20_second-gate-lane.md` § Brief: a second gate lane, two full gates at once on dragon-lin | Order with row 198 (Sage, mos-1040 N1): 197 lands first. After B1 the shared tests are packages/webui/tests/serve.test.mjs:100 and preview.test.mjs:208. Row 198 rebases onto 197's landing before its manifest review. |
 | 198 | retire the control board writer on 7331 (unauthenticated loopback writer, Q175; mos-1008) | bushroot; reviewers webby | #1696 | in-progress | 192 done, 197 done | Webby approves INVENTORY.md then the manifest; control-board, webui and cli suites and every scripts/test-*.sh green on Sage's gate; the mutants killed (sage) | `docs/plans/2026-10-20_retire-control-board.md` § Brief: retire the control board writer on 7331 | Order with row 197 (Sage, mos-1040 N1): 197 lands first. Row 198 rebases onto 197's landing before its manifest review; shared tests are packages/webui/tests/serve.test.mjs:100 and preview.test.mjs:208. |
-| 199 | MVP T1 item 6: a credential store per agent, own git identity, pushes to a remote (G11, G13; mos-0974) | megavolt; reviewers duckworth | #1697 | in-review, round 1, request posted | — | Duckworth approves DESIGN.md; Mos rules on the authority model; Duckworth approves the manifest; bus, business, cli and tasks suites and every scripts/test-*.sh green on Sage's gate; the mutants killed (sage) | `docs/plans/2026-10-20_agent-credentials.md` § Brief: a credential store per agent, own git identity, pushes to a remote | — |
-| 200 | stack-release.sh activate --sso for the Q175 phase 2 window (row 192 F3; chained on 192) | launchpad; reviewers webby | #1698 | in-review, round 3, request posted | — | Webby approves the manifest; cli suite and every scripts/test-*.sh green on Sage's gate; the mutants killed (sage) | `docs/plans/2026-10-20_stack-release-sso.md` § Brief: stack-release.sh activates a Console with --sso (Q175 phase 2 prerequisite) | — |
+| 199 | MVP T1 item 6: a credential store per agent, own git identity, pushes to a remote (G11, G13; mos-0974) | megavolt; reviewers duckworth | #1697 | done | — | Duckworth approves DESIGN.md; Mos rules on the authority model; Duckworth approves the manifest; bus, business, cli and tasks suites and every scripts/test-*.sh green on Sage's gate; the mutants killed (sage) | `docs/plans/2026-10-20_agent-credentials.md` § Brief: a credential store per agent, own git identity, pushes to a remote | Landed cb5fdb064 on refactor (base 76134dfde), pushed. Patch-id 828fa21a matches git diff 00d4cc1f6..86963d281 on the 37 manifest paths; docs/TOOLS.md 3-way with row 200, hunk unchanged. Manifest 35f900fd, Duckworth approve r1 29779. Gate on 9e1085816+patch: packages 2735/0, scripts 429/0; landed blobs equal the gate tree. |
+| 200 | stack-release.sh activate --sso for the Q175 phase 2 window (row 192 F3; chained on 192) | launchpad; reviewers webby | #1698 | done | — | Webby approves the manifest; cli suite and every scripts/test-*.sh green on Sage's gate; the mutants killed (sage) | `docs/plans/2026-10-20_stack-release-sso.md` § Brief: stack-release.sh activates a Console with --sso (Q175 phase 2 prerequisite) | Landed 9e1085816 on refactor (base 722136772), pushed. Patch-id 7ebfa6a5 matches git diff 00d4cc1f6..9df40878f on the 3 manifest paths. Manifest b3ead55c, Webby approve r3 29772. Gate on 9df40878f: packages 2675/0, scripts 429/0. Mutants 13/14, M12 ruled equivalent (sage-1446). |
 | 201 | FED R1: access.json loader and validator, and covers (#414) | gizmoduck; reviewers duckworth | #1699 | done | — | Duckworth approves the manifest; business suite and every scripts/test-*.sh green on Sage's gate; the mutants killed (sage) | `docs/plans/2026-10-20_federation-r1-r2-r5.md` § Brief: FED R1, the access.json loader and validator | Landed afad4993f on refactor (squash of gizmoduck ae3c36f24..44e36fc4c, manifest 225597146daf...0c520). patch-id ba604ad5e matches the reviewed diff on all 3 paths. Gate on 44e36fc4c in the slot (gizmoduck-0060): business 173/0, 10 scripts 422/0, mutants 44/44. Duckworth approve 29581. |
 | 202 | FED R5: mosaic access list, grant and revoke (#414) | quackerjack; reviewers duckworth | #1700 | in-review, round 1, request posted | — | Duckworth approves the manifest; cli suite and every scripts/test-*.sh green on Sage's gate; the mutants killed (sage) | `docs/plans/2026-10-20_federation-r1-r2-r5.md` § Brief: FED R5, mosaic access list, grant and revoke | Chained on row 201's candidate (Q177), not its done: claimable now, lands after 201 and rebases onto its landing (Sage) |
 | 203 | FED R2: the federation key in the system config (#414) | quackerjack; reviewers webby | #1701 | briefed | — | Webby approves the manifest; cli suite and every scripts/test-*.sh green on Sage's gate; the mutants killed (sage) | `docs/plans/2026-10-20_federation-r1-r2-r5.md` § Brief: FED R2, the federation key in the system config | Chained on row 192's candidate (Q177): starts on 192's candidate, lands after 192 (Sage) |
 | 204 | 193a: access level check widened to viewer (#1691) | morgana; reviewers duckworth | #1702 | done | — | Duckworth approves the manifest; business suite and every scripts/test-*.sh green on Sage's gate; the mutants killed (sage) | `docs/plans/2026-10-20_human-users-build.md` § Brief: 193a, the access level check widened to viewer | Landed d0bbc5c1c on refactor (base c9f374284). Patch-id 92c18aea matches git diff 44e36fc4c..f869fd062 on the 3 manifest paths. Manifest d38de8c9, Duckworth approve 29595. Gate 2789/0 on 4385b9ec1, mutants 7/7. Unpushed. |
 | 205 | 193b1: viewer verbs, board refusals and the message filter (#1691; also after FED R3 and R4 when filed) | morgana; reviewers duckworth | #1703 | queued | 196 done | Duckworth approves the manifest; bus suite and every scripts/test-*.sh green on Sage's gate; the mutants killed (sage) | `docs/plans/2026-10-20_human-users-build.md` § Brief: 193b1, viewer verbs, board refusals and the message filter | — |
-| 206 | 193b2: thread shares, schema 3j-3k after machine grant row a (#1691; live needs a --migrate window with Jason) | morgana; reviewers duckworth | #1704 | queued | 205 done, 234 done | Duckworth approves the manifest; bus suite, cli suite and every scripts/test-*.sh green on Sage's gate; the mutants killed (sage) | `docs/plans/2026-10-20_human-users-build.md` § Brief: 193b2, thread shares (schema 3k) | — |
+| 206 | 193b2: thread shares, schema 3k-3l after the #436b build (#1691; live needs a --migrate window with Jason) | morgana; reviewers duckworth | #1704 | queued | 205 done, 234 done, 236 done | Duckworth approves the manifest; bus suite, cli suite and every scripts/test-*.sh green on Sage's gate; the mutants killed (sage) | `docs/plans/2026-10-20_human-users-build.md` § Brief: 193b2, thread shares (schema 3l) | — |
 | 207 | 193c: mosaic access user verbs and --level viewer (#1691) | morgana; reviewers duckworth | #1705 | queued | 202 done | Duckworth approves the manifest; cli suite and every scripts/test-*.sh green on Sage's gate; the mutants killed (sage) | `docs/plans/2026-10-20_human-users-build.md` § Brief: 193c, mosaic access user verbs and --level viewer | — |
 | 208 | 193d: Console shared list, share controls and viewer read-only (#1691; also after FED R6 when filed) | morgana; reviewers duckworth | #1706 | queued | 192 done, 206 done | Duckworth approves the manifest; webui suite and every scripts/test-*.sh green on Sage's gate; the mutants killed (sage) | `docs/plans/2026-10-20_human-users-build.md` § Brief: 193d, the Console's shared list, share controls and viewer read-only | — |
 | 209 | FED R8: the hub window on 10.1.1.54, a recorded acceptance (#414, r4.11 b93f098f0; live window run by Jason and Mos, after the Case 2 install #416, Bean and Chet live and both Hermes gateways stopped) | sage; reviewers duckworth | — | queued | — | Every entry check's output is in the R8 record with who ran it; Jason signs in to the hub and sends one message, Melanie revokes, his next request is refused; Duckworth checks the record (sage) | `docs/plans/2026-10-20_federation-r1-r2-r5.md` § Brief: FED R8, the hub window on 10.1.1.54 | Stays queued until its entry gates near: Case 2 install on .54 (#416, by 2026-10-27), Bean and Chet live, both Hermes gateways on .54 stopped, R7, #412 phase 2, #419 answer. Filed per mos-1073 after duckworth-0034 (Sage) |
-| 210 | Agent host access with sudo through the credential store: grant per agent and host, the stack does ssh and sudo, the agent never sees the key (#1707, Vikunja #424, Q183/Q184, due 10-27; chained on row 199's candidate) | gizmoduck; reviewers duckworth | #1707 | in-review, round 1, request posted | — | Duckworth approves DESIGN.md, then the manifest; bus, business, cli suites and every scripts/test-*.sh green on Sage's gate; the mutants killed (sage) | `docs/plans/2026-10-20_host-credentials.md` § Brief: agent host access with sudo through the credential store (#424) | Design runs before 199 lands (Q177 chain on 199's candidate). after cleared so Gizmoduck can claim; lands only after 199 and rebases onto it. |
+| 210 | Agent host access with sudo through the credential store: grant per agent and host, the stack does ssh and sudo, the agent never sees the key (#1707, Vikunja #424, Q183/Q184, due 10-27; chained on row 199's candidate) | gizmoduck; reviewers duckworth | #1707 | done | — | Duckworth approves DESIGN.md, then the manifest; bus, business, cli suites and every scripts/test-*.sh green on Sage's gate; the mutants killed (sage) | `docs/plans/2026-10-20_host-credentials.md` § Brief: agent host access with sudo through the credential store (#424) | Landed f5753c0e8 on refactor (base 9d165be8c), pushed. Patch-id 723b1c83 matches git diff ad95c888c..0485384e9 on the 23 manifest paths; landed files pass r5 manifest 688d38b9. Duckworth approve r2 rev 2592, r3 29851. Mutants 52/53, M22b equivalent (rev 2584). Gate on ad95c888c+patch: packages 2796/0, scripts 429/0; landed blobs equal the gate tree. |
 | 211 | Force-push guard: scripts/git-hooks/pre-push refuses non-fast-forward and delete pushes from every worktree, and scripts/slot-busy.sh exits 1 on BUSY (#1709, Vikunja #426, mos-1078/1083) | rocko; reviewers dewey | #1709 | briefed | — | Dewey approves the manifest; the new or changed scripts/test-*.sh and every other scripts/test-*.sh green on Sage's gate; the mutants killed; hook installed in the canonical checkout with a scripted refused force-push (sage) | `docs/plans/2026-10-20_force-push-guard.md` § Brief: a pre-push hook that refuses force-pushes, and a busy check that fails on BUSY (#426) | — |
 | 212 | Case 2 C2-01 packages/library: mapping, scope, reader, resolver, R-rules, renderItems, survey | gosalyn; reviewers webby | #1713 | in-review, round 1, request posted | — | Webby approves the manifest. The library tests and the cli suite are green on Sage's gate, along with every `scripts/test-*.sh`. (sage) | `docs/plans/2026-10-20_case2-rows.md` § C2-01 packages/library: mapping, scope, reader, resolver, R-rules, renderItems, survey | — |
 | 213 | Case 2 C2-08 creative roles, persona file and block, M1, M2, M6, M10, prompt passed by file | morgana; reviewers webby | #1714 | in-review, round 2, request posted | — | Webby approves the manifest. The business, bus and harness suites, `scripts/test-config.sh` and every `scripts/test-*.sh` are green on Sage's gate, and the `models` mutant is killed. (sage) | `docs/plans/2026-10-20_case2-rows.md` § C2-08 creative roles, persona file and block, M1, M2, M6, M10, prompt passed by file | — |
@@ -258,7 +258,7 @@ Generated from `docs/plans/queue.json` revision 2539 by `queue render`. Do not e
 | 219 | Case 2 C2-09a one thread per creative instance | rocko; reviewers dewey | #1720 | briefed | — | Dewey approves the manifest. The bus, cli and webui suites are green on Sage's gate, along with every `scripts/test-*.sh`. Watch for hash pins on `bus.js` and `broker.mjs` (`packages/bus/tests/channel-proof.test.mjs` pins a webui file). (sage) | `docs/plans/2026-10-20_case2-rows.md` § C2-09a one thread per creative instance | — |
 | 220 | Case 2 C2-10a no raw session view (M7) and no raw Discord engine (M8) | researcher; reviewers filbert | #1721 | briefed | — | Filbert approves the manifest. The conversation and discord suites and `scripts/test-discord.sh` are green on Sage's gate, along with every `scripts/test-*.sh`. No test reaches a Discord server. (sage) | `docs/plans/2026-10-20_case2-rows.md` § C2-10a no raw session view (M7) and no raw Discord engine (M8) | — |
 | 221 | Case 2 C2-20 Bean and Chet persona import, with a count-only dry run | gosalyn; reviewers webby | #1722 | briefed | — | Webby approves the manifest. The test file runs green on its own and the cli suite is green on Sage's gate, along with every `scripts/test-*.sh`. (sage) | `docs/plans/2026-10-20_case2-rows.md` § C2-20 Bean and Chet persona import, with a count-only dry run | — |
-| 222 | Case 2 C2-03a fetch-only sync | megavolt; reviewers dewey | #1723 | briefed | — | Dewey approves the manifest. The library and bus suites are green on Sage's gate, along with every `scripts/test-*.sh`, and the mutant is killed. A search of the test run's output for the fixture token finds nothing. (sage) | `docs/plans/2026-10-20_case2-rows.md` § C2-03a fetch-only sync | — |
+| 222 | Case 2 C2-03a fetch-only sync | megavolt; reviewers dewey | #1723 | in-progress | — | Dewey approves the manifest. The library and bus suites are green on Sage's gate, along with every `scripts/test-*.sh`, and the mutant is killed. A search of the test run's output for the fixture token finds nothing. (sage) | `docs/plans/2026-10-20_case2-rows.md` § C2-03a fetch-only sync | — |
 | 223 | Case 2 C2-07 runner retry on a guard refusal, and the runner's notices | researcher; reviewers filbert | #1724 | briefed | — | Filbert approves the manifest. The harness suite is green on Sage's gate, along with every `scripts/test-*.sh`. (sage) | `docs/plans/2026-10-20_case2-rows.md` § C2-07 runner retry on a guard refusal, and the runner's notices | — |
 | 224 | Case 2 C2-05b broker lookup verbs and typed tools | rocko; reviewers dewey | #1725 | briefed | — | Dewey approves the manifest. The bus and harness suites are green on Sage's gate, along with every `scripts/test-*.sh`. (sage) | `docs/plans/2026-10-20_case2-rows.md` § C2-05b broker lookup verbs and typed tools | — |
 | 225 | Case 2 C2-10b Console chat: cited items and the status line | researcher; reviewers dewey | #1726 | briefed | — | Dewey approves the manifest. The webui suite is green on Sage's gate, along with every `scripts/test-*.sh`. Grep for hash pins on `bus.js` and `serve.mjs` before in-review. (sage) | `docs/plans/2026-10-20_case2-rows.md` § C2-10b Console chat: cited items and the status line | — |
@@ -266,12 +266,19 @@ Generated from `docs/plans/queue.json` revision 2539 by `queue render`. Do not e
 | 227 | Case 2 C2-14 end-to-end acceptance on a scratch root | launchpad; reviewers dewey | #1728 | briefed | — | Dewey runs the script and approves. It is green on Sage's gate with every `scripts/test-*.sh`. (sage) | `docs/plans/2026-10-20_case2-rows.md` § C2-14 end-to-end acceptance on a scratch root | — |
 | 228 | Row A: ZAI_API_KEY passes through ENV_ALLOW to sessions, README line, pass-through test (XS, Haiku high) | researcher; reviewers webby | #1729 | in-review, round 1, request posted | — | Webby approves the manifest. The mutant is killed. The seat suite and the cli suite are green on Sage's gate with every scripts/test-*.sh. (sage) | `docs/plans/2026-10-20_case2-rows.md` § Brief: row A, ZAI_API_KEY in the session env allowlist | — |
 | 229 | Row B: per-instance pi agent dir for Chet's Codex login, design only, starts after 10-27 (#428) | gosalyn; reviewers webby | #1730 | queued | — | A live check, with Jason's or Mos's go, that two clients on one ChatGPT login don't revoke each other's refresh tokens. No build row starts before it passes. Held until after 10-27. (sage) | `docs/plans/2026-10-20_case2-rows.md` § Brief: row B, a per-instance pi agent dir for Chet's Codex login (#428) | — |
-| 230 | Case 2 C2-13a unit render and host precheck (case2-unit.sh, case2-precheck.sh) | gosalyn; reviewers webby | #1732 | in-progress | — | Webby approves the manifest. The test file and the cli suite are green on Sage's gate, along with every scripts/test-*.sh. A run on a host is a separate window with Jason's go. (sage) | `docs/plans/2026-10-20_case2-rows.md` § C2-13a unit render and host precheck | — |
+| 230 | Case 2 C2-13a unit render and host precheck (case2-unit.sh, case2-precheck.sh) | gosalyn; reviewers webby | #1732 | done | — | Webby approves the manifest. The test file and the cli suite are green on Sage's gate, along with every scripts/test-*.sh. A run on a host is a separate window with Jason's go. (sage) | `docs/plans/2026-10-20_case2-rows.md` § C2-13a unit render and host precheck | Landed c8bc5cf4c on refactor (base 390ea5261), pushed. Patch-id f4b49eb68997 matches git diff 722136772..96768766c on the 5 manifest paths (manifest fbb0d7e42c67, Webby approve r2 rev 2563). packages/cli/README.md 3-way with row 199, hunks apart. Gosalyn gate on 96768766c: cli 541/0, scripts 429/0, mutants 10/10. Merged tree check: case2-unit 30/0, host 42/0. |
 | 231 | Case 2 C2-01b survey escapes, list item lines and attachment embeds (row 212 N1-N3) | gosalyn; reviewers webby | #1733 | briefed | 212 done | Webby approves the manifest. The library tests are green on Sage's gate, along with every scripts/test-*.sh. (sage) | `docs/plans/2026-10-20_case2-rows.md` § C2-01b survey escapes, list item lines and attachment embeds | — |
-| 232 | Installer I1: stack-release external units and stack-copy bundle copies (MVP, Q187, Vikunja #432) | darkwing; reviewers filbert | #1734 | in-progress | — | Filbert approves the manifest. The cli suite and every scripts/test-*.sh are green on Sage's gate, with the mutants killed. (sage) | `docs/plans/2026-10-20_installer-rows.md` § I1 stack-release external units and bundle copies | — |
-| 233 | Installer I3: stack-upgrade.sh root driver and the ops-01 host run sheet (MVP, Q187, Vikunja #432) | darkwing; reviewers filbert | #1735 | queued | 232 done | Filbert approves the manifest. The test file, the cli suite and every scripts/test-*.sh are green on Sage's gate, with the mutants killed. (sage) | `docs/plans/2026-10-20_installer-rows.md` § I3 the upgrade command and the host run sheet | — |
-| 234 | Machine grant row a: host enrollment, store records and migration 3i-3j (#436a, design r6 f9039682e, lands by 10-25 before the .53/.54 installs) | gizmoduck; reviewers duckworth | #1740 | queued | 210 done | Duckworth approves the manifest. The bus, business and cli suites and every scripts/test-*.sh are green on Sage's gate. The design's section 10 row a tests and mutants pass, the migration test included. (sage) (sage) | `docs/plans/2026-10-20_host-credentials.md` § Machine grant row a: enrollment, store records and migration 3i-3j | — |
+| 232 | Installer I1: stack-release external units and stack-copy bundle copies (MVP, Q187, Vikunja #432) | darkwing; reviewers filbert | #1734 | done | — | Filbert approves the manifest. The cli suite and every scripts/test-*.sh are green on Sage's gate, with the mutants killed. (sage) | `docs/plans/2026-10-20_installer-rows.md` § I1 stack-release external units and bundle copies | Landed e65a3ab4d on refactor (base 0444acd08), pushed. Patch-id 5adfbab9 matches git diff 8fede5fc6..da2da2f6c on the 9 manifest paths; tree entries (modes too) equal da2da2f6c, files pass manifest 7af3c943. Filbert approve r1 29829, r2 29865. Darkwing's landing gate on da2da2f6c: cli 593/0, scripts 429/0 (+156 queue node tests). Mutants 17/17. |
+| 233 | Installer I3: stack-upgrade.sh root driver and the ops-01 host run sheet (MVP, Q187, Vikunja #432) | darkwing; reviewers filbert | #1735 | in-progress | 232 done | Filbert approves the manifest. The test file, the cli suite and every scripts/test-*.sh are green on Sage's gate, with the mutants killed. (sage) | `docs/plans/2026-10-20_installer-rows.md` § I3 the upgrade command and the host run sheet | — |
+| 234 | Machine grant row a: host enrollment, store records and migration 3i-3j (#436a, design r6 f9039682e, lands by 10-25 before the .53/.54 installs) | gizmoduck; reviewers duckworth | #1740 | in-progress | 210 done | Duckworth approves the manifest. The bus, business and cli suites and every scripts/test-*.sh are green on Sage's gate. The design's section 10 row a tests and mutants pass, the migration test included. (sage) (sage) | `docs/plans/2026-10-20_host-credentials.md` § Machine grant row a: enrollment, store records and migration 3i-3j | — |
 | 235 | Machine grant row b: raise binding, executor, reconcile and revoke (#436, design r6 f9039682e, C1, N1, G27, G28) | gizmoduck; reviewers duckworth | #1741 | queued | 234 done | Duckworth approves the manifest. The bus, business and cli suites and every scripts/test-*.sh are green on Sage's gate. Section 10's row b tests and mutants pass, G27, G28 and the upsert mutant included. (sage) (sage) | `docs/plans/2026-10-20_host-credentials.md` § Machine grant row b: raise binding, executor, reconcile and revoke | — |
+| 236 | #436b Gitea grant path build: seat accounts and tokens through an approved grant, schema 3j-3k (design r5 1be535aca, due 10-27 at risk; live waits for Jason's section 8 approval and bootstrap step) | megavolt; reviewers dewey | #1742 | queued | 210 done, 234 done | Dewey approves the manifest. The bus, business and cli suites and every scripts/test-*.sh are green on Sage's gate. Section 9's mutants are killed, N9's restart test included. (sage) (sage) | `docs/plans/2026-10-20_agent-credentials.md` § Brief: #436b Gitea grant path, build (schema 3j-3k) | — |
+| 237 | Row 199 follow-up N1: one decision publishes once (publish-busy or #spent recheck) | megavolt; reviewers duckworth | #1743 | done | 199 done | Duckworth approves the manifest. The bus suite and every scripts/test-*.sh are green on Sage's gate, and the mutant is killed. (sage) (sage) | `docs/plans/2026-10-20_agent-credentials.md` § Brief: row 199 follow-up N1, one decision publishes once | Landed d7d943199 on refactor (local, push pending), patch-id c5f4beb4 = e42415935, manifest bb777cb0 blobs checked. Sage gate 01:31-01:44Z on 816d48b03+4 paths: M1 killed (bus 1/13, cli 1/8), every package suite and scripts/test-*.sh green (bus 478, cli 564). |
+| 238 | row 200 follow-up N1: the sso-config hint carries --instance NAME (#1744) | launchpad; reviewers webby | #1744 | in-review, round 1, request posted | 200 done | Webby approves the manifest; stack-release.test.mjs whole, cli suite and every scripts/test-*.sh green on Sage's gate; the mutant killed (sage) | `docs/plans/2026-10-20_stack-release-sso.md` § Brief: row 200 follow-up N1, the sso-config hint names the instance | — |
+| 239 | Row 194 follow-up: the credential revoke runs under the writer's lock, refusals after a revoke say so, and a stale-revision fire test (duckworth-0074, mos-1158) | honker; reviewers duckworth | #1745 | queued | 194 done | Duckworth approves the manifest. The bus, business, cli and webui suites and every scripts/test-*.sh are green on Sage's gate, and the mutants are killed. (sage) (sage) | `docs/plans/2026-10-20_agent-lifecycle.md` § Brief: row 194 follow-up, the revoke under the writer's lock and a fire test | — |
+| 240 | Installer I4: hostcheck, the bwrap profile check, pins and boot unit, from r6 B2 (MVP, Q187, Vikunja #432; split from I3) | darkwing; reviewers filbert | #1746 | queued | 233 done | Filbert approves the manifest. The test file, the cli suite and every scripts/test-*.sh are green on Sage's gate, with the mutants killed. (sage) (sage) | `docs/plans/2026-10-20_installer-rows.md` § I4 hostcheck: the bwrap profile check, pins and boot unit | — |
+| 241 | Row 237 follow-up: one decision lands once, a two-ticket broker land test and three mutants on the landing guards (megavolt-0069, sage-1651, P19 441) | megavolt; reviewers duckworth | #1747 | done | 237 done | Duckworth approves the manifest. The bus, seat and cli suites and every scripts/test-*.sh are green on Sage's gate, and the three mutants are killed. (sage) (sage) | `docs/plans/2026-10-20_agent-credentials.md` § Brief: row 237 follow-up, one decision lands once, with tests at the broker | Landed 5d4a61776 on refactor, pushed (base e65a3ab4d). Blobs from 3e3ed303e on 2 paths; patch-id a1649f80 equals git diff f5753c0e8..3e3ed303e on those paths; ls-tree modes equal; manifest e8266864 verifies on the landed files. Sage slot on bbf3b1ee8: M1-M3 killed; gate 15 packages 2797/0, 10 script suites 429/0. Duckworth approve 29870 rev 2628. |
+| 242 | Row 237 follow-up N1: a retry after publish-timeout pushes once; hold the decision or kill and wait for the push, a slow-push retry test and a mutant (duckworth-0069, P19 440) | megavolt; reviewers duckworth | #1748 | done | 237 done | Duckworth approves the manifest. The bus and cli suites and every scripts/test-*.sh are green on Sage's gate, and the mutant is killed. (sage) (sage) | `docs/plans/2026-10-20_agent-credentials.md` § Brief: row 237 follow-up N1, a retry after publish-timeout pushes once | Landed 5fb736b92 on refactor, pushed (base 96bac588f). Blobs from 635c10924 on 3 paths; patch-id ceb741ee equals git diff 8fede5fc6..635c10924 on those paths; ls-tree modes equal; manifest 1fbfab6c verifies on the landed files. Megavolt M1/M2 killed on Sage's slot; Sage gate 15 packages 2826/0, 10 script suites 429/0. Duckworth approve 29889 rev 2639. |

 <!-- mosaic-queue:end -->

@@ -1,6 +1,6 @@
 # PRD: Mosaic Stack

- Status: approved, version 1.6. Jason approved draft 0.4 unchanged as
+- Status: approved, version 1.8. Jason approved draft 0.4 unchanged as
  1.0 on 2026-10-05 (lead decision 61). They approved version 1.1, the
  Organization requirements, in decision 03130d08-ddce-480d-a601-e59f64744fc3
  on 2026-10-14. They approved version 1.2, the chief of staff, the
@@ -15,7 +15,64 @@
  confirmation of the text is the approval, so there is no in-Stack
  prd.approve for it. Version 1.6 records Jason's ruling Q169 of
  2026-10-16, on who removes and who configures the assistant. It is
-  never edited in place. Changes are a new version.
+  never edited in place. Changes are a new version. Version 1.7 routes the
+  chief of staff's hire and fire actions and the coder's push to its own
+  fork, and adds agent host access through the credential store, approved
+  by Jason in decision d52febb5 (prd.approve, yes). Version 1.8 records
+  Jason's ruling Q188 of 2026-10-20: trusted actions within role
+  guardrails by default, a manual mode for per-use raises, and grants the
+  chief of staff requests and the user approves. Jason approved it in T3,
+  relayed by Mos on 2026-10-21 (DECISIONS Q192), so there is no in-Stack
+  prd.approve for it.
+- Version 1.8 source, Jason's approval in T3, relayed by Mos on 2026-10-21
+  (DECISIONS Q192): "PRD 1.8: I am preemptively approving it. Do not
+  surface in the Mosaic Stack board. Just proceed."
+- Version 1.8 source, Jason's ruling Q188 (DECISIONS, 2026-10-20), his
+  answers to Q8 and Q10, in part. Q8: "I would rather grant the grant
+  right to an agent that runs with strict guardrails. That agent presents
+  the final authorization for the user. Upon approval, the grant is
+  created programmatically. I see this as: User configures their PATs, API
+  tokens, authorizations within the WebUI. The agent presents the request
+  for grant with X rights for another agent. The user reviews, then clicks
+  Approve/Deny. Click of Approve fires off protected mechanical methods to
+  handle the grants on Github, Gitea, .... services as needed. The tooling
+  would need to exist and must be guarded." And "Disallowing the agents to
+  create grants autonomously is a necessary evil for better security.
+  Requiring the user to manually perform the steps is a no-fly." Q10:
+  "Agents should have tools and command access based on roles. Those roles
+  dictate the allowed tools and commands. The use of a tool or command
+  should not be raised to the user unless the system is configured with a
+  manual mode that requires user interaction. By default I want to have
+  the agents capable of running commands and tools at will within their
+  sandbox/guardrails. This allows autonomous actions by agents within
+  their lanes. Perhaps a "Trusted actions within approved guardrails"
+  methodology." And "The main agent or chief of staff would be responsible
+  for surfacing the request to the user's inbox for approval. Not all
+  agents are capable or authorized to request directly. It must follow the
+  chain of command properly." He agreed with Mos's Q10 points 3 to 6:
+  protected stack code does every step on Approve, his tokens are entered
+  in the WebUI and agents never see them, a command on the approved list
+  runs without a click and any other is refused, and he, Mos or the tester
+  can revoke a grant at once.
+- Version 1.8 source, Jason's ruling Q190 (DECISIONS, 2026-10-20), his
+  answer "Q12: O1": each agent seat gets its own account on his Gitea,
+  created through the Q188 approval path once the Gitea grants exist.
+- Version 1.8 source, Jason's ruling Q191 (DECISIONS, through Mos in
+  mos-1149), that the assistant and the chief of staff are separate roles,
+  and only the chief raises a grant request: "Q13: that looks better".
+- Version 1.7 source, TARGET.md line 66: "Chief of staff agent has
+  hire/fire authority for agents as needed; unless user forbids per
+  agent". And Jason through Mos (mos-1067), DECISIONS Q183, in part: "I
+  will still want to allow infra agent(s) on my .53 instance to access
+  other servers, etc. However, not all agents will need to have that
+  access. I envision a credential store within Mosaic Stack that works as
+  some sort of variable for the agent to call. The system will enforce
+  access to the credentials to keep the agents sandboxed with proper
+  security. I need to be able to trust my agents with assisting me. This
+  will require sudo access to several systems. If we can utilize the
+  credential store in Mosaic Stack and allow agents to perform their jobs
+  with NOPASSWD sudo on various machines, I am a happy man." DECISIONS
+  Q184, on whether that is in place by 10-27: "Q5: by 10.27"
 - Version 1.6 source, Jason's ruling Q169 (DECISIONS, brain repo,
  2026-10-16): "The only agent that should be able to remove the
  assistant role is the chief of staff. The COS and the user should have
@@ -262,6 +319,39 @@ Added in version 1.2:
  in its own words. It summarizes and doesn't relay their text. (Version
  1.5.)

+Added in version 1.7:
+
+- **REQ-COS-3.** The chief of staff hires and fires role instances without
+  a decision each time. Hiring adds a role instance to the organization
+  file and lists it for launch. Firing ends the instance's runs and
+  removes it from the launch list. It stays in the organization file. Only
+  the user deletes an instance. These actions are `role.hire` and
+  `role.fire`. They leave the hard waits and route under this requirement,
+  within these bounds:
+  - The chief acts only in its own organization.
+  - The chief hires only role definitions that need no credentials, until
+    a later version adds credentialed roles.
+  - The chief hires only the role kinds its role file lists. Changing that
+    list is a reviewed commit.
+  - The chief hires only a role whose every action is on a fixed list of
+    plain work actions: sending messages, writing records, asking for
+    review, updating its assigned tasks, and the scope and working-push
+    actions of an assigned task. A role holding any other action, such as
+    launch, end, organization, naming, hire, review verdict or merge
+    authority, or any action added later, is never hired. So the chief
+    never hires a chief, never picks its own reviewers or merge gate, and
+    the author is never the reviewer. This holds whatever the role file's
+    list says. Adding to that list is a PRD change.
+  - The chief may set a hired instance's model and narrow its limits, and
+    nothing else about it.
+  - The user can forbid per agent. The user marks an instance so the chief
+    can't fire it, end its runs or change its model, and marks role kinds
+    the chief can't hire. Only the user changes these marks, through the
+    WebUI or the CLI.
+  - The kill switch stops every hire and fire while it is on.
+  - Every hire and fire is logged with the chief's instance, its run and
+    the reason.
+
 ### Variables

 - **REQ-VAR-1.** Variables come in four layers: system, business, project
@@ -289,8 +379,111 @@ Added in version 1.2:
  - in Vikunja, a `bot-<business>-<role>` user per role, plus one
    read-only `bot-<business>-sync` that does all polling (lead
    decisions 52 and 58).
+
+  Since version 1.8, a token or key for a grant is made by the grant code
+  on the user's Approve (REQ-GRANT-2), not by hand. Tokens that exist stay
+  as they are.
 - **REQ-CRED-2.** A session that finds only founder credentials stops.

+Added in version 1.7:
+
+- **REQ-CRED-3.** An agent with a grant can run commands with sudo on
+  another host. The agent asks for the host credential by name. The stack
+  checks that a grant exists for that agent and that host before the
+  credential is used. The agent never sees the key or any other secret
+  value (REQ-CRED-1, REQ-VAR-2). An agent without a grant for that host is
+  refused. Not every agent gets a grant. Who grants a host credential, and
+  how, is set by the #424 design, which Jason approves.
+
+Added in version 1.8 (Q188):
+
+- **REQ-CRED-4.** An action a role definition lists within-role, and that
+  uses a grant, runs without a decision for each use only when all of
+  these hold:
+  - the definition declares the credential kind the action uses;
+  - a grant names that agent, and that host or service;
+  - for a command, the command matches the grant's allowlist. A grant
+    lists exact argv prefixes. A wildcard grant is refused;
+  - the agent's key or token for that grant is issued and not revoked.
+
+  A command off the allowlist is refused, and adding one takes a new grant
+  request (REQ-GRANT-1). An action whose definition doesn't list it
+  within-role still needs a decision for each use. Only a reviewed role
+  change adds an action to a definition. `host.sudo` routes under this
+  requirement.
+- **REQ-GRANT-1.** No agent creates or writes a grant. A grant request
+  follows the chain of command, and only the chief of staff raises it to
+  the user's inbox. Any other role that needs a grant for itself or for an
+  agent it directs asks the chief of staff, through its chain: a worker
+  role through its PM, the PM and the CTO directly. The assistant passes
+  the user's own request to the chief of staff (REQ-ASSIST-1). The request
+  names the agent, the grant method and its target, the exact rights, and
+  a rotate-by or expiry date. The chief raises one only for an agent whose
+  reviewed role definition allows that kind of credential, and the broker
+  refuses any other. A grant can't name a wildcard, a shell or an empty
+  command. The request is a decision with the action `credential.mint`, so
+  it goes to the user as a hard wait (REQ-WAIT-1). A grant whose method
+  makes an account, such as a seat's own Gitea user (Q190), is the same
+  one decision: the method in the grant says it makes an account, the
+  request names the account, and the inbox shows the account name before
+  Approve. The user's one resolution covers the account and its
+  credential, so the hard-waits list doesn't change. An `account.create`
+  raise isn't a grant request and routes as version 1.7 has it. The broker
+  checks only that the chief of staff raised the request. The chain of
+  command before that is in the messaging lists and the role contracts,
+  not a broker check. The assistant and the chief of staff are separate
+  roles. No agent holds both, and the broker refuses a claim that would.
+- **REQ-GRANT-2.** The user approves or denies each grant request in the
+  inbox. Approve is the only thing that creates a grant, and the code uses
+  a grant only when it has a matching Approve record. No agent creates a
+  grant. A grant written into the business file by hand makes nothing. Row
+  210's hand-written grants stay a test path until Vikunja #436a moves
+  `host.run` to grants made by Approve. On Approve, protected stack code
+  does every step, not an agent and not the user: it records the grant,
+  makes the key or token, installs it on the machine or creates it on the
+  service, and logs each step. On Deny nothing is made, and the denial is
+  logged. The grant methods are:
+  - machine key: a key for one agent on one enrolled host, with the
+    command allowlist of REQ-CRED-4. A host's identity comes from the host
+    side when the user approves its enrollment, never from a first
+    connection. A host user with sudo receives a grant only after the user
+    approved that user by name;
+  - Gitea: a token for one agent, and for an agent seat its own Gitea user
+    (Q190), with an expiry. The all scope and the admin scope are never
+    granted;
+  - GitHub: a grant for one agent.
+
+  The Gitea and GitHub rights units come in a later design that Jason
+  approves.
+
+  The approval binds the exact rights the user saw and the target or its
+  enrolled identity. A change to the agent, its definition, the target,
+  the target's identity or the rights after the raise voids it. An
+  approval is used once. A grant the code couldn't finish is undone at
+  once on the stack's side, so it is never used. What it left on the host
+  or service stays visible as pending until it is removed, as for a revoke
+  (REQ-GRANT-4). A new grant needs a new approval, never an automatic
+  retry. The grant code runs only on a request the user resolved. A
+  request resolved by an arbiter, the tester or any agent makes nothing. A
+  `credential.mint` decision raised before version 1.8, or without the
+  fields of REQ-GRANT-1, makes nothing when it is approved. Until the
+  Console knows the signed-in human (Vikunja #412), Approve is
+  `mosaic decide` in the CLI (REQ-DEC-3).
+- **REQ-GRANT-3.** The user enters their own personal access tokens and
+  API tokens in the WebUI, or the CLI. Only the grant code reads them, to
+  make grants. No agent ever sees a token value or a key's private half.
+  Values appear in no event, log, message, prompt or agent file, and no
+  agent can read them back (REQ-VAR-2). Until the Console knows the
+  signed-in human, they are entered through the CLI.
+- **REQ-GRANT-4.** A grant can be revoked at once by the user, by the
+  assistant for a grant in its own organization, or by the tester on a dev
+  instance (Q173). A revoke needs no decision and no new trust. It takes
+  effect at once on the stack's side, without waiting on the network, so
+  the next use is refused. Removing the key or token at the host or
+  service follows. Until that removal is done it stays visible as pending.
+  A revoke while the grant is being made stops it, and nothing it made
+  stays usable. Every revoke is logged with who made it.
+
 ### Decisions

 - **REQ-DEC-1.** Every decision is a record in an append-only SQLite
@@ -338,6 +531,31 @@ Added in version 1.5 (Q167):
  settled under one commit stays settled when a later commit lands, and
  new raises cite the new commit.

+### Trusted actions
+
+Added in version 1.8 (Q188).
+
+- **REQ-TRUST-1.** Agents act within their role guardrails without asking.
+  The default mode is "trusted actions within approved guardrails". An
+  action a role file grants within-role is done at will, inside the
+  agent's sandbox, its tool limit and its grants, and is logged. It raises
+  nothing to the user. An action the file doesn't grant within-role still
+  routes by REQ-DEC-2, and a hard wait still goes to the user
+  (REQ-WAIT-1). Only a reviewed role change adds an action to a role file,
+  and REQ-WAIT-2 still keeps every hard wait out of every role file.
+- **REQ-TRUST-2.** The user can put chosen actions in manual mode. The
+  organization file holds the list of actions in manual mode, empty by
+  default. While an action is on the list, every use of it by any role
+  becomes a decision for that use, raised to the user, and the action
+  waits until the user resolves it. A decision denied, or not resolved,
+  refuses the action. Each decision is used once. For a command on another
+  host, the decision names the host, the command and its input. Actions
+  not on the list are unchanged. Only the user changes the list, through
+  the WebUI or the CLI. The chief of staff's organization writes
+  (REQ-ROLE-3) can't change it, and no agent can. Every change is logged
+  with who made it. A change applies to the next use, and a run already in
+  progress keeps no exemption.
+
 ### Hard waits

 Added in version 1.5 (Q167).
@@ -371,6 +589,13 @@ Added in version 1.5 (Q167).
  PRD version says it isn't. The reviewed commit that adds it names which
  it is.

+  `role.hire` and `role.fire` were added as hard waits and route under
+  REQ-COS-3 since version 1.7. `git.push.remote` was added as a hard wait
+  and routes under REQ-LAND-2 since version 1.7.
+
+  `host.sudo` was added as a hard wait and routes under REQ-CRED-4 since
+  version 1.8.
+
 ### Messages

 - **REQ-MSG-1.** Messages are addressed to a role. They are append-only
@@ -470,6 +695,37 @@ Added in version 1.5 (Q167, Mos's reading Q4).
  decision; the check ships with whichever of rows 137 and 139 lands
  second.

+Added in version 1.7:
+
+- **REQ-LAND-2.** A coder pushes its own work to its own fork. The action
+  is `git.push.remote`.
+  - What it pushes: one commit, by its oid, never a ref name. That commit
+    is the latest work commit the bus recorded for the coder's task, and
+    the coder made that push. A decision that authorizes a push names that
+    commit, and it doesn't authorize any other.
+  - Where it lands: only the branch
+    `refs/heads/<its Gitea user>/<branch>`. The host builds that name, the
+    agent never does. A push never forces.
+  - Which remote: the agent's own fork of the project's upstream. The
+    business file names the upstream, and the host never contacts it. For
+    each push the host builds the fork's address over https from the
+    upstream's host, port and repository name and the agent's own Gitea
+    user. The history check, the push and the credential match all use
+    that address. So the agent's own user owns the receiving repository on
+    every push, and the agent never names it.
+  - The host refuses an upstream on a host or port other than the agent's
+    Gitea, and an upstream the agent's own user owns. It refuses a fork
+    that is missing, empty or doesn't share the project's history. Gitea's
+    push-to-create stays off, so a push never creates a repository.
+  - Who may: the action routes under REQ-DEC-2 and is granted within-role
+    to the coder role only. No other role file grants it.
+  - Before version 1.7 the action was a hard wait under REQ-WAIT-3, so
+    each push needed a decision the human resolved, and that decision
+    named the commit.
+
+  Every push is logged with the remote, the ref, the commit and, when one
+  was given, the decision.
+
 ### Interface

 - **REQ-CLI-1.** `mosaic` is the front door. From it Jason can:
@@ -925,6 +1181,13 @@ only hard waits in his inbox.
  file only picks among modules already in the tree. The reviewed commit
  that adds a module is the only check on what it does, which is why
  modules from outside the repository wait for Jason (REQ-PLUG-1).
+- Trusted mode lets an agent run its allowed commands at will. On another
+  host, an allowed command that writes a file as root or starts a shell
+  can plant a key, and the seat sandbox doesn't confine the network, so
+  root can outlive the grant and a revoke. The allowlist narrows this. A
+  seat sandbox with its own network namespace closes it. Until then the
+  host's own audit log is the check after the fact (row 210 design section
+  6).

 ## Milestones

@@ -218,6 +218,9 @@ an operator inspect content and delivery evidence after an uncertain result.
 | `credentials.issue` | `{agent,service,token,date}`; human only (row 199, #1697). Writes the token to `<configDir>/secrets/agents/<business>/<agent>/<service>` (0600, dirs 0700: tmp, fsync, rename), rewrites the agent's reference in the business file to `{"store":true,<rotateBy or expires>:date}`, then holds the token in memory, with no restart. Over an issued entry it is a rotate: the old value is gone from disk and memory when it returns. `service` is `gitea` or `vikunja` and the business file must already name it for the agent (`credential-unknown`). A token the bus already holds is `credential-leak`; a bad token `credential-format`; a bad date `credential-date`. Returns `{agent,verb,service,date,state}`, `verb` `issue` or `rotate`. The tester gets `tester-refused`. |
 | `credentials.revoke` | `{agent,service?,reason}`; human, or the tester (Q173). Drops the entry from memory, then unlinks a store file; a `file` or `env` reference keeps its file and becomes `store`, so a restart loads nothing. Without `service`, every kind the agent has. Returns `{agent,verb,services:[{service,state}]}`. |
 | `credentials.delete` | `{agent,reason}`; human only. `credentials.revoke` for every kind, then removes the agent's store dir; a file there other than a token is `credential-file`. While the agent or one of its threads holds a claim, `agent-running`. |
+| `hosts.status` | No args; the human, the tester or the business's chief (row 234, #1740). `[{host,address,port,user,sudo,state,hostKeys,installerFingerprint,checkedAt,hostLineLeft}]` from the `hosts` records, with host keys as fingerprints. Never a key. |
+| `hosts.check` | `{host}`; same callers. Runs the host's `list <user>` as `mosaic-installer` with the installer key and the pinned host keys, then sets `state` `ready` and `checkedAt` and writes `grant.host.checked`. A nonzero exit is `host-failed`, a record that changed during the run `host-changed`, a record with no installer key `host-not-enrolled`. |
+| `hosts.remove` | `{host}`; the human or the tester. Deletes the record, writes `grant.host.removed` and removes the installer key. A `host_grants` record for the host is `host-in-use`, a guarded event naming a host line left on the host `host-line-left`. |

 Each of the three leaves one receipt in the organization's `changes.jsonl`: the actor and a
 `detail` of `{verb,agent,kind,date or reason}`, never a value. A change to the store alone writes
@@ -704,10 +707,10 @@ scope probes and rotation/expiry notifications; S2 never probes real services.

 ## Schema and verification

-`schema.sql` is v3i, SHA-256
-`6cde5232c57ac04dc6073112c0830c89cfc5e953d7a5727e7716263747fe8737`.
-It has 16 tables, 71 triggers and five views. Source digest and a trusted full
-sqlite_master digest are checked at open, alongside schema version `3i`, WAL,
+`schema.sql` is v3j, SHA-256
+`0a7b633ce7eec9d0bb37c3255f4244d97bd0c8eac38db91a11b4ef6cc982ec8c`.
+It has 18 tables, 72 triggers and five views. Source digest and a trusted full
+sqlite_master digest are checked at open, alongside schema version `3j`, WAL,
 quick_check and foreign-key integrity. Missing metadata refuses; it never
 reinitializes an existing file. Full synchronous WAL transactions either commit
 or roll back. SQL UPDATE, DELETE and INSERT OR REPLACE refuse on evidence tables.
@@ -867,6 +870,14 @@ one transaction; a failure leaves the store at 3h. It runs only through
 refuses a 3i store. The 3h fixture, `tests/fixtures/schema-3h.sql`, is pinned from
 81f26551b's tree; no live store is used.

+Schema 3j (row 234, #1740) adds only new objects: the `hosts` and `host_grants` tables, which
+hold enrolled hosts and host grants, and the `events_grant_actor` trigger. The trigger refuses an
+`action.allowed` event whose `body.action` or `body.operation` matches `grant.*` unless its actor
+is `actor_role` NULL with `actor_run` 'grant', the broker's grant writer (#436b section 7). The
+step runs in one transaction, and a failure leaves the store at 3i. The 3i fixture,
+`tests/fixtures/schema-3i.sql`, is pinned from 8fede5fc6's tree, and `tests/grant-migration.test.mjs`
+covers the step and the trigger.
+
 The managed runner calls usage.begin before an actual harness turn and usage.end
 after it, including a failed/stopped turn. Each takes only {turn: deliveredMessageId}.
 The broker requires the bound role holder and its delivery, binds run identity,
@@ -363,3 +363,34 @@ CREATE TABLE usage_records (
 CREATE TRIGGER usage_records_no_update BEFORE UPDATE ON usage_records BEGIN SELECT RAISE(ABORT, 'usage_records is append-only'); END;
 CREATE TRIGGER usage_records_no_delete BEFORE DELETE ON usage_records BEGIN SELECT RAISE(ABORT, 'usage_records is append-only'); END;
 CREATE TRIGGER usage_records_no_replace BEFORE INSERT ON usage_records WHEN EXISTS (SELECT 1 FROM usage_records WHERE seq=NEW.seq OR (business=NEW.business AND run=NEW.run AND turn=NEW.turn AND source=NEW.source AND phase=NEW.phase)) BEGIN SELECT RAISE(ABORT, 'usage_records is append-only'); END;
+CREATE TABLE hosts (
+  business TEXT NOT NULL,
+  host TEXT NOT NULL,
+  address TEXT NOT NULL,
+  port INTEGER NOT NULL CHECK (port BETWEEN 1 AND 65535),
+  user TEXT NOT NULL,
+  sudo INTEGER NOT NULL CHECK (sudo IN (0,1)),
+  host_keys TEXT NOT NULL CHECK (json_valid(host_keys) AND json_type(host_keys) = 'array' AND json_array_length(host_keys) > 0),
+  installer_fingerprint TEXT,
+  state TEXT NOT NULL CHECK (state IN ('pending-install','ready')),
+  decision TEXT NOT NULL REFERENCES decisions(id),
+  checked_at TEXT,
+  PRIMARY KEY (business, host),
+  CHECK (state = 'pending-install' OR (installer_fingerprint IS NOT NULL AND checked_at IS NOT NULL))
+) STRICT;
+CREATE TABLE host_grants (
+  business TEXT NOT NULL,
+  agent TEXT NOT NULL,
+  host TEXT NOT NULL,
+  commands TEXT NOT NULL CHECK (json_valid(commands) AND json_type(commands) = 'array' AND json_array_length(commands) > 0),
+  rotate_by TEXT NOT NULL,
+  tag TEXT NOT NULL CHECK (length(tag) = 39 AND tag GLOB 'mosaic-*' AND NOT substr(tag, 8) GLOB '*[^0-9a-f]*'),
+  decision TEXT NOT NULL REFERENCES decisions(id),
+  PRIMARY KEY (business, agent, host),
+  FOREIGN KEY (business, host) REFERENCES hosts(business, host)
+) STRICT;
+CREATE TRIGGER events_grant_actor BEFORE INSERT ON events
+  WHEN NEW.kind = 'action.allowed'
+    AND (json_extract(NEW.body, '$.action') GLOB 'grant.*' OR json_extract(NEW.body, '$.operation') GLOB 'grant.*')
+    AND NOT (NEW.actor_role IS NULL AND NEW.actor_run IS 'grant')
+  BEGIN SELECT RAISE(ABORT, 'only the grant writer records grant events'); END;
@@ -1,4 +1,5 @@
 import { BusError } from './broker.mjs';
+import { isHostKind } from '../../business/src/vocabulary.mjs';
 // Adapt S1's validated loadBusiness + resolveInstance outputs, without loading or writing files.
 export function busBusiness(business, resolved) {
  if (!business || typeof business.id !== 'string' || !business.roles || !resolved)
@@ -17,7 +18,10 @@ export function busBusiness(business, resolved) {
    out.roles[role].authority = structuredClone(r.limits.authority);
    // REQ-HARN-2: "web" in the resolved tool limit is the grant for the broker's web verbs.
    out.roles[role].web = (r.limits.tools ?? []).includes('web');
-    out.roles[role].credentials = structuredClone(r.credentials ?? {});
+    // Row 210 (#1707, design D5): resolveInstance leaves host.<id> keys out of the session's
+    // credentials. The bus child uses them, so they come back here from the business entry.
+    const hostKeys = Object.entries(business.roles[role].credentials ?? {}).filter(([kind]) => isHostKind(kind));
+    out.roles[role].credentials = { ...structuredClone(r.credentials ?? {}), ...structuredClone(Object.fromEntries(hostKeys)) };
  }
  return out;
 }
@@ -1,9 +1,12 @@
 import { BusError } from './broker.mjs';
+import { isHostKind } from '../../business/src/vocabulary.mjs';
 // Row 199 (#1697, design section 6): issue, rotate, revoke and delete of one agent's credentials, for
 // the broker's human-only verbs. The broker checks the session, the keys and a running claim first.
 // Each verb leaves one receipt in the organization's changes.jsonl: the actor and a detail naming the
 // verb, agent, kinds, date or reason, never a value. Nothing here logs, and a result carries no token.
 const DATE_KEY = Object.freeze({ gitea: 'rotateBy', vikunja: 'expires' });
+// Row 210 (#1707, design D1): a host.<id> key takes a rotate date, as gitea does.
+const dateKey = (service) => (isHostKind(service) ? 'rotateBy' : DATE_KEY[service]);
 const deny = (code) => {
  throw new BusError(code);
 };
@@ -22,12 +25,14 @@ export function credentialVerbs({ credentials, writer }) {
      // rotate is an issue over an entry the bus holds now; the old value is gone when this returns.
      const kind = ['not-issued', 'revoked', undefined].includes(state(instance, service)) ? 'issue' : 'rotate';
      const next = structuredClone(document);
-      next.roles[agent].credentials[service] = { store: true, [DATE_KEY[service]]: date };
+      next.roles[agent].credentials[service] = { store: true, [dateKey(service)]: date };
      const detail = { verb: kind, agent, kind: [service], date };
      const status = credentials.issue(instance, service, token, date, () =>
        writer.write(id, next, { revision, actor, detail }),
      );
-      return { agent, verb: kind, service, date: status.date, state: status.state };
+      // Row 210 (design D9): a host key's public line and fingerprint, for ops-01's authorized_keys.
+      const host = status.fingerprint ? { publicKey: status.publicKey, fingerprint: status.fingerprint } : {};
+      return { agent, verb: kind, service, date: status.date, state: status.state, ...host };
    }
    const services = verb === 'credentials.revoke' && args.service ? [args.service] : Object.keys(current);
    if (services.some((service) => !current[service])) deny('credential-unknown');
@@ -41,7 +46,7 @@ export function credentialVerbs({ credentials, writer }) {
    if (moved.length) {
      const next = structuredClone(document);
      for (const service of moved)
-        next.roles[agent].credentials[service] = { store: true, [DATE_KEY[service]]: current[service][DATE_KEY[service]] };
+        next.roles[agent].credentials[service] = { store: true, [dateKey(service)]: current[service][dateKey(service)] };
      writer.write(id, next, { revision, actor, detail });
    } else writer.record(id, { actor, detail });
    return {
@@ -3,7 +3,9 @@ import {
  renameSync, unlinkSync, rmdirSync, readdirSync,
 } from 'node:fs';
 import { dirname, isAbsolute, join, relative, resolve } from 'node:path';
+import { createHash } from 'node:crypto';
 import { BusError } from './broker.mjs';
+import { credentialKind, isHostKind } from '../../business/src/vocabulary.mjs';
 const deny = (code) => {
  throw new BusError(code);
 };
@@ -17,8 +19,86 @@ const day = (value) =>
  !Number.isNaN(Date.parse(value)) &&
  new Date(value).toISOString().slice(0, 10) === value;
 const TOKEN = /^[-A-Za-z0-9._~]+\n?$/;
+const PEM_BEGIN = '-----BEGIN OPENSSH PRIVATE KEY-----';
+const PEM_END = '-----END OPENSSH PRIVATE KEY-----';
+// Row 210 (#1707, design D2): an unencrypted openssh-key-v1 ed25519 key, parsed with Buffer so the
+// check runs at bus start with no process. Returns the public line and what D8 searches for.
+export function parseHostKey(text) {
+  if (typeof text !== 'string' || text.length > 16384 || text.includes('\r')) deny('credential-format');
+  const lines = text.replace(/\n$/, '').split('\n');
+  if (lines.length < 3 || lines[0] !== PEM_BEGIN || lines.at(-1) !== PEM_END) deny('credential-format');
+  const body = lines.slice(1, -1);
+  if (body.some((l) => !/^[A-Za-z0-9+/]+={0,2}$/.test(l))) deny('credential-format');
+  const joined = body.join('');
+  const blob = Buffer.from(joined, 'base64');
+  if (blob.toString('base64') !== joined) deny('credential-format');
+  let at = 0;
+  const bytes = (n) => {
+    if (n < 0 || at + n > blob.length) deny('credential-format');
+    const out = blob.subarray(at, at + n);
+    at += n;
+    return out;
+  };
+  const u32 = () => bytes(4).readUInt32BE(0);
+  const str = () => bytes(u32());
+  const magic = Buffer.from('openssh-key-v1\0');
+  if (!bytes(magic.length).equals(magic)) deny('credential-format');
+  if (str().toString() !== 'none' || str().toString() !== 'none' || str().length !== 0) deny('credential-format');
+  if (u32() !== 1) deny('credential-format');
+  const publicBlob = str();
+  const priv = str();
+  if (at !== blob.length) deny('credential-format');
+  if (
+    publicBlob.length !== 51 ||
+    publicBlob.readUInt32BE(0) !== 11 ||
+    publicBlob.subarray(4, 15).toString() !== 'ssh-ed25519' ||
+    publicBlob.readUInt32BE(15) !== 32
+  )
+    deny('credential-format');
+  const pub = publicBlob.subarray(19);
+  // The private section: check1, check2, key type, public, private (seed then public), comment, padding.
+  let p = 0;
+  const take = (n) => {
+    if (n < 0 || p + n > priv.length) deny('credential-format');
+    const out = priv.subarray(p, p + n);
+    p += n;
+    return out;
+  };
+  const pu32 = () => take(4).readUInt32BE(0);
+  const pstr = () => take(pu32());
+  if (pu32() !== pu32()) deny('credential-format');
+  if (pstr().toString() !== 'ssh-ed25519') deny('credential-format');
+  if (!pstr().equals(pub)) deny('credential-format');
+  const secret = pstr();
+  if (secret.length !== 64 || !secret.subarray(32).equals(pub)) deny('credential-format');
+  pstr();
+  const padding = priv.subarray(p);
+  if (padding.length >= 8 || padding.some((b, i) => b !== i + 1) || priv.length % 8 !== 0) deny('credential-format');
+  const seed = Buffer.from(secret.subarray(0, 32));
+  const publicLine = 'ssh-ed25519 ' + publicBlob.toString('base64');
+  const fingerprint = 'SHA256:' + createHash('sha256').update(publicBlob).digest('base64').replace(/=+$/, '');
+  // D8: each body line of 24 characters or more, the whole body, and the seed as hex and as base64
+  // at each of the three byte offsets (only the characters that depend on the seed alone).
+  const needles = [...body.filter((l) => l.length >= 24), joined, seed.toString('hex')];
+  for (const offset of [0, 1, 2]) {
+    const encoded = Buffer.concat([Buffer.alloc(offset), seed]).toString('base64');
+    needles.push(encoded.slice(Math.ceil((8 * offset) / 6), Math.floor((8 * (offset + 32)) / 6)));
+  }
+  return { text: lines.join('\n') + '\n', publicLine, fingerprint, seed, needles };
+}
+// D8: refuses credential-leak when the value's JSON text holds any part of the key.
+export function assertCleanKey(value, key) {
+  let encoded;
+  try {
+    encoded = JSON.stringify(value);
+  } catch {
+    deny('invalid-request');
+  }
+  if (encoded === undefined) return;
+  if (key.needles.some((n) => encoded.includes(n))) deny('credential-leak');
+}
 // Row 199 (#1697, design D1, D4): a store dir is the stack instance's user's own and nobody else's.
-const privateDir = (path, { missing = false } = {}) => {
+export const privateDir = (path, { missing = false } = {}) => {
  let st;
  try {
    st = lstatSync(path);
@@ -34,6 +114,8 @@ export class Credentials {
  // Row 199: every reference the bus loaded, so issue, rotate, revoke and status work per entry.
  #refs = new Map();
  #revoked = new Set();
+  // Row 210 (design D5, D9): instance:host.<id> -> the AbortController of the call in flight.
+  #inflight = new Map();
  #storeRoot;
  #repoRoots;
  #dataRoot;
@@ -46,7 +128,7 @@ export class Credentials {
    try {
      for (const [instance, services] of Object.entries(references))
        for (const [service, ref] of Object.entries(services)) {
-          if (!['gitea', 'vikunja'].includes(service) || !ref || typeof ref !== 'object')
+          if (!credentialKind(service) || !ref || typeof ref !== 'object')
            deny('credential-reference');
          const date = service === 'vikunja' ? ref.expires : ref.rotateBy;
          if (!day(date)) deny('credential-date');
@@ -60,8 +142,8 @@ export class Credentials {
          )
            deny('credential-reference');
          this.#refs.set(instance + ':' + service, { ref, date });
-          const token = this.#read(ref, env);
-          if (token !== null) this.#tokens.set(instance + ':' + service, { token, date });
+          const value = this.#read(ref, env, service);
+          if (value !== null) this.#tokens.set(instance + ':' + service, { ...value, date });
        }
    } catch (e) {
      this.close();
@@ -75,7 +157,7 @@ export class Credentials {
    return join(this.#storeRoot, business, agent, service);
  }
  // One token, read and checked, or null for a store reference with no file yet (design D3a).
-  #read(ref, env) {
+  #read(ref, env, service) {
          let token;
          if (ref.store) {
            const agentDir = dirname(ref.file);
@@ -137,13 +219,18 @@ export class Credentials {
            if (!/^[A-Z_][A-Z0-9_]*$/.test(ref.env)) deny('credential-reference');
            token = env[ref.env];
          }
-          return Credentials.#format(token);
+          return Credentials.#format(service, token);
  }
-  static #format(token) {
+  // { token } for gitea and vikunja, { token, key } for host.<id> (design D2).
+  static #format(service, token) {
+    if (isHostKind(service)) {
+      const key = parseHostKey(token);
+      return { token: key.text, key };
+    }
    if (typeof token !== 'string' || token.length > 16384 || !TOKEN.test(token)) deny('credential-format');
    token = token.replace(/\n$/, '');
    if (token.length < 16) deny('credential-format');
-    return token;
+    return { token };
  }
  #known(instance, service) {
    const known = this.#refs.get(instance + ':' + service);
@@ -156,7 +243,7 @@ export class Credentials {
  issue(instance, service, token, date, commit = () => {}) {
    this.#known(instance, service);
    if (!day(date)) deny('credential-date');
-    token = Credentials.#format(token);
+    const value = Credentials.#format(service, token);
    const file = this.#storePath(instance, service);
    const agentDir = dirname(file);
    mkdirSync(this.#storeRoot, { recursive: true, mode: 0o700 });
@@ -174,7 +261,7 @@ export class Credentials {
    let fd;
    try {
      fd = openSync(tmp, constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | constants.O_NOFOLLOW, 0o600);
-      writeSync(fd, token + '\n');
+      writeSync(fd, value.key ? value.token : value.token + '\n');
      fsyncSync(fd);
    } finally {
      if (fd !== undefined) closeSync(fd);
@@ -188,7 +275,7 @@ export class Credentials {
    }
    commit();
    this.#refs.set(instance + ':' + service, { ref: { service, store: true, file, [service === 'vikunja' ? 'expires' : 'rotateBy']: date }, date });
-    this.#tokens.set(instance + ':' + service, { token, date });
+    this.#tokens.set(instance + ':' + service, { ...value, date });
    this.#revoked.delete(instance + ':' + service);
    return this.status().find((e) => e.instance === instance && e.service === service);
  }
@@ -198,6 +285,8 @@ export class Credentials {
    const { ref } = this.#known(instance, service);
    this.#tokens.delete(instance + ':' + service);
    this.#revoked.add(instance + ':' + service);
+    // Row 210 (design D9): a host.run in flight for this agent and host is killed first.
+    this.#inflight.get(instance + ':' + service)?.abort();
    if (ref.store) {
      try {
        unlinkSync(ref.file);
@@ -219,16 +308,16 @@ export class Credentials {
      if (e.code === 'ENOENT') return { services };
      deny('credential-file');
    }
-    if (names.some((n) => !/^(gitea|vikunja)(\.tmp)?$/.test(n))) deny('credential-file');
+    if (names.some((n) => !credentialKind(n.replace(/\.tmp$/, '')))) deny('credential-file');
    for (const n of names) unlinkSync(join(agentDir, n));
    rmdirSync(agentDir);
    return { services };
  }
  // The agent-facing use (design D5): the key comes only from the broker's verified session.
-  async useFor(session, service, operation) {
+  async useFor(session, service, operation, options) {
    if (!session || typeof session.business !== 'string' || typeof session.role !== 'string' || session.role.startsWith('@'))
      deny('credential-not-yours');
-    return this.use(session.business + '/' + session.role, service, operation);
+    return this.use(session.business + '/' + session.role, service, operation, options);
  }
  assertClean(value) {
    let encoded;
@@ -239,24 +328,52 @@ export class Credentials {
    }
    for (const { token } of this.#tokens.values()) if (encoded?.includes(token)) deny('credential-leak');
  }
-  async use(instance, service, operation) {
-    const entry = this.#tokens.get(instance + ':' + service);
+  // Row 210 (design D5): whether a host.run for this agent and host is in flight.
+  busy(instance, service) {
+    return this.#inflight.has(instance + ':' + service);
+  }
+  // Row 210 (design D5, D8, D9): a host.<id> key runs one call at a time per agent and host, gets
+  // an abort signal that revoke fires, and is checked against `input` before and the result after.
+  async use(instance, service, operation, { input } = {}) {
+    const k = instance + ':' + service;
+    const entry = this.#tokens.get(k);
    if (!entry) deny('credential-unavailable');
    if (service === 'vikunja' && Date.now() >= Date.parse(entry.date + 'T00:00:00Z'))
      deny('credential-expired');
+    if (!entry.key) {
+      let result;
+      try {
+        result = await operation(entry.token);
+      } catch (e) {
+        // Row 199: a host step's own refusal (publish) keeps its code; anything else is the service's.
+        if (e instanceof BusError) throw e;
+        deny('service-failed');
+      }
+      this.assertClean(result);
+      return result;
+    }
+    if (this.#inflight.has(k)) deny('host-busy');
+    assertCleanKey(input, entry.key);
+    const controller = new AbortController();
+    this.#inflight.set(k, controller);
    let result;
    try {
-      result = await operation(entry.token);
+      result = await operation(entry.token, { key: entry.key, signal: controller.signal });
    } catch (e) {
-      // Row 199: a host step's own refusal (publish) keeps its code; anything else is the service's.
+      if (controller.signal.aborted) deny('credential-unavailable');
      if (e instanceof BusError) throw e;
-      deny('service-failed');
+      deny('host-failed');
+    } finally {
+      this.#inflight.delete(k);
    }
+    if (controller.signal.aborted) deny('credential-unavailable');
+    assertCleanKey(result, entry.key);
    this.assertClean(result);
    return result;
  }
  status() {
    return [...this.#refs.entries()].map(([key, { date }]) => {
+      const hostKey = this.#tokens.get(key)?.key;
      const i = key.lastIndexOf(':'),
        service = key.slice(i + 1),
        left = Date.parse(date + 'T00:00:00Z') - Date.now();
@@ -264,11 +381,12 @@ export class Credentials {
        instance: key.slice(0, i),
        service,
        date,
+        ...(hostKey ? { fingerprint: hostKey.fingerprint, publicKey: hostKey.publicLine } : {}),
        state: !this.#tokens.has(key)
          ? this.#revoked.has(key)
            ? 'revoked'
            : 'not-issued'
-          : service === 'gitea'
+          : service !== 'vikunja'
            ? left <= 0
              ? 'rotation-due'
              : 'valid'
@@ -0,0 +1,217 @@
+// Row 234 (#1740, #436a row a): the trusted half of host enrollment, run in the bus child. The broker
+// gets it as `hostGrant` and holds every store write. This module holds what touches the network or
+// a key file: the raise's ssh-keyscan (E1), the installer key pair (E2 steps 2 and 3) and the installer's
+// `list` for hosts.check (E4).
+//
+// The installer key lives at <configDir>/secrets/hosts/<business>/<hostId>/installer, 0600 in 0700 dirs,
+// written as 210's issue writes (tmp, fsync, rename). It is never read into an event or a message.
+import { spawn } from 'node:child_process';
+import { createHash } from 'node:crypto';
+import {
+  closeSync, constants, fsyncSync, mkdirSync, mkdtempSync, openSync, readFileSync, renameSync, rmSync, rmdirSync,
+  unlinkSync, writeSync,
+} from 'node:fs';
+import { dirname, join } from 'node:path';
+import { BusError } from './broker.mjs';
+import { parseHostKey, privateDir } from './credentials.mjs';
+import { runHost, HOST_LIMITS } from './host-run.mjs';
+import { checkAddress, HOST_KEY, USER } from '../../business/src/hosts.mjs';
+import { HOST_ID } from '../../business/src/vocabulary.mjs';
+
+const deny = (code) => {
+  throw new BusError(code);
+};
+const PATH = '/usr/bin:/bin';
+const KILL_WITH_PARENT = ['/usr/bin/setpriv', '--pdeathsig', 'KILL', '--'];
+// E1: the users no enrollment may name. The host writer refuses them again (tools/host/mosaic-keys-write).
+export const RESERVED_USERS = Object.freeze(['root', 'localadmin', 'mosaic-installer']);
+const FINGERPRINT = /^SHA256:[A-Za-z0-9+/]{43}$/;
+// E1: the three key types the keyscan asks for, so any other fingerprint can't match.
+const SCAN_TYPES = 'ed25519,ecdsa,rsa';
+export const INSTALLER_USER = 'mosaic-installer';
+const INSTALLER_AGENT = '@installer';
+const SCAN_MS = 10000;
+
+// X2 step 2: `mosaic-` and the first 32 hex digits of sha256 over business, agent and host id joined
+// with NUL. Names match ID_PATTERN or HOST_ID, neither holds NUL, so the join is one to one.
+export function grantTag(business, agent, hostId) {
+  return 'mosaic-' + createHash('sha256').update([business, agent, hostId].join('\0')).digest('hex').slice(0, 32);
+}
+export const installerTag = (business, hostId) => grantTag(business, INSTALLER_AGENT, hostId);
+
+// The OpenSSH fingerprint of a "<type> <base64>" line: sha256 over the decoded blob.
+export function fingerprint(line) {
+  const blob = Buffer.from(line.split(' ')[1], 'base64');
+  return 'SHA256:' + createHash('sha256').update(blob).digest('base64').replace(/=+$/, '');
+}
+
+// E1's binding. Anything off refuses invalid-request; the broker adds the chief, action and enrolled
+// checks. Returns a fresh object with only the bound keys.
+export function enrollCheck(grant) {
+  const allowed = ['method', 'host', 'address', 'port', 'user', 'sudo', 'fingerprints'];
+  if (!grant || typeof grant !== 'object' || Array.isArray(grant)) deny('invalid-request');
+  const own = Object.keys(grant);
+  if (own.some((k) => !allowed.includes(k)) || allowed.some((k) => !own.includes(k))) deny('invalid-request');
+  if (grant.method !== 'host-enroll') deny('invalid-request');
+  if (typeof grant.host !== 'string' || !HOST_ID.test(grant.host)) deny('invalid-request');
+  try {
+    checkAddress(grant.address, 'grant.address');
+  } catch {
+    deny('invalid-request');
+  }
+  if (!Number.isInteger(grant.port) || grant.port < 1 || grant.port > 65535) deny('invalid-request');
+  if (typeof grant.user !== 'string' || !USER.test(grant.user) || RESERVED_USERS.includes(grant.user)) deny('invalid-request');
+  if (typeof grant.sudo !== 'boolean') deny('invalid-request');
+  const prints = grant.fingerprints;
+  if (!Array.isArray(prints) || prints.length < 1 || prints.length > 3) deny('invalid-request');
+  if (prints.some((f) => typeof f !== 'string' || !FINGERPRINT.test(f)) || new Set(prints).size !== prints.length) deny('invalid-request');
+  return { method: 'host-enroll', host: grant.host, address: grant.address, port: grant.port, user: grant.user, sudo: grant.sudo, fingerprints: [...prints] };
+}
+
+// The keyscan's output lines, "<host> <type> <base64>", as "<type> <base64>". Comment lines and any
+// other type drop out. A key listed twice counts once.
+export function scanLines(stdout) {
+  const keys = [];
+  for (const line of stdout.split('\n')) {
+    if (!line || line.startsWith('#')) continue;
+    const parts = line.trim().split(/\s+/);
+    if (parts.length !== 3) continue;
+    const key = parts[1] + ' ' + parts[2];
+    if (HOST_KEY.test(key) && !keys.includes(key)) keys.push(key);
+  }
+  return keys;
+}
+
+// E1: `ssh-keyscan -T 5 -p <port> -t ed25519,ecdsa,rsa <address>` from the stack host. It reads public
+// keys and logs in to nothing. A scan that can't start refuses host-failed. One that runs and gets no key,
+// as from a host that doesn't answer, returns no lines, so the raise refuses host-key-mismatch
+// (duckworth-0081 N3).
+export function keyscan(address, port, { bin = 'ssh-keyscan', limitMs = SCAN_MS } = {}) {
+  return new Promise((resolve, reject) => {
+    const child = spawn(KILL_WITH_PARENT[0], [...KILL_WITH_PARENT.slice(1), bin, '-T', '5', '-p', String(port), '-t', SCAN_TYPES, '--', address], {
+      env: { PATH },
+      detached: true,
+      stdio: ['ignore', 'pipe', 'ignore'],
+    });
+    const out = [];
+    let size = 0;
+    child.stdout.on('data', (chunk) => {
+      size += chunk.length;
+      if (size <= 65536) out.push(chunk);
+    });
+    const timer = setTimeout(() => {
+      try {
+        process.kill(-child.pid, 'SIGKILL');
+      } catch {}
+    }, limitMs);
+    child.on('error', () => (clearTimeout(timer), reject(new BusError('host-failed'))));
+    child.on('close', () => (clearTimeout(timer), resolve(scanLines(Buffer.concat(out).toString('utf8')))));
+  });
+}
+
+// E1: the scanned set equals the requested set, or host-key-mismatch.
+export function sameFingerprints(lines, prints) {
+  const scanned = new Set(lines.map(fingerprint));
+  return scanned.size === prints.length && prints.every((f) => scanned.has(f));
+}
+
+const run = (bin, args) =>
+  new Promise((resolve, reject) => {
+    const child = spawn(bin, args, { env: { PATH }, stdio: ['ignore', 'ignore', 'ignore'] });
+    child.on('error', () => reject(new BusError('host-failed')));
+    child.on('close', (code) => (code === 0 ? resolve() : reject(new BusError('host-failed'))));
+  });
+
+export function hostGrant({ configDir, runRoot, limits = HOST_LIMITS, scan = keyscan, keygen = 'ssh-keygen' }) {
+  const keyRoot = join(configDir, 'secrets', 'hosts');
+  const keyPath = (business, hostId) => join(keyRoot, business, hostId, 'installer');
+  const readKey = (business, hostId) => {
+    const file = keyPath(business, hostId);
+    for (const dir of [keyRoot, dirname(dirname(file)), dirname(file)]) privateDir(dir);
+    let fd;
+    try {
+      fd = openSync(file, constants.O_RDONLY | constants.O_NOFOLLOW);
+      return parseHostKey(readFileSync(fd, 'utf8'));
+    } catch (e) {
+      if (e instanceof BusError) throw e;
+      deny('credential-file');
+    } finally {
+      if (fd !== undefined) closeSync(fd);
+    }
+  };
+  return {
+    enrollCheck,
+    sameFingerprints,
+    fingerprint,
+    installerTag,
+    keyscan: (address, port) => scan(address, port),
+    // E2 steps 2 and 3. Returns the public line and fingerprint; the private half only reaches the file.
+    async enroll(business, hostId) {
+      mkdirSync(runRoot, { recursive: true, mode: 0o700 });
+      privateDir(runRoot);
+      const dir = mkdtempSync(join(runRoot, 'h-'));
+      try {
+        const tag = installerTag(business, hostId);
+        await run(keygen, ['-q', '-t', 'ed25519', '-N', '', '-C', INSTALLER_USER + '-' + tag.slice('mosaic-'.length), '-f', join(dir, 'key')]);
+        const key = parseHostKey(readFileSync(join(dir, 'key'), 'utf8'));
+        const file = keyPath(business, hostId);
+        mkdirSync(keyRoot, { recursive: true, mode: 0o700 });
+        privateDir(keyRoot);
+        for (const d of [dirname(dirname(file)), dirname(file)]) {
+          if (!privateDir(d, { missing: true })) mkdirSync(d, { mode: 0o700 });
+          privateDir(d);
+        }
+        const tmp = file + '.tmp';
+        try {
+          unlinkSync(tmp);
+        } catch (e) {
+          if (e.code !== 'ENOENT') deny('credential-file');
+        }
+        let fd;
+        try {
+          fd = openSync(tmp, constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | constants.O_NOFOLLOW, 0o600);
+          writeSync(fd, key.text);
+          fsyncSync(fd);
+        } finally {
+          if (fd !== undefined) closeSync(fd);
+        }
+        renameSync(tmp, file);
+        const dirFd = openSync(dirname(file), constants.O_RDONLY);
+        try {
+          fsyncSync(dirFd);
+        } finally {
+          closeSync(dirFd);
+        }
+        return { publicLine: key.publicLine, fingerprint: key.fingerprint, tag };
+      } finally {
+        rmSync(dir, { recursive: true, force: true });
+      }
+    },
+    // The X3 undo and hosts.remove: the installer key and its two dirs, if present.
+    unenroll(business, hostId) {
+      const file = keyPath(business, hostId);
+      for (const f of [file + '.tmp', file]) {
+        try {
+          unlinkSync(f);
+        } catch (e) {
+          if (e.code !== 'ENOENT') deny('credential-file');
+        }
+      }
+      for (const d of [dirname(file), dirname(dirname(file))]) {
+        try {
+          rmdirSync(d);
+        } catch (e) {
+          if (!['ENOENT', 'ENOTEMPTY'].includes(e.code)) deny('credential-file');
+        }
+      }
+    },
+    // E4: `list <user>` as mosaic-installer with the installer key and the pinned host keys. A wrong
+    // pin refuses host-key-mismatch (runHost). Returns the installer fingerprint and the exit.
+    async check(business, hostId, record) {
+      const key = readKey(business, hostId);
+      const entry = { address: record.address, port: record.port, user: INSTALLER_USER, hostKeys: record.hostKeys };
+      const out = await runHost({ root: runRoot, hostId, entry, key, timeout: 30, limits, command: `list ${record.user}` });
+      return { installerFingerprint: key.fingerprint, exit: out.exit };
+    },
+  };
+}
@@ -0,0 +1,260 @@
+// Row 210 (#1707, design D5 to D7): run one sudo command on a registered host over ssh, with the
+// agent's host key handed to a private ssh-agent and never written to disk, argv or env.
+//
+// Each call gets a 0700 dir under <configDir>/secrets/run holding known_hosts (the registry's pinned
+// keys), id.pub, the agent socket and a pids file. ssh-agent and ssh each lead their own process
+// group and run under `setpriv --pdeathsig KILL`, so they die with the bus child. The `finally`
+// kills both groups and removes the dir. If the bus child dies first, sweepRunDir clears the dir
+// at the next start.
+import { spawn } from 'node:child_process';
+import { appendFileSync, existsSync, lstatSync, mkdirSync, mkdtempSync, readdirSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { BusError } from './broker.mjs';
+
+const deny = (code) => {
+  throw new BusError(code);
+};
+const KILL_WITH_PARENT = ['/usr/bin/setpriv', '--pdeathsig', 'KILL', '--'];
+const PATH = '/usr/bin:/bin';
+// Linux sun_path holds 108 bytes with the NUL.
+const SOCKET_MAX = 107;
+const RUN_DIR = /^h-[A-Za-z0-9]{6}$/;
+export const HOST_LIMITS = Object.freeze({ outputMax: 1024 * 1024, graceMs: 5000, agentWaitMs: 5000 });
+
+// D6: each element POSIX single-quoted, so the remote shell hands sudo exactly these strings.
+export const quote = (element) => "'" + element.replaceAll("'", "'\\''") + "'";
+export const remoteCommand = (argv) => ['sudo', '-n', '--', ...argv.map(quote)].join(' ');
+
+// D7 step 4: every option set here, nothing read from a config file.
+export function sshArgs({ hostId, address, port, user, dir }) {
+  const o = (x) => ['-o', x];
+  return [
+    // ssh's own messages go to the run dir's log, apart from the remote command's stderr (N3).
+    '-F', '/dev/null', '-T', '-E', join(dir, 'ssh.log'), '-p', String(port),
+    ...o('BatchMode=yes'), ...o('IdentitiesOnly=yes'), ...o(`IdentityFile=${join(dir, 'id.pub')}`),
+    ...o(`IdentityAgent=${join(dir, 'a.sock')}`),
+    ...o('StrictHostKeyChecking=yes'), ...o(`UserKnownHostsFile=${join(dir, 'known_hosts')}`),
+    ...o('GlobalKnownHostsFile=/dev/null'),
+    ...o(`HostKeyAlias=mosaic-host-${hostId}`), ...o('UpdateHostKeys=no'), ...o('CheckHostIP=no'), ...o('VerifyHostKeyDNS=no'),
+    ...o('ForwardAgent=no'), ...o('ForwardX11=no'), ...o('ClearAllForwardings=yes'), ...o('PermitLocalCommand=no'),
+    ...o('ProxyCommand=none'), ...o('ProxyJump=none'), ...o('ControlMaster=no'), ...o('ControlPath=none'),
+    ...o('ConnectTimeout=10'), ...o('ServerAliveInterval=15'), ...o('ServerAliveCountMax=3'),
+    '-l', user, '--', address,
+  ];
+}
+
+// Field 22 of /proc/<pid>/stat, the start time in clock ticks, or null. The comm field may hold
+// spaces and parentheses, so the count starts after the last ")" (field 2's end).
+export function startTime(pid) {
+  try {
+    const stat = readFileSync(`/proc/${pid}/stat`, 'utf8');
+    return stat.slice(stat.lastIndexOf(')') + 2).split(' ')[19] ?? null;
+  } catch {
+    return null;
+  }
+}
+const alive = (pid, start) => start !== null && startTime(pid) === start;
+const record = (dir, pid) => appendFileSync(join(dir, 'pids'), `${pid} ${startTime(pid)}\n`, { mode: 0o600 });
+const group = (child, signal) => {
+  if (!child?.pid) return;
+  try {
+    process.kill(-child.pid, signal);
+  } catch {}
+};
+const start = (bin, args, env, stdio) =>
+  spawn(KILL_WITH_PARENT[0], [...KILL_WITH_PARENT.slice(1), bin, ...args], { env, detached: true, stdio });
+
+// The run root is the stack instance's user's own, like the credential store.
+function runRoot(root) {
+  mkdirSync(root, { recursive: true, mode: 0o700 });
+  const st = lstatSync(root);
+  if (!st.isDirectory() || st.uid !== process.getuid() || (st.mode & 0o077) !== 0) deny('credential-file');
+  return root;
+}
+
+// Waits for ssh-agent's socket, or for the agent to exit first.
+async function waitForSocket(agent, sock, limitMs) {
+  const until = Date.now() + limitMs;
+  while (!existsSync(sock)) {
+    if (agent.exitCode !== null || agent.signalCode !== null || Date.now() > until) deny('host-failed');
+    await new Promise((r) => setTimeout(r, 20));
+  }
+}
+
+// Runs ssh-add with the key on its stdin; resolves on exit 0. A hung ssh-add is killed at
+// `limitMs` (host-failed) or on abort (credential-unavailable), so a revoke or a stuck agent
+// never holds the host busy (N2).
+export function addKey(sock, text, lifetime, { limitMs = HOST_LIMITS.agentWaitMs, signal = null } = {}) {
+  return new Promise((resolve, reject) => {
+    if (signal?.aborted) return reject(new BusError('credential-unavailable'));
+    const add = start('ssh-add', ['-q', '-t', String(lifetime), '-'], { PATH, SSH_AUTH_SOCK: sock }, ['pipe', 'ignore', 'ignore']);
+    const stop = (code) => {
+      group(add, 'SIGKILL');
+      reject(new BusError(code));
+    };
+    const timer = setTimeout(() => stop('host-failed'), limitMs);
+    const abort = () => stop('credential-unavailable');
+    signal?.addEventListener('abort', abort, { once: true });
+    const settle = () => {
+      clearTimeout(timer);
+      signal?.removeEventListener('abort', abort);
+    };
+    add.stdin.on('error', () => {});
+    add.stdin.end(text);
+    add.on('error', () => (settle(), reject(new BusError('host-failed'))));
+    add.on('close', (code) => (settle(), code === 0 ? resolve() : reject(new BusError('host-failed'))));
+  });
+}
+
+// ssh itself: stdin written once, stdout and stderr each kept to outputMax and drained past it.
+function runSsh(args, stdin, timeoutMs, signal, limits, onSpawn) {
+  return new Promise((resolve, reject) => {
+    const began = Date.now();
+    const ssh = start('ssh', args, { PATH }, ['pipe', 'pipe', 'pipe']);
+    onSpawn(ssh);
+    const streams = { stdout: [], stderr: [] };
+    const sizes = { stdout: 0, stderr: 0 };
+    const truncated = { stdout: false, stderr: false };
+    for (const name of ['stdout', 'stderr'])
+      ssh[name].on('data', (chunk) => {
+        const room = limits.outputMax - sizes[name];
+        if (chunk.length > room) truncated[name] = true;
+        if (room > 0) {
+          streams[name].push(chunk.subarray(0, room));
+          sizes[name] += Math.min(room, chunk.length);
+        }
+      });
+    ssh.stdin.on('error', () => {});
+    ssh.stdin.end(stdin);
+    let timedOut = false;
+    let kill = null;
+    const term = setTimeout(() => {
+      timedOut = true;
+      group(ssh, 'SIGTERM');
+      kill = setTimeout(() => group(ssh, 'SIGKILL'), limits.graceMs);
+    }, timeoutMs);
+    const abort = () => group(ssh, 'SIGKILL');
+    signal?.addEventListener('abort', abort, { once: true });
+    const settle = (fn) => {
+      clearTimeout(term);
+      clearTimeout(kill);
+      signal?.removeEventListener('abort', abort);
+      fn();
+    };
+    ssh.on('error', () => settle(() => reject(new BusError('host-failed'))));
+    ssh.on('close', (code, sig) =>
+      settle(() =>
+        resolve({
+          exit: code,
+          signal: sig ?? (timedOut ? 'SIGTERM' : null),
+          stdout: Buffer.concat(streams.stdout).toString('utf8'),
+          stderr: Buffer.concat(streams.stderr).toString('utf8'),
+          truncated,
+          ms: Date.now() - began,
+        }),
+      ),
+    );
+  });
+}
+
+// D7: one call. `key` is the parsed entry from credentials.mjs (text and publicLine); `entry` is
+// the registry's { address, port, user, hostKeys }. `root` is <configDir>/secrets/run.
+// Row 234 (#1740): `command`, when set, is sent as is in place of the sudo argv. The installer key's
+// forced command reads it (tools/host/mosaic-keys).
+export async function runHost({ root, hostId, entry, key, argv, stdin, timeout, signal = null, limits = HOST_LIMITS, command = null }) {
+  if (signal?.aborted) deny('credential-unavailable');
+  const dir = mkdtempSync(join(runRoot(root), 'h-'));
+  const sock = join(dir, 'a.sock');
+  let agent = null,
+    ssh = null;
+  try {
+    if (Buffer.byteLength(sock) > SOCKET_MAX) deny('host-failed');
+    writeFileSync(join(dir, 'known_hosts'), entry.hostKeys.map((k) => `mosaic-host-${hostId} ${k}\n`).join(''), { mode: 0o600, flag: 'wx' });
+    writeFileSync(join(dir, 'id.pub'), key.publicLine + '\n', { mode: 0o600, flag: 'wx' });
+    writeFileSync(join(dir, 'pids'), `${process.pid} ${startTime(process.pid)}\n`, { mode: 0o600, flag: 'wx' });
+    agent = start('ssh-agent', ['-D', '-a', sock], { PATH }, ['ignore', 'ignore', 'ignore']);
+    agent.on('error', () => {});
+    if (agent.pid) record(dir, agent.pid);
+    await waitForSocket(agent, sock, limits.agentWaitMs);
+    // D7 step 3: the agent drops the key at the call's limit plus 30 s even if nothing else runs.
+    await addKey(sock, key.text, timeout + 30, { limitMs: limits.agentWaitMs, signal });
+    if (signal?.aborted) deny('credential-unavailable');
+    const out = await runSsh(
+      [...sshArgs({ hostId, ...entry, dir }), command ?? remoteCommand(argv)],
+      stdin,
+      timeout * 1000,
+      signal,
+      limits,
+      (child) => {
+        ssh = child;
+        if (child.pid) record(dir, child.pid);
+      },
+    );
+    if (signal?.aborted) deny('credential-unavailable');
+    // Only ssh writes its log, so a remote command that prints the same text can't fake a pin
+    // refusal. On ssh's own exit 255 the agent still gets its message, after the remote stderr.
+    const log = out.exit === 255 && existsSync(join(dir, 'ssh.log')) ? readFileSync(join(dir, 'ssh.log'), 'utf8').slice(0, 4096) : '';
+    if (log.includes('Host key verification failed')) deny('host-key-mismatch');
+    if (log && !out.truncated.stderr) out.stderr += log;
+    return out;
+  } finally {
+    group(ssh, 'SIGKILL');
+    group(agent, 'SIGKILL');
+    rmSync(dir, { recursive: true, force: true });
+  }
+}
+
+// D7 step 6, at bus start before broker.sock listens. A dir whose bus pid is gone gets each of its
+// live recorded processes that names the dir killed, then is removed. A dir whose bus is alive is
+// left alone. Any entry that isn't a run dir refuses start.
+export function sweepRunDir(root) {
+  let names;
+  try {
+    names = readdirSync(root);
+  } catch (e) {
+    if (e.code === 'ENOENT') return { removed: [] };
+    deny('credential-file');
+  }
+  runRoot(root);
+  const removed = [];
+  for (const name of names) {
+    const dir = join(root, name);
+    const st = lstatSync(dir);
+    if (!RUN_DIR.test(name) || !st.isDirectory() || st.uid !== process.getuid()) deny('credential-file');
+    let lines = [];
+    try {
+      lines = readFileSync(join(dir, 'pids'), 'utf8').split('\n').filter(Boolean).map((l) => l.split(' '));
+    } catch {}
+    const [bus, ...children] = lines;
+    if (bus && alive(Number(bus[0]), bus[1])) continue;
+    for (const [pid, at] of children) {
+      if (!alive(Number(pid), at)) continue;
+      let cmdline = '';
+      try {
+        cmdline = readFileSync(`/proc/${pid}/cmdline`, 'utf8');
+      } catch {}
+      if (cmdline.includes(dir)) {
+        try {
+          process.kill(Number(pid), 'SIGKILL');
+        } catch {}
+      }
+    }
+    rmSync(dir, { recursive: true, force: true });
+    removed.push(name);
+  }
+  return { removed };
+}
+
+// The broker's executor (design D5): withHost beside withGitea, the key used only through useFor.
+export function hostExecutor({ credentials, root, limits = HOST_LIMITS }) {
+  return {
+    busy: (session, hostId) => credentials.busy(session.business + '/' + session.role, 'host.' + hostId),
+    run: (session, hostId, entry, { argv, stdin, timeout }) =>
+      credentials.useFor(
+        session,
+        'host.' + hostId,
+        (_token, { key, signal }) => runHost({ root, hostId, entry, key, argv, stdin, timeout, signal, limits }),
+        { input: { argv, stdin } },
+      ),
+  };
+}
@@ -0,0 +1,35 @@
+-- Row 234 (#436a row a, #1740): enrolled hosts and host grants live in the store, written only by
+-- the grant executor, hosts.check, hosts.remove and revoke, each in the transaction of its event.
+-- A grant event is an action.allowed whose body.action or body.operation is grant.*; the trigger
+-- refuses one unless the actor is (NULL, 'grant'), the broker's own grant writer (#436b section 7).
+CREATE TABLE hosts (
+  business TEXT NOT NULL,
+  host TEXT NOT NULL,
+  address TEXT NOT NULL,
+  port INTEGER NOT NULL CHECK (port BETWEEN 1 AND 65535),
+  user TEXT NOT NULL,
+  sudo INTEGER NOT NULL CHECK (sudo IN (0,1)),
+  host_keys TEXT NOT NULL CHECK (json_valid(host_keys) AND json_type(host_keys) = 'array' AND json_array_length(host_keys) > 0),
+  installer_fingerprint TEXT,
+  state TEXT NOT NULL CHECK (state IN ('pending-install','ready')),
+  decision TEXT NOT NULL REFERENCES decisions(id),
+  checked_at TEXT,
+  PRIMARY KEY (business, host),
+  CHECK (state = 'pending-install' OR (installer_fingerprint IS NOT NULL AND checked_at IS NOT NULL))
+) STRICT;
+CREATE TABLE host_grants (
+  business TEXT NOT NULL,
+  agent TEXT NOT NULL,
+  host TEXT NOT NULL,
+  commands TEXT NOT NULL CHECK (json_valid(commands) AND json_type(commands) = 'array' AND json_array_length(commands) > 0),
+  rotate_by TEXT NOT NULL,
+  tag TEXT NOT NULL CHECK (length(tag) = 39 AND tag GLOB 'mosaic-*' AND NOT substr(tag, 8) GLOB '*[^0-9a-f]*'),
+  decision TEXT NOT NULL REFERENCES decisions(id),
+  PRIMARY KEY (business, agent, host),
+  FOREIGN KEY (business, host) REFERENCES hosts(business, host)
+) STRICT;
+CREATE TRIGGER events_grant_actor BEFORE INSERT ON events
+  WHEN NEW.kind = 'action.allowed'
+    AND (json_extract(NEW.body, '$.action') GLOB 'grant.*' OR json_extract(NEW.body, '$.operation') GLOB 'grant.*')
+    AND NOT (NEW.actor_role IS NULL AND NEW.actor_run IS 'grant')
+  BEGIN SELECT RAISE(ABORT, 'only the grant writer records grant events'); END;
@@ -25,10 +25,6 @@ const LAUNCH_OPS = new Set([
  'mayLaunch',
  'landHolders',
  'landRelease',
-  'lifecycleRequests',
-  'lifecycleTake',
-  'lifecycleDelete',
-  'lifecycleDone',
 ]);
 function launchOp(m) {
  if (m.op === 'identity') return runtime.identity(m.cap);
@@ -59,11 +55,6 @@ function launchOp(m) {
  // role run started before its decision was resolved.
  if (m.op === 'landHolders') return runtime.landHolders(m.business);
  if (m.op === 'landRelease') return runtime.landRelease(m.record);
-  // Row 194 (#1692, D1.1): the launcher's lifecycle pass.
-  if (m.op === 'lifecycleRequests') return runtime.lifecycleRequests(m.business);
-  if (m.op === 'lifecycleTake') return runtime.lifecycleTake(m.record);
-  if (m.op === 'lifecycleDelete') return runtime.lifecycleDelete(m.record);
-  if (m.op === 'lifecycleDone') return runtime.lifecycleDone(m.record);
  if (m.op === 'credentialStatus') return runtime.credentialStatus(m.business, m.role);
  // Every LAUNCH_OPS name has its line above. A missing one used to answer as credentialStatus,
  // whose [] for an unknown role read as "no holders" for landHolders (row 156 mutant P02).
@@ -12,14 +12,11 @@ import { publishRemote, workingRepo, WorkingError } from '../../seat/src/working
 import { createLoader, hasModule } from '../../plugins/src/loader.mjs';
 import { pluginSettings } from '../../business/src/plugin-settings.mjs';
 import { instanceSettings } from '../../business/src/instance-settings.mjs';
-import { organizationWriter, OrganizationError } from '../../business/src/organization.mjs';
+import { organizationWriter } from '../../business/src/organization.mjs';
 import { credentialVerbs } from './credential-verbs.mjs';
-import { loadBusiness } from '../../business/src/business.mjs';
-import { loadRole } from '../../business/src/role.mjs';
-import { resolveInstance } from '../../business/src/resolve.mjs';
-import { canonicalJson } from '../../business/src/util.mjs';
-import { busBusiness } from './business.mjs';
 import { webService } from './web.mjs';
+import { hostExecutor, sweepRunDir } from './host-run.mjs';
+import { hostGrant } from './host-grant.mjs';
 import { verifyHuman } from './human.mjs';
 import { createUsage } from './usage.mjs';
 import { createLimits } from './limits.mjs';
@@ -99,50 +96,23 @@ export async function startBroker({
    ];
    // Row 199 (#1697, design D1): the per-agent store is <configDir>/secrets/agents.
    const storeRoot = organization ? join(organization.dir, 'secrets', 'agents') : null;
-    credentials = new Credentials({ references, repoRoots: protectedRoots, dataRoot, storeRoot });
    store = new Store(dataRoot);
+    // Row 234 (#1740, r6 X4 third bullet): each host grant record gives its agent a store reference to
+    // host.<id>, so a restart finds the keys the grant executor wrote. The loader refuses host.<id> in a
+    // role's credentials, so these never meet a business-file reference.
+    for (const g of store.all('SELECT business, agent, host, rotate_by FROM host_grants ORDER BY business, agent, host')) {
+      if (!Object.hasOwn(businesses, g.business)) continue;
+      const refs = (references[g.business + '/' + g.agent] = { ...(references[g.business + '/' + g.agent] ?? {}) });
+      refs['host.' + g.host] = { store: true, file: storeRoot ? join(storeRoot, g.business, g.agent, 'host.' + g.host) : null, rotateBy: g.rotate_by };
+    }
+    credentials = new Credentials({ references, repoRoots: protectedRoots, dataRoot, storeRoot });
    // vikunja:19/305: the plug-in switch through the same human-only path as the limits: the verbs
    // plugins and plugins.set, logged in changes.jsonl with the actor, a missing module refused.
    const plugins=organization?pluginSettings({dir:organization.dir,rolesDir:organization.rolesDir,exists:hasModule}):null;
    const levels=organization?await harnessLevels():()=>null;
    const settings=organization?launchSettings({...organization,sessions:()=>readSessions(dataRoot),levels}):null;
-    // Row 194 (#1692, brief item 8, row 199 D13): a fire or a delete revokes the agent's credentials
-    // after the writer's checks and before its write. Fire revokes each service of the entry and keeps
-    // the store directory, delete calls remove (sage-1593). A service the running bus doesn't know (an
-    // agent created since the start) has nothing in memory, so it goes on, and then no token or tmp
-    // file may remain in the agent's store directory (sage-1592). Any failure stops the verb with the
-    // file unchanged.
-    const revokeFailed = (message) => new OrganizationError('credential-revoke-failed', message);
-    function revoke(business, agent, how, services) {
-      const instance = business + '/' + agent;
-      const outside = [];
-      try {
-        if (how === 'delete' && storeRoot) credentials.remove(instance);
-        else
-          for (const service of services) {
-            try {
-              if (!credentials.revoke(instance, service).file) outside.push(service);
-            } catch (e) {
-              if (e.code !== 'credential-unknown') throw e;
-            }
-          }
-      } catch (e) {
-        throw revokeFailed(`${agent}: ${e.code ?? 'credential-file'}`);
-      }
-      if (storeRoot) {
-        let left = [];
-        try {
-          left = readdirSync(join(storeRoot, business, agent));
-        } catch (e) {
-          if (e.code !== 'ENOENT') throw revokeFailed(`${agent}: store directory can't be read`);
-        }
-        if (left.length > 0) throw revokeFailed(`${agent}: ${left.sort().join(' and ')} still in the store`);
-      }
-      // A file or env reference outside the store keeps its token for a restart (row 199 section 6).
-      return { revoked: services, outsideStore: how === 'fire' ? outside : [] };
-    }
    // Row 165 (#1662): the human adds and changes role instances through instances and instances.set.
-    const instances=organization?instanceSettings({dir:organization.dir,rolesDir:organization.rolesDir,system:organization.system,levels,revoke}):null;
+    const instances=organization?instanceSettings({dir:organization.dir,rolesDir:organization.rolesDir,system:organization.system,levels}):null;
    const usage = await createUsage({ store, dataRoot, businesses,
      log: entry => process.stderr.write(`usage: ${JSON.stringify(entry)}\n`) });
    // Row 125 (#1619, REQ-LIMIT-3, REQ-LIMIT-4): the limit checks read the organization file at
@@ -151,47 +121,10 @@ export async function startBroker({
    const limits = createLimits({ store, read: id => settings ? settings.current(id) : businesses[id], log: limitLog });
    for (const id of Object.keys(businesses)) await limits.refresh(id);
    const withTokens = (id, result) => ({ ...result, tokens: limits.report(id) });
-    // Row 194 (#1692, D3): after every write that commits, the broker takes the business as a restart
-    // would load it. The credential references, the project roots the Credentials store protects
-    // and the tracker bots are fixed at start (the Credentials store, the tasks adapter), so a file
-    // whose references, roots or bots differ from the boot copy isn't reloaded, and the write
-    // answers restart: true. Hire adds neither. A human create of a credentialed definition adds
-    // references, so it answers restart: true, and issue works after the restart (brief item 7).
-    // A role not in the boot copy matches only with no references and no bot. A reference compares
-    // by its kind and path only: row 199's issue rewrites the date in the file outside this reload,
-    // Credentials keeps its own copy of the date, and the broker never reads it.
-    const fixedRef = ({ file, env, store }) => ({ file, env, store });
-    const fixedRole = r => canonicalJson({
-      credentials: Object.fromEntries(Object.entries(r?.credentials ?? {}).map(([service, ref]) => [service, fixedRef(ref)])),
-      tracker: r?.tracker ?? null,
-    });
-    const fixedAtStart = b => ({
-      roles: Object.fromEntries(Object.entries(b.roles).map(([role, r]) => [role, fixedRole(r)])),
-      sync: canonicalJson(b.tracker?.sync ?? null),
-      roots: canonicalJson(Object.values(b.projects ?? {}).map(p => p.root).sort()),
-    });
-    const sameFixed = (boot, b) => fixedAtStart(b).sync === boot.sync && fixedAtStart(b).roots === boot.roots
-      && Object.entries(fixedAtStart(b).roles).every(([role, f]) => f === (boot.roles[role] ?? fixedRole(null)));
-    const booted = new Map(Object.entries(businesses).map(([id, b]) => [id, fixedAtStart(b)]));
-    const reloadLog = entry => process.stderr.write(`organization: ${JSON.stringify(entry)}\n`);
-    function reload(id) {
-      try {
-        const b = loadBusiness(id, { dir: organization.dir, rolesDir: organization.rolesDir });
-        const resolved = {};
-        for (const instance of Object.keys(b.roles)) resolved[instance] = resolveInstance({ system: organization.system, business: b, instance });
-        const next = busBusiness(b, resolved);
-        if (!sameFixed(booted.get(id), next)) {
-          reloadLog({ event: 'reload-needs-restart', business: id });
-          return false;
-        }
-        broker.reloadBusiness(id, next);
-        return true;
-      } catch (e) {
-        reloadLog({ event: 'reload-failed', business: id, message: e.message });
-        return false;
-      }
-    }
+    // Row 210 (#1707, design D7 step 6) and row 234 (#1740, r6 E2): the run dir and the host enrollment half.
+    const runRoot = organization ? join(organization.dir, 'secrets', 'run') : null;
    const broker = new Broker({
+      hostGrant: runRoot ? hostGrant({ configDir: organization.dir, runRoot }) : null,
      usage,
      limits,
      store,
@@ -206,32 +139,19 @@ export async function startBroker({
      },
      // limits and limits.set (organization.set is limits.set) carry each token limit's count; a
      // plugins.set reloads the business's limit checks in the background.
-      organization:settings?(id,verb,args,actor,context)=>{
+      organization:settings?(id,verb,args,actor)=>{
        if(verb==='limits')return withTokens(id,settings.read(id));
+        if(verb==='limits.set')return withTokens(id,settings.set(id,args,actor));
        if(verb==='plugins')return plugins.read(id);
        if(verb==='instances')return instances.read(id);
+        if(verb==='instances.set')return instances.set(id,args,actor);
        // Row 65 (mos-0840): the Console's routing table.
        if(verb==='routes')return settings.routes(id);
-        // Row 194 (#1692, V5): a delete's checks at the verb, with no write and no reload.
-        if(verb==='instances.check')return instances.checkDelete(id,args.instance);
-        let result;
-        if(verb==='limits.set')result=withTokens(id,settings.set(id,args,actor));
-        else if(verb==='instances.set')result=instances.set(id,args,actor);
-        else if(verb==='routes.set')result=settings.setRoutes(id,args,actor);
-        else if(verb==='plugins.set')result=plugins.set(id,args,actor);
-        // Row 194 (#1692, V6): the human's keep and noHire lists, through the instance writer.
-        else if(verb==='veto.set')result=instances.veto(id,args,actor);
-        // Row 194 (D2.1, D2.2): the chief's hire and fire, with the reason in the change context.
-        else if(verb==='instance.hire')result=instances.hire(id,args,{actor,context});
-        else if(verb==='instance.fire')result=instances.fire(id,{name:args.name},{actor,context});
-        else throw new BusError('invalid-request');
-        // Row 194 (D3 item 2): one reload, after every verb that committed, then the limit checks.
-        const live=reload(id);
+        if(verb==='routes.set')return settings.setRoutes(id,args,actor);
+        const result=plugins.set(id,args,actor);
        limits.refresh(id).catch(e=>limitLog({event:'limit-refresh-failed',business:id,message:e.message}));
-        return verb==='instances.set'?{...result,restart:!live}:result;
+        return result;
      }:null,
-      // Row 194 (D2.3): the role files as they stand, for the hire checks.
-      roleFile: organization ? (name) => loadRole(organization.rolesDir, name) : null,
      secretCheck: (value) => credentials.assertClean(value),
      credentialStatus: () => credentials.status(),
      // Row 199 (#1697, design section 6): issue, rotate, revoke and delete, live with no restart; each
@@ -249,15 +169,6 @@ export async function startBroker({
          return false;
        }
      },
-      // Row 194 (#1692, D4.1, B8): bus.tester as the file sets it now; an unreadable file is off.
-      testerOn: (id) => {
-        try {
-          const b = settings ? settings.current(id) : businesses[id];
-          return b?.vars?.['bus.tester'] === true;
-        } catch {
-          return false;
-        }
-      },
    });
    // Process identities must be supplied for every managed run when using the human transport.
    const launchRecords = [];
@@ -281,9 +192,14 @@ export async function startBroker({
        throw new BusError('invalid-adapter');
    }
    const web = await webServices(businesses);
+    // Row 210 (#1707, design D7 step 6): clear what a killed bus child left, before anyone can call.
+    if (runRoot) sweepRunDir(runRoot);
+    // Row 234 (r6 X3): end the enrollments a killed bus child left, before anyone can call.
+    broker.reconcileGrants();
    const path = join(store.directory, 'broker.sock');
    server = await serve({
      web: (business) => web.get(business) ?? null,
+      host: runRoot ? hostExecutor({ credentials, root: runRoot }) : null,
      tasks: adapter ? { handle: adapter.handle, timeout: adapter.timeout } : null,
      broker,
      path,
@@ -354,9 +270,42 @@ export async function startBroker({
          if (!(e instanceof BusError)) process.stderr.write(`bus: publish git-failed: ${JSON.stringify({ name: e?.name, code: e?.code })}\n`);
          Object.assign(entry, { state: 'refused', code: e instanceof BusError ? e.code : 'git-failed' });
        },
-      );
+      ).then(() => {
+        if (entry.held) settle(ticket, entry, entry.held);
+      });
      return { state: 'running' };
    }
+    // Row 242 (#1748): the git socket gave up on a publish (publish-timeout) whose push it never
+    // collected. Its publishRefused waits for the push: until that ends the ticket stays open, so
+    // checkPublish refuses another publish on the decision with publish-busy (row 237). A push that
+    // reached the fork is then recorded, which spends the decision; one that didn't is filed with
+    // the socket's code. Either way the decision can't push a second ref.
+    function settle(ticket, entry, code) {
+      remotes.delete(ticket);
+      try {
+        if (entry.state === 'pushed') {
+          try {
+            broker.recordPublish(ticket, { ref: entry.ref, commit: entry.commit, previous: entry.previous });
+            process.stderr.write(`bus: publish ${ticket}: pushed after the git socket refused ${code}; recorded\n`);
+            return;
+          } catch (e) {
+            if (!(e instanceof BusError)) throw e;
+            code = e.code;
+          }
+        }
+        broker.publishRefused(ticket, { code });
+      } catch (e) {
+        process.stderr.write(`bus: publish ${ticket}: not settled: ${JSON.stringify({ name: e?.name, code: e?.code })}\n`);
+      }
+    }
+    function publishRefused(ticket, args) {
+      const entry = remotes.get(ticket);
+      if (!entry) return broker.publishRefused(ticket, args);
+      if (!/^[a-z-]{1,64}$/.test(args?.code ?? '')) throw new BusError('invalid-request');
+      if (entry.state === 'running') entry.held = args.code;
+      else settle(ticket, entry, args.code);
+      return args.code;
+    }
    function publishResult(ticket) {
      const entry = remotes.get(ticket);
      if (!entry) throw new BusError('publish-unknown');
@@ -393,16 +342,11 @@ export async function startBroker({
      publishPush,
      publishResult,
      recordPublish: (ticket, pushed) => broker.recordPublish(ticket, pushed),
-      publishRefused: (ticket, args) => broker.publishRefused(ticket, args),
+      publishRefused,
      landHeld: (record) => broker.landHeld(record),
      // Row 156 (#1651): the launcher's landing pass.
      landHolders: (business) => broker.landHolders(business),
      landRelease: (r) => broker.landRelease(r),
-      // Row 194 (#1692, D1.1): the launcher's lifecycle pass.
-      lifecycleRequests: (business) => broker.lifecycleRequests(business),
-      lifecycleTake: (r) => broker.lifecycleTake(r),
-      lifecycleDelete: (r) => broker.lifecycleDelete(r),
-      lifecycleDone: (r) => broker.lifecycleDone(r),
      refuse: (cap, code, subject) => broker.refuse(cap, code, subject),
      credentialStatus,
      launches: bound,
@@ -1,6 +1,6 @@
 import { createServer } from 'node:net';
 import { lstatSync, chmodSync, unlinkSync } from 'node:fs';
-import { BusError, TASK_VERBS, WEB_VERBS, PROJECT_FILE_VERBS, PROJECT_SAVE_VERB, PROJECT_SAVE_REQUEST_MAX } from './broker.mjs';
+import { BusError, TASK_VERBS, WEB_VERBS, HOST_VERBS, HOSTS_VERBS, PROJECT_FILE_VERBS, PROJECT_SAVE_VERB, PROJECT_SAVE_REQUEST_MAX } from './broker.mjs';
 const LIMIT = 65536;
 // Row 148: a document save may carry up to 1 MiB of text. Only a request that names that verb near
 // its start (the proof object comes first) may pass LIMIT; the parsed verb is checked again below.
@@ -9,8 +9,10 @@ const SAVE_VERB_AT_START = new RegExp(`"verb":"${PROJECT_SAVE_VERB.replaceAll('.
 // `tasks` ({handle, timeout}) is the trusted S3 adapter; only the eight task verbs reach it.
 // `web` is the trusted web service (web.mjs), or a function from a business id to one (or null); only
 // the web verbs reach it, and without one they refuse web-not-configured (or web-not-granted).
+// `host` (row 210) is the trusted host.run executor (host-run.mjs), or null: host.run then refuses
+// host-not-configured.
 // A request carries exactly one of cap, human (row S4) and tester (row 110) proof.
-export async function serve({ broker, path, authenticateHuman = null, authenticateTester = null, timeout = 5000, tasks = null, web = null }) {
+export async function serve({ broker, path, authenticateHuman = null, authenticateTester = null, timeout = 5000, tasks = null, web = null, host = null }) {
  try {
    lstatSync(path);
    throw new BusError('socket-exists');
@@ -102,10 +104,29 @@ export async function serve({ broker, path, authenticateHuman = null, authentica
            });
          return;
        }
+        // Row 210 (#1707, design D5): a sudo command can run for minutes. As for web, the longer wait
+        // goes only to a call the broker admitted: the call's own limit plus 10 s.
+        if (HOST_VERBS.includes(r.verb)) {
+          const own = transient;
+          transient = null;
+          broker
+            .requestHost(cap, { verb: r.verb, args: r.args ?? {} }, host, { onAdmit: (ms) => socket.setTimeout(ms + 10000) })
+            .then(
+              (result) => finish({ ok: true, result }),
+              (e) => finish({ ok: false, error: e instanceof BusError ? e.code : 'host-failed' }),
+            )
+            .finally(() => {
+              if (own) broker.disconnect(own);
+            });
+          return;
+        }
        // Row138: only project Git effects need an await; preserve every other sync path below.
        if (r.verb === 'usage.begin' || r.verb === 'usage.end' ||
            r.verb === 'spec.read' || r.verb === 'record.write' || PROJECT_FILE_VERBS.includes(r.verb) ||
-            (r.verb === 'decision.raise' && (Object.hasOwn(r.args ?? {}, 'spec_path') || Object.hasOwn(r.args ?? {}, 'spec_commit')))) {
+            // Row 234 (#1740): a grant raise awaits its keyscan, and hosts.check its ssh.
+            HOSTS_VERBS.includes(r.verb) ||
+            (r.verb === 'decision.raise' && (Object.hasOwn(r.args ?? {}, 'spec_path') || Object.hasOwn(r.args ?? {}, 'spec_commit') ||
+              Object.hasOwn(r.args ?? {}, 'grant')))) {
          const own = transient;
          transient = null;
          // Local Git may take 100 seconds; keep its result beyond the ordinary idle deadline.
@@ -13,8 +13,8 @@ import { join, isAbsolute } from 'node:path';
 import { createHash } from 'node:crypto';

 const ddl = readFileSync(new URL('../schema.sql', import.meta.url), 'utf8');
-export const SCHEMA_SHA256 = '6cde5232c57ac04dc6073112c0830c89cfc5e953d7a5727e7716263747fe8737';
-export const SCHEMA_VERSION = '3i';
+export const SCHEMA_SHA256 = '0a7b633ce7eec9d0bb37c3255f4244d97bd0c8eac38db91a11b4ef6cc982ec8c';
+export const SCHEMA_VERSION = '3j';
 // Ordered, named offline steps. New schema changes append a step and keep prior DDL pinned.
 const legacyDDL = readFileSync(new URL('./migrations/3b.sql', import.meta.url), 'utf8');
 const LEGACY_SHA256 = '179ffe356d4ff19a49b5ebad39b6c6bfd7771deb8e1b7c55b5e746f039d69e65';
@@ -56,6 +56,11 @@ const migrations = [{
  from: '3h',
  to: '3i',
  sql: readFileSync(new URL('./migrations/3h-3i.sql', import.meta.url), 'utf8'),
+}, {
+  // Row 234 (#1740): enrolled hosts, host grants and the grant event guard. Only new objects.
+  from: '3i',
+  to: '3j',
+  sql: readFileSync(new URL('./migrations/3i-3j.sql', import.meta.url), 'utf8'),
 }];
 const timedTables = [
  'events',
@@ -69,6 +69,7 @@ async function engine(root, name, { store, schema, step = (s) => s }) {
  for (const file of ['3b.sql', '3b-3c.sql', '3c-3d.sql', '3d-3e.sql', '3e-3f.sql', '3f-3g.sql', '3g-3h.sql'])
    copyFileSync(here('../src/migrations/' + file), join(moduleRoot, 'src/migrations', file));
  writeFileSync(join(moduleRoot, 'src/migrations/3h-3i.sql'), step(readFileSync(here('../src/migrations/3h-3i.sql'), 'utf8')));
+  copyFileSync(here('../src/migrations/3i-3j.sql'), join(moduleRoot, 'src/migrations/3i-3j.sql'));
  return (await import(pathToFileURL(join(moduleRoot, 'src/store.mjs')))).Store;
 }

@@ -76,7 +77,7 @@ test('REQ-LIMIT-4 3h copy migrates to 3i: every row keeps its seq, the sequence
  const { root, path } = source3h(t), before = snapshot(path), was = master(path);
  assert.throws(() => new Store(root), /schema-mismatch/);
  new Store(root, { migrateSchema: true }).close();
-  assert.equal(version(path), '3i');
+  assert.equal(version(path), '3j');
  // Every table's rows as they were, usage_records with its seq values and sqlite_sequence with 50.
  assert.deepEqual(snapshot(path, before.columns).rows, before.rows);
  assert.deepEqual(before.rows.usage_records.map(r => r.seq), [1, 2, 3]);
@@ -84,7 +85,9 @@ test('REQ-LIMIT-4 3h copy migrates to 3i: every row keeps its seq, the sequence
  // sqlite_master as at 3h, the account line aside: same tables, indexes and triggers, same text.
  const old = '  account TEXT CHECK (account IS NULL),\n';
  assert.equal(was.filter(r => r.sql?.includes(old)).map(r => r.name).join(), 'usage_records');
-  assert.deepEqual(master(path), was.map(r => r.name === 'usage_records' ? { ...r, sql: r.sql.replace(old, '  account TEXT,\n') } : r));
+  // Row 234 (#1740) adds 3i→3j's own objects after this step. Its test is grant-migration.test.mjs.
+  const later = ['hosts', 'host_grants', 'events_grant_actor', 'sqlite_autoindex_hosts_1', 'sqlite_autoindex_host_grants_1'];
+  assert.deepEqual(master(path).filter(r => !later.includes(r.name)), was.map(r => r.name === 'usage_records' ? { ...r, sql: r.sql.replace(old, '  account TEXT,\n') } : r));
  assert.equal(was.filter(r => r.type === 'trigger' && r.tbl_name === 'usage_records').length, 3);
  const store = new Store(root);
  try {
@@ -122,11 +125,11 @@ test('REQ-LIMIT-4 a 3h→3i step that fails partway leaves the store at 3h with
  assert.deepEqual(snapshot(path, before.columns).rows, before.rows);
  // Still a whole 3h store: the real step migrates it.
  new Store(root, { migrateSchema: true }).close();
-  assert.equal(version(path), '3i');
+  assert.equal(version(path), '3j');
  assert.deepEqual(snapshot(path, before.columns).rows, before.rows);
 });

-test('REQ-LIMIT-4 the 3h engine refuses a 3i store, migrating or not, and leaves it at 3i', async t => {
+test('REQ-LIMIT-4 the 3h engine refuses a migrated store, migrating or not, and leaves it as it was', async t => {
  const { root, path } = source3h(t);
  new Store(root, { migrateSchema: true }).close();
  const after = snapshot(path), was = master(path);
@@ -134,14 +137,14 @@ test('REQ-LIMIT-4 the 3h engine refuses a 3i store, migrating or not, and leaves
    schema: ddl3h,
    store: (source) => source
      .replace(/export const SCHEMA_SHA256 = '[a-f0-9]+';/, `export const SCHEMA_SHA256 = '${createHash('sha256').update(ddl3h).digest('hex')}';`)
-      .replace("export const SCHEMA_VERSION = '3i';", "export const SCHEMA_VERSION = '3h';")
+      .replace("export const SCHEMA_VERSION = '3j';", "export const SCHEMA_VERSION = '3h';")
      .replace(/\}, \{\n {2}\/\/ Row 126 \(#1620\)[\s\S]*?\}\];\nconst timedTables/, '}];\nconst timedTables'),
  });
  const pinned = readFileSync(join(root, 'engine-3h/src/store.mjs'), 'utf8');
  assert.ok(pinned.includes("export const SCHEMA_VERSION = '3h';") && !pinned.includes('3h-3i'), 'the 3h engine has no 3h→3i step');
  assert.throws(() => new Store3h(root), /schema-mismatch/);
  assert.throws(() => new Store3h(root, { migrateSchema: true }), /schema-mismatch/);
-  assert.equal(version(path), '3i');
+  assert.equal(version(path), '3j');
  assert.deepEqual(master(path), was);
  assert.deepEqual(snapshot(path, after.columns).rows, after.rows);
 });
@@ -16,9 +16,7 @@ const baselines = {
 // organization-no-change, organization-project-mismatch, organization-unresolvable-instance), no proof or
 // transport change. Row 155 (#1649) added eight for the assistant routes.
 // Row 171 (#1668): project-name-is-repo maps to 409; no proof or transport change.
- // Row 194 (#1692, brief item 7, sage-1610 a): organization-tracker-required 400 and
- // organization-tracker-bot-taken 409; no proof or transport change.
- "packages/webui/src/bus.mjs": "aa79d8bbee3b96e173d81534a22fd881d4953a22b37b9b86adc28534ed63b5c7",
+ "packages/webui/src/bus.mjs": "76a1b57858c4aa41071746713a196299264851c18322a6f9869d553f0362d421",
 };
 const repoFile = path => new URL("../../../" + path, import.meta.url);

@@ -7,13 +7,9 @@ import { createHash } from 'node:crypto';
 import { DatabaseSync } from 'node:sqlite';
 import { fileURLToPath, pathToFileURL } from 'node:url';
 import { Store, schemaDigest } from '../src/store.mjs';
-import { Broker, ACTIONS } from '../src/broker.mjs';
-import { HIRE_ALLOWED } from '../../business/src/vocabulary.mjs';
+import { Broker } from '../src/broker.mjs';
 import { startBroker } from '../src/runtime.mjs';
 import { businessDoc, rolesCopy, systemFor, writeJson } from '../../business/tests/helpers.mjs';
-import { busBusiness } from '../src/business.mjs';
-import { loadBusiness } from '../../business/src/business.mjs';
-import { resolveInstance } from '../../business/src/resolve.mjs';

 // Row 123 (#1617): the chief of staff ends runs without a decision and changes the organization
 // file through the shared write path. REQ-ROLE-2 (one holder; revoke), REQ-ROLE-3 (the
@@ -31,7 +27,7 @@ const roles = {
  pm: { definition: 'pm', ...none },
  coder: { definition: 'coder', ...none },
 };
-const demo = (extra = {}) => ({
+const demo = () => ({
  demo: {
    id: 'demo',
    human: 'jason',
@@ -42,13 +38,12 @@ const demo = (extra = {}) => ({
    // Row 65: runtime launches bind only on a harness the business switches on.
    plugins: { harness: ['pi'] },
    vars: { 'bus.tester': true },
-    ...extra,
  },
 });

 const PATCH = { revision: 'a'.repeat(64), limits: { total: 3 } };

-function setup(t, extra = {}, { roleFile = null } = {}) {
+function setup(t) {
  const root = mkdtempSync(join(tmpdir(), 'bus-chief-'));
  const store = new Store(root);
  t.after(() => {
@@ -56,16 +51,13 @@ function setup(t, extra = {}, { roleFile = null } = {}) {
    rmSync(root, { recursive: true, force: true });
  });
  const organization = [];
-  const writer = { error: null, during: null };
+  const writer = { error: null };
  const b = new Broker({
    store,
-    businesses: demo(extra),
-    roleFile,
+    businesses: demo(),
    organization: (...args) => {
      organization.push(args);
-      if (writer.during) writer.during(args);
      if (writer.error) throw writer.error;
-      if (args[1] === 'instance.hire' || args[1] === 'instance.fire') return { revision: 'b'.repeat(64), transaction: 't-' + organization.length };
      // The human's limits read answers more than the revision; organization.revision must not.
      return args[1] === 'limits'
        ? { revision: 'b'.repeat(64), limits: { total: 7 }, models: { m: {} }, tokens: { used: 1 } }
@@ -614,7 +606,7 @@ async function database3c(t) {
  let source = readFileSync(here('../src/store.mjs'), 'utf8');
  const pinned = source
    .replace(/export const SCHEMA_SHA256 = '[a-f0-9]+';/, `export const SCHEMA_SHA256 = '${createHash('sha256').update(ddl3c).digest('hex')}';`)
-    .replace("export const SCHEMA_VERSION = '3i';", "export const SCHEMA_VERSION = '3c';")
+    .replace("export const SCHEMA_VERSION = '3j';", "export const SCHEMA_VERSION = '3c';")
    .replace(/\}, \{\n {2}from: '3c',[\s\S]*?\}\];\nconst timedTables/, '}];\nconst timedTables');
  assert.notEqual(pinned, source);
  assert.ok(!pinned.includes('3c-3d'), 'the 3c engine has no 3c→3d step');
@@ -638,7 +630,7 @@ test('REQ-ROLE-2, REQ-COS-1: the 3c→3d migration lets the chief of staff end a
  assert.throws(() => new Store(root), /schema-mismatch/);
  const store = new Store(root, { migrateSchema: true });
  t.after(() => store.close());
-  assert.equal(store.get("SELECT value FROM meta WHERE key='schema_version'").value, '3i');
+  assert.equal(store.get("SELECT value FROM meta WHERE key='schema_version'").value, '3j');
  assert.equal(store.get("SELECT body FROM events WHERE id='preserved'").body, '{"fixture":true}');
  assert.equal(store.get("SELECT holder_run FROM role_claims WHERE role='coder'").holder_run, 'coder-run');
  const b = new Broker({ store, businesses: demo(), organization: null });
@@ -653,403 +645,3 @@ test('REQ-ROLE-2, REQ-COS-1: the 3c→3d migration lets the chief of staff end a
  );
  assert.throws(() => store.run(REVOKE_NEITHER), /revoke needs a resolved decision or a reason/);
 });
-
-// Row 194 (#1692, D2.4): the per-agent forbid. The chief can't end a kept instance's run with a
-// reason or change its model. A decision the human resolved, and the human's own write, still can.
-const KEPT = { launch: { by: 'chief', instances: ['pm', 'coder'], keep: ['coder'] } };
-
-test('row 194 T10: the chief\'s reason end of a kept instance refuses instance-kept, holds the claim and spends nothing', (t) => {
-  const { call, lastClaim, allowed } = setup(t, KEPT);
-  assert.throws(() => call('chief', 'role.revoke', { role: 'coder', reason: 'replace it' }), /instance-kept/);
-  assert.deepEqual(lastClaim('coder'), { op: 'claim', decision: null, reason: null, by: 'coder-run' });
-  assert.equal(allowed('role.end').length, 0);
-  // An instance not on the list still ends with a reason.
-  assert.deepEqual(call('chief', 'role.revoke', { role: 'pm', reason: 'stuck' }), { revoked: true });
-});
-
-test('row 194 T10 (Q2): a role.revoke citing a decision the human resolved still ends a kept run', (t) => {
-  const { call, lastClaim } = setup(t, KEPT);
-  const d = call('chief', 'decision.raise', {
-    action: 'role.revoke', target: 'coder', question: 'Stop the coder?',
-    options: [{ key: 'yes', text: 'Yes' }, { key: 'no', text: 'No' }], recommendation: 'yes', blocking: false,
-  });
-  call('human', 'decision.resolve', { id: d.id, choice: 'yes' });
-  assert.deepEqual(call('chief', 'role.revoke', { role: 'coder', decision: d.id }), { revoked: true });
-  assert.deepEqual(lastClaim('coder'), { op: 'revoke', decision: d.id, reason: null, by: 'chief-run' });
-});
-
-test('row 194 T10 (B7): the chief\'s organization.set of a kept instance\'s model refuses before the writer; the human\'s limits.set does not', (t) => {
-  const { call, organization, allowed } = setup(t, KEPT);
-  assert.throws(() => call('chief', 'organization.set', { revision: PATCH.revision, instances: { coder: 'm' } }), /instance-kept/);
-  assert.throws(() => call('chief', 'organization.set', { revision: PATCH.revision, instances: { pm: 'm', coder: 'm' } }), /instance-kept/);
-  assert.equal(organization.length, 0);
-  assert.equal(allowed('organization.change').length, 0);
-  call('chief', 'organization.set', { revision: PATCH.revision, instances: { pm: 'm' } });
-  call('human', 'limits.set', { revision: PATCH.revision, instances: { coder: 'm' } });
-  assert.deepEqual(organization.map(([, verb, args]) => [verb, Object.keys(args.instances)]), [['limits.set', ['pm']], ['limits.set', ['coder']]]);
-});
-
-test('row 194 T13: organization.set and limits.set refuse the launch, retired, keep and noHire keys before the writer', (t) => {
-  const { call, organization } = setup(t, KEPT);
-  for (const extra of [{ launch: { keep: [] } }, { retired: [] }, { keep: ['pm'] }, { noHire: ['coder'] }])
-    for (const [who, verb] of [['chief', 'organization.set'], ['human', 'limits.set']])
-      assert.throws(() => call(who, verb, { ...PATCH, ...extra }), /invalid-request/, `${who} ${Object.keys(extra)[0]}`);
-  assert.equal(organization.length, 0);
-});
-
-test('row 194 T18 (D2.4): from a chief session veto.set and instances.set refuse, and nothing reaches the writer', (t) => {
-  const { call, organization } = setup(t, KEPT);
-  for (const op of ['keep', 'unkeep', 'nohire', 'hire'])
-    assert.throws(() => call('chief', 'veto.set', { revision: PATCH.revision, op, name: 'coder' }), /human-required/, op);
-  for (const op of ['add', 'change', 'delete'])
-    assert.throws(() => call('chief', 'instances.set', { revision: PATCH.revision, instance: 'coder', op, definition: 'coder' }), /human-required/, op);
-  assert.equal(organization.length, 0);
-  // The human's veto reaches the writer with the human as actor.
-  call('human', 'veto.set', { revision: PATCH.revision, op: 'unkeep', name: 'coder' });
-  assert.deepEqual(organization.at(-1), ['demo', 'veto.set', { revision: PATCH.revision, op: 'unkeep', name: 'coder' }, 'jason']);
-});
-
-// Row 194 (#1692, D2.1-D2.3): the chief's hire and fire. PRD 1.7 REQ-COS-3 routes role.hire and
-// role.fire within-role for the chief (sage-1471, mos-1089), so they take the reason form, as
-// role.end does: no decision, a reason of 1 to 500 characters that goes into the log. The role
-// files are stubs, so a definition's authority is the test's to set.
-const LISTED = { launch: { by: 'chief', instances: ['pm', 'coder'], keep: ['pm'], noHire: ['banned'] } };
-const roleDoc = (withinRole, extra = {}) => ({ roleVersion: 2, authority: { withinRole, crossRole: [] }, hireable: [], ...extra });
-const ROLE_FILES = {
-  'chief-of-staff': roleDoc(chiefAuthority, { hireable: ['coder', 'researcher', 'wide', 'banned'] }),
-  coder: roleDoc(['message.send', 'record.write']),
-  // A version 1 file has empty authority lists, so only the version check refuses it (M60).
-  researcher: { roleVersion: 1, authority: { withinRole: [], crossRole: [] }, hireable: [] },
-  wide: roleDoc(['message.send', 'task.create']),
-  banned: roleDoc(['message.send']),
-  pm: roleDoc(['message.send']),
-};
-const roleFile = (files) => (name) => {
-  if (!Object.hasOwn(files, name)) throw Object.assign(new Error(`no role ${name}`), { name: 'BusinessError' });
-  return files[name];
-};
-function hireSetup(t, extra = LISTED, files = ROLE_FILES) {
-  return setup(t, extra, { roleFile: roleFile(files) });
-}
-const HIRE = { name: 'helper', definition: 'coder', reason: 'more hands for the queue' };
-const FIRE = { name: 'coder', reason: 'the work is done' };
-const CONTEXT = (reason) => ({ instance: 'chief', run: 'chief-run', reason });
-const withoutReason = ({ reason, ...rest }) => rest;
-
-test('row 194 T8: the chief hires with a reason and no decision, the writer gets the reason as context, and the log names it', (t) => {
-  const { call, organization, allowed, store } = hireSetup(t);
-  const result = call('chief', 'instance.hire', HIRE);
-  assert.equal(result.transaction, 't-1');
-  assert.deepEqual(organization, [['demo', 'instance.hire', withoutReason(HIRE), 'chief-of-staff.chief', CONTEXT(HIRE.reason)]]);
-  const [use, ...rest] = allowed('role.hire');
-  assert.equal(rest.length, 0);
-  assert.equal(use.subject, 'helper');
-  assert.deepEqual({ reason: use.body.reason, transaction: use.body.transaction, decision: use.body.decision ?? null }, { reason: HIRE.reason, transaction: 't-1', decision: null });
-  // Within-role: no decision is raised or needed.
-  assert.equal(store.get('SELECT count(*) AS n FROM decisions').n, 0);
-  // vars reach the writer with the name and definition.
-  call('chief', 'instance.hire', { ...HIRE, name: 'aide', vars: { model: 'm', 'limits.x': 1 } });
-  assert.deepEqual(organization.at(-1)[2], { name: 'aide', definition: 'coder', vars: { model: 'm', 'limits.x': 1 } });
-});
-
-// T11 (D5): a business id names one business on one bus. The chief's hire and fire go to its own
-// business's writer, and no argument names another.
-test('row 194 T11: on a bus with two businesses, the chief of one hires and fires only in its own', (t) => {
-  const root = mkdtempSync(join(tmpdir(), 'bus-chief-two-'));
-  const store = new Store(root);
-  t.after(() => {
-    store.close();
-    rmSync(root, { recursive: true, force: true });
-  });
-  const organization = [];
-  const one = demo(LISTED).demo;
-  const b = new Broker({
-    store,
-    businesses: { demo: one, other: { ...one, id: 'other' } },
-    roleFile: roleFile(ROLE_FILES),
-    organization: (...args) => (organization.push(args), { revision: 'b'.repeat(64), transaction: 't-' + organization.length }),
-  });
-  const chief = b.bindLaunch({ business: 'demo', role: 'chief', run: 'chief-run', harness: 'pi' });
-  b.request(chief, { verb: 'role.claim' });
-  for (const verb of ['instance.hire', 'instance.fire'])
-    for (const extra of [{ business: 'other' }, { target: 'other' }])
-      assert.throws(() => b.request(chief, { verb, args: { ...(verb === 'instance.hire' ? HIRE : FIRE), ...extra } }), /invalid-request/, `${verb} ${Object.keys(extra)}`);
-  assert.equal(organization.length, 0);
-  b.request(chief, { verb: 'instance.hire', args: HIRE });
-  b.request(chief, { verb: 'instance.fire', args: FIRE });
-  assert.deepEqual(organization.map((c) => [c[0], c[1]]), [['demo', 'instance.hire'], ['demo', 'instance.fire']]);
-  assert.equal(store.get("SELECT count(*) AS n FROM events WHERE business='other'").n, 0);
-});
-
-test('row 194 T8: hire and fire need a reason of 1 to 500 characters and refuse a decision key', (t) => {
-  const { call, organization } = hireSetup(t);
-  for (const reason of [undefined, '', 'x'.repeat(501), 7]) {
-    const r = reason === undefined ? {} : { reason };
-    assert.throws(() => call('chief', 'instance.hire', { name: 'helper', definition: 'coder', ...r }), /invalid-request/, String(reason));
-    assert.throws(() => call('chief', 'instance.fire', { name: 'coder', ...r }), /invalid-request/, String(reason));
-  }
-  assert.throws(() => call('chief', 'instance.hire', { ...HIRE, decision: 'd-1' }), /invalid-request/);
-  assert.throws(() => call('chief', 'instance.fire', { ...FIRE, decision: 'd-1' }), /invalid-request/);
-  for (const name of ['human', 'tester']) assert.throws(() => call('chief', 'instance.hire', { ...HIRE, name }), /invalid-request/, name);
-  assert.equal(organization.length, 0);
-  call('chief', 'instance.hire', { ...HIRE, reason: 'x'.repeat(500) });
-  assert.equal(organization.length, 1);
-});
-
-test('row 194 T8 (sage-1471): only the chief hires or fires; every other role refuses role-not-chief, even one granted the actions', (t) => {
-  const granted = { authority: { withinRole: ['message.send', 'role.hire', 'role.fire'], crossRole: [] } };
-  const { call, organization, allowed } = hireSetup(t, { ...LISTED, roles: { ...roles, pm: { definition: 'pm', ...granted }, coder: { definition: 'coder', ...granted } } });
-  for (const who of ['pm', 'coder', 'assistant']) {
-    assert.throws(() => call(who, 'instance.hire', HIRE), /role-not-chief/, who);
-    assert.throws(() => call(who, 'instance.fire', FIRE), /role-not-chief/, who);
-  }
-  assert.throws(() => call('tester', 'instance.hire', HIRE), /tester-refused/);
-  assert.throws(() => call('reader', 'instance.hire', HIRE), /read-only/);
-  assert.throws(() => call('human', 'instance.fire', FIRE), /agent-required/);
-  assert.equal(organization.length, 0);
-  assert.equal(allowed('role.hire').length + allowed('role.fire').length, 0);
-});
-
-test('row 194 T8 (sage-1471): a chief whose authority lacks role.hire or role.fire refuses decision-required before the writer', (t) => {
-  for (const missing of ['role.hire', 'role.fire']) {
-    const authority = { withinRole: chiefAuthority.withinRole.filter((a) => a !== missing), crossRole: [] };
-    const { call, organization, lastClaim } = hireSetup(t, { ...LISTED, roles: { ...roles, chief: { definition: 'chief-of-staff', authority } } });
-    const [verb, args] = missing === 'role.hire' ? ['instance.hire', HIRE] : ['instance.fire', FIRE];
-    assert.throws(() => call('chief', verb, args), /decision-required/, missing);
-    assert.equal(organization.length, 0, missing);
-    assert.equal(lastClaim('coder').op, 'claim', missing);
-    // The other action still goes through.
-    const [other, otherArgs] = missing === 'role.hire' ? ['instance.fire', FIRE] : ['instance.hire', HIRE];
-    call('chief', other, otherArgs);
-    assert.equal(organization.length, 1, missing);
-  }
-});
-
-test('row 194 T8a: a re-hire of a fired name goes to the writer like a hire, and the writer\'s refusals pass through by name', (t) => {
-  const { call, organization, writer } = hireSetup(t);
-  const again = { name: 'coder', definition: 'coder', reason: 'needed again' };
-  for (const code of ['organization-instance-exists', 'organization-instance-retired', 'definition-not-hireable', 'instance-kept']) {
-    writer.error = Object.assign(new Error(code), { code });
-    assert.throws(() => call('chief', 'instance.hire', again), new RegExp(code));
-  }
-  writer.error = null;
-  call('chief', 'instance.hire', again);
-  assert.deepEqual(organization.at(-1).slice(1, 3), ['instance.hire', withoutReason(again)]);
-});
-
-test('row 194 T8b: a definition is hireable only when every action is on HIRE_ALLOWED, it is version 2, the chief lists it and noHire doesn\'t', (t) => {
-  assert.deepEqual([...HIRE_ALLOWED], ['message.send', 'record.write', 'review.request', 'task.update.assigned', 'task.scope.change', 'git.push.working']);
-  for (const action of ACTIONS) {
-    const files = { ...ROLE_FILES, wide: roleDoc(['message.send', action]) };
-    const { call, organization } = hireSetup(t, LISTED, files);
-    const run = () => call('chief', 'instance.hire', { ...HIRE, definition: 'wide' });
-    if (HIRE_ALLOWED.includes(action)) {
-      run();
-      assert.equal(organization.length, 1, action);
-    } else {
-      assert.throws(run, /definition-not-hireable/, action);
-      assert.equal(organization.length, 0, action);
-    }
-  }
-  const { call, organization } = hireSetup(t);
-  const hire = (definition) => call('chief', 'instance.hire', { ...HIRE, definition });
-  // Version 1 (M60), noHire, not on the chief's list, and no role file.
-  for (const definition of ['researcher', 'banned', 'pm', 'nothing'])
-    assert.throws(() => hire(definition), /definition-not-hireable/, definition);
-  assert.equal(organization.length, 0);
-  hire('coder');
-  assert.equal(organization.length, 1);
-});
-
-test('row 194 T8b: a hire without the role files configured refuses not-configured', (t) => {
-  const { call, organization } = setup(t, LISTED);
-  assert.throws(() => call('chief', 'instance.hire', HIRE), /not-configured/);
-  assert.equal(organization.length, 0);
-  assert.throws(() => new Broker({ store: null, businesses: demo(), roleFile: 'roles' }), /roleFile must be a function/);
-});
-
-test('row 194 T9: a fire revokes the claim, cancels open requests, asks the launcher to kill the runs, then delists and logs', (t) => {
-  const { call, organization, allowed, lastClaim, writer } = hireSetup(t);
-  // An open launch request of the coder, made by the human.
-  const open = call('human', 'instance.launch', { instance: 'coder' }).request;
-  let seen = null;
-  writer.during = ([, verb]) => { if (verb === 'instance.fire') seen = { stopped: allowed('fire.stopped').length, claim: lastClaim('coder').op, used: allowed('role.fire').length }; };
-  const result = call('chief', 'instance.fire', FIRE);
-  // Step A ran before the writer; step C after it.
-  assert.deepEqual(seen, { stopped: 1, claim: 'revoke', used: 0 });
-  assert.deepEqual(lastClaim('coder'), { op: 'revoke', decision: null, reason: 'the work is done', by: 'chief-run' });
-  assert.deepEqual(result.runs, ['coder-run']);
-  assert.deepEqual(result.cancelled, [open]);
-  assert.deepEqual(organization.at(-1), ['demo', 'instance.fire', { name: 'coder' }, 'chief-of-staff.chief', CONTEXT(FIRE.reason)]);
-  const [end] = allowed('lifecycle.end');
-  assert.equal(end.subject, 'coder');
-  assert.deepEqual({ ...end.body, request: null }, { action: 'lifecycle.end', request: null, via: 'chief', by: 'chief', runs: ['coder-run'], reason: 'the work is done', kill: true });
-  assert.equal(allowed('lifecycle.cancelled').filter((e) => e.body.request === open).length, 1);
-  const [use] = allowed('role.fire');
-  assert.equal(use.subject, 'coder');
-  assert.equal(use.body.reason, 'the work is done');
-  assert.equal(use.body.transaction, result.transaction);
-  assert.deepEqual(allowed('fire.done').map((e) => [e.subject, e.body.transaction]), [['coder', result.transaction]]);
-  // The human's read of the request shows the kill.
-  assert.equal(call('human', 'instance.request', { request: end.body.request }).kill, true);
-});
-
-test('row 194 T9: fire refusals come before step A and leave the claim, the requests and the file alone', (t) => {
-  const { call, organization, allowed, lastClaim } = hireSetup(t, { launch: { by: 'chief', instances: ['coder'], keep: ['pm'] } });
-  const fire = (name) => call('chief', 'instance.fire', { name, reason: 'r' });
-  assert.throws(() => fire('pm'), /instance-kept/);
-  assert.throws(() => fire('nobody'), /unknown-role/);
-  assert.throws(() => fire('assistant'), /organization-definition-refused/);
-  assert.throws(() => fire('chief'), /organization-instance-referenced/);
-  assert.throws(() => fire('coder'), /invalid-request/);
-  assert.equal(organization.length, 0);
-  assert.equal(allowed('fire.stopped').length + allowed('lifecycle.end').length + allowed('role.fire').length, 0);
-  assert.equal(lastClaim('coder').op, 'claim');
-});
-
-test('row 194 T9c: a writer failure at B leaves the instance firing, and the repeat delists and logs once', (t) => {
-  const { call, b, caps, organization, allowed, writer } = hireSetup(t);
-  writer.error = new Error('disk');
-  assert.throws(() => call('chief', 'instance.fire', FIRE), /outcome-unknown/);
-  writer.error = null;
-  assert.equal(allowed('fire.stopped').length, 1);
-  assert.equal(allowed('role.fire').length, 0);
-  // W-N1: while it fires, no launch of the instance starts by any path.
-  assert.throws(() => call('human', 'instance.launch', { instance: 'coder' }), /instance-firing/);
-  assert.throws(() => b.authorize(caps.chief, 'role.launch', { target: 'coder' }), /instance-firing/);
-  // The repeat has no claim to revoke. The revoked run is still bound until the launcher reports it
-  // ended, so the repeat asks for its kill again, then delists and logs.
-  const result = call('chief', 'instance.fire', FIRE);
-  assert.deepEqual(result.runs, ['coder-run']);
-  assert.equal(organization.filter(([, verb]) => verb === 'instance.fire').length, 2);
-  assert.equal(allowed('role.fire').length, 1);
-  assert.deepEqual(allowed('lifecycle.end').map((e) => e.body.kill), [true, true]);
-  // Once done, the instance launches again.
-  assert.ok(call('human', 'instance.launch', { instance: 'coder' }).request);
-});
-
-test('row 194 T9c: a failure at C leaves the fire unlogged and the instance firing, and the repeat logs it', (t) => {
-  const { call, organization, allowed, store, writer } = hireSetup(t);
-  // The delist commits, then the step C transaction aborts.
-  writer.during = () => store.run("CREATE TRIGGER fail_c BEFORE INSERT ON events WHEN json_extract(new.body,'$.action')='fire.done' BEGIN SELECT RAISE(ABORT, 'c failed'); END");
-  assert.throws(() => call('chief', 'instance.fire', FIRE));
-  writer.during = null;
-  store.run('DROP TRIGGER fail_c');
-  assert.equal(allowed('role.fire').length, 0);
-  assert.equal(allowed('fire.done').length, 0);
-  assert.throws(() => call('human', 'instance.launch', { instance: 'coder' }), /instance-firing/);
-  call('chief', 'instance.fire', FIRE);
-  assert.equal(organization.filter(([, verb]) => verb === 'instance.fire').length, 2);
-  assert.equal(allowed('role.fire').length, 1);
-  assert.equal(allowed('fire.done').length, 1);
-  assert.ok(call('human', 'instance.launch', { instance: 'coder' }).request);
-});
-
-test('row 194 W-N1: a fire.done before a later fire.stopped of the same instance leaves it firing; another instance\'s done does not end it', (t) => {
-  const { call, store } = hireSetup(t);
-  const step = (instance, action) =>
-    store.run("INSERT INTO events(id,at,business,kind,actor_role,actor_run,subject,body) VALUES(?,?,'demo','action.allowed','chief','chief-run',?,?)",
-      `${action}-${instance}-${Math.random()}`, new Date().toISOString(), instance, JSON.stringify({ action, request: null, transaction: null }));
-  step('coder', 'fire.done');
-  step('coder', 'fire.stopped');
-  step('pm', 'fire.done');
-  assert.throws(() => call('human', 'instance.launch', { instance: 'coder' }), /instance-firing/);
-  step('coder', 'fire.done');
-  assert.ok(call('human', 'instance.launch', { instance: 'coder' }).request);
-});
-
-test('row 194 T10: a hire or fire of a kept name refuses instance-kept before the writer', (t) => {
-  const { call, organization, lastClaim, allowed } = hireSetup(t);
-  assert.throws(() => call('chief', 'instance.hire', { ...HIRE, name: 'pm' }), /instance-kept/);
-  assert.throws(() => call('chief', 'instance.fire', { ...FIRE, name: 'pm' }), /instance-kept/);
-  assert.equal(organization.length, 0);
-  assert.equal(lastClaim('pm').op, 'claim');
-  assert.equal(allowed('role.hire').length + allowed('role.fire').length, 0);
-});
-
-test('row 194 T18: hire and fire take only their own keys, and a refused call writes nothing', (t) => {
-  const { call, organization, allowed } = hireSetup(t);
-  for (const extra of [{ keep: ['x'] }, { launch: {} }, { revision: 'a'.repeat(64) }, { force: true }]) {
-    assert.throws(() => call('chief', 'instance.hire', { ...HIRE, ...extra }), /invalid-request/, JSON.stringify(extra));
-    assert.throws(() => call('chief', 'instance.fire', { ...FIRE, ...extra }), /invalid-request/, JSON.stringify(extra));
-  }
-  assert.throws(() => call('chief', 'instance.hire', { ...HIRE, vars: { harness: 'pi' } }), /invalid-request/);
-  assert.throws(() => call('chief', 'instance.fire', { ...FIRE, definition: 'coder' }), /invalid-request/);
-  assert.equal(organization.length, 0);
-  assert.equal(allowed('fire.stopped').length, 0);
-});
-
-test('row 194 T8, T9, T18: through the runtime the chief hires and fires with the real writer, the receipt carries the reason, and a refusal leaves the file alone', async (t) => {
-  const root = mkdtempSync(join(tmpdir(), 'bus-chief-hire-'));
-  const rolesDir = rolesCopy(root);
-  // A hireable scratch definition: version 2, no credentials, every action on HIRE_ALLOWED.
-  writeFileSync(join(rolesDir, 'aide.md'), '# Aide\n');
-  writeJson(join(rolesDir, 'aide.json'), {
-    roleVersion: 2, name: 'aide', title: 'Aide', contract: 'aide.md', tools: ['read'], network: 'api-only',
-    authority: { withinRole: ['message.send'], crossRole: [] }, credentials: [],
-  });
-  const chiefFile = join(rolesDir, 'chief-of-staff.json');
-  writeJson(chiefFile, { ...JSON.parse(readFileSync(chiefFile, 'utf8')), hireable: ['aide'] });
-  const file = join(root, 'businesses/demo.json');
-  writeJson(file, { ...businessDoc(root, 'demo'), plugins: { harness: ['pi'] } });
-  mkdirSync(join(root, 'data'), { mode: 0o700 });
-  // The boot copy is the file's own bus form, as cli bootConfig builds it, so a write reloads.
-  const busForm = (dir, roles) => {
-    const b = loadBusiness('demo', { dir, rolesDir: roles });
-    const resolved = {};
-    for (const instance of Object.keys(b.roles)) resolved[instance] = resolveInstance({ system: systemFor(dir), business: b, instance });
-    return busBusiness(b, resolved);
-  };
-  const bus = await startBroker({
-    dataRoot: join(root, 'data'),
-    businesses: { demo: busForm(root, rolesDir) },
-    organization: { dir: root, rolesDir, system: systemFor(root) },
-  });
-  t.after(async () => {
-    await bus.close();
-    rmSync(root, { recursive: true, force: true });
-  });
-  const { broker } = bus;
-  const chief = broker.bindLaunch({ business: 'demo', role: 'chief', run: 'chief-run', harness: 'pi' });
-  broker.request(chief, { verb: 'role.claim' });
-  const call = (cap, verb, args) => broker.request(cap, { verb, args });
-  const receipts = () =>
-    readFileSync(join(root, 'businesses/.history/demo/changes.jsonl'), 'utf8').trim().split('\n').map(JSON.parse).filter((r) => r.state === 'committed');
-  const document = () => JSON.parse(readFileSync(file, 'utf8'));
-
-  // The shipped chief file grants both actions, so the runtime takes the reason form.
-  // A refused hire: coder declares credentials and isn't on the chief's list. The file is unchanged.
-  const bytes = readFileSync(file, 'utf8');
-  assert.throws(() => call(chief, 'instance.hire', { name: 'helper', definition: 'coder', reason: 'r' }), /definition-not-hireable/);
-  assert.equal(readFileSync(file, 'utf8'), bytes);
-
-  call(chief, 'instance.hire', { name: 'helper', definition: 'aide', reason: 'more hands' });
-  assert.deepEqual(document().roles.helper, { definition: 'aide' });
-  assert.ok(document().launch.instances.includes('helper'));
-  const [h] = receipts().slice(-1);
-  assert.equal(h.actor, 'chief-of-staff.chief');
-  assert.deepEqual(h.context, CONTEXT('more hands'));
-
-  const result = call(chief, 'instance.fire', { name: 'helper', reason: 'the work is done' });
-  assert.equal(result.delisted, true);
-  assert.ok(!document().launch.instances.includes('helper'));
-  assert.deepEqual(receipts().slice(-1)[0].context, CONTEXT('the work is done'));
-  // The reloaded business sees the delist: a refused call leaves the file alone.
-  const after = readFileSync(file, 'utf8');
-  assert.throws(() => call(chief, 'instance.fire', { name: 'helper', reason: 'again', extra: 1 }), /invalid-request/);
-  assert.equal(readFileSync(file, 'utf8'), after);
-});
-
-test('row 194 W-N1: the launcher\'s take of a launch or regenerate of a firing instance closes it as instance-firing', (t) => {
-  const { b, call, store } = hireSetup(t);
-  const launch = call('human', 'instance.launch', { instance: 'coder' }).request;
-  const regenerate = call('human', 'instance.regenerate', { instance: 'pm' }).request;
-  // A fire's step A as the store holds it with no step C, for requests step A didn't see.
-  for (const instance of ['coder', 'pm'])
-    store.run("INSERT INTO events(id,at,business,kind,actor_role,actor_run,subject,body) VALUES(?,?,'demo','action.allowed','chief','chief-run',?,?)",
-      'stopped-' + instance, new Date().toISOString(), instance, JSON.stringify({ action: 'fire.stopped', request: null }));
-  for (const request of [launch, regenerate]) {
-    const { go, refusal } = b.lifecycleTake({ business: 'demo', request });
-    assert.deepEqual({ go, refusal }, { go: false, refusal: 'instance-firing' });
-  }
-});
@@ -33,7 +33,7 @@ test('explicit 3b copy migration preserves evidence and opens as 3g; normal star
  const original = readFileSync(source);
  assert.throws(() => new Store(root), /schema-mismatch/);
  const store = new Store(root, { migrateSchema: true });
-  assert.equal(store.get("SELECT value FROM meta WHERE key='schema_version'").value, '3i');
+  assert.equal(store.get("SELECT value FROM meta WHERE key='schema_version'").value, '3j');
  assert.equal(store.get("SELECT body FROM events WHERE id='preserved'").body, '{"fixture":true}');
  assert.equal(store.get('SELECT count(*) n FROM task_comment_cursors').n, 0);
  const epoch = store.get("SELECT value FROM meta WHERE key='comment_cursor_epoch'").value;
@@ -75,15 +75,15 @@ test('named migration registry chains 3b through 3g to a fixture-only future ver
  const sha = createHash('sha256').update(futureDDL).digest('hex');
  let source = readFileSync(new URL('../src/store.mjs', import.meta.url), 'utf8');
  source = source.replace(/export const SCHEMA_SHA256 = '[a-f0-9]+';/, `export const SCHEMA_SHA256 = '${sha}';`)
-    .replace("export const SCHEMA_VERSION = '3i';", "export const SCHEMA_VERSION = '3j';")
-    .replace('}];\nconst timedTables', `}, { from: '3i', to: '3j', sql: ${JSON.stringify(futureSQL)} }];\nconst timedTables`);
+    .replace("export const SCHEMA_VERSION = '3j';", "export const SCHEMA_VERSION = '3k';")
+    .replace('}];\nconst timedTables', `}, { from: '3j', to: '3k', sql: ${JSON.stringify(futureSQL)} }];\nconst timedTables`);
  writeFileSync(join(moduleRoot, 'src/store.mjs'), source);
  writeFileSync(join(moduleRoot, 'schema.sql'), futureDDL);
-  for (const name of ['3b.sql', '3b-3c.sql', '3c-3d.sql', '3d-3e.sql', '3e-3f.sql', '3f-3g.sql', '3g-3h.sql', '3h-3i.sql'])
+  for (const name of ['3b.sql', '3b-3c.sql', '3c-3d.sql', '3d-3e.sql', '3e-3f.sql', '3f-3g.sql', '3g-3h.sql', '3h-3i.sql', '3i-3j.sql'])
    copyFileSync(new URL('../src/migrations/' + name, import.meta.url), join(moduleRoot, 'src/migrations', name));
  const { Store: FutureStore } = await import(pathToFileURL(join(moduleRoot, 'src/store.mjs')));
  const future = new FutureStore(root, { migrateSchema: true });
-  assert.equal(future.get("SELECT value FROM meta WHERE key='schema_version'").value, '3j');
+  assert.equal(future.get("SELECT value FROM meta WHERE key='schema_version'").value, '3k');
  assert.equal(future.get("SELECT name FROM sqlite_master WHERE name='future_fixture'").name, 'future_fixture');
  assert.equal(future.get("SELECT count(*) n FROM task_comment_cursors").n, 0);
  assert.equal(future.get("SELECT id FROM events").id, 'preserved');
@@ -109,7 +109,7 @@ test('offline command migrates only the supplied fixture root and reports usage
  const command = new URL('../src/migrate-schema.mjs', import.meta.url).pathname;
  const migrated = spawnSync(process.execPath, [command, root], { encoding: 'utf8' });
  assert.equal(migrated.status, 0, migrated.stderr);
-  assert.match(migrated.stdout, /bus schema 3i ready/);
+  assert.match(migrated.stdout, /bus schema 3j ready/);
  new Store(root).close();
  const usage = spawnSync(process.execPath, [command], { encoding: 'utf8' });
  assert.equal(usage.status, 2);
@@ -0,0 +1,153 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { Store } from '../src/store.mjs';
+import { Broker } from '../src/broker.mjs';
+import { startBroker } from '../src/runtime.mjs';
+import { businessDoc, rolesCopy, systemFor, writeJson } from '../../business/tests/helpers.mjs';
+
+// Row 213 (C2-08, #1714, Case 2 design 5.1): a creative instance talks with the user only, and it has
+// no decision channel (M6). The messaging lists are read from the shipped role files.
+const shipped = (name) =>
+  JSON.parse(readFileSync(fileURLToPath(new URL(`../../../roles/${name}.json`, import.meta.url)), 'utf8'));
+
+const within = { authority: { withinRole: ['message.send'], crossRole: [] } };
+const roles = {
+  chief: { definition: 'chief-of-staff', ...within },
+  assistant: { definition: 'assistant', ...within },
+  pm: { definition: 'pm', ...within },
+  bean: { definition: 'companion', ...within },
+  quill: { definition: 'proofreader', ...within },
+};
+const definitions = {
+  'chief-of-staff': {},
+  assistant: { messaging: shipped('assistant').messaging },
+  pm: {},
+  companion: { messaging: shipped('companion').messaging },
+  proofreader: { messaging: shipped('proofreader').messaging },
+};
+
+function setup(t) {
+  const root = mkdtempSync(join(tmpdir(), 'bus-creative-'));
+  const store = new Store(root);
+  t.after(() => {
+    store.close();
+    rmSync(root, { recursive: true, force: true });
+  });
+  const b = new Broker({ store, businesses: { demo: {
+    id: 'demo', human: 'jason', arbiters: { technical: 'pm', delivery: 'chief' }, roles, definitions,
+    projects: { stack: { root: '/nonexistent' } }, vars: { 'bus.tester': true },
+  } } });
+  const caps = {};
+  caps.human = b.bindHuman({ business: 'demo', human: 'jason', via: 'cli', outsideAgent: true });
+  const project = b.request(caps.human, { verb: 'project.create', args: { name: 'demo' } }).id;
+  const thread = b.request(caps.human, { verb: 'thread.create', args: { project, name: 'main' } }).id;
+  for (const role of Object.keys(roles)) {
+    caps[role] = b.bindLaunch({ business: 'demo', role, run: `${role}-run`, harness: 'pi', ...(role === 'assistant' ? { thread } : {}) });
+    b.request(caps[role], { verb: 'role.claim' });
+  }
+  caps.tester = b.bindTester({ business: 'demo' });
+  const call = (who, verb, args = {}) => b.request(caps[who], { verb, args });
+  const count = (sql) => store.get(sql).n;
+  return { call, count, store };
+}
+
+const raise = { action: 'policy.change', question: 'Change?', options: [{ key: 'yes', text: 'Yes' }, { key: 'no', text: 'No' }], recommendation: 'yes', blocking: false };
+
+test('M6: a creative raise refuses decision-not-allowed, cited or not, and no decision row appears; the assistant still raises', (t) => {
+  const { call, count } = setup(t);
+  for (const who of ['bean', 'quill']) {
+    assert.throws(() => call(who, 'decision.raise', raise), { code: 'decision-not-allowed' }, who);
+    // The refusal comes before the spec-cited path, so a cited raise never reaches the project.
+    assert.throws(() => call(who, 'decision.raise', { ...raise, project: 'stack', spec_path: 'spec/north-star.md', spec_commit: 'a'.repeat(40) }),
+      { code: 'decision-not-allowed' }, `${who} cited`);
+  }
+  assert.equal(count('SELECT count(*) n FROM decisions'), 0);
+  const d = call('assistant', 'decision.raise', raise);
+  assert.match(String(d.id), /./);
+  assert.equal(count('SELECT count(*) n FROM decisions'), 1);
+});
+
+test('a creative instance sends only to the user and hears only from the user', (t) => {
+  const { call, count } = setup(t);
+  for (const who of ['bean', 'quill']) {
+    call(who, 'message.send', { to: 'human', body: 'hello' });
+    for (const to of ['chief', 'assistant', 'pm', 'bean', 'quill'].filter((n) => n !== who)) {
+      assert.throws(() => call(who, 'message.send', { to, body: 'hello' }), { code: 'message-recipient-refused' }, `${who} to ${to}`);
+    }
+    for (const from of ['chief', 'pm']) {
+      assert.throws(() => call(from, 'message.send', { to: who, body: 'hello' }), { code: 'message-sender-refused' }, `${from} to ${who}`);
+    }
+    call('human', 'message.send', { to: who, body: 'hello' });
+  }
+  assert.equal(count("SELECT count(*) n FROM messages WHERE from_role IN ('bean','quill')"), 2);
+  assert.equal(count("SELECT count(*) n FROM messages WHERE to_role IN ('bean','quill')"), 2);
+});
+
+// M10 through the broker (webby-0040 B1): the broker names the actor from the session, so these cases
+// pin that a chief session reaches the writer as chief-of-staff.chief and a tester session as tester.
+// A real organization file and writer, as tester-writes.test.mjs.
+async function runtime(t) {
+  const root = mkdtempSync(join(tmpdir(), 'bus-creative-m10-'));
+  const rolesDir = rolesCopy(root);
+  const doc = businessDoc(root, 'demo');
+  doc.plugins = { ...doc.plugins, harness: ['pi'] };
+  doc.roles.bean = { definition: 'companion' };
+  for (const r of Object.values(doc.roles)) r.vars = { harness: 'pi', model: 'claude-sonnet-5-5', thinking: 'high', ...r.vars };
+  // Only bean names the sonnet key, so the chief may still change every other key.
+  for (const [name, r] of Object.entries(doc.roles)) if (name !== 'bean') r.vars.model = 'claude-opus-5-5';
+  const file = join(root, 'businesses/demo.json');
+  writeJson(file, doc);
+  mkdirSync(join(root, 'data'), { mode: 0o700 });
+  const bus = await startBroker({
+    dataRoot: join(root, 'data'),
+    businesses: {
+      demo: {
+        id: 'demo', human: 'jason', arbiters: { technical: 'chief', delivery: 'chief' }, vars: { 'bus.tester': true },
+        plugins: { harness: ['pi'] },
+        roles: { chief: { definition: 'chief-of-staff', authority: shipped('chief-of-staff').authority }, bean: { definition: 'companion', ...within } },
+      },
+    },
+    organization: { dir: root, rolesDir, system: systemFor(root) },
+  });
+  t.after(async () => { await bus.close(); rmSync(root, { recursive: true, force: true }); });
+  const b = bus.broker;
+  const human = b.bindHuman({ business: 'demo', human: 'jason', via: 'cli', outsideAgent: true });
+  const tester = b.bindTester({ business: 'demo' });
+  const chief = b.bindLaunch({ business: 'demo', role: 'chief', run: 'chief-run', harness: 'pi' });
+  b.request(chief, { verb: 'role.claim' });
+  const call = (cap, verb, args = {}) => b.request(cap, { verb, args });
+  const history = join(root, 'businesses/.history/demo/changes.jsonl');
+  const log = () => (existsSync(history) ? readFileSync(history, 'utf8').trim().split('\n').filter(Boolean).map(JSON.parse) : []);
+  const bytes = () => readFileSync(file, 'utf8');
+  return { human, tester, chief, call, log, bytes };
+}
+
+test('M10 through the broker: the chief and the tester are refused on bean, the human\'s limits.set of its models key works', async (t) => {
+  const { human, tester, chief, call, log, bytes } = await runtime(t);
+  const { revision, models } = call(human, 'limits');
+  const changed = { ...models, 'claude-sonnet-5-5': { ...models['claude-sonnet-5-5'], model: 'claude-sonnet-5-5-next' } };
+  const before = bytes();
+  // The chief of staff's organization.set reaches the writer as chief-of-staff.chief and is refused there.
+  assert.throws(() => call(chief, 'organization.set', { revision, models: changed }), { code: 'organization-creative-human-only' });
+  assert.throws(() => call(chief, 'organization.set', { revision, instances: { bean: 'claude-opus-5-5' } }), { code: 'organization-creative-instance' });
+  // The tester never reaches the writer through these two verbs (webby-0040 N5).
+  assert.throws(() => call(tester, 'organization.set', { revision, models: changed }), { code: 'tester-refused' });
+  assert.throws(() => call(tester, 'limits.set', { revision, models: changed }), { code: 'tester-refused' });
+  // Its instances.set and routes.set do reach the writer, as tester, and are refused there.
+  assert.throws(() => call(tester, 'instances.set', { revision, instance: 'bean', op: 'change', vars: { thinking: 'low' } }),
+    { code: 'organization-creative-human-only' });
+  assert.throws(() => call(tester, 'instances.set', { revision, instance: 'muse', op: 'add', definition: 'ideas' }),
+    { code: 'organization-creative-human-only' });
+  assert.throws(() => call(tester, 'routes.set', { revision, routes: { bean: { harness: 'pi', model: 'claude-opus-5-5', thinking: 'high', fallback: null } } }),
+    { code: 'organization-creative-human-only' });
+  assert.equal(bytes(), before);
+  assert.deepEqual(log().filter((e) => e.state === 'committed'), []);
+  // The human's limits.set of the same change lands, logged with the human as actor.
+  call(human, 'limits.set', { revision, models: changed });
+  assert.equal(JSON.parse(bytes()).launch.models['claude-sonnet-5-5'].model, 'claude-sonnet-5-5-next');
+  assert.deepEqual(log().filter((e) => e.state === 'committed').map((e) => e.actor), ['jason']);
+});
@@ -0,0 +1,365 @@
+PRAGMA journal_mode = WAL;
+PRAGMA foreign_keys = ON;
+CREATE TABLE meta (key TEXT PRIMARY KEY, value TEXT NOT NULL) STRICT;
+CREATE TABLE events (
+  seq INTEGER PRIMARY KEY AUTOINCREMENT,
+  id TEXT NOT NULL UNIQUE,
+  at TEXT NOT NULL,
+  business TEXT NOT NULL,
+  kind TEXT NOT NULL CHECK (kind IN (
+    'session.launched',
+    'session.ended',
+    'action.allowed',
+    'action.refused',
+    'task.created',
+    'task.assigned',
+    'task.state',
+    'task.closed',
+    'task.changed.external',
+    'task.conflict',
+    'task.missing',
+    'review.requested',
+    'review.verdict',
+    'human.input',
+    'config.refused',
+    'credential.expiring',
+    'credential.expired',
+    'credential.changed',
+    'launch.revoked',
+    'launch.restored',
+    'digest.sent')),
+  actor_role TEXT, actor_run TEXT,
+  subject TEXT,
+  corrects TEXT REFERENCES events(id),
+  body TEXT NOT NULL CHECK (json_valid(body))
+) STRICT;
+CREATE TABLE role_claims (
+  seq INTEGER PRIMARY KEY AUTOINCREMENT,
+  at TEXT NOT NULL,
+  business TEXT NOT NULL, role TEXT NOT NULL,
+  op TEXT NOT NULL CHECK (op IN ('claim','release','revoke')),
+  holder_run TEXT NOT NULL,
+  harness TEXT NOT NULL, address TEXT,
+  by TEXT NOT NULL, reason TEXT,
+  decision TEXT
+) STRICT;
+CREATE TABLE decisions (
+  seq INTEGER PRIMARY KEY AUTOINCREMENT,
+  id TEXT NOT NULL UNIQUE,
+  at TEXT NOT NULL,
+  business TEXT NOT NULL, project TEXT,
+  raised_by_role TEXT NOT NULL, raised_by_run TEXT NOT NULL,
+  class TEXT NOT NULL CHECK (class IN ('routine','within-role','cross-role','gated')),
+  action TEXT NOT NULL,
+  route_to TEXT NOT NULL,
+  question TEXT NOT NULL,
+  options TEXT NOT NULL CHECK (json_valid(options) AND json_array_length(options) BETWEEN 2 AND 9),
+  recommendation TEXT NOT NULL,
+  task_ref TEXT CHECK (task_ref IS NULL OR (task_ref GLOB 'vikunja:[1-9]*/[1-9]*' AND NOT substr(task_ref, 9) GLOB '*[^0-9/]*' AND NOT substr(task_ref, 9) GLOB '*/*/*')), requirement_ref TEXT,
+  blocking INTEGER NOT NULL CHECK (blocking IN (0,1)),
+  supersedes TEXT REFERENCES decisions(id)
+, spec_path TEXT, spec_commit TEXT) STRICT;
+CREATE TABLE decision_events (
+  seq INTEGER PRIMARY KEY AUTOINCREMENT,
+  decision TEXT NOT NULL REFERENCES decisions(id),
+  at TEXT NOT NULL,
+  op TEXT NOT NULL CHECK (op IN ('seen','resolved','withdrawn','expired')),
+  by TEXT NOT NULL,
+  choice TEXT, note TEXT, via TEXT
+) STRICT;
+CREATE TABLE messages (
+  seq INTEGER PRIMARY KEY AUTOINCREMENT,
+  id TEXT NOT NULL UNIQUE,
+  at TEXT NOT NULL,
+  business TEXT NOT NULL,
+  from_role TEXT NOT NULL, from_run TEXT NOT NULL,
+  to_role TEXT NOT NULL,
+  class TEXT NOT NULL,
+  in_reply_to TEXT REFERENCES messages(id),
+  decision TEXT REFERENCES decisions(id),
+  corrects TEXT REFERENCES messages(id),
+  body TEXT NOT NULL
+, to_name TEXT) STRICT;
+CREATE TABLE deliveries (
+  seq INTEGER PRIMARY KEY AUTOINCREMENT,
+  message TEXT NOT NULL REFERENCES messages(id),
+  at TEXT NOT NULL,
+  op TEXT NOT NULL CHECK (op IN ('routed','delivered','failed','read')),
+  holder_run TEXT, transport TEXT, address TEXT, detail TEXT
+) STRICT;
+CREATE TABLE task_snapshots (
+  seq INTEGER PRIMARY KEY AUTOINCREMENT,
+  at TEXT NOT NULL,
+  business TEXT NOT NULL,
+  task_ref TEXT NOT NULL CHECK (task_ref GLOB 'vikunja:[1-9]*/[1-9]*' AND NOT substr(task_ref, 9) GLOB '*[^0-9/]*' AND NOT substr(task_ref, 9) GLOB '*/*/*'),
+  updated TEXT NOT NULL,
+  etag TEXT,
+  digest TEXT NOT NULL CHECK (length(digest) = 64 AND NOT digest GLOB '*[^0-9a-f]*'),
+  fields TEXT NOT NULL CHECK (json_valid(fields)),
+  source TEXT NOT NULL CHECK (source IN ('self','poll')),
+  via TEXT CHECK (via IN ('board','cursor','task','reconcile')),
+  read_at TEXT,
+  role TEXT, run TEXT,
+  CHECK ((source = 'self') = (role IS NOT NULL AND run IS NOT NULL)),
+  CHECK ((source = 'poll') = (via IS NOT NULL AND read_at IS NOT NULL)),
+  CHECK (json_type(fields, '$.bucket') IS 'integer'
+         OR (source IS 'poll' AND via IS 'task' AND json_type(fields, '$.gone') IS 'text'))
+) STRICT;
+CREATE INDEX task_snapshots_ref ON task_snapshots (business, task_ref, seq);
+CREATE TRIGGER decisions_resolve_once BEFORE INSERT ON decision_events
+  WHEN NEW.op IN ('resolved','withdrawn','expired') AND EXISTS (
+    SELECT 1 FROM decision_events WHERE decision = NEW.decision AND op IN ('resolved','withdrawn','expired'))
+  BEGIN SELECT RAISE(ABORT, 'decision already closed'); END;
+CREATE TRIGGER decisions_resolved_choice BEFORE INSERT ON decision_events
+  WHEN NEW.op = 'resolved' AND (NEW.choice IS NULL OR NOT EXISTS (
+    SELECT 1 FROM decisions d, json_each(d.options) o WHERE d.id = NEW.decision AND json_extract(o.value,'$.key') = NEW.choice))
+  BEGIN SELECT RAISE(ABORT, 'resolution must name one of the options'); END;
+CREATE TRIGGER role_one_holder BEFORE INSERT ON role_claims
+  WHEN NEW.op = 'claim' AND (SELECT op FROM role_claims WHERE business = NEW.business AND role = NEW.role ORDER BY seq DESC LIMIT 1) = 'claim'
+  BEGIN SELECT RAISE(ABORT, 'role already held'); END;
+CREATE TRIGGER role_release_by_holder BEFORE INSERT ON role_claims
+  WHEN NEW.op IN ('release','revoke') AND COALESCE((SELECT op FROM role_claims WHERE business = NEW.business AND role = NEW.role ORDER BY seq DESC LIMIT 1),'') <> 'claim'
+  BEGIN SELECT RAISE(ABORT, 'role is not held'); END;
+CREATE TRIGGER role_release_same_run BEFORE INSERT ON role_claims
+  WHEN NEW.op = 'release' AND (SELECT holder_run FROM role_claims WHERE business = NEW.business AND role = NEW.role ORDER BY seq DESC LIMIT 1) <> NEW.holder_run
+  BEGIN SELECT RAISE(ABORT, 'only the holder releases; others revoke'); END;
+CREATE TRIGGER role_revoke_needs_decision BEFORE INSERT ON role_claims
+  WHEN NEW.op = 'revoke' AND NEW.decision IS NULL AND NEW.reason IS NULL
+  BEGIN SELECT RAISE(ABORT, 'revoke needs a resolved decision or a reason'); END;
+CREATE TRIGGER meta_no_update BEFORE UPDATE ON meta BEGIN SELECT RAISE(ABORT, 'meta is append-only'); END;
+CREATE TRIGGER meta_no_delete BEFORE DELETE ON meta BEGIN SELECT RAISE(ABORT, 'meta is append-only'); END;
+CREATE TRIGGER events_no_update BEFORE UPDATE ON events BEGIN SELECT RAISE(ABORT, 'events is append-only'); END;
+CREATE TRIGGER events_no_delete BEFORE DELETE ON events BEGIN SELECT RAISE(ABORT, 'events is append-only'); END;
+CREATE TRIGGER role_claims_no_update BEFORE UPDATE ON role_claims BEGIN SELECT RAISE(ABORT, 'role_claims is append-only'); END;
+CREATE TRIGGER role_claims_no_delete BEFORE DELETE ON role_claims BEGIN SELECT RAISE(ABORT, 'role_claims is append-only'); END;
+CREATE TRIGGER decisions_no_update BEFORE UPDATE ON decisions BEGIN SELECT RAISE(ABORT, 'decisions is append-only'); END;
+CREATE TRIGGER decisions_no_delete BEFORE DELETE ON decisions BEGIN SELECT RAISE(ABORT, 'decisions is append-only'); END;
+CREATE TRIGGER decision_events_no_update BEFORE UPDATE ON decision_events BEGIN SELECT RAISE(ABORT, 'decision_events is append-only'); END;
+CREATE TRIGGER decision_events_no_delete BEFORE DELETE ON decision_events BEGIN SELECT RAISE(ABORT, 'decision_events is append-only'); END;
+CREATE TRIGGER messages_no_update BEFORE UPDATE ON messages BEGIN SELECT RAISE(ABORT, 'messages is append-only'); END;
+CREATE TRIGGER messages_no_delete BEFORE DELETE ON messages BEGIN SELECT RAISE(ABORT, 'messages is append-only'); END;
+CREATE TRIGGER deliveries_no_update BEFORE UPDATE ON deliveries BEGIN SELECT RAISE(ABORT, 'deliveries is append-only'); END;
+CREATE TRIGGER deliveries_no_delete BEFORE DELETE ON deliveries BEGIN SELECT RAISE(ABORT, 'deliveries is append-only'); END;
+CREATE TRIGGER meta_no_replace BEFORE INSERT ON meta WHEN EXISTS (SELECT 1 FROM meta WHERE key = NEW.key) BEGIN SELECT RAISE(ABORT, 'meta is append-only'); END;
+CREATE TRIGGER events_no_replace BEFORE INSERT ON events WHEN EXISTS (SELECT 1 FROM events WHERE seq = NEW.seq OR id = NEW.id) BEGIN SELECT RAISE(ABORT, 'events is append-only'); END;
+CREATE TRIGGER role_claims_no_replace BEFORE INSERT ON role_claims WHEN EXISTS (SELECT 1 FROM role_claims WHERE seq = NEW.seq) BEGIN SELECT RAISE(ABORT, 'role_claims is append-only'); END;
+CREATE TRIGGER decisions_no_replace BEFORE INSERT ON decisions WHEN EXISTS (SELECT 1 FROM decisions WHERE seq = NEW.seq OR id = NEW.id) BEGIN SELECT RAISE(ABORT, 'decisions is append-only'); END;
+CREATE TRIGGER decision_events_no_replace BEFORE INSERT ON decision_events WHEN EXISTS (SELECT 1 FROM decision_events WHERE seq = NEW.seq) BEGIN SELECT RAISE(ABORT, 'decision_events is append-only'); END;
+CREATE TRIGGER messages_no_replace BEFORE INSERT ON messages WHEN EXISTS (SELECT 1 FROM messages WHERE seq = NEW.seq OR id = NEW.id) BEGIN SELECT RAISE(ABORT, 'messages is append-only'); END;
+CREATE TRIGGER deliveries_no_replace BEFORE INSERT ON deliveries WHEN EXISTS (SELECT 1 FROM deliveries WHERE seq = NEW.seq) BEGIN SELECT RAISE(ABORT, 'deliveries is append-only'); END;
+CREATE TRIGGER task_snapshots_no_update BEFORE UPDATE ON task_snapshots BEGIN SELECT RAISE(ABORT, 'task_snapshots is append-only'); END;
+CREATE TRIGGER task_snapshots_no_delete BEFORE DELETE ON task_snapshots BEGIN SELECT RAISE(ABORT, 'task_snapshots is append-only'); END;
+CREATE TRIGGER task_snapshots_no_replace BEFORE INSERT ON task_snapshots WHEN EXISTS (SELECT 1 FROM task_snapshots WHERE seq = NEW.seq) BEGIN SELECT RAISE(ABORT, 'task_snapshots is append-only'); END;
+CREATE TRIGGER decisions_blocking_needs_task BEFORE INSERT ON decisions
+  WHEN NEW.blocking = 1 AND NEW.task_ref IS NULL
+  BEGIN SELECT RAISE(ABORT, 'a blocking decision cites the task it blocks'); END;
+CREATE TRIGGER events_launch_by_human BEFORE INSERT ON events
+  WHEN NEW.kind IN ('launch.revoked','launch.restored') AND (NEW.actor_role IS NOT NULL OR NEW.actor_run IS NOT NULL)
+  BEGIN SELECT RAISE(ABORT, 'only the human revokes or restores launching'); END;
+CREATE TRIGGER events_credential_body BEFORE INSERT ON events
+  WHEN NEW.kind GLOB 'credential.*' AND (
+    json_extract(NEW.body, '$.service') IS NULL OR json_extract(NEW.body, '$.service') NOT IN ('gitea','vikunja')
+    OR json_extract(NEW.body, '$.instance') IS NULL)
+  BEGIN SELECT RAISE(ABORT, 'credential events name a service and a role instance'); END;
+CREATE TRIGGER events_task_missing_body BEFORE INSERT ON events
+  WHEN NEW.kind = 'task.missing' AND (
+    json_extract(NEW.body, '$.reason') IS NULL OR json_extract(NEW.body, '$.reason') NOT IN ('moved','not-found','no-access')
+    OR (json_extract(NEW.body, '$.reason') = 'moved' AND json_type(NEW.body, '$.project') IS NOT 'integer'))
+  BEGIN SELECT RAISE(ABORT, 'task.missing carries a reason, and the new project when moved'); END;
+CREATE TRIGGER events_task_subject BEFORE INSERT ON events
+  WHEN NEW.kind GLOB 'task.*' AND (NEW.subject IS NULL OR NOT (NEW.subject GLOB 'vikunja:[1-9]*/[1-9]*' AND NOT substr(NEW.subject, 9) GLOB '*[^0-9/]*' AND NOT substr(NEW.subject, 9) GLOB '*/*/*'))
+  BEGIN SELECT RAISE(ABORT, 'a task event names its task in subject'); END;
+CREATE TRIGGER events_task_created_body BEFORE INSERT ON events
+  WHEN NEW.kind = 'task.created' AND (
+    json_type(NEW.body, '$.request') IS NOT 'text'
+    OR NOT EXISTS (SELECT 1 FROM events WHERE id = json_extract(NEW.body, '$.request')
+                   AND kind = 'human.input' AND business = NEW.business)
+    OR json_type(NEW.body, '$.requirement') IS NOT 'text'
+    OR NOT json_extract(NEW.body, '$.requirement') GLOB 'REQ-[A-Z]*-[1-9]*'
+    OR json_extract(NEW.body, '$.requirement') GLOB 'REQ-*[^A-Z0-9-]*')
+  BEGIN SELECT RAISE(ABORT, 'task.created cites the human.input that asked for it and a requirement id'); END;
+CREATE VIEW launch_state AS
+  SELECT business, CASE kind WHEN 'launch.revoked' THEN 'revoked' ELSE 'allowed' END AS state, at
+  FROM events e WHERE kind IN ('launch.revoked','launch.restored')
+    AND seq = (SELECT max(seq) FROM events WHERE business = e.business AND kind IN ('launch.revoked','launch.restored'));
+CREATE VIEW task_external_changes AS
+  SELECT p.business, p.task_ref, p.seq, p.via, p.updated, p.digest, ls.digest AS self_digest
+  FROM task_snapshots p
+  LEFT JOIN task_snapshots ls ON ls.seq = (SELECT max(seq) FROM task_snapshots
+                                           WHERE business = p.business AND task_ref = p.task_ref AND source = 'self')
+  WHERE p.source = 'poll'
+    AND p.seq = (SELECT max(seq) FROM task_snapshots WHERE business = p.business AND task_ref = p.task_ref)
+    AND (ls.seq IS NULL OR (p.updated >= ls.updated AND p.read_at > ls.at AND p.digest <> ls.digest));
+CREATE VIEW task_current AS
+  SELECT s.seq, s.at, s.business, s.task_ref, s.updated, s.etag, s.digest, s.fields, s.source, s.via, s.read_at, s.role, s.run
+  FROM task_snapshots s
+  WHERE s.seq = (SELECT max(c.seq) FROM task_snapshots c
+                 WHERE c.business = s.business AND c.task_ref = s.task_ref
+                   AND (c.source = 'self'
+                        OR c.read_at > coalesce((SELECT ls.at FROM task_snapshots ls
+                                                 WHERE ls.business = c.business AND ls.task_ref = c.task_ref AND ls.source = 'self'
+                                                 ORDER BY ls.seq DESC LIMIT 1), '')));
+CREATE VIEW tasks_open AS
+  SELECT s.business, s.task_ref, json_extract(s.fields, '$.bucket') AS bucket, s.seq
+  FROM task_current s
+  WHERE json_type(s.fields, '$.gone') IS NULL
+    AND json_extract(s.fields, '$.done') = 0;
+CREATE VIEW urgent_inbox AS
+  SELECT d.id, d.business, d.task_ref, d.question, d.at
+  FROM decisions d
+  WHERE d.class = 'gated' AND d.blocking = 1
+    AND NOT EXISTS (SELECT 1 FROM decision_events x WHERE x.decision = d.id AND x.op IN ('resolved','withdrawn','expired'));
+CREATE TABLE task_comment_cursors (
+  seq INTEGER PRIMARY KEY AUTOINCREMENT,
+  business TEXT NOT NULL,
+  task_id INTEGER NOT NULL CHECK (task_id > 0),
+  last_comment INTEGER NOT NULL CHECK (last_comment > 0)
+) STRICT;
+CREATE INDEX task_comment_cursors_latest ON task_comment_cursors (business, task_id, seq);
+CREATE TRIGGER task_comment_cursors_no_update BEFORE UPDATE ON task_comment_cursors
+  BEGIN SELECT RAISE(ABORT, 'task_comment_cursors is append-only'); END;
+CREATE TRIGGER task_comment_cursors_no_delete BEFORE DELETE ON task_comment_cursors
+  BEGIN SELECT RAISE(ABORT, 'task_comment_cursors is append-only'); END;
+CREATE TRIGGER task_comment_cursors_no_replace BEFORE INSERT ON task_comment_cursors
+  WHEN EXISTS (SELECT 1 FROM task_comment_cursors WHERE seq = NEW.seq)
+  BEGIN SELECT RAISE(ABORT, 'task_comment_cursors is append-only'); END;
+CREATE TRIGGER task_comment_cursors_forward BEFORE INSERT ON task_comment_cursors
+  WHEN NEW.last_comment <= COALESCE((SELECT last_comment FROM task_comment_cursors
+    WHERE business = NEW.business AND task_id = NEW.task_id ORDER BY seq DESC LIMIT 1), 0)
+  BEGIN SELECT RAISE(ABORT, 'comment cursor must advance'); END;
+CREATE TABLE projects (
+  seq INTEGER PRIMARY KEY AUTOINCREMENT,
+  id TEXT NOT NULL UNIQUE,
+  at TEXT NOT NULL,
+  business TEXT NOT NULL,
+  name TEXT NOT NULL,
+  repo TEXT,
+  created_by TEXT NOT NULL,
+  UNIQUE (business, name)
+) STRICT;
+CREATE TABLE threads (
+  seq INTEGER PRIMARY KEY AUTOINCREMENT,
+  id TEXT NOT NULL UNIQUE,
+  at TEXT NOT NULL,
+  business TEXT NOT NULL,
+  project TEXT NOT NULL REFERENCES projects(id),
+  instance TEXT NOT NULL,
+  owner TEXT NOT NULL,
+  name TEXT NOT NULL,
+  UNIQUE (project, name)
+) STRICT;
+CREATE TABLE thread_claims (
+  seq INTEGER PRIMARY KEY AUTOINCREMENT,
+  at TEXT NOT NULL,
+  business TEXT NOT NULL,
+  thread TEXT NOT NULL REFERENCES threads(id),
+  op TEXT NOT NULL CHECK (op IN ('claim','release','revoke')),
+  holder_run TEXT NOT NULL,
+  harness TEXT NOT NULL, address TEXT,
+  by TEXT NOT NULL, reason TEXT,
+  decision TEXT
+) STRICT;
+CREATE TABLE message_threads (
+  message TEXT PRIMARY KEY REFERENCES messages(id),
+  thread TEXT NOT NULL REFERENCES threads(id)
+) STRICT;
+CREATE TABLE thread_opens (
+  seq INTEGER PRIMARY KEY AUTOINCREMENT,
+  at TEXT NOT NULL,
+  thread TEXT NOT NULL REFERENCES threads(id),
+  by TEXT NOT NULL
+) STRICT;
+CREATE INDEX thread_claims_thread ON thread_claims (thread, seq);
+CREATE INDEX message_threads_thread ON message_threads (thread);
+CREATE TRIGGER threads_project_business BEFORE INSERT ON threads
+  WHEN (SELECT business FROM projects WHERE id = NEW.project) IS NOT NEW.business
+  BEGIN SELECT RAISE(ABORT, 'a thread belongs to its project''s business'); END;
+CREATE TRIGGER thread_one_holder BEFORE INSERT ON thread_claims
+  WHEN NEW.op = 'claim' AND (SELECT op FROM thread_claims WHERE thread = NEW.thread ORDER BY seq DESC LIMIT 1) = 'claim'
+  BEGIN SELECT RAISE(ABORT, 'thread already held'); END;
+CREATE TRIGGER thread_one_per_run BEFORE INSERT ON thread_claims
+  WHEN NEW.op = 'claim' AND EXISTS (SELECT 1 FROM thread_claims c WHERE c.holder_run = NEW.holder_run AND c.business = NEW.business
+    AND c.seq = (SELECT max(seq) FROM thread_claims WHERE thread = c.thread) AND c.op = 'claim')
+  BEGIN SELECT RAISE(ABORT, 'run already holds a thread'); END;
+CREATE TRIGGER thread_release_by_holder BEFORE INSERT ON thread_claims
+  WHEN NEW.op IN ('release','revoke') AND COALESCE((SELECT op FROM thread_claims WHERE thread = NEW.thread ORDER BY seq DESC LIMIT 1),'') <> 'claim'
+  BEGIN SELECT RAISE(ABORT, 'thread is not held'); END;
+CREATE TRIGGER thread_release_same_run BEFORE INSERT ON thread_claims
+  WHEN NEW.op = 'release' AND (SELECT holder_run FROM thread_claims WHERE thread = NEW.thread ORDER BY seq DESC LIMIT 1) <> NEW.holder_run
+  BEGIN SELECT RAISE(ABORT, 'only the holder releases; others revoke'); END;
+CREATE TRIGGER thread_revoke_needs_decision BEFORE INSERT ON thread_claims
+  WHEN NEW.op = 'revoke' AND NEW.decision IS NULL AND NEW.reason IS NULL
+  BEGIN SELECT RAISE(ABORT, 'revoke needs a resolved decision or a reason'); END;
+CREATE TRIGGER thread_claims_business BEFORE INSERT ON thread_claims
+  WHEN (SELECT business FROM threads WHERE id = NEW.thread) IS NOT NEW.business
+  BEGIN SELECT RAISE(ABORT, 'a thread claim names the thread''s business'); END;
+CREATE TRIGGER message_threads_match BEFORE INSERT ON message_threads
+  WHEN NOT EXISTS (SELECT 1 FROM messages m JOIN threads t ON t.id = NEW.thread
+    WHERE m.id = NEW.message AND m.business = t.business AND t.instance IN (m.to_role, m.from_role))
+  BEGIN SELECT RAISE(ABORT, 'a threaded message is to or from the thread''s instance'); END;
+CREATE TRIGGER delivery_same_thread BEFORE INSERT ON deliveries
+  WHEN NEW.op IN ('routed','delivered') AND (NEW.op = 'delivered' OR NEW.holder_run IS NOT NULL)
+    AND EXISTS (SELECT 1 FROM message_threads mt JOIN messages m ON m.id = mt.message JOIN threads t ON t.id = mt.thread
+      WHERE mt.message = NEW.message AND m.to_role = t.instance
+        AND NOT EXISTS (SELECT 1 FROM thread_claims c WHERE c.seq = (SELECT max(seq) FROM thread_claims WHERE thread = t.id)
+          AND c.op = 'claim' AND c.holder_run IS NEW.holder_run))
+  BEGIN SELECT RAISE(ABORT, 'a threaded message goes only to its thread''s holder'); END;
+CREATE TRIGGER projects_no_update BEFORE UPDATE ON projects BEGIN SELECT RAISE(ABORT, 'projects is append-only'); END;
+CREATE TRIGGER projects_no_delete BEFORE DELETE ON projects BEGIN SELECT RAISE(ABORT, 'projects is append-only'); END;
+CREATE TRIGGER projects_no_replace BEFORE INSERT ON projects WHEN EXISTS (SELECT 1 FROM projects WHERE seq = NEW.seq OR id = NEW.id) BEGIN SELECT RAISE(ABORT, 'projects is append-only'); END;
+CREATE TRIGGER threads_no_update BEFORE UPDATE ON threads BEGIN SELECT RAISE(ABORT, 'threads is append-only'); END;
+CREATE TRIGGER threads_no_delete BEFORE DELETE ON threads BEGIN SELECT RAISE(ABORT, 'threads is append-only'); END;
+CREATE TRIGGER threads_no_replace BEFORE INSERT ON threads WHEN EXISTS (SELECT 1 FROM threads WHERE seq = NEW.seq OR id = NEW.id) BEGIN SELECT RAISE(ABORT, 'threads is append-only'); END;
+CREATE TRIGGER thread_claims_no_update BEFORE UPDATE ON thread_claims BEGIN SELECT RAISE(ABORT, 'thread_claims is append-only'); END;
+CREATE TRIGGER thread_claims_no_delete BEFORE DELETE ON thread_claims BEGIN SELECT RAISE(ABORT, 'thread_claims is append-only'); END;
+CREATE TRIGGER thread_claims_no_replace BEFORE INSERT ON thread_claims WHEN EXISTS (SELECT 1 FROM thread_claims WHERE seq = NEW.seq) BEGIN SELECT RAISE(ABORT, 'thread_claims is append-only'); END;
+CREATE TRIGGER message_threads_no_update BEFORE UPDATE ON message_threads BEGIN SELECT RAISE(ABORT, 'message_threads is append-only'); END;
+CREATE TRIGGER message_threads_no_delete BEFORE DELETE ON message_threads BEGIN SELECT RAISE(ABORT, 'message_threads is append-only'); END;
+CREATE TRIGGER message_threads_no_replace BEFORE INSERT ON message_threads WHEN EXISTS (SELECT 1 FROM message_threads WHERE message = NEW.message) BEGIN SELECT RAISE(ABORT, 'message_threads is append-only'); END;
+CREATE TRIGGER thread_opens_no_update BEFORE UPDATE ON thread_opens BEGIN SELECT RAISE(ABORT, 'thread_opens is append-only'); END;
+CREATE TRIGGER thread_opens_no_delete BEFORE DELETE ON thread_opens BEGIN SELECT RAISE(ABORT, 'thread_opens is append-only'); END;
+CREATE TRIGGER thread_opens_no_replace BEFORE INSERT ON thread_opens WHEN EXISTS (SELECT 1 FROM thread_opens WHERE seq = NEW.seq) BEGIN SELECT RAISE(ABORT, 'thread_opens is append-only'); END;
+CREATE TABLE instance_names (
+  seq INTEGER PRIMARY KEY AUTOINCREMENT,
+  at TEXT NOT NULL,
+  business TEXT NOT NULL,
+  instance TEXT NOT NULL,
+  name TEXT NOT NULL,
+  by TEXT NOT NULL
+) STRICT;
+CREATE TRIGGER instance_names_unique BEFORE INSERT ON instance_names
+  WHEN EXISTS (SELECT 1 FROM instance_names n WHERE n.business = NEW.business AND n.name = NEW.name
+    AND n.instance <> NEW.instance
+    AND n.seq = (SELECT max(seq) FROM instance_names WHERE business = n.business AND instance = n.instance))
+  BEGIN SELECT RAISE(ABORT, 'an instance name is unique in its business'); END;
+CREATE TRIGGER instance_names_no_update BEFORE UPDATE ON instance_names BEGIN SELECT RAISE(ABORT, 'instance_names is append-only'); END;
+CREATE TRIGGER instance_names_no_delete BEFORE DELETE ON instance_names BEGIN SELECT RAISE(ABORT, 'instance_names is append-only'); END;
+CREATE TRIGGER instance_names_no_replace BEFORE INSERT ON instance_names WHEN EXISTS (SELECT 1 FROM instance_names WHERE seq = NEW.seq) BEGIN SELECT RAISE(ABORT, 'instance_names is append-only'); END;
+-- Row 124 (#1618): immutable source snapshots and turn outcomes, never transcript text.
+CREATE TABLE usage_records (
+  seq INTEGER PRIMARY KEY AUTOINCREMENT,
+  at TEXT NOT NULL,
+  business TEXT NOT NULL,
+  run TEXT NOT NULL,
+  instance TEXT NOT NULL,
+  provider TEXT,
+  model TEXT,
+  account TEXT,
+  turn TEXT NOT NULL,
+  source TEXT NOT NULL,
+  phase TEXT NOT NULL CHECK (phase IN ('begin','end')),
+  status TEXT NOT NULL CHECK (status IN ('known','unknown')),
+  code TEXT,
+  cursor TEXT CHECK (cursor IS NULL OR json_valid(cursor)),
+  input INTEGER,
+  output INTEGER,
+  cache_write INTEGER,
+  cache_read INTEGER,
+  UNIQUE (business,run,turn,source,phase),
+  CHECK ((status='unknown' AND input IS NULL AND output IS NULL AND cache_write IS NULL AND cache_read IS NULL)
+    OR (status='known' AND input >= 0 AND output >= 0 AND cache_write >= 0 AND cache_read >= 0
+      AND input IS NOT NULL AND output IS NOT NULL AND cache_write IS NOT NULL AND cache_read IS NOT NULL))
+) STRICT;
+CREATE TRIGGER usage_records_no_update BEFORE UPDATE ON usage_records BEGIN SELECT RAISE(ABORT, 'usage_records is append-only'); END;
+CREATE TRIGGER usage_records_no_delete BEFORE DELETE ON usage_records BEGIN SELECT RAISE(ABORT, 'usage_records is append-only'); END;
+CREATE TRIGGER usage_records_no_replace BEFORE INSERT ON usage_records WHEN EXISTS (SELECT 1 FROM usage_records WHERE seq=NEW.seq OR (business=NEW.business AND run=NEW.run AND turn=NEW.turn AND source=NEW.source AND phase=NEW.phase)) BEGIN SELECT RAISE(ABORT, 'usage_records is append-only'); END;
@@ -0,0 +1,489 @@
+// Row 234 (#1740, #436a row a): host enrollment through a credential.mint raise with a `grant` binding
+// (r6 E1, E2, E4, X1, X3). The keyscan is a fake that returns key lines this test makes, ssh-keygen is
+// real, and the key files go under a scratch config dir. Nothing connects to any host.
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { execFileSync } from 'node:child_process';
+import { existsSync, mkdtempSync, readFileSync, readdirSync, rmSync, statSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { Broker, BusError, writeGrantEvent, registrySha256 } from '../src/broker.mjs';
+import { Store } from '../src/store.mjs';
+import { hostGrant, fingerprint, grantTag, installerTag } from '../src/host-grant.mjs';
+import { grantDecision } from './host-fixtures.mjs';
+
+const options = [{ key: 'yes', text: 'Yes' }, { key: 'no', text: 'No' }];
+const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
+const keyLine = (dir, name) => {
+  execFileSync('ssh-keygen', ['-q', '-t', 'ed25519', '-N', '', '-C', 'x', '-f', join(dir, name)]);
+  return readFileSync(join(dir, name + '.pub'), 'utf8').trim().split(' ').slice(0, 2).join(' ');
+};
+const refusesWith = async (p, code) => assert.rejects(Promise.resolve().then(() => p), (e) => (assert.equal(e.code, code), true));
+const refusesSync = (fn, code) => assert.throws(fn, (e) => (assert.equal(e.code, code), true));
+
+function setup(t, { keygen, check, hang = false } = {}) {
+  const root = mkdtempSync(join(tmpdir(), 'g234-'));
+  const store = new Store(root);
+  t.after(() => {
+    store.close();
+    rmSync(root, { recursive: true, force: true });
+  });
+  const hostKeys = [keyLine(root, 'hk1'), keyLine(root, 'hk2')];
+  const scans = [];
+  const scan = { lines: hostKeys };
+  const configDir = join(root, 'config');
+  const real = hostGrant({
+    configDir,
+    runRoot: join(configDir, 'secrets', 'run'),
+    scan: async (address, port) => (scans.push([address, port]), scan.lines),
+    ...(keygen ? { keygen } : {}),
+  });
+  const checks = [];
+  // `hang`: steps 2 and 3 run, then the call never returns, as when the child dies before step 4.
+  const enroll = hang ? async (...args) => (await real.enroll(...args), new Promise(() => {})) : real.enroll;
+  const hg = { ...real, enroll, check: async (...args) => (checks.push(args), check ? check(...args) : { installerFingerprint: args[2].installer_fingerprint, exit: 0 }) };
+  const business = {
+    id: 'demo',
+    human: 'jason',
+    arbiters: { technical: 'pm', delivery: 'pm' },
+    roles: {
+      chief: { definition: 'chief-of-staff', authority: { withinRole: ['message.send'], crossRole: [] } },
+      pm: { definition: 'pm', authority: { withinRole: ['message.send'], crossRole: [] } },
+    },
+    vars: { 'bus.tester': true },
+  };
+  const make = (h = hg) => new Broker({ store, businesses: { demo: business }, hostGrant: h });
+  const broker = make();
+  const caps = {};
+  const bind = (b) => {
+    for (const role of ['chief', 'pm']) {
+      caps[role] = b.bindLaunch({ business: 'demo', role, run: role + '-run-' + Math.random(), harness: 'pi', address: role });
+      b.request(caps[role], { verb: 'role.claim' });
+    }
+    caps.human = b.bindHuman({ business: 'demo', human: 'jason', via: 'cli', outsideAgent: true });
+    caps.tester = b.bindTester({ business: 'demo' });
+    caps.reader = b.bindReader({ business: 'demo' });
+  };
+  bind(broker);
+  const grant = (over = {}) => ({
+    method: 'host-enroll',
+    host: 'web1',
+    address: '192.0.2.10',
+    port: 22,
+    user: 'jarvis',
+    sudo: true,
+    fingerprints: hostKeys.map(fingerprint),
+    ...over,
+  });
+  const call = (who, verb, args = {}, b = broker) => b.request(caps[who], { verb, args });
+  const raise = (over = {}, who = 'chief', extra = {}) =>
+    call(who, 'decision.raise', {
+      action: 'credential.mint',
+      question: 'Enroll web1?',
+      options,
+      recommendation: 'yes',
+      blocking: false,
+      grant: grant(over),
+      ...extra,
+    });
+  const events = () =>
+    store
+      .all("SELECT kind, actor_role, actor_run, body FROM events WHERE business='demo' ORDER BY seq")
+      .map((e) => ({ kind: e.kind, actor_role: e.actor_role, actor_run: e.actor_run, ...JSON.parse(e.body) }));
+  const grantEvents = () => events().filter((e) => e.actor_run === 'grant');
+  const settle = async (decision) => {
+    for (let i = 0; i < 250; i++) {
+      if (grantEvents().some((e) => e.grantDecision === decision && ['grant.host.enrolled', 'grant.failed'].includes(e.action))) return;
+      await sleep(20);
+    }
+    throw new Error('enrollment did not end');
+  };
+  const keyFile = (host = 'web1') => join(configDir, 'secrets', 'hosts', 'demo', host, 'installer');
+  const hostRow = (host = 'web1') => store.get("SELECT * FROM hosts WHERE business='demo' AND host=?", host);
+  const messages = () => store.all("SELECT from_role, to_role, class, decision, body FROM messages WHERE business='demo' ORDER BY rowid");
+  return { root, store, broker, make, bind, caps, call, raise, grant, hostKeys, scan, scans, checks, events, grantEvents, settle, keyFile, hostRow, messages, configDir };
+}
+const approve = async (f, over) => {
+  const d = await f.raise(over);
+  const r = f.call('human', 'decision.resolve', { id: d.id, choice: 'yes' });
+  await f.settle(d.id);
+  return { d, r };
+};
+
+test('G1, A1: only the chief raises a grant, and a refused raise stores nothing and runs no keyscan', async (t) => {
+  const f = setup(t);
+  await refusesWith(f.raise({}, 'pm'), 'grant-chief-only');
+  await refusesWith(f.call('human', 'decision.raise', { action: 'credential.mint', question: 'q', options, recommendation: 'yes', blocking: false, grant: f.grant() }), 'agent-required');
+  await refusesWith(f.call('tester', 'decision.raise', { action: 'credential.mint', question: 'q', options, recommendation: 'yes', blocking: false, grant: f.grant() }), 'tester-refused');
+  assert.equal(f.scans.length, 0);
+  assert.equal(f.store.get('SELECT count(*) AS n FROM decisions').n, 0);
+  assert.deepEqual(f.events().filter((e) => e.kind === 'action.refused').map((e) => e.code), ['grant-chief-only', 'agent-required', 'tester-refused']);
+});
+
+test('G1: grant goes only with credential.mint, row a takes only host-enroll, and E1 refuses each bad field', async (t) => {
+  const f = setup(t);
+  await refusesWith(f.raise({}, 'chief', { action: 'deploy' }), 'invalid-request');
+  for (const over of [
+    { method: 'host' },
+    { user: 'root' },
+    { user: 'localadmin' },
+    { user: 'mosaic-installer' },
+    { user: 'Bad' },
+    { sudo: 'yes' },
+    { port: 0 },
+    { port: 65536 },
+    { host: 'Web_1' },
+    { address: '127.0.0.1' },
+    { address: 'localhost' },
+    { fingerprints: [] },
+    { fingerprints: ['SHA256:short'] },
+    { fingerprints: [f.grant().fingerprints[0], f.grant().fingerprints[0]] },
+    { extra: 1 },
+  ])
+    await refusesWith(f.raise(over), 'invalid-request');
+  const { method, ...noMethod } = f.grant();
+  await refusesWith(
+    f.call('chief', 'decision.raise', { action: 'credential.mint', question: 'q', options, recommendation: 'yes', blocking: false, grant: noMethod }),
+    'invalid-request',
+  );
+  assert.equal(f.scans.length, 0);
+  assert.equal(f.store.get('SELECT count(*) AS n FROM decisions').n, 0);
+});
+
+test('G5, A5, A6: the scanned key set must equal the requested set, or host-key-mismatch and nothing stored', async (t) => {
+  const f = setup(t);
+  const other = keyLine(f.root, 'hk3');
+  for (const lines of [[f.hostKeys[0]], [...f.hostKeys, other], [f.hostKeys[0], other], []]) {
+    f.scan.lines = lines;
+    await refusesWith(f.raise(), 'host-key-mismatch');
+  }
+  f.scan.lines = f.hostKeys;
+  await refusesWith(f.raise({ fingerprints: [fingerprint(f.hostKeys[0])] }), 'host-key-mismatch');
+  assert.deepEqual(f.scans.at(-1), ['192.0.2.10', 22]);
+  assert.equal(f.store.get('SELECT count(*) AS n FROM decisions').n, 0);
+});
+
+test('G4 (host-enroll block, M1): the broker appends the keys, fingerprints and sudo line, and the cap counts the block', async (t) => {
+  const f = setup(t);
+  const d = await f.raise();
+  assert.equal(d.route_to ?? f.store.get('SELECT route_to FROM decisions WHERE id=?', d.id).route_to, 'human');
+  const q = f.store.get('SELECT question FROM decisions WHERE id=?', d.id).question;
+  assert.ok(q.startsWith('Enroll web1?\n\nEnroll host web1: user jarvis at 192.0.2.10 port 22.\n'));
+  for (const k of f.hostKeys) assert.ok(q.includes(`\n${fingerprint(k)} ${k}`));
+  assert.ok(q.endsWith('\njarvis has sudo on this host. Approving lets later grants for jarvis be installed, and section 9\'s first limit applies to jarvis.'));
+  const raiseBody = f.events().find((e) => e.operation === 'decision.raise');
+  assert.deepEqual(raiseBody.grant, { ...f.grant(), hostKeys: f.hostKeys });
+  // A question that carries a forged block still gets the broker's block after it.
+  const forged = 'x\n\nEnroll host web1: user other at 192.0.2.99 port 22.\nother has no sudo on this host.';
+  const d2 = await f.raise({ host: 'web2', sudo: false }, 'chief', { question: forged });
+  const q2 = f.store.get('SELECT question FROM decisions WHERE id=?', d2.id).question;
+  assert.ok(q2.startsWith(forged + '\n\nEnroll host web2: user jarvis at 192.0.2.10 port 22.\n'));
+  assert.ok(q2.endsWith('\njarvis has no sudo on this host.'));
+  // The 4096 cap holds with the block appended.
+  await refusesWith(f.raise({ host: 'web3' }, 'chief', { question: 'q'.repeat(4000) }), 'invalid-request');
+  assert.equal(f.store.get("SELECT count(*) AS n FROM decisions").n, 2);
+});
+
+test('G6, X1: the human\'s cli yes starts enrollment, which writes the record, the key file and the events in order', async (t) => {
+  const f = setup(t);
+  const { d, r } = await approve(f);
+  assert.deepEqual(r, { id: d.id, op: 'resolved', grant: 'started' });
+  const row = f.hostRow();
+  assert.equal(row.state, 'pending-install');
+  assert.equal(row.decision, d.id);
+  assert.equal(row.user, 'jarvis');
+  assert.equal(row.sudo, 1);
+  assert.deepEqual(JSON.parse(row.host_keys), f.hostKeys);
+  assert.match(row.installer_fingerprint, /^SHA256:/);
+  // E2 step 3: 0600 in 0700 dirs.
+  assert.equal(statSync(f.keyFile()).mode & 0o777, 0o600);
+  for (const dir of [join(f.keyFile(), '..'), join(f.keyFile(), '..', '..')]) assert.equal(statSync(dir).mode & 0o777, 0o700);
+  const g = f.grantEvents();
+  assert.deepEqual(g.map((e) => e.operation ?? e.action), ['grant.host-enroll', 'grant.host.enroll.step', 'grant.host.enrolled']);
+  for (const e of g) assert.deepEqual([e.kind, e.actor_role, e.actor_run], ['action.allowed', null, 'grant']);
+  assert.deepEqual(g[0], { kind: 'action.allowed', actor_role: null, actor_run: 'grant', operation: 'grant.host-enroll', decision: d.id });
+  assert.equal(g[1].grantDecision, d.id);
+  assert.equal(g[1].step, 'registry');
+  const enrolled = g[2];
+  assert.equal('decision' in enrolled, false);
+  assert.equal(enrolled.registrySha256, registrySha256({ address: '192.0.2.10', port: 22, user: 'jarvis', sudo: true, hostKeys: f.hostKeys }));
+  assert.equal(enrolled.installerFingerprint, row.installer_fingerprint);
+  assert.deepEqual([enrolled.user, enrolled.sudo], ['jarvis', true]);
+  // E2 step 4's message to the human and the chief: the installer line, public half only.
+  const tag = installerTag('demo', 'web1');
+  const pub = execFileSync('ssh-keygen', ['-y', '-f', f.keyFile()], { encoding: 'utf8' }).trim().split(' ').slice(0, 2).join(' ');
+  const notes = f.messages().filter((m) => m.from_role === '_bus' && m.decision === d.id);
+  assert.deepEqual(notes.map((m) => [m.to_role, m.class]), [['human', 'RESULT'], ['chief', 'RESULT']]);
+  for (const m of notes)
+    assert.ok(m.body.includes(`\nrestrict,command="/usr/local/sbin/mosaic-keys",from="<from>" ${pub} mosaic-installer-${tag.slice(7)}\n`));
+  // A7: no part of the private key reaches the store.
+  const secret = readFileSync(f.keyFile(), 'utf8').split('\n').filter((l) => l.length >= 24 && !l.startsWith('-----'));
+  const dump = JSON.stringify([f.store.all('SELECT body FROM events'), f.store.all('SELECT body FROM messages'), f.store.all('SELECT * FROM hosts')]);
+  for (const l of secret) assert.equal(dump.includes(l), false);
+  // The tmp dir under the run root is gone.
+  assert.deepEqual(readdirSync(join(f.configDir, 'secrets', 'run')), []);
+});
+
+test('A2, A4: a credential.mint without grant, and a no, start nothing', async (t) => {
+  const f = setup(t);
+  const plain = f.call('chief', 'decision.raise', { action: 'credential.mint', question: 'Hand-made key?', options, recommendation: 'yes', blocking: false });
+  assert.deepEqual(f.call('human', 'decision.resolve', { id: plain.id, choice: 'yes' }), { id: plain.id, op: 'resolved' });
+  const d = await f.raise();
+  assert.deepEqual(f.call('human', 'decision.resolve', { id: d.id, choice: 'no' }), { id: d.id, op: 'resolved' });
+  await sleep(200);
+  assert.deepEqual(f.grantEvents(), []);
+  assert.equal(f.hostRow(), undefined);
+});
+
+test('A3, X1: a resolve by the tester or an agent starts nothing', async (t) => {
+  const f = setup(t);
+  const d = await f.raise();
+  for (const who of ['tester', 'pm', 'chief']) {
+    try {
+      f.call(who, 'decision.resolve', { id: d.id, choice: 'yes' });
+    } catch {}
+  }
+  await sleep(200);
+  assert.deepEqual(f.grantEvents(), []);
+  assert.equal(f.hostRow(), undefined);
+});
+
+test('G6 (duckworth-0081 B3): a withdraw by the chief or the human, and an arbiter resolve, start nothing', async (t) => {
+  const f = setup(t);
+  for (const who of ['chief', 'human']) {
+    const d = await f.raise();
+    assert.deepEqual(f.call(who, 'decision.withdraw', { id: d.id }), { id: d.id, op: 'withdrawn' });
+  }
+  // A grant raise always routes to the human, so the fixture writes an open one routed to the pm
+  // arbiter, which then resolves it yes through the verb.
+  const d = { id: grantDecision(f.store, { route: 'pm', grant: f.grant(), close: null }) };
+  assert.deepEqual(f.call('pm', 'decision.resolve', { id: d.id, choice: 'yes' }), { id: d.id, op: 'resolved' });
+  await sleep(200);
+  assert.deepEqual(f.grantEvents(), []);
+  assert.equal(f.hostRow(), undefined);
+  assert.deepEqual(f.broker.reconcileGrants(), []);
+  assert.equal(await f.broker.runEnrollment('demo', d.id), 'not-authorized');
+  assert.deepEqual(f.grantEvents(), []);
+});
+
+test('G10 (duckworth-0081 B1): a second start for a spent decision refuses decision-consumed, and an unresolved or agent-resolved one not-authorized', async (t) => {
+  const f = setup(t);
+  const { d } = await approve(f);
+  const before = { events: f.grantEvents(), row: f.hostRow(), messages: f.messages().length };
+  assert.equal(await f.broker.runEnrollment('demo', d.id), 'decision-consumed');
+  assert.deepEqual(f.grantEvents(), before.events);
+  assert.deepEqual(f.hostRow(), before.row);
+  assert.equal(f.messages().length, before.messages);
+  // Unresolved, then resolved by an agent: written by SQL, since the verb refuses the agent first.
+  const open = await f.raise({ host: 'web2' });
+  assert.equal(await f.broker.runEnrollment('demo', open.id), 'not-authorized');
+  f.store.run('INSERT INTO decision_events(decision,at,op,by,choice,via) VALUES(?,?,?,?,?,?)', open.id, new Date().toISOString(), 'resolved', 'chief', 'yes', 'broker');
+  assert.equal(await f.broker.runEnrollment('demo', open.id), 'not-authorized');
+  // A cli yes by someone other than the human, so the by check alone refuses it (duckworth-0083 N8, A3b).
+  const other = await f.raise({ host: 'web3' });
+  f.store.run('INSERT INTO decision_events(decision,at,op,by,choice,via) VALUES(?,?,?,?,?,?)', other.id, new Date().toISOString(), 'resolved', 'chief', 'yes', 'cli');
+  assert.equal(await f.broker.runEnrollment('demo', other.id), 'not-authorized');
+  assert.deepEqual(f.broker.reconcileGrants(), []);
+  assert.deepEqual(f.grantEvents(), before.events);
+  assert.equal(f.hostRow('web2'), undefined);
+  assert.equal(existsSync(f.keyFile('web2')), false);
+  assert.equal(f.hostRow('web3'), undefined);
+  assert.equal(existsSync(f.keyFile('web3')), false);
+});
+
+test('A8, S1: two approved enrollments for one host: the second ends host-enrolled and the pin stays', async (t) => {
+  const f = setup(t);
+  const d1 = await f.raise();
+  const d2 = await f.raise({ user: 'melanie', sudo: false });
+  f.call('human', 'decision.resolve', { id: d1.id, choice: 'yes' });
+  await f.settle(d1.id);
+  const before = f.hostRow();
+  f.call('human', 'decision.resolve', { id: d2.id, choice: 'yes' });
+  await f.settle(d2.id);
+  assert.deepEqual(f.hostRow(), before);
+  const failed = f.grantEvents().find((e) => e.grantDecision === d2.id && e.action === 'grant.failed');
+  assert.equal(failed.code, 'host-enrolled');
+  assert.ok(f.grantEvents().some((e) => e.operation === 'grant.host-enroll' && e.decision === d2.id));
+  assert.equal(f.grantEvents().filter((e) => e.grantDecision === d2.id && e.action === 'grant.host.enroll.step').length, 0);
+  // A raise for an enrolled host refuses before the keyscan.
+  const scans = f.scans.length;
+  await refusesWith(f.raise(), 'host-enrolled');
+  assert.equal(f.scans.length, scans);
+});
+
+test('A9: the hosts primary key refuses a second record for (business, host)', (t) => {
+  const f = setup(t);
+  const d = f.call('chief', 'decision.raise', { action: 'credential.mint', question: 'q', options, recommendation: 'yes', blocking: false });
+  const insert = () =>
+    f.store.run(
+      "INSERT INTO hosts(business,host,address,port,user,sudo,host_keys,state,decision) VALUES('demo','web1','192.0.2.1',22,'u',0,'[\"k\"]','pending-install',?)",
+      d.id,
+    );
+  insert();
+  assert.throws(insert, /UNIQUE|PRIMARY/);
+});
+
+test('X3: a failure at step 2 deletes the record again and ends grant.failed, with no key file', async (t) => {
+  const f = setup(t, { keygen: '/nonexistent/ssh-keygen' });
+  const { d } = await approve(f);
+  assert.equal(f.hostRow(), undefined);
+  assert.equal(existsSync(f.keyFile()), false);
+  const failed = f.grantEvents().find((e) => e.action === 'grant.failed');
+  assert.deepEqual([failed.grantDecision, failed.host, failed.code], [d.id, 'web1', 'host-failed']);
+  const notes = f.messages().filter((m) => m.from_role === '_bus' && m.decision === d.id);
+  assert.deepEqual(notes.map((m) => m.to_role), ['human', 'chief']);
+  assert.ok(notes[0].body.includes('failed: host-failed'));
+});
+
+test('A10, X3: at start a resolved, unspent enrollment is spent and ends interrupted, and never runs late', async (t) => {
+  const f = setup(t);
+  const d = await f.raise();
+  // The resolve commits, and the child dies before step 1: the resolve row alone, written here.
+  f.store.run("INSERT INTO decision_events(decision,at,op,by,choice,via) VALUES(?,?,?,?,?,?)", d.id, new Date().toISOString(), 'resolved', 'jason', 'yes', 'cli');
+  const restarted = f.make();
+  assert.deepEqual(restarted.reconcileGrants(), [d.id]);
+  const g = f.grantEvents();
+  assert.deepEqual(g.map((e) => e.operation ?? e.action), ['grant.host-enroll', 'grant.failed']);
+  assert.deepEqual([g[1].code, g[1].host, g[1].tag], ['interrupted', 'web1', installerTag('demo', 'web1')]);
+  assert.equal(f.hostRow(), undefined);
+  assert.deepEqual(restarted.reconcileGrants(), []);
+});
+
+test('X3: at start an enrollment that stopped after its registry step loses its record and key file', async (t) => {
+  const f = setup(t, { hang: true });
+  const d = await f.raise();
+  f.call('human', 'decision.resolve', { id: d.id, choice: 'yes' });
+  for (let i = 0; i < 250 && !existsSync(f.keyFile()); i++) await sleep(20);
+  assert.equal(f.hostRow().state, 'pending-install');
+  assert.ok(existsSync(f.keyFile()));
+  const restarted = f.make();
+  assert.deepEqual(restarted.reconcileGrants(), [d.id]);
+  assert.equal(f.hostRow(), undefined);
+  assert.equal(existsSync(f.keyFile()), false);
+  const failed = f.grantEvents().find((e) => e.grantDecision === d.id && e.action === 'grant.failed');
+  assert.deepEqual([failed.code, failed.host, failed.tag], ['interrupted', 'web1', installerTag('demo', 'web1')]);
+  assert.deepEqual(f.messages().filter((m) => m.decision === d.id && m.from_role === '_bus').map((m) => m.to_role), ['human', 'chief']);
+  assert.deepEqual(restarted.reconcileGrants(), []);
+});
+
+test('G24 first sentence, M2, A12: tags are mosaic- and 32 hex, and differ by business, agent and host', () => {
+  const long = 'a'.repeat(30) + '.' + '_'.repeat(2) + 'b'.repeat(31);
+  assert.equal(long.length, 64);
+  const tags = [grantTag('demo', long, 'web1'), grantTag('demo', long + 'x', 'web1'), grantTag('other', long, 'web1'), grantTag('demo', long, 'web2'), installerTag('demo', 'web1'), installerTag('other', 'web1')];
+  for (const t of tags) assert.match(t, /^mosaic-[0-9a-f]{32}$/);
+  assert.equal(new Set(tags).size, tags.length);
+});
+
+test('E4: hosts.check sets the record ready and records grant.host.checked; a non-zero list leaves it pending', async (t) => {
+  const exits = [1, 0];
+  const f = setup(t, { check: (b, h, r) => ({ installerFingerprint: r.installer_fingerprint, exit: exits.shift() }) });
+  await approve(f);
+  await refusesWith(f.call('chief', 'hosts.check', { host: 'web1' }), 'host-failed');
+  assert.equal(f.hostRow().state, 'pending-install');
+  await refusesWith(f.call('pm', 'hosts.check', { host: 'web1' }), 'grant-chief-only');
+  await refusesWith(f.call('chief', 'hosts.check', { host: 'nope' }), 'host-unknown');
+  const r = await f.call('chief', 'hosts.check', { host: 'web1' });
+  assert.equal(r.state, 'ready');
+  assert.equal(f.hostRow().state, 'ready');
+  assert.equal(f.hostRow().checked_at, r.checkedAt);
+  const checked = f.grantEvents().find((e) => e.action === 'grant.host.checked');
+  assert.deepEqual([checked.host, checked.by, checked.installerFingerprint], ['web1', 'chief', f.hostRow().installer_fingerprint]);
+  assert.equal(checked.registrySha256, registrySha256({ address: '192.0.2.10', port: 22, user: 'jarvis', sudo: true, hostKeys: f.hostKeys }));
+  const status = await f.call('human', 'hosts.status');
+  assert.deepEqual(status.map((h) => [h.host, h.state, h.hostKeys, h.hostLineLeft]), [['web1', 'ready', f.hostKeys.map(fingerprint), []]]);
+});
+
+test('G20 (duckworth-0081 B3): the human\'s hosts.check marks the host ready, and the reader refuses', async (t) => {
+  const f = setup(t);
+  await approve(f);
+  await refusesWith(f.call('reader', 'hosts.check', { host: 'web1' }), 'read-only');
+  const r = await f.call('human', 'hosts.check', { host: 'web1' });
+  assert.equal(r.state, 'ready');
+  assert.equal(f.hostRow().state, 'ready');
+  const checked = f.grantEvents().filter((e) => e.action === 'grant.host.checked');
+  assert.deepEqual(checked.map((e) => e.by), ['jason']);
+});
+
+test('G18 (duckworth-0081 B2), broker half: a check refused host-key-mismatch leaves the host pending-install with no grant.host.checked', async (t) => {
+  const f = setup(t, { check: () => { throw new BusError('host-key-mismatch'); } });
+  await approve(f);
+  await refusesWith(f.call('chief', 'hosts.check', { host: 'web1' }), 'host-key-mismatch');
+  assert.equal(f.checks.length, 1);
+  assert.equal(f.hostRow().state, 'pending-install');
+  assert.equal(f.hostRow().checked_at, null);
+  assert.deepEqual(f.grantEvents().filter((e) => e.action === 'grant.host.checked'), []);
+});
+
+test('E4: a check whose installer fingerprint differs from the record refuses host-changed', async (t) => {
+  const f = setup(t, { check: () => ({ installerFingerprint: 'SHA256:' + 'A'.repeat(43), exit: 0 }) });
+  await approve(f);
+  await refusesWith(f.call('tester', 'hosts.check', { host: 'web1' }), 'host-changed');
+  assert.equal(f.hostRow().state, 'pending-install');
+});
+
+test('E4, G21: hosts.remove is the human\'s or the tester\'s, deletes the key and the record, and records grant.host.removed', async (t) => {
+  const f = setup(t);
+  await approve(f);
+  await refusesWith(f.call('chief', 'hosts.remove', { host: 'web1' }), 'human-required');
+  await refusesWith(f.call('reader', 'hosts.remove', { host: 'web1' }), 'read-only');
+  assert.deepEqual(await f.call('human', 'hosts.remove', { host: 'web1' }), { host: 'web1', removed: true });
+  assert.equal(f.hostRow(), undefined);
+  assert.equal(existsSync(f.keyFile()), false);
+  assert.equal(existsSync(join(f.keyFile(), '..')), false);
+  const removed = f.grantEvents().find((e) => e.action === 'grant.host.removed');
+  assert.deepEqual([removed.host, removed.by], ['web1', 'jason']);
+  await refusesWith(f.call('tester', 'hosts.remove', { host: 'web1' }), 'host-unknown');
+});
+
+test('G21, F1, F2, M4, A22: hosts.remove refuses host-line-left on a guarded hostLineLeft, and ignores look-alikes', async (t) => {
+  const f = setup(t);
+  const { d } = await approve(f);
+  const at = new Date().toISOString();
+  // Look-alikes: the same body under action.refused, and under another actor of another kind.
+  const lookAlike = JSON.stringify({ action: 'grant.failed', grantDecision: d.id, host: 'web1', hostLineLeft: installerTag('demo', 'web1') });
+  f.store.run("INSERT INTO events(id,at,business,kind,actor_role,actor_run,subject,body) VALUES('la1',?,'demo','action.refused',NULL,'grant','web1',?)", at, lookAlike);
+  f.store.run("INSERT INTO events(id,at,business,kind,actor_role,actor_run,subject,body) VALUES('la2',?,'demo','action.refused','chief','chief-run','web1',?)", at, lookAlike);
+  // The trigger refuses the look-alike as an action.allowed from a session.
+  assert.throws(() =>
+    f.store.run("INSERT INTO events(id,at,business,kind,actor_role,actor_run,subject,body) VALUES('la3',?,'demo','action.allowed','chief','chief-run','web1',?)", at, lookAlike),
+  );
+  assert.equal((await f.call('human', 'hosts.status'))[0].hostLineLeft.length, 0);
+  // F1: the real shape, through the grant writer. F2: any guarded body, not only grant.failed.
+  writeGrantEvent(f.store, at, 'demo', { action: 'grant.revoke.closed', tag: 'mosaic-' + '0'.repeat(32), host: 'web1', hostLineLeft: 'mosaic-' + '0'.repeat(32) }, 'web1');
+  assert.deepEqual((await f.call('human', 'hosts.status'))[0].hostLineLeft, ['mosaic-' + '0'.repeat(32)]);
+  await refusesWith(f.call('human', 'hosts.remove', { host: 'web1' }), 'host-line-left');
+  assert.ok(f.hostRow());
+  assert.ok(existsSync(f.keyFile()));
+});
+
+test('hosts.remove refuses host-in-use while a grant record names the host', async (t) => {
+  const f = setup(t);
+  const { d } = await approve(f);
+  f.store.run(
+    "INSERT INTO host_grants(business,agent,host,commands,rotate_by,tag,decision) VALUES('demo','pm','web1','[[\"true\"]]','2099-01-01',?,?)",
+    grantTag('demo', 'pm', 'web1'),
+    d.id,
+  );
+  await refusesWith(f.call('human', 'hosts.remove', { host: 'web1' }), 'host-in-use');
+  assert.ok(f.hostRow());
+});
+
+test('the grant writer refuses a body outside section 7\'s shape', (t) => {
+  const f = setup(t);
+  const at = new Date().toISOString();
+  for (const body of [
+    { action: 'host.sudo' },
+    { action: 'grant.failed', decision: 'd' },
+    { operation: 'grant.host-enroll', decision: 'd', host: 'web1' },
+    { operation: 'grant.host-enroll' },
+    { operation: 'decision.raise', decision: 'd' },
+  ])
+    assert.throws(() => writeGrantEvent(f.store, at, 'demo', body), /grant event shape/);
+});
+
+test('recordEvent refuses reserved-event for a grant.* action or operation', (t) => {
+  const f = setup(t);
+  for (const body of [{ action: 'grant.failed' }, { operation: 'grant.host-enroll', decision: 'x' }])
+    refusesSync(() => f.broker.recordEvent(f.caps.chief, { kind: 'action.allowed', body }), 'reserved-event');
+  assert.equal(f.store.get("SELECT count(*) AS n FROM events WHERE json_extract(body,'$.action') GLOB 'grant.*'").n, 0);
+});
@@ -0,0 +1,212 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { chmodSync, copyFileSync, mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { pathToFileURL } from 'node:url';
+import { createHash } from 'node:crypto';
+import { DatabaseSync } from 'node:sqlite';
+import { Store, schemaDigest } from '../src/store.mjs';
+import { Broker } from '../src/broker.mjs';
+// Row 234 (#1740, #436a row a): the 3i→3j step adds the hosts and host_grants tables and the grant
+// event guard (#436b section 7 at fa5658941). It runs on a 3i store built here from the pinned 3i
+// schema (8fede5fc6's schema.sql) and fixture rows. No live store is read or copied.
+const AT = '2026-10-21T00:00:00.000Z';
+const TAG = 'mosaic-' + 'a'.repeat(32);
+const ddl3i = readFileSync(new URL('./fixtures/schema-3i.sql', import.meta.url), 'utf8');
+const here = (p) => new URL(p, import.meta.url);
+const NEW = ['hosts', 'host_grants', 'events_grant_actor', 'sqlite_autoindex_hosts_1', 'sqlite_autoindex_host_grants_1'];
+function source3i(t) {
+  const root = mkdtempSync(join(tmpdir(), 'grant-migrate-'));
+  t.after(() => rmSync(root, { recursive: true, force: true }));
+  mkdirSync(join(root, 'bus'), { mode: 0o700 });
+  const path = join(root, 'bus/bus.sqlite'), db = new DatabaseSync(path);
+  assert.equal(createHash('sha256').update(ddl3i).digest('hex'), '6cde5232c57ac04dc6073112c0830c89cfc5e953d7a5727e7716263747fe8737');
+  db.exec(ddl3i);
+  const run = (sql, ...args) => db.prepare(sql).run(...args);
+  run('INSERT INTO meta VALUES (?,?)', 'schema_version', '3i');
+  run('INSERT INTO meta VALUES (?,?)', 'schema_digest', schemaDigest(db));
+  run('INSERT INTO meta VALUES (?,?)', 'comment_cursor_epoch', AT);
+  run('INSERT INTO events(id,at,business,kind,actor_role,actor_run,body) VALUES(?,?,?,?,?,?,?)', 'e1', AT, 'demo', 'action.allowed', 'coder', 'run1', '{"action":"host.sudo"}');
+  run('INSERT INTO events(id,at,business,kind,body) VALUES(?,?,?,?,?)', 'e2', AT, 'demo', 'action.allowed', '{}');
+  db.close(); chmodSync(path, 0o600);
+  return { root, path };
+}
+function rows(path) {
+  const db = new DatabaseSync(path, { readOnly: true });
+  try {
+    return Object.fromEntries(db.prepare("SELECT name FROM sqlite_master WHERE type='table' AND name NOT IN ('hosts','host_grants')").all()
+      .map(({ name }) => [name, db.prepare(`SELECT * FROM ${name} ORDER BY rowid`).all()
+        .filter(r => name !== 'meta' || !['schema_version', 'schema_digest'].includes(r.key)).map(r => ({ ...r }))]));
+  } finally { db.close(); }
+}
+function master(path) {
+  const db = new DatabaseSync(path, { readOnly: true });
+  try {
+    return db.prepare('SELECT type,name,tbl_name,sql FROM sqlite_master ORDER BY type,name').all().map(r => ({ ...r }));
+  } finally { db.close(); }
+}
+const version = (path) => {
+  const db = new DatabaseSync(path, { readOnly: true });
+  try { return db.prepare("SELECT value FROM meta WHERE key='schema_version'").get().value; } finally { db.close(); }
+};
+// A copy of the bus module whose store.mjs, schema.sql and 3i→3j step the caller edits.
+async function engine(root, name, { store, schema, step = (s) => s }) {
+  const moduleRoot = join(root, name);
+  mkdirSync(join(moduleRoot, 'src/migrations'), { recursive: true });
+  const source = readFileSync(here('../src/store.mjs'), 'utf8'), edited = store ? store(source) : source;
+  if (store) assert.notEqual(edited, source);
+  writeFileSync(join(moduleRoot, 'src/store.mjs'), edited);
+  writeFileSync(join(moduleRoot, 'schema.sql'), schema ?? readFileSync(here('../schema.sql'), 'utf8'));
+  for (const file of ['3b.sql', '3b-3c.sql', '3c-3d.sql', '3d-3e.sql', '3e-3f.sql', '3f-3g.sql', '3g-3h.sql', '3h-3i.sql'])
+    copyFileSync(here('../src/migrations/' + file), join(moduleRoot, 'src/migrations', file));
+  writeFileSync(join(moduleRoot, 'src/migrations/3i-3j.sql'), step(readFileSync(here('../src/migrations/3i-3j.sql'), 'utf8')));
+  return (await import(pathToFileURL(join(moduleRoot, 'src/store.mjs')))).Store;
+}
+function fresh(t) {
+  const root = mkdtempSync(join(tmpdir(), 'grant-store-'));
+  const store = new Store(root);
+  t.after(() => { store.close(); rmSync(root, { recursive: true, force: true }); });
+  store.run(`INSERT INTO decisions(id,at,business,raised_by_role,raised_by_run,class,action,route_to,question,options,recommendation,blocking)
+    VALUES('d1',?,'demo','chief','run1','gated','credential.mint','human','q','["yes","no"]','yes',0)`, AT);
+  return store;
+}
+const event = (store, actor, body, kind = 'action.allowed') => store.run(
+  'INSERT INTO events(id,at,business,kind,actor_role,actor_run,body) VALUES(?,?,?,?,?,?,?)',
+  'e' + Math.random().toString(16).slice(2), AT, 'demo', kind, actor[0], actor[1], JSON.stringify(body));
+const host = (store, values = {}) => store.run(
+  `INSERT INTO hosts(business,host,address,port,user,sudo,host_keys,installer_fingerprint,state,decision,checked_at)
+    VALUES(:business,:host,:address,:port,:user,:sudo,:host_keys,:fp,:state,:decision,:checked)`,
+  { business: 'demo', host: 'web1', address: '192.0.2.10', port: 22, user: 'deploy', sudo: 0,
+    host_keys: '["ssh-ed25519 AAAA"]', fp: null, state: 'pending-install', decision: 'd1', checked: null, ...values });
+
+test('3i copy migrates to 3j: every row kept, and sqlite_master gains only the two tables, their keys and the guard', t => {
+  const { root, path } = source3i(t), before = rows(path), was = master(path);
+  assert.throws(() => new Store(root), /schema-mismatch/);
+  new Store(root, { migrateSchema: true }).close();
+  assert.equal(version(path), '3j');
+  assert.deepEqual(rows(path), before);
+  const now = master(path);
+  assert.deepEqual(now.filter(r => !NEW.includes(r.name)), was);
+  assert.deepEqual(now.filter(r => NEW.includes(r.name)).map(r => r.name).sort(), [...NEW].sort());
+  const store = new Store(root);
+  try {
+    assert.equal(store.get('PRAGMA quick_check').quick_check, 'ok');
+    assert.deepEqual(store.all('PRAGMA foreign_key_check'), []);
+    assert.equal(store.get('SELECT count(*) AS n FROM hosts').n, 0);
+    // An event row 210 wrote before the step stays, and a session can still write host.sudo.
+    event(store, ['coder', 'run2'], { action: 'host.sudo', phase: 'requested' });
+  } finally { store.close(); }
+});
+
+test('a 3i→3j step that fails partway leaves the store at 3i with every row and the schema intact', async t => {
+  const { root, path } = source3i(t), before = rows(path), was = master(path);
+  // The real step plus a statement that fails only when events has a row, so the empty replay at
+  // import passes and the store's run fails after both tables and the trigger exist.
+  const Failing = await engine(root, 'engine-failing', { step: (sql) => sql + 'INSERT INTO events SELECT * FROM events LIMIT 1;\n' });
+  assert.throws(() => new Failing(root, { migrateSchema: true }), /events is append-only/);
+  assert.equal(version(path), '3i');
+  assert.deepEqual(master(path), was);
+  assert.deepEqual(rows(path), before);
+  new Store(root, { migrateSchema: true }).close();
+  assert.equal(version(path), '3j');
+});
+
+test('the 3i engine refuses a 3j store, migrating or not, and leaves it at 3j', async t => {
+  const { root, path } = source3i(t);
+  new Store(root, { migrateSchema: true }).close();
+  const after = rows(path), was = master(path);
+  const Store3i = await engine(root, 'engine-3i', {
+    schema: ddl3i,
+    store: (source) => source
+      .replace(/export const SCHEMA_SHA256 = '[a-f0-9]+';/, `export const SCHEMA_SHA256 = '${createHash('sha256').update(ddl3i).digest('hex')}';`)
+      .replace("export const SCHEMA_VERSION = '3j';", "export const SCHEMA_VERSION = '3i';")
+      .replace(/\}, \{\n {2}\/\/ Row 234 \(#1740\)[\s\S]*?\}\];\nconst timedTables/, '}];\nconst timedTables'),
+  });
+  const pinned = readFileSync(join(root, 'engine-3i/src/store.mjs'), 'utf8');
+  assert.ok(pinned.includes("export const SCHEMA_VERSION = '3i';") && !pinned.includes('3i-3j'), 'the 3i engine has no 3i→3j step');
+  assert.throws(() => new Store3i(root), /schema-mismatch/);
+  assert.throws(() => new Store3i(root, { migrateSchema: true }), /schema-mismatch/);
+  assert.equal(version(path), '3j');
+  assert.deepEqual(master(path), was);
+  assert.deepEqual(rows(path), after);
+});
+
+test('A22b, sage-1703: a session-written grant.* row from before the step survives it, and the grant readers ignore it', async t => {
+  // The step adds the guard but leaves old rows. At 3i recordEvent had no reserved-event refusal, so a
+  // session could write these, and after the step only GRANT_EVIDENCE's actor filter keeps them out.
+  const { root, path } = source3i(t);
+  const db = new DatabaseSync(path);
+  const run = (sql, ...args) => db.prepare(sql).run(...args);
+  run(`INSERT INTO decisions(id,at,business,raised_by_role,raised_by_run,class,action,route_to,question,options,recommendation,blocking)
+    VALUES('d1',?,'demo','chief','run1','gated','credential.mint','human','q','["yes","no"]','yes',0)`, AT);
+  const legacy = [{ action: 'grant.host.removed', host: 'web1', hostLineLeft: TAG }, { operation: 'grant.host-enroll', decision: 'd1' }];
+  for (const [i, body] of legacy.entries())
+    run('INSERT INTO events(id,at,business,kind,actor_role,actor_run,body) VALUES(?,?,?,?,?,?,?)', 'old' + i, AT, 'demo', 'action.allowed', 'chief', 'run1', JSON.stringify(body));
+  db.close();
+  new Store(root, { migrateSchema: true }).close();
+  const store = new Store(root);
+  t.after(() => store.close());
+  assert.equal(store.get("SELECT count(*) AS n FROM events WHERE id IN ('old0','old1')").n, 2);
+  host(store);
+  const business = {
+    id: 'demo',
+    human: 'jason',
+    arbiters: { technical: 'pm', delivery: 'pm' },
+    roles: {
+      chief: { definition: 'chief-of-staff', authority: { withinRole: ['message.send'], crossRole: [] } },
+      pm: { definition: 'pm', authority: { withinRole: ['message.send'], crossRole: [] } },
+    },
+    vars: {},
+  };
+  const unenrolled = [];
+  const broker = new Broker({ store, businesses: { demo: business }, hostGrant: { unenroll: (b, h) => unenrolled.push([b, h]), installerTag: () => null } });
+  // The enrollment look-alike is not a spent decision, so nothing ends interrupted.
+  assert.deepEqual(broker.reconcileGrants(), []);
+  assert.equal(store.get("SELECT count(*) AS n FROM events WHERE actor_run='grant'").n, 0);
+  // The hostLineLeft look-alike is not a line left on the host.
+  const human = broker.bindHuman({ business: 'demo', human: 'jason', via: 'cli', outsideAgent: true });
+  assert.deepEqual(await broker.request(human, { verb: 'hosts.remove', args: { host: 'web1' } }), { host: 'web1', removed: true });
+  assert.deepEqual(unenrolled, [['demo', 'web1']]);
+});
+
+test('the guard: a grant.* action or operation on action.allowed needs the (NULL, grant) actor', t => {
+  const store = fresh(t);
+  const refused = /only the grant writer records grant events/;
+  for (const body of [{ action: 'grant.step' }, { action: 'grant.host.enrolled' }, { operation: 'grant.host-enroll', decision: 'd1' }]) {
+    assert.throws(() => event(store, ['chief', 'run1'], body), refused, JSON.stringify(body));
+    assert.throws(() => event(store, ['tester', 'run1'], body), refused);
+    assert.throws(() => event(store, [null, null], body), refused, 'the human and session-less pair is not the grant actor');
+    assert.throws(() => event(store, [null, 'run1'], body), refused);
+    assert.throws(() => event(store, ['grant', 'grant'], body), refused);
+    event(store, [null, 'grant'], body);
+  }
+  // Row 210's host.sudo and host.run stay outside the namespace, and so does any other kind.
+  event(store, ['coder', 'run1'], { action: 'host.sudo', phase: 'completed' });
+  event(store, ['coder', 'run1'], { action: 'grant.step' }, 'action.refused');
+  event(store, ['coder', 'run1'], { action: 'granted.step', operation: 'grantx' });
+  assert.equal(store.get("SELECT count(*) AS n FROM events WHERE actor_run='grant'").n, 3);
+});
+
+test('hosts: one record per business and host, a ready host has its installer and check, grants need the host', t => {
+  const store = fresh(t);
+  host(store);
+  assert.throws(() => host(store, { address: '192.0.2.11' }), /UNIQUE constraint failed: hosts\.business, hosts\.host/);
+  host(store, { business: 'other' });
+  assert.throws(() => host(store, { host: 'web2', state: 'ready' }), /CHECK constraint failed/);
+  assert.throws(() => host(store, { host: 'web2', state: 'ready', fp: 'SHA256:x' }), /CHECK constraint failed/);
+  host(store, { host: 'web2', state: 'ready', fp: 'SHA256:x', checked: AT });
+  assert.throws(() => host(store, { host: 'web3', state: 'live' }), /CHECK constraint failed/);
+  assert.throws(() => host(store, { host: 'web3', host_keys: '[]' }), /CHECK constraint failed/);
+  assert.throws(() => host(store, { host: 'web3', decision: 'nope' }), /FOREIGN KEY constraint failed/);
+  const grant = (values = {}) => store.run(
+    'INSERT INTO host_grants(business,agent,host,commands,rotate_by,tag,decision) VALUES(:business,:agent,:host,:commands,:rotate,:tag,:decision)',
+    { business: 'demo', agent: 'coder', host: 'web2', commands: '[["true"]]', rotate: '2026-12-01', tag: TAG, decision: 'd1', ...values });
+  assert.throws(() => grant({ host: 'web9' }), /FOREIGN KEY constraint failed/);
+  for (const tag of ['mosaic-' + 'A'.repeat(32), 'mosaic-' + 'a'.repeat(31), 'mosaix-' + 'a'.repeat(32), 'mosaic-' + 'a'.repeat(31) + 'g'])
+    assert.throws(() => grant({ tag }), /CHECK constraint failed/, tag);
+  assert.throws(() => grant({ commands: '[]' }), /CHECK constraint failed/);
+  grant();
+  assert.throws(() => grant({ tag: 'mosaic-' + 'b'.repeat(32) }), /UNIQUE constraint failed/);
+  assert.throws(() => store.run("DELETE FROM hosts WHERE business='demo' AND host='web2'"), /FOREIGN KEY constraint failed/);
+});
@@ -7,10 +7,11 @@ import { Store } from '../src/store.mjs';
 import { Broker, ACTIONS, HARD_WAITS } from '../src/broker.mjs';
 import { ACTIONS as VOCABULARY, GATED_ONLY } from '../../business/src/vocabulary.mjs';
 import { fixture } from './spec-fixtures.mjs';
+import { hostGrantRecord, hostRecord } from './host-fixtures.mjs';

 // PRD 1.5 REQ-WAIT-1, REQ-WAIT-2 and REQ-DEC-2 (row 139, #1633).
 const WAITS = ['spend', 'data.delete', 'network.expose', 'account.create', 'credential.mint', 'message.external',
-  'git.push.protected', 'git.push.remote', 'deploy'];
+  'git.push.protected', 'git.push.remote', 'host.sudo', 'deploy'];
 const LEFT = ['git.merge.protected', 'policy.change', 'prd.approve', 'role.revoke'];
 const cite = f => ({ project: 'stack', spec_path: 'spec/north-star.md', spec_commit: f.commit });
 const routed = (f, d) => ({ ...f.store.get('SELECT class, route_to FROM decisions WHERE id=?', d.id) });
@@ -38,12 +39,17 @@ test('REQ-WAIT-2: a business granting a hard wait at either class is refused; th
 test('REQ-DEC-2: every hard wait goes to the human, cited or not, and the arbiter cannot resolve it', async t => {
  const f = await fixture(t, { roles: { coder: { definition: 'coder',
    authority: { withinRole: ['message.send', 'record.write', 'git.push.working'], crossRole: [] } } } });
+  // Row 210: a host.sudo raise names a registered host the raiser is granted and an argv its grant allows.
+  // Row 234 (#1740): both are store records.
+  hostRecord(f.store, { host: 'web1', entry: { address: '10.0.0.5', port: 22, user: 'admin', hostKeys: ['ssh-ed25519 AAAA'] } });
+  hostGrantRecord(f.store, { agent: 'coder', host: 'web1', commands: [['systemctl', 'status']] });
  // Row 199: a git.push.remote raise binds the task's latest push, so the task has one.
  f.broker.recordPush(f.coder, { task_ref: 'vikunja:1/2', project: 'stack', branch: 'feat', ref: 'work/vikunja-stack-2',
    commit: 'a'.repeat(40), previous: null });
  for (const action of WAITS) {
    for (const args of [{}, cite(f), { ...cite(f), domain: 'technical' }]) {
-      const d = await f.raise({ action, ...(action === 'git.push.remote' ? { target: 'vikunja:1/2' } : {}), ...args });
+      const d = await f.raise({ action, ...(action === 'git.push.remote' ? { target: 'vikunja:1/2' } : {}),
+        ...(action === 'host.sudo' ? { target: 'web1', argv: ['systemctl', 'status'] } : {}), ...args });
      assert.deepEqual(routed(f, d), { class: 'gated', route_to: 'human' }, `${action} ${JSON.stringify(args)}`);
    }
  }
@@ -0,0 +1,62 @@
+// Row 234 (#1740, r6 X4): host and grant store records for tests. Row a has no way to make a host_grants
+// record outside a fixture, because row b's grant executor writes them. The decision, its raise event and
+// its close go in by SQL. The grant evidence goes through writeGrantEvent (F1), so the trigger sees the
+// real shape.
+import { randomUUID } from 'node:crypto';
+import { registrySha256, writeGrantEvent } from '../src/broker.mjs';
+import { grantTag } from '../src/host-grant.mjs';
+
+const AT = '2026-10-21T00:00:00.000Z';
+const OPTIONS = JSON.stringify([{ key: 'yes', text: 'Yes' }, { key: 'no', text: 'No' }]);
+export const HUMAN_YES = { op: 'resolved', by: 'jason', choice: 'yes', via: 'cli' };
+
+// A credential.mint decision with `grant` in its raise body. `close` is the decision_events row, or null
+// for an open decision.
+export function grantDecision(store, { business = 'demo', action = 'credential.mint', route = 'human', grant, close = HUMAN_YES }) {
+  const id = randomUUID();
+  store.run(
+    'INSERT INTO decisions(id,at,business,raised_by_role,raised_by_run,class,action,route_to,question,options,recommendation,blocking) VALUES(?,?,?,?,?,?,?,?,?,?,?,?)',
+    id, AT, business, 'chief', 'chief-run', 'gated', action, route, 'Grant?', OPTIONS, 'yes', 0,
+  );
+  store.run(
+    "INSERT INTO events(id,at,business,kind,actor_role,actor_run,subject,body) VALUES(?,?,?,'action.allowed',?,?,?,?)",
+    randomUUID(), AT, business, 'chief', 'chief-run', id,
+    JSON.stringify({ decision: id, action, operation: 'decision.raise', approvalChoice: 'yes', ...(grant ? { grant } : {}) }),
+  );
+  if (close)
+    store.run('INSERT INTO decision_events(decision,at,op,by,choice,via) VALUES(?,?,?,?,?,?)', id, AT, close.op, close.by, close.choice ?? null, close.via ?? null);
+  return id;
+}
+
+// A ready host record from an approved, spent and finished enrollment. grant.host.enrolled keeps the
+// start reconcile from reading the enrollment as interrupted.
+export function hostRecord(store, { business = 'demo', host = 'web1', entry, sudo = true }) {
+  const grant = { method: 'host-enroll', host, address: entry.address, port: entry.port, user: entry.user, sudo, fingerprints: [] };
+  const decision = grantDecision(store, { business, grant });
+  writeGrantEvent(store, AT, business, { operation: 'grant.host-enroll', decision }, decision);
+  const installerFingerprint = 'SHA256:' + 'A'.repeat(43);
+  writeGrantEvent(store, AT, business, {
+    action: 'grant.host.enrolled', grantDecision: decision, host, installerFingerprint, user: entry.user, sudo,
+    registrySha256: registrySha256({ ...entry, sudo }),
+  }, decision);
+  store.run(
+    'INSERT INTO hosts(business,host,address,port,user,sudo,host_keys,installer_fingerprint,state,decision,checked_at) VALUES(?,?,?,?,?,?,?,?,?,?,?)',
+    business, host, entry.address, entry.port, entry.user, sudo ? 1 : 0, JSON.stringify(entry.hostKeys), installerFingerprint, 'ready', decision, AT,
+  );
+  return decision;
+}
+
+// One agent's grant record on a host. By default its decision is a `host` grant for the same agent and
+// host, resolved yes by the human via cli and spent as grant.host. Each option breaks one part.
+export function hostGrantRecord(store, { business = 'demo', agent, host = 'web1', commands, rotateBy = '2099-01-01', grant = {}, close = HUMAN_YES, spend = 'grant.host', action }) {
+  const decision = grantDecision(store, {
+    business, close, action,
+    grant: grant === null ? undefined : { method: 'host', agent, host, commands, rotateBy, ...grant },
+  });
+  if (spend) writeGrantEvent(store, AT, business, { operation: spend, decision }, decision);
+  store.run(
+    'INSERT INTO host_grants(business,agent,host,commands,rotate_by,tag,decision) VALUES(?,?,?,?,?,?,?)',
+    business, agent, host, JSON.stringify(commands), rotateBy, grantTag(business, agent, host), decision,
+  );
+  return decision;
+}
@@ -0,0 +1,642 @@
+// Row 210 (#1707, design section 8): host.run over a scratch sshd on 127.0.0.1 that this test starts,
+// with keys this test makes and a fake sudo that records its argv and runs the command as the test
+// user. Nothing runs as root and nothing reaches another host.
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { execFileSync, spawn } from 'node:child_process';
+import { connect, createServer } from 'node:net';
+import { chmodSync, existsSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, rmSync, writeFileSync } from 'node:fs';
+import { tmpdir, userInfo } from 'node:os';
+import { join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { Credentials, parseHostKey } from '../src/credentials.mjs';
+import { addKey, hostExecutor, runHost, sshArgs, startTime, sweepRunDir, quote, remoteCommand } from '../src/host-run.mjs';
+import { fixture } from './spec-fixtures.mjs';
+import { HUMAN_YES, hostGrantRecord, hostRecord } from './host-fixtures.mjs';
+import { Broker, ORGANIZATION_KEYS } from '../src/broker.mjs';
+import { Store } from '../src/store.mjs';
+import { hostGrant } from '../src/host-grant.mjs';
+import { startBroker } from '../src/runtime.mjs';
+import { businessDoc, rolesCopy, systemFor, writeJson } from '../../business/tests/helpers.mjs';
+
+const SSHD = '/usr/bin/sshd';
+const REPO = fileURLToPath(new URL('../../../', import.meta.url));
+const USER = userInfo().username;
+const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
+const keygen = (file, ...extra) => execFileSync('ssh-keygen', ['-q', '-t', 'ed25519', '-N', '', '-C', 'test', ...extra, '-f', file]);
+const pubLine = (file) => readFileSync(file + '.pub', 'utf8').trim().split(' ').slice(0, 2).join(' ');
+// Every pid whose argv names `text`, with its argv and environment. ssh-agent makes itself
+// non-dumpable, so its environ reads as null. Its environment is the PATH runHost passes.
+const readOrNull = (file) => {
+  try {
+    return readFileSync(file, 'utf8');
+  } catch {
+    return null;
+  }
+};
+function procsNaming(text) {
+  const out = [];
+  for (const pid of readdirSync('/proc').filter((p) => /^\d+$/.test(p))) {
+    const cmdline = readOrNull(`/proc/${pid}/cmdline`);
+    if (cmdline?.includes(text)) out.push({ pid: Number(pid), cmdline, environ: readOrNull(`/proc/${pid}/environ`) });
+  }
+  return out;
+}
+async function until(fn, ms = 5000) {
+  const end = Date.now() + ms;
+  while (!fn()) {
+    if (Date.now() > end) return false;
+    await sleep(20);
+  }
+  return true;
+}
+const listening = (port) =>
+  new Promise((resolve) => {
+    const s = connect(port, '127.0.0.1');
+    s.on('connect', () => (s.destroy(), resolve(true)));
+    s.on('error', () => resolve(false));
+  });
+
+// A scratch sshd. ForceCommand puts the fake sudo first on PATH and hands the command to /bin/sh, so
+// the remote side parses the command line the way a real host's POSIX shell does.
+async function sshd(t, dir) {
+  if (!existsSync(SSHD)) throw new Error(`${SSHD} is missing: the executor tests need it and fail, never skip`);
+  keygen(join(dir, 'hostkey'));
+  keygen(join(dir, 'otherhost'));
+  keygen(join(dir, 'user'));
+  writeFileSync(join(dir, 'authorized_keys'), readFileSync(join(dir, 'user.pub')), { mode: 0o600 });
+  mkdirSync(join(dir, 'fake'));
+  writeFileSync(
+    join(dir, 'fake', 'sudo'),
+    `#!/bin/sh\n'${process.execPath}' -e 'require("fs").appendFileSync(process.argv[1], JSON.stringify(process.argv.slice(2)) + "\\n")' '${dir}/argv.json' "$@"\nshift 2\nexec "$@"\n`,
+  );
+  chmodSync(join(dir, 'fake', 'sudo'), 0o755);
+  // A remote command that prints ssh's pin refusal text and exits 255 (N3).
+  writeFileSync(join(dir, 'fake', 'fail255'), '#!/bin/sh\necho "Host key verification failed." >&2\nexit 255\n', { mode: 0o755 });
+  writeFileSync(join(dir, 'wrap.sh'), `#!/bin/sh\nPATH=${dir}/fake:/usr/bin:/bin; export PATH\nexec /bin/sh -c "$SSH_ORIGINAL_COMMAND"\n`);
+  chmodSync(join(dir, 'wrap.sh'), 0o755);
+  for (let attempt = 0; attempt < 5; attempt++) {
+    const port = 20000 + Math.floor(Math.random() * 20000);
+    writeFileSync(
+      join(dir, 'sshd_config'),
+      [`Port ${port}`, 'ListenAddress 127.0.0.1', `HostKey ${dir}/hostkey`, `AuthorizedKeysFile ${dir}/authorized_keys`,
+        `PidFile ${dir}/sshd.pid`, 'UsePAM no', 'StrictModes no', 'PasswordAuthentication no', 'KbdInteractiveAuthentication no',
+        `ForceCommand ${dir}/wrap.sh`, ''].join('\n'),
+    );
+    const daemon = spawn(SSHD, ['-D', '-f', join(dir, 'sshd_config'), '-E', join(dir, 'sshd.log')], { stdio: 'ignore' });
+    t.after(() => daemon.kill('SIGKILL'));
+    const deadline = Date.now() + 3000;
+    while (Date.now() < deadline && daemon.exitCode === null) {
+      if (await listening(port)) return port;
+      await sleep(30);
+    }
+    daemon.kill('SIGKILL');
+  }
+  throw new Error('scratch sshd did not start');
+}
+
+const GRANT = [['true'], ['false'], ['echo'], ['sleep'], ['head'], ['cat'], ['systemctl', 'status']];
+async function hostFixture(t, { commands = GRANT, reviewerHosts, wrongHostKey = false, coderWeb2 = false } = {}) {
+  const dir = mkdtempSync(join(tmpdir(), 'h210-'));
+  t.after(() => rmSync(dir, { recursive: true, force: true }));
+  const port = await sshd(t, dir);
+  const keyFile = join(dir, 'user');
+  const credentials = new Credentials({
+    references: { 'demo/coder': { 'host.web1': { file: keyFile, rotateBy: '2099-01-01' } } },
+    dataRoot: join(dir, 'data'),
+  });
+  t.after(() => credentials.close());
+  const root = join(dir, 'run');
+  const executor = hostExecutor({ credentials, root });
+  const entry = { address: '127.0.0.1', port, user: USER, hostKeys: [pubLine(join(dir, wrongHostKey ? 'otherhost' : 'hostkey'))] };
+  const authority = { withinRole: ['message.send', 'record.write'], crossRole: [] };
+  const f = await fixture(t, { roles: { coder: { definition: 'coder', authority } } });
+  // Row 234 (#1740, r6 X4): host.run reads store records, so the hosts and grants are fixtures there.
+  for (const host of ['web1', 'web2']) hostRecord(f.store, { host, entry });
+  hostGrantRecord(f.store, { agent: 'coder', host: 'web1', commands });
+  if (coderWeb2) hostGrantRecord(f.store, { agent: 'coder', host: 'web2', commands });
+  for (const [host, g] of Object.entries(reviewerHosts ?? {})) hostGrantRecord(f.store, { agent: 'reviewer', host, commands: g.commands });
+  const approve = async (argv, stdin, host = 'web1') => {
+    const d = await f.raise({ action: 'host.sudo', target: host, argv, ...(stdin !== undefined ? { stdin } : {}) });
+    f.call(f.human, 'decision.resolve', { id: d.id, choice: 'yes' });
+    return d.id;
+  };
+  const run = (args, cap = f.coder) => f.broker.requestHost(cap, { verb: 'host.run', args }, executor);
+  const call = async (argv, { stdin, timeout } = {}) =>
+    run({ host: 'web1', argv, ...(stdin !== undefined ? { stdin } : {}), ...(timeout ? { timeout } : {}), decision: await approve(argv, stdin) });
+  const events = () =>
+    f.store.all("SELECT kind, body FROM events WHERE business='demo' ORDER BY seq").map((e) => ({ kind: e.kind, ...JSON.parse(e.body) }));
+  const argvSeen = () => (existsSync(join(dir, 'argv.json')) ? readFileSync(join(dir, 'argv.json'), 'utf8').trim().split('\n').map((l) => JSON.parse(l)) : []);
+  const key = parseHostKey(readFileSync(keyFile, 'utf8'));
+  return { ...f, dir, root, port, entry, keyFile, key, credentials, executor, approve, run, call, events, argvSeen };
+}
+const refusesWith = async (p, code) => assert.rejects(p, (e) => (assert.equal(e.code, code), true));
+
+test('the executor tests need sshd, ssh, ssh-agent, ssh-add, ssh-keygen and setpriv: a missing one fails, never skips', () => {
+  for (const bin of [SSHD, '/usr/bin/ssh', '/usr/bin/ssh-agent', '/usr/bin/ssh-add', '/usr/bin/ssh-keygen', '/usr/bin/setpriv'])
+    assert.ok(existsSync(bin), `${bin} is missing`);
+});
+
+test('T3: organization.set, limits.set and instances.set refuse hosts, and the writer never runs', (t) => {
+  const root = mkdtempSync(join(tmpdir(), 'h210-'));
+  const store = new Store(root);
+  t.after(() => { store.close(); rmSync(root, { recursive: true, force: true }); });
+  const chiefAuthority = JSON.parse(readFileSync(join(REPO, 'roles', 'chief-of-staff.json'), 'utf8')).authority;
+  const businesses = {
+    demo: {
+      id: 'demo', human: 'jason', arbiters: { technical: 'chief', delivery: 'chief' }, definitions: {},
+      roles: { chief: { definition: 'chief-of-staff', authority: chiefAuthority } }, projects: {},
+    },
+  };
+  const calls = [];
+  const b = new Broker({ store, businesses, organization: (...a) => (calls.push(a), { ok: true }) });
+  const human = b.bindHuman({ business: 'demo', human: 'jason', via: 'cli', outsideAgent: true });
+  const chief = b.bindLaunch({ business: 'demo', role: 'chief', run: 'chief-run', harness: 'pi' });
+  b.request(chief, { verb: 'role.claim' });
+  const revision = 'a'.repeat(64);
+  const hosts = { web1: { address: '10.0.0.5', port: 22, user: 'admin', hostKeys: ['ssh-ed25519 AAAA'] } };
+  assert.equal(ORGANIZATION_KEYS.includes('hosts'), false);
+  assert.throws(() => b.request(chief, { verb: 'organization.set', args: { revision, hosts } }), /invalid-request/);
+  assert.throws(() => b.request(human, { verb: 'limits.set', args: { revision, hosts } }), /invalid-request/);
+  assert.throws(() => b.request(human, { verb: 'instances.set', args: { revision, instance: 'chief', op: 'change', hosts } }), /invalid-request/);
+  assert.equal(calls.length, 0);
+  // Controls: the same calls without hosts reach the writer.
+  b.request(chief, { verb: 'organization.set', args: { revision, models: {} } });
+  b.request(human, { verb: 'limits.set', args: { revision, models: {} } });
+  b.request(human, { verb: 'instances.set', args: { revision, instance: 'chief', op: 'change', launch: true } });
+  // organization.set reaches the writer as limits.set (broker.mjs:1379).
+  assert.deepEqual(calls.map((c) => c[1]), ['limits.set', 'limits.set', 'instances.set']);
+});
+
+test('T4: the value check takes one unencrypted ed25519 key and nothing else', () => {
+  const dir = mkdtempSync(join(tmpdir(), 'h210-'));
+  try {
+    keygen(join(dir, 'good'));
+    execFileSync('ssh-keygen', ['-q', '-t', 'ed25519', '-N', 'secret-pass', '-f', join(dir, 'enc')]);
+    execFileSync('ssh-keygen', ['-q', '-t', 'rsa', '-b', '2048', '-N', '', '-f', join(dir, 'rsa')]);
+    const good = readFileSync(join(dir, 'good'), 'utf8');
+    // Two keys: the same blob with nkeys set to 2.
+    const lines = good.trim().split('\n');
+    const blob = Buffer.from(lines.slice(1, -1).join(''), 'base64');
+    // magic (15), cipher "none" (4+4), kdf "none" (4+4), empty kdfoptions (4), then nkeys.
+    blob.writeUInt32BE(2, 15 + 8 + 8 + 4);
+    const pem = (b) => [lines[0], ...b.toString('base64').match(/.{1,70}/g), lines.at(-1)].join('\n') + '\n';
+    // One check each: a field renamed in place, so every other check still passes. Offsets: magic 15,
+    // cipher name 19, kdf name 27, nkeys 35, public type 47, private section 98, its type 110.
+    const renamed = (at, text) => {
+      const copy = Buffer.from(lines.slice(1, -1).join(''), 'base64');
+      copy.write(text, at, 'latin1');
+      return pem(copy);
+    };
+    const write = (name, text) => (writeFileSync(join(dir, name), text, { mode: 0o600 }), join(dir, name));
+    const load = (file, service = 'host.web1') =>
+      new Credentials({ references: { 'demo/coder': { [service]: { file, rotateBy: '2099-01-01' } } }, dataRoot: join(dir, 'data') });
+    const ok = load(join(dir, 'good'));
+    assert.match(ok.status()[0].fingerprint, /^SHA256:/);
+    assert.equal(ok.status()[0].publicKey, pubLine(join(dir, 'good')));
+    ok.close();
+    for (const file of [
+      join(dir, 'enc'),
+      join(dir, 'rsa'),
+      write('two', pem(blob)),
+      write('cipher', renamed(19, 'aes1')),
+      write('kdf', renamed(27, 'bcry')),
+      write('public-type', renamed(47, 'ssh-ed25518')),
+      write('private-type', renamed(110, 'ssh-ed25518')),
+      write('crlf', good.replaceAll('\n', '\r\n')),
+      write('token', 'fake_gitea_token_0123456789\n'),
+    ])
+      assert.throws(() => load(file), /credential-format/, file);
+    assert.throws(() => load(join(dir, 'good'), 'gitea'), /credential-format/);
+  } finally {
+    rmSync(dir, { recursive: true, force: true });
+  }
+});
+
+test('T5 to T8: registry, grant, argv shape and allowlist refusals', async (t) => {
+  const f = await hostFixture(t, { reviewerHosts: { web2: { commands: [['true']] } } });
+  await refusesWith(f.run({ host: 'web9', argv: ['true'] }), 'host-unknown');
+  await refusesWith(f.run({ host: 'web2', argv: ['true'] }), 'host-not-granted');
+  for (const argv of [[], ['a\0'], ['a'.repeat(4097)], Array(257).fill('true'), ['bin/true'], [7], 'true'])
+    await refusesWith(f.run({ host: 'web1', argv }), 'invalid-request');
+  await refusesWith(f.run({ host: 'web1', argv: ['true'], stdin: 'x'.repeat(65537) }), 'invalid-request');
+  await refusesWith(f.run({ host: 'web1', argv: ['true'], timeout: 901 }), 'invalid-request');
+  await refusesWith(f.run({ host: 'web1', argv: ['systemctl'] }), 'command-not-granted');
+  await refusesWith(f.run({ host: 'web1', argv: ['systemctl', 'restart', 'nginx'] }), 'command-not-granted');
+  await refusesWith(f.run({ host: 'web1', argv: ['ls'] }), 'command-not-granted');
+  // N1: the raise refuses the same way, so the human is never asked about a call host.run refuses.
+  assert.throws(() => f.raise({ action: 'host.sudo', target: 'web2', argv: ['true'] }), /host-not-granted/);
+  assert.throws(() => f.raise({ action: 'host.sudo', target: 'web1', argv: ['ls'] }), /command-not-granted/);
+  assert.equal(f.store.get("SELECT count(*) AS n FROM decisions WHERE action='host.sudo'").n, 0);
+  // Granted prefixes run, a longer argv too.
+  await f.call(['systemctl', 'status']);
+  assert.equal((await f.call(['echo', 'hi', 'there'])).stdout, 'hi there\n');
+  assert.deepEqual(f.argvSeen(), [['-n', '--', 'systemctl', 'status'], ['-n', '--', 'echo', 'hi', 'there']]);
+  const refused = f.events().filter((e) => e.kind === 'action.refused' && e.verb === 'host.run').map((e) => e.code);
+  assert.ok(refused.includes('host-unknown') && refused.includes('command-not-granted'));
+});
+
+test('T9: under 1.7 every call needs a decision bound to its host, argv and stdin, spent once', async (t) => {
+  const f = await hostFixture(t, { coderWeb2: true });
+  await refusesWith(f.run({ host: 'web1', argv: ['true'] }), 'decision-required');
+  const other = await f.approve(['echo', 'a']);
+  await refusesWith(f.run({ host: 'web1', argv: ['echo', 'b'], decision: other }), 'decision-mismatch');
+  const stdin = await f.approve(['cat'], 'one');
+  await refusesWith(f.run({ host: 'web1', argv: ['cat'], stdin: 'two', decision: stdin }), 'decision-mismatch');
+  await refusesWith(f.run({ host: 'web1', argv: ['cat'], decision: stdin }), 'decision-mismatch');
+  const host = await f.approve(['true'], undefined, 'web2');
+  await refusesWith(f.run({ host: 'web1', argv: ['true'], decision: host }), 'decision-mismatch');
+  const once = await f.approve(['cat'], 'one');
+  assert.equal((await f.run({ host: 'web1', argv: ['cat'], stdin: 'one', decision: once })).stdout, 'one');
+  await refusesWith(f.run({ host: 'web1', argv: ['cat'], stdin: 'one', decision: once }), 'decision-consumed');
+  // An unresolved decision doesn't run.
+  const open = (await f.raise({ action: 'host.sudo', target: 'web1', argv: ['true'] })).id;
+  await refusesWith(f.run({ host: 'web1', argv: ['true'], decision: open }), 'decision-not-approved');
+  // The human sees host, user, each argv element and all of stdin, appended by the broker.
+  const q = f.store.get('SELECT question FROM decisions WHERE id=?', once).question;
+  assert.ok(q.includes(`Host web1, ${USER} at 127.0.0.1 port ${f.port}`), q);
+  assert.ok(q.includes('argv: "cat"'), q);
+  assert.ok(q.endsWith('stdin: "one"'), q);
+  assert.throws(() => f.raise({ action: 'host.sudo', target: 'web1', argv: ['cat'], stdin: 'x'.repeat(4096) }), /invalid-request/);
+  assert.throws(() => f.raise({ action: 'host.sudo', target: 'web9', argv: ['cat'] }), /host-unknown/);
+  assert.throws(() => f.raise({ action: 'deploy', argv: ['cat'] }), /invalid-request/);
+  assert.equal(f.store.get("SELECT class FROM decisions WHERE id=?", once).class, 'gated');
+});
+
+test('T10, T11: argv reaches sudo unchanged after sudo -n --', async (t) => {
+  const f = await hostFixture(t);
+  const argv = ['true', 'a b', "it's", '"q"', '$(touch x)', '`id`', 'a;b', 'line\nbreak', '*', '?[a]', '$HOME', '\\'];
+  assert.equal((await f.call(argv)).exit, 0);
+  assert.deepEqual(f.argvSeen(), [['-n', '--', ...argv]]);
+  assert.equal(existsSync(join(f.dir, 'x')), false);
+  assert.equal(quote("it's"), "'it'\\''s'");
+  assert.equal(remoteCommand(['a b']), "sudo -n -- 'a b'");
+});
+
+test('T12, T13: exit code passes through, the timeout kills the group, output is capped', async (t) => {
+  const f = await hostFixture(t);
+  assert.equal((await f.call(['false'])).exit, 1);
+  const began = Date.now();
+  const slow = await f.call(['sleep', '30'], { timeout: 1 });
+  // D6: the timeout answers signal. ssh exits 255 on SIGTERM, which the result can't tell from a remote 255.
+  assert.equal(slow.signal, 'SIGTERM');
+  assert.ok(Date.now() - began < 10000);
+  const big = await f.call(['head', '-c', '2097152', '/dev/zero']);
+  assert.equal(Buffer.byteLength(big.stdout), 1024 * 1024);
+  assert.deepEqual(big.truncated, { stdout: true, stderr: false });
+});
+
+test('T14: a host key not in the registry refuses and nothing runs', async (t) => {
+  const f = await hostFixture(t, { wrongHostKey: true });
+  await refusesWith(f.call(['true']), 'host-key-mismatch');
+  assert.deepEqual(f.argvSeen(), []);
+});
+
+// Row 234 (#1740, r6 G18, duckworth-0081 B2): hosts.check's `list` goes through runHost with the record's
+// pinned keys. A stub `list` on the scratch sshd's PATH records each run.
+test('G18: hosts.check with a wrong pin refuses host-key-mismatch and runs nothing on the host', async (t) => {
+  const f = await hostFixture(t);
+  writeFileSync(join(f.dir, 'fake', 'list'), `#!/bin/sh\necho "$@" >> '${f.dir}/list.log'\n`, { mode: 0o755 });
+  const configDir = join(f.dir, 'cfg');
+  const keyDir = join(configDir, 'secrets', 'hosts', 'demo', 'web1');
+  mkdirSync(keyDir, { recursive: true, mode: 0o700 });
+  for (const d of [join(configDir, 'secrets'), join(configDir, 'secrets', 'hosts'), join(configDir, 'secrets', 'hosts', 'demo'), keyDir]) chmodSync(d, 0o700);
+  writeFileSync(join(keyDir, 'installer'), readFileSync(f.keyFile), { mode: 0o600 });
+  const hg = hostGrant({ configDir, runRoot: f.root });
+  const record = { address: '127.0.0.1', port: f.port, user: 'jarvis', hostKeys: [pubLine(join(f.dir, 'otherhost'))] };
+  await refusesWith(hg.check('demo', 'web1', record), 'host-key-mismatch');
+  assert.equal(existsSync(join(f.dir, 'list.log')), false);
+  // Control: with the right pin the same command reaches the stub.
+  const out = await runHost({ root: f.root, hostId: 'web1', entry: f.entry, key: f.key, timeout: 10, command: 'list jarvis' });
+  assert.equal(out.exit, 0);
+  assert.equal(readFileSync(join(f.dir, 'list.log'), 'utf8'), 'jarvis\n');
+});
+
+test('N3: a remote exit 255 that prints the pin refusal text is the command result, and an ssh failure keeps its message', async (t) => {
+  const f = await hostFixture(t, { commands: [['fail255']] });
+  const out = await f.call(['fail255']);
+  assert.equal(out.exit, 255);
+  assert.match(out.stderr, /Host key verification failed/);
+  assert.deepEqual(f.argvSeen(), [['-n', '--', 'fail255']]);
+  // A closed port: ssh's message reaches the agent from the run dir's log.
+  const closed = await runHost({ root: f.root, hostId: 'web1', entry: { ...f.entry, port: 1 }, key: f.key, argv: ['true'], stdin: '', timeout: 10 });
+  assert.equal(closed.exit, 255);
+  assert.match(closed.stderr, /port 1: Connection refused/);
+});
+
+test('T15: ssh reads no config file and no user known_hosts', async (t) => {
+  // ssh finds ~/.ssh from the passwd entry, not $HOME, and the test may not write the real home, so
+  // the options are checked here and the call runs with an alias no user file holds (BUILD.md).
+  const args = sshArgs({ hostId: 'web1', address: '10.0.0.5', port: 22, user: 'admin', dir: '/r' });
+  assert.deepEqual(args.slice(0, 2), ['-F', '/dev/null']);
+  assert.deepEqual(args.slice(3, 5), ['-E', '/r/ssh.log']);
+  for (const o of ['StrictHostKeyChecking=yes', 'UserKnownHostsFile=/r/known_hosts', 'GlobalKnownHostsFile=/dev/null',
+    'HostKeyAlias=mosaic-host-web1', 'BatchMode=yes', 'IdentitiesOnly=yes', 'ForwardAgent=no', 'ProxyCommand=none', 'ControlMaster=no'])
+    assert.ok(args.includes(o), o);
+  assert.deepEqual(args.slice(-4), ['-l', 'admin', '--', '10.0.0.5']);
+  const f = await hostFixture(t);
+  assert.equal((await f.call(['true'])).exit, 0);
+});
+
+test('T16, T17: key material in output or stdin refuses credential-leak, and no event holds it', async (t) => {
+  const f = await hostFixture(t, { commands: [['cat']] });
+  const line = f.key.text.split('\n')[2];
+  writeFileSync(join(f.dir, 'one-line'), line + '\n');
+  writeFileSync(join(f.dir, 'seed-hex'), f.key.seed.toString('hex') + '\n');
+  for (const file of [f.keyFile, join(f.dir, 'one-line'), join(f.dir, 'seed-hex')]) await refusesWith(f.call(['cat', file]), 'credential-leak');
+  const ran = f.argvSeen().length;
+  await refusesWith(f.call(['cat'], { stdin: 'x' + line }), 'credential-leak');
+  assert.equal(f.argvSeen().length, ran, 'nothing ran for a stdin leak');
+  const text = JSON.stringify(f.events());
+  for (const needle of [line, f.key.seed.toString('hex')]) assert.equal(text.includes(needle), false);
+  const failed = f.events().filter((e) => e.action === 'host.sudo' && e.phase === 'completed');
+  assert.ok(failed.every((e) => e.outcome === 'failed' && e.code === 'credential-leak'));
+});
+
+test('T18, T19, T20: one call at a time, no key in any argv or env, and nothing left after', async (t) => {
+  const f = await hostFixture(t);
+  const first = f.call(['sleep', '3']);
+  assert.ok(await until(() => f.argvSeen().length === 1), 'fake sudo started');
+  const procs = procsNaming(f.root);
+  assert.ok(procs.length >= 2, 'ssh-agent and ssh name the run dir');
+  const needles = [...f.key.needles, f.key.text];
+  assert.ok(procs.some((p) => p.environ !== null), 'ssh environ read');
+  for (const p of procs) for (const n of needles) assert.equal(p.cmdline.includes(n) || (p.environ ?? '').includes(n), false);
+  // host-busy refuses before the decision is spent, so it still runs after.
+  const held = await f.approve(['true']);
+  await refusesWith(f.run({ host: 'web1', argv: ['true'], decision: held }), 'host-busy');
+  assert.equal((await first).exit, 0);
+  assert.equal((await f.run({ host: 'web1', argv: ['true'], decision: held })).exit, 0);
+  // Success, a refusal, a timeout and a thrown error each leave no run dir and no process.
+  await refusesWith(f.call(['cat', f.keyFile]), 'credential-leak');
+  await f.call(['sleep', '30'], { timeout: 1 });
+  await assert.rejects(
+    runHost({ root: f.root, hostId: 'web1', entry: { ...f.entry, hostKeys: null }, key: f.key, argv: ['true'], stdin: '', timeout: 5 }),
+  );
+  assert.deepEqual(readdirSync(f.root), []);
+  assert.ok(await until(() => procsNaming(f.root).length === 0, 2000));
+});
+
+test('T21: revoke kills the call in flight, and the next call refuses', async (t) => {
+  const f = await hostFixture(t);
+  const slow = f.call(['sleep', '30']);
+  assert.ok(await until(() => f.argvSeen().length === 1));
+  f.credentials.revoke('demo/coder', 'host.web1');
+  await refusesWith(slow, 'credential-unavailable');
+  await refusesWith(f.call(['true']), 'credential-unavailable');
+  assert.ok(await until(() => procsNaming(f.root).length === 0, 2000));
+});
+
+test('T22: events carry host, address, user and argv in clear, and sizes and hashes only', async (t) => {
+  const f = await hostFixture(t);
+  await f.call(['cat'], { stdin: 'secret-ish stdin' });
+  const [requested, completed] = f.events().filter((e) => e.action === 'host.sudo' && e.phase);
+  assert.deepEqual(
+    { host: requested.host, address: requested.address, user: requested.user, argv: requested.argv, stdinBytes: requested.stdinBytes },
+    { host: 'web1', address: '127.0.0.1', user: USER, argv: ['cat'], stdinBytes: 16 },
+  );
+  assert.match(requested.stdinSha256, /^[0-9a-f]{64}$/);
+  assert.equal(completed.outcome, 'ran');
+  assert.equal(completed.stdoutBytes, 16);
+  assert.match(completed.stdoutSha256, /^[0-9a-f]{64}$/);
+  assert.equal(JSON.stringify(f.events()).includes('secret-ish stdin'), false);
+});
+
+test('T24: no literal gitea and vikunja kind list outside vocabulary.mjs, and the credential use sites are known', () => {
+  const files = readdirSync(join(REPO, 'packages')).flatMap((pkg) => {
+    const src = join(REPO, 'packages', pkg, 'src');
+    return existsSync(src) ? readdirSync(src).filter((n) => n.endsWith('.mjs')).map((n) => `packages/${pkg}/src/${n}`) : [];
+  });
+  const code = (file) => readFileSync(join(REPO, file), 'utf8').split('\n').filter((l) => !/^\s*(\/\/|\*)/.test(l)).join('\n');
+  const lists = files.filter((file) => !file.endsWith('business/src/vocabulary.mjs') &&
+    /\[\s*['"]gitea['"]\s*,\s*['"]vikunja['"]\s*\]/.test(code(file)));
+  assert.deepEqual(lists, []);
+  const uses = files.filter((file) => /credentials\.(use|useFor)\(/.test(code(file))).sort();
+  assert.deepEqual(uses, ['packages/bus/src/host-run.mjs', 'packages/bus/src/runtime.mjs', 'packages/tasks/src/adapter.mjs']);
+});
+
+test('T25: no role definition lists host.sudo while it is a hard wait', () => {
+  const dir = join(REPO, 'roles');
+  for (const name of readdirSync(dir).filter((n) => n.endsWith('.json'))) {
+    const role = JSON.parse(readFileSync(join(dir, name), 'utf8'));
+    const authority = role.authority ?? {};
+    for (const list of [authority.withinRole ?? [], authority.crossRole ?? []]) assert.equal(list.includes('host.sudo'), false, name);
+  }
+});
+
+test('T27: the bus child dying takes ssh and ssh-agent with it', async (t) => {
+  const f = await hostFixture(t);
+  // A separate bus child runs one call; the test SIGKILLs it while fake sudo sleeps.
+  const script = join(f.dir, 'child.mjs');
+  const src = new URL('../src/', import.meta.url).href;
+  writeFileSync(script, `
+import { Credentials } from '${src}credentials.mjs';
+import { hostExecutor } from '${src}host-run.mjs';
+const credentials = new Credentials({ references: { 'demo/coder': { 'host.web1': { file: ${JSON.stringify(f.keyFile)}, rotateBy: '2099-01-01' } } }, dataRoot: ${JSON.stringify(join(f.dir, 'data'))} });
+const executor = hostExecutor({ credentials, root: ${JSON.stringify(join(f.dir, 'run2'))} });
+await executor.run({ business: 'demo', role: 'coder' }, 'web1', ${JSON.stringify(f.entry)}, { argv: ['sleep', '60'], stdin: '', timeout: 120 });
+`);
+  const child = spawn(process.execPath, [script], { stdio: 'ignore' });
+  t.after(() => child.kill('SIGKILL'));
+  assert.ok(await until(() => f.argvSeen().length === 1, 10000), 'fake sudo started');
+  const [run] = readdirSync(join(f.dir, 'run2'));
+  const pids = readFileSync(join(f.dir, 'run2', run, 'pids'), 'utf8').trim().split('\n').map((l) => Number(l.split(' ')[0]));
+  assert.equal(pids.length, 3);
+  assert.equal(pids[0], child.pid);
+  child.kill('SIGKILL');
+  assert.ok(await until(() => pids.slice(1).every((p) => !existsSync(`/proc/${p}`)), 2000), 'ssh and ssh-agent are gone');
+  // The next start sweeps the dir.
+  assert.deepEqual(sweepRunDir(join(f.dir, 'run2')).removed, [run]);
+  assert.deepEqual(readdirSync(join(f.dir, 'run2')), []);
+});
+
+test('T27: ssh-add -t drops the key from an agent the test keeps alive', async (t) => {
+  const dir = mkdtempSync(join(tmpdir(), 'h210-'));
+  t.after(() => rmSync(dir, { recursive: true, force: true }));
+  keygen(join(dir, 'k'));
+  const sock = join(dir, 'a.sock');
+  const agent = spawn('ssh-agent', ['-D', '-a', sock], { stdio: 'ignore' });
+  t.after(() => agent.kill('SIGKILL'));
+  assert.ok(await until(() => existsSync(sock)));
+  await addKey(sock, readFileSync(join(dir, 'k'), 'utf8'), 1);
+  const list = () => {
+    try {
+      return execFileSync('ssh-add', ['-l'], { env: { PATH: '/usr/bin:/bin', SSH_AUTH_SOCK: sock }, encoding: 'utf8' });
+    } catch (e) {
+      return e.stdout;
+    }
+  };
+  assert.match(list(), /SHA256:/);
+  await sleep(2500);
+  assert.match(list(), /no identities/);
+});
+
+// The test's own limit makes a hung addKey (M37a, M37b) fail in seconds, not at the batch timeout.
+test('N2: a hung ssh-add is killed at its limit or on abort, and nothing is left running', { timeout: 10000 }, async (t) => {
+  const dir = mkdtempSync(join(tmpdir(), 'h210-'));
+  t.after(() => rmSync(dir, { recursive: true, force: true }));
+  keygen(join(dir, 'k'));
+  const text = readFileSync(join(dir, 'k'), 'utf8');
+  // An agent socket that accepts and never answers.
+  const closed = [];
+  const server = createServer((c) => c.resume().on('close', () => closed.push(Date.now())));
+  const sock = join(dir, 'a.sock');
+  await new Promise((r) => server.listen(sock, r));
+  t.after(() => server.close());
+  const began = Date.now();
+  await refusesWith(addKey(sock, text, 1, { limitMs: 300 }), 'host-failed');
+  assert.ok(Date.now() - began < 2000);
+  const controller = new AbortController();
+  setTimeout(() => controller.abort(), 100);
+  await refusesWith(addKey(sock, text, 1, { limitMs: 60000, signal: controller.signal }), 'credential-unavailable');
+  // Both ssh-add processes are gone: the socket saw each connection close.
+  assert.ok(await until(() => closed.length === 2), `closed ${closed.length}`);
+});
+
+test('T27: the start sweep keeps a live bus dir and kills only a matching live process', async (t) => {
+  const root = mkdtempSync(join(tmpdir(), 'h210-run-'));
+  t.after(() => rmSync(root, { recursive: true, force: true }));
+  chmodSync(root, 0o700);
+  const dead = spawn('true');
+  await new Promise((r) => dead.on('close', r));
+  const make = (name, lines) => {
+    mkdirSync(join(root, name), { mode: 0o700 });
+    writeFileSync(join(root, name, 'pids'), lines.map((l) => l.join(' ') + '\n').join(''));
+    return join(root, name);
+  };
+  // A dir whose bus is gone, with a planted live process that names it.
+  const gone = join(root, 'h-aaaaaa');
+  const planted = spawn('/bin/sh', ['-c', 'sleep 60; :', gone], { stdio: 'ignore', detached: true });
+  t.after(() => { try { process.kill(planted.pid, 'SIGKILL'); } catch {} });
+  await until(() => startTime(planted.pid) !== null);
+  make('h-aaaaaa', [[dead.pid, 'x'], [planted.pid, startTime(planted.pid)]]);
+  // A dir whose bus is alive.
+  make('h-bbbbbb', [[process.pid, startTime(process.pid)]]);
+  // A dir whose bus is gone and whose recorded pid is alive but with another start time.
+  const other = join(root, 'h-cccccc');
+  const decoy = spawn('/bin/sh', ['-c', 'sleep 60; :', other], { stdio: 'ignore', detached: true });
+  t.after(() => { try { process.kill(decoy.pid, 'SIGKILL'); } catch {} });
+  await until(() => startTime(decoy.pid) !== null);
+  make('h-cccccc', [[dead.pid, 'x'], [decoy.pid, '1']]);
+  assert.deepEqual(sweepRunDir(root).removed.sort(), ['h-aaaaaa', 'h-cccccc']);
+  assert.ok(await until(() => planted.exitCode !== null || planted.signalCode !== null, 2000), 'planted process killed');
+  assert.equal(existsSync(`/proc/${decoy.pid}`), true, 'decoy kept');
+  assert.deepEqual(readdirSync(root), ['h-bbbbbb']);
+  writeFileSync(join(root, 'stray'), '');
+  assert.throws(() => sweepRunDir(root), /credential-file/);
+});
+
+test('T27: the bus start sweeps <configDir>/secrets/run before it listens, and a stray entry stops the start', async (t) => {
+  const root = mkdtempSync(join(tmpdir(), 'h210-'));
+  t.after(() => rmSync(root, { recursive: true, force: true }));
+  const rolesDir = rolesCopy(root);
+  writeJson(join(root, 'businesses/demo.json'), businessDoc(root, 'demo'));
+  mkdirSync(join(root, 'data'), { mode: 0o700 });
+  const run = join(root, 'secrets', 'run');
+  mkdirSync(join(run, 'h-dddddd'), { recursive: true, mode: 0o700 });
+  chmodSync(join(root, 'secrets'), 0o700);
+  const dead = spawn('true');
+  await new Promise((r) => dead.on('close', r));
+  writeFileSync(join(run, 'h-dddddd', 'pids'), `${dead.pid} x\n`);
+  const demo = {
+    id: 'demo', human: 'jason', arbiters: { technical: 'coder', delivery: 'coder' },
+    roles: { coder: { authority: { withinRole: ['message.send'], crossRole: [] }, credentials: {} } },
+  };
+  const start = () => startBroker({ dataRoot: join(root, 'data'), businesses: { demo }, organization: { dir: root, rolesDir, system: systemFor(root) } });
+  const bus = await start();
+  try {
+    assert.deepEqual(readdirSync(run), []);
+  } finally {
+    await bus.close();
+  }
+  writeFileSync(join(run, 'stray'), '');
+  // A bus that starts anyway is closed, so a failure here ends the file instead of holding it open.
+  await assert.rejects(async () => { const again = await start(); await again.close(); }, /credential-file/);
+});
+
+// Row 234 (#1740, duckworth-0079 M3, r6 X4 first bullet): host.run takes a grant record only behind the
+// Approve record check. Each case breaks one part of it. The refusals come before the executor, so none
+// needs sshd. The control passes the check and stops at host-not-configured.
+test('M3: host.run refuses host-not-granted unless the grant record has an approved, spent host grant', async (t) => {
+  const f = await fixture(t, { roles: { coder: { definition: 'coder', authority: { withinRole: ['message.send'], crossRole: [] } } } });
+  const entry = { address: '10.0.0.5', port: 22, user: 'admin', hostKeys: ['ssh-ed25519 AAAA'] };
+  for (const host of ['web1', 'web2']) hostRecord(f.store, { host, entry });
+  const run = (cap = f.coder, host = 'web1') => f.broker.requestHost(cap, { verb: 'host.run', args: { host, argv: ['true'] } }, null);
+  const commands = [['true']];
+  const cases = {
+    'no record': null,
+    unresolved: { close: null },
+    'resolved no': { close: { ...HUMAN_YES, choice: 'no' } },
+    withdrawn: { close: { op: 'withdrawn', by: 'jason', via: 'cli' } },
+    'an arbiter': { close: { ...HUMAN_YES, by: 'reviewer', via: 'broker' } },
+    'the tester': { close: { ...HUMAN_YES, by: 'tester' } },
+    'an agent': { close: { ...HUMAN_YES, by: 'coder', via: 'broker' } },
+    'not via cli': { close: { ...HUMAN_YES, via: 'web' } },
+    'consumed as grant.host-enroll': { spend: 'grant.host-enroll' },
+    unspent: { spend: null },
+    'not a credential.mint': { action: 'deploy' },
+    'no grant in the raise': { grant: null },
+    'a host-enroll grant': { grant: { method: 'host-enroll' } },
+    'a grant for another agent': { grant: { agent: 'reviewer' } },
+    'a grant for another host': { grant: { host: 'web2' } },
+  };
+  for (const [name, opts] of Object.entries(cases)) {
+    f.store.run('DELETE FROM host_grants');
+    if (opts) hostGrantRecord(f.store, { agent: 'coder', host: 'web1', commands, ...opts });
+    await refusesWith(run(), 'host-not-granted').catch((e) => assert.fail(`${name}: ${e.message}`));
+  }
+  f.store.run('DELETE FROM host_grants');
+  hostGrantRecord(f.store, { agent: 'coder', host: 'web1', commands });
+  await refusesWith(run(), 'host-not-configured');
+  // The record is per agent: the reviewer holds none on web1, and web9 has no host record.
+  await refusesWith(run(f.reviewer), 'host-not-granted');
+  await refusesWith(run(f.coder, 'web9'), 'host-unknown');
+  // The host.sudo raise takes the same check (N1).
+  f.store.run('DELETE FROM host_grants');
+  hostGrantRecord(f.store, { agent: 'coder', host: 'web1', commands, spend: null });
+  assert.throws(() => f.raise({ action: 'host.sudo', target: 'web1', argv: ['true'] }), /host-not-granted/);
+});
+
+// Row 234 (#1740, M3, r6 X4 third bullet): at start each host_grants record gives Credentials a store
+// reference to host.<id>, so a restart finds the key the grant executor wrote.
+test('M3: a host_grants record gives Credentials a store reference at start, and a restart reads its key', async (t) => {
+  const root = mkdtempSync(join(tmpdir(), 'h234-'));
+  t.after(() => rmSync(root, { recursive: true, force: true }));
+  const rolesDir = rolesCopy(root);
+  mkdirSync(join(root, 'data'), { mode: 0o700 });
+  mkdirSync(join(root, 'secrets', 'agents'), { recursive: true, mode: 0o700 });
+  chmodSync(join(root, 'secrets'), 0o700);
+  const demo = {
+    id: 'demo', human: 'jason', arbiters: { technical: 'coder', delivery: 'coder' },
+    roles: { coder: { authority: { withinRole: ['message.send'], crossRole: [] }, credentials: {} } },
+  };
+  const start = () => startBroker({ dataRoot: join(root, 'data'), businesses: { demo }, organization: { dir: root, rolesDir, system: systemFor(root) } });
+  const hostKeys = (bus) => bus.credentials.status().filter((c) => c.service.startsWith('host.'));
+  let bus = await start();
+  assert.deepEqual(hostKeys(bus), []);
+  await bus.close();
+  const store = new Store(join(root, 'data'));
+  hostRecord(store, { host: 'web1', entry: { address: '10.0.0.5', port: 22, user: 'admin', hostKeys: ['ssh-ed25519 AAAA'] } });
+  hostGrantRecord(store, { agent: 'coder', host: 'web1', commands: [['true']], rotateBy: '2099-02-03' });
+  store.close();
+  bus = await start();
+  try {
+    assert.deepEqual(hostKeys(bus).map(({ instance, service, date, state }) => ({ instance, service, date, state })), [
+      { instance: 'demo/coder', service: 'host.web1', date: '2099-02-03', state: 'not-issued' },
+    ]);
+  } finally {
+    await bus.close();
+  }
+  const dir = join(root, 'secrets', 'agents', 'demo', 'coder');
+  mkdirSync(dir, { recursive: true, mode: 0o700 });
+  chmodSync(join(root, 'secrets', 'agents', 'demo'), 0o700);
+  keygen(join(dir, 'host.web1'));
+  bus = await start();
+  try {
+    const [key] = hostKeys(bus);
+    assert.equal(key.publicKey, pubLine(join(dir, 'host.web1')));
+    assert.notEqual(key.state, 'not-issued');
+  } finally {
+    await bus.close();
+  }
+});
@@ -0,0 +1,358 @@
+// Row 234 (#1740, #436a row a), design r6 E3: the four host files in tools/host, as G16 and G25.
+// The writer runs as the test user through a harness that loads it by path and passes its own dirs,
+// owner uid and user, group and sudo lookups, so nothing runs as root and nothing under /etc is read.
+// mosaic-keys runs from a copy whose sudo and logger paths point at stubs in a scratch dir.
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { execFileSync, spawnSync } from 'node:child_process';
+import { createHash, randomBytes } from 'node:crypto';
+import {
+  chmodSync, existsSync, lstatSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, rmSync, statSync, symlinkSync,
+  writeFileSync,
+} from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const REPO = fileURLToPath(new URL('../../../', import.meta.url));
+const TOOLS = join(REPO, 'tools', 'host');
+const WRITER = join(TOOLS, 'mosaic-keys-write');
+const REFUSED_GROUPS = ['sudo', 'admin', 'wheel', 'docker', 'lxd', 'disk', 'libvirt', 'incus-admin'];
+const tag = (n) => 'mosaic-' + createHash('sha256').update(String(n)).digest('hex').slice(0, 32);
+const u32 = (n) => {
+  const b = Buffer.alloc(4);
+  b.writeUInt32BE(n);
+  return b;
+};
+const keyBlob = () => Buffer.concat([u32(11), Buffer.from('ssh-ed25519'), u32(32), randomBytes(32)]).toString('base64');
+const fingerprint = (b64) => 'SHA256:' + createHash('sha256').update(Buffer.from(b64, 'base64')).digest('base64').replace(/=+$/, '');
+const notAllowed = (u) => `User ${u} is not allowed to run sudo on testhost.\n`;
+
+const HARNESS = `import importlib.machinery, importlib.util, json, os, sys
+sys.dont_write_bytecode = True
+cfg = json.loads(sys.argv[1])
+loader = importlib.machinery.SourceFileLoader('mosaic_keys_write', cfg['writer'])
+m = importlib.util.module_from_spec(importlib.util.spec_from_loader('mosaic_keys_write', loader))
+loader.exec_module(m)
+users = cfg['users']
+def log(msg):
+    with open(cfg['log'], 'a') as f:
+        f.write(msg + '\\n')
+def sudo(u):
+    with open(cfg['sudoLog'], 'a') as f:
+        f.write(u + '\\n')
+    return users[u]['sudo'] if 'sudo' in users[u] else 'User %s is not allowed to run sudo on testhost.\\n' % u
+host = m.Host(key_dir=cfg['keyDir'], conf_dir=cfg['confDir'], owner=os.getuid(),
+              passwd=lambda u: users[u]['uid'] if u in users else None,
+              groups=lambda u: users[u].get('groups', []), sudo=sudo, hostname='testhost', log=log)
+sys.exit(m.main(sys.argv[2:], host))
+`;
+
+// The users the harness's lookups know. users lists all of them but dave and eve. bob and dave are
+// privileged. carol has a sudo line. Each gX is in one refused group.
+function userTable() {
+  const users = {
+    alice: { uid: 1500 },
+    bob: { uid: 1501, groups: ['sudo', 'docker'], sudo: 'User bob may run the following commands on testhost:\n    (ALL) ALL\n' },
+    carol: { uid: 1502, sudo: 'User carol may run the following commands on testhost:\n    (root) /usr/bin/true\n' },
+    dave: { uid: 1503 },
+    eve: { uid: 1504 },
+    frank: { uid: 1505, groups: ['users', 'adm'] },
+    '../x': { uid: 1506 },
+    root: { uid: 0 },
+    toor: { uid: 0 },
+    daemon2: { uid: 999 },
+    localadmin: { uid: 1000 },
+    'mosaic-installer': { uid: 1001 },
+  };
+  for (const [i, g] of REFUSED_GROUPS.entries()) users['g' + g] = { uid: 1600 + i, groups: ['users', g] };
+  return users;
+}
+
+function hostDirs() {
+  const root = mkdtempSync(join(tmpdir(), 'hk234-'));
+  const keyDir = join(root, 'keys');
+  const confDir = join(root, 'conf');
+  mkdirSync(keyDir, { mode: 0o755 });
+  mkdirSync(confDir, { mode: 0o755 });
+  chmodSync(keyDir, 0o755);
+  const users = userTable();
+  const conf = (name, text) => {
+    writeFileSync(join(confDir, name), text, { mode: 0o644 });
+    chmodSync(join(confDir, name), 0o644);
+  };
+  conf('users', '# users the writer may touch\n' + Object.keys(users).filter((u) => !['dave', 'eve'].includes(u)).join('\n') + '\n');
+  conf('privileged', 'bob\ndave\n');
+  conf('from', '10.1.2.3/32\n');
+  const harness = join(root, 'harness.py');
+  writeFileSync(harness, HARNESS);
+  const cfg = { writer: WRITER, keyDir, confDir, users, log: join(root, 'syslog'), sudoLog: join(root, 'sudo.log') };
+  const run = (...args) => {
+    const r = spawnSync('python3', ['-B', '-I', harness, JSON.stringify(cfg), ...args], { encoding: 'utf8' });
+    return { status: r.status, stdout: r.stdout, stderr: r.stderr };
+  };
+  const read = (file) => readFileSync(join(keyDir, file), 'utf8');
+  const lastLog = () => readFileSync(cfg.log, 'utf8').trim().split('\n').at(-1);
+  const sudoCalls = () => (existsSync(cfg.sudoLog) ? readFileSync(cfg.sudoLog, 'utf8').trim().split('\n') : []);
+  return { root, keyDir, confDir, conf, run, read, lastLog, sudoCalls, done: () => rmSync(root, { recursive: true, force: true }) };
+}
+
+const refused = (r, code) => {
+  assert.equal(r.status, 1, r.stderr);
+  assert.equal(r.stderr, `mosaic-keys-write: refused ${code}\n`);
+};
+
+test('G16: the writer refuses each user, tag and key the design names, before any key file', () => {
+  const h = hostDirs();
+  try {
+    const key = keyBlob();
+    const t = tag(1);
+    const add = (user) => h.run('add', user, 'ssh-ed25519', key, t);
+    // The user pattern stops `../x` before any path, though the lookups and users know it.
+    for (const user of ['../x', 'Alice', 'a'.repeat(33), '1alice', 'al ice', '']) {
+      refused(add(user), 'user-pattern');
+      refused(h.run('list', user), 'user-pattern');
+    }
+    // users is always required: privileged alone allows nothing.
+    refused(add('dave'), 'user-not-listed');
+    refused(add('eve'), 'user-not-listed');
+    for (const user of ['root', 'localadmin', 'mosaic-installer']) refused(add(user), 'user-not-listed');
+    refused(add('toor'), 'user-system');
+    refused(add('daemon2'), 'user-system');
+    refused(add('ghost'), 'user-not-listed');
+    for (const g of REFUSED_GROUPS) {
+      refused(add('g' + g), 'user-group');
+      refused(h.run('remove', 'g' + g, t), 'user-group');
+    }
+    refused(add('carol'), 'user-sudo');
+    refused(h.run('list', 'carol'), 'user-sudo');
+    assert.equal(h.lastLog(), 'result=refused user-sudo user=carol');
+    for (const bad of ['mosaic-' + 'a'.repeat(31), 'mosaic-' + 'A'.repeat(32), 'mosaic-installer-' + 'a'.repeat(32), 'mosaic-' + 'g'.repeat(32)]) {
+      refused(h.run('add', 'alice', 'ssh-ed25519', key, bad), 'tag-pattern');
+      refused(h.run('remove', 'alice', bad), 'tag-pattern');
+    }
+    refused(h.run('add', 'alice', 'ssh-dss', key, t), 'key-format');
+    refused(h.run('add', 'alice', 'ssh-ed25519', key.slice(0, -2) + '!!', t), 'key-format');
+    refused(h.run('add', 'alice', 'ssh-ed25519', 'A', t), 'key-format');
+    refused(h.run('add', 'alice', 'ssh-ed25519', key + ' x', t), 'key-format');
+    for (const args of [[], ['list'], ['list', 'alice', 'bob'], ['add', 'alice', 'ssh-ed25519', key], ['remove', 'alice'], ['rm', 'alice', t]])
+      refused(h.run(...args), 'request');
+    // No refusal reached the key dir, so not even the lock exists.
+    assert.deepEqual(readdirSync(h.keyDir), []);
+    // Only users past the groups check reach sudo -l, and the privileged never do.
+    assert.deepEqual([...new Set(h.sudoCalls())], ['carol']);
+  } finally {
+    h.done();
+  }
+});
+
+test('G16: from= comes from the host file, a privileged user skips the group and sudo checks, and the line is exact', () => {
+  const h = hostDirs();
+  try {
+    const k1 = keyBlob();
+    const k2 = keyBlob();
+    assert.equal(h.run('add', 'alice', 'ssh-ed25519', k1, tag(1)).status, 0);
+    assert.equal(h.lastLog(), `result=added user=alice tag=${tag(1)} key=${fingerprint(k1)}`);
+    h.conf('from', '# the stack host\n10.9.9.9,192.168.1.0/24\n');
+    assert.equal(h.run('add', 'alice', 'ssh-ed25519', k2, tag(2)).status, 0);
+    assert.equal(
+      h.read('alice'),
+      `from="10.1.2.3/32",restrict ssh-ed25519 ${k1} ${tag(1)}\nfrom="10.9.9.9,192.168.1.0/24",restrict ssh-ed25519 ${k2} ${tag(2)}\n`,
+    );
+    // A tag already there changes nothing and exits 0.
+    assert.equal(h.run('add', 'alice', 'ssh-ed25519', k2, tag(1)).status, 0);
+    assert.equal(h.lastLog(), `result=present user=alice tag=${tag(1)} key=${fingerprint(k2)}`);
+    assert.equal(h.read('alice').split('\n').length, 3);
+    // bob is in sudo and docker with a sudo line, and privileged.
+    assert.equal(h.run('add', 'bob', 'ssh-ed25519', k1, tag(3)).status, 0);
+    // frank's groups are none of the refused ones.
+    assert.equal(h.run('add', 'frank', 'ssh-ed25519', k1, tag(4)).status, 0);
+    assert.deepEqual(h.sudoCalls(), ['alice', 'alice', 'alice', 'frank']);
+    // A from value that could close the quote, two values, or none, refuses and writes nothing.
+    for (const text of ['10.0.0.1",command="/bin/sh\n', '10.0.0.1\n10.0.0.2\n', '# none\n', '10.0.0.1 10.0.0.2\n']) {
+      h.conf('from', text);
+      refused(h.run('add', 'frank', 'ssh-ed25519', k2, tag(5)), 'config-from');
+    }
+    rmSync(join(h.confDir, 'from'));
+    refused(h.run('add', 'frank', 'ssh-ed25519', k2, tag(5)), 'config-from');
+    assert.ok(!h.read('frank').includes(tag(5)));
+    // list and remove don't need from.
+    assert.equal(h.run('list', 'frank').stdout, `from="10.9.9.9,192.168.1.0/24",restrict ssh-ed25519 ${k1} ${tag(4)}\n`);
+    for (const name of ['users', 'privileged']) {
+      chmodSync(join(h.confDir, name), 0o664);
+      refused(h.run('list', 'alice'), 'not-root-owned');
+      chmodSync(join(h.confDir, name), 0o644);
+    }
+    rmSync(join(h.confDir, 'users'));
+    refused(h.run('list', 'alice'), 'config-users');
+  } finally {
+    h.done();
+  }
+});
+
+test('G16: list shows tagged lines only, and add and remove never touch a line outside the tag pattern', () => {
+  const h = hostDirs();
+  try {
+    const k = keyBlob();
+    const hand = [
+      '# written by hand',
+      `ssh-ed25519 ${k} mosaic-installer-${'a'.repeat(32)}`,
+      '',
+      `ssh-ed25519 ${k} ${tag(9).toUpperCase()}`,
+      `ssh-ed25519 ${k} ${tag(1)} trailing`,
+    ];
+    const tagged = `from="10.1.2.3/32",restrict ssh-ed25519 ${k} ${tag(7)}`;
+    writeFileSync(join(h.keyDir, 'alice'), [hand[0], tagged, ...hand.slice(1)].join('\n') + '\n', { mode: 0o644 });
+    assert.equal(h.run('list', 'alice').stdout, tagged + '\n');
+    // The last field is the tag, so `... mosaic-<1> trailing` isn't tag 1.
+    assert.equal(h.run('remove', 'alice', tag(1)).status, 0);
+    assert.equal(h.lastLog(), `result=absent user=alice tag=${tag(1)}`);
+    assert.equal(h.run('add', 'alice', 'ssh-ed25519', k, tag(8)).status, 0);
+    assert.equal(h.run('remove', 'alice', tag(7)).status, 0);
+    assert.equal(h.lastLog(), `result=removed user=alice tag=${tag(7)}`);
+    assert.equal(h.read('alice'), [...hand, `from="10.1.2.3/32",restrict ssh-ed25519 ${k} ${tag(8)}`].join('\n') + '\n');
+    assert.equal(h.run('remove', 'alice', tag(8)).status, 0);
+    assert.equal(h.read('alice'), hand.join('\n') + '\n');
+    // A missing file lists nothing and a remove there changes nothing.
+    assert.equal(h.run('list', 'frank').stdout, '');
+    assert.equal(h.run('remove', 'frank', tag(1)).status, 0);
+    assert.ok(!existsSync(join(h.keyDir, 'frank')));
+  } finally {
+    h.done();
+  }
+});
+
+test('G25: the writer refuses a symlinked dir or user file, a group-writable dir and an odd tmp, and writes 0644', () => {
+  const h = hostDirs();
+  try {
+    const k = keyBlob();
+    const add = (n, user = 'alice') => h.run('add', user, 'ssh-ed25519', k, tag(n));
+    // A first add creates the file, regular, 0644, owned by the owner uid, with no tmp left.
+    assert.equal(add(1).status, 0);
+    const st = statSync(join(h.keyDir, 'alice'));
+    assert.equal(st.mode & 0o777, 0o644);
+    assert.equal(st.uid, process.getuid());
+    assert.deepEqual(readdirSync(h.keyDir).sort(), ['.lock', 'alice']);
+    // A leftover regular tmp is unlinked and the write goes ahead.
+    writeFileSync(join(h.keyDir, '.alice.tmp'), 'half a write');
+    assert.equal(add(2).status, 0);
+    assert.ok(h.read('alice').includes(tag(2)));
+    assert.ok(!existsSync(join(h.keyDir, '.alice.tmp')));
+    // A tmp that is a symlink, a dir or a fifo refuses, and nothing is written.
+    const decoy = join(h.root, 'decoy');
+    writeFileSync(decoy, 'decoy\n');
+    const before = h.read('alice');
+    for (const make of [
+      (p) => symlinkSync(decoy, p),
+      (p) => mkdirSync(p),
+      (p) => execFileSync('mkfifo', [p]),
+    ]) {
+      make(join(h.keyDir, '.alice.tmp'));
+      refused(add(3), 'tmp-file');
+      assert.equal(h.read('alice'), before);
+      assert.equal(readFileSync(decoy, 'utf8'), 'decoy\n');
+      rmSync(join(h.keyDir, '.alice.tmp'), { recursive: true });
+    }
+    // A symlinked user file refuses, though its target is a regular file the owner owns.
+    symlinkSync(decoy, join(h.keyDir, 'frank'));
+    refused(add(4, 'frank'), 'user-file');
+    refused(h.run('list', 'frank'), 'user-file');
+    assert.equal(readFileSync(decoy, 'utf8'), 'decoy\n');
+    assert.ok(lstatSync(join(h.keyDir, 'frank')).isSymbolicLink());
+    // A user "file" that is a dir refuses.
+    mkdirSync(join(h.keyDir, 'bob'));
+    refused(add(5, 'bob'), 'not-root-owned');
+    // A group-writable dir refuses.
+    chmodSync(h.keyDir, 0o775);
+    refused(add(6), 'not-root-owned');
+    chmodSync(h.keyDir, 0o755);
+    // A symlinked key dir refuses, and its target is untouched.
+    const real = join(h.root, 'real-keys');
+    mkdirSync(real, { mode: 0o755 });
+    rmSync(h.keyDir, { recursive: true });
+    symlinkSync(real, h.keyDir);
+    refused(add(7), 'key-dir');
+    assert.deepEqual(readdirSync(real), []);
+  } finally {
+    h.done();
+  }
+});
+
+// mosaic-keys from a copy with its sudo and logger paths on stubs. The stub sudo records its argv,
+// prints a line and exits 3, so the test sees the exit and output pass through.
+function forcedCommand() {
+  const root = mkdtempSync(join(tmpdir(), 'hk234-'));
+  const sudo = join(root, 'sudo');
+  const logger = join(root, 'logger');
+  writeFileSync(sudo, `#!/bin/bash\nprintf '%s\\n' "$@" > ${root}/sudo.argv\necho from-writer\nexit 3\n`, { mode: 0o755 });
+  writeFileSync(logger, `#!/bin/bash\nprintf '%s\\n' "$*" >> ${root}/logger.log\n`, { mode: 0o755 });
+  const source = readFileSync(join(TOOLS, 'mosaic-keys'), 'utf8');
+  assert.equal(source.split('/usr/bin/sudo').length, 2);
+  assert.equal(source.split('/usr/bin/logger').length, 2);
+  const copy = join(root, 'mosaic-keys');
+  writeFileSync(copy, source.replace('/usr/bin/sudo', sudo).replace('/usr/bin/logger', logger), { mode: 0o755 });
+  const run = (request) => {
+    rmSync(join(root, 'sudo.argv'), { force: true });
+    const env = { PATH: '/usr/bin:/bin', SSH_CONNECTION: '10.1.2.3 50000 10.1.2.9 22' };
+    if (request !== undefined) env.SSH_ORIGINAL_COMMAND = request;
+    const r = spawnSync(copy, [], { encoding: 'utf8', env });
+    const argv = existsSync(join(root, 'sudo.argv')) ? readFileSync(join(root, 'sudo.argv'), 'utf8').trim().split('\n') : null;
+    return { status: r.status, stdout: r.stdout, stderr: r.stderr, argv };
+  };
+  const logged = () => readFileSync(join(root, 'logger.log'), 'utf8').trim().split('\n');
+  return { run, logged, done: () => rmSync(root, { recursive: true, force: true }) };
+}
+
+test('G16: mosaic-keys passes the three requests to the writer through sudo and refuses anything else without it', () => {
+  const f = forcedCommand();
+  try {
+    const k = keyBlob();
+    const t = tag(1);
+    const writer = ['-n', '/usr/local/sbin/mosaic-keys-write'];
+    for (const words of [['list', 'alice'], ['add', 'alice', 'ssh-ed25519', k, t], ['add', 'alice', 'ecdsa-sha2-nistp256', 'AAAA', t], ['remove', 'alice', t]]) {
+      const r = f.run(words.join(' '));
+      assert.deepEqual(r.argv, [...writer, ...words]);
+      assert.equal(r.status, 3);
+      assert.equal(r.stdout, 'from-writer\n');
+    }
+    const bad = [
+      undefined, '', 'list', 'list ../x', 'list Alice', 'list alice;id', 'list alice ', ' list alice', 'list  alice', 'list\talice',
+      'list alice\nlist bob', 'list $(id)', 'list alice`id`', 'list *', 'rm alice', 'list ' + 'a'.repeat(33),
+      `add alice ssh-dss ${k} ${t}`, `add alice ssh-ed25519 ${k}! ${t}`, `add alice ssh-ed25519 ${k}`, `add alice ssh-ed25519 ${k} ${t} x`,
+      `remove alice mosaic-${'a'.repeat(31)}`, `remove alice ${t.toUpperCase()}`, `remove alice ${t}\n`, `remove alice ${t}; rm -rf /`,
+    ];
+    for (const request of bad) {
+      const r = f.run(request);
+      assert.equal(r.argv, null, JSON.stringify(request));
+      assert.equal(r.status, 1);
+      assert.equal(r.stderr, 'mosaic-keys: refused\n');
+    }
+    // Two bad requests hold a newline, so count the logger calls, not the lines.
+    const logged = f.logged().filter((l) => l.startsWith('-t mosaic-keys -- '));
+    assert.equal(logged.length, 4 + bad.length);
+    assert.equal(logged[0], '-t mosaic-keys -- connection=10.1.2.3 50000 10.1.2.9 22 request=list alice');
+  } finally {
+    f.done();
+  }
+});
+
+test('E3: the sudoers line and the sshd drop-in are the design lines and parse', () => {
+  const lines = (file) => readFileSync(join(TOOLS, file), 'utf8').split('\n').filter((l) => l && !l.startsWith('#'));
+  assert.deepEqual(lines('mosaic-keys.sudoers'), ['mosaic-installer ALL=(root) NOPASSWD: /usr/local/sbin/mosaic-keys-write']);
+  assert.deepEqual(lines('mosaic-keys.sshd.conf'), ['AuthorizedKeysFile .ssh/authorized_keys .ssh/authorized_keys2 /etc/ssh/mosaic-keys/%u']);
+  assert.ok(existsSync('/usr/bin/visudo'), 'visudo on the test host');
+  execFileSync('/usr/bin/visudo', ['-c', '-q', '-f', join(TOOLS, 'mosaic-keys.sudoers')]);
+  const dir = mkdtempSync(join(tmpdir(), 'hk234-'));
+  try {
+    execFileSync('ssh-keygen', ['-q', '-t', 'ed25519', '-N', '', '-f', join(dir, 'hk')]);
+    writeFileSync(join(dir, 'cfg'), `HostKey ${join(dir, 'hk')}\nInclude ${join(TOOLS, 'mosaic-keys.sshd.conf')}\n`);
+    const out = execFileSync('/usr/bin/sshd', ['-T', '-f', join(dir, 'cfg'), '-C', 'user=alice,host=x,addr=127.0.0.1'], { encoding: 'utf8' });
+    // sshd -T prints this key as AuthorizedKeysFile, unlike most.
+    const line = out.split('\n').filter((l) => /^authorizedkeysfile /i.test(l));
+    assert.deepEqual(line.map((l) => l.split(' ').slice(1).join(' ')), ['.ssh/authorized_keys .ssh/authorized_keys2 /etc/ssh/mosaic-keys/%u']);
+  } finally {
+    rmSync(dir, { recursive: true, force: true });
+  }
+  for (const file of ['mosaic-keys', 'mosaic-keys-write']) assert.equal(statSync(join(TOOLS, file)).mode & 0o111, 0o111, file);
+  assert.equal(readFileSync(WRITER, 'utf8').split('\n')[0], '#!/usr/bin/python3 -I');
+});
@@ -8,7 +8,7 @@ import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { Store } from '../src/store.mjs';
-import { Broker, LIFECYCLE_HUMAN_VERBS, ORGANIZATION_KEYS, TESTER_ORGANIZATION_VERBS } from '../src/broker.mjs';
+import { Broker, ORGANIZATION_KEYS } from '../src/broker.mjs';

 const chiefAuthority = JSON.parse(readFileSync(fileURLToPath(new URL('../../../roles/chief-of-staff.json', import.meta.url)), 'utf8')).authority;
 const none = { authority: { withinRole: ['message.send'], crossRole: [] } };
@@ -75,8 +75,6 @@ test('row 165 runtime: an add and a change reach the organization file with the
  assert.equal(view.definitions['merge-gate'].accepted, true);
  const added = bus.broker.request(human, { verb: 'instances.set', args: { ...ADD, revision: view.revision } });
  assert.equal(added.instances['sec-1'].launched, true);
-  // Row 194 (D3 item 3): this boot copy's coder has no credential references and the file's has, so
-  // the bus doesn't reload and asks for a restart. reload.test.mjs boots from the file.
  assert.equal(added.restart, true);
  assert.deepEqual(JSON.parse(readFileSync(file, 'utf8')).roles['sec-1'], { definition: 'security-reviewer' });
  const first = log().at(-1);
@@ -86,8 +84,7 @@ test('row 165 runtime: an add and a change reach the organization file with the
  const before = readFileSync(file, 'utf8');
  const entries = log().length;
  const code = (args) => { try { bus.broker.request(human, { verb: 'instances.set', args: { revision: changed.revision, ...args } }); } catch (e) { return e.code; } return null; };
-  // Row 194 (brief item 7, sage-1610 a): an add of a vikunja definition needs its bot.
-  assert.equal(code({ instance: 'reviewer-2', op: 'add', definition: 'reviewer' }), 'organization-tracker-required');
+  assert.equal(code({ instance: 'reviewer-2', op: 'add', definition: 'reviewer' }), 'organization-credentials-out-of-scope');
  assert.equal(code({ instance: 'sec-1', op: 'change', definition: 'coder' }), 'organization-credentials-out-of-scope');
  assert.equal(code({ instance: 'sec-1', op: 'add', definition: 'merge-gate' }), 'organization-instance-exists');
  assert.equal(code({ instance: 'ghost', op: 'change', vars: {} }), 'organization-unknown-instance');
@@ -97,42 +94,3 @@ test('row 165 runtime: an add and a change reach the organization file with the
  assert.equal(readFileSync(file, 'utf8'), before);
  assert.equal(log().length, entries, 'a refused write logs nothing');
 });
-
-// Row 194 (#1692, D4, D4.1): the human lifecycle verbs so far, veto.set and instances.set's three ops.
-test('row 194 T12: agent and reader sessions refuse veto.set; the tester gets add and change but not delete or veto.set; the human passes the hook for each listed verb', (t) => {
-  const root = mkdtempSync(join(tmpdir(), 'instances-verb-'));
-  const store = new Store(root);
-  t.after(() => { store.close(); rmSync(root, { recursive: true, force: true }); });
-  const calls = [];
-  const b = new Broker({ store, businesses: biz(), organization: (id, verb, args, actor) => (calls.push([verb, args.op, actor]), verb === 'instances.check' ? { revision: ADD.revision } : { ok: true }) });
-  const human = b.bindHuman({ business: 'demo', human: 'jason', via: 'cli', outsideAgent: true });
-  const tester = b.bindTester({ business: 'demo' });
-  const caps = { reader: b.bindReader({ business: 'demo' }) };
-  for (const role of ['chief', 'pm']) caps[role] = b.bindLaunch({ business: 'demo', role, run: `${role}-run`, harness: 'pi' });
-  const VETO = { revision: ADD.revision, op: 'keep', name: 'pm' };
-  for (const [who, cap] of Object.entries(caps)) {
-    assert.throws(() => b.request(cap, { verb: 'veto.set', args: VETO }), /human-required/, who);
-    assert.throws(() => b.request(cap, { verb: 'instances.set', args: { ...ADD, op: 'delete' } }), /human-required/, who);
-  }
-  assert.throws(() => b.request(tester, { verb: 'veto.set', args: VETO }), /tester-refused/);
-  assert.throws(() => b.request(tester, { verb: 'instances.set', args: { revision: ADD.revision, instance: 'pm', op: 'delete' } }), /tester-refused/);
-  assert.equal(TESTER_ORGANIZATION_VERBS.includes('veto.set'), false);
-  assert.equal(calls.length, 0);
-  // veto.set takes exactly its three keys, and instances.set only its three ops.
-  for (const args of [{ ...VETO, actor: 'forged' }, { revision: VETO.revision, op: 'keep' }, { ...VETO, holder: 'mos' }])
-    assert.throws(() => b.request(human, { verb: 'veto.set', args }), /invalid-request/);
-  assert.throws(() => b.request(human, { verb: 'instances.set', args: { ...ADD, op: 'remove' } }), /invalid-request/);
-  assert.equal(calls.length, 0);
-  // The hook refuses a verb missing from LIFECYCLE_HUMAN_VERBS, so each call below passing shows the
-  // hook got that exact entry.
-  assert.deepEqual([...LIFECYCLE_HUMAN_VERBS].sort(), ['instance.end', 'instance.launch', 'instance.regenerate', 'instances.set add', 'instances.set change', 'instances.set delete', 'veto.set']);
-  b.request(human, { verb: 'veto.set', args: VETO });
-  b.request(human, { verb: 'instances.set', args: ADD });
-  b.request(human, { verb: 'instances.set', args: { revision: ADD.revision, instance: 'pm', op: 'change', vars: {} } });
-  // S2c: the delete is a request after the writer's check, and writes nothing yet.
-  assert.ok(b.request(human, { verb: 'instances.set', args: { revision: ADD.revision, instance: 'pm', op: 'delete' } }).request);
-  b.request(tester, { verb: 'instances.set', args: ADD });
-  b.request(tester, { verb: 'instances.set', args: { revision: ADD.revision, instance: 'pm', op: 'change', vars: {} } });
-  assert.deepEqual(calls, [['veto.set', 'keep', 'jason'], ['instances.set', 'add', 'jason'], ['instances.set', 'change', 'jason'],
-    ['instances.check', undefined, 'jason'], ['instances.set', 'add', 'tester'], ['instances.set', 'change', 'tester']]);
-});
@@ -306,6 +306,28 @@ test('a ticket outlives the run that asked, and recordLand checks the task again
  assert.throws(() => w.b.landRefused(ticket, { code: 'gate-failed' }), /land-unknown/);
 });

+// Row 241 (#1747): one decision lands once. Two tickets on one decision can't both reach
+// recordLand through the git socket (land-busy, git-socket.mjs), so this pins the broker's own
+// guard: recordLand runs #landFacts again, and a decision spent by the first refuses the second.
+test('two tickets on one decision: the first recordLand lands, the second refuses decision-consumed and records nothing', (t) => {
+  const w = setup(t);
+  const { d } = w.ready();
+  const first = w.check({ task_ref: TASK, decision: d.id }).ticket;
+  const second = w.check({ task_ref: TASK, decision: d.id }).ticket;
+  assert.notEqual(first, second);
+  assert.deepEqual(w.b.recordLand(first, w.land), { task_ref: TASK, commit: B });
+  assert.throws(() => w.b.recordLand(second, { ...w.land, commit: C, previous: B }), /decision-consumed/);
+  assert.equal(w.merges().length, 1);
+  assert.equal(w.merges()[0].body.commit, B);
+  assert.equal(w.results().length, 1);
+  assert.deepEqual(w.events('action.refused'), []);
+  // The git socket then ends the second ticket with the broker's code, as it does any record refusal.
+  assert.equal(w.b.landRefused(second, { code: 'decision-consumed', notify: true }), 'decision-consumed');
+  assert.deepEqual(w.events('action.refused').map((e) => e.body), [{ code: 'decision-consumed' }]);
+  assert.equal(w.merges().length, 1);
+  assert.throws(() => w.b.recordLand(second, w.land), /land-unknown/);
+});
+
 test('landRefused files the code on the task, tells the role only with notify, and ends the ticket', (t) => {
  const w = setup(t);
  const { d } = w.ready();
@@ -1,164 +0,0 @@
-// Row 194 (#1692, brief item 8, row 199 D13, T20): fire and delete revoke the agent's credentials
-// after the writer's checks and before the write. Fire revokes each service and keeps the store
-// directory. Delete calls remove (sage-1593). A failed revoke stops the verb with
-// credential-revoke-failed and the business file's bytes unchanged. Fake tokens in a scratch root.
-import test from 'node:test';
-import assert from 'node:assert/strict';
-import { chmodSync, existsSync, mkdirSync, mkdtempSync, readdirSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
-import { tmpdir } from 'node:os';
-import { join } from 'node:path';
-import { busBusiness } from '../src/business.mjs';
-import { startBroker } from '../src/runtime.mjs';
-import { loadBusiness } from '../../business/src/business.mjs';
-import { resolveInstance } from '../../business/src/resolve.mjs';
-import { businessDoc, FAR_DATE, rolesCopy, systemFor, writeJson } from '../../business/tests/helpers.mjs';
-
-const TOKEN = 'fake_issued_token_0123456789';
-const store = (agent, service) => ({ store: true, [service === 'gitea' ? 'rotateBy' : 'expires']: FAR_DATE });
-
-// coder: gitea in the store, vikunja a file reference. rev-2 and rev-3: both in the store, with a
-// tracker bot. `drop` names instances whose credentials the boot copy leaves out, as a restart that
-// dropped the entry would: the running bus then has no entry for a file on disk (sage-1592).
-async function setup(t, { drop = [] } = {}) {
-  const root = mkdtempSync(join(tmpdir(), 'bus-lifecycle-revoke-'));
-  const rolesDir = rolesCopy(root);
-  const doc = { ...businessDoc(root, 'demo'), plugins: { harness: ['pi'] } };
-  doc.roles.coder.credentials.gitea = store('coder', 'gitea');
-  for (const [name, botId] of [['rev-2', 40], ['rev-3', 41]]) {
-    doc.roles[name] = { definition: 'reviewer', tracker: { bot: `bot-demo-${name}`, botId }, credentials: { gitea: store(name, 'gitea'), vikunja: store(name, 'vikunja') } };
-  }
-  doc.launch.instances.push('rev-2', 'rev-3');
-  const file = writeJson(join(root, 'businesses/demo.json'), doc);
-  mkdirSync(join(root, 'data'), { mode: 0o700 });
-  mkdirSync(join(root, 'secrets', 'agents'), { recursive: true, mode: 0o700 });
-  const b = loadBusiness('demo', { dir: root, rolesDir });
-  const resolved = {};
-  for (const i of Object.keys(b.roles)) resolved[i] = resolveInstance({ system: systemFor(root), business: b, instance: i });
-  const boot = busBusiness(b, resolved);
-  for (const name of drop) delete boot.roles[name].credentials;
-  const bus = await startBroker({ dataRoot: join(root, 'data'), businesses: { demo: boot }, organization: { dir: root, rolesDir, system: systemFor(root) } });
-  t.after(async () => {
-    await bus.close();
-    chmodSync(join(root, 'secrets', 'agents'), 0o700);
-    rmSync(root, { recursive: true, force: true });
-  });
-  const human = bus.broker.bindHuman({ business: 'demo', human: 'jason', via: 'cli', outsideAgent: true });
-  const chief = bus.broker.bindLaunch({ business: 'demo', role: 'chief', run: 'chief-run', harness: 'pi' });
-  bus.broker.request(chief, { verb: 'role.claim' });
-  const ask = (verb, args) => bus.broker.request(human, { verb, args });
-  const fire = (name) => bus.broker.request(chief, { verb: 'instance.fire', args: { name, reason: 'the work is done' } });
-  const agentDir = (agent) => join(root, 'secrets', 'agents', 'demo', agent);
-  const plant = (agent, service) => {
-    mkdirSync(agentDir(agent), { recursive: true, mode: 0o700 });
-    writeFileSync(join(agentDir(agent), service), TOKEN + '\n', { mode: 0o600 });
-  };
-  // A delete runs as the launcher's pass would: the verb's request, the take, then lifecycleDelete.
-  // A refused delete closes the request with its code, as the launcher does.
-  const remove = (instance) => {
-    const { request } = ask('instances.set', { revision: ask('instances').revision, instance, op: 'delete' });
-    assert.equal(bus.lifecycleTake({ business: 'demo', request }).go, true);
-    try {
-      return { request, ...bus.lifecycleDelete({ business: 'demo', request }) };
-    } catch (e) {
-      bus.lifecycleDone({ business: 'demo', request, refusal: e.code });
-      throw e;
-    }
-  };
-  const bytes = () => readFileSync(file, 'utf8');
-  const code = (fn) => { try { fn(); } catch (e) { return e.code; } return null; };
-  const status = (agent) => Object.fromEntries(bus.credentialStatus('demo', agent).map((e) => [e.service, e.state]));
-  return { root, bus, ask, fire, remove, agentDir, plant, bytes, code, status, file };
-}
-
-test('T20 fire: a revoke that fails stops the fire with the file unchanged; one that succeeds revokes, keeps the directory and names the services outside the store', async (t) => {
-  const f = await setup(t);
-  f.ask('credentials.issue', { agent: 'coder', service: 'gitea', token: TOKEN, date: '2099-01-01' });
-  assert.ok(existsSync(join(f.agentDir('coder'), 'gitea')));
-  // The revoke can't unlink the token, so it fails before the write: the file still lists coder.
-  const before = f.bytes();
-  chmodSync(f.agentDir('coder'), 0o500);
-  assert.equal(f.code(() => f.fire('coder')), 'credential-revoke-failed');
-  chmodSync(f.agentDir('coder'), 0o700);
-  assert.equal(f.bytes(), before);
-  assert.ok(JSON.parse(before).launch.instances.includes('coder'));
-
-  const fired = f.fire('coder');
-  assert.equal(fired.delisted, true);
-  assert.deepEqual(fired.credentials, { revoked: ['gitea', 'vikunja'], outsideStore: ['vikunja'] });
-  assert.ok(!JSON.parse(f.bytes()).launch.instances.includes('coder'));
-  assert.deepEqual(f.status('coder'), { gitea: 'revoked', vikunja: 'revoked' });
-  // The directory stays, empty, so the status reads revoked and the human removes the remote token.
-  assert.deepEqual(readdirSync(f.agentDir('coder')), []);
-});
-
-test('T20 fire: with no entry in the running bus, a token on disk refuses and an empty store goes on', async (t) => {
-  const f = await setup(t, { drop: ['rev-2'] });
-  f.plant('rev-2', 'gitea');
-  const before = f.bytes();
-  assert.equal(f.code(() => f.fire('rev-2')), 'credential-revoke-failed');
-  assert.equal(f.bytes(), before);
-  rmSync(join(f.agentDir('rev-2'), 'gitea'));
-  const fired = f.fire('rev-2');
-  assert.equal(fired.delisted, true);
-  assert.deepEqual(fired.credentials, { revoked: ['gitea', 'vikunja'], outsideStore: [] });
-});
-
-test('T20 delete: a revoke that fails keeps the file; one that succeeds clears the store, deletes, and names the tracker bot', async (t) => {
-  const f = await setup(t);
-  f.ask('credentials.issue', { agent: 'rev-2', service: 'vikunja', token: TOKEN, date: '2099-01-01' });
-  // remove refuses a name it doesn't own (credential-file), so the delete stops with the file unchanged.
-  writeFileSync(join(f.agentDir('rev-2'), 'notes'), 'x');
-  const before = f.bytes();
-  assert.equal(f.code(() => f.remove('rev-2')), 'credential-revoke-failed');
-  assert.equal(f.bytes(), before);
-  // remove revokes the services it knows before it reads the directory (row 199), so the token is
-  // already gone: a failed delete leaves the agent listed with nothing it can use.
-  assert.equal(existsSync(join(f.agentDir('rev-2'), 'vikunja')), false);
-  assert.deepEqual(f.status('rev-2'), { gitea: 'revoked', vikunja: 'revoked' });
-  rmSync(join(f.agentDir('rev-2'), 'notes'));
-
-  const out = f.remove('rev-2');
-  assert.equal(out.bot, 'bot-demo-rev-2');
-  assert.equal(existsSync(f.agentDir('rev-2')), false);
-  assert.deepEqual(f.status('rev-2'), { gitea: 'revoked', vikunja: 'revoked' });
-  const after = JSON.parse(f.bytes());
-  assert.equal(Object.hasOwn(after.roles, 'rev-2'), false);
-  assert.ok(after.retired.includes('rev-2'));
-  // The launcher's close carries the bot, so the CLI and the Console name it.
-  const done = f.bus.lifecycleDone({ business: 'demo', request: out.request, transaction: out.transaction, bot: out.bot });
-  assert.equal(done.done.bot, 'bot-demo-rev-2');
-});
-
-test('T20 delete: with no entry in the running bus, a token file is cleared and the delete goes on; a file reference refuses', async (t) => {
-  const f = await setup(t, { drop: ['rev-3'] });
-  f.plant('rev-3', 'gitea');
-  const out = f.remove('rev-3');
-  assert.equal(out.bot, 'bot-demo-rev-3');
-  assert.equal(existsSync(f.agentDir('rev-3')), false);
-  assert.equal(Object.hasOwn(JSON.parse(f.bytes()).roles, 'rev-3'), false);
-  // coder's vikunja is a file reference: deleting it stays a hand edit, refused at the request.
-  const before = f.bytes();
-  assert.equal(f.code(() => f.remove('coder')), 'organization-credentials-out-of-scope');
-  assert.equal(f.bytes(), before);
-  assert.deepEqual(f.status('coder'), { gitea: 'not-issued', vikunja: 'valid' });
-});
-
-test('T21 delete: a write between the raise and the take makes the delete refuse revision-conflict before it revokes anything', async (t) => {
-  const f = await setup(t);
-  f.ask('credentials.issue', { agent: 'rev-2', service: 'vikunja', token: TOKEN, date: '2099-01-01' });
-  const { request } = f.ask('instances.set', { revision: f.ask('instances').revision, instance: 'rev-2', op: 'delete' });
-  assert.equal(f.bus.lifecycleTake({ business: 'demo', request }).go, true);
-  // A write after the raise: the request's revision is now stale.
-  const raised = f.bytes();
-  f.ask('credentials.issue', { agent: 'rev-3', service: 'gitea', token: 'fake_other_token_9876543210', date: '2099-02-01' });
-  assert.ok(f.bytes() !== raised, 'the issue wrote the business file');
-  const before = f.bytes();
-  const entry = structuredClone(JSON.parse(before).roles['rev-2'].credentials);
-  assert.equal(f.code(() => f.bus.lifecycleDelete({ business: 'demo', request })), 'revision-conflict');
-  // Nothing revoked: the token stays issued, Credentials is unchanged and no store file is removed.
-  assert.equal(f.bytes(), before);
-  assert.deepEqual(JSON.parse(f.bytes()).roles['rev-2'].credentials, entry);
-  assert.equal(readFileSync(join(f.agentDir('rev-2'), 'vikunja'), 'utf8'), TOKEN + '\n');
-  assert.deepEqual(readdirSync(f.agentDir('rev-2')), ['vikunja']);
-  assert.deepEqual(f.status('rev-2'), { gitea: 'not-issued', vikunja: 'valid' });
-});
@@ -1,373 +0,0 @@
-// Row 194 (#1692, D1.1, V2-V5, D4.1): the broker half of the lifecycle verbs. Launch, regenerate
-// and delete are requests the launcher's pass takes through the host ops. Terminate revokes and
-// cancels at the verb and names the runs the pass signals. The launcher half is in cli lifecycle.test.mjs.
-import test from 'node:test';
-import assert from 'node:assert/strict';
-import { mkdirSync, mkdtempSync, readFileSync, rmSync } from 'node:fs';
-import { tmpdir } from 'node:os';
-import { join } from 'node:path';
-import { fileURLToPath } from 'node:url';
-import { Store } from '../src/store.mjs';
-import { Broker, LIFECYCLE_REQUEST_MS, TESTER_VERBS } from '../src/broker.mjs';
-
-const shipped = (name) => JSON.parse(readFileSync(fileURLToPath(new URL(`../../../roles/${name}.json`, import.meta.url)), 'utf8'));
-const none = { authority: { withinRole: ['message.send'], crossRole: [] } };
-const R = 'a'.repeat(64);
-const doc = (extra = {}) => ({
-  id: 'demo', human: 'jason', arbiters: { technical: 'pm', delivery: 'chief' },
-  vars: { 'bus.tester': true },
-  definitions: { 'chief-of-staff': {}, assistant: { messaging: shipped('assistant').messaging } },
-  roles: {
-    chief: { definition: 'chief-of-staff', authority: shipped('chief-of-staff').authority },
-    pm: { definition: 'pm', ...none },
-    coder: { definition: 'coder', ...none },
-    assistant: { definition: 'assistant', ...none },
-  },
-  retired: ['old'],
-  ...extra,
-});
-const OTHER = { id: 'other', human: 'jason', arbiters: { technical: 'only-there', delivery: 'only-there' }, roles: { 'only-there': none } };
-
-function setup(t, { organization = null, testerOn = undefined } = {}) {
-  const root = mkdtempSync(join(tmpdir(), 'lifecycle-verbs-'));
-  const store = new Store(root);
-  t.after(() => { store.close(); rmSync(root, { recursive: true, force: true }); });
-  const tester = { on: true };
-  const b = new Broker({ store, businesses: { demo: doc(), other: OTHER }, organization,
-    testerOn: testerOn === undefined ? () => tester.on : testerOn });
-  const caps = {
-    human: b.bindHuman({ business: 'demo', human: 'jason', via: 'cli', outsideAgent: true }),
-    tester: b.bindTester({ business: 'demo' }),
-    reader: b.bindReader({ business: 'demo' }),
-  };
-  const call = (who, verb, args = {}) => b.request(caps[who], { verb, args });
-  const code = (fn) => { try { fn(); } catch (e) { return e.code; } return null; };
-  const ask = (who, verb, args = {}) => code(() => call(who, verb, args));
-  let runs = 0;
-  const bind = (role, { claim = true, thread, name = `${role}-${++runs}` } = {}) => {
-    caps[name] = b.bindLaunch({ business: 'demo', role, run: name, harness: 'pi', ...(thread ? { thread } : {}) });
-    if (claim) call(name, 'role.claim');
-    return name;
-  };
-  const lifecycle = () => store.get("SELECT count(*) n FROM events WHERE kind='action.allowed' AND json_extract(body,'$.action') LIKE 'lifecycle.%'").n;
-  const inputs = () => store.get("SELECT count(*) n FROM events WHERE kind='human.input'").n;
-  const take = (request) => b.lifecycleTake({ business: 'demo', request });
-  const done = (request, extra = {}) => b.lifecycleDone({ business: 'demo', request, ...extra });
-  const state = (request) => call('human', 'instance.request', { request });
-  return { b, store, caps, call, code, ask, bind, lifecycle, inputs, take, done, state, tester };
-}
-// Moves the clock past a request's 60 s, for the rest of the test.
-const later = (t) => { const now = Date.now(); t.mock.method(Date, 'now', () => now + LIFECYCLE_REQUEST_MS + 1000); };
-
-test('row 194 T12: agent and reader sessions refuse the lifecycle verbs before any effect; the tester gets launch, end and the request read, never regenerate', (t) => {
-  const f = setup(t);
-  f.bind('chief');
-  f.bind('pm');
-  const verbs = [['instance.launch', { instance: 'coder' }], ['instance.regenerate', { instance: 'coder' }],
-    ['instance.end', { instance: 'coder' }], ['instance.request', { request: 'r1' }]];
-  for (const [verb, args] of verbs) {
-    assert.equal(f.ask('reader', verb, args), 'read-only', `reader ${verb}`);
-    for (const who of ['chief-1', 'pm-2']) assert.equal(f.ask(who, verb, args), 'human-required', `${who} ${verb}`);
-  }
-  assert.equal(f.ask('tester', 'instance.regenerate', { instance: 'coder' }), 'tester-refused');
-  assert.equal(f.lifecycle(), 0);
-  for (const verb of ['instance.launch', 'instance.end', 'instance.request']) assert.ok(TESTER_VERBS.includes(verb), verb);
-  assert.equal(TESTER_VERBS.includes('instance.regenerate'), false);
-  // Each human verb passes the D4 hook with its LIFECYCLE_HUMAN_VERBS entry.
-  const { request } = f.call('human', 'instance.launch', { instance: 'coder' });
-  f.call('human', 'instance.regenerate', { instance: 'pm' });
-  assert.deepEqual(f.call('human', 'instance.end', { instance: 'coder' }).cancelled, [request]);
-});
-
-test('row 194 V2 and V4 at the verb: the request is open, by the human, with a human.input; thread, retired, unknown and revoked refuse with no event', (t) => {
-  const f = setup(t);
-  const before = f.inputs();
-  const { request } = f.call('human', 'instance.launch', { instance: 'coder' });
-  const r = f.state(request);
-  assert.deepEqual([r.action, r.instance, r.by, r.state, r.done, r.cancelled], ['lifecycle.launch', 'coder', 'jason', 'open', null, null]);
-  assert.equal(f.inputs(), before + 1);
-  const raw = JSON.parse(f.store.get("SELECT body FROM events WHERE json_extract(body,'$.request')=? AND json_extract(body,'$.action')='lifecycle.launch'", request).body);
-  assert.deepEqual(raw, { action: 'lifecycle.launch', request, via: 'cli', by: 'jason' });
-  const count = f.lifecycle();
-  assert.equal(f.ask('human', 'instance.launch', { instance: 'assistant' }), 'not-thread-launch');
-  assert.equal(f.ask('human', 'instance.regenerate', { instance: 'assistant' }), 'regenerate-thread');
-  assert.equal(f.ask('human', 'instance.launch', { instance: 'old' }), 'instance-retired');
-  assert.equal(f.ask('human', 'instance.regenerate', { instance: 'old' }), 'instance-retired');
-  assert.equal(f.ask('human', 'instance.launch', { instance: 'ghost' }), 'unknown-role');
-  assert.equal(f.ask('human', 'instance.launch', { instance: 'coder', extra: 1 }), 'invalid-request');
-  assert.equal(f.ask('human', 'instance.launch', { instance: '../x' }), 'invalid-request');
-  f.call('human', 'launch.revoke');
-  assert.equal(f.ask('human', 'instance.launch', { instance: 'coder' }), 'launch-revoked');
-  assert.equal(f.ask('human', 'instance.regenerate', { instance: 'coder' }), 'launch-revoked');
-  assert.equal(f.lifecycle(), count);
-  assert.equal(f.ask('human', 'instance.request', { request: 'no-such' }), 'unknown-request');
-});
-
-test('row 194 D1.1 take: a request is taken once, closes once, and lifecycleRequests lists only what is not closed', (t) => {
-  const f = setup(t);
-  const { request } = f.call('human', 'instance.launch', { instance: 'coder' });
-  const second = f.call('human', 'instance.regenerate', { instance: 'pm' }).request;
-  assert.deepEqual(f.b.lifecycleRequests('demo').map((r) => [r.request, r.state]), [[request, 'open'], [second, 'open']]);
-  assert.equal(f.code(() => f.done(request, { run: 'run-x' })), 'request-not-taken');
-  const go = f.take(request);
-  assert.deepEqual([go.go, go.refusal, go.state, go.action, go.instance, go.by], [true, null, 'taken', 'lifecycle.launch', 'coder', 'jason']);
-  const again = f.take(request);
-  assert.deepEqual([again.go, again.refusal, again.state], [false, 'request-closed', 'taken']);
-  assert.equal(f.store.get("SELECT count(*) n FROM events WHERE json_extract(body,'$.action')='lifecycle.taken'").n, 1);
-  assert.equal(f.code(() => f.done(request, { refusal: 'Not A Code' })), 'invalid-request');
-  assert.equal(f.code(() => f.done(request, { run: '../x' })), 'invalid-request');
-  assert.equal(f.code(() => f.done(request, { extra: 1 })), 'invalid-request');
-  const closed = f.done(request, { run: 'run-x' });
-  assert.deepEqual([closed.state, closed.done], ['closed', { run: 'run-x', transaction: null, refusal: null }]);
-  assert.equal(f.code(() => f.done(request, { run: 'run-x' })), 'request-closed');
-  assert.deepEqual(f.take(request).refusal, 'request-closed');
-  assert.deepEqual(f.b.lifecycleRequests('demo').map((r) => r.request), [second]);
-  assert.equal(f.code(() => f.take('no-such')), 'unknown-request');
-  assert.equal(f.code(() => f.b.lifecycleRequests('ghost')), 'unknown-business');
-  // A request from one business isn't another's.
-  assert.equal(f.code(() => f.b.lifecycleTake({ business: 'other', request: second })), 'unknown-request');
-});
-
-test('row 194 D1.1 take: a launch.revoke after the request closes it launch-revoked, and a request past 60 s closes request-expired', (t) => {
-  const f = setup(t);
-  const revoked = f.call('human', 'instance.launch', { instance: 'coder' }).request;
-  const regen = f.call('human', 'instance.regenerate', { instance: 'coder' }).request;
-  f.call('human', 'launch.revoke');
-  for (const request of [revoked, regen]) {
-    const r = f.take(request);
-    assert.deepEqual([r.go, r.refusal, r.state, r.done.refusal], [false, 'launch-revoked', 'closed', 'launch-revoked']);
-  }
-  assert.equal(f.store.get("SELECT count(*) n FROM events WHERE json_extract(body,'$.action')='lifecycle.taken'").n, 0);
-  f.call('human', 'launch.restore');
-  const old = f.call('human', 'instance.launch', { instance: 'coder' }).request;
-  later(t);
-  const r = f.take(old);
-  assert.deepEqual([r.go, r.refusal, r.state], [false, 'request-expired', 'closed']);
-  assert.deepEqual(f.b.lifecycleRequests('demo'), []);
-});
-
-test('row 194 T12a: the tester launches and ends on its own business with actor tester; bus.tester off in the file refuses the call and the take tester-off', (t) => {
-  const f = setup(t);
-  const inputs = f.inputs();
-  const { request } = f.call('tester', 'instance.launch', { instance: 'coder' });
-  const r = f.call('tester', 'instance.request', { request });
-  assert.deepEqual([r.by, r.state], ['tester', 'open']);
-  assert.equal(JSON.parse(f.store.get("SELECT body FROM events WHERE json_extract(body,'$.request')=? AND json_extract(body,'$.action')='lifecycle.launch'", request).body).via, 'tester');
-  assert.equal(f.inputs(), inputs, 'a tester request is not human input');
-  const human = f.call('human', 'instance.launch', { instance: 'pm' }).request;
-  // A tester reads only its own requests.
-  assert.equal(f.ask('tester', 'instance.request', { request: human }), 'unknown-request');
-  // The cap is bound to demo: an instance only `other` declares is unknown here.
-  assert.equal(f.ask('tester', 'instance.launch', { instance: 'only-there' }), 'unknown-role');
-  // bus.tester switched off in the file, with no restart.
-  f.tester.on = false;
-  assert.equal(f.ask('tester', 'instance.launch', { instance: 'coder' }), 'tester-off');
-  assert.equal(f.ask('tester', 'instance.end', { instance: 'coder' }), 'tester-off');
-  const off = f.take(request);
-  assert.deepEqual([off.go, off.refusal], [false, 'tester-off']);
-  assert.equal(f.take(human).go, true, 'the human request is not the tester switch');
-  // Anything but exactly true is off.
-  f.tester.on = 'true';
-  assert.equal(f.ask('tester', 'instance.launch', { instance: 'coder' }), 'tester-off');
-  f.tester.on = true;
-  const later2 = f.call('tester', 'instance.launch', { instance: 'coder' }).request;
-  const ended = f.call('tester', 'instance.end', { instance: 'coder' });
-  assert.deepEqual(ended.cancelled, [later2]);
-  assert.equal(f.state(ended.request).by, 'tester');
-  assert.equal(f.state(later2).cancelled.by, 'tester');
-});
-
-test('row 194 V3 terminate: claims revoked, open requests cancelled, bound runs named, taken requests listed; nothing at all answers not-held', (t) => {
-  const f = setup(t);
-  const held = f.bind('coder');
-  const unclaimed = f.bind('coder', { claim: false });
-  const open = f.call('human', 'instance.launch', { instance: 'coder' }).request;
-  const taken = f.call('human', 'instance.regenerate', { instance: 'coder' }).request;
-  f.take(taken);
-  const other = f.call('human', 'instance.launch', { instance: 'pm' }).request;
-  const out = f.call('human', 'instance.end', { instance: 'coder', reason: 'stuck on a loop' });
-  assert.deepEqual([out.runs, out.cancelled, out.taken], [[held, unclaimed], [open], [taken]]);
-  const claim = f.store.get("SELECT * FROM role_claims WHERE role='coder' ORDER BY seq DESC LIMIT 1");
-  assert.deepEqual([claim.op, claim.holder_run, claim.by, claim.reason], ['revoke', held, 'jason', 'stuck on a loop']);
-  assert.deepEqual([f.state(open).state, f.state(open).cancelled], ['closed', { by: 'jason' }]);
-  assert.equal(f.state(taken).state, 'taken', 'a taken request is past cancelling');
-  assert.equal(f.state(other).state, 'open', 'another instance keeps its request');
-  // The end is a request the pass takes, with the runs to signal. It never expires.
-  const end = f.state(out.request);
-  assert.deepEqual([end.action, end.runs, end.state], ['lifecycle.end', [held, unclaimed], 'open']);
-  later(t);
-  assert.equal(f.take(out.request).go, true);
-  assert.equal(f.take(open).refusal, 'request-closed');
-  // The runs stay named while bound and not ended.
-  f.done(taken, { run: 'coder-new' });
-  for (const run of [held, unclaimed]) f.b.endLaunch({ business: 'demo', run, reason: 'signalled' });
-  assert.equal(f.ask('human', 'instance.end', { instance: 'coder' }), 'not-held');
-  assert.equal(f.ask('human', 'instance.end', { instance: 'old' }), 'unknown-role');
-  assert.equal(f.ask('human', 'instance.end', { instance: 'coder', reason: '' }), 'invalid-request');
-});
-
-test('row 194 V3 terminate of a thread instance: the human ends every thread, the tester only its own', (t) => {
-  const f = setup(t);
-  const hp = f.call('human', 'project.create', { name: 'human work' }).id;
-  const tp = f.call('tester', 'project.create', { name: 'test work' }).id;
-  const H = f.call('human', 'thread.create', { project: hp, name: 'mine' }).id;
-  const T = f.call('tester', 'thread.create', { project: tp, name: 'probe' }).id;
-  const h = f.bind('assistant', { thread: H });
-  const tr = f.bind('assistant', { thread: T });
-  const tester = f.call('tester', 'instance.end', { instance: 'assistant' });
-  assert.deepEqual(tester.runs, [tr]);
-  assert.equal(f.store.get('SELECT op FROM thread_claims WHERE thread=? ORDER BY seq DESC LIMIT 1', H).op, 'claim');
-  assert.equal(f.store.get('SELECT op FROM thread_claims WHERE thread=? ORDER BY seq DESC LIMIT 1', T).op, 'revoke');
-  const human = f.call('human', 'instance.end', { instance: 'assistant' });
-  assert.deepEqual(human.runs, [h, tr]);
-  assert.equal(f.store.get('SELECT op FROM thread_claims WHERE thread=? ORDER BY seq DESC LIMIT 1', H).op, 'revoke');
-});
-
-// The writer stand-in: instances.check answers per instance, instances.set commits a transaction.
-function writer(answers) {
-  const calls = [];
-  const organization = (id, verb, args, actor) => {
-    calls.push([verb, args, actor]);
-    if (verb === 'instances.check') {
-      const a = answers[args.instance] ?? { revision: R };
-      if (a instanceof Error) throw a;
-      return a;
-    }
-    if (verb === 'instances.set') return { transaction: `tx-${calls.length}`, restart: false };
-    return { ok: true };
-  };
-  return { calls, organization };
-}
-const refused = (code) => Object.assign(new Error(code), { code });
-const lastListed = () => Object.assign(new Error('coder is the last name in launch.instances'), { name: 'BusinessError' });
-
-test('row 194 T6 V5 order at the verb: the writer\'s named refusals, then instance-running, instance-starting, the last-listed refusal and the revision', (t) => {
-  const w = writer({ chief: refused('organization-instance-referenced'), pm: lastListed(), coder: lastListed() });
-  const f = setup(t, { organization: w.organization });
-  const del = (instance, revision = R) => f.ask('human', 'instances.set', { revision, instance, op: 'delete' });
-  // A named refusal comes before the broker's checks, even with a claim held.
-  f.bind('chief');
-  assert.equal(del('chief'), 'organization-instance-referenced');
-  // The last-listed refusal waits until running and starting have passed.
-  const run = f.bind('coder');
-  assert.equal(del('coder'), 'instance-running');
-  f.call('human', 'instance.end', { instance: 'coder' });
-  f.b.endLaunch({ business: 'demo', run, reason: 'signalled' });
-  const starting = f.call('human', 'instance.launch', { instance: 'coder' }).request;
-  assert.equal(del('coder'), 'instance-starting');
-  f.take(starting);
-  assert.equal(del('coder'), 'instance-starting', 'a taken request with no done is still starting');
-  f.done(starting, { refusal: 'launch-refused' });
-  assert.equal(del('coder'), 'invalid-request');
-  assert.equal(del('pm'), 'invalid-request');
-  assert.equal(del('assistant', 'b'.repeat(64)), 'revision-conflict');
-  assert.equal(del('assistant', 'not-a-revision'), 'invalid-request');
-  assert.equal(f.ask('human', 'instances.set', { revision: R, instance: 'assistant', op: 'delete', definition: 'x' }), 'invalid-request');
-  assert.ok(w.calls.every(([verb]) => verb === 'instances.check'), 'the checks write nothing');
-  assert.equal(f.store.get("SELECT count(*) n FROM events WHERE json_extract(body,'$.action')='lifecycle.delete'").n, 0);
-  const { request } = f.call('human', 'instances.set', { revision: R, instance: 'assistant', op: 'delete' });
-  const r = f.state(request);
-  assert.deepEqual([r.action, r.instance, r.by, r.revision, r.retry, r.state], ['lifecycle.delete', 'assistant', 'jason', R, false, 'open']);
-  assert.deepEqual(w.calls.at(-1), ['instances.check', { instance: 'assistant' }, 'jason']);
-  // An open delete is a starting request too: a second delete waits for the first.
-  assert.equal(del('assistant'), 'instance-starting');
-});
-
-test('row 194 V5: an open launch past its 60 s is not starting, as it can only close request-expired', (t) => {
-  const w = writer({});
-  const f = setup(t, { organization: w.organization });
-  f.call('human', 'instance.launch', { instance: 'coder' });
-  later(t);
-  assert.ok(f.call('human', 'instances.set', { revision: R, instance: 'coder', op: 'delete' }).request);
-});
-
-test('row 194 V5 after the take: lifecycleDelete re-checks running and starting, then commits through the writer with the human as actor', (t) => {
-  const w = writer({});
-  const f = setup(t, { organization: w.organization });
-  const { request } = f.call('human', 'instances.set', { revision: R, instance: 'coder', op: 'delete' });
-  const del = () => f.b.lifecycleDelete({ business: 'demo', request });
-  assert.equal(f.code(del), 'request-not-taken');
-  assert.equal(f.take(request).go, true);
-  // A launch recorded after the delete's verb and a claim taken since both stop it.
-  const launch = f.call('human', 'instance.launch', { instance: 'coder' }).request;
-  assert.equal(f.code(del), 'instance-starting');
-  f.call('human', 'instance.end', { instance: 'coder' });
-  const run = f.bind('coder');
-  assert.equal(f.code(del), 'instance-running');
-  f.call('human', 'instance.end', { instance: 'coder' });
-  f.b.endLaunch({ business: 'demo', run, reason: 'signalled' });
-  assert.equal(f.state(launch).cancelled.by, 'jason');
-  const out = del();
-  assert.deepEqual(w.calls.at(-1), ['instances.set', { revision: R, instance: 'coder', op: 'delete' }, 'jason']);
-  assert.deepEqual(out, { transaction: out.transaction, retry: false });
-  assert.match(out.transaction, /^tx-/);
-  assert.equal(f.done(request, { transaction: out.transaction }).done.transaction, out.transaction);
-  const launchReq = f.call('human', 'instance.launch', { instance: 'pm' }).request;
-  assert.equal(f.code(() => f.b.lifecycleDelete({ business: 'demo', request: launchReq })), 'request-not-taken');
-});
-
-test('row 194 V5 retry: a retired name deletes again only after workspace-rename-failed, and that request commits nothing', (t) => {
-  const w = writer({});
-  const f = setup(t, { organization: w.organization });
-  assert.equal(f.ask('human', 'instances.set', { revision: R, instance: 'old', op: 'delete' }), 'organization-instance-retired');
-  const { request } = f.call('human', 'instances.set', { revision: R, instance: 'pm', op: 'delete' });
-  f.take(request);
-  const { transaction } = f.b.lifecycleDelete({ business: 'demo', request });
-  f.done(request, { transaction, refusal: 'workspace-rename-failed' });
-  // The bus reloads after the commit, as the runtime does.
-  const next = doc({ retired: ['old', 'pm'], arbiters: { technical: 'coder', delivery: 'chief' } });
-  delete next.roles.pm;
-  f.b.reloadBusiness('demo', next);
-  const writes = w.calls.length;
-  const retry = f.call('human', 'instances.set', { revision: R, instance: 'pm', op: 'delete' }).request;
-  assert.deepEqual([f.state(retry).retry, f.state(retry).revision], [true, R]);
-  f.take(retry);
-  // S3: the retry answers the failed delete's transaction, which names the rename's target.
-  assert.ok(transaction);
-  assert.deepEqual(f.b.lifecycleDelete({ business: 'demo', request: retry }), { transaction, retry: true });
-  assert.equal(w.calls.length, writes, 'a retry neither checks nor writes the file');
-  f.done(retry);
-  assert.equal(f.ask('human', 'instances.set', { revision: R, instance: 'pm', op: 'delete' }), 'organization-instance-retired');
-});
-
-test('row 194 V5 runtime: a delete request, the take and lifecycleDelete commit the file with retired, log the human and reload so the name no longer binds', async (t) => {
-  const { startBroker } = await import('../src/runtime.mjs');
-  const { busBusiness } = await import('../src/business.mjs');
-  const { loadBusiness } = await import('../../business/src/business.mjs');
-  const { resolveInstance } = await import('../../business/src/resolve.mjs');
-  const { businessDoc, rolesCopy, systemFor, writeJson } = await import('../../business/tests/helpers.mjs');
-  const root = mkdtempSync(join(tmpdir(), 'lifecycle-runtime-'));
-  const rolesDir = rolesCopy(root);
-  const file = writeJson(join(root, 'businesses/demo.json'), { ...businessDoc(root, 'demo'), plugins: { harness: ['pi'] } });
-  mkdirSync(join(root, 'data'), { mode: 0o700 });
-  const b = loadBusiness('demo', { dir: root, rolesDir });
-  const resolved = {};
-  for (const i of Object.keys(b.roles)) resolved[i] = resolveInstance({ system: systemFor(root), business: b, instance: i });
-  const bus = await startBroker({ dataRoot: join(root, 'data'), businesses: { demo: busBusiness(b, resolved) }, organization: { dir: root, rolesDir, system: systemFor(root) } });
-  t.after(async () => { await bus.close(); rmSync(root, { recursive: true, force: true }); });
-  const human = bus.broker.bindHuman({ business: 'demo', human: 'jason', via: 'cli', outsideAgent: true });
-  const ask = (verb, args) => bus.broker.request(human, { verb, args });
-  const code = (fn) => { try { fn(); } catch (e) { return e.code; } return null; };
-  const revision = () => ask('instances').revision;
-  ask('instances.set', { revision: revision(), instance: 'sec-1', op: 'add', definition: 'security-reviewer', launch: true });
-  const before = readFileSync(file, 'utf8');
-  // The real writer's refusals reach the verb, and none of them writes.
-  assert.equal(code(() => ask('instances.set', { revision: revision(), instance: 'coder', op: 'delete' })), 'organization-credentials-out-of-scope');
-  assert.equal(code(() => ask('instances.set', { revision: revision(), instance: 'pm', op: 'delete' })), 'organization-instance-referenced');
-  assert.equal(code(() => ask('instances.set', { revision: 'b'.repeat(64), instance: 'sec-1', op: 'delete' })), 'revision-conflict');
-  assert.equal(readFileSync(file, 'utf8'), before);
-  const { request } = ask('instances.set', { revision: revision(), instance: 'sec-1', op: 'delete' });
-  assert.equal(readFileSync(file, 'utf8'), before, 'the verb only records the request');
-  assert.deepEqual(bus.lifecycleRequests('demo').map((r) => [r.request, r.action, r.instance]), [[request, 'lifecycle.delete', 'sec-1']]);
-  assert.equal(bus.lifecycleTake({ business: 'demo', request }).go, true);
-  const { transaction } = bus.lifecycleDelete({ business: 'demo', request });
-  const after = JSON.parse(readFileSync(file, 'utf8'));
-  assert.equal(Object.hasOwn(after.roles, 'sec-1'), false);
-  assert.deepEqual(after.retired, ['sec-1']);
-  assert.equal(after.launch.instances.includes('sec-1'), false);
-  const log = readFileSync(join(root, 'businesses/.history/demo/changes.jsonl'), 'utf8').trim().split('\n').map(JSON.parse).at(-1);
-  assert.deepEqual([log.actor, log.state, log.transaction], ['jason', 'committed', transaction]);
-  assert.equal(bus.lifecycleDone({ business: 'demo', request, transaction }).state, 'closed');
-  assert.equal(code(() => bus.broker.bindLaunch({ business: 'demo', role: 'sec-1', run: 'run-1', harness: 'pi' })), 'unknown-role');
-  assert.equal(code(() => ask('instance.launch', { instance: 'sec-1' })), 'instance-retired');
-});
@@ -55,7 +55,7 @@ test('3f copy migrates to 3g preserving every old column/row, with an empty inst
  assert.throws(() => new Store(root), /schema-mismatch/);
  const store = new Store(root, { migrateSchema: true });
  try {
-    assert.equal(store.get("SELECT value FROM meta WHERE key='schema_version'").value, '3i');
+    assert.equal(store.get("SELECT value FROM meta WHERE key='schema_version'").value, '3j');
    assert.deepEqual({ ...store.get('SELECT to_name FROM messages') }, { to_name: null });
    assert.equal(store.get('SELECT count(*) AS n FROM instance_names').n, 0);
    assert.deepEqual({ ...store.get('SELECT spec_path,spec_commit FROM decisions') }, { spec_path: 'docs/spec.md', spec_commit: 'c'.repeat(40) });
@@ -12,7 +12,8 @@ import { fixture } from './spec-fixtures.mjs';
 test('Broker keeps the sandbox client import closure: only the listed imports, no lazy project import', () => {
  const source = readFileSync(new URL('../src/broker.mjs', import.meta.url), 'utf8');
  assert.deepEqual([...source.matchAll(/^import .*;$/gm)].map(m => m[0]), [
-    "import { randomUUID, randomBytes } from 'node:crypto';",
+    // Row 210 (#1707): createHash gives host.run events the argv, stdin and output sha256 values.
+    "import { randomUUID, randomBytes, createHash } from 'node:crypto';",
    // Row 65 (#1558): bindLaunch checks a run's transcript path is absolute.
    "import { isAbsolute } from 'node:path';",
    // Row 65: the plug-in name pattern a harness takes. kinds.mjs is in RUNNER_FILES and imports nothing.
@@ -22,9 +23,11 @@ test('Broker keeps the sandbox client import closure: only the listed imports, n
    "import { MERGE, LandingRefusal, readLanding } from './landing.mjs';",
    // Row 141 (#1635): the business ID_PATTERN for instance names. The vocabulary is already in
    // RUNNER_FILES and imports nothing. Row 155 (#1649) reads THREAD_DEFINITION and END_PROTECTED
-    // from it too. Row 199 (#1697) reads the D9c fork parse, forkProblem and forkUrl, from it. Row 194
-    // (#1692, D2.4) reads unhireableAction, the hire veto's action name.
-    "import { ID_PATTERN, THREAD_DEFINITION, END_PROTECTED, forkProblem, forkUrl, unhireableAction } from '../../business/src/vocabulary.mjs';",
+    // from it too. Row 199 (#1697) reads the D9c fork parse, forkProblem and forkUrl, from it.
+    // Row 210 (#1707) reads credentialKind and the D6 argv check, validArgv and commandAllowed, from it.
+    // Row 234 (#1740) reads HOST_ID for the hosts verbs.
+    // Row 213 (#1714) reads CREATIVE_DEFINITIONS for the creative raise refusal (M6).
+    "import { ID_PATTERN, THREAD_DEFINITION, END_PROTECTED, forkProblem, forkUrl, credentialKind, validArgv, commandAllowed, HOST_ID, CREATIVE_DEFINITIONS } from '../../business/src/vocabulary.mjs';",
  ]);
  assert.doesNotMatch(source, /\bimport\s*\(/);
  assert.doesNotMatch(readFileSync(new URL('../src/landing.mjs', import.meta.url), 'utf8'), /\bimport\b/);
@@ -181,6 +181,32 @@ test('the request cannot name the fork, the user or the destination', (t) => {
    assert.throws(() => f.publish(d, 'coder', extra), /invalid-request/);
 });

+// Row 237 (#1743, duckworth-0068 N1): the decision is spent at recordPublish, after the push, so
+// checkPublish refuses a second ticket on a decision that already has one open.
+test('one decision, one open publish: a second ticket refuses publish-busy, whatever its branch', (t) => {
+  const f = setup(t);
+  f.push(A);
+  const d = f.approve();
+  const r = f.publish(d);
+  assert.throws(() => f.publish(d), /publish-busy/);
+  assert.throws(() => f.publish(d, 'coder', { branch: 'other' }), /publish-busy/);
+  // A refused publish frees the decision, which is still unspent; the retry gets a ticket.
+  f.b.publishRefused(r.ticket, { code: 'fork-unavailable' });
+  const retry = f.publish(d, 'coder', { branch: 'other' });
+  assert.throws(() => f.publish(d), /publish-busy/);
+  f.b.recordPublish(retry.ticket, { ref: retry.dst, commit: A, previous: null });
+  assert.equal(f.events('action.allowed').filter((e) => e.body.action === 'git.push.remote' && e.body.operation !== 'decision.raise').length, 1);
+  assert.throws(() => f.publish(d), /decision-consumed/);
+  // Another agent's decision on the same task isn't held by this one's ticket.
+  const f2 = setup(t);
+  f2.push(A);
+  const mine = f2.approve();
+  f2.publish(mine);
+  f2.push(B, A, 'second');
+  const theirs = f2.approve('second');
+  assert.equal(typeof f2.publish(theirs, 'second').ticket, 'string');
+});
+
 test('publishRefused files the code on the task\'s trail and drops the ticket', (t) => {
  const f = setup(t);
  f.push(A);
@@ -1,168 +0,0 @@
-// Row 194 (#1692, D3, T14): after every write that commits, the broker takes the business as a
-// restart would load it, so a created instance binds with no restart. A definition change on a
-// running instance refuses, and a file whose credential references changed isn't reloaded.
-import test from 'node:test';
-import assert from 'node:assert/strict';
-import { mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
-import { tmpdir } from 'node:os';
-import { join } from 'node:path';
-import { Broker } from '../src/broker.mjs';
-import { busBusiness } from '../src/business.mjs';
-import { startBroker } from '../src/runtime.mjs';
-import { Store } from '../src/store.mjs';
-import { loadBusiness } from '../../business/src/business.mjs';
-import { resolveInstance } from '../../business/src/resolve.mjs';
-import { businessDoc, rolesCopy, systemFor, writeJson } from '../../business/tests/helpers.mjs';
-
-// The bus form of the business file, built as cli bootConfig builds it.
-function busForm(root, rolesDir, id = 'demo') {
-  const b = loadBusiness(id, { dir: root, rolesDir });
-  const resolved = {};
-  for (const instance of Object.keys(b.roles)) resolved[instance] = resolveInstance({ system: systemFor(root), business: b, instance });
-  return busBusiness(b, resolved);
-}
-
-async function setup(t) {
-  const root = mkdtempSync(join(tmpdir(), 'reload-'));
-  const rolesDir = rolesCopy(root);
-  const doc = businessDoc(root, 'demo');
-  doc.plugins = { harness: ['pi', 'claude-code'] };
-  const file = writeJson(join(root, 'businesses/demo.json'), doc);
-  mkdirSync(join(root, 'data'), { mode: 0o700 });
-  const bus = await startBroker({ dataRoot: join(root, 'data'), businesses: { demo: busForm(root, rolesDir) }, organization: { dir: root, rolesDir, system: systemFor(root) } });
-  t.after(async () => { await bus.close(); rmSync(root, { recursive: true, force: true }); });
-  const reloads = [];
-  const reloadBusiness = bus.broker.reloadBusiness.bind(bus.broker);
-  bus.broker.reloadBusiness = (id, next) => { reloads.push(structuredClone(next)); reloadBusiness(id, next); };
-  const human = bus.broker.bindHuman({ business: 'demo', human: 'jason', via: 'cli', outsideAgent: true });
-  const ask = (verb, args) => bus.broker.request(human, { verb, args });
-  const revision = () => ask('instances').revision;
-  return { root, rolesDir, file, bus, reloads, ask, revision };
-}
-const code = (fn) => { try { fn(); } catch (e) { return e.code; } return null; };
-let runs = 0;
-const bind = (bus, role) => bus.broker.bindLaunch({ business: 'demo', role, run: `run-${++runs}`, harness: 'pi' });
-
-test('T14 a create goes live with no restart: the new instance binds at once and the answer says restart false', async (t) => {
-  const f = await setup(t);
-  assert.equal(code(() => bind(f.bus, 'sec-1')), 'unknown-role');
-  const added = f.ask('instances.set', { revision: f.revision(), instance: 'sec-1', op: 'add', definition: 'security-reviewer', launch: true });
-  assert.equal(added.restart, false);
-  assert.equal(f.reloads.length, 1);
-  assert.equal(f.reloads[0].roles['sec-1'].definition, 'security-reviewer');
-  assert.ok(bind(f.bus, 'sec-1'));
-});
-
-test('T14 every committed verb reloads once, limits.set, routes.set, plugins.set and veto.set included, and a refused one does not', async (t) => {
-  const f = await setup(t);
-  f.ask('limits.set', { revision: f.revision(), limits: { tokens: { instances: { coder: { limit: 100 } } } } });
-  assert.equal(f.reloads.length, 1);
-  assert.equal(f.reloads[0].launch.limits.tokens.instances.coder.limit, 100);
-  f.ask('routes.set', { revision: f.revision(), routes: { coder: { harness: 'claude-code', model: 'claude-sonnet-5-5', thinking: 'low', fallback: null } } });
-  assert.equal(f.reloads.length, 2);
-  assert.equal(f.reloads[1].roles.coder.vars.harness, 'claude-code');
-  f.ask('plugins.set', { revision: f.revision(), plugins: { harness: ['claude-code', 'pi'] } });
-  assert.equal(f.reloads.length, 3);
-  assert.deepEqual(f.reloads[2].plugins.harness, ['claude-code', 'pi']);
-  f.ask('veto.set', { revision: f.revision(), op: 'keep', name: 'coder' });
-  assert.equal(f.reloads.length, 4);
-  assert.deepEqual(f.reloads[3].launch.keep, ['coder']);
-  assert.equal(code(() => f.ask('instances.set', { revision: f.revision(), instance: 'ghost', op: 'change', vars: {} })), 'organization-unknown-instance');
-  assert.equal(code(() => f.ask('veto.set', { revision: f.revision(), op: 'keep', name: 'coder' })), 'organization-no-change');
-  assert.equal(f.reloads.length, 4);
-});
-
-test('T14 a definition change on a running instance refuses instance-running; a vars change still goes live', async (t) => {
-  const f = await setup(t);
-  f.ask('instances.set', { revision: f.revision(), instance: 'sec-1', op: 'add', definition: 'security-reviewer', launch: true });
-  const cap = bind(f.bus, 'sec-1');
-  f.bus.broker.request(cap, { verb: 'role.claim' });
-  const before = readFileSync(f.file, 'utf8');
-  assert.equal(code(() => f.ask('instances.set', { revision: f.revision(), instance: 'sec-1', op: 'change', definition: 'merge-gate' })), 'instance-running');
-  assert.equal(readFileSync(f.file, 'utf8'), before);
-  const changed = f.ask('instances.set', { revision: f.revision(), instance: 'sec-1', op: 'change', vars: { model: 'claude-sonnet-5-5' } });
-  assert.equal(changed.restart, false);
-  assert.equal(f.reloads.at(-1).roles['sec-1'].vars.model, 'claude-sonnet-5-5');
-});
-
-test('T14 a file whose credential references differ from the boot copy is not reloaded and the write answers restart true', async (t) => {
-  const f = await setup(t);
-  const doc = JSON.parse(readFileSync(f.file, 'utf8'));
-  const moved = join(f.root, 'secrets', 'moved-gitea.token');
-  writeFileSync(moved, 'placeholder-not-a-token', { mode: 0o600 });
-  doc.roles.coder.credentials.gitea.file = moved;
-  writeFileSync(f.file, JSON.stringify(doc, null, 2) + '\n', { mode: 0o600 });
-  const added = f.ask('instances.set', { revision: f.revision(), instance: 'sec-1', op: 'add', definition: 'security-reviewer' });
-  assert.equal(added.restart, true);
-  assert.equal(f.reloads.length, 0);
-  assert.equal(code(() => bind(f.bus, 'sec-1')), 'unknown-role');
-});
-
-test('T14 a date-only change to a credential reference still reloads: row 199 issue rewrites the date outside the reload', async (t) => {
-  const f = await setup(t);
-  const doc = JSON.parse(readFileSync(f.file, 'utf8'));
-  doc.roles.coder.credentials.gitea.rotateBy = '2098-06-01';
-  doc.roles.coder.credentials.vikunja.expires = '2098-06-01';
-  writeFileSync(f.file, JSON.stringify(doc, null, 2) + '\n', { mode: 0o600 });
-  const changed = f.ask('instances.set', { revision: f.revision(), instance: 'coder', op: 'change', vars: { harness: 'pi', model: 'claude-sonnet-5-5' } });
-  assert.equal(changed.restart, false);
-  assert.equal(f.reloads.length, 1);
-  assert.equal(f.reloads[0].roles.coder.vars.model, 'claude-sonnet-5-5');
-});
-
-// Row 194 (brief item 7, T19, sage-1605, sage-1610 a): a human create of a credentialed definition
-// answers restart true, because credential references are fixed at start. issue refuses until a
-// restart loads the entry. After one, issue works, the status reads valid, and a vars change after
-// the issue goes live: issue rewrites the date, and the fixed-at-start compare ignores dates.
-test('T19 a credentialed create answers restart true; issue works only after a restart, and a later vars change goes live', async (t) => {
-  const f = await setup(t);
-  mkdirSync(join(f.root, 'secrets', 'agents'), { recursive: true, mode: 0o700 });
-  const added = f.ask('instances.set', { revision: f.revision(), instance: 'rev-2', op: 'add', definition: 'reviewer', tracker: { bot: 'bot-demo-rev-2', botId: 40 } });
-  assert.equal(added.restart, true);
-  assert.equal(f.reloads.length, 0);
-  const issue = { agent: 'rev-2', service: 'gitea', token: 'fake_issued_token_0123456789', date: '2099-01-01' };
-  assert.equal(code(() => f.ask('credentials.issue', issue)), 'credential-unknown');
-
-  mkdirSync(join(f.root, 'data-2'), { mode: 0o700 });
-  const bus = await startBroker({ dataRoot: join(f.root, 'data-2'), businesses: { demo: busForm(f.root, f.rolesDir) }, organization: { dir: f.root, rolesDir: f.rolesDir, system: systemFor(f.root) } });
-  t.after(() => bus.close());
-  const reloads = [];
-  const reloadBusiness = bus.broker.reloadBusiness.bind(bus.broker);
-  bus.broker.reloadBusiness = (id, next) => { reloads.push(structuredClone(next)); reloadBusiness(id, next); };
-  const human = bus.broker.bindHuman({ business: 'demo', human: 'jason', via: 'cli', outsideAgent: true });
-  const ask = (verb, args) => bus.broker.request(human, { verb, args });
-  ask('credentials.issue', issue);
-  assert.equal(bus.credentialStatus('demo', 'rev-2').find(e => e.service === 'gitea').state, 'valid');
-  assert.equal(JSON.parse(readFileSync(f.file, 'utf8')).roles['rev-2'].credentials.gitea.rotateBy, '2099-01-01');
-  const changed = ask('instances.set', { revision: ask('instances').revision, instance: 'rev-2', op: 'change', vars: { harness: 'pi', model: 'claude-sonnet-5-5' } });
-  assert.equal(changed.restart, false);
-  assert.equal(reloads.length, 1);
-  assert.equal(reloads[0].roles['rev-2'].vars.model, 'claude-sonnet-5-5');
-});
-
-test('T14 a file whose project root differs from the boot copy is not reloaded, because the Credentials store protects the boot roots', async (t) => {
-  const f = await setup(t);
-  const doc = JSON.parse(readFileSync(f.file, 'utf8'));
-  const moved = join(f.root, 'project-moved');
-  mkdirSync(moved);
-  doc.projects.stack.root = moved;
-  writeFileSync(f.file, JSON.stringify(doc, null, 2) + '\n', { mode: 0o600 });
-  const added = f.ask('instances.set', { revision: f.revision(), instance: 'sec-1', op: 'add', definition: 'security-reviewer' });
-  assert.equal(added.restart, true);
-  assert.equal(f.reloads.length, 0);
-});
-
-test('T14 reloadBusiness refuses an unknown business, a changed human and a document the boot check refuses', (t) => {
-  const root = mkdtempSync(join(tmpdir(), 'reload-unit-'));
-  t.after(() => rmSync(root, { recursive: true, force: true }));
-  const role = { authority: { withinRole: [], crossRole: [] } };
-  const demo = { id: 'demo', human: 'jason', arbiters: { technical: 'coder', delivery: 'coder' }, roles: { coder: role } };
-  const b = new Broker({ store: new Store(root), businesses: { demo } });
-  assert.equal(code(() => b.reloadBusiness('other', demo)), 'unknown-business');
-  assert.equal(code(() => b.reloadBusiness('demo', { ...demo, human: 'mos' })), 'invalid-business');
-  assert.equal(code(() => b.reloadBusiness('demo', { ...demo, roles: { coder: role, tester: role } })), 'invalid-business');
-  assert.equal(code(() => b.reloadBusiness('demo', { ...demo, roles: { coder: { authority: { withinRole: ['spend'], crossRole: [] } } } })), 'invalid-authority');
-  assert.equal(code(() => b.reloadBusiness('demo', null)), 'invalid-business');
-  b.reloadBusiness('demo', { ...demo, roles: { coder: role, 'sec-1': role } });
-  assert.ok(b.bindLaunch({ business: 'demo', role: 'sec-1', run: 'run-1', harness: 'pi' }));
-});
@@ -45,7 +45,7 @@ test('requirements returns the committed list to a holding role session, and no
  const pm = agent('pm');
  const list = call(b, pm, 'requirements');
  assert.deepEqual(list, loadRequirements());
-  assert.equal(list.requirements.length, 58);
+  assert.equal(list.requirements.length, 68);
  assert.deepEqual(call(b, agent('coder'), 'requirements'), list);
  assert.throws(() => call(b, human, 'requirements'), /agent-required/);
  assert.throws(() => call(b, reader, 'requirements'), /read-only/);
@@ -519,7 +519,8 @@ test('v3b prototype refusals, views and append-only mutations', (t) => {
  // Row 121 (#1615) adds 5 tables and 24 triggers for projects and threads; threads.test.mjs tests them.
  // Row 141 (#1635) adds instance_names and its 4 triggers; names.test.mjs tests them.
  // Row 124 adds usage_records and its three append-only triggers.
-  assert.equal(count('table') - 1, 16);
-  assert.equal(count('trigger'), 70);
+  // Row 234 (#1740) adds hosts, host_grants and the events_grant_actor guard; grant-migration.test.mjs tests them.
+  assert.equal(count('table') - 1, 18);
+  assert.equal(count('trigger'), 71);
  assert.equal(count('view'), 5);
 });
@@ -53,7 +53,7 @@ test('3e copy migrates through 3f to 3g preserving every old column/row and addi
  assert.throws(() => new Store(root), /schema-mismatch/);
  const store = new Store(root, { migrateSchema: true });
  try {
-    assert.equal(store.get("SELECT value FROM meta WHERE key='schema_version'").value, '3i');
+    assert.equal(store.get("SELECT value FROM meta WHERE key='schema_version'").value, '3j');
    assert.deepEqual({ ...store.get('SELECT spec_path,spec_commit FROM decisions') }, { spec_path: null, spec_commit: null });
    assert.equal(store.get('PRAGMA quick_check').quick_check, 'ok');
    assert.deepEqual(store.all('PRAGMA foreign_key_check'), []);
@@ -21,8 +21,6 @@ test('row 175: TESTER_VERBS and the organization branch tester set are pinned',
    'usage', 'names', 'limits', 'plugins', 'instances', 'project.list', 'thread.list', 'name.set', 'project.create', 'credentials',
    // Row 177 (#1675): the tester's own threads.
    'thread.create', 'thread.open', 'thread.send', 'thread.messages', 'assistant.stop',
-    // Row 194 (#1692, D4.1): launch and terminate, and the read of its own requests.
-    'instance.launch', 'instance.end', 'instance.request',
  ]);
  assert.deepEqual([...TESTER_ORGANIZATION_VERBS], ['limits', 'plugins', 'instances', 'plugins.set', 'instances.set', 'routes.set', 'routes']);
  assert.ok(Object.isFrozen(TESTER_VERBS) && Object.isFrozen(TESTER_ORGANIZATION_VERBS));
@@ -95,8 +93,6 @@ test('row 175: W2 as the tester refuses credentials, protected definitions, huma
  const entries = r.log().length;
  const refused = [
    [{ instance: 'reviewer-2', op: 'add', definition: 'reviewer' }, 'organization-credentials-out-of-scope'],
-    // Row 194 (brief item 7): only the human's add binds credentials. A valid bot doesn't lift it.
-    [{ instance: 'reviewer-2', op: 'add', definition: 'reviewer', tracker: { bot: 'bot-reviewer-2', botId: 40 } }, 'organization-credentials-out-of-scope'],
    [{ instance: 'thread-2', op: 'add', definition: 'assistant' }, 'organization-definition-refused'],
    [{ instance: 'human', op: 'add', definition: 'merge-gate' }, 'invalid-request'],
    [{ instance: 'tester', op: 'add', definition: 'merge-gate' }, 'invalid-request'],
@@ -108,8 +104,8 @@ test('row 175: W2 as the tester refuses credentials, protected definitions, huma
    assert.equal(r.code(r.tester, 'instances.set', { revision, ...args }), want, JSON.stringify(args));
    assert.equal(r.bytes(), before, JSON.stringify(args));
    assert.equal(r.call(r.tester, 'instances').revision, revision);
-    assert.equal(r.log().length, entries, `a refused write logs nothing: ${JSON.stringify(args)}`);
  }
+  assert.equal(r.log().length, entries, 'a refused write logs nothing');
  // The control: the same add with an instance var lands, so the refusal above is the var.
  r.call(r.tester, 'instances.set', { revision, instance: 'gate-2', op: 'add', definition: 'merge-gate', vars: { model: 'claude-sonnet-5-5' } });
  assert.ok(r.log().length > entries);
@@ -49,7 +49,7 @@ async function database3d(t) {
  const source = readFileSync(here('../src/store.mjs'), 'utf8');
  const pinned = source
    .replace(/export const SCHEMA_SHA256 = '[a-f0-9]+';/, `export const SCHEMA_SHA256 = '${createHash('sha256').update(ddl3d).digest('hex')}';`)
-    .replace("export const SCHEMA_VERSION = '3i';", "export const SCHEMA_VERSION = '3d';")
+    .replace("export const SCHEMA_VERSION = '3j';", "export const SCHEMA_VERSION = '3d';")
    .replace(/\}, \{\n {2}from: '3d',[\s\S]*?\}\];\nconst timedTables/, '}];\nconst timedTables');
  assert.ok(!pinned.includes('3d-3e'), 'the 3d engine has no 3d→3e step');
  writeFileSync(join(moduleRoot, 'src/store.mjs'), pinned);
@@ -101,7 +101,7 @@ test('REQ-THREAD-1 REQ-ORG-2: the 3d→3e migration adds the thread tables and l
  assert.throws(() => new Store(root), /schema-mismatch/);
  const store = new Store(root, { migrateSchema: true });
  t.after(() => store.close());
-  assert.equal(store.get("SELECT value FROM meta WHERE key='schema_version'").value, '3i');
+  assert.equal(store.get("SELECT value FROM meta WHERE key='schema_version'").value, '3j');
  for (const table of ['projects', 'threads', 'thread_claims', 'message_threads', 'thread_opens'])
    assert.equal(store.get(`SELECT count(*) n FROM ${table}`).n, 0, table);
  // Parked: the undelivered ones are counted per business and role, and none is changed or given a thread.
@@ -161,5 +161,5 @@ test('REQ-THREAD-1: the offline command prints the kept-message counts before th
  const command = new URL('../src/migrate-schema.mjs', import.meta.url).pathname;
  const migrated = spawnSync(process.execPath, [command, root], { encoding: 'utf8' });
  assert.equal(migrated.status, 0, migrated.stderr);
-  assert.equal(migrated.stdout, [...REPORT, 'bus schema 3i ready', ''].join('\n'));
+  assert.equal(migrated.stdout, [...REPORT, 'bus schema 3j ready', ''].join('\n'));
 });
@@ -51,12 +51,12 @@ function snapshot(path, columns) {
    return { columns, rows };
  } finally { db.close(); }
 }
-test('REQ-LIMIT-4 3g copy migrates through 3h to 3i preserving every old column, row and sequence; new usage table is empty', t => {
+test('REQ-LIMIT-4 3g copy migrates through 3h and 3i to 3j preserving every old column, row and sequence; new usage table is empty', t => {
  const { root, path, copy } = source3g(t), before = snapshot(path), untouched = readFileSync(copy);
  assert.throws(() => new Store(root), /schema-mismatch/);
  const store = new Store(root, { migrateSchema: true });
  try {
-    assert.equal(store.get("SELECT value FROM meta WHERE key='schema_version'").value, '3i');
+    assert.equal(store.get("SELECT value FROM meta WHERE key='schema_version'").value, '3j');
    assert.deepEqual({ ...store.get('SELECT to_name FROM messages') }, { to_name: null });
    assert.equal(store.get('SELECT count(*) AS n FROM usage_records').n, 0);
    assert.equal(store.get('SELECT name FROM instance_names').name, 'Builder');
@@ -50,10 +50,11 @@ in this repository, or `$MOSAIC_ROLES_DIR` if set.
  `withinRole` actions run without asking. `crossRole` actions need the
  arbiter. Any action not listed is gated: it goes to Jason, or to the
  arbiter for its domain when the raise cites the project's current spec
-  commit (PRD 1.5 REQ-DEC-2). The eight hard waits in `GATED_ONLY`
+  commit (PRD 1.5 REQ-DEC-2). The nine hard waits in `GATED_ONLY`
  (REQ-WAIT-1: `spend`, `data.delete`, `network.expose`, `account.create`,
-  `credential.mint`, `message.external`, `git.push.protected`, `deploy`)
-  always go to Jason and can't appear in either list (REQ-WAIT-2).
+  `credential.mint`, `message.external`, `git.push.protected`,
+  `git.push.remote`, `deploy`) always go to Jason and can't appear in
+  either list (REQ-WAIT-2). `git.push.remote` joined in row 199 (#1697).
  `GATED_ONLY` is every action that `ROUTED` doesn't name, so an action
  added to the vocabulary is a hard wait until a PRD says otherwise and the
  commit adds it to `ROUTED` (REQ-WAIT-3). `git.merge.protected`,
@@ -156,10 +157,7 @@ file through the broker's `organization.set`, limited to the keys the human's
 call them (row 132). Under Jason's ruling Q169 (row 155, #1649) the chief of
 staff is the one agent that ends the assistant, which ends every assistant
 thread run, and it configures the assistant through `assistants` (Assistant
-settings, below) and names instances through `set_name`. PRD 1.7 REQ-COS-3
-(row 194) grants it `role.hire` and `role.fire` within role: it hires and
-fires with a reason and no decision, through the broker's `instance.hire` and
-`instance.fire`, which the harness's `hire` and `fire` tools call. It has no credentials and the same read-only tools. It is the only shipped role that holds `role.launch`, so
+settings, below) and names instances through `set_name`. It has no credentials and the same read-only tools. It is the only shipped role that holds `role.launch`, so
 it is the only role `launch.by` can name. The PM holds no `role.launch`
 (REQ-LAUNCH-1); it asks the chief of staff for a session.

@@ -9,9 +9,8 @@ import { checkModels, checkLimits, checkAccount } from "./launch.mjs";
 import { checkVars } from "./vars.mjs";
 import { parseCredentialRef } from "./credentials.mjs";
 import { loadRole } from "./role.mjs";
-import { END_PROTECTED } from "./vocabulary.mjs";
 import { checkPlugins } from "../../plugins/src/kinds.mjs";
-import { forkProblem, giteaName, parseGiteaUrl } from "./vocabulary.mjs";
+import { forkProblem, giteaName, parseGiteaUrl, HOST_SERVICE, CREATIVE_DEFINITIONS } from "./vocabulary.mjs";
 import {
  requireObject, rejectUnknownKeys, requireId, requirePositiveInt, requireString, requireDistinctList, readJsonFile, deepFreeze,
 } from "./util.mjs";
@@ -20,7 +19,7 @@ const BOT_NAME = /^bot-[a-z0-9][a-z0-9._-]{0,60}$/;
 // How long a thread's session stays up with no turn before the launcher stops
 // it, when launch.threadIdleSeconds is absent (REQ-THREAD-2, row 121).
 export const THREAD_IDLE_SECONDS = 900;
-const TOP_KEYS = ["businessVersion", "id", "human", "arbiters", "projects", "vars", "tracker", "roles", "launch", "plugins", "retired"];
+const TOP_KEYS = ["businessVersion", "id", "human", "arbiters", "projects", "vars", "tracker", "roles", "launch", "plugins", "hosts"];

 // The config directory: next to the system config, $MOSAIC_CONFIG or
 // ~/.config/mosaic-dev/config.json, the same rule mosaic-config.mjs uses.
@@ -34,7 +33,7 @@ export function businessFilePath(id, dir = configDir()) {
  return join(dir, "businesses", `${id}.json`);
 }

-export function checkBot(tracker, where) {
+function checkBot(tracker, where) {
  requireObject(tracker, where);
  rejectUnknownKeys(tracker, ["bot", "botId"], where);
  if (typeof tracker.bot !== "string" || !BOT_NAME.test(tracker.bot)) refuse(`${where}.bot must be a Vikunja bot username starting with "bot-"`);
@@ -103,6 +102,19 @@ function checkTracker(tracker, file) {
  return { sync, labels };
 }

+// Row 213 (C2-08, Case 2 design 4): persona vars belong only to a creative instance, and come as a
+// pair, since the bundle reads the file only against its digest.
+function checkPersonaVars(vars, definition, at) {
+  const set = ["persona.name", "persona.sha256"].filter((key) => Object.hasOwn(vars, key));
+  if (set.length === 0) return;
+  if (!CREATIVE_DEFINITIONS.includes(definition)) refuse(`${at}.vars: persona vars need a creative definition (${definition} isn't one)`);
+  if (set.length === 1) refuse(`${at}.vars: persona.name and persona.sha256 are set together or not at all`);
+}
+
+// Row 234 (#1740, r6 S1): hosts and host grants are bus store records made by a human-approved grant,
+// so the business file can't name them. The key stays known so the refusal says where they went.
+const HOSTS_MOVED = "lives in the bus store now: enroll a host with a host-enroll grant (mosaic hosts status)";
+
 function checkRoles(roles, file, rolesDir, business) {
  const where = `${file} roles`;
  requireObject(roles, where);
@@ -115,12 +127,15 @@ function checkRoles(roles, file, rolesDir, business) {
    requireId(instance, `${where} instance name`);
    const at = `${where}.${instance}`;
    requireObject(entry, at);
-    rejectUnknownKeys(entry, ["definition", "holder", "vars", "tracker", "credentials", "identity", "publish"], at);
+    rejectUnknownKeys(entry, ["definition", "holder", "vars", "tracker", "credentials", "identity", "publish", "hosts"], at);
    requireId(entry.definition, `${at}.definition`);
    const definition = Object.hasOwn(definitions, entry.definition) ? definitions[entry.definition] : loadRole(rolesDir, entry.definition);
    definitions[entry.definition] = definition;
    if (definition.roleVersion !== 2) refuse(`${at}: role definition ${entry.definition} is version 1 and can't back a business role instance`);
    const services = definition.credentials.map((c) => c.service);
+    if (entry.hosts !== undefined) refuse(`${at}.hosts ${HOSTS_MOVED}`);
+    // A host.<id> key reference comes from the agent's grant record at bus start (r6 X4), never from here.
+    const kinds = services.filter((s) => s !== HOST_SERVICE);
    let tracker = null;
    if (services.includes("vikunja")) {
      if (entry.tracker === undefined) refuse(`${at} needs "tracker" with its Vikunja bot, because ${entry.definition} uses vikunja`);
@@ -137,7 +152,7 @@ function checkRoles(roles, file, rolesDir, business) {
      holder: entry.holder === undefined ? null : requireId(entry.holder, `${at}.holder`),
      vars: checkVars(entry.vars ?? {}, "agent", `${at}.vars`),
      tracker,
-      credentials: checkCredentialMap(entry.credentials ?? {}, services, `${at}.credentials`,
+      credentials: checkCredentialMap(entry.credentials ?? {}, kinds, `${at}.credentials`,
        { configDir: dirname(dirname(file)), business, agent: instance }),
    };
    // Row 199 (#1697, design D8, D9 step 2): identity and publish are optional, so today's files
@@ -149,6 +164,7 @@ function checkRoles(roles, file, rolesDir, business) {
      if (!out[instance].identity || !services.includes("gitea")) refuse(`${at}.publish needs identity and a gitea definition`);
      out[instance].publish = requireDistinctList(entry.publish, `${at}.publish`, (p) => requireId(p, `${at}.publish entry`), { nonEmpty: true });
    }
+    checkPersonaVars(out[instance].vars, entry.definition, at);
  }
  return { roles: out, definitions };
 }
@@ -157,7 +173,7 @@ function checkLaunch(launch, roles, definitions, file) {
  const where = `${file} launch`;
  requireObject(launch, where);
  if (Object.hasOwn(launch,"max")) refuse(`${where}.max needs migration: mosaic limits migrate --file FILE --models FILE`);
-  rejectUnknownKeys(launch, ["by", "instances", "models", "limits", "threadIdleSeconds", "account", "keep", "noHire"], where);
+  rejectUnknownKeys(launch, ["by", "instances", "models", "limits", "threadIdleSeconds", "account"], where);
  requireId(launch.by, `${where}.by`);
  if (!Object.hasOwn(roles, launch.by)) refuse(`${where}.by names ${launch.by}, which the business file doesn't declare`);
  const launcher = definitions[roles[launch.by].definition];
@@ -181,29 +197,7 @@ function checkLaunch(launch, roles, definitions, file) {
  for(const [instance,role] of Object.entries(roles))if(role.vars.model!==undefined&&!Object.hasOwn(models,role.vars.model))refuse(`${where}: instance ${instance} selects unknown model ${role.vars.model}`);
  // No upper bound: limits have no ceiling in code (Q150).
  const threadIdleSeconds = launch.threadIdleSeconds === undefined ? THREAD_IDLE_SECONDS : requirePositiveInt(launch.threadIdleSeconds, `${where}.threadIdleSeconds`);
-  // Row 194 (#1692, D2.4, D2.5): the human's per-agent forbid. keep names declared instances the
-  // chief can't fire, replace or end. noHire names definitions the chief can't hire, by the id
-  // pattern only, so a stale entry is harmless. Both are optional and only the human writes them.
-  const keep = launch.keep === undefined ? undefined : requireDistinctList(launch.keep, `${where}.keep`, (name) => {
-    requireId(name, `${where}.keep entry`);
-    if (!Object.hasOwn(roles, name)) refuse(`${where}.keep names ${name}, which the business file doesn't declare`);
-    if (END_PROTECTED.includes(roles[name].definition)) refuse(`${where}.keep names ${name}, whose definition ${roles[name].definition} can't be kept`);
-  });
-  const noHire = launch.noHire === undefined ? undefined
-    : requireDistinctList(launch.noHire, `${where}.noHire`, (name) => requireId(name, `${where}.noHire entry`));
-  return {
-    by: launch.by, instances, models, limits, threadIdleSeconds, ...(account ? { account } : {}),
-    ...(keep ? { keep } : {}), ...(noHire ? { noHire } : {}),
-  };
-}
-
-// Row 194 (#1692, V5): instance names a delete retired. None may be declared again, so a later
-// create or hire can't reuse a name whose decisions outlive it.
-function checkRetired(retired, roles, file) {
-  return requireDistinctList(retired, `${file} retired`, (name) => {
-    requireId(name, `${file} retired entry`);
-    if (Object.hasOwn(roles, name)) refuse(`${file} retired names ${name}, which roles still declares`);
-  });
+  return { by: launch.by, instances, models, limits, threadIdleSeconds, ...(account ? { account } : {}) };
 }

 // Validate a parsed business document read from `file`. `rolesDir` is where
@@ -220,6 +214,7 @@ export function validateBusinessDocument(document, file, { rolesDir }) {
  }
  const human = requireId(document.human, "business human");
  const vars = checkVars(document.vars ?? {}, "business", `${file} vars`);
+  if (document.hosts !== undefined) refuse(`${file} hosts ${HOSTS_MOVED}`);
  const { roles, definitions } = checkRoles(document.roles, file, rolesDir, document.id);

  requireObject(document.arbiters, `${file} arbiters`);
@@ -277,11 +272,9 @@ export function validateBusinessDocument(document, file, { rolesDir }) {
  // here; whether each module loads is the loader's check, at load time.
  const plugins = document.plugins === undefined ? {}
    : structuredClone(checkPlugins(document.plugins, `${file} plugins`, { fail: (_code, message) => refuse(message) }));
-  const retired = document.retired === undefined ? undefined : checkRetired(document.retired, roles, file);

  return deepFreeze({
    businessVersion: 1, id: document.id, file, human, arbiters, projects, vars, tracker, roles, launch, plugins, definitions,
-    ...(retired ? { retired } : {}),
  });
 }

@@ -5,11 +5,11 @@
 import { lstatSync, realpathSync } from "node:fs";
 import { isAbsolute, join, normalize, relative, sep } from "node:path";
 import { refuse } from "./errors.mjs";
-import { SERVICES } from "./vocabulary.mjs";
+import { credentialKind, isHostKind } from "./vocabulary.mjs";
 import { requireObject, rejectUnknownKeys, requireDate } from "./util.mjs";

 const ENV_NAME = /^[A-Z][A-Z0-9_]{0,63}$/;
-export const DATE_KEY = Object.freeze({ gitea: "rotateBy", vikunja: "expires" });
+const DATE_KEY = Object.freeze({ gitea: "rotateBy", vikunja: "expires" });
 const WARN_DAYS = 7;
 const DAY_MS = 24 * 60 * 60 * 1000;

@@ -21,9 +21,10 @@ const DAY_MS = 24 * 60 * 60 * 1000;
 // can't use the form. A `file` reference into the agents' store must be the
 // agent's own path (`credential-not-yours`).
 export function parseCredentialRef(ref, service, where, { store = null } = {}) {
-  if (!SERVICES.includes(service)) refuse(`${where}: unknown credential service ${JSON.stringify(service)}`);
+  if (!credentialKind(service)) refuse(`${where}: unknown credential service ${JSON.stringify(service)}`);
  requireObject(ref, where);
-  const dateKey = DATE_KEY[service];
+  // Row 210 (#1707, design D1): an ssh key doesn't expire, so host.<id> takes rotateBy as gitea does.
+  const dateKey = isHostKind(service) ? "rotateBy" : DATE_KEY[service];
  rejectUnknownKeys(ref, ["file", "env", "store", dateKey], where);
  const hasFile = ref.file !== undefined;
  const hasEnv = ref.env !== undefined;
@@ -70,15 +71,13 @@ export function checkCredentialRef(ref, { forbiddenRoots = [], now = new Date(),
  const problems = [];
  const warnings = [];
  const label = `${ref.service} ${ref.file ? `file ${ref.file}` : `env ${ref.env}`}`;
-  let notIssued = false;
  if (ref.file) {
    let stat = null;
    try {
      stat = lstatSync(ref.file);
    } catch (e) {
      // Row 199 (design D3a): a store reference with no file is an agent not issued yet.
-      notIssued = Boolean(ref.store) && e.code === "ENOENT";
-      if (notIssued) warnings.push(`${label}: not issued`);
+      if (ref.store && e.code === "ENOENT") warnings.push(`${label}: not issued`);
      else problems.push(`${label}: not found`);
    }
    if (stat) {
@@ -107,10 +106,6 @@ export function checkCredentialRef(ref, { forbiddenRoots = [], now = new Date(),
  } else if (env[ref.env] === undefined || env[ref.env] === "") {
    warnings.push(`${label}: not set in this environment; the launcher must provide it`);
  }
-  // Row 194 (brief item 7, sage-1605 pick a): a human create writes the create day as the date,
-  // and issue writes the real one. Until then the date describes no token, so a store reference
-  // with no file skips both date checks. Every other reference keeps them.
-  if (notIssued) return { problems, warnings };
  const days = (dateText) => Math.floor((Date.parse(`${dateText}T00:00:00Z`) - now.getTime()) / DAY_MS);
  if (ref.expires) {
    const left = days(ref.expires);
@@ -0,0 +1,86 @@
+// Row 210 (#1707, design D3 and D6): the address, user and host key checks, and the argv allowlist the
+// broker matches each host.run against. Row 234 (#1740, r6 S1) moved the host registry and the grants
+// out of the business file into bus store records. The enrollment raise checks its fields with these,
+// and row b's host grant raise checks its commands with checkCommands.
+
+import { isIP } from "node:net";
+import { refuse } from "./errors.mjs";
+import { ARGV_MAX } from "./vocabulary.mjs";
+// Row 210 r4 (#1707): the argv check lives in vocabulary.mjs, which the worker sandbox mounts
+// and which imports nothing, so the broker can read it. Re-exported so the D6 checks keep one
+// business home here.
+export { ARGV_MAX, ARG_BYTES, ARGV_BYTES, validArgv, commandAllowed } from "./vocabulary.mjs";
+
+const DNS = /^[a-z0-9]([a-z0-9.-]{0,251}[a-z0-9])?$/;
+export const USER = /^[a-z_][a-z0-9_-]{0,31}$/;
+export const HOST_KEY = /^(ssh-ed25519|ecdsa-sha2-nistp256|ssh-rsa) [A-Za-z0-9+/]+={0,2}$/;
+
+// D6: a prefix starting with one of these, by basename, would turn the grant back into "any".
+// The list can't be complete. Under PRD 1.7 the control is the human's decision on each call (D4).
+export const REFUSED_COMMANDS = Object.freeze([
+  "sh", "bash", "dash", "zsh", "ksh", "fish", "busybox",
+  "su", "sudo", "doas", "pkexec", "runuser", "env", "xargs", "nohup", "setsid", "timeout", "nice",
+  "systemd-run", "chroot", "nsenter", "unshare", "setpriv", "capsh", "flock", "stdbuf", "ionice", "chrt",
+  "taskset", "strace", "script", "watch",
+  "perl", "ruby", "node", "sed", "vi", "vim", "less",
+]);
+// Versioned names: python, python3, python3.12; awk, gawk, mawk, nawk; php, php8.2.
+const REFUSED_FORMS = Object.freeze([/^python[0-9.]*$/, /^[gmn]?awk$/, /^php[0-9.]*$/]);
+
+export function refusedCommand(first) {
+  const base = first.split("/").pop();
+  return REFUSED_COMMANDS.includes(base) || REFUSED_FORMS.some((form) => form.test(base));
+}
+
+// D3 step 2: true when the address is this machine. A host grant there would be root on the
+// stack's own machine (section 6).
+export function ownMachine(address) {
+  const version = isIP(address);
+  if (version === 4) {
+    const first = Number(address.split(".")[0]);
+    return first === 127 || first === 0;
+  }
+  if (version === 6) {
+    // The URL parser writes the canonical form, so 0:0:0:0:0:0:0:1 reads as [::1] and
+    // ::ffff:127.0.0.1 as [::ffff:7f00:1].
+    const canonical = new URL(`http://[${address}]`).hostname;
+    return canonical === "[::1]" || canonical === "[::]" || /^\[::ffff:(7f[0-9a-f]{2}|[0-9a-f]{1,2}):/.test(canonical);
+  }
+  return address === "localhost" || address.endsWith(".localhost");
+}
+
+export function checkAddress(address, where) {
+  if (typeof address !== "string") refuse(`${where} must be an IP address or a DNS name`);
+  const version = isIP(address);
+  if (version === 6 && address.includes("%")) refuse(`${where} must not carry an IPv6 zone`);
+  if (version === 0) {
+    if (!DNS.test(address) || address.includes("..")) refuse(`${where} must be an IP address or a DNS name`);
+    // 127.1, 2130706433 and 0177.0.0.1 pass the DNS pattern and the resolver reads them as IPv4.
+    if (/^[0-9.]+$/.test(address)) refuse(`${where} must be a full four-part IPv4 address`);
+    if (address.split(".").some((label) => label.startsWith("0x"))) refuse(`${where} must not hold a hex label`);
+  }
+  if (ownMachine(address)) refuse(`${where} names this machine (${address})`);
+  return address;
+}
+
+// D6: an argv allowlist and nothing else. No wildcard: "any", "*", {} and [] all refuse.
+export function checkCommands(commands, where) {
+  if (!Array.isArray(commands)) refuse(`${where} must be a list of argv prefixes; there is no wildcard grant`);
+  if (commands.length === 0) refuse(`${where} must not be empty`);
+  const seen = new Set();
+  return commands.map((prefix, i) => {
+    const at = `${where}[${i}]`;
+    if (!Array.isArray(prefix) || prefix.length === 0) refuse(`${at} must be a non-empty argv prefix`);
+    if (prefix.length > ARGV_MAX) refuse(`${at} has more than ${ARGV_MAX} elements`);
+    for (const element of prefix) {
+      if (typeof element !== "string" || element === "" || element.includes("\0")) refuse(`${at} elements must be non-empty strings`);
+      if (/[*?[]/.test(element)) refuse(`${at} must not hold *, ? or [; the match is literal`);
+    }
+    if (prefix[0].includes("/") && !prefix[0].startsWith("/")) refuse(`${at}[0] must be a bare name or an absolute path`);
+    if (refusedCommand(prefix[0])) refuse(`${at} starts with ${prefix[0]}, a shell, runner or interpreter, which would grant any command`);
+    const key = JSON.stringify(prefix);
+    if (seen.has(key)) refuse(`${at} repeats a prefix`);
+    seen.add(key);
+    return [...prefix];
+  });
+}
@@ -4,9 +4,9 @@

 export { BusinessError } from "./errors.mjs";
 export {
-  ACTIONS, GATED_ONLY, HIRE_ALLOWED, TOOLS, NETWORKS, SERVICES, GITEA_SCOPE_CATEGORIES, VIKUNJA_GRANTABLE,
+  ACTIONS, GATED_ONLY, TOOLS, NETWORKS, SERVICES, GITEA_SCOPE_CATEGORIES, VIKUNJA_GRANTABLE,
 } from "./vocabulary.mjs";
-export { validateRoleDocument, loadRoleFile, loadRole, unhireableAction } from "./role.mjs";
+export { validateRoleDocument, loadRoleFile, loadRole } from "./role.mjs";
 export { LAYERS, REGISTRY, THINKING, FALLBACK_VARS, checkVars, mergeVars } from "./vars.mjs";
 export { parseCredentialRef, checkCredentialRef } from "./credentials.mjs";
 export { configDir, businessFilePath, validateBusinessDocument, loadBusiness } from "./business.mjs";
@@ -1,133 +1,42 @@
 // Row 165 (#1662, Q171): the human adds a role instance and changes an existing one's definition,
 // vars and launch membership. It is human-only: the broker's instances and instances.set verbs
 // reach it, and neither is in ORGANIZATION_KEYS, so the chief of staff's tool can't (sage-0918).
-// holder, credentials and tracker stay hand edits. Row 194 (#1692) adds delete, the human's veto
-// lists and the chief's hire and fire. Every write goes through the organization writer, which
-// logs the actor and the old and new values.
+// holder, credentials and tracker stay hand edits, and there is no delete. Every write goes
+// through the organization writer, which logs the actor and the old and new values.
 import { existsSync, readdirSync } from "node:fs";
 import { organizationWriter, OrganizationError } from "./organization.mjs";
-import { validateBusinessDocument, businessFilePath, checkBot } from "./business.mjs";
-import { DATE_KEY } from "./credentials.mjs";
-import { checkRoutes } from "./launch-settings.mjs";
+import { validateBusinessDocument, businessFilePath } from "./business.mjs";
+import { checkRoutes, creativeHumanOnly } from "./launch-settings.mjs";
 import { loadProject, projectFilePath } from "./project.mjs";
 import { resolveInstance } from "./resolve.mjs";
 import { loadRole } from "./role.mjs";
-import { refuse } from "./errors.mjs";
 import { isPlainObject, canonicalJson } from "./util.mjs";
-import { END_PROTECTED, ID_PATTERN } from "./vocabulary.mjs";
+import { CREATIVE_DEFINITIONS, END_PROTECTED, ID_PATTERN } from "./vocabulary.mjs";

-const SET_KEYS = ["revision", "instance", "op", "definition", "vars", "launch", "tracker"];
-const VETO_KEYS = ["revision", "op", "name"];
-const VETO_OPS = ["keep", "unkeep", "nohire", "hire"];
+const SET_KEYS = ["revision", "instance", "op", "definition", "vars", "launch"];
 const id = value => typeof value === "string" && ID_PATTERN.test(value);
-const revisionOk = value => typeof value === "string" && /^[a-f0-9]{64}$/.test(value);
-// Row 194 (D2.2, N3): the vars a hire may set, the ones the chief can already set on an instance.
-// Every limits.* key merges by intersection, so it can only narrow.
-const HIRE_VAR = key => key === "model" || key.startsWith("limits.");
-
-// Row 194 (#1692, V5): why an instance can't be deleted, checked in the design's order, or null.
-// The last-listed check runs when the proposed file is validated (deletedDocument).
-export function deleteRefusal(document, rolesDir, instance) {
-  if (!Object.hasOwn(document.roles, instance)) return { code: "organization-unknown-instance" };
-  const entry = document.roles[instance];
-  if (END_PROTECTED.includes(entry.definition)) return { code: "organization-definition-refused" };
-  const references = [];
-  if (document.launch?.by === instance) references.push("launch.by");
-  for (const kind of ["delivery", "technical"]) if (document.arbiters?.[kind] === instance) references.push(`arbiters.${kind}`);
-  if (references.length > 0) {
-    return { code: "organization-instance-referenced", message: `${instance} is ${references.join(" and ")}; change that first` };
-  }
-  if (document.launch?.keep?.includes(instance)) {
-    return { code: "organization-instance-kept", message: `${instance} is kept; run veto unkeep first` };
-  }
-  // Row 194 (brief item 8): delete revokes the agent's store credentials before the write, so an
-  // instance whose every reference is `store` can go, its tracker bot included (sage-1610 b). A
-  // file or env reference stays a hand edit.
-  const refs = Object.values(entry.credentials ?? {});
-  if (refs.some(ref => ref?.store !== true)) {
-    return { code: "organization-credentials-out-of-scope", message: `${instance} holds a file or env credential; deleting it is a hand edit` };
-  }
-  return null;
-}
-
-// The document with `instance` deleted (V5 step 2). It removes roles.<instance> and the references
-// that exist only for it, launch.instances and launch.limits.tokens.instances, and adds the name to
-// retired. Every other reference (launch.by, the arbiters, launch.keep) refuses in deleteRefusal.
-// A business whose only listed instance is this one refuses with a BusinessError.
-export function deletedDocument(document, instance) {
-  const next = structuredClone(document);
-  delete next.roles[instance];
-  if (next.launch) {
-    if (next.launch.instances.length === 1 && next.launch.instances[0] === instance) {
-      refuse(`${instance} is the last name in launch.instances; a business needs one instance the chief may launch`);
-    }
-    next.launch.instances = next.launch.instances.filter(name => name !== instance);
-    const tokens = next.launch.limits?.tokens?.instances;
-    if (tokens && Object.hasOwn(tokens, instance)) delete tokens[instance];
-  }
-  next.retired = [...(next.retired ?? []), instance];
-  return next;
-}

 // A definition this writer can give an instance: version 2, not END_PROTECTED, and declaring no
 // credential. An instance of one that declares credentials needs credentials and a tracker bot,
 // which stay out of this row (sage-0918); the refusal names that, so a later row lifts it alone.
-// Row 194 (brief item 7): the human's add passes credentials true and lifts it. The tester's add,
-// change and hire keep it.
-function definitionFor(rolesDir, name, { credentials = false } = {}) {
-  if (END_PROTECTED.includes(name)) throw new OrganizationError("organization-definition-refused");
+// Row 213 (C2-08, M10): a creative definition is END_PROTECTED, yet this writer is how the human
+// adds and changes one, so it isn't closed here. The caller runs creativeHumanOnly first.
+const closed = name => END_PROTECTED.includes(name) && !CREATIVE_DEFINITIONS.includes(name);
+
+function definitionFor(rolesDir, name) {
+  if (closed(name)) throw new OrganizationError("organization-definition-refused");
  const definition = loadRole(rolesDir, name);
  if (definition.roleVersion !== 2) throw new OrganizationError("invalid-request", `role definition ${name} is version 1`);
-  if (!credentials && definition.credentials.length > 0) {
+  if (definition.credentials.length > 0) {
    throw new OrganizationError("organization-credentials-out-of-scope",
      `${name} declares ${definition.credentials.map(c => c.service).join(" and ")} credentials; binding them is a hand edit`);
  }
  return definition;
 }

-// Row 194 (brief item 7, sage-1605, sage-1610 a): the human's add of a credentialed definition.
-// Each declared service gets a store reference dated the create day (UTC), and no file: the agent
-// needs a bus restart, then row 199's issue. A vikunja definition needs args.tracker, an existing
-// Vikunja bot the human names. The add makes no Vikunja account. Any other definition refuses it.
-function createdCredentials(old, instance, definition, args) {
-  const services = definition.credentials.map(c => c.service);
-  const out = {};
-  if (services.includes("vikunja")) {
-    if (!Object.hasOwn(args, "tracker")) {
-      throw new OrganizationError("organization-tracker-required", `${definition.name} uses vikunja; add needs tracker {bot, botId}, an existing Vikunja bot`);
-    }
-    let tracker;
-    try {
-      tracker = checkBot(args.tracker, "tracker");
-    } catch (e) {
-      if (e.name === "BusinessError") throw new OrganizationError("invalid-request", e.message);
-      throw e;
-    }
-    // business.mjs checks the same after the write: no two instances and not the sync bot.
-    const taken = Object.entries(old.roles).filter(([name, entry]) => name !== instance && entry.tracker).map(([name, entry]) => [name, entry.tracker]);
-    if (old.tracker?.sync) taken.push(["tracker.sync", old.tracker.sync]);
-    for (const [name, other] of taken) {
-      if (other.bot === tracker.bot || other.botId === tracker.botId) {
-        throw new OrganizationError("organization-tracker-bot-taken", `${name} already uses bot ${other.bot} (botId ${other.botId})`);
-      }
-    }
-    out.tracker = tracker;
-  } else if (Object.hasOwn(args, "tracker")) {
-    throw new OrganizationError("invalid-request", `${definition.name} uses no vikunja credential, so it takes no tracker`);
-  }
-  if (services.length > 0) {
-    const today = new Date().toISOString().slice(0, 10);
-    out.credentials = Object.fromEntries(services.map(service => [service, { store: true, [DATE_KEY[service]]: today }]));
-  }
-  return out;
-}
-
 // levels(name): the thinking levels harness module `name` applies, or null (launch-settings.mjs
-// checkRoutes, row 65). Row 194 (brief item 8, row 199 D13): revoke(business, instance, how,
-// services) revokes the instance's credentials for a fire or a delete and throws
-// credential-revoke-failed when it can't. Null in a writer with no bus (the CLI's), which revokes
-// nothing.
-export function instanceSettings({ dir, rolesDir, system, levels = () => null, revoke = null }) {
+// checkRoutes, row 65).
+export function instanceSettings({ dir, rolesDir, system, levels = () => null }) {
  const writer = organizationWriter({ dir, rolesDir });

  // The definitions in rolesDir and whether add and set accept each one.
@@ -144,7 +53,7 @@ export function instanceSettings({ dir, rolesDir, system, levels = () => null, r
      }
      if (definition.roleVersion !== 2) continue;
      const services = definition.credentials.map(c => c.service);
-      out[name] = { services, accepted: !END_PROTECTED.includes(name) && services.length === 0 };
+      out[name] = { services, accepted: !closed(name) && services.length === 0 };
    }
    return out;
  }
@@ -158,20 +67,15 @@ export function instanceSettings({ dir, rolesDir, system, levels = () => null, r
      vars: entry.vars ?? {},
      launched: launch ? launch.instances.includes(name) : false,
      launcher: launch ? launch.by === name : false,
-      protected: END_PROTECTED.includes(entry.definition),
-      kept: (launch?.keep ?? []).includes(name),
+      protected: closed(entry.definition),
    }]));
-    // Row 194 (D1): the human's forbid lists and the retired names. The bus adds running runs.
-    return {
-      business, revision, launch: launch !== null, instances, definitions: definitions(),
-      noHire: [...(launch?.noHire ?? [])], retired: [...(document.retired ?? [])],
-    };
+    return { business, revision, launch: launch !== null, instances, definitions: definitions() };
  }

-  // args: { revision, instance, op: "add" | "change" | "delete", definition?, vars?, launch?: boolean }.
+  // args: { revision, instance, op: "add" | "change", definition?, vars?, launch?: boolean }.
  // add needs definition; change needs at least one of definition, vars and launch. vars replaces
-  // the instance's vars whole. Row 194 (D3): the writer's restart is false. The bus reloads the
-  // business after the write and sets restart from that reload (runtime.mjs).
+  // the instance's vars whole. The answer's restart is true when the running bus must restart
+  // before the change counts: the broker holds the roles it loaded at start (broker.mjs bindLaunch).
  function set(business, args, actor) {
    if (!isPlainObject(args) || Object.keys(args).some(key => !SET_KEYS.includes(key))) {
      throw new OrganizationError("invalid-request");
@@ -180,7 +84,7 @@ export function instanceSettings({ dir, rolesDir, system, levels = () => null, r
      throw new OrganizationError("invalid-request");
    }
    const { instance, op } = args;
-    if (!id(instance) || !["add", "change", "delete"].includes(op)) throw new OrganizationError("invalid-request");
+    if (!id(instance) || (op !== "add" && op !== "change")) throw new OrganizationError("invalid-request");
    // The broker refuses a business whose roles name human or tester (broker.mjs, the load check),
    // so an instance under either name would stop the bus at its next start (row 165 r2, Dewey F1).
    if (instance === "human" || instance === "tester") {
@@ -191,36 +95,27 @@ export function instanceSettings({ dir, rolesDir, system, levels = () => null, r
    if (Object.hasOwn(args, "launch") && typeof args.launch !== "boolean") throw new OrganizationError("invalid-request");

    const old = writer.read(business).document;
-    if (op === "delete") {
-      if (Object.keys(args).some(key => !["revision", "instance", "op"].includes(key))) throw new OrganizationError("invalid-request");
-      const services = Object.keys(old.roles[instance]?.credentials ?? {});
-      const beforeWrite = revoke ? () => revoke(business, instance, "delete", services) : null;
-      const result = commit(business, old, planDelete(old, instance), { revision: args.revision, actor, beforeWrite });
-      // sage-1610 (b): the bot user and any token it holds live in Vikunja, which this write
-      // can't reach (row 199 A5).
-      const bot = old.roles[instance]?.tracker?.bot;
-      return bot ? { ...result, tracker: { bot, removeByHand: `remove the Vikunja bot user ${bot} and any token it holds by hand in Vikunja` } } : result;
-    }
    const next = structuredClone(old);
    const exists = Object.hasOwn(next.roles, instance);
+    let redefined = false;
    if (op === "add") {
      if (!Object.hasOwn(args, "definition")) throw new OrganizationError("invalid-request");
      if (exists) throw new OrganizationError("organization-instance-exists");
-      if ((old.retired ?? []).includes(instance)) throw new OrganizationError("organization-instance-retired");
-      // Only the human's add binds credentials. The tester keeps the refusal (row 175 W2): the bus
-      // names the tester's actor "tester", which no human or role may be called.
-      const definition = definitionFor(rolesDir, args.definition, { credentials: actor !== "tester" });
+      creativeHumanOnly(old, actor, instance, args.definition);
+      definitionFor(rolesDir, args.definition);
      next.roles[instance] = { definition: args.definition, ...(Object.hasOwn(args, "vars") ? { vars: structuredClone(args.vars) } : {}) };
-      Object.assign(next.roles[instance], createdCredentials(old, instance, definition, args));
+      redefined = true;
    } else {
-      if (Object.hasOwn(args, "tracker")) throw new OrganizationError("invalid-request", "tracker is set only by add");
      if (!["definition", "vars", "launch"].some(key => Object.hasOwn(args, key))) throw new OrganizationError("invalid-request");
      if (!exists) throw new OrganizationError("organization-unknown-instance");
      const entry = next.roles[instance];
      // An assistant's settings change only through limits.set's assistants key (row 155), so
-      // nothing here touches a protected instance, its vars and launch membership included.
-      if (END_PROTECTED.includes(entry.definition)) throw new OrganizationError("organization-definition-refused");
+      // nothing here touches a protected instance, its vars and launch membership included. A
+      // creative instance is the exception: the human changes it here, and only the human (M10).
+      creativeHumanOnly(old, actor, instance, entry.definition);
+      if (closed(entry.definition)) throw new OrganizationError("organization-definition-refused");
      if (Object.hasOwn(args, "definition") && args.definition !== entry.definition) {
+        creativeHumanOnly(old, actor, instance, args.definition);
        definitionFor(rolesDir, args.definition);
        // The old definition's credentials would bind to the new one's authority.
        if (loadRole(rolesDir, entry.definition).credentials.length > 0) {
@@ -228,7 +123,8 @@ export function instanceSettings({ dir, rolesDir, system, levels = () => null, r
            `${instance} holds ${entry.definition} credentials; moving them to another definition is a hand edit`);
        }
        entry.definition = args.definition;
-        }
+        redefined = true;
+      }
      if (Object.hasOwn(args, "vars")) entry.vars = structuredClone(args.vars);
    }
    if (Object.hasOwn(args, "launch")) {
@@ -237,101 +133,6 @@ export function instanceSettings({ dir, rolesDir, system, levels = () => null, r
      if (!args.launch) next.launch.instances = listed.filter(name => name !== instance);
      else if (!listed.includes(instance)) listed.push(instance);
    }
-    return commit(business, old, next, { revision: args.revision, actor });
-  }
-
-  // Row 194 (V5): the delete's checks against the file as it stands, and its document. The broker
-  // runs this at the verb with no write, and the launcher's pass runs set op delete after the take.
-  function planDelete(document, instance) {
-    const refusal = deleteRefusal(document, rolesDir, instance);
-    if (refusal) throw new OrganizationError(refusal.code, refusal.message);
-    return deletedDocument(document, instance);
-  }
-
-  function checkDelete(business, instance) {
-    const { document, revision } = writer.read(business);
-    const next = planDelete(document, instance);
-    validateBusinessDocument(next, businessFilePath(business, dir), { rolesDir });
-    return { revision };
-  }
-
-  // Row 194 (V6): args { revision, op: keep | unkeep | nohire | hire, name }. keep needs a declared
-  // instance that isn't END_PROTECTED. nohire needs only the id pattern. Human-only at the broker.
-  function veto(business, args, actor) {
-    if (!isPlainObject(args) || Object.keys(args).some(key => !VETO_KEYS.includes(key))) throw new OrganizationError("invalid-request");
-    if (!revisionOk(args.revision) || !VETO_OPS.includes(args.op) || !id(args.name)) throw new OrganizationError("invalid-request");
-    const old = writer.read(business).document;
-    if (!old.launch) throw new OrganizationError("organization-launch-not-configured");
-    const next = structuredClone(old);
-    const { op, name } = args;
-    const key = op === "keep" || op === "unkeep" ? "keep" : "noHire";
-    const list = next.launch[key] ?? [];
-    if (op === "keep") {
-      if (!Object.hasOwn(next.roles, name)) throw new OrganizationError("organization-unknown-instance");
-      if (END_PROTECTED.includes(next.roles[name].definition)) throw new OrganizationError("organization-definition-refused");
-    }
-    const add = op === "keep" || op === "nohire";
-    if (add === list.includes(name)) throw new OrganizationError("organization-no-change");
-    next.launch[key] = add ? [...list, name] : list.filter(entry => entry !== name);
-    return commit(business, old, next, { revision: args.revision, actor });
-  }
-
-  // Row 194 (#1692, D2.2): the chief's hire, after the broker's identity, grant, allowlist and
-  // hireable checks. args { name, definition, vars? }. A new name is added and listed. A fired name
-  // (declared, not listed) is listed again only with its own definition and no vars. The writer
-  // reads the file as it stands, so a veto or retire written since the broker's copy still counts.
-  function hire(business, args, { actor, context }) {
-    const { document: old, revision } = writer.read(business);
-    if (!old.launch) throw new OrganizationError("organization-launch-not-configured");
-    const { name, definition } = args;
-    if (!id(name) || !id(definition) || name === "human" || name === "tester") throw new OrganizationError("invalid-request");
-    if (Object.hasOwn(args, "vars") && (!isPlainObject(args.vars) || !Object.keys(args.vars).every(HIRE_VAR))) {
-      throw new OrganizationError("invalid-request", "hire vars may set only model and limits keys");
-    }
-    if ((old.launch.noHire ?? []).includes(definition)) throw new OrganizationError("definition-not-hireable");
-    definitionFor(rolesDir, definition);
-    if ((old.retired ?? []).includes(name)) throw new OrganizationError("organization-instance-retired");
-    if ((old.launch.keep ?? []).includes(name)) throw new OrganizationError("instance-kept");
-    const next = structuredClone(old);
-    if (Object.hasOwn(old.roles, name)) {
-      const fired = !old.launch.instances.includes(name) && old.launch.by !== name;
-      if (!fired || old.roles[name].definition !== definition || Object.hasOwn(args, "vars")) {
-        throw new OrganizationError("organization-instance-exists");
-      }
-    } else {
-      next.roles[name] = { definition, ...(Object.hasOwn(args, "vars") ? { vars: structuredClone(args.vars) } : {}) };
-    }
-    next.launch.instances.push(name);
-    return commit(business, old, next, { revision, actor, context });
-  }
-
-  // Row 194 (D2.2 step B): the fire's delist. An instance already delisted is done, so a repeated
-  // fire after a failed step C goes on to consume (webby-0011 B2). The checks repeat against the file.
-  function fire(business, args, { actor, context }) {
-    const { document: old, revision } = writer.read(business);
-    if (!old.launch) throw new OrganizationError("organization-launch-not-configured");
-    const { name } = args;
-    if (!id(name) || !Object.hasOwn(old.roles, name)) throw new OrganizationError("organization-unknown-instance");
-    if ((old.launch.keep ?? []).includes(name)) throw new OrganizationError("instance-kept");
-    if (END_PROTECTED.includes(old.roles[name].definition)) throw new OrganizationError("organization-definition-refused");
-    if (old.launch.by === name) throw new OrganizationError("organization-instance-referenced", `${name} is launch.by`);
-    if (!old.launch.instances.includes(name)) return { ...read(business), transaction: null, delisted: false };
-    if (old.launch.instances.length === 1) {
-      refuse(`${name} is the last name in launch.instances; a business needs one instance the chief may launch`);
-    }
-    const next = structuredClone(old);
-    next.launch.instances = old.launch.instances.filter(entry => entry !== name);
-    // Item 8: fire revokes each service of the entry and keeps the store directory (sage-1593).
-    const services = Object.keys(old.roles[name].credentials ?? {});
-    let revoked = null;
-    const beforeWrite = revoke ? () => { revoked = revoke(business, name, "fire", services); } : null;
-    const result = commit(business, old, next, { revision, actor, context, beforeWrite });
-    return { ...result, delisted: true, ...(revoked ? { credentials: revoked } : {}) };
-  }
-
-  // The checks every write runs, then beforeWrite (a fire's or a delete's revoke), then the write. A
-  // check that refuses revokes nothing, and a revoke that throws writes nothing.
-  function commit(business, old, next, { revision, actor, context, beforeWrite = null }) {
    if (canonicalJson(next) === canonicalJson(old)) throw new OrganizationError("organization-no-change");

    // The checks mosaic business validate runs, before the writer publishes anything, then the
@@ -358,15 +159,9 @@ export function instanceSettings({ dir, rolesDir, system, levels = () => null, r
        }
      }
    }
-    // Row 194 N1 (sage-1634): a delete writes on the revision its request read when it was raised,
-    // so a write since then makes it stale. The revision is checked here, before the revoke, because
-    // the writer's own check comes after it. A write between this read and the writer's lock still
-    // revokes and then refuses (BUILD.md follow-up).
-    if (writer.read(business).revision !== revision) throw new OrganizationError("revision-conflict", "organization revision changed; read again");
-    if (beforeWrite) beforeWrite();
-    const receipt = writer.write(business, next, { revision, actor, context });
-    return { ...read(business), transaction: receipt.transaction, restart: false };
+    const receipt = writer.write(business, next, { revision: args.revision, actor });
+    return { ...read(business), transaction: receipt.transaction, restart: redefined };
  }

-  return { writer, read, set, checkDelete, veto, hire, fire };
+  return { writer, read, set };
 }
@@ -5,7 +5,16 @@ import { resolveInstance } from "./resolve.mjs";
 import { usageCounts } from "./launch.mjs";
 import { canonicalJson, isPlainObject, requireObject, rejectUnknownKeys } from "./util.mjs";
 import { FALLBACK_VARS } from "./vars.mjs";
-import { THREAD_DEFINITION } from "./vocabulary.mjs";
+import { THREAD_DEFINITION, CREATIVE_DEFINITIONS } from "./vocabulary.mjs";
+
+// Row 213 (C2-08, Case 2 design 4, M10): a creative instance, its persona included, is the
+// human's. A write that touches one is accepted only when its actor is the business file's
+// human; the broker sets the actor to the human's id, "tester" or <definition>.<instance>.
+export function creativeHumanOnly(document, actor, instance, definition) {
+  if (CREATIVE_DEFINITIONS.includes(definition) && actor !== document.human) {
+    throw new OrganizationError("organization-creative-human-only", `${instance} is a ${definition} instance, which only the human changes`);
+  }
+}

 // Row 155 (#1649, Jason's ruling Q169): the fields of an assistant instance's entry the human and
 // the chief of staff may change. holder and credentials stay hand edits.
@@ -166,13 +175,30 @@ export function launchSettings({ dir, rolesDir, system, sessions = () => [], now
      stamp(next.launch.limits, old.document.launch.limits, at);
    }
    if (Object.hasOwn(args, "reset")) reset(next.launch.limits, args.reset, at);
-    if (Object.hasOwn(args, "models")) next.launch.models = args.models;
+    if (Object.hasOwn(args, "models")) {
+      // M10: replacing launch.models can change the model behind a key a creative instance names
+      // without touching the instance, so a change to or removal of such a key is the human's.
+      for (const [instance, entry] of Object.entries(old.document.roles)) {
+        const vars = entry.vars ?? {};
+        for (const key of [vars.model, vars["fallback.model"]]) {
+          if (typeof key !== "string") continue;
+          const was = own(old.document.launch.models, key) ? canonicalJson(old.document.launch.models[key]) : null;
+          const is = own(args.models, key) ? canonicalJson(args.models[key]) : null;
+          if (was !== is) creativeHumanOnly(old.document, actor, instance, entry.definition);
+        }
+      }
+      next.launch.models = args.models;
+    }
    if (Object.hasOwn(args, "instances")) {
      requireObject(args.instances, "instance model selections");
      for (const [instance, key] of Object.entries(args.instances)) {
        if (!Object.hasOwn(next.roles, instance) || typeof key !== "string") {
          throw new OrganizationError("invalid-request");
        }
+        // M10: a creative instance's model changes through instances.set or routes.set, whoever asks.
+        if (CREATIVE_DEFINITIONS.includes(next.roles[instance].definition)) {
+          throw new OrganizationError("organization-creative-instance", `${instance}'s model changes through instances.set or routes.set`);
+        }
        next.roles[instance].vars = { ...next.roles[instance].vars, model: key };
      }
    }
@@ -250,6 +276,7 @@ export function launchSettings({ dir, rolesDir, system, sessions = () => [], now
    const exact = (value, keys) => isPlainObject(value) && Object.keys(value).length === keys.length && keys.every(key => Object.hasOwn(value, key));
    for (const [instance, route] of Object.entries(args.routes)) {
      if (!Object.hasOwn(next.roles, instance)) throw new OrganizationError("organization-unknown-instance");
+      creativeHumanOnly(old.document, actor, instance, next.roles[instance].definition);
      if (!exact(route, [...ROUTE_FIELDS, "fallback"]) || ROUTE_FIELDS.some(key => typeof route[key] !== "string")) {
        throw new OrganizationError("invalid-request");
      }
@@ -175,9 +175,8 @@ export function organizationWriter({ dir, rolesDir, barrier = () => {} }) {
  }

  // Row 199 (#1697, design section 6): `detail` says what a credential verb did (verb, agent, kind,
-  // date, reason), never a value; the other setters pass none. context, when given, is logged with
-  // the change: row 194's hire and fire carry the chief's run and the decision there (D2.2).
-  function write(id, document, { revision, actor, detail, context }) {
+  // date, reason), never a value; the other setters pass none.
+  function write(id, document, { revision, actor, detail }) {
    requireId(actor, "authenticated actor");
    requireId(id, "organization id");
    return withLock(id, ({ home, parent }) => {
@@ -203,7 +202,7 @@ export function organizationWriter({ dir, rolesDir, barrier = () => {} }) {
      durable(candidate, bytes);
      syncDir(tx);
      const event = {
-        transaction, actor, ...(context === undefined ? {} : { context }), business: id, before, after,
+        transaction, actor, business: id, before, after,
        changes: changes(old, written), ...(detail === undefined ? {} : { detail }), at: new Date().toISOString(),
      };
      log(id, { ...event, state: "prepared" });
@@ -4,7 +4,7 @@
 // layer wins. Limits: every layer narrows, nothing widens.

 import { refuse } from "./errors.mjs";
-import { ACTIONS, NETWORKS } from "./vocabulary.mjs";
+import { ACTIONS, NETWORKS, isHostKind } from "./vocabulary.mjs";
 import { checkVars, mergeVars } from "./vars.mjs";
 import { canonicalJson, sha256, deepFreeze } from "./util.mjs";
 import { projectFilePath } from "./project.mjs";
@@ -87,7 +87,9 @@ export function resolveInstance({ system, business, project = null, instance })
    vars,
    provenance,
    limits: { tools, network, authority: { withinRole, crossRole } },
-    credentials: entry.credentials,
+    // Row 210 (#1707, design D5): a host key is used only by the bus child, never by the session,
+    // so it stays out of the session's credentials and the harness's needs.
+    credentials: Object.fromEntries(Object.entries(entry.credentials).filter(([kind]) => !isHostKind(kind))),
    tracker: entry.tracker,
    launch,
    // REQ-HARN-2: the search-source plug-in the organization file switches on, by name.
@@ -4,11 +4,12 @@
 // ceilings. Version 1 files still load: they carry no authority, so every
 // vocabulary action is gated for them.

-import { existsSync, lstatSync } from "node:fs";
+import { lstatSync } from "node:fs";
 import { basename, dirname, join } from "node:path";
 import { refuse } from "./errors.mjs";
 import {
-  ACTIONS, GATED_ONLY, TOOLS, NETWORKS, SERVICES, GITEA_SCOPE_CATEGORIES, VIKUNJA_GRANTABLE, unhireableAction,
+  ACTIONS, GATED_ONLY, TOOLS, NETWORKS, SERVICES, HOST_SERVICE, GITEA_SCOPE_CATEGORIES, VIKUNJA_GRANTABLE,
+  CREATIVE_DEFINITIONS, CREATIVE_TOOLS,
 } from "./vocabulary.mjs";
 import {
  requireObject, rejectUnknownKeys, requireId, requireString, requireDistinctList, readJsonFile, deepFreeze,
@@ -17,7 +18,7 @@ import {
 const CONTRACT_NAME = /^[a-z0-9][a-z0-9._-]{0,60}\.md$/;
 const V1_KEYS = ["roleVersion", "name", "tools", "network"];
 const V2_REQUIRED = ["roleVersion", "name", "title", "contract", "tools", "network", "authority", "credentials"];
-const V2_KEYS = [...V2_REQUIRED, "messaging", "skills", "hireable"];
+const V2_KEYS = [...V2_REQUIRED, "messaging", "skills"];
 const SKILL_NAME = /^[A-Za-z0-9._-]+$/;

 function checkTools(tools) {
@@ -75,25 +76,6 @@ function checkSkills(skills) {
  });
 }

-// Row 194 (#1692, D2.3): unhireableAction is vocabulary.mjs's, exported here as before.
-export { unhireableAction };
-
-// Row 194 (#1692, D2.3): optional. The role definitions this role may hire, by name. Each one must
-// be a version 2 file in the same directory whose every action is on HIRE_ALLOWED. The named file
-// is validated without its own "hireable" check, so a list can't recurse.
-function checkHireable(hireable, file) {
-  const dir = dirname(file);
-  return requireDistinctList(hireable, "role hireable", (name) => {
-    requireId(name, "role hireable entry");
-    const path = join(dir, `${name}.json`);
-    if (!existsSync(path)) refuse(`hireable names ${name}, which has no role file`);
-    const named = validateRoleDocument(readJsonFile(path, "role file"), path, { hireable: false });
-    if (named.roleVersion !== 2) refuse(`hireable names ${name}, which is role version 1`);
-    const outside = unhireableAction(named);
-    if (outside !== null) refuse(`hireable names ${name}, which holds ${outside}`);
-  });
-}
-
 function checkGiteaScopes(scopes) {
  const list = requireDistinctList(scopes, "gitea scopes", (scope) => {
    const m = typeof scope === "string" ? /^(read|write):([a-z]+)$/.exec(scope) : null;
@@ -126,10 +108,15 @@ function checkCredentials(credentials) {
  const seen = new Set();
  return credentials.map((entry, i) => {
    requireObject(entry, `role credentials[${i}]`);
-    rejectUnknownKeys(entry, ["service", "scopes"], `role credentials[${i}]`);
-    if (!SERVICES.includes(entry.service)) refuse(`role credentials[${i}].service must be one of: ${SERVICES.join(", ")}`);
+    // Row 210 (#1707, design D1): "host" takes no scopes; the business file names the hosts.
+    const host = entry.service === HOST_SERVICE;
+    rejectUnknownKeys(entry, host ? ["service"] : ["service", "scopes"], `role credentials[${i}]`);
+    if (!host && !SERVICES.includes(entry.service)) {
+      refuse(`role credentials[${i}].service must be one of: ${[...SERVICES, HOST_SERVICE].join(", ")}`);
+    }
    if (seen.has(entry.service)) refuse(`role credentials name ${entry.service} twice`);
    seen.add(entry.service);
+    if (host) return { service: HOST_SERVICE };
    const scopes = entry.service === "gitea" ? checkGiteaScopes(entry.scopes) : checkVikunjaScopes(entry.scopes);
    return { service: entry.service, scopes };
  });
@@ -150,12 +137,30 @@ function checkContract(contract, file) {
  return path;
 }

+// Row 213 (C2-08, Case 2 design 4, M1): a creative role only reads and answers the human. Its file
+// may name no tool outside CREATIVE_TOOLS, no authority but message.send, and must carry a messaging
+// key that names only the human, so it can't relay through another role.
+function checkCreative(role) {
+  const wider = role.tools.filter((tool) => !CREATIVE_TOOLS.includes(tool));
+  if (wider.length > 0) refuse(`creative role ${role.name} may not name tools ${wider.join(", ")} (allowed: ${CREATIVE_TOOLS.join(", ")})`);
+  const actions = [...role.authority.withinRole, ...role.authority.crossRole];
+  if (role.authority.crossRole.length > 0 || actions.some((a) => a !== "message.send")) {
+    refuse(`creative role ${role.name} may hold only withinRole message.send`);
+  }
+  if (role.messaging === null) refuse(`creative role ${role.name} requires "messaging"`);
+  for (const key of ["sendTo", "receiveFrom"]) {
+    if (role.messaging[key].some((entry) => entry !== "human")) {
+      refuse(`creative role ${role.name} messaging.${key} may name only human`);
+    }
+  }
+  return role;
+}
+
 // Validate a parsed role document read from `file`. Returns a frozen role:
 // { roleVersion, name, title, contract, contractPath, tools, network,
 //   authority: { withinRole, crossRole }, credentials: [{ service, scopes }],
-//   messaging: { sendTo, receiveFrom } | null, skills: [name], hireable: [name] }.
-// options.hireable false skips the hireable list's checks of other files (D2.3) and keeps the list.
-export function validateRoleDocument(document, file, options = {}) {
+//   messaging: { sendTo, receiveFrom } | null, skills: [name] }.
+export function validateRoleDocument(document, file) {
  requireObject(document, "role");
  if (document.roleVersion !== 1 && document.roleVersion !== 2) refuse('role "roleVersion" must be 1 or 2');
  rejectUnknownKeys(document, document.roleVersion === 1 ? V1_KEYS : V2_KEYS, "role");
@@ -164,16 +169,17 @@ export function validateRoleDocument(document, file, options = {}) {
  if (document.name !== base) refuse(`role "name" (${document.name}) must match its filename (${base}.json)`);
  const tools = checkTools(document.tools);
  if (document.roleVersion === 1) {
+    if (CREATIVE_DEFINITIONS.includes(document.name)) refuse(`creative role ${document.name} must be version 2`);
    const network = document.network === undefined ? "none" : checkNetwork(document.network);
    return deepFreeze({
      roleVersion: 1, name: document.name, title: null, contract: null, contractPath: null, tools, network,
-      authority: { withinRole: [], crossRole: [] }, credentials: [], messaging: null, skills: [], hireable: [],
+      authority: { withinRole: [], crossRole: [] }, credentials: [], messaging: null, skills: [],
    });
  }
  for (const key of V2_REQUIRED) {
    if (document[key] === undefined) refuse(`role version 2 requires "${key}"`);
  }
-  return deepFreeze({
+  const role = {
    roleVersion: 2,
    name: document.name,
    title: requireString(document.title, 'role "title"', { max: 80 }),
@@ -185,10 +191,8 @@ export function validateRoleDocument(document, file, options = {}) {
    credentials: checkCredentials(document.credentials),
    messaging: document.messaging === undefined ? null : checkMessaging(document.messaging),
    skills: document.skills === undefined ? [] : checkSkills(document.skills),
-    hireable: document.hireable === undefined ? []
-      : options.hireable === false ? requireDistinctList(document.hireable, "role hireable", (name) => requireId(name, "role hireable entry"))
-        : checkHireable(document.hireable, file),
-  });
+  };
+  return deepFreeze(CREATIVE_DEFINITIONS.includes(role.name) ? checkCreative(role) : role);
 }

 export function loadRoleFile(file) {
@@ -145,6 +145,18 @@ export const REGISTRY = Object.freeze({
  "fallback.harness": def(["agent"], moduleName),
  "fallback.model": def(["agent"], string(200)),
  "fallback.thinking": def(["agent"], oneOf(THINKING)),
+  // Row 213 (C2-08, Case 2 design 4): a creative instance's persona. The name the user sees, one line,
+  // and the sha256 of <configDir>/personas/<business>/<instance>.md. The text stays out of the
+  // business file; the bundle reads the file at launch and refuses it off this digest.
+  "persona.name": def(["agent"], (v, key) => {
+    requireString(v, `variable ${key}`, { max: 40 });
+    if (/[\u0000-\u001f\u007f\u2028\u2029]/.test(v)) refuse(`variable ${key} must be one line with no control characters`);
+    return v;
+  }),
+  "persona.sha256": def(["agent"], (v, key) => {
+    if (typeof v !== "string" || !/^[0-9a-f]{64}$/.test(v)) refuse(`variable ${key} must be 64 lowercase hex characters`);
+    return v;
+  }),

  // Limits narrow the role definition's ceilings. limits.authority is an
  // allowlist: a role action it doesn't name becomes gated.
@@ -23,6 +23,9 @@ export const ACTIONS = Object.freeze([
  // Row 199 (#1697, mos-1027 Q-M2): the host pushes an agent's recorded work commit to the fork its
  // business grants it. A hard wait under REQ-WAIT-3 until a PRD version routes it.
  "git.push.remote",
+  // Row 210 (#1707, design D4): an agent runs a command with sudo on a host its business grants it.
+  // A hard wait under REQ-WAIT-3 until a PRD version routes it, so Jason decides each call.
+  "host.sudo",
  "review.request",
  "review.verdict",
  "record.write",
@@ -38,10 +41,6 @@ export const ACTIONS = Object.freeze([
  // Row 141 (#1635): sets a role instance's name. Routed under PRD 1.5 REQ-MSG-2, which has the chief of
  // staff set names once its role file grants that within-role.
  "instance.name",
-  // Row 194 (#1692): the chief of staff hires (adds and lists a role instance) and fires (ends its
-  // runs and delists it). Hard waits under PRD 1.6 (mos-1017), routed under PRD 1.7 REQ-COS-3.
-  "role.hire",
-  "role.fire",
  "credential.mint",
  "spend",
  "deploy",
@@ -61,7 +60,7 @@ export const ACTIONS = Object.freeze([
 // action joins this list only by the reviewed commit that names it routed.
 // git.merge.protected, policy.change, prd.approve and role.revoke left the
 // hard waits in 1.5 and route by REQ-DEC-2. instance.name (row 141) is routed
-// under REQ-MSG-2 (1.5). role.hire and role.fire left the hard waits in 1.7 (REQ-COS-3).
+// under REQ-MSG-2 (1.5).
 export const ROUTED = Object.freeze([
  "task.create",
  "task.assign",
@@ -85,42 +84,15 @@ export const ROUTED = Object.freeze([
  "policy.change",
  "prd.approve",
  "decision.resolve.technical",
-  // PRD 1.7 REQ-COS-3 (row 194, #1692): the chief's hire and fire, within the bounds the broker checks.
-  "role.hire",
-  "role.fire",
 ]);

 // The hard waits (PRD 1.5 REQ-WAIT-1): always gated, always the human's,
 // cited spec or not. A role file may not list these under withinRole or
 // crossRole (REQ-WAIT-2). Today this is spend, data.delete, network.expose,
 // account.create, credential.mint, message.external, git.push.protected,
-// git.push.remote and deploy; a test pins the list.
+// git.push.remote, host.sudo (row 210) and deploy; a test pins the list.
 export const GATED_ONLY = Object.freeze(ACTIONS.filter((action) => !ROUTED.includes(action)));

-// Row 194 (#1692, D2.3): the chief of staff hires only a definition whose every withinRole and
-// crossRole action is on this list. An allowlist, so an action added to ACTIONS later is never
-// hireable until a reviewed commit adds it here. git.push.remote (row 199) is not on it.
-export const HIRE_ALLOWED = Object.freeze([
-  "message.send",
-  "record.write",
-  "review.request",
-  "task.update.assigned",
-  "task.scope.change",
-  "git.push.working",
-]);
-
-// Row 194 (#1692, D2.3): the first action of a definition's authority that isn't on
-// HIRE_ALLOWED, or null when every one is. role.mjs's hireable check and the broker's hire check
-// use it. It lives here because the session sandbox mounts this file and not role.mjs
-// (seat/src/sandbox.mjs RUNNER_FILES), and the runner imports broker.mjs.
-export function unhireableAction(role) {
-  for (const key of ["withinRole", "crossRole"]) {
-    const outside = role.authority[key].find((action) => !HIRE_ALLOWED.includes(action));
-    if (outside !== undefined) return outside;
-  }
-  return null;
-}
-
 // pi's documented built-in tools; the same list scripts/mosaic-task.mjs
 // accepts for tasks.
 export const BUILTIN_TOOLS = Object.freeze(["read", "write", "edit", "bash", "grep", "find", "ls"]);
@@ -136,6 +108,41 @@ export const NETWORKS = Object.freeze(["none", "api-only", "open"]);

 export const SERVICES = Object.freeze(["gitea", "vikunja"]);

+// Row 210 (#1707, design D1): a role definition declares {"service": "host"} once, and the business
+// file binds each host. A host key's kind is host.<hostId>, one key per agent and host.
+export const HOST_SERVICE = "host";
+export const HOST_ID = /^[a-z0-9][a-z0-9-]{0,31}$/;
+export const HOST_PREFIX = "host.";
+export const isHostKind = (name) =>
+  typeof name === "string" && name.startsWith(HOST_PREFIX) && HOST_ID.test(name.slice(HOST_PREFIX.length));
+// Every place that checks a credential kind asks this, so the closed set has one definition.
+export const credentialKind = (name) => SERVICES.includes(name) || isHostKind(name);
+
+// Row 210 r4 (#1707): the broker checks argv with these. They sit here, not in hosts.mjs,
+// because broker.mjs runs in the worker sandbox and reads only mounted files that need nothing else.
+export const ARGV_MAX = 256;
+export const ARG_BYTES = 4096;
+export const ARGV_BYTES = 32768;
+
+// D6: a call's argv. 1 to 256 strings, each 1 to 4096 bytes with no NUL, 32768 bytes in all, and
+// argv[0] a bare name or an absolute path. Also the broker's check, at raise and at call.
+export function validArgv(argv) {
+  if (!Array.isArray(argv) || argv.length === 0 || argv.length > ARGV_MAX) return false;
+  let total = 0;
+  for (const element of argv) {
+    if (typeof element !== "string" || element === "" || element.includes("\0")) return false;
+    const bytes = Buffer.byteLength(element);
+    if (bytes > ARG_BYTES) return false;
+    total += bytes;
+  }
+  return total <= ARGV_BYTES && (!argv[0].includes("/") || argv[0].startsWith("/"));
+}
+
+// True when argv starts with one of the grant's prefixes, element by element, literally.
+export function commandAllowed(argv, commands) {
+  return commands.some((prefix) => prefix.length <= argv.length && prefix.every((element, i) => element === argv[i]));
+}
+
 // Gitea token scopes are <read|write>:<category>. "all" and the admin
 // category are never granted to a role.
 export const GITEA_SCOPE_CATEGORIES = Object.freeze([
@@ -163,10 +170,29 @@ export const ID_PATTERN = /^[a-z0-9][a-z0-9._-]{0,63}$/;
 // Row 121 (#1615): an instance of this definition talks with the user in threads (REQ-THREAD-1).
 // Row 155 (#1649) moves it here from the broker, so the organization writer reads the same name.
 export const THREAD_DEFINITION = "assistant";
+
+// Row 213 (C2-08, #1714, Case 2 design 4): the creative roles. Each only reads and answers the human
+// in cited items; its instances are the human's alone (M10).
+export const CREATIVE_DEFINITIONS = Object.freeze(["companion", "ideas", "research", "proofreader", "fact-checker", "continuity"]);
+// The reply item kinds each creative definition may send (design 4, 5.2's reply-kind check).
+export const CREATIVE_KINDS = Object.freeze({
+  companion: Object.freeze(["idea", "question", "finding", "fact"]),
+  ideas: Object.freeze(["idea", "question"]),
+  research: Object.freeze(["fact", "question"]),
+  proofreader: Object.freeze(["correction", "question"]),
+  "fact-checker": Object.freeze(["finding", "question"]),
+  continuity: Object.freeze(["finding", "question"]),
+});
+// The only tools a creative role file may name (M1): reading, and the broker's web grant.
+export const CREATIVE_TOOLS = Object.freeze(["read", "grep", "find", "ls", "web"]);
+// The definitions that may hold a thread: the assistant and the creative roles. The definition the
+// chief of staff may set stays THREAD_DEFINITION.
+export const THREAD_DEFINITIONS = Object.freeze([THREAD_DEFINITION, ...CREATIVE_DEFINITIONS]);
 // Row 139 (#1633), Jason's ruling Q169 (PRD 1.6): definitions only the chief of staff, or a decision
 // the human resolved through the CLI, may end or revoke. Row 155 moves the list here, and no
-// organization write may give an instance one of them.
-export const END_PROTECTED = Object.freeze([THREAD_DEFINITION]);
+// organization write may give an instance one of them, except the human's instances.set for a
+// creative definition (row 213).
+export const END_PROTECTED = THREAD_DEFINITIONS;

 // Row 199 (#1697, design D9c): the Gitea URL parse. It lives here because the broker reads it and
 // this file imports nothing. Gitea's name rule for users and repositories: letters, digits, "_", "."
@@ -159,10 +159,11 @@ test("the contract passes work to the chief of staff and directs no one", () =>
  assert.doesNotMatch(text, /to\s+the\s+role\s+it\s+concerns/);
 });

-test("REQ-HARN-2: the assistant holds the web grant, and no other role file does", () => {
+// Row 213 (C2-08, Case 2 design 4): companion and research hold it too, for the broker's web tools.
+test("REQ-HARN-2: the assistant, companion and research hold the web grant, and no other role file does", () => {
  const names = readdirSync(REPO_ROLES).filter((f) => f.endsWith(".json") && f !== "conductor-policy.json").map((f) => f.slice(0, -5));
  const granted = names.filter((name) => loadRole(REPO_ROLES, name).tools.includes("web"));
-  assert.deepEqual(granted, ["assistant"]);
+  assert.deepEqual(granted, ["assistant", "companion", "research"]);
  for (const name of ["coder", "reviewer", "chief-of-staff", "pm", "cto", "researcher"]) {
    assert.ok(!loadRole(REPO_ROLES, name).tools.includes("web"), name);
  }
@@ -235,35 +235,24 @@ test("the shipped example refuses as written and validates once filled in", () =
  assert.equal(id, 15);
 });

-// Row 194 (#1692, D2.5, T17): the per-agent forbid and the retired list.
-test("row 194 keep, noHire and retired validate, and a file without them loads as before", () => {
-  const plain = check();
-  assert.equal(Object.hasOwn(plain.launch, "keep"), false);
-  assert.equal(Object.hasOwn(plain.launch, "noHire"), false);
-  assert.equal(Object.hasOwn(plain, "retired"), false);
-  const business = check((d) => {
-    d.launch.keep = ["coder", "chief"];
-    d.launch.noHire = ["reviewer", "no-such-role"];
-    d.retired = ["old-coder"];
-  });
-  assert.deepEqual(business.launch.keep, ["coder", "chief"]);
-  // A stale noHire entry is harmless: only the id pattern is checked.
-  assert.deepEqual(business.launch.noHire, ["reviewer", "no-such-role"]);
-  assert.deepEqual(business.retired, ["old-coder"]);
-  assert.ok(Object.isFrozen(business.launch.keep) && Object.isFrozen(business.retired));
-  assert.deepEqual(check((d) => { d.launch.keep = []; d.launch.noHire = []; d.retired = []; }).launch.keep, []);
-});
-
-test("row 194 each bad keep, noHire or retired entry refuses", () => {
-  refuses(() => check((d) => { d.launch.keep = ["ghost"]; }), /launch\.keep names ghost, which the business file doesn't declare/);
-  refuses(() => check((d) => { d.launch.keep = ["coder", "coder"]; }), /duplicate entry in .*launch\.keep/);
-  refuses(() => check((d) => { d.launch.keep = "coder"; }), /launch\.keep must be an array/);
-  refuses(() => check((d) => { d.roles.assistant = { definition: "assistant" }; d.launch.keep = ["assistant"]; }),
-    /launch\.keep names assistant, whose definition assistant can't be kept/);
-  refuses(() => check((d) => { d.launch.noHire = ["Bad Name"]; }), /launch\.noHire entry/);
-  refuses(() => check((d) => { d.launch.noHire = ["coder", "coder"]; }), /duplicate entry in .*launch\.noHire/);
-  refuses(() => check((d) => { d.retired = ["coder"]; }), /retired names coder, which roles still declares/);
-  refuses(() => check((d) => { d.retired = ["x", "x"]; }), /duplicate entry in .*retired/);
-  refuses(() => check((d) => { d.retired = ["../x"]; }), /retired entry/);
-  refuses(() => check((d) => { d.retired = {}; }), /retired must be an array/);
+// Row 213 (C2-08, #1714), deviation D1: the persona vars sit on a creative instance only, and
+// both or neither. The var checks themselves are vars.mjs's.
+test("persona vars: agent layer, creative definition only, both or neither", () => {
+  const sha = "a".repeat(64);
+  const persona = { "persona.name": "Bean", "persona.sha256": sha };
+  const business = check((d) => { d.roles.bean = { definition: "companion", vars: { ...persona } }; });
+  assert.deepEqual({ ...business.roles.bean.vars }, persona);
+  assert.doesNotThrow(() => check((d) => { d.roles.bean = { definition: "ideas" }; }));
+  refuses(() => check((d) => { d.vars["persona.name"] = "Bean"; }), /persona\.name can't be set at the business layer/);
+  refuses(() => check((d) => { d.roles.pm.vars = { ...d.roles.pm.vars, ...persona }; }),
+    /roles\.pm\.vars: persona vars need a creative definition \(pm isn't one\)/);
+  refuses(() => check((d) => { d.roles.chief.vars = { ...persona }; }), /chief-of-staff isn't one/);
+  for (const key of Object.keys(persona)) {
+    refuses(() => check((d) => { d.roles.bean = { definition: "research", vars: { [key]: persona[key] } }; }),
+      /roles\.bean\.vars: persona\.name and persona\.sha256 are set together or not at all/);
+  }
+  for (const [key, value] of [["persona.name", "x".repeat(41)], ["persona.name", "Be\nan"], ["persona.name", "Be\u0007an"], ["persona.name", "Be\u2028an"], ["persona.name", "Be\u2029an"], ["persona.name", 7],
+    ["persona.sha256", "A".repeat(64)], ["persona.sha256", sha.slice(1)], ["persona.sha256", `${sha}0`]]) {
+    refuses(() => check((d) => { d.roles.bean = { definition: "companion", vars: { ...persona, [key]: value } }; }), new RegExp(`variable ${key.replace(".", "\\.")}`), 2);
+  }
 });
@@ -14,15 +14,12 @@ import { businessDoc, launchDoc, REPO_ROLES, systemFor, tmp, writeJson } from ".

 // Decision 104's list plus role.launch (decision 139) plus role.end and
 // organization.change (row 123, REQ-COS-1) and record.write (row 138), plus instance.name
-// (row 141, REQ-MSG-2, sage-0589), plus role.hire and role.fire (row 194, PRD 1.7 REQ-COS-3,
-// sage-1471, mos-1089). A role file that differs from it fails.
+// (row 141, REQ-MSG-2, sage-0589). A role file that differs from it fails.
 const APPROVED = Object.freeze({
  tools: ["read", "grep", "find", "ls"],
  network: "api-only",
-  authority: Object.freeze({ withinRole: Object.freeze(["message.send", "role.launch", "role.end", "organization.change", "record.write", "instance.name", "role.hire", "role.fire"]), crossRole: Object.freeze([]) }),
+  authority: Object.freeze({ withinRole: Object.freeze(["message.send", "role.launch", "role.end", "organization.change", "record.write", "instance.name"]), crossRole: Object.freeze([]) }),
  credentials: Object.freeze([]),
-  // Row 194 (#1692, Q4, sage-1374): empty until a policy commit after the PRD 1.7 resolve.
-  hireable: Object.freeze([]),
 });

 // The fixture business's chief-of-staff instance, which is also its launcher.
@@ -88,9 +85,9 @@ test("the resolved record matches the approved list, so a widened file fails", (
  assert.deepEqual(record.credentials, {});
 });

-test("the chief of staff holds role.launch, message.send, role.end, organization.change, record.write, instance.name, role.hire and role.fire; every other action is gated", () => {
+test("the chief of staff holds role.launch, message.send, role.end, organization.change, record.write and instance.name; every other action is gated", () => {
  const record = resolved(loadFixture());
-  const held = ["message.send", "role.launch", "role.end", "organization.change", "record.write", "instance.name", "role.hire", "role.fire"];
+  const held = ["message.send", "role.launch", "role.end", "organization.change", "record.write", "instance.name"];
  for (const action of ACTIONS) {
    assert.equal(classify(record, action), held.includes(action) ? "within" : "gated", action);
  }
@@ -142,8 +139,6 @@ test("the contract names no duty to talk to the human and the pm contract no lau
  assert.doesNotMatch(chief, /main (agent|point of interaction)/i);
  assert.doesNotMatch(chief, /\bJason\b/);
  assert.match(chief, /never talk to the user/);
-  // Row 194 (#1692, D3 item 5, N3): a hire launches with no restart once the human sets its route.
-  assert.match(chief, /A hire is listed for `launch` at once, with no restart, but it\s+runs only after the human sets its route \(harness and thinking\)/);
  const pm = readFileSync(join(REPO_ROLES, "pm.md"), "utf8");
  assert.doesNotMatch(pm, /^- Launch /m);
  assert.match(pm, /You don't launch sessions/);
--- a/Show More
+++ b/Show More