row 211 (#1709 , #426 ): a pre-push guard that refuses deletes and non-fast-forward pushes, its installer, and slot-busy.sh that exits 1 on BUSY

scripts/git-hooks/pre-push refuses a delete, a remote tip missing locally and any update whose remote tip isn't an ancestor of the local tip; a new branch and a fast-forward pass. scripts/install-git-hooks.sh puts it in the common .git/hooks, refuses a set core.hooksPath or a different hook without --force-install, and runs a canary through git hook run. scripts/slot-busy.sh exits 0 CLEAR, 1 BUSY, 2 error. scripts/test-git-guard.sh (61 cases) and the mutant runner in agents/darkwing/work/queue-211; TOOLS.md gets the usage. Not run yet: written during Gander's slot (sage-2801).
2026-10-22 11:46:06 -05:00
23 changed files with 798 additions and 540 deletions
@@ -0,0 +1,142 @@
+# Row 211 (#1709, Vikunja P19 #426): a pre-push hook that refuses force-pushes, and a busy check that fails on BUSY
+
+Darkwing, 2026-10-22. Brief: `docs/plans/2026-10-20_force-push-guard.md` (blob 3a8c2cf13). Moved from Rocko
+to me by sage-2801 (Q220, mos-1301). Base: aca16404c. Branch: `darkwing/row211`. Reviewer: Dewey. Gate
+owner: Sage.
+
+## What ships
+
+- `scripts/git-hooks/pre-push` (new, `/bin/sh`). For each ref line on stdin it refuses:
+  - a delete (local sha all zeros);
+  - a remote tip that isn't in this repository (`git cat-file -e <remote>^{commit}`), with "fetch first,
+    then push again";
+  - a remote tip that isn't an ancestor of the local tip (`git merge-base --is-ancestor`), naming the ref
+    and both shas;
+  - an ancestor check that fails for any other reason (exit above 1);
+  - a short or overlong ref line, or a non-hex object name.
+
+  A new ref (remote sha all zeros) passes, and so does an empty push. It fetches nothing. On any refusal
+  it prints one line per refused ref and a closing line, and exits 1, so git pushes no ref at all.
+- `scripts/install-git-hooks.sh` (new). Installs the hook as `pre-push` in the common `.git/hooks`
+  (`git rev-parse --git-common-dir`), so a `--repo` naming a worktree lands in the shared directory.
+  It refuses (exit 2):
+  - a set `core.hooksPath` at any scope;
+  - a different installed `pre-push`, unless `--force-install` is given;
+  - a symlinked `pre-push`, even with `--force-install`;
+  - any of `GIT_DIR`, `GIT_WORK_TREE`, `GIT_COMMON_DIR`, `GIT_INDEX_FILE`, `GIT_OBJECT_DIRECTORY` or
+    `GIT_ALTERNATE_OBJECT_DIRECTORIES` in the environment;
+  - a directory that isn't a git checkout.
+
+  It never writes the installed file in place. A new hook goes in by `link()` from a temporary copy, so
+  a hook that appeared meanwhile is kept and the install refuses. A replacement goes in by `rename()`.
+  Then it compares the bytes, checks the mode, and runs a canary through `git hook run` (git 2.55 here):
+  an empty push must pass and a delete line must be refused with the guard's message.
+- `scripts/slot-busy.sh` (new). Exit 0 CLEAR, 1 BUSY, 2 its own error, one `BUSY <pid> <rule> cwd=<cwd>
+  <command>` line per match. Rules: `node ... --test`, `*gate*.sh` (after a space, `/`, `_` or `-`), a
+  `mutant` substring, `test-*.sh`, `docker compose` and `docker-compose`. It skips its own pid and its
+  ancestors, empty command lines (kernel threads) and shell-snapshot wrappers.
+- `scripts/test-git-guard.sh` (new), 61 cases, and three Maintenance rows plus a short section in
+  `docs/TOOLS.md`.
+
+## Choices
+
+1. **A separate `scripts/install-git-hooks.sh`, not `queue-commit.sh --install-push-hook`.** The brief
+   left this open. `queue-commit.sh --install-hook` is the queue guard's installer. It is tied to the
+   canonical checkout and to the lead (jason/sage) and runs the queue guard's canary. The push guard has
+   neither tie: it must also be installable in a scratch clone for the tests, and every seat worktree
+   shares it. Putting it in `queue-commit.sh` would widen that script's reach for no gain. The cost is a
+   second installer with a similar shape. The install pattern (copy beside, link or rename, verify,
+   canary) follows `queue-commit.sh`.
+2. **No privilege check in the installer.** The brief makes the canonical install a separate step with
+   Sage after landing, and the tests need to install into scratch clones as the suite's user. So the
+   script installs wherever it is told. The guard is advisory on the client in any case (`--no-verify`).
+3. **The hook source is the working file next to the installer** (`$ROOT/scripts/git-hooks/pre-push`),
+   not a blob from a ref. That lets the mutant runner install a mutated copy from its own tree, and
+   matches how `queue-commit.sh` reads its guard.
+4. **A new `scripts/test-git-guard.sh`, not more cases in `test-land-work.sh`.** The brief allowed either.
+   Land-work's suite is about `land-work.sh`, and the gate runs every `scripts/test-*.sh`, so a new file
+   gets gated with no wiring.
+5. **`--proc-root DIR` is a test seam in `slot-busy.sh`.** On a live host the real `/proc` may hold
+   other seats' runs at any time, so the suite can't demand exit 0 there. Exit 0 and every rule are
+   tested against a fake `/proc` with pids above `pid_max` (4194304), so they can't collide with the
+   ancestor set, which always comes from the real `/proc`. The real `/proc` is tested with a stand-in:
+   a `/bin/sh` script named `node`, started as `node --test standin.test.mjs` in its own cwd. The suite
+   asserts its BUSY line with that cwd, exit 1, that `slot-busy > /dev/null && echo ran` prints nothing,
+   that the suite itself (an ancestor whose command line matches `test-*.sh`) has no BUSY line, and that
+   after the stand-in exits its pid is gone. The brief's "0 without one" is the fake-`/proc` case.
+6. **Ancestors are skipped**, not only its own pid as the brief says. A gate script that runs the busy
+   check matches its own rules (`*gate*.sh`, `test-*.sh`, `mutant`), so checking only `$$` would make
+   every such caller see itself as BUSY.
+7. **The gate rule is broader than `gate.sh`**: `[ /_-]gate[^ /]*\.sh `, so `sage-gate.sh` and
+   `gate-253.sh` match too. A false BUSY costs a wait; a false CLEAR costs a broken run.
+8. **Shell-snapshot wrappers are skipped.** An agent harness runs each command as `bash -c 'source
+   .../shell-snapshots/snapshot-*.sh && eval <command text>'`, so the wrapper's command line holds the
+   text of whatever the agent typed, including a busy check that names `test-*.sh`. The real child
+   processes the wrapper starts are still matched.
+
+## Tests (`scripts/test-git-guard.sh`)
+
+Scratch bare remote, a scratch clone with the guard installed, and a worktree of that clone. Git runs
+with `GIT_CONFIG_NOSYSTEM=1` and an empty `GIT_CONFIG_GLOBAL`, as in `test-land-work.sh`. Nothing touches
+origin, `~/.mosaic`, `~/.mosaic-dev` or `~/.config/mosaic-dev`.
+
+- Install: exit 0, the canary passed, bytes and mode, no temporary file left, and the worktree's git
+  resolves `hooks/pre-push` to the common file.
+- From the worktree: a new branch and a fast-forward pass. A `--force` push of a rewritten branch, a
+  `+refspec` push and a `--force-with-lease` push are refused by the guard's message, naming the ref and
+  both shas, and the remote ref is unchanged. `:ref` and `--delete` are refused and the branch stays.
+- A second clone moves the remote; a `--force` push from the worktree is then refused with "fetch
+  first", the remote stays where the other clone put it, and the guard fetched nothing.
+- The hook fed by hand: a short line, a non-hex name and an unknown local object are refused; an empty
+  push passes.
+- The installer: `core.hooksPath` set refuses with that message and writes no hook (in `.git/hooks` or
+  the hooks path). A different hook refuses and stays byte-identical. `--force-install` replaces it, and
+  a hard link to the old file keeps the old bytes, so the replacement was a rename. A second install of
+  the same bytes exits 0. A symlinked hook refuses even with `--force-install`. A `--repo` naming a
+  worktree lands in the common directory. `GIT_DIR` set, a plain directory and an unknown argument
+  refuse.
+- `slot-busy.sh`, fake `/proc`: CLEAR with exit 0 when nothing matches (a server, a `grep gate`, a
+  snapshot wrapper whose text holds `node --test`, an empty command line). Exit 1 and the BUSY line for
+  `node --test`, with no CLEAR in the output, and `> /dev/null && echo ran` prints nothing. Each rule
+  once more (7 cases). Exit 2 for a missing root, an empty root and an unknown argument.
+- `slot-busy.sh`, real `/proc`: the stand-in cases in choice 5.
+
+## Mutants (`agents/darkwing/work/queue-211/mutants.sh`)
+
+Each mutant copies the four scripts into its own tree, edits one site there (exactly one match), and runs
+that tree's suite under `timeout -k 10 180`. The worktree's files are never edited. The unmutated suite
+runs first and a red base stops the run. The brief's five come first:
+
+| Mutant | Site |
+|---|---|
+| ancestor-dropped | pre-push: `rc=0` in place of the `merge-base --is-ancestor` call |
+| unknown-object-passes | pre-push: the missing-remote-tip branch skips the ref without refusing |
+| delete-passes | pre-push: the delete branch skips the ref without refusing |
+| install-over-hookspath | installer: the `core.hooksPath` refusal is `true \|\| die` |
+| busy-exits-0 | slot-busy: `exit 0` when BUSY |
+| differing-hook-replaced | installer: a different hook is replaced without `--force-install` |
+| replace-in-place | installer: the replacement writes into the installed file (`cat >`) instead of renaming |
+| symlink-followed | installer: no symlink refusal |
+| ancestor-error-passes | pre-push: an ancestor check exiting above 1 doesn't refuse |
+| snapshot-matched | slot-busy: no shell-snapshot skip |
+| ancestors-matched | slot-busy: no ancestor skip |
+| no-node-rule | slot-busy: the `node --test` rule removed |
+| no-compose-rule | slot-busy: the `docker compose` rule removed |
+
+`install-over-hookspath` still exits 2, because its canary then fails (git looks for the hook in the hooks
+path). The suite kills it on the message and on "no hook was written", not on the exit code.
+
+## Runs
+
+Pending: nothing has run yet. Gander held the gate slot (row 253 run 5, from 16:32Z) while this was
+written, so only `bash -n`, `sh -n` and a `DRY=1` mutant pass (every site matched once, no suite run)
+happened. The suite, the mutants and every other `scripts/test-*.sh` run in a CLEAR Sage announces, with
+`TMPDIR` under `/mnt/storage/scratch/tmp`. Results and the measured suite time go here before review.
+
+## Known limits
+
+- `git push --no-verify` skips the hook. Gitea branch protection (ops-01, through Mos) is the guard that
+  holds.
+- The hook doesn't check tags differently from branches: a moved tag is refused like a rewritten branch.
+- `slot-busy.sh` can call a process BUSY that isn't a run, for example an editor with a `test-*.sh` open.
+  It never reads files under a seat's directory, so it can't tell.
@@ -0,0 +1,74 @@
+#!/usr/bin/env bash
+# Row 211 (#426) mutants. Run from the candidate worktree's root:
+#   TMPDIR=<scratch dir> LOG=<dir> bash agents/darkwing/work/queue-211/mutants.sh > mutants.txt
+# Each mutant copies the four row-211 scripts into its own tree, edits one
+# site there (exactly one match, else NO MATCH), and runs that tree's
+# scripts/test-git-guard.sh under a 180 s timeout. The worktree's files are
+# never edited. "killed" means the suite failed; "survived" means it passed.
+# The unmutated suite runs first, and a red base stops the run (exit 3).
+set -u
+LOG=${LOG:-.}
+FILES="scripts/git-hooks/pre-push scripts/install-git-hooks.sh scripts/slot-busy.sh scripts/test-git-guard.sh"
+WORK=$(mktemp -d "${TMPDIR:-/tmp}/r211-mutants.XXXXXX") || exit 2
+trap 'rm -rf "$WORK"' EXIT
+
+tree() { # $1: name. Prints the copy's root.
+  local t="$WORK/$1" f
+  for f in $FILES; do mkdir -p "$t/$(dirname "$f")" && cp -p -- "$f" "$t/$f" || return 1; done
+  echo "$t"
+}
+suite() { # $1: tree, $2: log
+  timeout -k 10 180 bash "$1/scripts/test-git-guard.sh" > "$2" 2>&1
+}
+edit() { # $1: file, $2: from, $3: to. Exit 3 unless $2 occurs exactly once.
+  python3 -B - "$1" "$2" "$3" <<'PY'
+import sys
+path, old, new = sys.argv[1:4]
+text = open(path).read()
+if text.count(old) != 1:
+    sys.exit(3)
+open(path, "w").write(text.replace(old, new))
+PY
+}
+
+base=$(tree base) || exit 2
+if [ -n "${DRY:-}" ]; then
+  echo "base: not run (DRY)"
+elif suite "$base" "$LOG/mut-base.log"; then
+  echo "base: green ($(tail -1 "$LOG/mut-base.log"))"
+else
+  echo "base: RED, stopping ($(tail -1 "$LOG/mut-base.log"))"
+  exit 3
+fi
+
+run() { # $1: name, $2: file, $3: from, $4: to
+  local name=$1 file=$2 t log
+  t=$(tree "$name") || { echo "$name: COPY FAILED"; return; }
+  if ! edit "$t/$file" "$3" "$4"; then echo "$name: NO MATCH"; return; fi
+  if [ -n "${DRY:-}" ]; then echo "$name: match"; return; fi
+  log="$LOG/mut-$name.log"
+  if suite "$t" "$log"; then
+    echo "$name: survived"
+  else
+    echo "$name: killed (exit $?, $(grep -c '^FAIL' "$log") FAIL; first: $(grep -m1 '^FAIL' "$log" | cut -c6-100))"
+  fi
+}
+H=scripts/git-hooks/pre-push
+I=scripts/install-git-hooks.sh
+S=scripts/slot-busy.sh
+
+# The brief's five.
+run ancestor-dropped $H $'    git merge-base --is-ancestor "$rsha" "$lsha" 2>/dev/null\n    rc=$?' '    rc=0'
+run unknown-object-passes $H $'        refuse "$rref: the remote tip $rsha isn\'t in this repository; fetch first, then push again"\n        continue' '        continue'
+run delete-passes $H $'        refuse "$rref: a delete (remote $rsha); seat branches are never deleted by push"\n        continue' '        continue'
+run install-over-hookspath $I '[ -z "$out" ] || die 2 "refused: core.hooksPath' '[ -z "$out" ] || true || die 2 "refused: core.hooksPath'
+run busy-exits-0 $S 'if [ "$busy" = 1 ]; then exit 1; fi' 'if [ "$busy" = 1 ]; then exit 0; fi'
+# Further sites the suite pins.
+run differing-hook-replaced $I '[ "$FORCE" = 1 ] || die 2 "refused: a different' 'true || die 2 "refused: a different'
+run replace-in-place $I 'mv -f -- "$tmp" "$HOOK" ||' 'cat -- "$tmp" > "$HOOK" && rm -f -- "$tmp" ||'
+run symlink-followed $I 'if [ -L "$HOOK" ]; then die 2' 'if false; then die 2'
+run ancestor-error-passes $H '        *) refuse "$rref: the ancestor check failed' '        *) : "$rref: the ancestor check failed'
+run snapshot-matched $S $'  if [[ "$c" == *"/shell-snapshots/snapshot-"* ]]; then return 1; fi\n' ''
+run ancestors-matched $S '  [ -z "${SKIP[$pid]:-}" ] || continue' '  :'
+run no-node-rule $S 'if [[ "$c" =~ $RE_NODE ]]; then echo "node --test"; return 0; fi' ':'
+run no-compose-rule $S 'if [[ "$c" =~ $RE_COMPOSE ]]; then echo "docker compose"; return 0; fi' ':'
@@ -1,120 +0,0 @@
-# Row 239 (#1745) build notes (append only)
-
-## 2026-10-22 b1 (Honker)
-
-Design d1 5da5f28f6 was approved by Duckworth with C1 and C2 and no blockers (duckworth-0165, note
-agents/duckworth/work/row239/REVIEW-design-d1.md). The code is on honker/row239 from aca16404c. No test
-has run yet: every run waits for Sage's CLEAR.
-
-### Duckworth's conditions and answers
-
- C1 (option a): `outcome-unknown-revoked` is in the Console's `OPEN` list (webui bus.mjs), so
-  `sendOutcome` answers it as `outcome-unknown` with `sent: 'unknown'` and never "Nothing changed". T6
-  covers it and M3f is its mutant.
- C2: `write()` sets `revoked = true` after `beforeWrite()` returns, and a catch around the whole
-  `withLock(...)` call marks the error. So a throw from the lock's release in its finally is marked as
-  well. This is structural and has no test, as Duckworth said.
- Q1: `beforeWrite` runs after both validations. Q2: two codes. Q3: M2 removes the `:188` check (now
-  organization.mjs:195).
-
-### Notes N1-N5
-
- N1: `beforeWrite` must not write the same business, because it would find its own lock and refuse
-  `organization-busy`. This is said in the comments on `write()` and `commit()`. Today's revokes (the
-  bus's credential revoke) write no business file.
- N2: the lock is held across the revoke. A fire or a delete now keeps other writers of that business
-  out for as long as the revoke takes. They refuse `organization-busy`, as they do for any held lock.
- N3: a revoke that fails partway (some tokens revoked, then `credential-revoke-failed`) behaves as
-  today. The error carries no `revoked` mark, because `beforeWrite` didn't return, and nothing is
-  written. This row doesn't change that.
- N4: a delete closed with `outcome-unknown-revoked` exits 3 in the CLI, as every closed refusal does.
-  Exit 1 (transport EXIT) applies only to a direct verb answer.
- N5: I grepped for "before the write" and similar comments. The ones left (lifecycle-revoke.test:2,
-  instance-settings:56, cli instances.mjs:53, serve.mjs:365) are still true and are unchanged. T21 in
-  bus lifecycle-revoke.test:173 is unchanged.
-
-### Differences from the design
-
- The business tests are in lifecycle-settings.test.mjs, not instance-settings.test.mjs. The fire tests
-  and their fixture already live there. The fixture now returns `dir` and `rolesDir` too.
- T3 covers T3b (the delete) in the same test, looping over fire and delete. It also checks that a
-  revoke throwing `credential-revoke-failed` carries no mark and writes nothing.
- T4b is the plain-code check. The design's "T4b, outcome-unknown-revoked for an fs-style error" is in
-  T4, which checks EIO with and without the mark for both a fire and a delete.
- The bus test's fake org gets `deleteError`, thrown from its `instances.set` branch, so T4 can drive a
-  delete.
- transport.test gets one assertion, `busExit("outcome-unknown-revoked") === 1`, for M3g.
- A latent Console text: a direct (not closed-request) `revision-conflict-revoked` answer in the
-  Console would still get " Nothing changed." appended, because only `OPEN` codes skip it. That sentence
-  is true there: the file is unchanged. No direct human path gives this code today, since a delete
-  reaches the Console as a closed request's refusal.
- The Console's STATUS entry for `outcome-unknown-revoked` (503) can't be reached while the code is in
-  `OPEN`. It stays for symmetry with the CLI and is harmless.
-
-### What changed
-
- packages/business/src/organization.mjs: `write()` takes `beforeWrite`, runs it under the lock after
-  the revision check and both validations, and marks any later error `revoked`. The body is reindented
-  inside the try.
- packages/business/src/instance-settings.mjs: `instanceSettings` takes an optional `writer`. `commit()`
-  passes `beforeWrite` to `writer.write` instead of calling it. The early check stays, and its comment
-  is rewritten.
- packages/bus/src/broker.mjs: `#organizationFail` maps a marked error to `revision-conflict-revoked` or
-  `outcome-unknown-revoked` before the existing mappings. `#fireJob`'s notice adds "Its credential
-  tokens may already be revoked." for a `-revoked` code.
- packages/bus/src/runtime.mjs: comment only.
- packages/cli/src/instances.mjs: two REASONS entries. packages/cli/src/transport.mjs: EXIT
-  `outcome-unknown-revoked` 1.
- packages/webui/src/serve.mjs: two AGENT_REASONS entries. packages/webui/src/bus.mjs: `OPEN` entry and
-  two STATUS entries.
- Tests:
-  - business lifecycle-settings.test: "row 239 T1", "row 239 T2", "row 239 T3".
-  - bus fire-revokes-grants.test: "row 239 T4", "row 239 T4b".
-  - cli instances.test: "row 239 T5 CLI". cli transport.test: one assertion in "busExit and
-    refuseInsideAgent".
-  - webui agents.test: "row 239 T6".
-  - bus channel-proof.test re-pins packages/cli/src/transport.mjs (662642a8...) and
-    packages/webui/src/bus.mjs (1eba9774...), with a comment on each. Neither changes a proof or the
-    transport. The design's file list missed this. The pin grep found it before the first run.
-### Mutants for the gate (exact-once replacements)
-
- M1 (instance-settings.mjs, beforeWrite before the lock): replace
-  `    const receipt = writer.write(business, next, { revision, actor, context, beforeWrite });` with
-  `    if (beforeWrite) beforeWrite();\n    const receipt = writer.write(business, next, { revision, actor, context });`.
-  The kill is lifecycle-settings "row 239 T1" (the revoke spy has a call).
- M2 (organization.mjs, the fire refusal dropped): delete the line
-  `        if (revision !== before) fail("revision-conflict", "organization revision changed; read again");`.
-  The kill is "row 239 T1" (the write lands over the hand edit).
- M3a (organization.mjs, the mark dropped): `      if (revoked && e instanceof Error) e.revoked = true;`
-  becomes `      void revoked;`. The kills are "row 239 T2" and "row 239 T3" (business). T4 drives the mark
-  through a fake org, so it doesn't see M3a.
- M3b (broker.mjs): delete the line
-  `    if (e.revoked) fail(e.code === "revision-conflict" ? "revision-conflict-revoked" : "outcome-unknown-revoked");`.
-  The kill is fire-revokes-grants "row 239 T4".
- M3c (cli instances.mjs): delete the five lines from `  "revision-conflict-revoked": "the business file`
-  through `    "business file again with \`mosaic business instances\` before trying again",`. The kill is
-  instances.test "row 239 T5 CLI".
- M3d (webui serve.mjs): delete the two lines starting `  'revision-conflict-revoked': 'the business file`
-  and `  'outcome-unknown-revoked': 'the agent\'s tokens`. The kill is agents.test "row 239 T6".
- M3e (broker.mjs): `      const tokens = code.endsWith('-revoked') ? ' Its credential tokens may already be revoked.' : '';`
-  becomes `      const tokens = '';`. The kill is "row 239 T4".
- M3f (webui bus.mjs, C1): the `OPEN` line loses `, 'outcome-unknown-revoked'`. The kill is "row 239 T6"
-  (the launch POST answers 503 outcome-unknown, sent unknown).
- M3g (cli transport.mjs): delete the line `  "outcome-unknown-revoked": 1,`. The kill is transport.test
-  "busExit and refuseInsideAgent".
-
-A kill counts only as a failed assertion in the named test, not a load error or a different test.
-
-### Gate plan (mos-1275 timeouts)
-
- My row 256 gate (2026-10-22 10:34Z, same machine) took 590s for the cli package, 57s for webui and
-  38s for test-foundation, the longest shell script.
- Packages: `timeout -k 10 1800` per package (3x the cli run).
- Each scripts/test-*.sh: `timeout -k 10 300` (more than 3x the 38s longest).
- Single files and mutants: `timeout -k 10 600` per file run (cli instances.test whole is the longest
-  single file).
- Order on Sage's CLEAR: the touched test files whole (business lifecycle-settings, bus
-  fire-revokes-grants and channel-proof, cli instances and transport, webui agents), then M1-M3g, then
-  the full gate.
- Before the in-review move: grep packages/*/tests for the changed comment and error text and for
-  64-hex pins on the changed files, and drift-check BASE..refactor against them.
@@ -1,159 +0,0 @@
-# Row 239 design: the revoke under the writer's lock, and a fire test
-
-Brief: docs/plans/2026-10-20_agent-lifecycle.md, "Brief: row 194 follow-up, the revoke under the writer's
-lock and a fire test" (blob 3b3b3b2b9), from Duckworth's row 194 b3 N1 and mos-1158. Base aca16404c (row
-194 landed as fd6dd327c, row 281 as e479521d3). Builder Honker, reviewer Duckworth, gate owner Sage.
-Draft 1, 2026-10-22.
-
-## Today
-
- `instance-settings.mjs` `commit()` runs the checks, then compares the caller's revision with a fresh
-  `writer.read` (row 194 b3, sage-1634), then calls `beforeWrite` (the fire's or the delete's credential
-  revoke), then `writer.write`.
- `writer.write` (`organization.mjs`) takes the lock, runs `recover`, checks the revision again (`:188`),
-  validates, prepares, checks the bytes once more before publication (`:221`), renames and commits.
- So two windows are left.
-  - A write that lands between `commit()`'s read and the writer's lock still gets a revoke and then a
-    `revision-conflict`.
-  - Any refusal after the revoke ran (the `:221` check, or an I/O failure the bus reports as
-    `outcome-unknown`) uses the same text as one before it, so nothing says the tokens may be gone.
- Row 281 left this path alone. Its fire job (`broker.mjs` `#fireJob`) runs step G (grants), then step B,
-  which is this same `write('instance.fire')`, and reports a step B failure as `fire.failed` along with a
-  human notice that names the code. Its delete job only does step G. The delete itself still commits
-  through `lifecycleDelete` → `instances.set` op delete → `commit()`.
-
-## What changes
-
-### 1. `beforeWrite` runs inside `writer.write`, under the lock (organization.mjs)
-
-`write(id, document, { revision, actor, detail, context, beforeWrite = null })`. The order under the lock:
-
-1. `recover`, read, then the `:188` revision check. A refusal here revokes nothing.
-2. Projects-protected and both validations. A refusal here revokes nothing either. I put `beforeWrite`
-   after these rather than straight after `:188`, so a document the writer would refuse anyway never
-   costs a revoke. Q1 asks Duckworth to confirm this.
-3. `beforeWrite()`. If it throws (today `credential-revoke-failed`), the error propagates as it is and
-   nothing has been written, as now.
-4. Prepare, the `:221` check, rename and commit, wrapped so that any error thrown after step 3 gets
-   `revoked = true` set on it before it is rethrown. That covers `revision-conflict` from `:221`, an
-   `organization-refused` from `log()`, a barrier throw, and an fs error.
-
-`record()` and the other writers (`launch-settings`, `plugin-settings`, `credentialVerbs`) pass no
-`beforeWrite` and behave as before.
-
-### 2. commit() passes beforeWrite through (instance-settings.mjs)
-
-`commit()` passes `beforeWrite` to `writer.write` and no longer calls it itself. The row 194 b3 early check
-stays. It costs one read, keeps T21's refusal before any validation work, and is no longer what protects
-the revoke. Its comment is rewritten to say so, and the "(BUILD.md follow-up)" sentence goes.
-
-`instanceSettings({ ..., writer = organizationWriter({ dir, rolesDir }) })` takes an optional writer, so a
-test can inject one (the brief's "injected writer"). `runtime.mjs` passes none.
-
-### 3. The bus names a refusal after a revoke (broker.mjs `#organizationFail`)
-
-The bus answers with a code only, and the CLI and Console look the text up by code. So the "may already be
-revoked" signal has to be a code. Two new codes:
-
- `revision-conflict-revoked`: `e.revoked && e.code === 'revision-conflict'`.
- `outcome-unknown-revoked`: `e.revoked` with any other code. The write may or may not have landed, since a
-  failure after the rename is recovered as committed.
-
-Both are checked before the existing mappings. An error without `revoked` maps exactly as today, so a
-refusal before any revoke keeps today's code and text. Q2 asks about the names.
-
-### 4. The texts
-
- CLI `instances.mjs` REASONS:
-  - `revision-conflict-revoked`: "the business file changed before the write, after the agent's tokens
-    were revoked; the tokens may already be revoked and the instance can't use them; read the instances
-    again and run the same command again, which is safe".
-  - `outcome-unknown-revoked`: "the write's outcome is unknown and the agent's tokens may already be
-    revoked; read the instances before trying again".
- Console `serve.mjs` AGENT_REASONS: the same two, in the Console's wording ("delete again").
- `#fireJob`'s `fire.failed` notice: when the code ends in `-revoked`, it adds "Its credential tokens may
-  already be revoked." The chief's synchronous fire (no grants) answers with the code, as every chief verb
-  does.
- `transport.mjs` EXIT: `outcome-unknown-revoked` exits 1, as `outcome-unknown` does. Console
-  `bus.mjs` STATUS: `revision-conflict-revoked` 409, `outcome-unknown-revoked` 503. A delete's code
-  reaches both as a closed request's `refusal`, so these two only matter for a direct verb answer.
-
-## Tests
-
- **T1, the brief's fire test** (business `instance-settings.test.mjs`). The fire uses an injected writer
-  that wraps the real one. Its `write` makes one hand edit of the business file (a vars change on another
-  instance) and then calls the real `write`, so the edit lands after `commit()`'s early check and before
-  the lock's `:188` check. Expected:
-  - the fire refuses `revision-conflict` without `revoked`;
-  - the revoke spy has no calls;
-  - the business file's bytes are the hand edit's;
-  - changes.jsonl has no new prepared entry.
- **T2** (same file). A fire on a real writer built with `barrier: stage => stage === 'prepared' && edit()`.
-  The revoke runs, then `:221` refuses. Expected: `revision-conflict` with `revoked === true`, one revoke
-  call, the file's bytes are the edit's, and the last receipt is `aborted`.
- **T3** (same file). The same, with a `prepared` barrier that throws. Expected: the error has
-  `revoked === true`, one revoke call, and the file unchanged. A delete through the same writer gives the
-  same result (T3b).
- **T4** (bus `fire-revokes-grants.test.mjs`, its injected `f.org`). `f.org.fireError` is a
-  `revision-conflict` with `revoked: true`. Expected:
-  - the job's `fire.failed` carries `revision-conflict-revoked`, and the inbox message says "may already
-    be revoked";
-  - the same with no `grants` (the synchronous fire) refuses `revision-conflict-revoked`;
-  - a plain `revision-conflict` still maps to `revision-conflict` and the message lacks the sentence.
-  - T4b: `outcome-unknown-revoked` for an fs-style error with `revoked`.
- **T5** (cli `lifecycle.test.mjs` or `instances.test.mjs`, whichever already reads a closed delete's
-  refusal). A delete closed with `revision-conflict-revoked` prints the new text, and one closed with
-  `revision-conflict` prints today's.
- **T6** (webui `agents.test.mjs`). The same pair for the Console's reason.
- T21 (bus `lifecycle-revoke.test.mjs`) stays as it is, for delete.
-
-## Mutants
-
-| Mutant | Change | Killed by |
-| --- | --- | --- |
-| M1 | `beforeWrite` before the lock: `commit()` calls `beforeWrite()` itself and passes none to `write` | T1 (the revoke spy has a call) |
-| M2 | The fire refusal dropped: the `:188` revision check removed | T1 (the write lands over the hand edit) |
-| M3a | The mark dropped: no `revoked = true` in the catch | T2, T3, and T4 through the codes |
-| M3b | `#organizationFail` ignores `revoked` | T4 |
-| M3c | CLI text: the two REASONS entries removed | T5 |
-| M3d | Console text: the two AGENT_REASONS entries removed | T6 |
-| M3e | The notice: the `fire.failed` sentence removed | T4 |
-
-M3a-M3e together are the brief's "drop the may already be revoked text".
-
-## Files
-
- `packages/business/src/organization.mjs`
- `packages/business/src/instance-settings.mjs`
- `packages/business/tests/instance-settings.test.mjs`
- `packages/bus/src/broker.mjs`
- `packages/bus/tests/fire-revokes-grants.test.mjs`
- `packages/cli/src/instances.mjs`
- `packages/cli/src/transport.mjs`
- one cli test file
- `packages/webui/src/serve.mjs`
- `packages/webui/src/bus.mjs`
- `packages/webui/tests/agents.test.mjs`
- This packet.
-
-## Gate
-
-As the brief says:
-
- Duckworth approves the manifest.
- The bus, business, cli and webui suites and every `scripts/test-*.sh` are green on Sage's slot, with
-  the touched test files run whole.
- M1-M3e are killed.
-
-Before the in-review move I grep the tests for the changed comment and error text, and for hash pins on the
-changed files.
-
-## Questions for Duckworth
-
- **Q1.** Should `beforeWrite` run after the writer's validations (my pick) or straight after `:188` (the
-  brief's literal place)? Running it later means a document the writer would refuse revokes nothing.
- **Q2.** Are two new codes, `revision-conflict-revoked` and `outcome-unknown-revoked`, the right way to
-  carry the signal? The alternative is to give `BusError` a detail field, which every CLI and Console
-  reader would then have to learn. The codes are additive and no existing code changes meaning.
- **Q3.** The brief's mutant "drop the fire refusal": I read it as removing the `:188` check (M2). If you
-  meant the fire test's own refusal, say so and I'll redefine it.
@@ -166,8 +166,37 @@ resolved through the CLI.
 | `scripts/test-conductor.sh` | Auto-apply selftests (sandboxed) | 17 cases |
 | `scripts/test-auth.sh` | Auth checkpoint selftests (no Docker) | 13 cases |
 | `scripts/test-land-work.sh` | Land-work selftests (sandboxed, fake Docker) | 84 cases |
+| `scripts/test-git-guard.sh` | Push guard, its installer and `slot-busy.sh` (scratch bare remote, fake `/proc`) | 61 cases |
+| `scripts/install-git-hooks.sh [--repo DIR] [--force-install]` | Install the push guard as `pre-push` in the common `.git/hooks` | Refuses a set `core.hooksPath` or a different installed hook; exit 0 ok · 1 failed · 2 refused · 4 usage |
+| `scripts/slot-busy.sh` | Busy check: one `BUSY` line per gate or test process, or `CLEAR` | Exit 0 CLEAR · 1 BUSY · 2 error; chain on the exit code |
 | `scripts/gitea-api.sh <METHOD> <path> [body]` | Gitea API helper; reads the JSON credential file or a raw per-seat token file | Token never on argv/stdout |

+### Push guard and busy check (row 211, #426)
+
+`scripts/git-hooks/pre-push` refuses a push that deletes a branch, or that
+moves a branch to a commit that doesn't descend from the remote tip (a
+`--force`, `--force-with-lease` or `+refspec` push of a rewritten branch). A
+new branch and a fast-forward pass. The hook fetches nothing: when the remote
+tip isn't in the local repository it refuses and says to fetch first.
+`git push --no-verify` skips it, so Gitea's branch protection (ops-01) is the
+guard that holds. `scripts/install-git-hooks.sh` copies it into the common
+`.git/hooks`, which every worktree of the checkout shares, then runs a canary
+through `git hook run`. Installing it in the canonical checkout is a step for
+the lead after the row lands.
+
+Chain the busy check on its exit code, and set `pipefail` in any script that
+pipes it:
+
+```bash
+bash scripts/slot-busy.sh > "$LOG" && gate
+```
+
+Never `bash scripts/slot-busy.sh | tail -1 && gate`: `tail` exits 0, so the
+gate runs while BUSY. It matches `node ... --test`, a `*gate*.sh`, `mutant`, a
+`test-*.sh` and `docker compose` command lines, skips itself, its ancestors
+and agent shell-snapshot wrappers, and reads only `/proc/<pid>/cmdline` and
+the cwd link.
+
 ## Seat launch with registration (`scripts/mosaic`)

 ```bash
@@ -1947,13 +1947,11 @@ export class Broker {
    } catch (e) {
      const code = e instanceof BusError ? e.code : 'outcome-unknown';
      const list = out.grants.map((g) => g.grant).join(', ') || 'none';
-      // Row 239 (#1745): a step B refusal after the writer's revoke ran.
-      const tokens = code.endsWith('-revoked') ? ' Its credential tokens may already be revoked.' : '';
      this.#store.transaction(() => {
        this.#event(sc, 'action.allowed', { action: 'fire.failed', job, step, code }, name);
        this.#humanNotice(
          sc.business,
-          `Fire of ${name}: job ${job} revoked its grants (${list}) but stopped at step ${step} (${code}).${tokens} The instance is still firing. Run the fire again once ${code} is cleared.`,
+          `Fire of ${name}: job ${job} revoked its grants (${list}) but stopped at step ${step} (${code}). The instance is still firing. Run the fire again once ${code} is cleared.`,
        );
      });
    }
@@ -4407,9 +4405,6 @@ export class Broker {
  // The bus code for an organization writer's refusal. Anything the writer didn't refuse by name is
  // outcome-unknown: the write may have committed.
  #organizationFail(e, verb) {
-    // Row 239 (#1745): the writer marks an error raised after a fire's or a delete's revoke ran, so
-    // the human reads that the tokens may already be revoked. Without the mark, today's code.
-    if (e.revoked) fail(e.code === "revision-conflict" ? "revision-conflict-revoked" : "outcome-unknown-revoked");
    if (e.code === "revision-conflict") fail("revision-conflict");
    if (e.code?.startsWith("organization-")) fail(e.code);
    if (e.code === "invalid-plugins" || e.code === "unknown-plugin") fail(e.code);
@@ -148,11 +148,11 @@ export async function startBroker({
    const levels=organization?await harnessLevels():()=>null;
    const settings=organization?launchSettings({...organization,sessions:()=>readSessions(dataRoot),levels}):null;
    // Row 194 (#1692, brief item 8, row 199 D13): a fire or a delete revokes the agent's credentials
-    // after the writer's checks and before its write, under the writer's lock (row 239). Fire revokes
-    // each service of the entry and keeps the store directory, delete calls remove (sage-1593). A
-    // service the running bus doesn't know (an agent created since the start) has nothing in memory,
-    // so it goes on, and then no token or tmp file may remain in the agent's store directory
-    // (sage-1592). Any failure stops the verb with the file unchanged.
+    // after the writer's checks and before its write. Fire revokes each service of the entry and keeps
+    // the store directory, delete calls remove (sage-1593). A service the running bus doesn't know (an
+    // agent created since the start) has nothing in memory, so it goes on, and then no token or tmp
+    // file may remain in the agent's store directory (sage-1592). Any failure stops the verb with the
+    // file unchanged.
    const revokeFailed = (message) => new OrganizationError('credential-revoke-failed', message);
    function revoke(business, agent, how, services) {
      const instance = business + '/' + agent;
@@ -17,8 +17,7 @@ import { Client } from "../src/client.mjs";
 const baselines = {
 "packages/bus/src/human.mjs": "0c6d96abe4607cba0b02b0638a2fc217ff8135bac9a47761a0ef015fbe9d3079",
 "packages/bus/src/human-cli.mjs": "271b9781d73cf31cc562a56180e3ebcd725b5fde148a83347a201fdef2fc28af",
- // Row 239 (#1745): EXIT outcome-unknown-revoked 1; no proof or transport change.
- "packages/cli/src/transport.mjs": "662642a8ce739fcb6c188ad07125a94e008c8a305eced127c8041d472c56e55b",
+ "packages/cli/src/transport.mjs": "5129c44b4d9f642e825344df65c9bfb4bac4fc8d6b25343b42d39853dbd40774",
 // Row 165 (#1662): seven STATUS entries for the role instance routes (organization-instance-exists,
 // organization-unknown-instance, organization-credentials-out-of-scope, organization-launch-not-configured,
 // organization-no-change, organization-project-mismatch, organization-unresolvable-instance), no proof or
@@ -26,9 +25,7 @@ const baselines = {
 // Row 171 (#1668): project-name-is-repo maps to 409; no proof or transport change.
 // Row 194 (#1692, brief item 7, sage-1610 a): organization-tracker-required 400 and
 // organization-tracker-bot-taken 409; no proof or transport change.
- // Row 239 (#1745): outcome-unknown-revoked joins OPEN (duckworth-0165 C1), and STATUS gets
- // revision-conflict-revoked 409 and outcome-unknown-revoked 503; no proof or transport change.
- "packages/webui/src/bus.mjs": "1eba977443b3e308dbc5b08567b11e1059bb238a5f57939c6917dd775156e5cf",
+ "packages/webui/src/bus.mjs": "15e8123ffdbb6d067e8a516f5823efdb5de3c869963764f27cd14bb9e4ce3313",
 };
 const repoFile = path => new URL("../../../" + path, import.meta.url);

@@ -133,9 +133,8 @@ async function setup(t) {
    },
  };
  // The fake organization writer. A fire delists the name and a delete drops the role, each with a
-  // reload, as the runtime reloads after a commit. `fireError` makes the fire's write refuse, and
-  // `deleteError` the delete's (row 239).
-  const org = { log: [], fireError: null, deleteError: null };
+  // reload, as the runtime reloads after a commit. `fireError` makes the fire's write refuse.
+  const org = { log: [], fireError: null };
  const sw = { state: { version: 1, halted: false, generation: GENERATION } };
  let broker;
  const organization = (business, op, args) => {
@@ -147,7 +146,6 @@ async function setup(t) {
      return { revision: REV, transaction: 't-' + org.log.length };
    }
    if (op === 'instances.set') {
-      if (org.deleteError) throw org.deleteError;
      delete doc.roles[args.instance];
      doc.launch.instances = doc.launch.instances.filter((n) => n !== args.instance);
      broker.reloadBusiness('demo', doc);
@@ -954,44 +952,3 @@ test("row 281 T14 (N1, sage-2653): a host removed under an undecided decision st
  assert.ok(!f.doc.launch.instances.includes('coder'));
  assert.equal(f.grantEvents().filter((e) => e.action === 'grant.revoke.refused').length, 1);
 });
-
-// Row 239 (#1745): the writer marks an error raised after its own revoke ran (revoked: true), and the
-// bus names it, so the human reads that the tokens may already be revoked. Unmarked, today's code.
-test("row 239 T4: a refusal after the writer's revoke is named -revoked, in the job's fire.failed and notice, a synchronous fire and a delete", async (t) => {
-  const f = await setup(t);
-  await f.approveHost('coder', 'web1');
-  f.org.fireError = Object.assign(new Error('refused'), { code: 'revision-conflict', revoked: true });
-  const out = f.fire('coder');
-  await f.broker.grantsIdle();
-  const [failed] = f.allowed('fire.failed');
-  assert.deepEqual([failed.body.job, failed.body.step, failed.body.code], [out.job, 'B', 'revision-conflict-revoked']);
-  const [message] = f.inbox();
-  assert.ok(message.includes('(revision-conflict-revoked). Its credential tokens may already be revoked. The instance is still firing.'), message);
-  // helper has no grant, so its fire writes synchronously and answers with the code.
-  await rejects(() => f.fire('helper'), 'revision-conflict-revoked');
-  // Any other marked error: the write may have landed.
-  f.org.fireError = Object.assign(new Error('EIO: i/o error'), { code: 'EIO', revoked: true });
-  await rejects(() => f.fire('helper'), 'outcome-unknown-revoked');
-  f.org.fireError = Object.assign(new Error('refused'), { code: 'revision-conflict' });
-  await rejects(() => f.fire('helper'), 'revision-conflict');
-  f.org.fireError = null;
-  f.org.deleteError = Object.assign(new Error('refused'), { code: 'revision-conflict', revoked: true });
-  assert.equal(f.remove('helper').code, 'revision-conflict-revoked');
-  f.org.deleteError = Object.assign(new Error('EIO: i/o error'), { code: 'EIO', revoked: true });
-  assert.equal(f.remove('helper').code, 'outcome-unknown-revoked');
-  f.org.deleteError = Object.assign(new Error('refused'), { code: 'revision-conflict' });
-  assert.equal(f.remove('helper').code, 'revision-conflict');
-});
-
-test("row 239 T4b: an unmarked step B refusal keeps its code, and the notice says nothing of the tokens", async (t) => {
-  const f = await setup(t);
-  await f.approveHost('coder', 'web1');
-  f.org.fireError = Object.assign(new Error('refused'), { code: 'revision-conflict' });
-  const out = f.fire('coder');
-  await f.broker.grantsIdle();
-  const [failed] = f.allowed('fire.failed');
-  assert.deepEqual([failed.body.job, failed.body.code], [out.job, 'revision-conflict']);
-  const [message] = f.inbox();
-  assert.ok(message.includes('(revision-conflict). The instance is still firing.'), message);
-  assert.ok(!message.includes('may already be revoked'), message);
-});
@@ -144,8 +144,9 @@ function createdCredentials(old, instance, definition, args) {
 // checkRoutes, row 65). Row 194 (brief item 8, row 199 D13): revoke(business, instance, how,
 // services) revokes the instance's credentials for a fire or a delete and throws
 // credential-revoke-failed when it can't. Null in a writer with no bus (the CLI's), which revokes
-// nothing. Row 239 (#1745): writer is the organization writer, injected only by tests.
-export function instanceSettings({ dir, rolesDir, system, levels = () => null, revoke = null, writer = organizationWriter({ dir, rolesDir }) }) {
+// nothing.
+export function instanceSettings({ dir, rolesDir, system, levels = () => null, revoke = null }) {
+  const writer = organizationWriter({ dir, rolesDir });

  // The definitions in rolesDir and whether add and set accept each one.
  function definitions() {
@@ -378,9 +379,8 @@ export function instanceSettings({ dir, rolesDir, system, levels = () => null, r
    }
  }

-  // The checks every write runs, then the write, which runs beforeWrite (a fire's or a delete's
-  // revoke) under its lock (row 239). A check that refuses revokes nothing, and a revoke that throws
-  // writes nothing. beforeWrite must not write this business: the writer holds its lock.
+  // The checks every write runs, then beforeWrite (a fire's or a delete's revoke), then the write. A
+  // check that refuses revokes nothing, and a revoke that throws writes nothing.
  function commit(business, old, next, { revision, actor, context, beforeWrite = null }) {
    if (canonicalJson(next) === canonicalJson(old)) throw new OrganizationError("organization-no-change");

@@ -410,11 +410,12 @@ export function instanceSettings({ dir, rolesDir, system, levels = () => null, r
      }
    }
    // Row 194 N1 (sage-1634): a delete writes on the revision its request read when it was raised,
-    // so a write since then makes it stale. This early check refuses it without taking the lock. The
-    // writer checks again under its lock, before the revoke (row 239), and that check is what keeps
-    // a stale fire or delete from revoking.
+    // so a write since then makes it stale. The revision is checked here, before the revoke, because
+    // the writer's own check comes after it. A write between this read and the writer's lock still
+    // revokes and then refuses (BUILD.md follow-up).
    if (writer.read(business).revision !== revision) throw new OrganizationError("revision-conflict", "organization revision changed; read again");
-    const receipt = writer.write(business, next, { revision, actor, context, beforeWrite });
+    if (beforeWrite) beforeWrite();
+    const receipt = writer.write(business, next, { revision, actor, context });
    return { ...read(business, actor), transaction: receipt.transaction, restart: false };
  }

@@ -177,70 +177,55 @@ export function organizationWriter({ dir, rolesDir, barrier = () => {} }) {
  // Row 199 (#1697, design section 6): `detail` says what a credential verb did (verb, agent, kind,
  // date, reason), never a value; the other setters pass none. context, when given, is logged with
  // the change: row 194's hire and fire carry the chief's run and the decision there (D2.2).
-  // Row 239 (#1745): beforeWrite (a fire's or a delete's credential revoke) runs under the lock,
-  // after the revision check and the validations, so a refusal there revokes nothing. An error
-  // after it returns carries revoked: true, the lock's release included (duckworth-0165 C2), and the
-  // bus names it so the human reads that the tokens may already be revoked. beforeWrite must not
-  // write this business itself: it would find its own lock and refuse organization-busy.
-  function write(id, document, { revision, actor, detail, context, beforeWrite = null }) {
+  function write(id, document, { revision, actor, detail, context }) {
    requireId(actor, "authenticated actor");
    requireId(id, "organization id");
-    let revoked = false;
-    try {
-      return withLock(id, ({ home, parent }) => {
-        recover(id);
-        const file = businessFilePath(id, dir);
-        const oldBytes = regular(file);
-        const before = sha256(oldBytes);
-        if (revision !== before) fail("revision-conflict", "organization revision changed; read again");
-        const old = JSON.parse(oldBytes);
-        // C2-04 M9: every organization setter preserves the whole project
-        // mapping, including library playgrounds and hybrid universes.
-        if (canonicalJson(document?.projects) !== canonicalJson(old.projects))
-          fail('organization-projects-protected');
-        validateBusinessDocument(document, file, { rolesDir });
-        const bytes = JSON.stringify(document, null, 2) + "\n";
-        // Check and log exactly what lands on disk, for every setter: a value JSON
-        // can't carry (a Date, a Map) serializes as something else (row 131, sage-0314).
-        const written = JSON.parse(bytes);
-        if (canonicalJson(written.projects) !== canonicalJson(old.projects))
-          fail('organization-projects-protected');
-        validateBusinessDocument(written, file, { rolesDir });
-        if (beforeWrite) {
-          beforeWrite();
-          revoked = true;
-        }
-        const after = sha256(bytes);
-        const transaction = randomUUID();
-        const tx = join(home, transaction);
-        directory(tx);
-        const previous = join(tx, "previous.json");
-        durable(previous, oldBytes);
-        const candidate = join(parent, "." + id + "." + transaction + ".tmp");
-        durable(candidate, bytes);
-        syncDir(tx);
-        const event = {
-          transaction, actor, ...(context === undefined ? {} : { context }), business: id, before, after,
-          changes: changes(old, written), ...(detail === undefined ? {} : { detail }), at: new Date().toISOString(),
-        };
-        log(id, { ...event, state: "prepared" });
-        syncDir(home);
-        barrier("prepared");
-        if (sha256(regular(file)) !== before) {
-          log(id, { ...event, state: "aborted" });
-          rmSync(candidate);
-          fail("revision-conflict", "organization revision changed before publication");
-        }
-        renameSync(candidate, file);
-        syncDir(parent);
-        barrier("renamed");
-        log(id, { ...event, state: "committed" });
-        return { revision: after, transaction, previous };
-      });
-    } catch (e) {
-      if (revoked && e instanceof Error) e.revoked = true;
-      throw e;
-    }
+    return withLock(id, ({ home, parent }) => {
+      recover(id);
+      const file = businessFilePath(id, dir);
+      const oldBytes = regular(file);
+      const before = sha256(oldBytes);
+      if (revision !== before) fail("revision-conflict", "organization revision changed; read again");
+      const old = JSON.parse(oldBytes);
+      // C2-04 M9: every organization setter preserves the whole project
+      // mapping, including library playgrounds and hybrid universes.
+      if (canonicalJson(document?.projects) !== canonicalJson(old.projects))
+        fail('organization-projects-protected');
+      validateBusinessDocument(document, file, { rolesDir });
+      const bytes = JSON.stringify(document, null, 2) + "\n";
+      // Check and log exactly what lands on disk, for every setter: a value JSON
+      // can't carry (a Date, a Map) serializes as something else (row 131, sage-0314).
+      const written = JSON.parse(bytes);
+      if (canonicalJson(written.projects) !== canonicalJson(old.projects))
+        fail('organization-projects-protected');
+      validateBusinessDocument(written, file, { rolesDir });
+      const after = sha256(bytes);
+      const transaction = randomUUID();
+      const tx = join(home, transaction);
+      directory(tx);
+      const previous = join(tx, "previous.json");
+      durable(previous, oldBytes);
+      const candidate = join(parent, "." + id + "." + transaction + ".tmp");
+      durable(candidate, bytes);
+      syncDir(tx);
+      const event = {
+        transaction, actor, ...(context === undefined ? {} : { context }), business: id, before, after,
+        changes: changes(old, written), ...(detail === undefined ? {} : { detail }), at: new Date().toISOString(),
+      };
+      log(id, { ...event, state: "prepared" });
+      syncDir(home);
+      barrier("prepared");
+      if (sha256(regular(file)) !== before) {
+        log(id, { ...event, state: "aborted" });
+        rmSync(candidate);
+        fail("revision-conflict", "organization revision changed before publication");
+      }
+      renameSync(candidate, file);
+      syncDir(parent);
+      barrier("renamed");
+      log(id, { ...event, state: "committed" });
+      return { revision: after, transaction, previous };
+    });
  }

  // Row 199: a receipt with no document change, for a credential verb that changes only the agents'
@@ -4,10 +4,9 @@
 import test, { after } from "node:test";
 import assert from "node:assert/strict";
 import { spawnSync } from "node:child_process";
-import { existsSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { readFileSync, rmSync } from "node:fs";
 import { join } from "node:path";
 import { instanceSettings } from "../src/instance-settings.mjs";
-import { OrganizationError, organizationWriter } from "../src/organization.mjs";
 import { CREATIVE_DEFINITIONS } from "../src/vocabulary.mjs";
 import { businessDoc, REPO, rolesCopy, systemConfig, systemFor, tmp, writeJson } from "./helpers.mjs";

@@ -37,7 +36,7 @@ function fixture(mutate) {
  const log = () => readFileSync(settings.writer.logFile("acme"), "utf8").trim().split("\n").map(line => JSON.parse(line));
  const onDisk = () => JSON.parse(readFileSync(file, "utf8"));
  const revision = () => settings.read("acme").revision;
-  return { root, dir, rolesDir, file, settings, validate, log, onDisk, revision };
+  return { root, file, settings, validate, log, onDisk, revision };
 }

 // Each refusal: its code (or the validator's BusinessError), and the file's bytes unchanged.
@@ -245,73 +244,3 @@ test("row 256 checkDelete passes the human's creative delete and refuses another
  assert.throws(() => f.settings.checkFire("acme", "bean"), e => e.code === "organization-definition-refused");
  assert.equal(readFileSync(f.file, "utf8"), bytes);
 });
-
-// Row 239 (#1745): a fire's or a delete's revoke runs inside the writer, under its lock, after the
-// revision check. revoking(f, writer, fail) builds settings on f's files with a spy revoke and that writer.
-function revoking(f, writer, fail = null) {
-  const calls = [];
-  const revoke = (business, agent, how, services) => {
-    calls.push([business, agent, how, services]);
-    if (fail) throw fail;
-  };
-  const settings = instanceSettings({ dir: f.dir, rolesDir: f.rolesDir, system: systemFor(f.root), revoke, ...(writer ? { writer } : {}) });
-  return { settings, calls };
-}
-const receipts = f => (existsSync(f.settings.writer.logFile("acme")) ? f.log() : []);
-// A hand edit: the same document in other bytes, so the revision changes and the file still validates.
-const handEdit = f => {
-  const bytes = JSON.stringify(f.onDisk()) + "\n";
-  writeFileSync(f.file, bytes);
-  return bytes;
-};
-
-test("row 239 T1 a fire on a revision that goes stale before the writer's lock refuses there and revokes nothing", () => {
-  const f = fixture();
-  const real = organizationWriter({ dir: f.dir, rolesDir: f.rolesDir });
-  let edited = null;
-  // The edit lands after commit()'s early check and before the writer takes its lock.
-  const writer = { ...real, write: (id, document, options) => { edited = handEdit(f); return real.write(id, document, options); } };
-  const { settings, calls } = revoking(f, writer);
-  const before = receipts(f).length;
-  assert.throws(() => settings.fire("acme", { name: "sec-1" }, { actor: "chief", context: CONTEXT }),
-    e => e.code === "revision-conflict" && e.revoked === undefined);
-  assert.deepEqual(calls, []);
-  assert.equal(readFileSync(f.file, "utf8"), edited);
-  assert.equal(receipts(f).length, before);
-});
-
-test("row 239 T2 a write after the revoke refused before publication carries revoked, and the file keeps the edit", () => {
-  const f = fixture();
-  let edited = null;
-  const writer = organizationWriter({ dir: f.dir, rolesDir: f.rolesDir, barrier: stage => { if (stage === "prepared") edited = handEdit(f); } });
-  const { settings, calls } = revoking(f, writer);
-  assert.throws(() => settings.fire("acme", { name: "sec-1" }, { actor: "chief", context: CONTEXT }),
-    e => e.code === "revision-conflict" && e.revoked === true);
-  assert.deepEqual(calls, [["acme", "sec-1", "fire", []]]);
-  assert.equal(readFileSync(f.file, "utf8"), edited);
-  assert.equal(receipts(f).at(-1).state, "aborted");
-});
-
-test("row 239 T3 any error after the revoke carries revoked, for a fire and a delete; a revoke that throws carries nothing", () => {
-  for (const [how, act] of [
-    ["fire", settings => settings.fire("acme", { name: "sec-1" }, { actor: "chief", context: CONTEXT })],
-    ["delete", (settings, f) => settings.set("acme", { revision: f.revision(), instance: "sec-1", op: "delete" }, "jason")],
-  ]) {
-    const f = fixture();
-    const bytes = readFileSync(f.file, "utf8");
-    const writer = organizationWriter({ dir: f.dir, rolesDir: f.rolesDir, barrier: stage => { if (stage === "prepared") throw new Error("stopped at prepared"); } });
-    const { settings, calls } = revoking(f, writer);
-    assert.throws(() => act(settings, f), e => e.message === "stopped at prepared" && e.revoked === true, how);
-    assert.equal(calls.length, 1, how);
-    assert.equal(calls[0][2], how);
-    assert.equal(readFileSync(f.file, "utf8"), bytes, how);
-
-    const g = fixture();
-    const gBytes = readFileSync(g.file, "utf8");
-    const failing = revoking(g, null, new OrganizationError("credential-revoke-failed"));
-    assert.throws(() => act(failing.settings, g), e => e.code === "credential-revoke-failed" && e.revoked === undefined, how);
-    assert.equal(failing.calls.length, 1, how);
-    assert.equal(readFileSync(g.file, "utf8"), gBytes, how);
-    assert.deepEqual(receipts(g), [], how);
-  }
-});
@@ -55,12 +55,6 @@ export const REASONS = {
  "credential-revoke-failed": "a credential couldn't be revoked, so the business file is unchanged; tokens already revoked " +
    "stay revoked and the instance can't use them; clear what else the agent's store directory holds and run the same " +
    "command again, which is safe",
-  // Row 239 (#1745): a fire's or a delete's revoke runs under the writer's lock; these follow one that ran.
-  "revision-conflict-revoked": "the business file changed after the agent's tokens were revoked and before the write, so " +
-    "the file is unchanged; the tokens may already be revoked and the instance can't use them; read it again with " +
-    "`mosaic business instances` and run the same command again, which is safe",
-  "outcome-unknown-revoked": "the agent's tokens may already be revoked and the write's outcome is unknown; read the " +
-    "business file again with `mosaic business instances` before trying again",
  "capacity-full": "a launch limit is reached; `mosaic limits --business BUSINESS` shows them",
  "limit-reached": "a launch limit is reached; `mosaic limits --business BUSINESS` shows them",
  "unknown-role": "the business has no such instance",
@@ -42,7 +42,6 @@ const EXIT = {
  "tester-off": 3,
  "tester-refused": 3,
  "outcome-unknown": 1,
-  "outcome-unknown-revoked": 1,
  "response-too-large": 1,
  "invalid-response": 1,
 };
@@ -316,28 +316,6 @@ test("row 194 CLI V5: delete polls to the transaction and the read lists the nam
  assert.match(failed.err, new RegExp(`^mosaic: workspace-rename-failed: .*run the same delete again to retry the rename \\(request [^,]+, transaction ${s.log().at(-1).transaction}\\)$`, "m"));
 });

-// Row 239 (#1745): a fire's or a delete's revoke runs under the writer's lock. A delete closed after
-// that revoke ran says the tokens may already be revoked; a plain revision-conflict keeps its text.
-test("row 239 T5 CLI: a delete closed -revoked says the tokens may already be revoked; a plain revision-conflict doesn't", async (t) => {
-  let refusal = "revision-conflict-revoked";
-  const s = await setup(t, { hook: closing(() => ({ refusal })) });
-  const added = await s.mosaic(["instance", "add", "acme", "sec-1", "--definition", "security-reviewer", "--revision", await s.revision()]);
-  assert.equal(added.code, 0, added.err);
-  const del = async () => s.mosaic(["instance", "delete", "acme", "sec-1", "--revision", await s.revision()]);
-  let r = await del();
-  assert.equal(r.code, 3, r.err);
-  assert.match(r.err, /^mosaic: revision-conflict-revoked: the business file changed after the agent's tokens were revoked .*; the tokens may already be revoked .*which is safe \(request [^)]+\)$/m);
-  refusal = "outcome-unknown-revoked";
-  r = await del();
-  assert.equal(r.code, 3, r.err);
-  assert.match(r.err, /^mosaic: outcome-unknown-revoked: the agent's tokens may already be revoked and the write's outcome is unknown; .* \(request [^)]+\)$/m);
-  refusal = "revision-conflict";
-  r = await del();
-  assert.equal(r.code, 3, r.err);
-  assert.match(r.err, /^mosaic: revision-conflict: the business file changed since that revision; .* \(request [^)]+\)$/m);
-  assert.doesNotMatch(r.err, /may already be revoked/);
-});
-
 test("row 194 CLI: lifecycle and veto usage errors exit 4 before any bus call", async (t) => {
  const s = await setup(t);
  const rev = "a".repeat(64);
@@ -45,8 +45,6 @@ test("a bus code on stderr becomes the exit code; garbage and timeouts are outco
 test("busExit and refuseInsideAgent", () => {
  assert.equal(busExit("unauthenticated"), 3);
  assert.equal(busExit("invalid-request"), 2);
-  // Row 239 (#1745): a write whose outcome is unknown after its revoke exits as outcome-unknown does.
-  assert.equal(busExit("outcome-unknown-revoked"), 1);
  assert.doesNotThrow(() => refuseInsideAgent(humanEnv()));
  assert.throws(() => refuseInsideAgent({ PI_AGENT_DIR: "/x" }), (e) => e.exitCode === 3 && /PI_AGENT_DIR/.test(e.message));
 });
@@ -75,8 +75,7 @@ export const busReader = options => views({ call: busCaller(options) });
 // A send's error, sorted. The broker writes in one transaction, so any code it
 // returns means nothing was written. A transport that lost the answer, or an
 // answer that can't be read, leaves the outcome open: the message may exist.
-// Row 239 (duckworth-0165 C1): so does a write that failed after its revoke.
-const OPEN = ['outcome-unknown', 'invalid-response', 'response-too-large', 'outcome-unknown-revoked'];
+const OPEN = ['outcome-unknown', 'invalid-response', 'response-too-large'];
 export function sendOutcome(err) {
  const code = err instanceof BusReadError ? err.code : 'outcome-unknown';
  return OPEN.includes(code) ? { code: 'outcome-unknown', sent: 'unknown' } : { code, sent: false };
@@ -88,8 +87,6 @@ const STATUS = {
  'human-required': 403, 'peercred-required': 403, unauthenticated: 403, 'unknown-business': 403, 'read-only': 403,
  'outcome-unknown': 503, 'no-bus-host': 503, 'not-configured': 503,
  'revision-conflict':409,'organization-busy':409,'organization-uncertain':503,
-  // Row 239 (#1745): a fire's or a delete's write refused after its revoke ran.
-  'revision-conflict-revoked': 409, 'outcome-unknown-revoked': 503,
  'invalid-request': 400, 'unknown-role': 400, 'message-not-found': 400, 'request-too-large': 400,
  // Row 148: the spec and docs editor. A stale base, a busy or dirty repository and an unchanged
  // file are the user's to resolve by reloading; a path or content the project refuses is a 400.
@@ -364,9 +364,6 @@ const AGENT_REASONS = {
  'workspace-rename-failed': 'the business file is changed and the name retired, but the workspace stayed where it was; delete it again to retry the rename',
  // Brief item 8, deviation 11 (sage-1620): the revoke runs before the write, so a retry is safe.
  'credential-revoke-failed': 'a credential couldn\'t be revoked, so the business file is unchanged. Tokens already revoked stay revoked and the instance can\'t use them. Clear what else the agent\'s store directory holds and delete again, which is safe',
-  // Row 239 (#1745): a fire's or a delete's revoke runs under the writer's lock; these follow one that ran.
-  'revision-conflict-revoked': 'the business file changed after the agent\'s tokens were revoked and before the write, so the file is unchanged. The tokens may already be revoked and the instance can\'t use them. Read the role instances again and delete again, which is safe',
-  'outcome-unknown-revoked': 'the agent\'s tokens may already be revoked and the write\'s outcome is unknown. Read the role instances again before trying',
  'capacity-full': 'a launch limit is reached',
  'limit-reached': 'a launch limit is reached',
  'no-route': 'the instance has no harness, model and thinking yet; set its route first',
@@ -220,21 +220,3 @@ test('row 194 N5: agents.js is served as JavaScript and index.html loads it once
  const html = await get(s, '/', { host: 'console.example', 'x-user': 'jason' });
  assert.equal(html.text.match(/<script src="\/agents\.js" defer><\/script>/g)?.length, 1);
 });
-
-// Row 239 (#1745): a fire's or a delete's revoke runs under the writer's lock. A delete closed after
-// that revoke ran says the tokens may already be revoked; a plain revision-conflict keeps its text.
-// duckworth-0165 C1: a direct answer of outcome-unknown-revoked is an open outcome, never "Nothing changed".
-test('row 239 T6: a delete closed -revoked says the tokens may already be revoked, and outcome-unknown-revoked is an open outcome', async t => {
-  let refusal = 'revision-conflict-revoked';
-  const s = await setup(t, { agent: async (verb, args) => { if (verb !== 'instance.request') throw new BusReadError('outcome-unknown-revoked'); return { ...ANSWERS['instance.request'](args), done: { run: null, transaction: null, refusal } }; } });
-  const reason = async () => (await get(s, `/api/agent/request?id=${ID}`)).body.reason;
-  assert.match(await reason(), /business file changed after the agent's tokens were revoked .*\. The tokens may already be revoked .* delete again, which is safe$/);
-  refusal = 'outcome-unknown-revoked';
-  assert.match(await reason(), /tokens may already be revoked and the write's outcome is unknown\. Read the role instances again before trying$/);
-  refusal = 'revision-conflict';
-  assert.match(await reason(), /the business file changed since you read it/);
-  assert.doesNotMatch(await reason(), /may already be revoked/);
-  const unknown = await send(s, '/api/agent/launch', { instance: 'coder' });
-  assert.deepEqual([unknown.status, unknown.body.error, unknown.body.sent], [503, 'outcome-unknown', 'unknown']);
-  assert.doesNotMatch(unknown.body.message, /Nothing changed/);
-});
@@ -0,0 +1,50 @@
+#!/bin/sh
+# Mosaic push guard (row 211, #426). Installed as pre-push in the common
+# .git/hooks by `scripts/install-git-hooks.sh`; never edit the installed copy.
+# For each ref git is about to push, it refuses a delete and any update whose
+# remote tip isn't an ancestor of the local tip: a force-push or a +refspec.
+# A new ref passes. It fetches nothing, so a remote tip that isn't in this
+# repository refuses. Any failure of the check refuses too.
+# `git push --no-verify` skips this hook; Gitea's branch protection is the
+# guard that holds (ops-01). Canon: never force-push.
+refused=0
+refuse() {
+    echo "mosaic push guard: refused: $*" >&2
+    refused=1
+}
+zero() {
+    case "$1" in *[!0]*) return 1 ;; esac
+    return 0
+}
+while read -r lref lsha rref rsha extra || [ -n "${lref:-}" ]; do
+    if [ -z "${rsha:-}" ] || [ -n "${extra:-}" ]; then
+        refuse "unreadable ref line from git: $lref ${lsha:-} ${rref:-} ${rsha:-} ${extra:-}"
+        continue
+    fi
+    case "$lsha$rsha" in
+        *[!0-9a-f]*) refuse "$rref: a ref line with a non-hex object name (local $lsha, remote $rsha)"; continue ;;
+    esac
+    if zero "$lsha"; then
+        refuse "$rref: a delete (remote $rsha); seat branches are never deleted by push"
+        continue
+    fi
+    if zero "$rsha"; then
+        continue
+    fi
+    if ! git cat-file -e "$rsha^{commit}" 2>/dev/null; then
+        refuse "$rref: the remote tip $rsha isn't in this repository; fetch first, then push again"
+        continue
+    fi
+    git merge-base --is-ancestor "$rsha" "$lsha" 2>/dev/null
+    rc=$?
+    case $rc in
+        0) ;;
+        1) refuse "$rref: not a fast-forward; remote $rsha isn't an ancestor of local $lsha (a force-push or a rewritten branch)" ;;
+        *) refuse "$rref: the ancestor check failed (exit $rc) for remote $rsha and local $lsha" ;;
+    esac
+done
+if [ "$refused" != 0 ]; then
+    echo "mosaic push guard: nothing was pushed; a pushed branch only moves forward (canon: never force-push)" >&2
+    exit 1
+fi
+exit 0
@@ -0,0 +1,99 @@
+#!/usr/bin/env bash
+# install-git-hooks.sh: install the push guard (row 211, #426) as pre-push in
+# a repository's common .git/hooks, which every linked worktree shares.
+#
+# Usage:
+#   scripts/install-git-hooks.sh [--repo DIR] [--force-install]
+#
+# DIR defaults to this script's own checkout. The hook's bytes are this
+# checkout's scripts/git-hooks/pre-push. It refuses when core.hooksPath is set
+# (git would not run the hook), and when a different pre-push is installed,
+# unless --force-install is given. It never edits an installed hook in place:
+# a new hook is linked in, a replacement is renamed over the old one. A canary
+# then runs the installed hook through git and needs a delete refused.
+#
+# Exit codes: 0 installed (or already the same bytes); 1 failed; 2 refused;
+# 4 usage. Installing in the canonical checkout is its own step with the lead.
+set -uo pipefail
+
+ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd -P)"
+SRC="$ROOT/scripts/git-hooks/pre-push"
+TMPD=""
+
+say() { printf 'install-git-hooks: %s\n' "$*" >&2; }
+die() { local code=$1; shift; say "$*"; exit "$code"; }
+cleanup() { if [ -n "$TMPD" ]; then rm -rf -- "$TMPD"; fi; }
+trap cleanup EXIT
+
+usage() {
+  sed -n '5,6p' "${BASH_SOURCE[0]}" | sed 's/^# \{0,1\}//' >&2
+  exit 4
+}
+
+REPO=$ROOT
+FORCE=0
+while [ $# -gt 0 ]; do
+  case "$1" in
+    --repo) [ $# -ge 2 ] || usage; REPO=$2; shift 2 ;;
+    --force-install) FORCE=1; shift ;;
+    -h|--help) usage ;;
+    *) say "unknown argument: $1"; usage ;;
+  esac
+done
+
+for v in GIT_DIR GIT_WORK_TREE GIT_COMMON_DIR GIT_INDEX_FILE GIT_OBJECT_DIRECTORY GIT_ALTERNATE_OBJECT_DIRECTORIES; do
+  if [ -n "${!v+x}" ]; then die 2 "refused: $v is set; run with the normal git environment"; fi
+done
+[ -f "$SRC" ] && [ ! -L "$SRC" ] || die 2 "refused: $SRC is missing or not a regular file"
+
+g() { git -C "$REPO" "$@"; }
+top=$(g rev-parse --show-toplevel 2>/dev/null) || die 2 "refused: $REPO is not a git checkout"
+common=$(g rev-parse --path-format=absolute --git-common-dir) || die 1 "cannot read $REPO's git common directory"
+HOOKS="$common/hooks"
+HOOK="$HOOKS/pre-push"
+
+out=$(g config --show-scope --get-all core.hooksPath 2>/dev/null)
+[ -z "$out" ] || die 2 "refused: core.hooksPath is set ($(printf '%s' "$out" | tr '\n\t' '; ')), so git would not run the push guard; unset it first"
+
+if [ -L "$HOOK" ]; then die 2 "refused: $HOOK is a symlink; remove it by hand if it is not wanted"; fi
+mkdir -p "$HOOKS" || die 1 "cannot create $HOOKS"
+tmp="$HOOKS/.pre-push.install-git-hooks.$$"
+if [ -e "$HOOK" ]; then
+  [ -f "$HOOK" ] || die 2 "refused: $HOOK is not a regular file"
+  if cmp -s "$SRC" "$HOOK"; then
+    chmod 0755 "$HOOK" || die 1 "chmod failed"
+    note="the same bytes were already there"
+  else
+    [ "$FORCE" = 1 ] || die 2 "refused: a different pre-push hook is installed at $HOOK; compare it with $SRC, and pass --force-install to replace it"
+    cp -- "$SRC" "$tmp" && chmod 0755 "$tmp" || { rm -f -- "$tmp"; die 1 "cannot write $tmp"; }
+    # rename() swaps the whole file; the old hook's bytes are never edited.
+    mv -f -- "$tmp" "$HOOK" || { rm -f -- "$tmp"; die 1 "cannot replace $HOOK"; }
+    note="replaced a different hook (--force-install)"
+  fi
+else
+  cp -- "$SRC" "$tmp" && chmod 0755 "$tmp" || { rm -f -- "$tmp"; die 1 "cannot write $tmp"; }
+  # link() never replaces, so a hook that appeared meanwhile is kept.
+  if ! ln -- "$tmp" "$HOOK" 2>/dev/null; then rm -f -- "$tmp"; die 2 "refused: a pre-push hook appeared at $HOOK while installing"; fi
+  rm -f -- "$tmp"
+  note="new"
+fi
+
+cmp -s "$SRC" "$HOOK" || die 1 "$HOOK differs from $SRC after install"
+[ -x "$HOOK" ] || die 1 "$HOOK is not executable after install"
+
+# The canary: git runs the hook it would run for a push. A delete line needs
+# no objects; the guard must refuse it, and pass an empty push.
+TMPD=$(mktemp -d "${TMPDIR:-/tmp}/install-git-hooks.XXXXXX") || die 1 "mktemp failed"
+z=0000000000000000000000000000000000000000
+printf '(delete) %s refs/heads/install-canary 1%s\n' "$z" "${z#0}" > "$TMPD/delete"
+: > "$TMPD/empty"
+if ! out=$(cd "$top" && git hook run --to-stdin="$TMPD/empty" pre-push -- canary canary 2>&1); then
+  die 2 "refused: the canary's empty push failed, so git is not running the push guard as installed: $out"
+fi
+out=$(cd "$top" && git hook run --to-stdin="$TMPD/delete" pre-push -- canary canary 2>&1); rc=$?
+[ "$rc" -ne 0 ] && [[ "$out" == *"mosaic push guard: refused"* ]] \
+  || die 2 "refused: the canary's delete was not refused by the push guard (exit $rc)"
+
+printf 'ok installed the push guard at %s (%s, sha256 %s, mode 0755); canary passed\n' \
+  "$HOOK" "$note" "$(sha256sum < "$HOOK" | cut -d' ' -f1)"
+exit 0
@@ -0,0 +1,77 @@
+#!/usr/bin/env bash
+# slot-busy.sh: the shared busy check (row 211, #426). Is a gate or a test run
+# going on this host?
+#
+# Usage:
+#   scripts/slot-busy.sh [--proc-root DIR]
+#
+# It prints one BUSY line per matching process, or one CLEAR line. Exit codes:
+# 0 CLEAR, 1 BUSY, 2 its own error. Chain it on the exit code, never on a
+# filter of its output:
+#   bash scripts/slot-busy.sh > LOG && gate          (set -o pipefail if piped)
+# never `bash scripts/slot-busy.sh | tail -1 && gate`, which runs while BUSY.
+#
+# A process matches when its command line holds `node ... --test`, a
+# `*gate*.sh`, `mutant`, a `test-*.sh` or `docker compose`/`docker-compose`.
+# It skips itself and its ancestors (a gate script may run the check), and an
+# agent harness's shell-snapshot wrapper, whose command line is the agent's
+# command text; that shell's real children are still matched. It reads only
+# /proc/<pid>/cmdline and the cwd link, never a file under a seat's directory.
+# --proc-root names a stand-in for /proc in the selftests.
+set -uo pipefail
+
+PROC=/proc
+while [ $# -gt 0 ]; do
+  case "$1" in
+    --proc-root) [ $# -ge 2 ] || { echo "slot-busy: error: --proc-root needs a directory" >&2; exit 2; }; PROC=$2; shift 2 ;;
+    -h|--help) sed -n '5,6p' "${BASH_SOURCE[0]}" | sed 's/^# \{0,1\}//' >&2; exit 2 ;;
+    *) echo "slot-busy: error: unknown argument: $1" >&2; exit 2 ;;
+  esac
+done
+[ -d "$PROC" ] || { echo "slot-busy: error: $PROC is not a directory" >&2; exit 2; }
+
+# This process and its ancestors, from the real /proc.
+declare -A SKIP=()
+p=$$
+while [ -n "$p" ] && [ "$p" != 0 ]; do
+  SKIP[$p]=1
+  p=$(awk '/^PPid:/{print $2; exit}' "/proc/$p/status" 2>/dev/null) || p=""
+done
+[ "${#SKIP[@]}" -ge 1 ] && [ -n "${SKIP[$$]:-}" ] || { echo "slot-busy: error: cannot read its own process" >&2; exit 2; }
+
+RE_NODE='[ /]node[^ ]* (.* )?--test '
+RE_GATE='[ /_-]gate[^ /]*\.sh '
+RE_TEST='[ /]test-[^ /]*\.sh '
+RE_COMPOSE='[ /]docker( compose|-compose) '
+match() { # $1: the command line, NULs as spaces. Prints the rule that matched.
+  local c=" $1 "
+  if [[ "$c" == *"/shell-snapshots/snapshot-"* ]]; then return 1; fi
+  if [[ "$c" =~ $RE_NODE ]]; then echo "node --test"; return 0; fi
+  if [[ "$c" =~ $RE_GATE ]]; then echo "gate"; return 0; fi
+  if [[ "$c" == *mutant* ]]; then echo "mutant"; return 0; fi
+  if [[ "$c" =~ $RE_TEST ]]; then echo "test script"; return 0; fi
+  if [[ "$c" =~ $RE_COMPOSE ]]; then echo "docker compose"; return 0; fi
+  return 1
+}
+
+seen=0
+busy=0
+for d in "$PROC"/[0-9]*; do
+  [ -d "$d" ] || continue
+  pid=${d##*/}
+  [[ "$pid" =~ ^[0-9]+$ ]] || continue
+  seen=$((seen + 1))
+  [ -z "${SKIP[$pid]:-}" ] || continue
+  # A process can exit between the listing and the read; that's not an error.
+  cmd=$(tr '\0' ' ' < "$d/cmdline" 2>/dev/null) || continue
+  cmd=${cmd% }
+  [ -n "$cmd" ] || continue
+  rule=$(match "$cmd") || continue
+  cwd=$(readlink "$d/cwd" 2>/dev/null) || cwd="?"
+  printf 'BUSY %s %s cwd=%s %s\n' "$pid" "$rule" "$cwd" "${cmd:0:200}"
+  busy=1
+done
+[ "$seen" -ge 1 ] || { echo "slot-busy: error: no processes under $PROC" >&2; exit 2; }
+if [ "$busy" = 1 ]; then exit 1; fi
+echo "CLEAR"
+exit 0
@@ -0,0 +1,257 @@
+#!/usr/bin/env bash
+# Sandboxed selftests for the push guard, its installer and the busy check
+# (row 211, #426): scripts/git-hooks/pre-push, scripts/install-git-hooks.sh
+# and scripts/slot-busy.sh.
+#
+# Pushes go from a scratch clone and its worktree to a scratch bare remote,
+# never to origin. Git sees no user or system config. The busy check runs
+# against a fake /proc (pids above pid_max) for the exit codes and rules, and
+# against the real /proc with a sleeping stand-in whose argv is `node --test`.
+set -uo pipefail
+cd "$(dirname "$0")/.."
+REPO="$(pwd)"
+unset GIT_DIR GIT_WORK_TREE GIT_COMMON_DIR GIT_INDEX_FILE GIT_OBJECT_DIRECTORY GIT_ALTERNATE_OBJECT_DIRECTORIES
+
+SANDBOX="$(cd "$(mktemp -d)" && pwd -P)"
+STANDIN=""
+cleanup() {
+    if [ -n "$STANDIN" ]; then kill "$STANDIN" 2>/dev/null; wait "$STANDIN" 2>/dev/null; fi
+    rm -rf "$SANDBOX"
+}
+trap cleanup EXIT
+
+PASS=0
+FAIL=0
+# Status colors: terminal-only, NO_COLOR-respecting; plain when piped.
+if [ -t 1 ] && [ -z "${NO_COLOR:-}" ]; then
+    C_OK=$'\033[0;32m'; C_FAIL=$'\033[0;31m'; C_RESET=$'\033[0m'
+else
+    C_OK=""; C_FAIL=""; C_RESET=""
+fi
+check() {
+    if [ "$2" = "0" ]; then PASS=$((PASS+1)); echo "${C_OK}OK${C_RESET}    $1"; else FAIL=$((FAIL+1)); echo "${C_FAIL}FAIL${C_RESET} $1"; fi
+}
+has() { [[ "$1" == *"$2"* ]]; }
+
+# Git sees no user or system config: no hooks path, no signing, a fixed identity.
+: > "$SANDBOX/gitconfig"
+export GIT_CONFIG_NOSYSTEM=1 GIT_CONFIG_GLOBAL="$SANDBOX/gitconfig"
+export GIT_AUTHOR_NAME=suite GIT_AUTHOR_EMAIL=suite@local GIT_COMMITTER_NAME=suite GIT_COMMITTER_EMAIL=suite@local
+
+HOOK_SRC="$REPO/scripts/git-hooks/pre-push"
+INSTALL="$REPO/scripts/install-git-hooks.sh"
+BUSY="$REPO/scripts/slot-busy.sh"
+
+B="$SANDBOX/remote.git"
+C="$SANDBOX/clone"
+W="$SANDBOX/wt"
+O="$SANDBOX/other"
+commit() { # $1: repo, $2: file and message
+    echo "$2" > "$1/$2" && git -C "$1" add "$2" && git -C "$1" commit -q -m "$2"
+}
+rtip() { git -C "$B" rev-parse -q --verify "refs/heads/$1"; }
+
+# ---- the remote, a clone with the guard, a worktree ----
+git init -q --bare -b main "$B"
+git init -q -b main "$SANDBOX/seed"
+commit "$SANDBOX/seed" base
+git -C "$SANDBOX/seed" push -q "$B" main
+git clone -q "$B" "$C"
+
+echo "== install =="
+out=$(bash "$INSTALL" --repo "$C" 2>&1); rc=$?
+check "the install into a clean clone exits 0" "$rc"
+check "it reports the install and a passed canary" "$(has "$out" "ok installed the push guard" && has "$out" "canary passed"; echo $?)"
+check "the hook is in the common .git/hooks, with the repository's bytes, executable" \
+    "$(cmp -s "$HOOK_SRC" "$C/.git/hooks/pre-push" && [ -x "$C/.git/hooks/pre-push" ]; echo $?)"
+check "no temporary file is left in .git/hooks" \
+    "$(ls -A "$C/.git/hooks" | grep -q '^\.pre-push\.install'; [ $? = 1 ]; echo $?)"
+git -C "$C" worktree add -q -b seat/w "$W" origin/main
+check "the worktree's git runs the common hook" \
+    "$([ "$(git -C "$W" rev-parse --path-format=absolute --git-path hooks/pre-push)" = "$C/.git/hooks/pre-push" ]; echo $?)"
+
+echo "== pushes from the worktree =="
+commit "$W" one
+out=$(git -C "$W" push origin seat/w 2>&1); rc=$?
+check "a new branch passes" "$rc"
+check "the remote branch is at the pushed commit" "$([ "$(rtip seat/w)" = "$(git -C "$W" rev-parse HEAD)" ]; echo $?)"
+
+commit "$W" two
+out=$(git -C "$W" push origin seat/w 2>&1); rc=$?
+check "a fast-forward passes" "$rc"
+check "the remote branch moved forward" "$([ "$(rtip seat/w)" = "$(git -C "$W" rev-parse HEAD)" ]; echo $?)"
+
+before=$(rtip seat/w)
+git -C "$W" reset -q --hard HEAD~1
+commit "$W" two-rewritten
+after=$(git -C "$W" rev-parse HEAD)
+out=$(git -C "$W" push --force origin seat/w 2>&1); rc=$?
+check "push --force of a rewritten branch is refused" "$([ "$rc" -ne 0 ]; echo $?)"
+check "the refusal is the guard's, and names the ref and both shas" \
+    "$(has "$out" "mosaic push guard: refused: refs/heads/seat/w: not a fast-forward" && has "$out" "$before" && has "$out" "$after"; echo $?)"
+check "the remote ref is unchanged after the refused --force" "$([ "$(rtip seat/w)" = "$before" ]; echo $?)"
+
+out=$(git -C "$W" push origin +seat/w:seat/w 2>&1); rc=$?
+check "a +refspec push is refused" "$([ "$rc" -ne 0 ] && has "$out" "not a fast-forward"; echo $?)"
+check "the remote ref is unchanged after the refused +refspec" "$([ "$(rtip seat/w)" = "$before" ]; echo $?)"
+
+out=$(git -C "$W" push --force-with-lease origin seat/w 2>&1); rc=$?
+check "push --force-with-lease is refused too" "$([ "$rc" -ne 0 ] && has "$out" "not a fast-forward"; echo $?)"
+
+out=$(git -C "$W" push origin :seat/w 2>&1); rc=$?
+check "a delete (:ref) is refused" "$([ "$rc" -ne 0 ] && has "$out" "mosaic push guard: refused: refs/heads/seat/w: a delete"; echo $?)"
+out=$(git -C "$W" push --delete origin seat/w 2>&1); rc=$?
+check "a delete (--delete) is refused" "$([ "$rc" -ne 0 ] && has "$out" "a delete"; echo $?)"
+check "the remote branch still exists after the refused deletes" "$([ "$(rtip seat/w)" = "$before" ]; echo $?)"
+
+# Another clone moves the remote; this clone never fetches it.
+git clone -q -b seat/w "$B" "$O"
+commit "$O" from-other
+git -C "$O" push -q origin seat/w
+moved=$(rtip seat/w)
+check "the other clone moved the remote, and this clone lacks that commit" \
+    "$([ "$moved" != "$before" ] && ! git -C "$C" cat-file -e "$moved^{commit}" 2>/dev/null; echo $?)"
+out=$(git -C "$W" push --force origin seat/w 2>&1); rc=$?
+check "a push over a remote tip missing locally is refused, saying fetch first" \
+    "$([ "$rc" -ne 0 ] && has "$out" "isn't in this repository; fetch first"; echo $?)"
+check "the remote ref is unchanged after that refusal" "$([ "$(rtip seat/w)" = "$moved" ]; echo $?)"
+check "the guard fetched nothing" "$(! git -C "$C" cat-file -e "$moved^{commit}" 2>/dev/null; echo $?)"
+
+echo "== the hook, fed by hand =="
+z=0000000000000000000000000000000000000000
+hookrun() { (cd "$C" && printf '%s\n' "$1" | sh "$C/.git/hooks/pre-push" origin "$B" 2>&1); }
+out=$(hookrun "refs/heads/x $(git -C "$C" rev-parse HEAD) refs/heads/x"); rc=$?
+check "a short ref line is refused" "$([ "$rc" -ne 0 ] && has "$out" "unreadable ref line"; echo $?)"
+out=$(hookrun "refs/heads/x HEAD refs/heads/x $z"); rc=$?
+check "a non-hex object name is refused" "$([ "$rc" -ne 0 ] && has "$out" "non-hex"; echo $?)"
+out=$(hookrun "refs/heads/x 1234567890123456789012345678901234567890 refs/heads/x $(git -C "$C" rev-parse HEAD)"); rc=$?
+check "a failed ancestor check (an unknown local object) is refused" \
+    "$([ "$rc" -ne 0 ] && has "$out" "the ancestor check failed"; echo $?)"
+out=$(printf '' | (cd "$C" && sh "$C/.git/hooks/pre-push" origin "$B" 2>&1)); rc=$?
+check "an empty push passes" "$rc"
+
+echo "== installer refusals =="
+fresh() { rm -rf "$1"; git clone -q "$B" "$1"; }
+fresh "$SANDBOX/hp"
+git -C "$SANDBOX/hp" config core.hooksPath .husky
+out=$(bash "$INSTALL" --repo "$SANDBOX/hp" 2>&1); rc=$?
+check "the install refuses with core.hooksPath set (exit 2)" "$([ "$rc" = 2 ]; echo $?)"
+check "it says core.hooksPath is set" "$(has "$out" "core.hooksPath is set"; echo $?)"
+check "no hook was written under the hooksPath refusal" \
+    "$([ ! -e "$SANDBOX/hp/.git/hooks/pre-push" ] && [ ! -e "$SANDBOX/hp/.husky/pre-push" ]; echo $?)"
+
+fresh "$SANDBOX/df"
+printf '#!/bin/sh\nexit 0\n' > "$SANDBOX/df/.git/hooks/pre-push"
+chmod 0755 "$SANDBOX/df/.git/hooks/pre-push"
+ln "$SANDBOX/df/.git/hooks/pre-push" "$SANDBOX/df-old"
+out=$(bash "$INSTALL" --repo "$SANDBOX/df" 2>&1); rc=$?
+check "the install refuses a different installed pre-push (exit 2)" \
+    "$([ "$rc" = 2 ] && has "$out" "a different pre-push hook is installed"; echo $?)"
+check "the different hook is untouched" \
+    "$([ "$(cat "$SANDBOX/df/.git/hooks/pre-push")" = "$(printf '#!/bin/sh\nexit 0')" ]; echo $?)"
+out=$(bash "$INSTALL" --repo "$SANDBOX/df" --force-install 2>&1); rc=$?
+check "--force-install replaces it" \
+    "$([ "$rc" = 0 ] && has "$out" "replaced a different hook" && cmp -s "$HOOK_SRC" "$SANDBOX/df/.git/hooks/pre-push"; echo $?)"
+check "the replacement was a rename: the old file keeps its bytes" \
+    "$([ "$(cat "$SANDBOX/df-old")" = "$(printf '#!/bin/sh\nexit 0')" ]; echo $?)"
+out=$(bash "$INSTALL" --repo "$SANDBOX/df" 2>&1); rc=$?
+check "a second install over the same bytes exits 0" "$([ "$rc" = 0 ] && has "$out" "the same bytes"; echo $?)"
+
+fresh "$SANDBOX/ln"
+ln -s /dev/null "$SANDBOX/ln/.git/hooks/pre-push"
+out=$(bash "$INSTALL" --repo "$SANDBOX/ln" --force-install 2>&1); rc=$?
+check "the install refuses a symlinked pre-push, even with --force-install" "$([ "$rc" = 2 ] && has "$out" "is a symlink"; echo $?)"
+
+fresh "$SANDBOX/wd"
+git -C "$SANDBOX/wd" worktree add -q -b seat/x "$SANDBOX/wd-wt" origin/main
+out=$(bash "$INSTALL" --repo "$SANDBOX/wd-wt" 2>&1); rc=$?
+check "an install named by a worktree path lands in the common .git/hooks" \
+    "$([ "$rc" = 0 ] && cmp -s "$HOOK_SRC" "$SANDBOX/wd/.git/hooks/pre-push"; echo $?)"
+
+out=$(GIT_DIR="$SANDBOX/wd/.git" bash "$INSTALL" --repo "$SANDBOX/wd" 2>&1); rc=$?
+check "the install refuses with GIT_DIR set" "$([ "$rc" = 2 ] && has "$out" "GIT_DIR is set"; echo $?)"
+mkdir -p "$SANDBOX/plain"
+out=$(bash "$INSTALL" --repo "$SANDBOX/plain" 2>&1); rc=$?
+check "the install refuses a directory that isn't a checkout" "$([ "$rc" = 2 ]; echo $?)"
+out=$(bash "$INSTALL" --nope 2>&1); rc=$?
+check "an unknown argument exits 4" "$([ "$rc" = 4 ]; echo $?)"
+
+echo "== slot-busy, fake /proc =="
+P="$SANDBOX/proc"
+fakeproc() { # $1: pid, $2: cwd, rest: argv
+    local pid=$1 cwd=$2; shift 2
+    mkdir -p "$P/$pid"
+    printf '%s\0' "$@" > "$P/$pid/cmdline"
+    ln -sfn "$cwd" "$P/$pid/cwd"
+}
+busyrun() { bash "$BUSY" --proc-root "$P" 2>&1; }
+fakeproc 4194401 /srv node server.mjs
+fakeproc 4194402 /srv grep -r gate .
+fakeproc 4194403 /srv /bin/bash -c "source /home/u/.claude/shell-snapshots/snapshot-bash-1.sh && eval 'node --test x.test.mjs'"
+mkdir -p "$P/4194404"; : > "$P/4194404/cmdline"
+out=$(busyrun); rc=$?
+check "no matching process: exit 0 and CLEAR" "$([ "$rc" = 0 ] && [ "$out" = CLEAR ]; echo $?)"
+check "an agent's shell-snapshot wrapper isn't a match" "$(! has "$out" "4194403"; echo $?)"
+
+fakeproc 4194410 /seat/a node --test packages/x/tests/a.test.mjs
+out=$(busyrun); rc=$?
+check "a node --test process: exit 1" "$([ "$rc" = 1 ]; echo $?)"
+check "its BUSY line names pid, rule and cwd" "$(has "$out" "BUSY 4194410 node --test cwd=/seat/a node --test"; echo $?)"
+check "BUSY output never says CLEAR" "$(! has "$out" "CLEAR"; echo $?)"
+ran=$(bash "$BUSY" --proc-root "$P" >/dev/null && echo ran)
+check "\`slot-busy > LOG && step\` doesn't run the step while BUSY" "$([ -z "$ran" ]; echo $?)"
+rm -rf "${P:?}/4194410"
+
+rule() { # $1: expected rule, rest: argv
+    local want=$1; shift
+    rm -rf "${P:?}/4194420"; fakeproc 4194420 /seat/b "$@"
+    out=$(busyrun); rc=$?
+    check "busy on: $* ($want)" "$([ "$rc" = 1 ] && has "$out" "BUSY 4194420 $want "; echo $?)"
+}
+rule "node --test" /usr/bin/node --experimental-strip-types --test a.test.ts
+rule "gate" bash /mnt/scratch/sage-gate.sh 253
+rule "gate" bash ./gate.sh
+rule "mutant" bash agents/x/work/queue-1/mutants.sh M3
+rule "test script" bash scripts/test-land-work.sh
+rule "docker compose" docker compose -p x up -d
+rule "docker compose" /usr/bin/docker-compose up
+rm -rf "${P:?}/4194420"
+
+out=$(bash "$BUSY" --proc-root "$SANDBOX/no-such-proc" 2>&1); rc=$?
+check "a missing proc root: exit 2" "$([ "$rc" = 2 ]; echo $?)"
+mkdir -p "$SANDBOX/empty-proc"
+out=$(bash "$BUSY" --proc-root "$SANDBOX/empty-proc" 2>&1); rc=$?
+check "a proc root with no processes: exit 2" "$([ "$rc" = 2 ]; echo $?)"
+out=$(bash "$BUSY" --nope 2>&1); rc=$?
+check "an unknown argument: exit 2" "$([ "$rc" = 2 ]; echo $?)"
+
+echo "== slot-busy, real /proc =="
+mkdir -p "$SANDBOX/bin" "$SANDBOX/standin"
+cat > "$SANDBOX/bin/node" <<'EOF'
+#!/bin/sh
+trap 'exit 0' TERM
+while :; do sleep 0.2; done
+EOF
+chmod +x "$SANDBOX/bin/node"
+(cd "$SANDBOX/standin" && exec "$SANDBOX/bin/node" --test standin.test.mjs) &
+STANDIN=$!
+for _ in $(seq 50); do
+    has "$(tr '\0' ' ' < "/proc/$STANDIN/cmdline" 2>/dev/null)" "--test standin" && break
+    sleep 0.1
+done
+out=$(bash "$BUSY" 2>&1); rc=$?
+check "with a stand-in node --test running: exit 1" "$([ "$rc" = 1 ]; echo $?)"
+check "the stand-in has a BUSY line with its cwd" \
+    "$(printf '%s\n' "$out" | grep -q "^BUSY $STANDIN node --test cwd=$SANDBOX/standin "; echo $?)"
+check "this suite, an ancestor, has no BUSY line" "$(! printf '%s\n' "$out" | grep -q "^BUSY $$ "; echo $?)"
+ran=$(bash "$BUSY" >/dev/null && echo ran)
+check "\`slot-busy > LOG && step\` doesn't run the step with the stand-in up" "$([ -z "$ran" ]; echo $?)"
+kill "$STANDIN" 2>/dev/null; wait "$STANDIN" 2>/dev/null
+gone=$STANDIN; STANDIN=""
+out=$(bash "$BUSY" 2>&1); rc=$?
+check "after the stand-in exits, it has no BUSY line" "$(! printf '%s\n' "$out" | grep -q "^BUSY $gone "; echo $?)"
+check "the real-/proc run exits 0 or 1, never 2" "$([ "$rc" = 0 ] || [ "$rc" = 1 ]; echo $?)"
+
+echo "---"
+echo "git-guard selftests: $PASS passed, $FAIL failed"
+[ "$FAIL" -eq 0 ]